Data processing agreement

1. Parties and roles

This data processing agreement (“DPA”) is between the business that installs Marka Cart Drawer on a Shopify store (“you”, the controller) and Marka Modern Retail Private Limited (“we”, the processor). For personal data of your store’s customers and visitors, you decide why and how it is processed by choosing to use the app and configuring it; we process it only to provide the app to you. Shopify is not a party to this DPA: data reaches us through Shopify’s APIs under Shopify’s own terms with you.

Where the Digital Personal Data Protection Act, 2023 (India) applies, you are the Data Fiduciary and we are your Data Processor. Where US state privacy laws apply (for example the California Consumer Privacy Act), we act as your service provider or processor: we do not sell or share the personal data, and we do not retain, use or disclose it outside our direct business relationship with you or combine it with data from other stores.

Data about you and your staff as our customer (account and billing details) is handled by us as a controller, as described in the privacy policy.

If this DPA and the terms of service conflict on data protection, this DPA prevails.

2. Subject matter, duration, nature and purpose

Subject matter: providing the Marka Cart Drawer app for your store. Duration: while the app is installed, plus the deletion periods in section 5. Nature: receiving data from Shopify’s APIs and the storefront, storing it encrypted, analysing it to personalise your store’s cart, offers and recommendations, measuring results, and deleting it. Purposes: those listed in the privacy policy, section 5 — nothing else.

3. Categories of data subjects

• Your store’s customers and the visitors of your online store.
• Your staff users who open the app in your Shopify admin.

4. Categories of personal data

• Shopify customer IDs, orders of the last 60 days and their line items, order counts, amount spent, customer-since date and country (Shopify protected customer data, Level 1).
• Email address, phone number and address of your customers (Shopify protected customer data, Level 2), kept encrypted with a key unique to your store. Names are not processed.
• Storefront and cart events (products viewed, added and removed, offers seen and accepted) with pseudonymous session identifiers.

No special categories of personal data are intended to be processed. Details: privacy policy, section 4.

5. Our obligations

• Instructions. We process the personal data only on your documented instructions — these terms and the way you configure the app — unless the law requires otherwise, in which case we tell you first where the law allows. We tell you if we believe an instruction breaks data protection law.
• Confidentiality. Everyone we authorise to process the personal data is bound by confidentiality.
• Security. We apply the technical and organisational measures in Annex II and keep them up to date.
• Sub-processors. You give a general authorisation for the sub-processors in Annex III. We tell you at least 30 days before adding or replacing one (in the app or by email); you may object on reasonable data protection grounds, and if we cannot resolve the objection you may end the agreement by uninstalling the app. We impose the same data protection obligations on every sub-processor and remain responsible for them.
• Data subject requests. Shopify forwards your customers’ access and deletion requests to us through its compliance webhooks; we delete the data on customers/redact and prepare an encrypted file for customers/data_request, which you download in the app under Settings → Privacy requests (kept 30 days). We help you, as far as reasonably possible, with other requests, data protection impact assessments and consultations with supervisory authorities.
• Personal data breaches. We notify you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your store’s data, with the information you need for your own notifications: its nature, the categories and approximate number of people and records concerned, the likely consequences and the measures taken or proposed. We update you as we learn more.
• Deletion. When you uninstall the app we delete your customers’ contact details at once and all other personal data of your store 30 days later, or earlier on Shopify’s shop/redact request. Encrypted database backups expire within 7 days. Retention while the app is installed: privacy policy, section 10.
• Audits. On request we give you the information needed to show that we meet this DPA. Where that is not enough, you may audit our compliance once a year, on 30 days’ written notice, at your cost, under confidentiality, without access to other customers’ data; an independent auditor bound by confidentiality may do so for you.

6. International transfers

The app and its data are hosted by Microsoft Azure in the United States (North Central US (Illinois, United States)). Our team operates the service from India and may access the systems remotely to run and support it.

When personal data from the European Economic Area is transferred to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), Module 2 (controller to processor), are incorporated into this DPA by reference, with you as data exporter and us as data importer. The optional docking clause (clause 7) does not apply; under clause 9 option 2 (general written authorisation) applies with the notice period in section 5; the optional wording in clause 11 does not apply; clauses 17 and 18: the law and courts of Ireland. Annexes I to III of the clauses are completed by sections 1 to 4 and Annexes II and III of this DPA.

For personal data from the United Kingdom, the UK International Data Transfer Addendum to those clauses applies; for personal data from Switzerland, the clauses apply with the changes the Swiss Federal Act on Data Protection requires (references to the GDPR read as references to that Act, and the Swiss Federal Data Protection and Information Commissioner as the competent authority where it supervises the transfer). If the clauses and this DPA conflict, the clauses prevail.

7. Liability and term

Each party’s liability under this DPA is subject to the limits in the terms of service, except where the law or the Standard Contractual Clauses do not allow a limit. This DPA lasts as long as we process personal data for your store. To receive a copy signed by us, write to tech@houseofmarka.com.

Annex II — Technical and organisational measures

• Encryption in transit (TLS) for every connection to and from the app; database connections require TLS.
• Encryption at rest by Microsoft Azure for the database, its logs and backups; your customers’ email addresses, phone numbers and addresses and the data-request files are additionally encrypted with AES-256-GCM using a key unique to your store, derived (HKDF-SHA256) from a master key held in Azure Key Vault, separately from the database.
• Matching the same customer across records and grouping customers by area use one-way keyed codes unique to your store, without decrypting contact details; an area is only used when at least 5 different customers of your store are in it.
• Contact details are decrypted only to answer a data request, and every decryption is first written to an access log (purpose, fields, actor and time; kept 1 year).
• Individual customers’ data is not displayed in the merchant admin and cannot be browsed or exported there.
• Each store’s data is separated by store; data of one store is never used for another store.
• Services use managed identities: no passwords or keys in code or container images; secrets are kept in Azure Key Vault.
• Access to production systems is limited to the people who run the service.
• Separate test and production environments, databases and keys; test stores use generated demo customers.
• Automatic daily backups with point-in-time restore, encrypted at rest and kept 7 days; nightly jobs enforce the retention periods.
• A documented security incident response process, including notification of affected merchants.

Annex III — Sub-processors

Shopify is the platform your store runs on and the source of the data; it acts under its own agreement with you and is not our sub-processor.

Contact