Peci: Revenue Radar — Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service for the Peci: Revenue Radar application ("App") and is entered into between:

PÉCI Kft., Aradi utca 5., 2119 Pécel, Hungary (Cg. 13-09-089813; EU VAT HU12761609) ("Processor", "we", "us"); and

the Merchant — the Shopify store owner who installs the App ("Controller", "you").

You accept this DPA together with the Terms of Service, in the acceptance step the App shows after installation and before its first use (Terms of Service, Section 3A). It is incorporated by reference into the Terms of Service and, on any question of data protection, prevails over the Terms of Service, the Privacy Policy and the Cookie Policy.

---

1. Definitions

Terms not defined here carry the meaning given in Regulation (EU) 2016/679 ("GDPR").

• "Customer Personal Data" — personal data relating to the Controller's end-customers that the Processor processes on the Controller's behalf under this DPA, as specified in Annex 1.
• "Sub-processor" — a third party engaged by the Processor to process Customer Personal Data.
• "Applicable Data Protection Law" — the GDPR, the UK GDPR, the Hungarian Act CXII of 2011 on Informational Self-Determination (Infotv.), and the US state privacy laws listed in Section 12, each as applicable.
• "Shopify" — Shopify Inc. and its affiliates, the platform on which both parties operate. Shopify is not a Sub-processor of the Processor; see Section 6.3.

2. Roles of the parties

2.1 In respect of Customer Personal Data, the Controller is the controller and the Processor is the processor (GDPR Art.4(7)–(8)).

2.2 In respect of Merchant account, billing and usage data, the Processor acts as an independent controller. That processing is governed by the Privacy Policy, not by this DPA.

2.3 The Controller is responsible for establishing and maintaining a lawful basis for the processing it instructs, and for providing the notices its own customers are entitled to.

3. Subject-matter, duration, nature and purpose

3.1 Subject-matter and purpose. Recording storefront cart and checkout events through the App's Shopify Web Pixel and showing the Controller, in aggregated and bot-filtered form, where carts and checkouts are abandoned; and, while the Controller is on the free plan, counting the distinct visitors of the Controller's store each month against that plan's monthly visitor threshold, which is part of the service the Controller instructs. Both are further specified in Annex 1.

3.2 Duration. For as long as the App is installed, plus the retention periods set out in Annex 1.

3.3 Nature of processing. Collection, storage, structuring, aggregation, retrieval, disclosure to the Controller by transmission (Section 9.3) and erasure.

3.4 Categories of data subject and personal data. As set out in Annex 1.

4. Processor obligations

The Processor shall:

4.1 Process only on documented instructions from the Controller, including as to international transfers, unless required otherwise by Union or Member State law to which the Processor is subject or, where the UK GDPR applies, by the law of the United Kingdom; in that case the Processor shall inform the Controller before processing, unless that law prohibits it on important grounds of public interest. The Controller's documented instructions consist of this DPA, the Terms of Service, the App's configuration settings, and any further written instruction the parties agree. The Processor processes Customer Personal Data only for the purpose set out in Section 3.1.

4.2 Immediately notify the Controller if, in the Processor's opinion, an instruction infringes Applicable Data Protection Law (GDPR Art.28(3), final paragraph).

4.3 Ensure confidentiality. Personnel authorised to process Customer Personal Data are bound by contractual or statutory confidentiality obligations and process it only on the Controller's instructions (GDPR Art.32(4)).

4.4 Implement Art.32 security measures, as described in Annex 2.

4.5 Respect the conditions for engaging Sub-processors set out in Section 6.

4.6 Assist the Controller with data-subject requests, as set out in Section 7.

4.7 Assist the Controller with GDPR Art.32–36 obligations (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of processing and the information available to the Processor.

4.8 Delete or return Customer Personal Data at the end of the provision of services, and delete existing copies, as set out in Section 9.

4.9 Make available all information necessary to demonstrate compliance with Art.28, and allow for and contribute to audits, as set out in Section 10.

5. Controller obligations

5.1 The Controller warrants that it has a lawful basis for the processing it instructs, and that it has provided its customers with any notice required by Applicable Data Protection Law, including notice that the App is installed on its store.

5.2 Where the Controller's jurisdiction requires consent for any processing carried out through the App, the Controller is responsible for obtaining it. The App's Web Pixel declares the analytics purpose only, and Shopify runs it only where the store's customer privacy settings permit analytics for the visitor. The App does not read consent or opt-out signals itself. The Controller is responsible for configuring those settings, including whether and where its store asks visitors for consent, as its jurisdiction requires; whether the pixel runs for a visitor depends on them.

6. Sub-processors

6.1 General authorisation. The Controller grants the Processor general written authorisation to engage Sub-processors, subject to this Section.

6.2 Current Sub-processors at the effective date:

Sub-processor	Role	Data shared	Region	Transfer safeguard
Vercel Inc.	Application hosting, edge delivery and application logs	All data in transit; transient IP addresses at the edge; application and request logs, including the IP address and user agent of each request, kept for up to 30 days	United States	EU–US Data Privacy Framework and/or Standard Contractual Clauses
Databricks, Inc. (Neon)	PostgreSQL database hosting (Neon, provisioned via Vercel Marketplace)	All persisted data	United States (AWS us-east-1)	Databricks EU–US Data Privacy Framework certification, which covers Neon; SCCs as fallback
Amazon Web Services (Amazon Simple Email Service)	Delivery of the e-mails the App sends to the Controller: the answer to a customers/data_request and the copy of Customer Personal Data under Section 9.3	Those e-mails, in transit only: the copy, and the answer, which carries Shopify's request identifier that Shopify can link to the requesting customer (Section 9.2)	eu-west-1 (Ireland, EU)	Processed within the EU; no third-country transfer for this processing
Zoho Corporation B.V., the Netherlands (Zoho Mail)	E-mail hosting for the Processor's e-mail addresses	Any request a data subject sends the Processor directly (Section 7.2), and the Controller's requests under Section 7.4 with the identifiers they contain and the Processor's answers	European Union (Zoho's EU data centre)	Processed in Zoho's EU data centre

6.3 Shopify is not a Sub-processor. Shopify is the independent platform on which both parties operate and, in respect of storefront customer data, acts as an independent controller under its own terms. Data reaches the App from Shopify; Shopify does not process on the Processor's instruction.

6.4 Changes. The Processor shall give the Controller at least 30 days' prior notice, by email to the store's contact e-mail address, of any intended addition or replacement of a Sub-processor. The Controller may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the Controller may terminate the affected part of the service by uninstalling the App, with a pro-rata refund of any prepaid fees for the unused period.

6.5 Flow-down and liability. The Processor shall impose on each Sub-processor, by written contract, data-protection obligations no less protective than those in this DPA, and remains fully liable to the Controller for the Sub-processor's performance.

7. Data-subject requests

7.1 The App implements Shopify's mandatory GDPR webhooks. Requests routed through Shopify (customers/data_request, customers/redact, shop/redact) are handled automatically, as described in Annex 1.

7.2 Where a data subject contacts the Processor directly, the Processor shall not respond on the substance but shall refer the data subject to the Controller and inform the Controller without undue delay.

7.3 Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller's obligation to respond to requests under GDPR Chapter III.

7.4 Requests by identifier. The App cannot match a request routed through Shopify to the storefront events it holds (Annex 1). Where the Controller sends privacy@peci.io a customer's checkout token or Shopify's visitor identifier (clientId) and asks for access to, or erasure of, the data held for it, the Processor shall, within 14 days of the request, either send the matching records as a machine-readable (JSON) file to the store's contact e-mail address, or delete them, as the Controller asks, and shall tell the Controller which records it found. Such records exist only within the retention periods in Annex 1: storefront events for 30 days, and, for a visitor identifier, the monthly visitor count of the current and the previous month. For an identifier outside those periods there is nothing to provide or delete, and the Processor says so.

8. Personal data breach

8.1 The Processor shall notify the Controller without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data.

8.2 The notification shall describe, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point for further information. Where the information cannot be provided at once, it shall be provided in phases without undue further delay.

8.3 Notification is not an acknowledgement of fault or liability.

9. Deletion and return of data

9.1 On uninstall or shop/redact. The Processor purges Merchant and shop personal data and all Shopify access tokens within 30 days of the triggering event. On uninstall the access tokens are deleted at once; the remaining data is deleted when Shopify's shop/redact webhook arrives (typically 48 hours after the uninstall), or, if it does not arrive, by the scheduled cleanup 30 days after the uninstall. This is subject to the exceptions set out in this Section, which set out everything within this DPA that is not purged at once. Records that the Processor keeps longer as its own records, as controller, are governed by the Privacy Policy, not by this DPA: the record of the Controller's acceptance of the Terms of Service, for 5 years after uninstall (Section 2.2 of this DPA); the records of GDPR webhook handling (Section 9.2); and requests sent to the Processor directly (Section 9.6).

9.2 Retained compliance records. The App keeps an event log (AuditLog). Its ordinary operational entries are retained for 90 days and are deleted on shop/redact, or, if that webhook does not arrive, 30 days after the uninstall. Three entry types are the exception: the records of GDPR webhook handling (customers/data_request, customers/redact, shop/redact), which are retained for 3 years and survive a shop redaction. The Processor keeps these entries for that period as its own records, as controller, solely to be able to demonstrate that the requests were handled, and uses them for no other purpose; that retention is governed by the Privacy Policy (Section 5). These entries hold Shopify's own request identifiers (the webhook id and the data-request id) and row counts; they carry no customer or visitor identifier. Shopify can link its request identifiers to the customer who made the request; the Processor cannot. The shop domain does remain in them, which is a business identifier of the Controller. No operational entry carries a customer or visitor identifier.

9.3 Return. The App has no self-service export of Customer Personal Data. Before uninstalling, the Controller may request a copy of its data (the categories in Annex 1) by email to privacy@peci.io. The Processor sends the copy only to the store's contact e-mail address, and otherwise asks for confirmation first. It provides the copy as a machine-readable (JSON) file, without access tokens, within 30 days. Uninstalling the App is the Controller's instruction to delete under Section 9.1; after deletion, return is no longer possible.

9.4 Restore history. The database Sub-processor keeps a point-in-time restore history of 24 hours. Data deleted under this Section can therefore remain restorable for up to 24 hours after its deletion.

9.5 Request logs. The hosting Sub-processor's request log records the IP address and user agent of each storefront request to the App and keeps them for up to 30 days (Section 6.2). These entries are not deleted on shop/redact; they expire within 30 days of the request. The copy of the production logs on the Processor's own server holds neither the IP address nor the user agent and is kept for 14 days (Privacy Policy, Section 5).

9.6 Requests sent to the Processor directly. A request a data subject sends the Processor directly (Section 7.2), and the Processor's reply, are kept in the Processor's mailbox until the matter is closed and then for 5 years, as the Processor's own record, as controller, solely to be able to show how the request was handled. That retention is governed by the Privacy Policy (Section 5). The records the Processor sends under Section 7.4 are not kept after they are sent.

10. Audit

10.1 The Processor shall make available to the Controller all information necessary to demonstrate compliance with GDPR Art.28, on written request and no more than once per twelve-month period, unless required more frequently by a supervisory authority, following a personal data breach, where the Controller has reasonable grounds to suspect non-compliance, or where the Controller needs the information to answer a request of a data subject or of a supervisory authority, or otherwise to demonstrate its own compliance under Applicable Data Protection Law.

10.2 The Processor may satisfy this obligation by providing its security documentation and, where available, third-party certifications or audit reports of its Sub-processors.

10.3 On-site audits shall be at the Controller's expense, on at least 30 days' written notice, during business hours, subject to confidentiality undertakings, and conducted so as not to disrupt the Processor's business or the confidentiality of other customers' data.

11. International transfers

11.1 Customer Personal Data is hosted in the United States by the hosting and database Sub-processors (Vercel and Neon, Section 6.2). The e-mail delivery service listed there (Amazon Simple Email Service) processes the e-mails sent to the Controller (Section 6.2) within the European Union (AWS Region eu-west-1), and the e-mail host processes any request a data subject sends the Processor directly within the European Union.

11.2 Transfers are made under the EU–US Data Privacy Framework where the recipient is certified, and otherwise under the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Three (processor to processor), concluded between the Processor and the Sub-processor; by accepting this DPA, the Controller authorises these transfers. Where the Controller is established outside the European Economic Area, Customer Personal Data that the Processor returns or sends to the Controller (including a copy under Section 9.3) is transferred under Module Four (processor to controller) of the same Clauses, which are incorporated into this DPA by reference.

11.3 Where the UK GDPR applies, the UK International Data Transfer Addendum to the SCCs applies.

11.4 The Processor shall conduct and document transfer impact assessments as required, and shall notify the Controller if it becomes unable to comply with this Section.

12. United States state privacy terms

12.1 This Section applies where the Controller is subject to the California Consumer Privacy Act as amended ("CCPA"), or to the consumer privacy statutes of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or other US states with materially similar processor/service-provider requirements.

12.2 Service provider / processor status. The Processor acts as a "service provider" (CCPA) or "processor" (other states) with respect to Customer Personal Data.

12.3 Restrictions (CCPA §1798.140(ag), §7051 of the CCPA Regulations). The Processor shall not:

• sell or share Customer Personal Data;
• retain, use or disclose it for any purpose other than the specific business purposes of measuring storefront cart and checkout abandonment and reporting it to the Controller, and counting distinct monthly visitors on the free plan, as described in Annex 1, or as otherwise permitted by the CCPA;
• retain, use or disclose it outside the direct business relationship between the parties;
• combine it with personal data received from another source, or collected from its own interaction with the consumer, except as permitted by the CCPA.

12.4 The Processor certifies that it understands and will comply with the restrictions in Section 12.3. The Processor shall comply with all applicable sections of the CCPA and its regulations with respect to Customer Personal Data, and shall provide the same level of privacy protection as the CCPA requires of the Controller (11 CCR §7051(a)(5)).

12.5 The Processor shall notify the Controller if it determines it can no longer meet its obligations under Applicable Data Protection Law, and the Controller may take reasonable steps to stop and remediate unauthorised use.

12.6 Controller's right to verify. The Controller may take reasonable and appropriate steps to ensure that the Processor uses Customer Personal Data consistently with the Controller's obligations under the CCPA, including the information and audit rights in Section 10, which apply to CCPA compliance as they apply to GDPR Art.28 (11 CCR §7051(a)(6)).

12.7 Deidentified data. Where the Processor holds deidentified data, it shall maintain it in deidentified form and shall not attempt to reidentify it.

12.8 Other US state laws. Where the Controller is subject to a US state law named in Section 12.1, Sections 4.7, 7.3 and 10 apply to the Controller's obligations under that law as they apply under the GDPR. In particular, the Processor assists the Controller in responding to consumer requests and in conducting data protection assessments, and makes available, on the Controller's reasonable request, the information necessary to demonstrate compliance with the processor obligations of that law.

12.9 Assessments. The Controller, or an assessor it designates, may conduct reasonable assessments under Section 10.3. Alternatively, the Processor may arrange, at its own cost, for a qualified and independent assessor to assess its policies and technical and organisational measures against an appropriate and accepted control standard, at least once a year, and provides the report to the Controller on request.

12.10 Security duties. The Processor is responsible for the security of the App and its infrastructure, as described in Annex 2. The Controller is responsible for the security of its Shopify store and of access to its store account.

12.11 Subcontractors. Section 6 applies to any subcontractor the Processor engages to process Customer Personal Data under the CCPA: the Controller is notified under Section 6.4, and each subcontractor is bound by written contract to the restrictions in Section 12.3.

13. Liability and order of precedence

13.1 Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except that nothing in this DPA or the Terms of Service limits either party's liability toward a data subject under GDPR Art.82, or any other liability that cannot lawfully be excluded or limited.

13.2 In the event of conflict, this DPA prevails over the Terms of Service, the Privacy Policy and the Cookie Policy on any question of data protection.

14. Term and termination

14.1 This DPA takes effect when the Controller accepts the Terms of Service in the App and continues until the App is uninstalled and the deletion obligations in Section 9 are complete.

14.2 Sections that by their nature should survive termination — including Sections 4.3, 8, 9, 10, 12.3, 12.7 and 13 — survive.

14.3 Changes. Changes to the list of Sub-processors in Section 6.2 follow Section 6.4; other changes to this DPA follow Section 24 of the Terms of Service.

15. Governing law

15.1 This DPA is governed by Hungarian law, and the courts identified in the Terms of Service have jurisdiction.

---

ANNEX 1 — Details of processing

Categories of data subject: visitors of the Controller's Shopify store who add a product to the cart, view the cart, or start or complete checkout, where the store's customer privacy settings permit analytics for them. For this DPA, the Controller's end-customers include every visitor of the store, whether or not they place an order.

Categories of personal data:

Category	Field(s)	Purpose	Retention
Storefront event	Event type, the event's own identifier, the time it occurred and the time it was received; Shopify's pseudonymous visitor identifier (clientId); a session key built from that identifier and the calendar day; checkout token; currency, subtotal and total; products involved (product and variant ID, product title, price, quantity) (PixelEvent)	Measuring where purchases are abandoned	30 days; deleted on shop/redact
Bot assessment	A one-way hash of the user agent together with the shop domain; a bot score and its reasons (PixelEvent). The raw user agent, the screen size and the cookie flag sent with the event are used for the score and not stored; the recorded reasons name which of them indicated automation	Excluding automated traffic	As the storefront event
Monthly visitor count	Pseudonymous visitor identifier, month, first and last time seen (VisitorMonth)	Counting distinct visitors per month against the free plan's monthly visitor threshold, only while the Controller is on the free plan (Section 3.1); used for no other purpose	The current and the previous month; deleted on shop/redact
Daily figures	Per-day and per-product totals; no visitor identifier (ProductFunnelDaily, ShopFunnelDaily)	The Controller's dashboard	Until shop/redact, or 30 days after the uninstall if that webhook does not arrive
Request log	The IP address and user agent of each storefront request, in the hosting Sub-processor's request log (not in the App's database)	Operating and securing the App	Up to 30 days (Section 9.5)

Data NOT stored: customer names, email addresses, postal addresses, telephone numbers, payment data. Shopify's mandatory privacy webhooks deliver the customer's e-mail address and phone number with each request; the App stores neither. It reads Shopify's request identifiers and, for customers/redact, the customer id, which it passes to the handler without storing or logging it.

Data received but NOT stored: the raw user agent, the screen size and whether cookies are enabled (used once, at intake, for the bot assessment above); the discount amount and the number of items in the cart (discarded unused); IP addresses, which the App does not store (the hosting provider's request log records them, Section 9.5). The pixel does not send the page referrer. The App's Shopify access scopes (write_pixels, read_customer_events) give it no access to customer records or orders.

Special categories of data: none. The Controller shall not instruct processing of special-category data through the App.

Automated GDPR webhook handling:

Shopify webhook	Processor action
customers/data_request	The App holds no record keyed to a customer account or an order and cannot link Shopify's pseudonymous visitor identifier to one, so there is no record to compile. A compliance entry records Shopify's request ids only. The App answers the Controller automatically, once per request, by e-mail to the store's contact e-mail address, confirming that it holds no record linked to the customer's account or orders; if it cannot be sent at once, the App retries until it is sent, unless the shop's data has been deleted in the meantime. Records held for a checkout token or visitor identifier the Controller provides are handled under Section 7.4
customers/redact	For the same reason, the request matches no record and nothing is deleted on receipt; all storefront events are deleted after 30 days and monthly visitor counts after two months in any case. One compliance entry is written, carrying the request id and counts only. Records held for a checkout token or visitor identifier the Controller provides are handled under Section 7.4
shop/redact	Purge all shop data and access tokens and the operational event-log entries. The GDPR compliance entries are retained (Section 9.2)

ANNEX 2 — Technical and organisational measures (Art.32)

• Encryption in transit: TLS for all connections between the storefront, the App and the database.
• Encryption at rest: provided by the database Sub-processor.
• Resilience: managed hosting with the availability characteristics of the Sub-processors named in Section 6.2.
• Access control: access to production data is limited to authorised personnel, is authenticated, and is used only on the Controller's instructions under a confidentiality obligation; Shopify access tokens are stored server-side only and are never exposed to the storefront.
• Authentication: the App authenticates to Shopify with OAuth session tokens; webhook payloads are verified by HMAC and rejected if the signature does not match.
• Event intake: the event collector rejects events for shops that have not installed the App; it does not authenticate the sender of an event, so the figures can include events that do not come from the pixel.
• Minimisation: the pixel copies event data through a fixed list of fields and never copies the checkout's e-mail, phone, addresses or marketing flags; the user agent is reduced to a hash at intake; no customer names, email addresses or payment data are processed.
• Restoration: the database Sub-processor provides point-in-time restore of the database to any moment within the preceding 24 hours.
• Testing: automated test suites run on every change; deletion and redaction paths are covered by tests.
• Retention enforcement: a scheduled job, every four hours, removes expired records.

Further information on residual risks and compensating measures is available to the Controller on request (Section 10).