Data Processing Agreement
Effective Date: October 5, 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Ecordio (“Processor”) and the merchant using Ecordio (“Merchant” or “Controller”). It applies automatically whenever Ecordio processes Customer Personal Data on the Merchant's behalf. If the DPA and the Terms conflict, this DPA prevails for matters of data protection.
1. Definitions
- Customer Personal Data: personal data of the Merchant's customers that Ecordio receives from the Merchant's connected stores.
- Data Protection Laws: all laws that apply to the processing, which may include the GDPR, the UK GDPR, India's Digital Personal Data Protection Act 2023, Singapore's PDPA and US state privacy laws such as the CCPA.
- Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data.
2. Scope of Processing
- Subject matter and purpose: syncing, displaying and managing the Merchant's orders in Ecordio.
- Data subjects: the Merchant's customers.
- Categories of data: customer name and email address, order details (order number, items, amounts, statuses, notes, tags) and fulfillment tracking. Ecordio does not collect customer phone numbers, postal addresses or payment card details.
- Duration: for as long as the Merchant's store is connected, plus the deletion period in Section 9.
3. Processing on Instructions
Ecordio processes Customer Personal Data only on the Merchant's documented instructions, which are the Terms, this DPA and the Merchant's use of the service. Ecordio will not sell Customer Personal Data, use it for advertising, or combine it with data from other merchants. Ecordio will tell the Merchant if it believes an instruction breaks Data Protection Laws.
4. The Merchant's Responsibilities
The Merchant is responsible for having a lawful basis for the data it connects to Ecordio, for giving its customers any required privacy notices, and for the accuracy of the instructions it gives.
5. Confidentiality
Ecordio ensures that anyone it authorises to access Customer Personal Data is bound by confidentiality and accesses it only as needed to provide or support the service.
6. Security
Ecordio maintains technical and organisational measures appropriate to the risk, as described in Annex 1 and on our Security page. Ecordio may improve these measures over time but will not reduce the overall level of protection.
7. Sub-processors
The Merchant authorises Ecordio to use sub-processors in the categories described on our Sub-processors page. Ecordio will provide the current list of named sub-processors, with the function and processing region of each, to the Merchant on request. Ecordio will impose data protection terms on each sub-processor that are no less protective than this DPA, and remains responsible for their performance. Ecordio will notify Merchants by email at least 14 days before adding or replacing a sub-processor that processes Customer Personal Data. A Merchant may object on reasonable data protection grounds; if the parties cannot resolve the objection, the Merchant may stop using the affected service.
8. Assistance and Data Subject Requests
Taking into account the nature of the processing, Ecordio will help the Merchant respond to requests from its customers to exercise their rights. Ecordio automatically honours customer deletion (redaction) requests received through Shopify and records data access requests for follow-up. If Ecordio receives a request directly from a data subject, it will refer the request to the Merchant. Ecordio will also give reasonable help with data protection impact assessments and regulator consultations.
9. Deletion at the End of Processing
When the Merchant disconnects a store or uninstalls Ecordio, Ecordio erases the store's access credentials immediately and permanently deletes all Customer Personal Data from that store within 30 days, or sooner when the platform sends a deletion request. Backups containing the data expire within a further 7 days. The Merchant can export its data before disconnecting.
10. Personal Data Breaches
Ecordio will notify the Merchant without undue delay, and in any case within 48 hours, after confirming a Personal Data Breach affecting the Merchant's Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the data and customers affected, the likely consequences and the measures taken. Ecordio will provide further information as it becomes available and will help the Merchant meet its own notification obligations.
11. Audits
On reasonable request, Ecordio will provide the information needed to demonstrate compliance with this DPA, such as answers to security questionnaires. Any further audit must be agreed in advance, be conducted with reasonable notice during business hours, and be subject to confidentiality.
12. International Transfers
Customer Personal Data is hosted in Singapore. Where Data Protection Laws require a transfer mechanism for data leaving the Merchant's jurisdiction, the parties will rely on an appropriate safeguard, such as the European Commission's Standard Contractual Clauses, which are incorporated by reference where they apply.
13. Term
This DPA lasts for as long as Ecordio processes Customer Personal Data on the Merchant's behalf.
Annex 1: Security Measures
- Encryption in transit: HTTPS for all traffic
- Encryption at rest: industry-standard (AES-256) encryption for store access credentials, order notes and backups; passwords stored only as salted one-way hashes
- Access control: role-based permissions within each workspace; administrative staff access restricted and audit-logged
- Access logging: views and changes of order data are recorded with the user, time and orders involved
- Passwords: minimum 12 characters, with common and easily guessed passwords rejected
- Data minimisation: no customer phone numbers, addresses or payment details are collected
- Authentication protection: protection against automated password guessing, and sessions that can be revoked immediately
- Separation: production runs on dedicated infrastructure with its own credentials, separate from development and test data
- Backups: daily encrypted backups, with a copy stored in a separate location in the same region, deleted after 7 days
- Retention: automatic deletion of disconnected-store data, deleted records and logs after 30 days
- Incident response: documented process with merchant notification within 48 hours
Contact
Questions about this DPA: support@ecordio.com.