Data Processing Addendum

You are the controller and we are the processor of the personal data described in Annex 1. Each party complies with the Data Protection Laws that apply to it.

We process personal data only on your documented instructions, which are these Terms, this DPA and your use and configuration of the App, unless required to do otherwise by law (in which case we will inform you unless the law prohibits it). We will tell you if we believe an instruction infringes Data Protection Laws.

Anyone we authorize to process personal data is bound by confidentiality obligations.

We implement the technical and organizational measures described in Annex 2, appropriate to the risk of the processing.

You authorize us to use the sub-processors listed in Annex 3. We impose data protection obligations on each sub-processor that are no less protective than this DPA, and remain responsible for them. We will announce new sub-processors on this page and by email or in the App at least 14 days before they start processing your data. You may object on reasonable data protection grounds; if we cannot address the objection, you may stop using the App and uninstall it.

We are located in Japan, which the European Commission has recognized as providing an adequate level of protection. Where personal data is transferred to a sub-processor in a country without an adequacy decision, the transfer is covered by the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) or another lawful transfer mechanism.

Taking into account the nature of the processing, we help you respond to requests from data subjects and meet your obligations on security, breach notification, data protection impact assessments and prior consultation. Requests that Shopify forwards to the App (customer data requests and redaction requests) are handled automatically as described in our Privacy Policy.

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with the information reasonably available to help you meet your notification obligations.

When you uninstall the App, we stop processing and delete your personal data after Shopify’s shop redaction request (sent 48 hours after uninstalling), except where the law requires us to keep it. Retention during use is described in Annex 1.

On request, we will provide the information reasonably necessary to demonstrate compliance with this DPA. If that information is not sufficient, you may audit our compliance once a year with at least 30 days’ notice, at your own cost, in a way that does not disrupt our business or compromise other customers’ data.

If this DPA conflicts with the Terms of Service, this DPA prevails with respect to the processing of personal data.

• Subject matter and nature: providing the RoastSheet app to the Controller.
• Purpose: calculating roasting amounts, green bean weights, batches and packing lists from unfulfilled orders, printing and exporting them, the optional daily email, and billing.
• Types of personal data: order data without customer fields (order ID and number, creation date, tags, fulfillment and cancellation status, and line items with product, variant and quantities), the store contact email address and store name. Customer names, email addresses, phone numbers and addresses are not requested or processed.
• Categories of data subjects: the merchant’s customers (only through order records that do not include their contact details), and the merchant’s staff and owners.
• Special categories of data: none.
• Duration and retention: order data is processed in memory when a sheet is created and is not stored. Aggregated sheet results and, on the Free plan, order IDs used for counting are deleted after about 90 days. All store data is deleted after Shopify’s shop redaction request. Request logs at our hosting provider are deleted within a few days.

• Encryption in transit (TLS) for all traffic; encryption at rest by our hosting provider.
• Shopify access tokens are additionally encrypted with AES-256-GCM; encryption keys are stored as secrets, separate from the data.
• Requests from Shopify (webhooks, app proxy) are verified with Shopify’s signatures; the app runs only inside the authenticated Shopify admin.
• Data minimization: the App requests only the API permissions it needs and does not request customer names, emails, phone numbers or addresses.
• Data of each store is separated by store identifier in every database query.
• Access to production systems is limited to the operator and protected with multi-factor authentication.
• Automatic deletion according to the retention periods in Annex 1, and deletion of all store data on Shopify’s shop redaction request.
• Error monitoring and logging configured to avoid collecting personal data where possible.