Decisioner Data Processing Addendum
Last updated: 2026-10-18
This Data Processing Addendum ("DPA") forms part of the Decisioner Terms of Service between the merchant ("Controller") and Lalettayin LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom ("Processor").
1. Definitions
"GDPR", "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings in Regulation (EU) 2016/679. "Customer Personal Data" means personal data of the Controller's shoppers that the Processor processes through the App. "Subprocessor" means a third party the Processor engages to process Customer Personal Data. "SCCs" means the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914.
2. Roles and instructions
2.1 The Controller is the controller and the Processor is a processor of Customer Personal Data. 2.2 The Processor processes Customer Personal Data only on the Controller's documented instructions. The Terms, the settings the Controller chooses in the App and this DPA are those instructions. 2.3 The Processor tells the Controller if it believes an instruction breaks data protection law. 2.4 The Controller is responsible for the lawfulness of the processing, including marketing consent of each customer (Terms §3).
3. Details of processing (Annex I)
| Item | Description |
|---|---|
| Subject matter | Deciding and preparing marketing messages for customer events of the Controller's store (abandoned checkouts and carts, product browsing, new accounts, first orders, refunds) |
| Duration | While the App is installed, plus the deletion periods in §9 |
| Nature and purpose | Eligibility and consent checks; banded decision features; decision on send/timing/variant/discount tier; creating single-use discount codes; handing the message to the Controller's Klaviyo account or Shopify Flow workflow; outcome measurement; answering GDPR requests |
| Data subjects | The Controller's customers who start a checkout |
| Categories of data | Shopify customer ID; email address (read for the call, not stored); email marketing consent state; data-sale opt-out flag; order-history summaries as bands (lifetime orders; last-60-day orders, spend, recency, discount use); cart total, item count and product category groups; checkout token, checkout ID and recovery link; time-zone bucket; order ID, value and discount used for outcomes |
| Special categories | None. Sensitive product categories are grouped, excluded by default and never sent to the decision model |
| Storefront data (only with the visitor's consent) | Web pixel events reduced to event type, time and product category group (90 days); a keyed hash of Shopify's client id linked to a customer only after a checkout or a click on a link in the App's own message (30 days sliding); double opt-in sign-up evidence (wording version and hash, region, time) |
| Not processed | Names, phone numbers, postal addresses, page addresses, search words, product titles, cart free text, form fields, keystrokes; no shopper session replay, fingerprinting, IP/device matching, identity graphs, ad retargeting or cross-store data |
| Storefront detail | Pixel events: product viewed, added to cart, checkout started, checkout contact information submitted, collection viewed, search submitted (the search text is never read); only while the visitor allows analytics and marketing. Visitor linking needs sale/sharing consent too, starts only after a checkout or a click on the App's own tracked link (signed dc token, ≤ 7 days, single use) and is never cross-store. The hashed visitor key is pseudonymous data, not anonymous data. Unconfirmed double opt-in requests are deleted after 3 days |
| Learning (only with the Controller's ML consent) | Per-store choice-model state and per-store calibration trained on the Controller's orders, checkouts and message outcomes; used only for the Controller's store, never pooled or used for other stores or any general model; deleted at once on withdrawal, uninstall purge and shop/redact. The consent is given in the App by a staff user (wording version, SHA-256 of the text shown, staff user, store and time are recorded) and is the Controller's prior written consent under Shopify Partner Program Agreement §9.15(b) |
4. Confidentiality
The Processor ensures that persons authorised to process Customer Personal Data are bound by confidentiality and have access only as needed.
5. Security (Annex II — technical and organisational measures)
- Hosting in the EU (Google Cloud
europe-west1); database on a private IP, reachable only through mutually authenticated TLS with IAM; no public database endpoint in production. - TLS on every external connection; provider encryption at rest; additional AES-256-GCM encryption, bound to the store, for the Klaviyo key, internal per-store keys and GDPR export files.
- Pseudonymisation: customers are keyed internally by an HMAC of the customer ID with a per-store secret. The decision model receives only banded features, with no store, customer, email, token or other identifier, validated by a strict schema.
- Data minimisation: Email-only Level 2 access; email never stored or logged; webhook payloads never logged; analytics of staff use carry no shopper personal data.
- Tenant isolation: every query is scoped to the store; tests prove cross-store requests fail.
- Access control: least privilege, multi-factor authentication on all provider accounts; production changes only through a reviewed release script.
- Access logging: database statement audit (pgaudit), Secret Manager and Cloud SQL Data Access audit logs, and an in-App log of every export download; reviewed monthly.
- Backups: daily, kept no more than 30 days.
- Human review: staff approval of each message by default; emergency stop.
6. Subprocessors
6.1 The Controller gives general authorisation to the Subprocessors listed at https://decisioner.co.uk/legal/subprocessors.html. 6.2 The Processor gives at least 30 days' notice of a new or replaced Subprocessor by email to the store's contact address and an update on our subprocessors page. The Controller may object on reasonable data-protection grounds; if the parties cannot resolve it, the Controller may uninstall the App. 6.3 The Processor imposes data-protection obligations on each Subprocessor that are no less protective than this DPA and stays liable for them. 6.4 The decision-model provider (TypeSafe) receives Customer Personal Data derived from real stores only after a data-processing addendum with it is signed (no improvement use, rolling deletion within 30 days, breach notice within 24 hours). Until then it receives only synthetic data and data from the Processor's own development stores. 6.4a No Subprocessor that runs a model (TypeSafe, Google Vertex AI) may use Customer Personal Data or the Controller's data to train or improve its models; they process it for inference only. The Processor sends them no shop, customer, subject or checkout identifier.
6.5 Tools the Controller connects are not Subprocessors. A marketing tool the Controller connects through the App (or reaches through its own Shopify Flow workflow) is a destination selected by the Controller and the Controller's own processor under the Controller's contract with that vendor. The Processor sends it only the data needed to deliver a message the Controller approved (contact email or phone number, message content, discount code, link, template reference) and reads only consent and time-zone facts. The Controller is responsible for that vendor's data-processing terms, data region and channel rules (TCPA/10DLC, CASL, PECR, TRAI DLT, LGPD, WhatsApp template approval and per-message cost). Credentials are stored encrypted and deleted on disconnect, uninstall and shop/redact.
7. International transfers
Where Customer Personal Data is transferred outside the EEA, UK or Switzerland to a country without an adequacy decision, the SCCs apply: Module 2 (controller to processor) between the Controller and the Processor where needed, and Module 3 (processor to processor) between the Processor and each Subprocessor. The SCCs are those of Commission Implementing Decision (EU) 2021/914, Module 2 (controller to processor) and Module 3 (processor to processor) as applicable, with these choices: the Clause 7 docking clause applies; Clause 9 option 2 (general written authorisation, with 30 days' notice of changes); the optional language in Clause 11 does not apply; Clause 17: the law of Ireland; Clause 18: the courts of Ireland. For transfers from the United Kingdom the UK International Data Transfer Addendum applies, and for transfers from Switzerland the SCCs apply with the amendments required by the Swiss FDPIC. A transfer impact assessment is available on request.
8. Data subject requests
The Processor answers Shopify's customers/data_request, customers/redact and shop/redact requests within 30 days: data exports are provided in the App for the Controller; deletions remove every App record of the customer, the App-created unused discount codes and App metafields. The Processor helps the Controller with other requests by appropriate measures.
9. Deletion and return
- Retention while installed: decision, delivery and outcome records 13 months; profile summaries 13 months after last activity; detailed model-call log 30 days; exports 7 days; webhook receipts and job payloads 7 days; storefront events 90 days; visitor links 30 days after last use; unconfirmed sign-ups 3 days; GDPR request records and export access log 3 years with the customer key removed on completion.
- On uninstall: the Klaviyo key and sessions are deleted at once; all store data is deleted 30 days after uninstall unless the Controller reinstalls first;
shop/redactalways deletes. - Backups expire within 30 days.
- The Controller can export a customer's data at any time through Shopify's data request.
10. Personal data breach
The Processor notifies the Controller without undue delay and within 24 hours of becoming aware of a personal data breach affecting Customer Personal Data, with the information known at that time, and updates it as more is known. The Processor helps the Controller meet its 72-hour notice to the supervisory authority and notifies Shopify as the Partner Program terms require.
11. Assistance, audits and records
The Processor helps the Controller with data protection impact assessments and prior consultations as far as they concern the App. On reasonable request, the Processor provides the information needed to show compliance with this DPA, including summaries of its security measures and Subprocessor certifications. The Controller may audit once per year on 30 days' written notice, primarily by receiving the Processor's latest security documentation and questionnaire answers; on-site audits take place only where a supervisory authority requires them or after a personal data breach, at the Controller's cost.
12. Automated decision-making
The App's decisions are marketing decisions with no legal or similarly significant effect on customers (assessment available on request). Staff approval is the default. The Controller decides whether to turn on automatic sending. A discount is only an extra offer over the normal price; a random holdout receives no message; the model receives no protected attributes or proxies and no discount depends on them. Learning from the Controller's store happens only after its ML consent (§3) and only for its store.
13. Liability, term and precedence
This DPA applies while the Processor processes Customer Personal Data for the Controller. The liability terms of the Terms of Service apply. If this DPA and the Terms conflict on data protection, this DPA wins; if the SCCs and this DPA conflict, the SCCs win.
14. Contact
Data protection contact: privacy@decisioner.co.uk.