Data Processing Addendum (DPA)

Version 1.0 · Updated 2 September 2026

This Data Processing Addendum ("DPA") forms part of the Merchant Terms of Service and applies where Soldio processes personal data on behalf of a merchant in connection with the App.

1. Parties

Processor: SOLDIO PTE. LTD. (Singapore), registered at DUO Tower, 3 Fraser Street #04-23A, Singapore 189352 ("Processor", "we", "us")
Controller: Merchant ("Controller", "you")

2. Definitions

"Personal Data" means any information relating to an identified or identifiable individual processed under this DPA. "Process/Processing" has the meaning given under applicable data protection laws.

3. Roles

For merchant customer personal data, the Merchant is the Controller and SOLDIO PTE. LTD. is the Processor.

4. Processing details

Subject matter and purpose. Provide clearance campaign functionality and campaign analytics to merchants.

Categories of data subjects

Merchant customers (as reflected in order-related data)
Merchant staff/admin users (as provided by Shopify during authentication)

Categories of personal data

Shop identifiers
Admin user identifiers and profile fields (name, email) as provided by Shopify
Order identifiers and timestamps
Product identifiers, quantities, and monetary totals for campaign analytics

The App is designed not to require customer name, email, phone, or address.

Processing operations

Receive and process order events to calculate campaign metrics
Store campaign configuration and aggregated analytics
Delete shop data upon merchant uninstall or privacy compliance request

5. Processor obligations

Processor will:

Process Personal Data only on documented instructions from Controller
Ensure personnel with access are subject to confidentiality obligations
Implement appropriate technical and organizational measures to protect Personal Data
Assist Controller with data subject requests, to the extent applicable and feasible

6. Security measures

Taking into account the state of the art and the risks of the processing, Processor implements appropriate technical and organisational measures pursuant to Article 32 of the GDPR, including:

Encryption of Personal Data in transit (TLS/HTTPS), including TLS-encrypted database connections
Encryption of Personal Data at rest using AES-256, applied to the primary database, replicas and all backups
Access controls and least-privilege infrastructure access
Avoidance of storing unnecessary customer identifiers
Logging practices designed to minimise inclusion of personal data
Use of infrastructure providers holding recognised security certifications (Render: ISO 27001, SOC 2 Type 2)
Periodic review of these measures

7. Subprocessors

Controller authorises Processor to use subprocessors necessary to provide the App. The current list is maintained on the Subprocessors page at legal.soldio.com/legal/subprocessors.

Processor will ensure each subprocessor is bound by data protection obligations no less protective than those in this DPA, and remains fully liable to Controller for the performance of each subprocessor's obligations.

Where Processor intends to add or replace a subprocessor, Processor will give Controller as much notice as is reasonably practicable and in any event at least 10 days' notice before the change takes effect. Controller may object on reasonable data-protection grounds during that period; if the objection cannot be resolved, Controller may terminate the affected part of the service.

8. International transfers

Personal Data is processed in the United States — application hosting and the database, error monitoring, and transactional email. The subprocessor used for each is named on the Subprocessors page referenced in section 7.

Processor is established in Singapore.

Where a subprocessor is certified under the EU–U.S. Data Privacy Framework (including its UK and Swiss extensions), transfers to that subprocessor rely on that certification. Sentry (Functional Software, Inc.) is so certified.

Standard Contractual Clauses (Modules Two and Three) and the UK International Data Transfer Addendum are already in force between Processor and its hosting subprocessor, Render Services, Inc., and are deemed executed under that subprocessor's data processing addendum.

8.1 Transfers from Controller to Processor

Singapore is not the subject of an adequacy decision under Article 45 of the GDPR. Accordingly, where Controller transfers Personal Data protected by the GDPR or the UK GDPR to Processor in Singapore, that transfer is made subject to the Standard Contractual Clauses as set out below.

"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

"UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B.1.0, issued by the UK Information Commissioner under s.119A(1) of the Data Protection Act 2018 and laid before the UK Parliament on 2 February 2022.

Modules. Where Controller acts as a controller and Processor acts as a processor, Module Two (controller to processor) applies. Where Controller acts as a processor on behalf of a third-party controller and Processor acts as a subprocessor, Module Three (processor to processor) applies. Controller is the data exporter and Processor is the data importer.

Completion of the Clauses. For each applicable Module:

the optional docking clause in Clause 7 does not apply;
in Clause 9, Option 2 (general written authorisation) applies, and the notice period for subprocessor changes is as set out in section 7 of this DPA;
in Clause 11, the optional language does not apply;
in Clause 13, all square brackets are removed and the text retained;
in Clause 17, Option 1 applies and the SCCs are governed by the law of Ireland;
in Clause 18(b), disputes are resolved before the courts of Ireland;
section 1 (Parties) and section 4 (Processing details) of this DPA contain the information required by Annex I;
section 6 (Security measures) of this DPA contains the information required by Annex II; and
the Subprocessors page referenced in section 7 contains the information required by Annex III.

United Kingdom. Where the UK GDPR applies, the SCCs incorporated above apply as amended and completed by the UK Addendum, which is incorporated by reference. Tables 1 to 3 of the UK Addendum are deemed completed with the corresponding information from this DPA, and Table 4 is deemed completed by selecting "importer".

Switzerland. Where the Swiss Federal Act on Data Protection applies, the SCCs apply with references to the GDPR read as references to that Act, references to EU member states read as references to Switzerland, and the Federal Data Protection and Information Commissioner as the competent supervisory authority.

Execution. The Parties agree that acceptance of the Terms of Service has the same effect as signing the SCCs, including their Annexes, and the same effect as signing the UK Addendum. No separate signature is required.

9. Personal data breach

Processor will notify Controller without undue delay after becoming aware of a personal data breach affecting Personal Data processed under this DPA. The notification will describe, to the extent known at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Processor will provide further information as it becomes available and will provide reasonable assistance to Controller in meeting its own notification obligations to supervisory authorities and data subjects.

Where the breach affects data received through the Shopify API, Processor will also notify Shopify within 24 hours of becoming aware of it.

Where Processor acts as a data intermediary under the Singapore Personal Data Protection Act 2012, Processor will notify the organisation on whose behalf it processes without undue delay, and will notify the Personal Data Protection Commission where required.

10. Retention and deletion

Processor retains Personal Data only as long as necessary for the purposes described.

On uninstall, settings and sessions are deleted immediately. Campaign and order records are deleted on receipt of Shopify's shop redaction request, which usually follows about 48 hours after uninstall.

11. Audit and accountability

On reasonable request, Processor will provide information reasonably necessary to demonstrate compliance with this DPA, subject to confidentiality and security constraints.

12. Governing law

This DPA forms part of the Merchant Terms of Service and is governed by the same law and subject to the same jurisdiction as those Terms (Singapore), except where applicable data protection law requires otherwise.

13. Contact

Privacy contact: support@soldio.com