Data processing addendum

Last updated: November 3, 2026 · Effective: [EFFECTIVE DATE]

This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Terms") between [LEGAL ENTITY NAME] ("Playbuy" or "Processor") and the merchant that has installed the Playbuy app ("Merchant" or "Controller"). It applies automatically when the Merchant accepts the Terms and applies whenever Playbuy processes Merchant Personal Data. Words not defined here have the meaning given in the Terms or in Data Protection Law.

1. Definitions

• Data Protection Law means all data protection laws that apply to the processing, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of UK law and the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act as amended by the CPRA ("CCPA").
• Merchant Personal Data means personal data that Playbuy processes on the Merchant's behalf to provide the Service, as described in Annex 1.
• Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Merchant Personal Data.
• Subprocessor means a third party that Playbuy engages to process Merchant Personal Data.
• SCCs means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914; the UK Addendum means the International Data Transfer Addendum issued by the UK Information Commissioner.

2. Roles and instructions

• For Merchant Personal Data, the Merchant is the controller (or a processor acting for its own controller) and Playbuy is a processor (or subprocessor). Playbuy is a separate controller for merchant account data, as described in its Privacy Policy; this DPA does not apply to that data.
• Playbuy will process Merchant Personal Data only on the Merchant's documented instructions. The Terms, this DPA and the Merchant's configuration and use of the Service are the Merchant's complete instructions. Other instructions require written agreement.
• Playbuy will tell the Merchant if, in its opinion, an instruction breaks Data Protection Law, and may stop the affected processing until the instruction is changed.
• If the law requires Playbuy to process Merchant Personal Data other than on instructions, it will tell the Merchant first, unless the law forbids that.

3. Merchant obligations

• The Merchant is responsible for having a lawful basis for the processing, for giving shoppers a privacy notice that covers the Service, and for collecting any consent required, for example through Shopify's cookie banner and Customer Privacy API.
• The Merchant will not use the Service to send Playbuy special category data, data about criminal convictions, or end-customer contact or payment details, for example in video captions.

4. Processor obligations

• Confidentiality. Playbuy will make sure that anyone it authorizes to process Merchant Personal Data is bound by a duty of confidentiality.
• Security. Playbuy will implement and maintain the technical and organizational measures in Annex 2. It may update them, provided the overall level of protection is not reduced.
• Data subject requests. Taking into account the nature of the processing, Playbuy will help the Merchant respond to requests from data subjects, including by supporting Shopify's customers/data_request and customers/redact webhooks. If Playbuy receives a request directly, it will refer the person to the Merchant and will not respond itself, except to confirm the referral.
• Assistance. Playbuy will give the Merchant reasonable information and help with data protection impact assessments, prior consultations with supervisory authorities, and security obligations, as they relate to the Service.
• Records. Playbuy will keep records of its processing as required by Article 30(2) GDPR.

5. Security incidents

• Playbuy will notify the Merchant without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Merchant Personal Data.
• The notice will go to the Merchant's store contact email, and will describe, as far as then known, the nature of the incident, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. Playbuy will provide more information as it becomes available.
• Playbuy will take reasonable steps to contain and investigate the incident and reduce its effects. Notice of an incident is not an admission of fault.

6. Subprocessors

• The Merchant gives general authorization for Playbuy to engage Subprocessors. The current Subprocessors are listed on the subprocessors page and are: Railway, Cloudflare, Resend, Shopify.
• Playbuy will impose data protection terms on each Subprocessor that protect Merchant Personal Data at least as well as this DPA, and remains responsible for each Subprocessor's performance.
• Playbuy will give at least 30 days' notice before a new Subprocessor starts processing Merchant Personal Data, by updating the subprocessors page and emailing the Merchant's store contact address.
• The Merchant may object on reasonable data protection grounds by emailing [CONTACT EMAIL] within that notice period. The parties will discuss the objection in good faith. If Playbuy cannot reasonably address it, the Merchant may end the Service by uninstalling the app, and Playbuy will refund, through Shopify, any prepaid fees for the period after the end date.

7. International transfers

• Playbuy and its Subprocessors process Merchant Personal Data mainly in the United States. Playbuy will only transfer Merchant Personal Data outside the EEA, UK or Switzerland in line with Data Protection Law.
• To the extent a transfer from the EEA to a country without an adequacy decision is not covered by another valid mechanism (such as the EU-US Data Privacy Framework), the SCCs are incorporated into this DPA by reference: Module 2 (controller to processor) where the Merchant is a controller, and Module 3 (processor to processor) where the Merchant is a processor. The Merchant is the data exporter and Playbuy the data importer. For the SCCs: the optional docking clause in Clause 7 applies; Option 2 (general authorization, with the notice period in section 6) applies to Clause 9; the optional wording in Clause 11 does not apply; Clauses 17 and 18 select the law and courts of [EU MEMBER STATE FOR SCCs]; and Annexes I and II are completed by Annexes 1 and 2 of this DPA.
• For transfers from the UK, the UK Addendum applies, completed with the information in this DPA, and either party may end it as allowed by its Section 19. For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection and the competent authority being the Swiss Federal Data Protection and Information Commissioner.
• If the SCCs conflict with this DPA, the SCCs prevail.

8. Audits

On written request, Playbuy will make available the information reasonably needed to show compliance with this DPA, such as completed security questionnaires and a summary of its security controls. If that information is not enough to meet a requirement of Data Protection Law, the Merchant may, at its own cost and no more than once a year (or after a Security Incident or a regulator's request), carry out an audit with at least 30 days' notice, during business hours, under a confidentiality agreement, and in a way that does not disrupt the Service or expose other merchants' data.

9. Deletion and return

• While the Service is in use, the Merchant can export its video list, product tags and analytics as CSV files from the dashboard.
• When the app is uninstalled, Playbuy deletes the store's Shopify access tokens and stops serving its widgets straight away. It deletes all remaining Merchant Personal Data when it receives Shopify's shop/redact webhook, which Shopify sends about 48 hours after uninstall, except where the law requires it to keep data.
• Copies in database backups are deleted when those backups are overwritten, within [BACKUP RETENTION PERIOD]. Until then they are protected under this DPA and not actively used.

10. US state privacy laws

Where the CCPA or a similar US law applies, Playbuy acts as a service provider or processor. It will not sell or share Merchant Personal Data; retain, use or disclose it for any purpose other than providing the Service, or outside the direct business relationship with the Merchant; or combine it with personal information from other sources, except as the law allows. It will comply with the CCPA, give the same level of privacy protection the CCPA requires, and tell the Merchant if it can no longer meet these obligations. The Merchant may take reasonable steps to stop and remediate unauthorized use.Playbuy certifies that it understands these restrictions.

11. Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Law or the SCCs do not allow this. If this DPA conflicts with the Terms, this DPA prevails for the processing of Merchant Personal Data. This DPA ends when Playbuy has deleted all Merchant Personal Data. For a countersigned copy, email [CONTACT EMAIL] from your store's contact address.

Annex 1: Details of processing

Annex 2: Technical and organizational security measures

Encryption

• All traffic to the dashboard, event collection and file delivery uses HTTPS (TLS), with HSTS on our web domains.
• Shopify access and refresh tokens, and connected social account tokens, are encrypted at rest with AES-256-GCM. Shopify access tokens expire and are refreshed regularly.
• Dashboard session tokens and sign-in link tokens are stored only as one-way hashes.

Access control and tenant isolation

• Every database query for merchant data is scoped to a single store, so one merchant cannot reach another's data.
• Dashboard users have roles (owner, admin, editor). Sensitive actions, such as connecting accounts or exporting data, require higher roles. Removing a team member also ends their sessions.
• Staff are never linked to an account by an unverified email address.
• Sessions use secure, HTTP-only cookies with idle (7 days) and absolute (30 days) expiry. Sign-in links are single use and short lived.
• Database and queue services are reachable only on the hosting provider's private network. Production access is limited to authorized personnel.

Request integrity and abuse prevention

• Shopify OAuth requests and webhooks are verified with HMAC signatures; requests that fail verification are rejected.
• The event collection endpoint accepts events only for installed stores with published widgets, checks the request origin against the store's domains, filters known bots, and applies rate limits per IP hash and per store.
• Event processing is idempotent, so retries do not double-count data.
• The dashboard sends a strict Content Security Policy and other security headers. Storefront widgets display merchant content as text inside an isolated Shadow DOM and do not run custom scripts.

Data minimization and retention

• The web pixel reads only order ID, totals, currency and line-item product data; it never reads customer names or contact details.
• Visitor identifiers are created only with analytics consent reported by Shopify's Customer Privacy API.
• IP addresses are hashed on receipt and not stored. Raw events are deleted after 30 days by a nightly job. Expired sessions and sign-in links are deleted nightly.
• Application logs automatically redact tokens, cookies, signatures, email addresses and customer fields.

Availability and resilience

• The database is backed up by the hosting provider on a [BACKUP SCHEDULE] schedule.
• Background jobs retry failures and set aside entries that keep failing, so one bad request cannot stop processing for other stores.

Secure development and vulnerability management

• Every change runs automated type checks, tests and a dependency vulnerability audit before release, and the codebase has had independent security reviews.
• We run a responsible disclosure programme at security@playbuy.app, described on our security page and in our security.txt.

Subprocessors

• Subprocessors are chosen for their security practices and bound by written data protection terms, as described in section 6.