Data Processing Agreement

1. Subject matter and duration

The Processor processes personal data on behalf of the Controller to provide the FLUXO service: receiving the Controller's orders, preparing and shipping them through the logistics provider chosen by the Controller, tracking deliveries, contacting customers about delivery when enabled, sending the Controller's WhatsApp marketing messages to customers who have consented, when enabled, and reconciling cash-on-delivery payments.

The DPA lasts as long as the Processor processes personal data for the Controller, and ends when the data has been deleted or returned under section 9.

2. Data and data subjects

• Data subjects: the Controller's customers and recipients of its orders.
• Categories of data: name, shipping address, phone number, email address, order contents and amounts, payment method, delivery and tracking data, messages and call transcripts about the delivery, marketing consent and opt-out records (only when those features are enabled).
• No special categories of data (such as health data) are processed.

3. Instructions

The Processor processes the data only on the documented instructions of the Controller, which are given by the configuration of the Controller's store and FLUXO portal and by this DPA, including when the logistics provider chosen by the Controller operates the portal on its behalf. The Controller is responsible for having a valid legal basis for each use it enables, including the customers' consent for marketing; the Processor sends marketing messages only to customers recorded as having consented and applies opt-outs immediately. The Processor informs the Controller if it believes an instruction infringes data protection law.

4. Confidentiality

Everyone authorised to access the data is bound by confidentiality and accesses only what is needed for the service.

5. Security

The Processor applies the technical and organisational measures described in the Annex, and keeps them up to date.

6. Sub-processors

The Controller gives a general authorisation to use the sub-processors listed in the FLUXO Privacy Policy (/privacy). The Processor informs the Controller at least 15 days before adding or replacing a sub-processor, so the Controller can object. Each sub-processor is bound by data protection obligations equivalent to this DPA, and the Processor remains responsible for it.

7. Assistance

The Processor helps the Controller respond to data subjects' requests (access, rectification, erasure, restriction, portability, objection). Shopify's GDPR requests (customers/data_request, customers/redact, shop/redact) are handled automatically. The Processor also assists, where necessary, with security, data protection impact assessments and consultations with authorities.

8. Personal data breaches

The Processor notifies the Controller without undue delay, and in any case within 48 hours of becoming aware of it, of any personal data breach affecting the Controller's data, with the information available on its nature, the data and people concerned, the likely consequences and the measures taken. The Processor also informs Shopify where required by Shopify's terms.

9. Deletion and return

When the app is uninstalled or the service ends, the Processor deletes the Controller's personal data (Shopify shop/redact request, carried out within 48 hours of receipt), except where the law requires it to be kept. Before that, the Controller can export its orders from the FLUXO portal. During the service, personal data is deleted according to the retention periods in the Privacy Policy.

10. Audits and information

The Processor makes available to the Controller the information needed to demonstrate compliance with this DPA and answers its questions in writing. Audits can be agreed in advance, with reasonable notice and at the Controller's expense.

11. International transfers

Data is stored in the European Union. Any transfer outside the EU by a sub-processor relies on the European Commission's Standard Contractual Clauses or on an adequacy decision.

Annex — Technical and organisational measures

• Encryption in transit (HTTPS/TLS) on every connection and encryption at rest (AES-256), including daily backups.
• Additional encryption (AES-256-GCM) of Shopify tokens and carrier credentials, with the key kept outside the database.
• Separation of each logistics provider's and each store's data, enforced in the database (row-level security) and in every server action.
• Least-privilege access for staff, individual accounts, strong passwords, access logs; credentials rotated when a person with access leaves.
• Verification of Shopify's HMAC signature on installation and on every webhook; tests on test stores with test data only.
• Data-loss prevention: daily encrypted backups with point-in-time recovery by the database provider, database rules that reject invalid data, no bulk exports of customer data outside the portal.
• Written security incident response procedure (detection, containment, assessment, notification within the deadlines above, review).
• Automatic deletion of personal data according to the retention periods in the Privacy Policy.