Data Processing Agreement

Last updated: September 28, 2026

This Data Processing Agreement (hereinafter: "Agreement") forms an integral part of the Setify Terms of Service. By installing or continuing to use Setify in a Shopify store, the store agrees to the terms set forth herein.

Parties

  • The store that has installed Setify in its Shopify store, hereinafter "the Controller".
  • Digital Connect, located at Dravietdijk 10, 4706 LD Roosendaal, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 50891111, provider of the Setify app, reachable at support@setify.io, hereinafter "the Processor".

1. Definitions

Terms such as personal data, processing, data subject, controller, processor, sub-processor, and personal data breach have the meanings assigned to them in the General Data Protection Regulation (GDPR).

2. Subject Matter and Duration

  • The Processor processes personal data on behalf of the Controller solely to the extent necessary to deliver and operate the Setify app features selected by the Controller. Annex 1 details the data categories, data subjects, processing purposes, and retention periods.
  • This agreement remains in effect for as long as Setify is installed in the Controller's store, and thereafter for as long as the Processor retains any data on behalf of the Controller.

3. Instructions and Scope

  • The Processor processes personal data exclusively on documented instructions from the Controller. Configurations and options selected within the Setify administration panel, as well as enabling storefront features, constitute instructions.
  • The Processor does not use personal data for its own purposes, marketing, or commercial gain, and does not sell or share such data with third parties.
  • If the Processor believes that an instruction violates the GDPR or applicable data protection regulations, it shall inform the Controller without undue delay.

4. Confidentiality

All personnel authorized to process personal data on behalf of the Processor are subject to strict contractual or statutory confidentiality obligations. Access is restricted strictly to personnel who need it to operate, develop, and maintain the service.

5. Security Measures

The Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Annex 2 describes these security measures. The Processor may update these measures periodically, provided the overall level of security is maintained.

6. Sub-processors

  • The Controller hereby grants general authorization to the Processor to engage the sub-processors listed in Annex 3.
  • The Processor imposes data protection obligations on sub-processors that are at least as stringent as those set out in this Agreement.
  • The Processor will notify the Controller at least 14 days in advance of any intended addition or replacement of sub-processors. The Controller may object to such changes on reasonable grounds within that period. If the parties cannot resolve the objection, the Controller may uninstall Setify.

7. International Data Transfers

Transfers of personal data to countries outside the European Economic Area (EEA) occur solely in accordance with Chapter V of the GDPR, such as under the EU-U.S. Data Privacy Framework or approved Standard Contractual Clauses (SCCs). Annex 3 lists the location and transfer basis for each sub-processor.

8. Data Subject Rights

  • If the Processor receives a request directly from a data subject (e.g., access, rectification, or deletion), it shall forward the request promptly to the Controller.
  • The Processor assists the Controller, insofar as reasonably possible, in responding to data subjects exercising their rights under the GDPR.

9. Personal Data Breaches

  • The Processor shall notify the Controller of any personal data breach affecting the Controller's data without undue delay, and at the latest within 48 hours after becoming aware of it.
  • The notification will provide all reasonably available information: nature of the incident, categories and numbers of data subjects and records involved, likely consequences, and remediation measures taken or planned.
  • Notifying supervisory authorities and data subjects remains the sole responsibility of the Controller. The Processor provides full cooperation in fulfilling these obligations.

10. Assistance with DPIAs and Consultation

The Processor provides reasonable assistance to the Controller with Data Protection Impact Assessments (DPIAs) and prior consultations with supervisory authorities, to the extent related to Setify's processing activities.

11. Audits and Verification

  • The Processor makes available to the Controller all information necessary to demonstrate compliance with this Agreement.
  • The Controller may commission an audit, conducted by an independent certified auditor bound by confidentiality, at most once per calendar year at the Controller's expense, provided written notice of at least 30 days is given.

12. Termination and Data Deletion

  • Upon uninstallation of Setify, the Processor immediately deletes store API access tokens. Other store configurations and data are permanently purged within 30 days of uninstallation, unless retention is required by law. Upon written request to support@setify.io, all data is purged immediately.
  • Data created within the Controller's own Shopify environment (such as draft orders) is managed directly by the Controller in Shopify.

13. Liability

The liability of the parties under this Data Processing Agreement is governed by the liability limitations set forth in Section 8 of the Setify Terms of Service.

14. Governing Law and Miscellaneous

  • In the event of any conflict between this Data Processing Agreement and the Setify Terms of Service, this Agreement shall prevail with regard to the processing of personal data.
  • This Agreement is governed by and construed in accordance with the laws of the Netherlands.

Annex 1. Processing Activities

  • Configurators and sales blocks on storefronts: when loading frontend scripts, hosting and CDN providers receive technical connection metadata (IP address, user-agent, timestamp) in server logs for caching and security purposes.
  • Configurator analytics: aggregated, anonymous counts by day and hour (views, completions, option clicks). Contains no personally identifiable information. Retention period: 365 days.
  • Save set for later (optional merchant feature): email address and optional first name of visitors saving a configuration. Forwarded directly via Shopify API to create a draft order in the merchant store. Setify does not retain this data.

Setify does not process special categories of personal data or payment credentials. Payments are processed entirely within Shopify's secure checkout.

Annex 2. Technical and Organizational Security Measures

  • All communications between storefronts, Setify backend, Shopify APIs, and databases are encrypted using HTTPS (TLS 1.3).
  • API keys, access tokens, and secrets are stored exclusively in secure hosting environment variables and are never committed to source code.
  • Shopify webhooks and API calls are cryptographically validated using HMAC-SHA256 signatures before processing.
  • Data minimization: Setify only processes data strictly necessary for operation. Customer email addresses are never logged.
  • Access control: access to hosting, database, and partner accounts is restricted to authorized engineers. All administrative accounts (Vercel, Upstash, GitHub, Shopify Partner) require mandatory two-factor authentication (2FA).
  • Strict environment segregation: testing and development take place in an isolated development environment with a dedicated test database and development store.
  • Database security: Upstash databases and automated backups are encrypted at rest (AES-256) and in transit (TLS), hosted within European Union data centers (AWS EU).
  • Established incident response procedures for logging, investigating, and reporting security incidents and data breaches pursuant to Section 9.

Annex 3. Sub-processors

  • Vercel Inc.: Application server hosting and uploaded media storage. Location: United States (with edge points in EU including Frankfurt/Amsterdam). Transfer basis: EU-U.S. Data Privacy Framework.
  • Upstash, Inc.: Serverless database for configurator settings and counts. Location: European Union (AWS EU / Frankfurt / Ireland). Transfer basis: EU-U.S. Data Privacy Framework.
  • Cloudflare, Inc. (cdnjs): Content delivery network for static frontend libraries and icons. Location: Global network. Transfer basis: EU-U.S. Data Privacy Framework.

Shopify operates as the merchant's core platform and is not a sub-processor of Setify. Data exchanged with Shopify is governed by the direct contract between the merchant and Shopify.