This Data Processing Agreement ("DPA") forms part of the Essential Apps Terms of Service (the "Terms") available at https://essential-apps.com/legal/terms-and-conditions.
1. Parties and scope
1.1 Parties. This Data Processing Agreement ("DPA") is between:
you, the Merchant, as controller (or as processor acting for another controller); and
the company listed as the Provider of the relevant App in Annex A of the Terms, as processor (or sub-processor).
1.2 A separate DPA for each App. Each App's Provider is a party to this DPA only for that App. It is the only processor for the processing described in that App's processing details. If you use several Apps, a separate instance of this DPA applies between you and each App's Provider. Another company in the Schedule that processes personal data for an App does so only as that Provider's sub-processor (Section 7).
1.3 When this DPA applies. This DPA applies whenever the Provider processes personal data on your behalf in providing an App ("Merchant Personal Data"). It applies under:
the EU General Data Protection Regulation 2016/679 ("GDPR");
the UK GDPR and the Data Protection Act 2018;
the Swiss Federal Act on Data Protection; and
US state privacy laws, including the California Consumer Privacy Act as amended by the CPRA ("CCPA"), Virginia, Colorado, Connecticut, Utah, Texas and Oregon laws, and laws in other states with comparable provisions;
and any other data protection law applicable to the processing (together, "Data Protection Laws").
1.4 Data the Provider controls. This DPA does not apply to personal data the Provider processes as an independent controller. That processing is described in each App's privacy policy. It includes:
your account, billing, support and marketing contact data
security logs
fee calculation and billing records
de-identified or aggregated data
1.5 Processing details. The description of processing for each App is set out in that App's processing details. See Annex 1.
2. Processing on instructions
2.1 Instructions. The Provider processes Merchant Personal Data only on your documented instructions, unless required otherwise by EU or Member State law to which it is subject. In that case it will inform you before processing, unless that law prohibits it. Your instructions are: (a) this DPA and the Terms; (b) your Configuration and use of the App, including the Shopify permissions you approve; and (c) other reasonable written instructions consistent with the Terms that you send to support@essential-apps.com.
2.2 Unlawful instructions. The Provider will inform you promptly if, in its opinion, an instruction infringes Data Protection Laws. It may suspend the affected processing until the instruction is confirmed or changed.
2.3 Your responsibilities as controller. You are responsible for:
having a lawful basis for the processing;
giving the required information to your customers;
obtaining any required consents, including for storage of or access to information on customers' devices (cookies, localStorage). Where the App supports Shopify's Customer Privacy API, you are responsible for configuring your consent banner accordingly;
the accuracy of the data you provide; and
making sure your instructions comply with Data Protection Laws.
3. Confidentiality
The Provider ensures that persons authorised to process Merchant Personal Data, including personnel of Affiliate Service Providers, are bound by confidentiality obligations and process the data only as needed for the Services.
4. Security
4.1 Measures. The Provider implements the technical and organisational measures in Annex 3, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of processing and the risks to individuals (GDPR Art. 32).
4.2 Updates. The Provider may update Annex 3 provided that the overall level of protection is not reduced.
4.3 No absolute guarantee. Section 9.2 of the Terms applies. The Provider's obligation is to implement and maintain appropriate measures, not to guarantee that no incident will occur.
5. Personal data breaches
5.1 Notification. The Provider will notify you without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Merchant Personal Data.
5.2 Content. The notice will include, as far as then known: the nature of the breach; the categories and approximate numbers of individuals and records concerned; likely consequences; measures taken or proposed; and a contact point. Information may be provided in phases.
5.3 Cooperation. The Provider will take reasonable steps to contain and remedy the breach. It will give you reasonable assistance with your notifications to supervisory authorities and individuals (GDPR Arts. 33–34).
5.4 Not an admission. Notification of a breach is not an admission of fault or liability.
5.5 Contact. Notifications go to your Store's contact email address. You must keep it current.
6. Assistance
6.1 Requests from individuals. Taking into account the nature of processing, the Provider will assist you by appropriate technical and organisational measures in responding to requests from individuals exercising their rights. For Shopify Apps, this assistance is primarily provided through Shopify's mandatory privacy webhooks (customer data request, customer redaction, shop redaction), which the Provider processes as described in the App's processing details. If the Provider receives a request directly, it will refer the individual to you unless legally required otherwise.
6.2 DPIAs and consultation. The Provider will provide reasonable information to help you with data protection impact assessments and prior consultations (GDPR Arts. 35–36), as far as they relate to the App.
6.3 Costs. Assistance beyond the standard functionality of the App, Shopify's webhooks and the information published in this DPA may be charged at reasonable cost, unless the need for it arises from the Provider's breach.
7. Sub-processors
7.1 General authorisation. You give general authorisation for the Provider to engage sub-processors. The current sub-processors for each App, including any Affiliate Service Providers, are listed in the App's processing details (Annex 1) and, for services used for all Apps, in Annex 2.
7.2 Changes. The Provider will give at least 30 days' notice before adding or replacing a sub-processor. Notice is given by email to your Store's contact email address, with the updated Annex 2. In urgent cases (for example, to maintain security or continuity), notice may be shorter, and the Provider will explain why.
7.3 Objection. You may object on reasonable data-protection grounds within the notice period. The Provider will try to address the objection. If it cannot, your remedy is to terminate the affected App by uninstalling it. You will receive a pro-rata credit of prepaid fees for the period after uninstallation.
7.4 Flow-down. The Provider imposes data protection obligations on each sub-processor by written contract, offering at least the same level of protection as this DPA. Where a sub-processor is an Affiliate Service Provider, this is done through an intra-group agreement.
7.5 Responsibility. The Provider remains responsible to you for its sub-processors' performance, as required by GDPR Art. 28(4), subject to Section 12.
8. International transfers
8.1 Locations. Merchant Personal Data may be processed in the EEA, the United States and other countries where the Provider or its sub-processors operate, as stated in Annex 1 and Annex 2.
8.2 Safeguards. Where Merchant Personal Data subject to GDPR, UK GDPR or Swiss law is transferred to a country without an adequacy decision, the Provider ensures that an appropriate safeguard applies. This will be one of: (a) the recipient's certification under the EU–US Data Privacy Framework, the UK Extension or the Swiss–US DPF, as applicable; (b) the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs"), with the UK International Data Transfer Addendum where relevant; or (c) another mechanism recognised by Data Protection Laws.
8.3 Merchants outside the EEA. Where you are established outside the EEA and the Provider transfers Merchant Personal Data back to you, the SCCs Module Four (processor to controller) are incorporated by reference, with the following elections:
Clause 7 (docking clause) applies.
Clause 11 optional language does not apply.
Clause 17: the law of the Republic of Lithuania.
Clause 18: the courts of Vilnius, Lithuania.
Annexes: Annex 1 and Annex 3.
8.4 Conflict. If the SCCs apply and conflict with this DPA, the SCCs prevail.
9. Deletion and return
9.1 On termination. When you uninstall an App, the Provider deletes Merchant Personal Data in accordance with the App's processing details (Annex 1). In the normal course this happens after Shopify sends the shop data deletion ("shop/redact") request, which Shopify sends about 48 hours after uninstallation, and in any case within the period required by Shopify, unless EU or Member State law requires storage.
9.2 Return. Before uninstalling, you can export your Configuration and use the App's reports. Merchant Personal Data related to your orders remains available to you in Shopify, which is the system of record. Because of this, the Provider does not separately return order data unless you request it in writing before uninstalling and it is technically reasonable to do so.
9.3 Backups and records. Data in backups is deleted when the backups expire under the backup periods stated for each App in Annex 1. Until then it is protected under this DPA and not actively used. Records the Provider keeps as controller (for example, billing records) are governed by the App's privacy policy.
10. Audits and information
10.1 Information. On written request, the Provider will provide information necessary to demonstrate compliance with GDPR Art. 28. This includes this DPA, Annex 3, Annex 2 and, where available, summaries of security assessments or third-party certifications of its sub-processors.
10.2 Audits. If that information is not sufficient to demonstrate compliance, or if a supervisory authority requires it, you may audit the Provider's compliance with this DPA, subject to these conditions: (a) at least 30 days' written notice; (b) no more than once in any 12-month period, unless following a personal data breach or a regulator's request; (c) during business hours, without unreasonable disruption, subject to confidentiality, security and other customers' confidentiality; (d) by you or an independent auditor bound by confidentiality who is not a competitor of the Provider; and (e) at your cost, unless the audit reveals a material breach by the Provider. Audits of sub-processors are carried out by relying on their published certifications and reports, where available.
11. US state privacy laws
Where the Provider processes Merchant Personal Data as a "service provider" or "processor" under US state privacy laws, the Provider: (a) processes it only for the business purposes in the App's processing details (Annex 1); (b) does not sell or share it (as those terms are defined in the CCPA). This includes not using it for cross-context behavioural advertising; (c) does not retain, use or disclose it outside the direct business relationship with you, or combine it with personal information from other sources, except as permitted by those laws; (d) complies with the applicable obligations of those laws and provides the same level of privacy protection they require; (e) notifies you if it can no longer meet its obligations; and (f) allows you to take reasonable and appropriate steps to stop and remediate unauthorised use.
12. Liability
12.1 One cap. Each party's liability under or in connection with this DPA is subject to Section 13 of the Terms, which applies as one combined limitation across the Terms and this DPA. This DPA does not create a separate or additional cap.
12.2 Individuals and regulators. Section 12.1 does not limit: (a) individuals' rights against either party under Data Protection Laws (including GDPR Art. 82); or (b) supervisory authorities' powers. Nor does this DPA relieve either party of its own direct obligations under Data Protection Laws.
12.3 Allocation. Where both parties are liable to an individual for the same damage, each party's share between them is determined by its responsibility for the damage, in accordance with GDPR Art. 82(5) and subject to Section 12.1.
13. Term and order of precedence
13.1 Term. This DPA applies for as long as the Provider processes Merchant Personal Data for the relevant App.
13.2 Order of precedence. For the processing of personal data, this DPA prevails over the Terms, except Section 13 of the Terms, which governs liability. The SCCs, where they apply, prevail over both.
13.3 Changes. The Provider may update this DPA under Section 16 of the Terms. It may not reduce the protection required by Data Protection Laws.
Annex 1 — Processing details
1.1 Essential Upsell & Cross Sell
This Annex describes the processing under this DPA for Essential Upsell & Cross Sell (GDPR Art. 28(3)).
1. Parties
| Role | Party |
|---|---|
| Controller | The Merchant using Essential Upsell & Cross Sell (contact: the Store's contact email address) |
| Processor | UAB Essential Upsells, company code 307589579, Baltupio g. 45-27, LT-08324 Vilnius, Lithuania. Contact: support@essential-apps.com |
| Affiliate sub-processor | UAB Essential apps, company code 306227239 (see Annex 2, Part 2.1) |
No other company is a processor for this App.
2. Subject-matter, nature and purpose of processing
The App lets the Merchant show product offers (cross-sell, upsell, frequently bought together, volume discounts, add-ons, cart and checkout offers, post-purchase offers) and apply the discounts the Merchant configures. The processing is limited to:
| # | Processing activity | Purpose |
|---|---|---|
| P1 | Rendering offers on the storefront, using the logged-in shopper's customer tags and country to decide which offers to show | Execute the Merchant's targeting rules |
| P2 | Marking cart lines added through an offer, and calculating discounts in Shopify's discount engine | Apply the Merchant's configured discounts |
| P3 | Post-purchase offers: verifying the checkout and order, and preparing the signed order change for the item the buyer accepts | Execute post-purchase offers |
| P4 | Receiving order data for orders containing App offers (via Shopify webhooks and Google Pub/Sub) and storing order-level analytics events | Revenue attribution, merchant analytics, usage-based billing |
| P5 | Receiving storefront offer-impression and cart events | Merchant analytics (impressions, conversion) |
| P7 | Processing Shopify privacy webhooks (customer data request, customer redaction, shop redaction) | Assist the Merchant with data-subject rights and deletion |
3. Categories of data subjects
Buyers / customers of the Merchant who place orders containing App offers, or who accept post-purchase offers.
Storefront visitors who see App offers, including logged-in customers.
(Merchant staff data is processed by the Provider as controller. It is covered by the privacy policy, not by this Annex.)
4. Categories of personal data
| Category | Details | Activities |
|---|---|---|
| Order identifiers | Shopify order ID, order number, line-item IDs, checkout reference/token (post-purchase) | P3, P4, P7 |
| Order contents | Products and variants purchased, titles, quantities, prices, discounts, currency, order timestamps, test flag, sales channel | P4 |
| Line-item properties | Property names and values on all lines of orders that contain an App offer. This includes the App's own markers and any free text entered by buyers through other apps or the theme (for example, gift messages or engraving text). Currently stored with the order event | P4 |
| Customer tags (logged-in shoppers) | Tags the Merchant has assigned to the customer. Read in the shopper's browser to apply targeting. Not sent to or stored on the Provider's servers | P1 |
| Approximate location | Country code derived from IP address at the network edge. Returned to the browser and not stored by the App. IP addresses may appear in hosting providers' request logs | P1 |
| Storefront event data | Random event identifiers, product or offer identifiers, offer label, counts, timestamps. No IP address, user-agent or customer ID is included in the events | P5 |
| Device storage | Browser localStorage and sessionStorage entries: unsent analytics events queue, per-tab random ID, countdown timer state. No cookies are set by the App | P1, P5 |
| Privacy-request data | Shopify customer ID and order IDs from privacy webhooks. Email and phone are removed before storage | P7 |
Special categories of data (GDPR Art. 9): none intended. Buyer free text in line-item properties could contain any information. The Merchant should not use line-item properties for sensitive data.
Not processed: buyer names, email addresses, phone numbers, postal addresses and payment data. The App's Shopify protected customer data access is Level 1.
5. Duration and retention
| Data | Retention |
|---|---|
| Order analytics events and storefront events | While the App is installed. Deleted for specific orders on a Shopify customer redaction request, and deleted for the whole Store on a Shopify shop redaction request |
| Post-purchase analytics keyed by checkout reference | Deleted on shop redaction (cannot be matched to a customer on customer redaction) |
| Aggregated daily analytics (per offer: counts and totals, no order or customer identifiers) | While installed. Deleted on shop redaction, together with the rest of the store's data |
| Privacy-webhook records (sanitised) | 90 days |
| Pub/Sub messages in transit | Up to 7 days |
| Browser storage | Analytics queue entries: until sent, at most 24 hours. Countdown timer: until the timer expires |
| Backups (database point-in-time history) | Up to 30 days |
| Logs (hosting and pipeline) | Up to 30 days (Vercel runtime logs: 1–30 days depending on configuration; Google Cloud Logging default bucket: 30 days) |
Deletion timing on uninstall: Shopify sends the shop redaction request about 48 hours after uninstall. The Provider applies a grace period of up to 3 days, to protect merchants who reinstall, and then deletes the data within Shopify's 30-day deadline.
6. Sub-processors used by this App
From Annex 2, the following process Merchant Personal Data for this App:
UAB Essential apps (affiliate; analytics endpoint domain)
Vercel
Neon
Google Cloud
Upstash (shop-level job data only)
Cloudflare (network proxy in front of the App's servers; IP addresses and request data in transit)
Supabase (static images; IP only)
7. Transfers
Merchant Personal Data is stored and processed primarily in the United States: application hosting (Vercel, us-east-2), both databases (Neon, us-east-2) and the analytics pipeline (Google Cloud, us-central1). Background job data (shop-level billing jobs) is processed in the EU (Upstash, Frankfurt). Safeguards: DPA §8.
8. App-specific technical measures
In addition to Annex 3:
Server-side validation of offers before signing post-purchase order changes.
Logging practices avoid recording buyer free-text and email addresses.
Order webhooks are limited by field filtering to order and line-item fields needed for revenue attribution. No customer name, email, phone or address fields are requested.
Email and phone are removed from privacy-webhook payloads before storage.
Storefront analytics events contain no IP address, user-agent or customer identifier.
Storefront and checkout features are designed to fail safely: if the App's servers are unavailable, App offers are not shown, and Shopify checkout continues.
Automated processing of Shopify privacy webhooks, with a daily job and deadline tracking.
Database point-in-time recovery with a history window of up to 30 days.
Shopify access tokens are stored encrypted (AES-256-GCM, key held outside the database).
Order webhooks are restricted by Shopify field filtering to the fields listed in §4. No customer object is requested.
Storefront events pass through Shopify's signed App Proxy. The shop is taken from Shopify's signature, never from the request body, and only impression and cart events are accepted from storefronts.
Discount amounts come only from Merchant Configuration stored in Shopify metafields by the Provider's server, not from browser input.
Consent: the App's storefront analytics do not currently read Shopify Customer Privacy API consent signals. The Merchant should treat the App's storefront analytics as non-essential processing in its consent management.
1.2 Essential Cart Drawer
1. Parties
| Role | Party |
|---|---|
| Controller | The Merchant using the App (contact: the Store's contact email address) |
| Processor | UAB Essential apps, company code 306227239, Baltupio g. 45-27, LT-08324 Vilnius, Lithuania. Contact: support@essential-apps.com |
2. Subject-matter, nature and purpose of processing
| # | Processing activity | Purpose |
|---|---|---|
| P1 | Rendering the cart drawer, offers and reward bar; using logged-in shoppers' customer tags in the browser | Execute the Merchant's targeting rules |
| P2 | Calculating rewards and offer discounts in Shopify's discount engine | Apply the Merchant's configured rewards |
| P3 | Receiving storefront analytics events through the Shopify App Proxy (Cloudflare Worker) | Merchant statistics |
| P4 | Receiving order data (orders/create) and storing order-line attribution | Revenue attribution, merchant statistics, usage-based billing |
| P5 | Processing Shopify privacy webhooks | Data-subject rights and deletion |
3. Categories of data subjects
Storefront visitors and customers of the Merchant who use the cart drawer or place orders after using it.
4. Categories of personal data
| Category | Details |
|---|---|
| Order identifiers | Order id, order number, line-item ids, cart id / cart token |
| Order contents | Products, variants, titles, quantities, prices, discounts, currency, order time |
| Cart attributes and line properties | Received in the order webhook; read only to recognise the App's own markers; not stored |
| Storefront events | Random event ids, product/offer identifiers, event type, time. No IP address, customer id or device id in the events |
| Customer tags | Read in the browser; not sent to servers |
| Device storage | localStorage (unsent events queue, editor cache) and sessionStorage (de-duplication keys, tab id). No cookies |
Not processed: names, email addresses, phone numbers, postal addresses, payment data. No special categories.
5. Duration and retention
| Data | Retention |
|---|---|
| Order attribution and analytics | While installed. A customer's order and cart rows are deleted on customer redaction. Deleted on shop redaction, together with the rest of the store's data (only billing records are kept) |
| Event de-duplication ids | 48 hours (daily clean-up) |
| Browser storage | Until sent or the session ends |
| Compliance webhook audit rows | Email and phone removed; customer and order ids kept for 90 days, then deleted |
| Backups | 1-day point-in-time restore (Neon) |
6. Sub-processors used by this App
Vercel (hosting, United States – Washington DC)
Neon / Databricks (database, United States – AWS us-east-2, Ohio)
Cloudflare (Workers for analytics ingest; R2 file storage; network)
Upstash QStash (scheduled jobs; shop domain and ids only; EU – eu-central-1)
7. Transfers
United States (Vercel iad1, Neon us-east-2); job queue in the EU; Cloudflare global edge (R2 icon library in Eastern North America, no personal data). Safeguards: DPA Section 8.
8. App-specific technical measures
Shopify access tokens are stored encrypted (AES-256-GCM, key held outside the database).
Storefront events are verified by Shopify App Proxy signatures; the shop is taken from the signature.
Order webhook limited by field filtering; no customer object requested; raw order payloads not stored.
Compliance webhook payloads sanitised (email and phone removed) before storage.
Discount Function: for offers with a fixed product list, discounts only apply to products on that list; the spend attribute from the browser can only lower the qualifying amount.
Security review: an external penetration test was performed on the sister app Essential Upsell (September 2026). Cart Drawer was reviewed internally against those findings; the high-priority fixes are implemented (including the offer-discount gate) and the remaining fixes are in progress.
1.3 Essential Checkout Customizer
1. Parties
| Role | Party |
|---|---|
| Controller | The Merchant using the App (contact: the Store's contact email address) |
| Processor | UAB Essential apps, company code 306227239, Baltupio g. 45-27, LT-08324 Vilnius, Lithuania. Contact: support@essential-apps.com |
2. Subject-matter, nature and purpose of processing
| # | Processing activity | Purpose |
|---|---|---|
| P1 | Evaluating the Merchant's checkout rules (payment and delivery customisation, validations, discounts) inside Shopify Functions, using cart, buyer and delivery-address data supplied by Shopify at checkout | Execute the Merchant's checkout rules |
| P2 | Storing the Merchant's rules, including any personal data the Merchant enters into them (e.g. specific email addresses, ZIP codes or address lists) | Provide the App |
| P3 | Showing a thank-you page offer and a checkout free-shipping bar through Shopify checkout extensions | Execute the Merchant's offers |
| P4 | Processing Shopify privacy webhooks | Data-subject rights and deletion |
3. Categories of data subjects
Buyers at the Merchant's checkout; individuals whose details the Merchant enters into rules.
4. Categories of personal data
| Category | Details |
|---|---|
| Buyer data evaluated at checkout (not transferred to the Processor's servers) | Email, customer tags, B2B company, logged-in status, number of orders, total spent; delivery address (city, province, country, ZIP); cart contents |
| Data in rule configuration (stored) | Whatever the Merchant enters, e.g. email addresses, ZIP codes, address lists |
No special categories. No cookies or browser storage.
5. Duration and retention
| Data | Retention |
|---|---|
| Checkout-time evaluation | Transient, inside Shopify; nothing kept by the Processor |
| Rule configuration | Until the Merchant changes or deletes the rule, or shop redaction. On customer redaction, the customer's email address is removed from rule conditions (the only customer identifier a rule can hold; customer tags are not personal identifiers); other values (postcodes, addresses) remain the Merchant's responsibility (Terms, Annex K.4) |
| Backups | Weekly snapshots, kept 5 weeks |
6. Sub-processors used by this App
Vercel (hosting, United States – Washington DC): rule configuration only
Neon / Databricks (database, United States – AWS us-east-1): rule configuration only
Sentry (error reports; may include IP addresses; United States)
7. Transfers
Rule configuration is stored in the United States (Vercel iad1; Neon AWS us-east-1). Checkout-time buyer data stays within Shopify. Safeguards: DPA Section 8.
8. App-specific technical measures
Buyer data is processed only inside Shopify Functions and checkout extensions; the extensions make no network calls to the Processor.
The App has no Shopify access to orders or customer records.
Staff access to a store's App data is logged (who, what, when); entries are deleted after 12 months.
Shopify access tokens are stored encrypted (AES-256-GCM, key held outside the database).
1.4 Essential Loyalty Program & Rewards
1. Parties
| Role | Party |
|---|---|
| Controller | The Merchant using the App (contact: the Store's contact email address) |
| Processor | UAB Essential apps, company code 306227239, Baltupio g. 45-27, LT-08324 Vilnius, Lithuania. Contact: support@essential-apps.com |
2. Subject-matter, nature and purpose of processing
| # | Processing activity | Purpose |
|---|---|---|
| P1 | Maintaining loyalty member profiles synced from Shopify customers | Run the Merchant's loyalty programme |
| P2 | Awarding, deducting and expiring points; assigning tiers | Execute the Merchant's programme rules |
| P3 | Creating rewards in Shopify: discount codes, free shipping, free products, store credit (gift cards supported in the data model but not issued) | Fulfil redemptions |
| P4 | Referral programme: referral codes, referral links, visit counting, referral rewards | Execute the Merchant's referral programme |
| P5 | Reviewing customer submissions (text, images) for points | Execute the Merchant's earning actions |
| P6 | Sending programme emails on the Merchant's behalf, with unsubscribe and open/click measurement | Merchant's customer communications |
| P7 | Syncing with the Merchant's connected services (Klaviyo, Omnisend, Postscript, Judge.me), including forwarding customer deletion requests to Klaviyo and Omnisend | Merchant's instructions |
| P8 | Showing loyalty data in the storefront, customer accounts, checkout, POS and Shopify admin | Display to the customer and the Merchant |
| P9 | Processing Shopify privacy webhooks | Data-subject rights and deletion |
3. Categories of data subjects
The Merchant's customers who are loyalty programme members, referred friends, and storefront visitors who use referral links.
4. Categories of personal data
| Category | Details |
|---|---|
| Identity and contact | Name, email address, phone number, locale, customer tags |
| Marketing preferences | Email and SMS marketing consent (from Shopify); email unsubscribe status |
| Birthday | Day and month (and year if provided) for birthday rewards |
| Purchase data | Total amount spent, number of orders, orders that earned points |
| Loyalty data | Points balance and history, tier, rewards redeemed (codes, store-credit transactions, gift cards), referral code and referral relationships |
| Submissions | Text, amounts and images submitted by customers (images stored in the Merchant's Shopify Files); review outcome |
| Email interaction | Delivery, open and click events for programme emails |
| Device storage | Cookie `__honeypop_el_discount_pending` (carries a redeemed code to the cart); localStorage referral-visit de-duplication key; sessionStorage reward flags |
No special categories of data intended. Customers could include sensitive information in free-text or image submissions; the Merchant should configure submission actions accordingly. No payment card data.
5. Duration and retention
| Data | Retention |
|---|---|
| Member profiles and loyalty data | While the Merchant uses the App; erased per customer on Shopify customer redaction (including references in other members' referral feeds); all data purged on shop redaction |
| Email interaction events | Per-send open/click rows deleted after 13 months (earlier on uninstall or plan downgrade); per-template lifetime counters kept for the life of the shop |
| Submission images | Deleted on customer redaction and 90 days after the Merchant's review |
| Logs | Error logs (PII redacted by key) 7–30 days; web server access logs 7 days; privacy-request and customer-data access logs 10 years (compliance evidence and legal claims; Lithuanian Civil Code art. 1.125 limitation period) |
| Backups | Daily managed-database backups, 15 days |
6. Sub-processors used by this App
UpCloud USA Inc (application server, managed PostgreSQL, monitoring; United States – Chicago)
Cloudflare (proxy)
Google Cloud (Pub/Sub event delivery; region not pinned: US or EU)
Postmark (email delivery, US)
Sentry (error monitoring, United States)
Klaviyo and Judge.me are not our sub-processors. They are the Merchant's own providers, used on the Merchant's instruction.
7. Transfers
Primary processing in the United States (UpCloud Chicago). Safeguards: DPA Section 8.
8. App-specific technical measures
Shopify access tokens are encrypted at application level, with key rotation.
The managed PostgreSQL database and its backups are encrypted at rest by UpCloud (always on). The application server's disk is not encrypted at rest; access to it is limited to authorised personnel (Annex 3, item 2).
Tracking and unsubscribe links use internal ids, not email addresses.
Customer erasure removes all personal fields, the customer's orders, and references in other customers' referral feeds; it runs even for uninstalled or suspended shops.
Data-subject access requests are compiled automatically and sent to the store owner.
1.5 Essential Preorder & Back in Stock
1. Parties
| Role | Party |
|---|---|
| Controller | The Merchant using the App (contact: the Store's contact email address) |
| Processor | UAB Essential apps, company code 306227239, Baltupio g. 45-27, LT-08324 Vilnius, Lithuania. Contact: support@essential-apps.com |
2. Subject-matter, nature and purpose of processing
| # | Processing activity | Purpose |
|---|---|---|
| P1 | Collecting back-in-stock sign-ups (email and/or phone, locale, market, product, consent flags) through the storefront form | Notify shoppers when products return, as instructed by the Merchant |
| P2 | Sending back-in-stock, preorder confirmation and shipping-update emails | Merchant's customer communications |
| P3 | Transmitting sign-ups to the Merchant's connected Klaviyo / Omnisend account, and writing marketing consent to the Merchant's Shopify customers | Merchant's instructions |
| P4 | Reading orders and customers from Shopify; storing preorder line details | Manage preorders, fulfilment holds and reporting |
| P5 | Charging remaining balances through Shopify payment mandates, on the Merchant's instruction (admin action or Shopify Flow) | Collect deferred preorder payments |
| P6 | Holding and releasing fulfilment; updating inventory | Execute the Merchant's preorder settings |
| P7 | Processing Shopify privacy webhooks | Assist with data-subject rights and deletion |
3. Categories of data subjects
Shoppers who sign up for back-in-stock alerts; customers who place preorders; storefront visitors.
4. Categories of personal data
| Category | Details |
|---|---|
| Contact data | Email address, phone number (as entered by the shopper or held in Shopify orders) |
| Customer and order data | Shopify customer and order identifiers, name, shipping address (read from Shopify for emails and fulfilment), products, quantities, preorder amounts, payment status |
| Consent records | Privacy-terms confirmation and timestamp; newsletter / marketing consent |
| Communication data | Email delivery status (SendGrid message id and events) |
| Locale and market | Shopper language and market |
| Payment data | Not stored. Charges use Shopify payment mandates; card details stay with Shopify |
| Device storage | sessionStorage: sign-up id and variant id for the current visit. No cookies |
No special categories of data.
5. Duration and retention
| Data | Retention |
|---|---|
| Back-in-stock sign-ups | For as long as the Merchant uses the App (the Merchant may delete sign-ups at any time); deleted on customer redaction (email/phone match) and shop redaction |
| Preorder order details | Until shop redaction, or customer redaction for the affected orders |
| Email delivery events | Notification or order id only (no contact details); until shop redaction |
| Logs (emails and phones masked) | Up to 30 days (Sentry, EU) |
| Backups | 14-day point-in-time restore (Neon) |
Customer redaction deletes matching sign-ups (by email or phone) and the order rows concerned. Shop redaction deletes all sign-ups, orders and sessions, with an alert if any data remains.
6. Sub-processors used by this App
Vercel (hosting, EU – Frankfurt)
Neon / Databricks (database, EU – AWS eu-central-1, Frankfurt)
Trigger.dev (background jobs, EU – Frankfurt)
Upstash (queues, cache, UK – AWS eu-west-2, London)
Google Cloud (Pub/Sub event delivery; storage policy: any region)
Twilio SendGrid (email delivery, US)
Sentry (errors, EU – Germany)
Klaviyo and Omnisend are not our sub-processors. They are the Merchant's own providers, used on the Merchant's instruction.
7. Transfers
Hosting, database and jobs in the EU (Frankfurt); queue in the UK (adequacy decision); Pub/Sub in any Google Cloud region; SendGrid and Anthropic in the United States (DPF / SCCs). Safeguards: DPA Section 8.
8. App-specific technical measures
Storefront requests go through Shopify's signed App Proxy.
An idempotency key on every balance charge prevents duplicate charges.
Emails and phone numbers are masked in application logs.
Connected-service credentials are encrypted.
GDPR processing is batched, with crash recovery and alerts if data remains after shop redaction.
Consent to privacy terms and to marketing are recorded separately, with a timestamp.
1.6 Essential Subscriptions App
1. Parties
| Role | Party |
|---|---|
| Controller | The Merchant using the App (contact: the Store's contact email address) |
| Processor | UAB Essential apps, company code 306227239, Baltupio g. 45-27, LT-08324 Vilnius, Lithuania. Contact: support@essential-apps.com |
2. Subject-matter, nature and purpose of processing
| # | Processing activity | Purpose |
|---|---|---|
| P1 | Creating and maintaining subscription contracts and selling plans | Run the Merchant's subscriptions |
| P2 | Charging subscribers on each billing cycle through Shopify subscription billing; retrying failed payments (dunning) | Collect recurring payments on the Merchant's settings |
| P3 | Sending subscription emails to subscribers on the Merchant's behalf (Postmark), optionally from the Merchant's own domain | Merchant's customer communications |
| P4 | Customer portal: skip, pause, resume, swap, cancel; retention surveys | Let subscribers manage subscriptions |
| P5 | Importing subscriptions from other apps | Migration on the Merchant's instruction |
| P6 | Processing Shopify privacy webhooks | Data-subject rights and deletion |
3. Categories of data subjects
The Merchant's subscribers and customers.
4. Categories of personal data
| Category | Details |
|---|---|
| Identity and contact | Shopify customer ID, display name, email address, language (customer snapshot); phone number where part of an address |
| Addresses | Delivery and billing addresses |
| Payment | Payment-method summary: type, card brand, last digits, linked email address, Shopify payment-method ID; payment status, failed-attempt details (masked card number, amounts, next retry). No full card data |
| Subscription and order data | Products, prices, schedule, contract status, orders created, portal actions |
| Survey data | Cancellation reason and free-text comment |
| Import data | Source-app contract payloads |
| Device storage | sessionStorage in the campaign widget (free-gift flow); no cookies |
No special categories intended (free-text comments could contain anything).
5. Duration and retention
| Data | Retention |
|---|---|
| Contracts and related data | While the Merchant uses the App. On customer redaction: personal fields, addresses, payment summary, survey comments, import payloads, activity and dunning details are redacted. On shop redaction: all customers are redacted |
| Logs | Up to 8 days (Better Stack); Heroku log buffer up to a week. Logs are redacted in the App; compliance webhook logs are being narrowed to ids |
| Backups | Heroku Postgres continuous protection, last 4 days |
6. Sub-processors used by this App
Heroku (hosting, Postgres database, Key-Value Store; United States)
Postmark (email delivery, United States; message content kept 45 days)
Better Stack (application logs, 8 days)
7. Transfers
United States (Heroku, Postmark). Safeguards: DPA Section 8.
8. App-specific technical measures
Charges are tied to a specific billing cycle and protected by a distributed lock; inactive, paused or skipped contracts are not charged.
Payment card data is never stored; only a summary from Shopify.
Full redaction workflow for customers and shops.
Protected customer data Level 2 and `read_all_orders` access approved by Shopify.
Merchants can enable upcoming-charge reminder emails (timing and content configurable). Customers can cancel online once the Merchant's minimum-cycles rule is met; the minimum is shown before purchase.
1.7 Essential Free Gift BOGO BXGY
1. Parties
| Role | Party |
|---|---|
| Controller | The Merchant using the App (contact: the Store's contact email address) |
| Processor | UAB Essential apps, company code 306227239, Baltupio g. 45-27, LT-08324 Vilnius, Lithuania. Contact: support@essential-apps.com |
2. Subject-matter, nature and purpose of processing
| # | Processing activity | Purpose |
|---|---|---|
| P1 | Showing offers and adding gift lines to the cart (storefront widget, cart transform) | Execute the Merchant's gift offers |
| P2 | Calculating gift and BOGO discounts in Shopify's discount engine | Apply the Merchant's rewards |
| P3 | Receiving paid orders (orders/paid) and storing offer conversions (order id, order value, gift value) | Offer statistics; revenue figures |
| P4 | Processing Shopify privacy webhooks | Data-subject rights and deletion |
3. Categories of data subjects
Storefront visitors and customers of the Merchant who place orders.
4. Categories of personal data
| Category | Details |
|---|---|
| Received, not stored | Order payload from Shopify. Restricted with `include_fields` to order id, price sets, currency, discount applications and line items |
| Stored | Order id, order subtotal, value of gifts, currency, offer id |
| Device storage | sessionStorage (gift link / BOGO state). No cookies |
No special categories. No payment data stored.
5. Duration and retention
| Data | Retention |
|---|---|
| Offer conversions | While installed; deleted on shop redaction. Customer redaction deletes rows for `orders_to_redact` |
| Backups | Weekly, plus Neon point-in-time restore |
| Logs | Up to 30 days. Order diagnostics are limited to amounts |
6. Sub-processors used by this App
Vercel (hosting, United States – Washington DC)
Neon / Databricks (database, EU – AWS eu-central-1, Frankfurt)
Trigger.dev (scheduled jobs, EU – Frankfurt; no customer data)
Cloudflare R2 (offer settings and merchant images; no customer data)
7. Transfers
Database and jobs in the EU (Frankfurt); web servers in the United States (Vercel iad1). Safeguards: DPA Section 8.
8. App-specific technical measures
Only order id and amounts are stored from orders.
Compliance webhook payloads are stored without personal data.
Discount qualification is computed from the shopper's non-gift cart lines; a tagged gift line is only discounted if its variant/product is one of the offer's configured gifts (forged lines are charged full price).
Expiring offline Shopify tokens; tokens blanked on uninstall; the read-only analytics database role cannot read token columns.
Protected customer data: Level 1 (approved 9 July 2026); orders limited to the last 60 days.
Upload allowlist for merchant images.
1.8 Essential Estimated Delivery Date
1. Parties
| Role | Party |
|---|---|
| Controller | The Merchant using the App (contact: the Store's contact email address) |
| Processor | UAB Essential apps, company code 306227239, Baltupio g. 45-27, LT-08324 Vilnius, Lithuania. Contact: support@essential-apps.com |
2. Subject-matter, nature and purpose of processing
| # | Processing activity | Purpose |
|---|---|---|
| P1 | Serving the Merchant's delivery-widget configuration to visitors' browsers (Cloudflare R2) | Show delivery estimates |
| P2 | Counting widget impressions (Cloudflare Worker) | Merchant statistics, plan usage |
| P3 | Processing Shopify privacy webhooks | Data-subject rights |
3. Categories of data subjects
Visitors to the Merchant's online store and checkout.
4. Categories of personal data
| Category | Details |
|---|---|
| Network data | IP address and browser metadata received by Cloudflare when the widget configuration loads and an impression is counted. Not stored by the App |
| Impression events | Store, widget id, widget type. No visitor identifier |
Not processed: names, emails, addresses (the checkout block does not read the buyer's address), orders, payment data. No cookies or browser storage. No special categories.
5. Duration and retention
| Data | Retention |
|---|---|
| Impression counts | Counts per store, no visitor identifiers; kept while installed; deleted on the Merchant's request; automatic deletion on shop redaction is being added |
| Cloudflare request logs | Cloudflare's standard retention for the plan |
6. Sub-processors used by this App
Cloudflare (R2 storage, Workers, network)
A cloud hosting provider (App server)
A managed Postgres database provider (database)
The App's developer, an independent contractor who operates part of the App's infrastructure for the Provider
Sentry (error reports; may include IP addresses; United States)
7. Transfers
Processing may take place in the United States or the EU. Safeguards: DPA Section 8.
8. App-specific technical measures
No access to orders or customers; the checkout block reads no buyer details.
Impression events contain no visitor identifiers.
1.9 Essential CRO Split A/B Testing
1. Parties
| Role | Party |
|---|---|
| Controller | The Merchant using the App (contact: the Store's contact email address) |
| Processor | UAB Essential apps, company code 306227239, Baltupio g. 45-27, LT-08324 Vilnius, Lithuania. Contact: support@essential-apps.com |
2. Subject-matter, nature and purpose of processing
| # | Processing activity | Purpose |
|---|---|---|
| P1 | Assigning visitors to test variants and remembering the assignment (localStorage visitor id) | Show a consistent version to each visitor |
| P2 | Redirecting visitors to a preview theme for theme tests | Run the Merchant's theme test |
| P3 | Receiving Shopify customer events through the App's web pixel (page view, add to cart, checkout started/completed) | Measure test results |
| P4 | Calculating test statistics | Report results to the Merchant |
| P5 | Processing Shopify privacy webhooks | Data-subject rights and deletion |
3. Categories of data subjects
Visitors and customers of the Merchant's online store.
4. Categories of personal data
| Category | Details |
|---|---|
| Online identifiers | Random visitor id (localStorage); Shopify client id |
| Device data | Browser user agent |
| Browsing data | Page and product URLs, cart lines, test variants seen, event times |
| Order data | Order id, order total and currency, shipping price; delivery city, province and country |
Not processed: names, email addresses, phone numbers, street addresses, payment data. No special categories.
5. Duration and retention
| Data | Retention |
|---|---|
| Visitor ids, events, test participation | While the Merchant keeps the test; no automatic clean-up yet |
| Logs | Up to 30 days (Better Stack); compliance webhook payloads (email, phone) currently appear in logs |
| Customer redaction | Events and participation rows linked to the redacted orders are deleted on the Merchant's request; automatic deletion is being added |
| Shop redaction | The shop record is anonymised; visitor-level data is deleted on the Merchant's request (automatic deletion is being added) |
6. Sub-processors used by this App
Heroku (hosting, Postgres database, Key-Value Store, statistics service; United States)
Amazon Web Services S3 (preview screenshots, United States – us-east-1; no visitor data)
Better Stack (logs, 30 days)
Sentry (error reports; may include IP addresses; United States)
(The statistics calculation service receives only aggregated counts and is not a sub-processor of personal data.)
7. Transfers
United States. Safeguards: DPA Section 8.
8. App-specific technical measures
Shopify delivers web pixel events only with the visitor's analytics consent where the store requires consent (Shopify Customer Privacy, `analytics = true`); no marketing or sale-of-data use. The visitor id and variant assignment are stored in the visitor's localStorage before consent and sent only after it.
Random identifiers instead of names or emails.
Themes are not copied: a theme test only publishes the winning theme if the Merchant selects it; the other theme stays unpublished in the store. Original template content is saved before a test replaces it.
1.10 Essential AI SEO: AI Blog Post
1. Parties
| Role | Party |
|---|---|
| Controller | The Merchant using the App |
| Processor | UAB Essential apps, company code 306227239, Baltupio g. 45-27, LT-08324 Vilnius, Lithuania. Contact: support@essential-apps.com |
2. Subject-matter, nature and purpose of processing
| # | Processing activity | Purpose |
|---|---|---|
| P1 | Reading and writing the Merchant's blog articles in Shopify | Publish AI-generated posts |
| P2 | Sending the Merchant's article requests to AI providers and storing results | Generate content |
3. Categories of data subjects and data
The App processes no data about the Merchant's customers or visitors. Personal data is processed only if the Merchant includes it in article requests or blog content (for example, a named person in a topic). In that case: any personal data contained in the Merchant's text.
4. Duration and retention
Articles and requests are deleted on uninstall (with the Merchant's sessions); `shop/redact` (about 48 hours after uninstall) deletes any remaining sessions, articles and webhook records. Compliance webhook records are stored without email or phone. Published posts remain in the Merchant's Shopify blog. Replicate deletes prompts and images after one hour; Anthropic keeps API requests for up to 30 days. Backups: Neon point-in-time restore.
5. Sub-processors used by this App
Vercel (hosting, United States)
Neon / Databricks (database, United States – AWS us-east-2, Ohio)
Upstash QStash (job queue, EU – Frankfurt)
Anthropic (AI text, standard commercial API; Claude Haiku 4.5; United States)
Replicate (AI images, United States; images copied into the Merchant's Shopify store)
6. Transfers
United States; job queue in the EU. Safeguards: DPA Section 8.
1.11 Essential Trust Badges & Icons
1. Parties
| Role | Party |
|---|---|
| Controller | The Merchant using Essential Trust Badges & Icons (contact: the Store's contact email address) |
| Processor | UAB Essential apps, company code 306227239, Baltupio g. 45-27, LT-08324 Vilnius, Lithuania. Contact: support@essential-apps.com |
No other company is a processor for this App.
2. Subject-matter, nature and purpose of processing
The App displays trust badges, icons and banners configured by the Merchant on the Merchant's storefront. The processing is limited to:
| # | Processing activity | Purpose |
|---|---|---|
| P1 | Determining the visitor's country from the IP address of a request sent by the visitor's browser | Execute the Merchant's country targeting |
| P2 | Reading the logged-in customer's tags in the visitor's browser | Execute the Merchant's customer-tag targeting |
| P3 | Receiving badge view and click events | Merchant statistics (views, clicks, click-through rate) |
| P4 | Processing Shopify privacy webhooks | Assist the Merchant with data-subject rights and deletion |
3. Categories of data subjects
Visitors to the Merchant's storefront, including logged-in customers.
4. Categories of personal data
| Category | Details | Activities |
|---|---|---|
| IP address | Processed by the location service to derive a country code (Cloudflare adds the country; the App's endpoint returns it and stores nothing; IPs may appear in hosting request logs); received by the statistics service with each request, not stored (only aggregated counters are kept) | P1, P3 |
| Browser user agent | Received by the statistics service with each request; not stored | P3 |
| Country code | Derived from the IP; returned to the browser | P1 |
| Customer tags | Read in the visitor's browser; not sent to or stored on the Processor's servers | P2 |
| Badge events | Store, badge identifier, badge name, badge type, call-to-action type, event type, time. No customer identifier, cookie or device identifier | P3 |
Not processed: orders, customer records, names, email addresses, phone numbers, postal addresses, payment data. The App has no access to orders or customers in Shopify. No special categories of data.
Device storage: none. The App sets no cookies and uses no localStorage or sessionStorage on the storefront.
5. Duration and retention
| Data | Retention |
|---|---|
| Location lookups | Not stored by the App; hosting router logs only in Heroku's short live buffer |
| Badge events | Stored only as aggregated counters (views per shop per month; per-item counts per day) for as long as the Merchant uses the App; deleted on the Merchant's request; automatic deletion on shop redaction is being added |
| Logs | No log storage beyond Heroku's live buffer |
6. Sub-processors used by this App
Sub-processors (all accounts held by UAB Essential apps):
Heroku (hosting of the App, the location service and the statistics service)
Cloudflare (proxy in front of the location service)
Supabase (configuration storage, United States — AWS us-east-1; holds no visitor data)
Sentry (error reports; may include IP addresses; United States)
7. Transfers
Heroku (app, statistics service): United States (app) and EU (statistics service); Supabase: United States (AWS us-east-1). Safeguards: DPA Section 8.
8. App-specific technical measures
Read-only Shopify access to products, themes and languages. No order or customer scopes.
Visitor events carry no customer, cookie or device identifiers.
Customer-tag targeting runs entirely in the visitor's browser.
Storefront events are disabled in Shopify preview and theme-editor mode.
1.12 Essential Announcement Bar
1. Parties
| Role | Party |
|---|---|
| Controller | The Merchant using Essential Announcement Bar (contact: the Store's contact email address) |
| Processor | UAB Essential apps, company code 306227239, Baltupio g. 45-27, LT-08324 Vilnius, Lithuania. Contact: support@essential-apps.com |
2. Subject-matter, nature and purpose of processing
The App shows announcement bars configured by the store (messages, links, countdowns, free-shipping messages and similar). The processing is limited to:
| # | Processing activity | Purpose |
|---|---|---|
| P1 | Determining the visitor's country from the IP address of a request sent by the visitor's browser | Execute the Merchant's country targeting |
| P2 | Receiving bar view and click events | Merchant statistics |
| P3 | Storing a dismissed-bar flag in the visitor's browser (localStorage) | Respect the visitor's choice to close a bar |
| P4 | Processing Shopify privacy webhooks | Assist the Merchant with data-subject rights and deletion |
3. Categories of data subjects
Visitors to the Merchant's storefront, including logged-in customers.
4. Categories of personal data
| Category | Details |
|---|---|
| IP address | Processed transiently to derive a country code (added by Cloudflare; responses mostly served from Cloudflare's cache; not stored by the App); received by the statistics service with each request, not stored (only aggregated counters are kept) |
| Browser user agent | Received by the statistics service with each request; not stored |
| Country code | Derived from the IP; returned to the browser |
| App events | Store, App element identifier, event type and time (and, for add-to-cart events, the price of the added item). No customer identifier, cookie or device identifier |
| Device storage | localStorage: a dismissed-bar flag. No cookies, no sessionStorage. |
Not processed: orders, customer records, names, email addresses, phone numbers, postal addresses, payment data. The App has no access to orders or customers in Shopify. No special categories of data.
5. Duration and retention
| Data | Retention |
|---|---|
| Location lookups | Not stored by the App |
| App events | Stored only as aggregated counters (views per shop per month; per-item counts per day) for as long as the Merchant uses the App; deleted on the Merchant's request; automatic deletion on shop redaction is being added |
| Browser storage | Until the visitor clears it, or the timer / bar state no longer applies |
6. Sub-processors used by this App
Heroku (hosting; location and statistics services)
Cloudflare (proxy for `essential-announcement-bar.cc`)
Supabase (configuration; no visitor data; United States)
Better Stack (application and router logs incl. IP addresses, EU – Frankfurt, 8 days)
Sentry (error reports, may include requesters' IP addresses; United States, 90 days)
7. Transfers
App servers, statistics service and logs (Better Stack) in the EU; Supabase and Sentry in the United States. Safeguards: DPA Section 8.
8. App-specific technical measures
No Shopify access to orders or customers.
Storefront events carry no customer, cookie or device identifiers.
The App's storefront script is served by Shopify's CDN as a theme app extension.
1.13 Essential Free Shipping Bar
1. Parties
| Role | Party |
|---|---|
| Controller | The Merchant using Essential Free Shipping Bar (contact: the Store's contact email address) |
| Processor | UAB Essential apps, company code 306227239, Baltupio g. 45-27, LT-08324 Vilnius, Lithuania. Contact: support@essential-apps.com |
2. Subject-matter, nature and purpose of processing
The App shows a free-shipping or order-goal bar configured by the store, and can apply the store's free gifts and order discounts when a shopper's cart reaches the goal. The processing is limited to:
| # | Processing activity | Purpose |
|---|---|---|
| P1 | Determining the visitor's country from the IP address of a request sent by the visitor's browser | Show the right currency and goal |
| P2 | Reading the cart and adding gift or recommended products at the visitor's action or when a goal is reached | Execute the Merchant's free-gift and recommendation offers |
| P3 | Calculating free gifts and order discounts in Shopify's discount engine | Apply the Merchant's configured rewards |
| P4 | Receiving bar view, add-to-cart and error events | Merchant statistics; error monitoring |
| P5 | Storing a dismissed-bar flag in the visitor's browser (localStorage) | Respect the visitor's choice to close the bar |
| P6 | Processing Shopify privacy webhooks | Assist the Merchant with data-subject rights and deletion |
3. Categories of data subjects
Visitors to the Merchant's storefront, including logged-in customers.
4. Categories of personal data
| Category | Details |
|---|---|
| IP address | Processed transiently to derive a country code (added by Cloudflare; responses mostly served from Cloudflare's cache; not stored by the App); received by the statistics service with each request, not stored (only aggregated counters are kept) |
| Browser user agent | Received by the statistics service with each request; not stored |
| Country code | Derived from the IP; returned to the browser |
| App events | Store, App element identifier, event type and time (and, for add-to-cart events, the price of the added item). No customer identifier, cookie or device identifier |
| Device storage | localStorage: a dismissed-bar flag. No cookies set. (For one store only, the script reads the Google Translate language cookie to pick the bar language.) |
Not processed: orders, customer records, names, email addresses, phone numbers, postal addresses, payment data. The App has no access to orders or customers in Shopify. No special categories of data.
5. Duration and retention
| Data | Retention |
|---|---|
| Location lookups | Not stored by the App |
| App events | Stored only as aggregated counters (views per shop per month; per-item counts per day) for as long as the Merchant uses the App; deleted on the Merchant's request; automatic deletion on shop redaction is being added |
| Browser storage | Until the visitor clears it, or the timer / bar state no longer applies |
6. Sub-processors used by this App
Heroku (hosting; location, configuration and statistics services)
Cloudflare (proxy for `freeshipping-essential-apps.uk`)
Sentry (storefront error reports)
Heroku Postgres (backend database, EU) and Heroku EU (statistics service)
7. Transfers
App servers in the United States (Heroku); backend database and statistics service in the EU (Heroku); Sentry in the United States. Safeguards: DPA Section 8.
8. App-specific technical measures
No Shopify access to orders or customers.
Storefront events carry no customer, cookie or device identifiers.
The App's storefront script is served by Shopify's CDN as a theme app extension.
1.14 Essential Countdown Timer Bar
1. Parties
| Role | Party |
|---|---|
| Controller | The Merchant using Essential Countdown Timer Bar (contact: the Store's contact email address) |
| Processor | UAB Essential apps, company code 306227239, Baltupio g. 45-27, LT-08324 Vilnius, Lithuania. Contact: support@essential-apps.com |
2. Subject-matter, nature and purpose of processing
The App shows countdown timers configured by the store (for example sale or shipping-cutoff timers), and can empty the cart when a timer ends if the store chooses that option. The processing is limited to:
| # | Processing activity | Purpose |
|---|---|---|
| P1 | Determining the visitor's country from the IP address of a request sent by the visitor's browser | Execute the Merchant's country targeting |
| P2 | Storing timer state and a dismissed-bar flag in the visitor's browser (localStorage / sessionStorage) | Keep timers consistent across pages |
| P3 | Reading the cart and, where the Merchant enabled it, clearing the cart when a timer ends | Execute the Merchant's timer settings |
| P4 | Receiving timer view, click, dismissal and completion events | Merchant statistics |
| P5a | Generating countdown-timer images embedded in the Merchant's emails when recipients open them (recipients' IP and email-client details reach the service; not stored) | Show email countdown timers |
| P5 | Processing Shopify privacy webhooks | Assist the Merchant with data-subject rights and deletion |
3. Categories of data subjects
Visitors to the Merchant's storefront, including logged-in customers.
4. Categories of personal data
| Category | Details |
|---|---|
| IP address | Processed transiently to derive a country code (added by Cloudflare; responses mostly served from Cloudflare's cache; not stored by the App); received by the statistics service with each request, not stored (only aggregated counters are kept) |
| Browser user agent | Received by the statistics service with each request; not stored |
| Country code | Derived from the IP; returned to the browser |
| App events | Store, App element identifier, event type and time (and, for add-to-cart events, the price of the added item). No customer identifier, cookie or device identifier |
| Device storage | localStorage: timer end time per timer, dismissed-bar flag. sessionStorage: timer-completed flag. No cookies. |
Not processed: orders, customer records, names, email addresses, phone numbers, postal addresses, payment data. The App has no access to orders or customers in Shopify. No special categories of data.
5. Duration and retention
| Data | Retention |
|---|---|
| Location lookups | Not stored by the App |
| App events | Stored only as aggregated counters (views per shop per month; per-item counts per day) for as long as the Merchant uses the App; deleted on the Merchant's request; automatic deletion on shop redaction is being added |
| Browser storage | Until the visitor clears it, or the timer / bar state no longer applies |
6. Sub-processors used by this App
Heroku (hosting, EU; location, statistics and email-timer services)
Amazon Web Services S3 (cache of generated email timer images, United States; no personal data stored)
Cloudflare (proxy for `cache-essential-apps.cc`)
Heroku Postgres (backend database, EU) and Heroku EU (statistics service)
7. Transfers
App servers, backend database, statistics service and email-timer service in the EU (Heroku); email timer image cache in the United States (AWS S3); Sentry in the United States. Safeguards: DPA Section 8.
8. App-specific technical measures
No Shopify access to orders or customers.
Storefront events carry no customer, cookie or device identifiers.
The App's storefront script is served by Shopify's CDN as a theme app extension.
Annex 2 — Sub-processors
This Annex lists the third parties that may process personal data for a participating App, whether as a sub-processor of the App's Provider or as a recipient of data the Provider controls. The column for each App shows whether that App uses the vendor.
Changes: we will update this Annex at least 30 days before adding or replacing a sub-processor and notify merchants by email (Section 7.2).
2.1 Affiliate Service Providers (intra-group)
| Company | Services | Data | Location | Used by Essential Upsell & Cross Sell |
|---|---|---|---|---|
| UAB Essential apps (company code 306227239, Vilnius, Lithuania) | Support help desk (via Help Scout), merchant email platform (via MailerLite), `essential-apps.com` domain hosting the analytics endpoint, source-code hosting (via GitHub) | Merchant staff contact data and support messages, merchant email address, storefront event routing (no content stored by Essential apps itself) | EU (Lithuania), plus its own sub-processors below | ✅ |
2.2 Services used for all Apps
| Vendor | Purpose | Personal data | Location | Safeguard |
|---|---|---|---|---|
| Help Scout PBC (USA) | Support help desk and in-app chat | Merchant staff name, email, messages, browser metadata | United States | Help Scout DPA: EU–US DPF + UK Extension; SCCs |
| Google Workspace (Google Ireland / Google LLC) | Support and legal mailbox support@essential-apps.com | Correspondence | EU / United States | Cloud Data Processing Addendum; SCCs; EU–US DPF |
| GitHub Inc. (USA) | Source-code hosting | None by design | United States | GitHub Data Protection Agreement |
For Essential Upsell & Cross Sell these services are provided through UAB Essential apps (2.1).
2.3 App-specific sub-processors
Each App's own sub-processors are listed in section "Sub-processors used by this App" of its processing details in Annex 1. For Essential Upsell & Cross Sell, the full details are:
| Vendor | Purpose | Personal data | Processing location | Transfer safeguard | Upsell |
|---|---|---|---|---|---|
| Vercel Inc. (USA) | Application hosting, serverless functions, scheduled jobs, edge network, admin web analytics | All App data in transit; request logs incl. IP addresses; merchant staff admin usage | United States (cle1, us-east-2, Cleveland) / global edge network | Vercel DPA (incorporated in Terms §11.1): SCCs 2021 + UK Addendum; EU–US DPF | ✅ |
| Databricks, Inc. (Neon) (USA) | Managed PostgreSQL: main database and analytics database | Merchant account data, configuration, order line data, event data | United States (AWS us-east-2), both databases | Databricks DPA (incorporated in the Master Cloud Services Agreement) | ✅ |
| Google LLC / Google Cloud | Pub/Sub messaging, Cloud Run services (analytics publisher and subscriber) | Order line data, storefront events, shop domain | United States (us-central1) | Google Cloud Data Processing Addendum (incorporated) with SCCs; EU–US DPF | ✅ |
| Upstash Inc. (USA) | Background job queue (QStash) | Shop domain, billing job payloads | EU (Frankfurt, eu-central-1) | Processing in the EU; vendor is US-based Upstash DPA; EU–US DPF (per Upstash trust center) | ✅ |
| Cloudflare Inc. (USA) | DNS and reverse proxy / CDN in front of the App's servers | All admin and API traffic in transit, incl. IP addresses | Global edge network | Cloudflare Customer DPA (incorporated in Self-Serve Subscription Agreement): EU–US DPF + SCCs | ✅ |
| Twilio Inc. (SendGrid) (USA) | Transactional email to merchants (billing and service notices) | Merchant email address, shop domain, email content | United States | Twilio Data Protection Addendum: Binding Corporate Rules + SCCs | ✅ |
| Help Scout PBC (USA) — via UAB Essential apps | Support help desk and in-app chat (Beacon) | Merchant staff name, email, messages, browser metadata | United States | Help Scout DPA (part of Terms of Service): EU–US DPF + UK Extension; SCCs + UK IDTA fallback | ✅ |
| MailerLite (UAB MailerLite, Lithuania) — via UAB Essential apps | Merchant email marketing list | Merchant store email address, shop domain | EU | n/a if EU | ✅ (controller processing — see privacy policy) |
| Google Workspace (Google Ireland / Google LLC) — via UAB Essential apps | Support and legal mailbox support@essential-apps.com | Merchant and individual correspondence | EU / United States | Cloud Data Processing Addendum (incorporated); SCCs; EU–US DPF | ✅ |
| Hostinger (UAB Hostinger operations, Lithuania) — via UAB Essential apps | Domain registration and DNS for essential-apps.com | None (DNS only) | EU | n/a | ✅ (no personal data) |
| GitHub Inc. (USA, Microsoft) — via UAB Essential apps | Source-code hosting | None by design (source code and configuration only) | United States | GitHub Data Protection Agreement (part of GitHub Customer Agreement, accepted by the org) | ✅ (no personal data) |
| Supabase Inc. (USA) — via UAB Essential apps | Hosting of static interface images used in the post-purchase page | Browser IP address when images load (no storage by the App) | Not material (public images only) | Not required: no personal data stored; IP exposure only. Recommended: move images into the extension and drop the vendor | ✅ |
| Slack Technologies (USA) | Internal operations tool (plan administration commands) | Shop domain, plan | United States | Slack Data Processing Addendum | ✅ (internal) |
Annex 3 — Technical and organisational measures
These are the baseline measures for all participating Apps. App-specific measures are stated in each App's processing details (Annex 1).
A. Access control
Access to Shopify store data uses OAuth tokens issued by Shopify, limited to the permissions approved by the merchant.
Production systems (hosting, databases, cloud projects) are accessible only to authorised personnel who need access for their role.
Multi-factor authentication enforced for company email accounts and the source-code hosting organisation.
Access is removed promptly when personnel leave or change roles.
B. Data security
Encryption in transit (TLS) for all external connections. Encryption at rest provided by the database and cloud providers, except for the application server disk of Essential Loyalty Program & Rewards (see Annex 1.4).
Secrets are kept in the hosting provider's environment-variable or secret store.
C. Application security
Shopify webhooks are verified by HMAC signature. Storefront and admin requests are authenticated using Shopify's signed requests or session tokens.
Changes are deployed from version-controlled source code.
D. Data minimisation
Each App requests only the Shopify permissions its features need. App-specific minimisation measures are stated in Annex 1.
E. Availability and resilience
Hosting with established cloud or hosting providers.
Database backups or point-in-time recovery, as stated for each App in Annex 1.
F. Deletion and retention
Handling of Shopify privacy webhooks and retention limits as set out for each App in Annex 1.
G. Organisational
Confidentiality obligations for personnel and contractors.
A written incident response procedure, including severity triage, containment, credential rotation and the breach notification steps in Section 5.
Data processing terms with sub-processors, including with the Affiliate Service Provider (UAB Essential apps).