Data Processing Agreement.

01 — Parties + roles

Controller: the client engaging shopifywebdeveloper.co.uk under a Statement of Work.

Processor: shopifywebdeveloper.co.uk (UK-registered business, London).

This DPA forms part of and supplements the Statement of Work. In the event of conflict between this DPA and the SOW, this DPA prevails for matters of personal data processing.

02 — Subject matter and duration

Subject matter: the personal data you instruct us to process in the course of delivering the services in your SOW (e.g. customer records during a Shopify migration, employee accounts during a B2B build).

Categories of data: typically — names, email addresses, postal addresses, order history, account credentials, payment metadata (not card numbers — those stay with Shopify Payments / Stripe and never touch our systems).

Categories of data subjects: typically — your customers, your employees, your trade buyers.

Duration: for the duration of the SOW, plus any tail period agreed in writing for handover and post-launch support.

03 — Processing instructions

We process personal data only on your documented instructions, including:

• The Statement of Work itself.
• Written communications during the engagement (Slack, email, ticket comments).
• Configuration choices made via your admin console (Shopify, ERP, etc.).

If we believe an instruction infringes UK or EU GDPR, we will notify you before acting on it.

04 — Confidentiality

Anyone we authorise to process your personal data is under a written confidentiality obligation (employment contract for staff, NDA for contractors). Access is limited to those who need it to perform the SOW.

05 — Security measures

We implement appropriate technical and organisational measures, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256 where supported by the underlying platform).
• Access controls — least privilege, MFA on all admin accounts, time-bounded access tokens.
• Audit logs — admin actions logged for 12 months minimum.
• Backups — encrypted, retained per the platform's policy (we don't take separate backups of your store data; we rely on Shopify's).
• Incident response — documented procedure with named owner, escalation path, and breach-notification protocol.
• Vendor security review — sub-processors reviewed at onboarding and annually.
• Staff training — annual data protection refresher for everyone with admin access.

06 — Sub-processors

You authorise our use of the following sub-processors. Each operates under a written processing agreement compliant with UK GDPR Article 28:

We will give you 30 days' notice before adding or replacing a sub-processor. If you object, we'll work with you to find an alternative; if no alternative is workable, either party may terminate the affected portion of the SOW without penalty.

07 — Data subject rights

If a data subject contacts us directly with a request relating to data we process on your behalf, we will:

1. Forward the request to you within 5 working days.
2. Not respond to the data subject directly without your authorisation.
3. Assist you (within reason) in fulfilling the request, including providing data exports.

08 — Breach notification

If we become aware of a personal data breach affecting your data, we will:

• Notify you without undue delay and in any case within 48 hours of becoming aware.
• Provide all information reasonably required for you to meet your own obligations to the ICO and to data subjects.
• Take reasonable steps to mitigate and remediate.

You remain responsible for any notification to the ICO and to affected data subjects.

09 — International transfers

Where personal data is transferred outside the UK / EEA in the course of the services, the transfer is governed by:

• The UK International Data Transfer Agreement (IDTA), or
• The UK Addendum to the EU Standard Contractual Clauses (SCCs), or
• An adequacy decision.

We will provide copies of the relevant transfer mechanism on request.

10 — Audit and inspection

Once per 12 months, you may audit our compliance with this DPA on 30 days' written notice. The audit may take the form of:

• A documentation review (our default offering — we provide our records of processing, sub-processor list, security policy, and incident log).
• A remote interview with our DPO and engineering lead.
• An on-site inspection where reasonably necessary, at your cost.

We will assist with regulatory audits at no charge.

11 — Return or deletion of data

On termination of the SOW, you choose whether we:

• Return the personal data to you in a structured, machine-readable format (default), or
• Delete the personal data, including all copies in our backups, within 90 days.

We will provide written confirmation of deletion on request.

12 — Liability and indemnity

Our liability under this DPA is subject to the limits set out in the Master Services Agreement or Statement of Work, except where Article 82 of UK GDPR imposes direct liability on us as processor.

13 — How to execute this DPA

Most engagements: this DPA is incorporated by reference in the SOW you sign — no separate signature required. If your procurement process needs a separately signed DPA, email dpo@shopifywebdeveloper.co.uk and we'll countersign within 2 working days.