Data Processing Agreement

Last updated: October 30, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the merchant who installs Ship To Who ("you", the "Controller") and BrightLayer Lab LLC, a Virginia limited liability company that operates the Ship To Who application ("we", "us", the "Processor"). It sets out how we handle the personal data we process for you when you use the App.

At a glance. This summary does not replace the sections below.

• You decide why and how your customers' data is used. We use it only to run Ship To Who for you.
• We clear gift recipient and shipping details from the App 60 days after an order is placed, or 30 days after it is fulfilled or cancelled if that comes first, and while the App is installed we also delete the App's recipient field from those Shopify orders, or from any order once it is 55 days old if that comes first (a daily job does this, so within about a day after that date). Other copies in your Shopify orders, and when the recipient field stays, are covered in Section 5.4.
• We never store or use the buyer's email address, payment details or the items ordered.
• The App is offered only to merchants established in the United States, and in Canada outside Quebec (development stores anywhere). Your data is stored and processed in the United States (Section 6).
• The providers we use to run the App are listed in Annex 3: Render (hosting, delivered through its edge network provider Cloudflare), Neon (database) and Zoho (support email). Shopify is your own platform provider, not one of ours.
• If a security breach affects your data, we tell you without undue delay and within 72 hours.

1. Definitions

• App: the Ship To Who application, including its pages in your Shopify admin, its recipient block on your storefront, its block on the thank-you and order status pages and, when it is available for your store and you turn it on, the buyer fix page.
• Personal Data: any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the GDPR, and any information that is "personal information" or "personal data" under the US state privacy laws that apply to the processing, including the CCPA, or under the Canadian Privacy Laws.
• Processing: any operation performed on personal data, as defined in Article 4(2) of the GDPR.
• Data Subject: the person the personal data is about. Under this DPA these are the people listed in Section 2.4.
• Sub-processor: any third party we engage to process personal data on your behalf. Shopify is not one (Section 4.4).
• Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data processed under this DPA, including a breach at one of our sub-processors. It includes a "breach of security safeguards" under PIPEDA and a "confidentiality incident" under Quebec's private-sector privacy law affecting that data.
• CCPA: the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its regulations.
• Canadian Privacy Laws: the Personal Information Protection and Electronic Documents Act (PIPEDA) and the provincial private-sector privacy laws recognized as substantially similar to it, including Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25 (S.Q. 2021, c. 25) ("Quebec's private-sector privacy law").
• Applicable Data Protection Law: US state privacy laws such as the CCPA, the Canadian Privacy Laws, the GDPR (EU) 2016/679, the UK GDPR, the Swiss Federal Act on Data Protection (FADP), the Australian Privacy Act 1988, and any other data protection law that applies to the processing.

2. Scope and Purpose

2.1 Subject Matter

We process personal data to provide Ship To Who as described in the Terms of Service. Ship To Who checks gift orders for a shipping address that looks like the buyer's own instead of the recipient's, holds those orders so your staff can check them, and helps your staff and your buyers correct them.

2.2 Duration

Processing continues for as long as you use the App, plus any retention period needed to meet legal obligations or to complete data deletion (Section 5).

2.3 Nature and Purpose of Processing

Automated checks. The order check applies fixed rules automatically, but it makes no final decision about anyone. A hold only pauses fulfillment so your staff can look, and the App never cancels an order or changes it on its own. Your staff can release a hold or mark a flag as a false alarm at any time. Our Privacy Policy (Section 9) describes the rules.

2.4 Categories of Data Subjects

• Buyers: your customers who place orders in your store
• Gift recipients: the people buyers name as the recipient of an order
• Other people named in delivery details: for example the person a funeral tribute is "in memory of"
• Shipping addressees: the person named in an order's shipping address. This is the gift recipient, or the buyer when the buyer chose "It's for me" or a gift is shipping to the buyer by mistake
• Your staff: staff members who use the App in your Shopify admin

2.5 Types of Personal Data Processed

The App keeps a copy of the recipient and shipping details for most orders that have a shipping address. This includes orders where the buyer chose "It's for me" and orders with no recipient entered that ship to someone other than the buyer (Section 2.3 explains why). It does not keep one for orders without a shipping address, or for orders with no gift details that ship to the buyer's own name.

About gift recipients and other people named in delivery details

• Recipient name and phone number, as the buyer entered them in the App's block, or in another app's or your theme's fields if you set the App to read those
• Delivery type and delivery details: hospital, ward and room; school, building and department; company and floor or suite; funeral home, service date and "in memory of"; hotel and check-in date

About the shipping addressee

• Shipping name, first and last name, company, address lines 1 and 2, and city
• In the correction history, when staff or the buyer save a correction: the full shipping address before and after, including state or province, postal code, country and phone number. The shipping phone number may be the buyer's own if their browser filled it in

About buyers

• First and last name from the order's customer and billing details. We read these only to compare them with the shipping name, and from them keep only the name words that matched
• When the order ships to the buyer (including "It's for me" orders and the mistake the App looks for), the shipping name and address lines above are the buyer's own
• Shopify order ID, order number and order time, which you can link to the buyer in Shopify
• The Shopify customer ID and order IDs listed in a privacy request Shopify sends us
• The order's confirmation number, which the thank-you and order status block and the fix link send us. We compare it with the order and do not store it in the App's database or record it in the App's request log (Section 5.2)
• Whether the buyer marked the order as a gift, reported a problem, saved a correction or confirmed their details, and when

About your staff

• The email address of the staff member who records an outcome or saves a correction, shown on the order page
• When the fix page is on, the email address of the staff member who creates a fix link
• The Shopify user ID in the short-lived sign-in token that staff browsers send when opening the App, which we use to sign the staff member in. The App's request log does not record the token (Section 5.2)

What the App does not store or use

• The buyer's email address. We have not asked Shopify for access to email; we requested name, address and phone only
• Payment details, transactions, prices, totals or the items ordered
• The buyer's billing address, other than the name, or the phone number on their customer account
• Shopify's order notifications include more of the order than the App needs, such as the items ordered and prices. The App reads only the details described above, holds the rest only in memory while it handles the notification, and never stores the notification itself. If handling a notification fails, the error record in our server logs can include values from the order (Annex 3)
• The App does not record IP addresses. When the fix page is on, it counts start-link requests per network address in the server's memory only (Annex 2). Our hosting provider handles the network address of each connection in order to deliver it (Annex 3)

Sensitive details. The App's block asks for delivery details that can reveal sensitive information about the recipient or others. The Hospital delivery type asks for the hospital, ward and room, which show that a named person is a patient and are likely to be data concerning health. The Funeral home type asks for the funeral home, service date and "in memory of", which can reveal a bereavement and name a person who has died. For that reason the Hospital and Funeral home delivery types start switched off. The recipient block on your storefront offers them only if you turn them on in the block's settings in your theme editor. The App's Settings has its own list of delivery types, which the staff correction form and the buyer fix page use; keep it the same as the block's. The block always offers Home, and you can switch off any other delivery type in its settings. These details are used only to check and deliver the order. The App's own copies are cleared on the schedule in Section 5.1, together with the recipient field the App writes on the order while the App is installed (at the latest within about a day after the order is 55 days old; Section 5.4), and staff access to them is logged (Annex 2). The same details are also in your Shopify order, in its additional details and in the note line the App writes, and those copies are not cleared by the App's purge (Section 5.4).

2.6 Our Own Records

Some records about your use of the App are kept by us as an independent controller, as described in our Privacy Policy (published at https://shiptowho.com/privacy), and not on your behalf:

• Sign-in sessions: your store's Shopify access and refresh tokens and, for each staff member who opens the App, the session Shopify gives us: Shopify user ID, first and last name, email address, language, whether the email is verified, and whether they are the account owner or a collaborator. We need these to sign staff in and to work with Shopify. They are deleted when you uninstall the App.
• Access log: a record of each time staff view the Needs attention or All gift orders lists, view or change an order, or download a privacy-request export, and of each buyer correction on the fix page. Each entry holds the store, who acted (the staff member's email, their Shopify user ID if there is no email, or "customer" for a buyer correction), an internal record reference, the action and the time, and never a customer's name, address or phone number. It is kept for 18 months (Section 5.1).
• Support correspondence: messages about your account and your use of the App that you or your staff send to support@shiptowho.com, and our replies.

When you, your staff, a buyer or a recipient send us customer or recipient data so that we can act for you, for example a request under Section 4.5 or a copy under Section 5.3, we handle that data as your processor under this DPA, with Zoho as sub-processor (Annex 3), and delete it from our mailbox within 30 days after the request is closed.

The retention and deletion of these records are still described in Section 5 so that you have the full picture.

3. Obligations of the Data Controller

You shall:

1. Ensure there is a lawful basis for processing personal data through the App, and any consent the law requires. The Hospital delivery type is off by default. If you turn it on, or offer another detail that reveals health or other special category data, also identify a condition under Article 9(2) of the GDPR (or the equivalent under other laws that apply to you), or leave that delivery type off
2. Inform buyers, and where required gift recipients, about the processing as the laws that apply to you require, for example in your store's privacy policy. This includes Articles 13 and 14 of the GDPR where they apply and, under the Canadian Privacy Laws, telling them that the data is stored and processed in the United States (Section 6.6)
3. Send us a working contact for privacy matters at support@shiptowho.com, and tell us when it changes. Without one, our notices reach only the addresses described in Section 4.8
4. Check Settings, Customer data requests in the App for new requests from Shopify, and respond to data subject requests within the timeframes required by applicable law (for example one month under the GDPR, and 30 days under PIPEDA and Quebec's private-sector privacy law), using the tools in Section 4.5. The App does not send an email or other alert when a request arrives
5. Review the App's retention schedule in Section 5.1. It is fixed and cannot be changed in the App settings. Data the App writes into your Shopify orders is covered in Section 5.4
6. Ensure your instructions to us comply with applicable data protection law. The text you write in the App settings (for example the hold note and the contact text shown to buyers) is part of your instructions; keep personal data in it to what is needed
7. Control which staff can open the App through Shopify's staff permissions. The App has no roles of its own: every staff member who can open it can see all of its pages
8. Notify us without undue delay if you become aware of a data breach involving data processed by the App

4. Obligations of the Data Processor

We shall:

4.1 Processing Instructions

• Process personal data only on your documented instructions (the Terms of Service, this DPA, your App settings and the actions your staff take in the App), including with regard to transfers of personal data to a third country or an international organisation, unless we are required to do otherwise by Union or Member State law or other law to which we are subject. In that case we will tell you of that legal requirement before processing, unless that law prohibits this on important grounds of public interest
• Not process personal data for any purpose other than providing Ship To Who to you. The counts and accuracy figures in the App are worked out for your store alone, from your store's own records, and in the App are shown only to your store (Section 2.3). We do not compute or use accuracy figures across stores; across stores the App records only operational totals in its server logs, such as how many records the daily purge deleted
• Not set cookies of our own through the App, and not use your customers' data for marketing, advertising, analytics tracking or profiling: the App uses it only to provide Ship To Who to you, for the purposes in Section 2.3, mainly to check, hold and correct your orders and to show your store its own accuracy figures, and does not override any consent choices a buyer makes in your store
• Inform you if, in our opinion, an instruction infringes applicable data protection law

Requests from authorities. If we receive a legally binding request from a public authority or any other third party for personal data we process for you, we will:

• Tell you promptly, unless the law prohibits it. If it does, we will use reasonable efforts to have the prohibition lifted so that we can tell you as much as possible, as soon as possible
• Assess whether the request is lawful, and challenge it where, after careful assessment, we conclude there are reasonable grounds to consider it unlawful
• Disclose only the minimum personal data the request requires, on a reasonable interpretation of it
• Keep a record of the request and our response

We will not disclose personal data we process for you to any other third party except on your instructions or as this DPA allows.

California and other US state laws. For the CCPA, you are the business and we are your service provider; under other US state privacy laws, you are the controller and we are your processor. You disclose personal information to us only for the limited and specified business purposes described in Section 2.3, which are the only purposes for which we may process it. We:

• Will not sell or share it (as those terms are defined in the CCPA)
• Will not retain, use or disclose it for any purpose, including any commercial purpose, other than those business purposes, or outside our direct business relationship with you, except as the CCPA and its regulations allow a service provider
• Will not combine it with personal information we receive from or on behalf of anyone else, or collect from our own interactions with consumers, except as the CCPA regulations allow
• Will comply with the CCPA and give the personal information the same level of privacy protection the CCPA requires of you
• Will tell you if we decide that we can no longer meet our obligations under the CCPA

You may take reasonable and appropriate steps to make sure we use the personal information consistently with your obligations under the CCPA, including through Section 7, and, on notice to us, to stop and remediate any use you reasonably believe is unauthorized.

Canada. Under the Canadian Privacy Laws, you remain accountable for the personal information you transfer to us, and we process it as your service provider. This DPA is the contract that gives that information a comparable level of protection while we process it: we use it only for the purposes in Section 2.3, protect it with the measures in Annex 2, and return or delete it as Section 5 provides. Section 6.6 covers storage in the United States and Quebec.

4.2 Confidentiality

• Ensure that all personnel authorized to process personal data are bound by obligations of confidentiality, and limit access to production systems to authorized BrightLayer Lab LLC personnel who need it to run the App

4.3 Security (Article 32 GDPR)

Implement appropriate technical and organizational measures, taking into account the nature of the data, including the sensitive delivery details described in Section 2.5. The measures are listed in Annex 2. In short:

• HTTPS for every connection to the App, and authentication on every request that reaches your data
• Each store sees only its own data
• Shopify permissions limited to orders (including the buyer's first and last name on each order) and merchant-managed fulfillment orders; protected customer data limited to name, address and phone, not email
• Automatic purge of recipient and shipping details on a fixed schedule
• A log of staff access to protected customer data
• The App's database hosted on Neon, which encrypts stored data and its backups. The App stores only a one-way hash of fix-link codes in its database, and its request log leaves out query strings and masks fix-link codes (Section 5.2)

4.4 Sub-processors

You give us general written authorization to engage the sub-processors listed in Annex 3 (Render, Neon and Zoho), and new sub-processors under the notice process below.

Shopify is your platform, not our sub-processor. Your store runs on Shopify under your own agreement with Shopify. The App receives your orders from Shopify and writes its changes back into your store, and Shopify runs the App's storefront block and its thank-you and order status block, and serves its admin page scripts. Shopify does this as your own provider, under your agreement with Shopify and Shopify's terms, not as a sub-processor we engage, so the commitments in this Section 4.4 about sub-processors do not apply to Shopify. Annex 3 describes what Shopify handles for the App, for completeness.

The public website is outside this DPA. The Ship To Who website at shiptowho.com is a static page served through our Cloudflare account, with cookieless Cloudflare Web Analytics that sets no identifier on the visitor's device. These services process ordinary request details of website visitors (such as IP address, browser and request time) and never receive your customers' data. They are not sub-processors of the processing governed by this DPA; they are described in our Privacy Policy, where we act as an independent controller.

Services that never receive your data are not sub-processors. For example, our source code is hosted on GitHub and holds no store data. Development and testing use BrightLayer Lab's own development stores, separate databases and made-up data, never your store's data.

We shall:

• Maintain the current list of sub-processors in Annex 3 of this DPA. We will give you at least 30 days' prior written notice, by updating the list and by email as described in Section 4.8, before a new sub-processor begins processing personal data, so you have an opportunity to object. You may review the current list at any time and may object to a new sub-processor within that notice period by contacting us. If the objection cannot be reasonably resolved, you may stop using the App and terminate the affected services without penalty.
• Ensure sub-processors are bound by data protection obligations no less protective than those in this DPA
• Remain liable to you, within the limits in Section 8, for our sub-processors' performance of their data protection obligations as for our own

4.5 Data Subject Requests

Buyers, through Shopify's privacy requests.

• Access and portability. When Shopify sends us a customer data request (customers/data_request), we record the request ID, the buyer's Shopify customer ID and the order IDs it lists. It appears in the App under Settings, Customer data requests, with its date and number of orders; the list shows the 20 most recent requests. The App sends no email or alert, so we check for new requests at least once a week and remind you within 7 days of a request arriving (Section 4.8), and your staff should also check the list (Section 3, item 4). Your staff download a JSON file built at that moment from what the App still holds for those orders. For each order it contains the order ID and number, the recipient details, the shipping copy, the matched name words and the correction history (dates, before and after). Staff identities are left out, and each download is recorded in the access log. Once the App has purged an order's details, the file holds only the order ID and number and the dates of any corrections. The file does not include the other details the App keeps about those orders after the purge: order time, gift choice, check result, holds, outcome, buyer report records and when the buyer reported a problem, corrected or confirmed details. If you need them for a response, write to support@shiptowho.com with the request date and we will send them for the listed orders within 15 days. You send the file, and anything we send you, to the customer.
• Erasure. When Shopify sends us a customer redaction request (customers/redact), we act as described in Section 5.5.
• Data the App wrote into your Shopify store is covered in Section 5.4.

Gift recipients and other people named in delivery details. Recipients are usually not your Shopify customers, and Shopify's privacy requests are based on the buyer's orders, so they do not reach recipients. If a recipient asks you for access, correction or deletion, your staff can correct the recipient on the order in the App. For access or deletion, write to support@shiptowho.com with the orders concerned. Within 15 days we will send you what the App holds about the recipient for those orders and, if you ask, clear the recipient details from the App. We clear them with the App's own tool, which does for those orders what a customer redaction request does (Section 5.5): it also deletes their fix links and buyer report records and, while the App is installed, the App's recipient field (Section 5.4). The order's additional details and note line are in your store, where your staff can edit them (Section 5.4). If a recipient writes to us directly, we pass the request to you promptly and act on your instructions. Recipient details are also purged from the App automatically on the schedule in Section 5.1.

Other rights. We will assist you with other data subject rights (rectification, objection, restriction) on a manual basis where we hold the relevant data or where the App wrote it into your store. Most such rights are exercised through your own workflow; we will respond to reasonable written requests for data-level changes without undue delay and within 15 days, and in any case in time for you to meet your legal deadline.

4.6 Data Breach Notification

• Notify you without undue delay, and no later than 72 hours, after becoming aware of a Personal Data Breach affecting your data, including one at a sub-processor, by the means in Section 4.8
• Describe in the notice, as far as is known at the time: the nature of the breach, including the categories and approximate number of data subjects and of records concerned; its likely consequences; the measures we have taken or propose to take, including to mitigate its possible adverse effects; and a contact point for more information. Where we cannot provide all of this at once, we will provide it in phases as it becomes available, without undue further delay
• Provide enough information for you to meet your breach notification obligations under Articles 33 and 34 of the GDPR and your breach reporting, notification and record-keeping obligations under the Canadian Privacy Laws (Section 6.6)
• Cooperate with you in investigating and remediating the breach
• Keep a record of each Personal Data Breach, including its facts, its effects and the remedial action taken

4.7 Data Protection Impact Assessments

• Assist you with data protection impact assessments (DPIAs) and any prior consultation of a supervisory authority where required under Articles 35 and 36 of the GDPR, and with any privacy impact assessment the Canadian Privacy Laws require of you, taking into account the nature of processing and the information available to us, including the sensitive delivery details described in Section 2.5
• Answer reasonable questions you send to support@shiptowho.com for these assessments, or for any other privacy assessment you carry out, within 15 days

4.8 How We Send Notices

We send notices under this DPA, including breach notices (Section 4.6), sub-processor changes (Section 4.4) and data request reminders (Section 4.5), by email to:

• the privacy contact you have sent us (Section 3, item 3), if any; and
• the email addresses Shopify gives us for your staff who have opened the App, including the store owner's if the owner has opened it.

The App does not keep your store's contact email. Shopify's uninstall notification includes it, but the App does not store it. The App also deletes staff sign-in details when you uninstall. If we have no working address for you, including after you uninstall, we also post the notice on shiptowho.com and use any channel Shopify provides to app developers for your store.

5. Data Retention and Deletion

5.1 Retention Period

The App's retention is fixed. A daily job applies it, so data goes within about a day after the date shown. Copies in our database provider's restore history and our hosting provider's logs last a short time longer (Section 5.2).

5.2 Backups and Logs

• Database restore history. Neon keeps an encrypted restore history of the database as part of its service. On our current Neon plan it covers the last 6 hours, and we will keep it to 28 days at most. Purged or deleted data can remain in that history until it ages out. We use it only to recover from a failure. If we restore the database, we restart the App or run the daily purge straight away, which clears restored recipient details past their purge date and deletes the restored data of any store uninstalled more than 30 days earlier. Before the App resumes normal processing, we re-apply the customer redactions, uninstall clean-ups and store deletions received after the restore point that we can identify, and we ask affected merchants to send again any redaction requests from the period we restored over.
• Server logs. Render keeps the App's server logs for the log retention period of our Render plan, which we will keep to 28 days at most. We do not forward them to any other service, and only BrightLayer Lab LLC's owner has access to them. For each request, the App's request log records only the method, the path with any query string removed and fix-link codes masked, the status, the response size and the response time. It does not record confirmation numbers, fix-link codes or sign-in tokens. The paths of order pages your staff open in the App include the order ID. The logs also hold the App's own event and error lines (Annex 3). A line for an unhandled error records the path of the request that failed, without its query string and with fix-link codes masked, as the request log does. Separately, Render and its edge network provider may keep their own platform logs of requests to the App, under their own retention, and these may record the full web address of a fix link (Section 2.3, Annex 3). We use the logs only to run and secure the App.

5.3 Deletion or Return on Termination

In accordance with Article 28(3)(g) of the GDPR, you may choose deletion or return of personal data at the end of the services.

• Return. The recipient fields saved on your orders through Shopify (the order's additional details) and the "Gift recipient (Ship To Who)" note line are already in your Shopify orders and stay there after you uninstall. The App's recipient field on the order is not a copy you can rely on keeping: the App has already deleted it from orders whose details it cleared and from orders more than 55 days old (its daily job does this within about a day after that age), it cannot delete it after you uninstall, and Shopify keeps the remaining values only for a limited time (Section 5.4). If you also want a copy of what the App holds, write to support@shiptowho.com before you uninstall, because uninstalling clears the recipient details from the App at once. We make the copy promptly after your request. The purge schedule in Section 5.1 keeps running in the meantime, so the copy covers what the App holds when we make it. We will use commercially reasonable efforts to send it within 30 days, as an encrypted file with the password sent in a separate message, not as a plain email attachment.
• Deletion is the default. If you do not ask for a copy before uninstalling, we delete the personal data as follows.
• If we end the service. If we suspend or end your access under the Terms of Service, you may still ask for a copy as described above, unless the data has already been deleted after an uninstall, by Shopify's store deletion request or the App's 30-day backstop (below). If you do not uninstall, we delete what the App holds for your store within 30 days after your access ends, or after we send you the copy you asked for, if later.

When you uninstall the App (Shopify's app/uninstalled notification), we immediately:

• Clear the recipient details, shipping copies, matched name words and correction details for all your orders
• Delete all sign-in sessions for your store, including the Shopify access token, and any unfinished background jobs and fix links
• Stop serving your store: the App's buyer-facing endpoints refuse an uninstalled store

The remaining records (Section 5.1) are kept until Shopify sends its store deletion request (shop/redact), about 48 hours after you uninstall, so a quick reinstall keeps your accuracy figures. On that request we delete everything the App holds for your store: settings, order records, correction history, staff emails, report records, privacy request records, fix links, sessions, notification receipts, background jobs and the access log. If that request has not been processed, the App's daily purge deletes the same records automatically once your store has been uninstalled for more than 30 days, normally within a day of that date, unless you have reinstalled and opened the App in the meantime.

Deletion from the App is permanent, subject to Section 5.2. We shall delete existing copies of personal data after deletion or return is complete, unless retention is required by applicable law.

5.4 Data the App Writes into Your Shopify Store

While it works, the App writes into your Shopify orders:

• Your chosen tag on flagged orders
• The "Gift recipient (Ship To Who)" line in the order note (name, delivery type and details, recipient phone), printed on packing slips
• Fulfillment holds, with a hold note that for a mismatch by default names the recipient and the shipping name. The App asks Shopify to notify your staff of each hold, and Shopify's notification may include the note
• When staff save a correction (recorded as Fixed), or a buyer saves the fix page: the corrected shipping address and the recipient details in the order's additional details
• The App's recipient field on the order (recipient name, phone, delivery type and details)

The tag, the note line, the hold notes and the corrected address and additional details are part of your Shopify store, under your control and Shopify's terms. They stay after the App's purge, a customer redaction request and uninstalling. Your staff can edit or remove the tag, the order note, the additional details and the shipping address in Shopify; hold records are kept by Shopify under its own terms. Other apps on your store with access to orders can read the order note and additional details.

The App's recipient field works differently. Your staff can read it on the order page but cannot edit or delete it, so the App deletes it. While the App is installed, a background job deletes the App's recipient field from an order in Shopify when the App clears its own copy of that order's recipient details, whether by the daily purge (Section 5.1), a customer redaction request (Section 5.5) or a request under Section 4.5, or once the order is 55 days old, whichever comes first. The App's daily job starts the deletion for orders that reach 55 days, so it happens within about a day after that date, while Shopify still gives the App access to the order. The job retries for up to an hour if Shopify cannot be reached; if it still cannot, the App records the failure in its server logs and its next daily job starts the deletion again, as long as the order was placed less than 60 days earlier. If Shopify refuses the deletion, the field stays on that order and the App records the failure in its server logs. Once the App has cleared its own copy of an order's recipient details or started deleting the field from that order, it does not write the field there again, even if the deletion failed: a later correction updates only the shipping address, the additional details and the note line. If Shopify repeats an order's new-order notification after a correction, or after the App cleared its copy or the field, the App writes neither the field nor the note line from it, so the repeat does not overwrite the corrected or deleted details. Uninstalling is different: the App loses access to your store at once, so it cannot delete the field, and the field stays on any order it has not already been deleted from. Shopify then deletes the field's definition, keeps its values only for a limited time it does not guarantee, and then removes them. If you reinstall and open the App before then, the field comes back on those orders. If the App still holds your store's records (Section 5.3), it starts deleting the field at its next daily purge, as above, from those orders, including any whose deletion was still waiting or being retried when you uninstalled. If the App has already deleted your store's records, it no longer knows those orders and does not delete the field.

5.5 Customer-Level Deletion

When Shopify sends us a customer redaction request (customers/redact), for the orders it lists we immediately:

• Clear the recipient details, the shipping copy, the matched name words, and the before and after details in the correction history
• Delete any fix links and buyer report records for those orders
• Delete the privacy request records Shopify sent us for the same buyer (their Shopify customer ID and order IDs)
• Start the background job that deletes the App's recipient field from those orders in Shopify, if the App is installed and has not already done so (Section 5.4)

These remain until your store's data is deleted (Section 5.3), for the purposes given in Section 5.1: the order record without those details (including whether the buyer or staff reported first, and when, and when the buyer corrected or confirmed details), and the staff email on the outcome and on each correction. Other data in your Shopify store, such as the order note line and additional details, is not changed (Section 5.4). Details the App stores from later activity on the same order, for example the before and after copy of a correction saved afterwards, follow the schedule in Section 5.1. Such a correction does not write the App's recipient field on the order again (Section 5.4).

6. International Transfers

The App runs on Render and its database is hosted by Neon, both in the United States. Support email is hosted by Zoho in the United States (Annex 3). Personal data processed under this DPA, including that of people in Canada, is stored and processed in the United States. Requests to and from the App travel through the nearest location of Render's edge network provider, Cloudflare, which may be outside the United States (for example in Canada) and handles them there only in transit (Annex 3).

Geographic availability. Under Section 4 of the Terms of Service, the App is offered only to merchants established in the United States, and in Canada outside Quebec. Merchants established in Quebec are not served. Shopify development stores are served wherever they are, because they hold test data only. The App reads from Shopify the country and province or state of your store's business address (your primary business entity in Shopify, or your store address if there is none) and whether it is a development store, keeps them on your store's record and refreshes them at most once a day, or each time your staff open the App while it is not served. For a store that is not a development store and whose business address is outside the United States and Canada, or in Quebec, the App opens in your Shopify admin only to a page saying it is not available and where Shopify places the store, and it records nothing from new-order notifications, the thank-you and order status block or the buyer fix page for your store. If the country cannot be determined, the App serves the store and logs the event. A store in Canada whose province cannot be determined is also served. Shopify's privacy requests and the clean-up when you uninstall are always processed, for every store (Sections 4.5, 5.3 and 5.5). If your store is not served, your staff can open only that page and cannot use the App; write to support@shiptowho.com for the files for customer data requests, a copy of what the App holds for your store, or its deletion (Terms of Service, Section 4).

Canada. Section 6.6 applies to personal information subject to the Canadian Privacy Laws.

GDPR, UK GDPR and FADP. Because the App is offered only to merchants in the United States and in Canada outside Quebec (above), Sections 6.1 to 6.5 apply only where processing under this DPA is nonetheless subject to the GDPR, the UK GDPR or the FADP, for example where a merchant in the United States or Canada offers its goods to buyers, or delivers to recipients, located in the EEA, the United Kingdom or Switzerland.

6.1 EU Standard Contractual Clauses (Controller-to-Processor Transfers)

For transfers of personal data from the EEA, or otherwise subject to the GDPR, to a third country that lacks an adequacy decision under Article 45 of the GDPR, the parties incorporate by reference the Standard Contractual Clauses (Module Two, Controller to Processor) adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021 (the "EU SCCs"). You are the data exporter and we (BrightLayer Lab LLC) are the data importer. The optional and modular elements of the EU SCCs are completed as follows:

• Clause 7 (Docking clause): not used
• Clause 9(a) (Sub-processors): Option 2, general written authorization. The current sub-processor list and the change-notice process are set out in Section 4.4 and Annex 3
• Clause 11(a) (Independent dispute resolution): not selected
• Clause 17 (Governing law): Option 1, the law of Ireland
• Clause 18 (Choice of forum and jurisdiction): the courts of Ireland
• Annex I: as set out in Annex 1 of this DPA
• Annex II (Technical and organizational measures): as set out in Annex 2 of this DPA
• Annex III (List of sub-processors): as set out in Annex 3 of this DPA

6.2 UK International Data Transfer Addendum

For transfers of personal data from the United Kingdom, the parties incorporate by reference the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner's Office under section 119A of the UK Data Protection Act 2018 (the "UK Addendum"), read together with the EU SCCs in Section 6.1. Tables 1, 2 and 3 of the UK Addendum are completed by reference to the EU SCCs and to Annex 1 Part D and the other annexes of this DPA. In Table 4, neither party may end the UK Addendum as set out in its Section 19.

6.3 Swiss Transfers

For transfers of personal data subject to the Swiss Federal Act on Data Protection of 25 September 2020 (the revised FADP, in force since 1 September 2023), the EU SCCs in Section 6.1 apply, and protect data subjects under the FADP, with the following adaptations:

• References to the "GDPR" are read as references to the FADP where the FADP applies
• The competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner, for transfers governed by the FADP
• The term "Member State" must not be interpreted so as to exclude data subjects in Switzerland from suing for their rights in their place of habitual residence (Switzerland), in accordance with Clause 18(c)
• Swiss law governs transfers concerning Swiss-only data subjects

6.4 Sub-processor Onward Transfers

Where our sub-processors transfer personal data outside the EEA, the United Kingdom or Switzerland, or use their own sub-processors (for example Render's edge network provider, Annex 3), those onward transfers are governed by the Standard Contractual Clauses, UK Addendum and data processing terms that each sub-processor listed in Annex 3 offers its customers.

6.5 Adequacy

Where an adequacy decision under Article 45 of the GDPR, or an equivalent UK or Swiss adequacy mechanism, covers the destination country, the parties may rely on that adequacy decision instead of the SCCs and the UK Addendum. BrightLayer Lab LLC is not certified under the EU-US Data Privacy Framework, its UK Extension or the Swiss-US Data Privacy Framework, so transfers to us rely on Sections 6.1 to 6.3.

6.6 Canada

For personal information subject to the Canadian Privacy Laws:

• Accountability. You remain accountable for the personal information and decide how it is used. We process it only as your service provider under this DPA (Section 4.1).
• Storage in the United States. We and our sub-processors store and process it in the United States (Annex 3); requests in transit may pass through the nearest location of Render's edge network provider, which may be outside the United States (Section 6). In the United States it may be accessible to courts, law enforcement and national security authorities under United States law. Section 4.1 says how we handle requests from authorities. Your privacy notice should tell your customers this, for example: "We use service providers, including Ship To Who, that store and process personal information in the United States, where it may be accessible to courts, law enforcement and national security authorities under United States law."
• Quebec. The App is not offered to merchants established in Quebec (Section 6). Quebec's private-sector privacy law may still apply to some of the personal information you process through the App, for example about buyers or recipients in Quebec. Where it does, those people exercise their rights of access and correction through you, with our help under Section 4.5, and can complain to the Commission d'accès à l'information du Québec, and the Breaches paragraph below applies.
• Breaches. Reporting a breach of security safeguards to the Office of the Privacy Commissioner of Canada and notifying affected individuals under PIPEDA, reporting a breach to a provincial privacy authority and notifying affected persons where a provincial law requires it (for example a confidentiality incident to the Commission d'accès à l'information du Québec under Quebec's private-sector privacy law), and keeping the breach records those laws require, are your responsibility as the organization in control of the information. Our notice within 72 hours under Section 4.6 gives you the information we have for them. For personal information subject to Quebec's private-sector privacy law, we will also tell you without delay of any violation or attempted violation of our obligations to keep it confidential.

7. Audit and Compliance Information

On reasonable written notice, and no more than once per calendar year (except where required by a supervisory authority, following a Personal Data Breach affecting your data, or where there are reasonable indications that we are not complying with this DPA), you may request:

• Written responses to a reasonable data protection and security questionnaire
• Publicly available security and compliance documentation from our sub-processors (Annex 3) that shows relevant certifications or controls
• Documentation describing our technical and organizational measures (Annex 2)
• Where the questionnaire and documentation above are not sufficient to satisfy an audit obligation you demonstrably have under Article 28(3)(h) of the GDPR, an audit or inspection by an independent third-party auditor you mandate, bound by written confidentiality obligations, at your expense, on at least 30 days' prior written notice, during normal business hours, in a manner that does not disrupt our operations or compromise the confidentiality of other customers' data, and with the same frequency limit and exceptions as above

You acknowledge that, as a small software operator, our ordinary means of demonstrating compliance are the questionnaire responses and the sub-processor and technical-and-organizational-measures documentation described above. We do not currently hold a third-party security certification such as a SOC 2 report or ISO 27001, and we do not maintain the infrastructure to provide direct, unsupervised access to production systems or personnel; any independent audit will be limited as set out above. Where an audit or inspection is compelled by a supervisory authority or required by applicable law, we will cooperate in good faith with you and the authority to respond to the specific request.

Nothing in this Section limits the audit rights under Clause 8.9 of the EU SCCs where they apply, or your rights under Section 4.1 for US state laws.

8. Liability

Our liability under this DPA is subject to the limitations in Sections 12.2 and 12.3 of the Terms of Service. The limit in Section 12.2 is our total liability for all claims together, including claims under this DPA, and the time limit for claims in Section 12.5 of the Terms applies to them.

Nothing in the Terms of Service or this DPA limits or excludes:

• either party's liability to data subjects under Clause 12 of the EU SCCs, including as applied by the UK Addendum and Section 6.3, where they apply; or
• any liability that applicable data protection law or other law does not allow to be limited or excluded.

9. Governing Law and Order of Precedence

This DPA is governed by the same law that governs the Terms of Service, the laws of the Commonwealth of Virginia, and disputes under it go only to the courts named in Section 16 of the Terms, except that the EU SCCs, the UK Addendum and the Swiss adaptations, where they apply, carry their own governing law and choice of forum as set out in Sections 6.1 to 6.3.

If there is a conflict concerning the processing of personal data, the documents apply in this order: (1) the EU SCCs, the UK Addendum and the Swiss adaptations in Section 6.3, where they apply; (2) this DPA; (3) the Terms of Service. This applies despite any contrary term in the Terms of Service, including its disclaimers and its entire-agreement clause.

10. Contact

Data Processor contact for data protection matters:

• Company: BrightLayer Lab LLC
• Address: 8401 Mayland Dr #10685, Richmond, VA 23294, USA
• Email: support@shiptowho.com
• Website: https://shiptowho.com

Annex 1: Description of the Processing

This annex describes the processing. Where the EU SCCs and the UK Addendum apply (Section 6), it completes Annex I of the EU SCCs and Table 1 to Table 3 of the UK Addendum.

Part A: List of Parties

Part B: Description of the Transfer

Part C: Competent Supervisory Authority

In accordance with Clause 13(a) of the EU SCCs:

• Where the data exporter is not established in the EU, falls within Article 3(2) of the GDPR and has appointed a representative under Article 27(1), the supervisory authority of the Member State in which the representative is established
• Where the data exporter is not established in the EU, falls within Article 3(2) of the GDPR and is not required to appoint a representative under Article 27(2), the supervisory authority of one of the Member States in which the data subjects whose personal data are transferred are located

For UK transfers, the UK Information Commissioner's Office. For Swiss transfers, the Swiss Federal Data Protection and Information Commissioner.

Part D: UK Addendum Tables

Annex 2: Technical and Organizational Measures

Annex 3: Sub-processors

Your platform provider (not a sub-processor we engage). Shopify is the commerce platform your store and the App run on, under your own agreement with Shopify (Section 4.4). It sends the App orders, privacy requests and your store's business country and province or state and development-store status, receives the App's changes to your orders (tags, the recipient field and its deletion, the note line, holds and corrections), runs the App's storefront block and its thank-you and order status block, and serves the App's admin page scripts. All the personal data in Section 2.5 comes from your Shopify store. Shopify processes it on its own infrastructure, under your agreement with Shopify and Shopify's terms.

By installing and using Ship To Who, you accept this Data Processing Agreement as part of the Terms of Service.