DATA PROCESSING AGREEMENT

Last updated October 24, 2026

This Data Processing Agreement ("DPA") forms part of the agreement between Opclera Systems LLC, a Texas limited liability company ("Opclera", "we", "us"), and the merchant that installs or uses one of our Shopify apps (the "Merchant", "you"), consisting of the app's terms of service as accepted through the Shopify App Store (the "Agreement"). It applies whenever we process Customer Personal Data on your behalf in providing an app (the "Services"). If this DPA conflicts with the Agreement, this DPA prevails for the processing of Customer Personal Data.

You accept this DPA by installing or using one of our apps; nothing needs to be signed.

1. DEFINITIONS

• Data Protection Laws: all laws on privacy and personal data that apply to the processing under this DPA, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), the California Consumer Privacy Act as amended by the CPRA ("CCPA"), and other US state privacy laws, each as amended.
• Customer Personal Data: personal data about your customers (and your staff, where relevant) that we process on your behalf through the Services, as described in Annex I.
• Controller, processor, data subject, personal data, processing, personal data breach, supervisory authority: as defined in the GDPR. For the CCPA, "controller" includes "business" and "processor" includes "service provider."
• Subprocessor: a third party we engage to process Customer Personal Data.
• Standard Contractual Clauses ("SCCs"): the clauses approved by the European Commission in Implementing Decision (EU) 2021/914, Module Two (controller to processor).

2. ROLES

You are the controller of Customer Personal Data and we are your processor. You are responsible for having a lawful basis for the processing and for giving your customers the notices the law requires. This DPA does not cover personal data about you as our customer (for example, your account and billing contact), which we process as a controller under our Privacy Policy.

3. OUR OBLIGATIONS AS PROCESSOR

We will:

• Follow your instructions. Process Customer Personal Data only on your documented instructions, which are the Agreement, this DPA and your use and configuration of the Services, unless the law requires otherwise; in that case we will tell you first unless the law forbids it. We will tell you if we believe an instruction breaks Data Protection Laws.
• Keep it confidential. Ensure that anyone we authorize to process Customer Personal Data is bound by confidentiality.
• Keep it secure. Apply the technical and organizational measures in Annex II, as required by GDPR Article 32.
• Use subprocessors only as allowed by Section 4.
• Help with data subject requests. Considering the nature of the processing, help you answer requests from your customers to exercise their rights (access, correction, deletion, portability, objection), including the requests Shopify sends us through its mandatory privacy webhooks. If a request comes to us directly, we will pass it to you and not answer it ourselves unless you tell us to.
• Help with your other obligations. Give you reasonable help with security, breach notifications, data protection impact assessments and consultations with supervisory authorities (GDPR Articles 32 to 36), considering the information available to us.
• Delete it at the end as set out in Section 6.
• Show compliance. Make available the information reasonably needed to demonstrate compliance with this DPA, and allow audits as set out in Section 7.

4. SUBPROCESSORS

You give us general authorization to engage subprocessors. Our current subprocessors are listed in Annex III.

We will tell you at least 30 days before adding or replacing a subprocessor, by updating Annex III on this page and by email to your store's contact email. You may object on reasonable data protection grounds within that period; if we cannot reasonably address the objection, you may stop using the affected app, and this is your sole remedy.

We impose on each subprocessor data protection obligations no less protective than this DPA, and we remain responsible to you for its performance.

5. PERSONAL DATA BREACHES

We will notify you without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as known, the nature of the breach, the categories and approximate numbers of data subjects and records, the likely consequences, and the measures taken or proposed. We will provide further information as it becomes available and take reasonable steps to contain the breach. Our notice is not an admission of fault.

6. DELETION

When you uninstall an app, Shopify sends us a shop deletion request (the shop/redact webhook, sent 48 hours after uninstall). We delete the Customer Personal Data held for your store within 30 days of receiving it. Our database backups are kept for 30 days, so deleted data leaves them within a further 30 days. Customer-level deletion requests (customers/redact) are handled the same way for the customer concerned. We may keep data only where the law requires it, and then keep it confidential and process it for no other purpose.

7. AUDITS

You may ask us in writing for information about our compliance with this DPA, and we will answer within a reasonable time, including by completing a reasonable security questionnaire once a year. Where the law or a supervisory authority requires more, you may audit our compliance, at your cost, on at least 30 days' notice, no more than once in any 12 months, during normal business hours, in a way that does not disrupt our business or breach our obligations to other customers, and subject to confidentiality.

8. INTERNATIONAL TRANSFERS

We are located in the United States and process Customer Personal Data in the United States and on our subprocessors' networks (see Annex III).

EU/EEA: where Customer Personal Data is transferred from the EEA to us, the SCCs, Module Two, are incorporated into this DPA by reference, with you as data exporter and us as data importer, and with these choices: Clause 7 (docking clause) applies; Clause 9(a) Option 2 (general written authorization, with the notice period in Section 4); the optional wording in Clause 11(a) does not apply; Clause 13: the supervisory authority determined under Clause 13(a); Clause 17: the law of Ireland; Clause 18(b): the courts of Ireland. Annexes I, II and III of this DPA complete Annexes I, II and III of the SCCs.

United Kingdom: for transfers from the UK, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner applies, completed with the information in this DPA; either party may end it as allowed by its Section 19.

Switzerland: for transfers from Switzerland, the SCCs apply as amended so that references to the GDPR mean the FADP, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner, and "Member State" includes Switzerland.

If the SCCs conflict with this DPA, the SCCs prevail.

9. US STATE PRIVACY LAWS

Where the CCPA or a similar US state law applies, we act as your service provider (or processor) and will not: (a) sell or share Customer Personal Data; (b) retain, use or disclose it for any purpose other than providing the Services, including any commercial purpose other than the Services; (c) retain, use or disclose it outside our direct business relationship with you; or (d) combine it with personal data we receive from others or collect ourselves, except as the law allows. We will notify you if we can no longer meet our obligations under these laws. You may take reasonable steps to stop and remedy unauthorized use.

10. SHOPIFY PROTECTED CUSTOMER DATA

We access Shopify protected customer data only where an app needs it, and only the fields Shopify has approved for that app. We meet Shopify's protected customer data requirements, including data minimization, encryption in transit and at rest, access limits and retention limits.

11. GENERAL

This DPA lasts as long as we process Customer Personal Data for you. Sections that by their nature should survive (including Sections 5, 6 and 9) survive its end.

Each party's liability under this DPA is subject to the limits of liability in the Agreement, except where Data Protection Laws or the SCCs do not allow such a limit.

We may update this DPA to reflect changes in law or in our Services. We will post the new version on this page with a new "Last updated" date and, for changes that materially reduce your protection, tell you at least 30 days in advance.

Questions about this DPA: opclera.com/contact.

ANNEX I: DESCRIPTION OF THE PROCESSING

ANNEX II: TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

• Encryption: all traffic over HTTPS (TLS); data hosted on Cloudflare, which encrypts data at rest.
• Access control: production data reachable only by Opclera's owner, through accounts protected by multi-factor authentication; no shared passwords; secrets kept in the hosting platform's secret store, never in code.
• Isolation: each store's data is kept separate and every query is scoped to the store.
• Minimization: apps request the fewest Shopify permissions and protected-data fields they need, and read customer data from Shopify when needed instead of storing it.
• Verification: every Shopify webhook and request is verified (HMAC and session tokens) before it is processed.
• Monitoring: apps log errors and actions to a private event log that holds store domains and Shopify order IDs only; email addresses and phone numbers are masked, and customer names and addresses are never written to it.
• Backups and recovery: point-in-time recovery of the databases for 30 days; restore procedures documented.
• Deletion: automated handling of Shopify's mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact).
• Development: code in private repositories, automated checks before release, dependency security alerts and secret scanning.
• Incidents: a documented breach response, with notice to Merchants as in Section 5.

ANNEX III: SUBPROCESSORS