Data Processing Agreement

This Data Processing Agreement describes how Alacart Apps Inc., a company incorporated in Canada, processes personal data on behalf of merchants using Wrapped: Gift Blocks ("the App"). It forms part of our Terms of Service and applies where the processing is subject to the EU General Data Protection Regulation or the UK GDPR.

Our role

You are the data controller. We are the data processor. You decide what gift options to offer and what data flows through them, and we process that data to deliver the service. Personal data belonging to your customers remains in your Shopify store, under Shopify's own data practices.

What we process

We process personal data to present gift options at the storefront and checkout, attach gift details to orders, and produce gifting analytics and reporting for you. Processing continues for as long as the App is installed, plus the deletion period described below. The data subjects are your customers and your staff who use the App.

The personal data we process is limited to:

• Shopify customer identifier (pseudonymous), linked to order and gifting metadata
• Buyer first and last name, read at checkout and not stored
• Your staff name, email address, and store domain
• Gifting attributes — the gift options and messages your customers select or write. These are stored on the Order record in your Shopify account and belong to you. In our own systems they are stored anonymously and used only to produce analytics and reporting.

We do not process your customers' email addresses, phone numbers, shipping or billing addresses, or payment details, and we do not process special category data.

Our commitments

As your processor, we commit to the following:

• We process personal data only on your instructions, as set out in this agreement and in your configuration of the App.
• Personnel with access to personal data are bound by confidentiality obligations and are granted access only as needed.
• We maintain appropriate technical and organisational security measures, including encryption in transit and at rest, role-based access control to production systems, tenant-level data separation, automated backups, and secrets management outside source code.
• We engage sub-processors only under written terms no less protective than these, and we remain responsible for their performance.
• We assist you in responding to data subject requests, taking into account the nature of the processing and the information available to us.
• We notify you without undue delay, and within 72 hours, of any personal data breach affecting your data, with the information available to us.
• On uninstall we delete or return your data at your choice, within 90 days of a written request.
• We provide the information needed to demonstrate compliance with this agreement and respond to reasonable security questionnaires.

Where data is processed

We are incorporated in Canada. Canada holds adequacy decisions from both the European Commission and the United Kingdom for commercial organisations subject to PIPEDA, so transfers of personal data from the EEA or the UK to us require no additional safeguards such as Standard Contractual Clauses. Our infrastructure is hosted in the United States. Onward transfers to sub-processors are covered by those providers' own transfer safeguards, including the EU–US Data Privacy Framework where applicable.

Sub-processors

We use the following third-party providers to deliver the App:

• Shopify Inc. — the underlying commerce platform and app framework (Canada, United States)
• Amazon Web Services, Inc. — application hosting, database, storage, and transactional email (United States)
• Intercom, Inc. — customer support messaging and help center (United States, Ireland)

We will give at least 30 days' notice before adding or replacing a sub-processor, and you may object on reasonable data protection grounds.

Data subject requests

Requests from your customers should be directed to you as the controller. Shopify's built-in customer data request and redaction flows apply to Wrapped, and we honour them automatically. If a data subject contacts us directly, we forward the request to you and do not respond substantively.

Changes

We may update this Data Processing Agreement from time to time. When we do, we will update the date at the top of this page. Continued use of the App after changes are posted means you accept the updated terms.

Contact us

If you have questions about this agreement or want to make a data request, email us at support+data-processing@alacartapps.co