Legal
Data processing addendum
Last updated
1. Scope
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between the merchant (“you”, the controller) and Bulkvane (“Bulkvane”, the processor). It applies when Bulkvane processes personal data on your behalf through the Bulkvane app for Shopify — mainly your customers' details in customer import and export jobs, and any personal data in files you upload. It's accepted when you accept the Terms, and it prevails over them on data protection.
It's designed to meet Article 28 of the EU GDPR and UK GDPR, and the service-provider requirements of the California Consumer Privacy Act and similar US state laws.
2. Details of processing
| Subject matter | Providing the App: bulk export, import, preview, editing and undo of store data. |
|---|---|
| Duration | While the App is installed; job data at most 30 days after each job finishes. |
| Nature and purpose | Storing, reading, transforming and writing data to your Shopify store on your instructions. |
| Data subjects | Your customers, and your staff who use the App. |
| Personal data | Customer name, email, phone, note, tags, tax-exempt status, default address and company; marketing consent status, orders count and amount spent (read only). Staff name and email from Shopify sessions. |
| Special categories | None intended. Don't upload special category data. |
3. Bulkvane's obligations
Bulkvane will:
- process personal data only on your documented instructions — your use of the App and these terms — unless the law requires otherwise, in which case we'll tell you first where allowed;
- not sell or share the personal data, retain, use or disclose it outside our direct business relationship with you, or combine it with data from other sources, except as the law permits for service providers;
- not use the personal data to train AI models;
- make sure everyone authorised to process it is bound by confidentiality;
- apply the security measures in section 5;
- help you, as far as reasonably possible, respond to data subject requests and meet your obligations on security, breach notification and data protection impact assessments;
- notify you without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting your data;
- delete personal data at the end of processing: job data 30 days after each job, and all store data when you uninstall the App or Shopify sends a shop redaction request;
- make available the information needed to show compliance with this DPA, and allow reasonable audits — normally by providing documentation and answers to a security questionnaire, at most once a year unless there's been a breach.
4. Sub-processors
You authorise Bulkvane to use the sub-processors below. We impose data protection terms on each that are at least as protective as this DPA, and remain responsible for their performance.
| Sub-processor | Purpose | Location |
|---|---|---|
| Shopify | App platform, sign-in and billing | Canada, United States and others |
| Cloud hosting provider | Runs the app, its database and job files | Region available on request |
| Brevo | Sends job and account emails you turn on | European Union |
| Resend | Delivers website contact form messages and newsletter sign-ups | United States |
| Cloudflare | Spam protection (Turnstile) on website forms | Global network |
We'll update this list at least 14 days before a new sub-processor starts processing your data. If you object on reasonable data protection grounds, tell us at [email protected]; if we can't resolve it, you may uninstall the App and we'll refund any prepaid fees for the remaining period.
5. Security measures
- Encryption of data in transit (TLS) and at rest, including backups.
- Access to production data limited to authorised staff with strong passwords and two-factor authentication; access is logged.
- Separation of production and test data.
- Hashing of API and OAuth tokens; short-lived signed download links.
- Protection against server-side request forgery on link imports.
- Automatic deletion under fixed retention periods.
- A documented incident response process.
6. International transfers
Where personal data is transferred from the EEA, the UK or Switzerland to a country without an adequacy decision, the parties agree to the European Commission's Standard Contractual Clauses (Module 2, controller to processor, or Module 3 where applicable) and the UK International Data Transfer Addendum, which are incorporated by reference. Bulkvane ensures its sub-processors provide equivalent safeguards.
7. Your obligations
You're responsible for having a lawful basis and giving any required notices for the personal data you process with the App, and for the accuracy of the data and instructions you provide.
8. Contact
Data protection questions and requests: [email protected]. If you need a countersigned copy of this DPA, email us and we'll send one.