Data Processing Agreement (DPA)

Product: SpinX – a Shopify App by ePlugin Co., Ltd.
Last updated: June 18, 2025

This DPA governs the Processor’s handling of personal data on behalf of the Controller in compliance with GDPR and similar data protection laws.

1. Data Subject

• Visitors and customers of the Merchant’s store.

2. Data Types Processed

• Email, name (if provided via popup or fetched from Shopify).

3. Processing Activities

• Storing campaign data.
• Allowing merchants to download reports.
• Sending email-based rewards when configured.

4. Retention

• Customer data is deleted automatically after 90 days.
• Early deletion is available upon merchant request.

5. Subprocessors

• Infrastructure providers are used under strict data protection agreements.

6. Rights of Data Subjects

• Data subjects may request access or deletion of data through the Merchant.

7. Security Measures

• See Security Policy for encryption, access control, and incident response.

8. Contact

For DPA-related matters, contact: [email protected]

All policies are reviewed at least annually or whenever substantial changes are made to the app’s data handling.