This Data Processing Agreement (the "DPA") forms part of the Terms of Service between Lusitanian Heritage LLC, a limited liability company registered in the State of Florida, United States (542 Washington Avenue, 39, Miami Beach, FL 33139), trading as Norma Media("we", "us", the "Processor"), and the client who uses the Platform ("you", the "Controller").
It applies where you connect a Shopify store to the Platform and we therefore process personal data on your behalf. It is entered into automatically when you connect a store, and no signature is required. Where this DPA conflicts with the Terms of Service, this DPA prevails in respect of the processing of personal data.
It reflects Article 28(3) of Regulation (EU) 2016/679 ("GDPR"), and applies equally where UK or other equivalent data protection law governs the processing.
1. Roles of the parties
In respect of store data obtained through Shopify, you are the controller and we are the processor. You determine the purposes and means of the processing; we process that data only on your documented instructions.
Your instructions are given by connecting your store, by selecting the permissions you grant during that connection, and by your use of the Platform. This DPA and the Terms of Service constitute your complete and final instructions. If we consider an instruction to infringe applicable data protection law, we will inform you without undue delay.
We are a separate and independent controller in respect of your own account data — the name and email address of the people who use the Platform, and our billing records. That processing is described in our Privacy Policy and is not governed by this DPA.
2. Subject matter, duration, nature and purpose
Subject matter and nature.Reading order and catalogue data from your Shopify store through Shopify's Admin API, storing it, and deriving reporting from it.
Purpose.To report your store's revenue and attribute it to the Google Ads campaigns we manage for you, and to derive the campaign metrics shown in the Platform — return on ad spend, average order value and return rate. We process this data for no other purpose. We do not use it to train models, to build audiences, to profile individuals, or for our own marketing.
Duration. For as long as your store remains connected, subject to the deletion periods in section 8.
3. Personal data and data subjects
Categories of data subjects: your customers, and visitors to your store who subsequently placed an order.
Types of personal data: order records, comprising order identifiers and dates, order status, order and refund totals, currency, shipping country, the products and quantities in each order, and the UTM parameters and landing pages of the visits preceding the purchase. We also process aggregated sales figures, which do not relate to identified individuals, and product and collection names, which are not personal data.
We do not process the names, email addresses, telephone numbers or street addresses of your customers, nor their IP addresses, geolocation or device information. We place no pixel, script or cookie on your storefront. No special categories of personal data within the meaning of Article 9 GDPR are processed.
Shopify requires applications that use its reporting API to hold what it calls "Level 2" protected customer data access, a level defined by reference to customer name, address, telephone and email fields. That requirement attaches to the reporting API as a whole rather than to individual fields. We hold it for that reason alone and do not read those fields.
4. Confidentiality
We ensure that our personnel authorised to process your store data are bound by an obligation of confidentiality, and that access is limited to those who need it to deliver the service. Access is controlled by role and by per-area permission, and staff access to connected store data is recorded in an access log which we retain for twelve months and review periodically.
5. Security measures
Taking into account the state of the art, the costs of implementation and the risks presented by the processing, we implement the following technical and organisational measures under Article 32 GDPR:
- Encryption in transit— all connections to the Platform and to Shopify's APIs use TLS.
- Encryption at rest — the database is encrypted at rest by our hosting provider, and store access credentials are additionally encrypted at the application layer with AES-256-GCM.
- Data minimisation — we request only the fields listed in section 3, and no identifying customer fields are read or stored.
- Access control — role-based access with per-area permissions, and a minimum password length of twelve characters for staff accounts.
- Access logging — staff access to connected store data is logged with the person, the store and the time.
- Separation of environments — development environments do not hold live store credentials, and protected fields are removed from data used outside production.
- Automated deletion — the retention periods in section 8 are enforced by a scheduled job rather than by manual action.
- Backups — backups are encrypted and point-in-time recovery is available.
6. Sub-processors
You give a general authorisation for us to engage the sub-processors below. Each is bound by written terms imposing data protection obligations no less protective than those in this DPA.
- Neon — managed PostgreSQL database, hosted in the European Union (eu-west-2). Stores the order and catalogue data described in section 3.
- Vercel — application hosting and compute. Store data is processed in memory during requests and scheduled jobs; it is not stored there.
No other sub-processor receives store data. In particular, our transactional email provider carries only account activation and password reset messages, which contain no store data.
We will inform you at least thirty days before adding or replacing a sub-processor. If you reasonably object on data protection grounds within that period, you may disconnect your store and terminate the affected processing without penalty.
7. International transfers
Store data is stored in the European Union. Because we are established in the United States, our personnel access that data from the United States, and our hosting provider may process it in the United States. Where such a transfer takes place from the European Economic Area, the United Kingdom or Switzerland, it is made under appropriate safeguards within the meaning of Chapter V GDPR.
We will enter into the European Commission's Standard Contractual Clauses (Decision 2021/914), including the UK International Data Transfer Addendum where applicable, on request. Contact us at info@norma-media.com and we will execute them with you.
8. Retention and deletion
- Order records are deleted twenty-four months after the order date.
- Your store's access credentials are deleted immediately when you uninstall the application or disconnect the store.
- Your store's order, collection and campaign-mapping data is deleted when Shopify sends us the corresponding deletion request following an uninstall, and in any event within seven days of the uninstall.
- On termination of the service, all remaining personal data processed on your behalf is deleted within thirty days.
You may request earlier deletion at any time by disconnecting your store or by contacting us. Deletion is permanent; we do not retain archived copies beyond the rolling backup window of our hosting provider, from which data ages out.
9. Assistance to you
Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures in fulfilling your obligations to respond to requests from data subjects exercising their rights under Chapter III GDPR. Because we hold no identifying customer fields, we are generally unable to locate an individual within your store data on the basis of a name or email address; where you identify the relevant records, we will act on your instruction.
We also assist you, taking into account the information available to us, in complying with your obligations under Articles 32 to 36 GDPR, including security of processing, breach notification, and data protection impact assessments.
10. Personal data breaches
We will notify you without undue delay, and in any event within seventy-two hours, after becoming aware of a personal data breach affecting your store data. The notification will describe the nature of the breach, the categories and approximate volume of data concerned, the likely consequences, and the measures taken or proposed. Where we cannot provide all of that information at once, we will provide it in phases without further undue delay.
11. Audits
We make available to you the information necessary to demonstrate compliance with the obligations in Article 28 GDPR, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate. We will respond to a reasonable written request for such information within thirty days. Audits may be carried out no more than once in any twelve-month period, unless required by a supervisory authority or following a personal data breach affecting your data.
12. Changes to this DPA
We may update this DPA to reflect changes in the service or in applicable law. Where a change materially reduces your rights or our obligations, we will give you at least thirty days' notice before it takes effect. Continued use of the Platform after that period constitutes acceptance.
13. Contact
For any question about this DPA, to request the Standard Contractual Clauses, or to make a request under section 9 or 11, contact us at info@norma-media.com.