Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of the ReorderPilot Terms of Service between the Shopify merchant using ReorderPilot ("Merchant") and Verluno Labs ("Provider").
This DPA applies to personal data processed by Provider on Merchant's behalf in connection with ReorderPilot.
1. Roles
To the extent applicable under privacy and data-protection law, Merchant acts as the controller, business, or equivalent responsible party for personal data relating to Merchant's customers.
Provider acts as Merchant's processor, service provider, or equivalent party when processing that personal data to provide ReorderPilot.
2. Processing instructions and purpose
Provider will process covered personal data only as reasonably necessary to provide, secure, maintain, and support ReorderPilot; comply with Merchant's lawful instructions; and satisfy applicable legal and Shopify requirements.
ReorderPilot uses limited order information to calculate inventory demand, sales velocity, forecasts, and reorder recommendations.
3. Categories of data
Shopify order information processed for forecasting is limited to information such as:
- Shopify order identifiers.
- Order creation dates.
- Cancellation status.
- Line-item quantities.
- Shopify product-variant identifiers.
ReorderPilot does not require customer names, email addresses, phone numbers, or shipping or billing addresses for forecasting.
ReorderPilot may also process merchant-user, supplier, business, product, inventory, and purchase-order information as described in the Privacy Policy.
4. Data minimization and use limitation
Provider will use covered personal data only for the purposes described in this DPA, the Privacy Policy, and the ReorderPilot service.
Provider will not sell protected customer data or use it for unrelated advertising or customer profiling.
5. Confidentiality and security
Provider will maintain reasonable administrative and technical measures designed to protect covered data against unauthorized access, disclosure, alteration, or loss.
Shopify API communications are transmitted over encrypted HTTPS/TLS connections. Protected Shopify order information used for forecasting is not persisted in ReorderPilot's application database.
Production systems that persist application data must use appropriate access controls and encryption at rest.
6. Subprocessors
Merchant authorizes Provider to use subprocessors reasonably necessary to operate ReorderPilot, including Shopify and infrastructure, database-hosting, monitoring, and transactional email providers.
Provider remains responsible for limiting subprocessors' access to information reasonably necessary for their services.
7. Customer requests
Provider will reasonably assist Merchant with applicable customer privacy requests involving ReorderPilot data.
Provider processes Shopify's authenticated customer data-request and customer-redaction webhooks. Because ReorderPilot does not retain customer-specific profiles or stored Shopify order records, ReorderPilot generally has no customer-specific record to return or delete.
8. Retention and deletion
Protected order information used to perform forecasting is not retained as a ReorderPilot order-history database.
Other merchant operational data is retained only as reasonably necessary to provide ReorderPilot, meet legal obligations, or comply with Merchant instructions.
Following uninstall, Provider processes Shopify's shop-redaction request and deletes ReorderPilot data associated with the Merchant's shop unless retention is legally required.
9. Compliance
Provider will process covered data in accordance with applicable contractual obligations to Shopify and applicable privacy and data- protection requirements relevant to Provider's processing.
10. Duration
This DPA remains effective while Provider processes covered personal data on behalf of Merchant in connection with ReorderPilot.
11. Contact
Data-protection questions may be directed to Verluno Labs through the developer/support contact identified for ReorderPilot in its Shopify App Store listing.