Effective date: October 16, 2026

This Data Processing Addendum (the DPA) forms part of the agreement governing a merchant’s use of Privacy Desk (the Agreement) between JPGStudios LLC, with an address at 201 Mountain Rest Road, New Paltz, NY 12561, United States (Privacy Desk, Provider, we, us, or Processor), and the merchant that accepts the Agreement (Merchant, Customer, you, or Controller). This DPA becomes binding when the Merchant accepts the Agreement or when the parties otherwise execute or incorporate this DPA in writing.

If there is a conflict between this DPA and the Agreement regarding the processing of Merchant Personal Data, this DPA controls. Capitalized terms not defined in this DPA have the meanings given in the Agreement.

This DPA is intended to satisfy Article 28 of Regulation (EU) 2016/679 (GDPR), the equivalent processor-contract requirements of the UK GDPR, and applicable service-provider and contractor requirements under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA).

1. Definitions

1. Applicable Data Protection Law means privacy and data-protection law applicable to the processing of Merchant Personal Data under the Agreement, including the GDPR, UK GDPR, and CCPA.
2. Consumer, Controller, Data Subject, Personal Data, Personal Information, Process, Processor, Sell, Share, Service Provider, and Supervisory Authority have the meanings assigned by Applicable Data Protection Law.
3. Merchant Personal Data means Personal Data or Personal Information processed by Provider on behalf of Merchant through Privacy Desk.
4. Security Incident means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Merchant Personal Data. It does not include unsuccessful attempts or activities that do not compromise Merchant Personal Data.
5. Subprocessor means a third party appointed by Provider to process Merchant Personal Data on Merchant’s behalf.

2. Roles and scope

1. Merchant is the Controller or Business and appoints Provider as its Processor, Service Provider, or Contractor for Merchant Personal Data.
2. The details of the processing are described in Annex I. Merchant determines the purposes and essential means of processing and is responsible for the lawfulness of its instructions, notices, legal bases, and responses to Data Subjects.
3. Provider processes Merchant Personal Data only:
   • on Merchant’s documented instructions, including instructions submitted through Privacy Desk and the Agreement;
   • to provide, secure, maintain, support, and troubleshoot Privacy Desk;
   • to comply with applicable law, in which case Provider will inform Merchant before processing unless legally prohibited; or
   • as otherwise permitted for a Processor, Service Provider, or Contractor by Applicable Data Protection Law.
4. Provider will promptly inform Merchant if, in Provider’s reasonable opinion, an instruction infringes Applicable Data Protection Law. Provider may suspend the affected processing until the parties resolve the issue.
5. Nothing in this DPA relieves either party of its own obligations under Applicable Data Protection Law.

3. Confidentiality and access

1. Provider will ensure that personnel authorized to process Merchant Personal Data are bound by appropriate confidentiality obligations and receive access only as necessary to perform their duties.
2. Provider will maintain reasonable access controls designed to prevent unauthorized access to Merchant Personal Data.
3. Merchant controls which of its Shopify staff accounts can access Privacy Desk and is responsible for its users, credentials, permissions, and lawful use of the service.

4. Security

1. Taking into account the state of the art, implementation costs, the nature and scope of processing, and the risks to Data Subjects, Provider will maintain appropriate technical and organizational measures designed to protect Merchant Personal Data.
2. The measures currently applicable to Privacy Desk are described in Annex II. Provider may update them when an update does not materially reduce the overall protection of Merchant Personal Data.
3. Merchant is responsible for configuring Privacy Desk appropriately, including choosing a lawful retention period, reviewing permissions, verifying requesters where required, and preventing sensitive information from being entered unnecessarily into free-text fields.

5. Data Subject requests

1. Taking into account the nature of the processing, Provider will provide reasonable assistance through appropriate technical and organizational measures to help Merchant respond to requests to exercise Data Subject rights.
2. Privacy Desk provides workflows for recording, verifying, managing, and documenting privacy-rights requests. The service does not determine whether a request is valid or whether an exception applies; those decisions remain Merchant’s responsibility.
3. If Provider receives a request from a Data Subject relating to Merchant Personal Data, Provider will, where legally permitted, direct the requester to Merchant or notify Merchant. Provider will not independently respond on Merchant’s behalf unless instructed or legally required.

6. Assistance and compliance

Taking into account the nature of processing and information available to Provider, Provider will provide reasonable assistance to Merchant with:

• security-of-processing obligations;
• notifications to Supervisory Authorities and affected Data Subjects following a Security Incident;
• data-protection impact assessments; and
• prior consultation with a Supervisory Authority where required.

Assistance beyond the standard functionality of Privacy Desk may be subject to reasonable fees when permitted by the Agreement and Applicable Data Protection Law.

7. Security Incidents

1. Provider will notify Merchant without undue delay after becoming aware of a Security Incident affecting Merchant Personal Data.
2. To the extent reasonably available, the notice will describe the nature of the incident, the categories and approximate number of affected Data Subjects and records, likely consequences, measures taken or proposed, and a contact for further information.
3. Provider may provide information in phases as it becomes available. A notification is not an admission of fault or liability.
4. Provider will take reasonable steps to contain, investigate, and mitigate the Security Incident and will reasonably cooperate with Merchant’s response.

8. Subprocessors

1. Merchant gives Provider general written authorization to engage the Subprocessors listed in Annex III to provide Privacy Desk.
2. Provider will impose written data-protection obligations on each Subprocessor that are no less protective in material respects than the obligations applicable to Provider under this DPA, to the extent relevant to the Subprocessor’s services. Provider remains responsible for its Subprocessors’ performance of those obligations as required by Applicable Data Protection Law.
3. Provider will make an updated Subprocessor list available at https://jpgstudios.us/privacy-desk-subprocessors/ or by request to privacy@jpgstudios.us. Provider will give Merchant reasonable advance notice of a new Subprocessor that will process Merchant Personal Data.
4. Merchant may object to a new Subprocessor on reasonable data-protection grounds by notifying Provider in writing within 15 days after notice. The parties will work in good faith to address the objection. If no reasonable alternative is available, either party may terminate the affected service without penalty upon written notice.

9. International transfers

1. Provider will not transfer Merchant Personal Data from the EEA, United Kingdom, or Switzerland to a country that does not provide an adequate level of protection unless an appropriate transfer mechanism and safeguards are in place.
2. Where required for an EEA restricted transfer, the parties incorporate the European Commission’s Standard Contractual Clauses adopted by Implementing Decision (EU) 2021/914 (EU SCCs), using Module Two (Controller to Processor), as follows:
   • for purposes of Clauses 17 and 18, the SCC Governing Member State is the EU Member State in which Merchant is established, provided that its law allows for third-party beneficiary rights; if Merchant is not established in an EU Member State or that Member State’s law does not allow for third-party beneficiary rights, the SCC Governing Member State is Ireland;
   • Clause 7 (docking) applies;
   • in Clause 9, Option 2 (general written authorization) applies with the notice period in Section 8;
   • the optional language in Clause 11 does not apply;
   • in Clause 17, Option 1 applies and the law is the law of the SCC Governing Member State;
   • under Clause 18, the courts of the SCC Governing Member State have jurisdiction; and
   • Annexes I through III of this DPA complete the corresponding annexes of the EU SCCs.
3. For a UK restricted transfer, the EU SCCs are modified by and incorporate the then-current UK International Data Transfer Addendum issued by the UK Information Commissioner’s Office. The information in Annexes I through III completes the applicable tables of that addendum.
4. For transfers subject to Swiss data-protection law, references in the EU SCCs to the GDPR and EU law will be interpreted to include the Swiss Federal Act on Data Protection where applicable, and the competent Swiss courts and authority will have jurisdiction as required by that law.
5. If a different lawful transfer mechanism is required, the parties will reasonably cooperate to implement it.

10. Return, deletion, and retention

1. During the Agreement, Merchant may use Privacy Desk’s available functionality to access and manage its case records.
2. Privacy Desk applies the retention period selected by Merchant to eligible closed privacy-request records and automatically anonymizes the requester’s identifying fields after that period. Merchant is responsible for choosing a retention period consistent with its legal obligations.
3. Upon termination of the Agreement or Merchant’s written instruction, Provider will delete or return Merchant Personal Data, at Merchant’s choice, unless applicable law requires continued storage. Data in protected backups may remain until overwritten through the ordinary backup lifecycle, during which it will remain protected and beyond active use.
4. Provider may retain limited information where required to establish, exercise, or defend legal claims; comply with law; maintain security records; or document deletion, provided it remains protected and is used only for that purpose.

11. Demonstrating compliance and audits

1. Provider will make available information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the GDPR or UK GDPR.
2. No more than once annually, unless required by a Supervisory Authority or following a Security Incident, Merchant may request a reasonable audit of Provider’s relevant processing. The parties will first use current third-party reports, certifications, questionnaires, and documentation where these reasonably satisfy the request.
3. Any additional inspection must occur on reasonable advance notice, during normal business hours, without disrupting Provider’s operations, and subject to confidentiality and security requirements. Merchant will bear its costs and reimburse Provider’s reasonable costs unless the audit identifies a material breach by Provider.
4. Audits must not expose another customer’s information, compromise security, or require disclosure of legally privileged information or Provider trade secrets unrelated to the audit purpose.

12. CCPA/CPRA terms

To the extent the CCPA applies to Merchant Personal Information:

1. Provider acts as a Service Provider or Contractor and receives Merchant Personal Information only for the limited and specified business purposes in Annex I.
2. Provider will not Sell or Share Merchant Personal Information.
3. Provider will not retain, use, or disclose Merchant Personal Information outside the direct business relationship with Merchant or for any purpose, including a commercial purpose, other than the purposes in Annex I or as otherwise permitted by the CCPA.
4. Provider will not combine Merchant Personal Information with Personal Information received from or on behalf of another person, or collected from Provider’s own interactions with a Consumer, except as permitted by the CCPA.
5. Provider will comply with applicable CCPA obligations and provide the same level of privacy protection required of Merchant for the Merchant Personal Information it processes.
6. Provider will notify Merchant if it determines it can no longer meet its CCPA obligations.
7. Merchant may take reasonable and appropriate steps to help ensure Provider uses Merchant Personal Information consistently with Merchant’s CCPA obligations and, upon notice, may take reasonable and appropriate steps to stop and remediate unauthorized use.
8. Provider will enable Merchant to comply with Consumer requests as described in Section 5.
9. Each Subprocessor processing Merchant Personal Information must be bound by a written contract that satisfies applicable CCPA requirements.

13. General terms

1. This DPA continues for as long as Provider processes Merchant Personal Data.
2. Liability arising from this DPA is subject to the exclusions and limitations in the Agreement to the extent permitted by Applicable Data Protection Law.
3. The governing-law and dispute-resolution provisions of the Agreement apply except where Applicable Data Protection Law or the EU SCCs require otherwise.
4. Changes to this DPA must be in writing. Provider may update this DPA to reflect changes in law or the service, provided the update does not materially reduce Data Subject protections. Provider will give reasonable notice of material changes.

Annex I — Processing details

A. Parties

Controller / Business
The Shopify merchant that accepts the Agreement. The merchant’s identity, address, contact details, and authorized user information are associated with its Shopify account or otherwise supplied to Provider.

Processor / Service Provider / Contractor
JPGStudios LLC
201 Mountain Rest Road, New Paltz, NY 12561, United States
Privacy contact: privacy@jpgstudios.us

B. Subject matter and purpose

Provider processes Merchant Personal Data to provide Privacy Desk, including:

• receiving customer privacy-rights requests through a merchant storefront;
• sending transactional acknowledgments;
• enabling Merchant to search, review, verify, assign, update, complete, deny, and document requests;
• calculating operational target dates selected by the service;
• maintaining case activity and email-delivery records;
• receiving and processing Shopify mandatory privacy-compliance webhooks;
• applying Merchant-configured retention and anonymization; and
• securing, maintaining, and troubleshooting the service.

Provider does not determine Merchant’s legal response to a privacy request and does not use Merchant Personal Data for advertising or the sale of Personal Data.

C. Duration and frequency

Processing is continuous for the term of the Agreement and continues only as needed for deletion, backup expiration, legal compliance, or dispute resolution after termination.

D. Categories of Data Subjects

• Merchant customers, prospective customers, storefront visitors, and other individuals submitting privacy-rights requests;
• individuals identified in Shopify privacy-compliance webhook payloads; and
• Merchant staff and authorized app users.

E. Categories of Personal Data

• identifiers and contact details: first and last name, email address, telephone number, company, country or region, Shopify customer identifier, and request identifier;
• privacy-request information: jurisdiction, request type, submission method, comments supplied by the requester, request status, verification status, assignment, response summary, denial reason, and operational dates;
• audit and communications information: case activity, actor labels, email status, message identifier, delivery error, and timestamps;
• merchant and authorization information: Shopify shop domain, session and access-token data, authorized-user identifiers and profile details; and
• security and technical information: rate-limit keys, webhook identifiers, and limited request metadata needed to protect the service.

The service is not intended for sensitive personal information beyond what is necessary to process a privacy-rights request. Merchant must not intentionally submit payment-card data, account passwords, government identifiers, health information, biometric data, or similarly sensitive content into free-text fields.

F. Processing operations

Collection, receipt, recording, organization, structuring, storage, retrieval, consultation, matching, updating, transmission of transactional email, restriction, anonymization, deletion, and other processing needed to provide Privacy Desk on Merchant’s documented instructions.

G. Merchant instructions and responsibilities

The Agreement, Merchant’s configuration and use of Privacy Desk, and other written instructions accepted by Provider constitute documented instructions. Merchant is responsible for providing legally required notices, establishing a lawful basis, verifying requesters when appropriate, determining request outcomes, and configuring lawful retention.

Annex II — Technical and organizational measures

Privacy Desk uses measures designed for the nature and risk of the service, including:

1. Tenant separation: application queries scope merchant records by the authenticated Shopify shop.
2. Authentication: merchant administrative access uses Shopify’s authenticated embedded-app sessions and the permissions Merchant manages in Shopify.
3. Transport protection: public application traffic, service integrations, and database connections use encrypted transport supported or enforced by the applicable platforms.
4. Storage protection: production database storage and platform-managed database backups are encrypted at rest by the hosting provider.
5. Secrets management: production credentials and API keys are stored as deployment configuration rather than committed to source control.
6. Application safeguards: server-side validation, request-size limits, rate limiting, honeypot protection, and authenticated webhook verification are used for relevant endpoints.
7. Webhook integrity: Shopify webhook authentication and Mailgun webhook signature, timestamp, and replay validation are applied to their respective endpoints.
8. Data minimization: Privacy Desk requests and stores fields intended for privacy-request case management and avoids order, payment, and address data unless the service is later expressly expanded.
9. Retention: Merchant-configurable retention and scheduled anonymization apply to eligible closed privacy-request records.
10. Case accountability: material case changes and transactional email-delivery events are recorded in the request activity history. This is a case-management audit trail and is not represented as a log of every record view.
11. Environment separation: production Personal Data is not intentionally copied into local development or test environments; test environments use separate configuration and non-production data.
12. Personnel controls: production access is limited to authorized personnel with a business need, subject to confidentiality obligations and the authentication controls of the hosting and administrative platforms.
13. Resilience and recovery: managed platform health controls and database backup capabilities support service restoration. Recovery objectives are not guaranteed unless stated in the Agreement.
14. Secure deletion: scheduled anonymization, Shopify erasure workflows, cascading record deletion where applicable, and platform backup expiration are used to remove or place data beyond active use.

Annex III — Authorized Subprocessors

Subprocessor	Service	Data and purpose	Processing location
Salesforce, Inc. (Heroku) and its infrastructure providers	Application hosting and managed PostgreSQL database	Merchant Personal Data described in Annex I, application configuration, operational logs, and encrypted backups needed to host and operate Privacy Desk	European Union region selected for the Privacy Desk application and database; limited ancillary processing may occur as described by Heroku’s terms
Mailgun Technologies, Inc.	Transactional acknowledgment email delivery and delivery-event webhooks	Recipient name and email, message content, request reference, delivery status, and related message metadata	European Union region for the configured sending domain; limited ancillary processing may occur as described by Mailgun’s terms

Shopify provides the commerce platform, app authentication, app proxy, and mandatory privacy-compliance webhook infrastructure under its direct agreement with Merchant. Shopify is therefore treated as Merchant’s platform provider rather than a Subprocessor appointed by Provider under this DPA.

Subprocessor legal names, affiliates, and infrastructure providers are governed by the applicable provider terms and may change. The current public list at https://jpgstudios.us/privacy-desk-subprocessors/ is the authoritative operational list.