This addendum applies automatically to merchants who use the CheckoutLeak Shopify app.
1. Scope and parties
This Data Processing Addendum (“DPA”) is between you, the merchant who installs the CheckoutLeak Shopify app (“you”, the controller), and CheckoutLeak (“we”, “us”, the processor). It forms part of our terms of service and is incorporated into them by reference when you install the app.
It applies to personal data we process on your behalf to provide the app (“store personal data”), where the EU General Data Protection Regulation (GDPR), the UK GDPR or similar data protection laws apply. Personal data we handle as a controller, such as waitlist sign-ups and support emails, is covered by our privacy policy instead. If this DPA and the terms conflict on the processing of store personal data, this DPA applies.
2. Details of the processing
- Subject matter: providing the CheckoutLeak app: scans, findings and recommendations, fixes you approve, Autopilot rules you enable, alerts, the weekly summary, and the optional storefront insights and AI suggestions.
- Duration: while the app is installed on your store, and afterwards until deletion as described in section 3.6.
- Nature and purpose: reading data from your store through the Shopify API and, if you turn it on, the storefront pixel; reducing it to aggregates; storing and analysing it; applying changes you approve; sending the emails and alerts you choose; and, if you use them, generating AI suggestions. We process store personal data only to provide, secure and support the app.
- Categories of data:
- product and catalog data (titles, descriptions, images, prices, costs and settings);
- discount configuration (codes, titles, values and rules);
- aggregated order data: daily totals per discount code, with no individual orders and no customer fields;
- anonymous storefront events, stored as daily counters (a rejected discount code is kept only as a keyed hash);
- your store owner’s email address, read from Shopify to send summaries and alerts, and not stored;
- settings you give us, such as alert preferences and an optional Slack webhook URL, and an audit trail of installs, plan changes and fixes.
- Data subjects: your store owner and staff; your store’s visitors and shoppers, only in anonymous, aggregated form; and any person whose details appear in your catalog or discount data (for example, a discount code named after a creator).
- Special categories: none. Please don’t put special category data (such as health information) in products or discounts.
3. Our obligations
3.1 Instructions
We process store personal data only on your documented instructions. Your instructions are these terms and this DPA, and the way you use and configure the app, such as approving a fix, turning on an Autopilot rule or changing your settings. If the law requires other processing, we will tell you first unless the law prohibits it. We will tell you if we believe an instruction breaks data protection law.
3.2 Confidentiality
Everyone we authorise to process store personal data is bound by a duty of confidentiality.
3.3 Security
We apply appropriate technical and organisational measures to protect store personal data, as described on our security page. We may update these measures over time, as long as they don’t reduce the overall level of protection.
3.4 Helping you respond to requests
Taking into account the nature of the processing, we help you respond to requests from people exercising their data protection rights. Shopify’s customer data and erasure requests reach us automatically and are handled as described in our privacy policy; because we hold no customer personal data, there is normally nothing to return or delete. If someone contacts us directly about your store’s data, we will pass the request on to you. We also give you reasonable help with security, breach notification, data protection impact assessments and consultations with supervisory authorities, using the information available to us.
3.5 Personal data breaches
We will notify you without undue delay after becoming aware of a personal data breach affecting store personal data, and give you the information we have that you reasonably need to meet your own obligations. We will update you as we learn more.
3.6 Deletion at the end
When you uninstall the app, our access to your store ends immediately and your store’s access tokens are deleted. When Shopify sends its data erasure request (shop/redact), about 48 hours later, we delete all store personal data, keeping only a record that the erasure happened (your shop domain and the time), unless the law requires us to keep something longer. The data comes from your Shopify store and remains available to you there. If you want a copy of what CheckoutLeak holds before you uninstall, email legal@checkoutleak.com.
3.7 Audits and information
On request, we will make available the information reasonably necessary to show that we meet this DPA, including written answers to your reasonable questions. If that is not enough to meet a requirement of data protection law, we will allow and contribute to an audit by you or an independent auditor you appoint, with reasonable notice, at your cost, under confidentiality, and no more than once a year unless a supervisory authority requires it or after a personal data breach.
4. Subprocessors
You give us general authorisation to use the subprocessors listed on our subprocessors page. We impose data protection obligations on each of them that are, in substance, no less protective than this DPA, and we remain responsible to you for their work.
Before we add or replace a subprocessor, we update that page and, where the change is material for store personal data, email your store’s owner email. You may object on reasonable data protection grounds within 30 days by writing to legal@checkoutleak.com. We will try to address the objection; if we can’t, you can stop using the app by uninstalling it, and the deletion in section 3.6 applies.
5. International transfers
Store personal data is stored in London (UK) and our app functions run in Dublin (Ireland). Some subprocessors may process data in other countries, including the United States. Where store personal data leaves the EEA or the UK, we rely on an adequacy decision or on appropriate safeguards, such as the EU Standard Contractual Clauses and, for UK data, the UK International Data Transfer Agreement or Addendum, where applicable.
6. Your obligations
You are responsible for having a lawful basis for the store personal data you let us process, for making sure your instructions comply with the law, and for telling your store’s visitors and shoppers how their data is used, including in your store’s privacy policy and its cookie and consent settings. The storefront pixel respects the consent choices made through Shopify’s customer privacy settings.
7. General
This DPA stays in force for as long as we process store personal data for you. Each party’s liability under it is subject to the limits in the terms, except where the law does not allow those limits. We may update this DPA to reflect changes in the law, our subprocessors or the app; we won’t materially reduce the protection it gives you, and we will tell you about material changes in the app or by email before they take effect.
8. Contact
Questions about this DPA: legal@checkoutleak.com. Privacy questions: privacy@checkoutleak.com.