Pricekeep data processing agreement

Effective 15 November 2026

This Data Processing Agreement ("DPA") is between the merchant who installs Pricekeep (the "Controller", "Merchant") and SUPER LARGE ARTIFICIAL BUFFER CORPORATION L.P., Makedonomachon 31, 14569 Dionysos, Greece (the "Processor", "we"). It forms part of the terms under which the Merchant uses the App and applies whenever we process personal data on the Merchant's behalf. By installing or using the App, the Merchant accepts this DPA. It is designed to meet Article 28 of the EU General Data Protection Regulation ("GDPR") and the UK GDPR.

1. Definitions

"Personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the GDPR. "Customer data" means personal data about the Merchant's customers that we process to provide the App, as described in Annex 1.

2. Roles and instructions

The Merchant is the controller and we are the processor of customer data. We process customer data only on the Merchant's documented instructions, which are: to provide the App as configured by the Merchant in its settings, and as described in our privacy policy. We will tell the Merchant if we believe an instruction breaks data protection law. The Merchant is responsible for having a lawful basis for the processing and for informing its customers.

3. Confidentiality

Anyone we authorise to process customer data is bound by a duty of confidentiality.

4. Security

We implement the technical and organisational measures in Annex 2, appropriate to the risk, and keep them under review.

5. Sub-processors

The Merchant authorises the sub-processors listed in Annex 3. We will give at least 30 days' notice of a new or replacement sub-processor by updating this page and notifying Merchants in the App. The Merchant may object on reasonable data protection grounds; if we cannot address the objection, the Merchant may stop using the App. We impose data protection obligations on each sub-processor that are no less protective than this DPA and remain responsible for their performance.

6. Helping the Merchant

Taking into account the nature of the processing, we will help the Merchant to respond to data subject requests (access, rectification, erasure, restriction, portability and objection), including by acting on Shopify's customer data request and erasure notifications, and will provide reasonable help with security, breach notification, data protection impact assessments and consultations with supervisory authorities.

7. Personal data breaches

We will notify the Merchant without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer data, with the information the Merchant needs to meet its own notification duties, and will take reasonable steps to contain it.

8. Deletion

We delete customer data automatically: reminders, including the shopper's email address, 90 days after the reminder is finished, and unpaid draft orders the App created when their link expires. When the Merchant uninstalls the App, we delete all of its data within 30 days of Shopify's shop erasure notification, unless law requires us to keep it.

9. Audits and information

We will make available the information reasonably needed to show compliance with this DPA, and allow audits by the Merchant or an auditor it appoints, on reasonable notice, no more than once a year (unless required by a supervisory authority or after a breach), under confidentiality, and at the Merchant's cost. Written answers and our security documentation will be provided first.

10. International transfers

Where customer data is transferred outside the EEA, UK or Switzerland to a country without an adequacy decision, the transfer is governed by the European Commission's Standard Contractual Clauses (Module 2 between the Merchant and us, Module 3 with our sub-processors), with the UK Addendum where UK data is involved, which are incorporated by reference.

11. Liability, term and law

Each party's liability under this DPA is subject to the limits in the terms that govern the Merchant's use of the App. This DPA lasts as long as we process customer data for the Merchant. It is governed by the laws of Greece, except where the Standard Contractual Clauses require otherwise. If this DPA conflicts with other terms, this DPA prevails for data protection matters.

Annex 1: Details of processing

• Subject matter and purpose: sending shoppers the reminder they requested, with a checkout link and, if the Merchant allows it, the price they saw (price lock), and showing the Merchant its reminder history.
• Nature: receiving reminder requests from the Merchant's storefront, storing them, and on the chosen day creating a draft order in the Merchant's Shopify store and asking Shopify to email its invoice to the shopper.
• Duration: for the term of the Merchant's use of the App, subject to the retention periods in section 8.
• Data subjects: shoppers who request a reminder on the Merchant's storefront.
• Categories of data: email address; reminder date, time zone, country and language; product and variant IDs, titles, quantities and prices; price lock details; draft order ID, checkout link, status, and the total if the shopper bought. No names, postal addresses, phone numbers or payment details are stored.
• Special categories of data: none.

Annex 2: Security measures

• Encryption in transit (TLS) for all connections and encryption at rest for databases.
• Verification of the signature on every request from Shopify (HMAC).
• Least-privilege Shopify permissions; no access to customer contact details.
• Access to production systems restricted to authorised personnel, with strong authentication.
• Data minimisation and automatic deletion under the retention periods above.
• Backups held by the database provider, with the same encryption and access controls.
• Dependency updates and monitoring of errors and unusual activity.

Annex 3: Authorised sub-processors

• Shopify Inc. and its affiliates: e-commerce platform the App runs on (global).
• Render Services, Inc.: application hosting (EU, Frankfurt, Germany).
• Render Services, Inc. (managed PostgreSQL): database hosting (EU, Frankfurt, Germany).

Contact

SUPER LARGE ARTIFICIAL BUFFER CORPORATION L.P., Makedonomachon 31, 14569 Dionysos, Greece. G.E.MI. no. 172893101000, VAT no. EL802245467. Email: admin@slabuf.com.