Data Processing Addendum

1. Roles and instructions

The Shopify merchant is the controller and Arturas Gotceitas / Lithuanian Masters is the processor for personal data contained in operational order data. We process that data only on the merchant’s documented instructions in the Terms, app configuration, and lawful support requests, unless law requires otherwise. We will notify the merchant before legally required processing unless prohibited.

2. Processing details

Subject and duration

Providing Tikkivo BakeList for the subscription and the limited deletion or legal-retention period afterward.

Nature and purpose

Reading eligible Shopify orders, resolving production dates, grouping quantities, displaying and exporting production sheets, handling privacy requests, and securing and supporting those functions.

Data subjects

Customers and other people referenced in merchant order properties.

Data

Order and line identifiers, order reference, products, variants, quantities, dates, status, tags, location or method, and merchant-selected production attributes. Shopify’s dedicated customer email, phone, billing-address, and shipping-address fields are not requested. Merchant-configured production attributes can contain personal data; the merchant must minimize those attributes and must not configure unnecessary contact, payment, health, or other sensitive information.

3. Confidentiality and security

Access is restricted to authorized people who are bound to confidentiality. Measures include data minimization, Shopify authentication, tenant isolation, role checks, protected session data, encrypted public transport, signed and expiring export links, request validation, and retention and deletion controls. We will review measures as risk and the service change.

4. Subprocessors

The merchant gives general authorization for Shopify, OVHcloud-hosted infrastructure operated under our control, and Cloudflare. They provide commerce APIs and authentication, hosting infrastructure, and network delivery and protection. We remain responsible for subprocessor obligations under this DPA. We will give notice before adding a subprocessor that processes merchant order data; the merchant may raise a reasonable data-protection objection before the change takes effect.

5. International transfers

Where processing involves a restricted international transfer, the parties and subprocessors will use a lawful transfer mechanism required by applicable data-protection law. Shopify and Cloudflare describe their transfer arrangements in their own data-processing terms.

6. Requests and assistance

The merchant is responsible for responding to data subjects. Send a request that concerns Tikkivo BakeList-held data to [email protected] with the Shopify shop and relevant Shopify request or order identifiers. We will reasonably assist with access, correction, deletion, restriction, objections, security assessments, and regulator consultation, taking account of the processing and information available to us.

7. Incidents

We will notify the merchant without undue delay after becoming aware of a personal-data breach affecting merchant data and provide available information reasonably needed for the merchant’s assessment and notifications. The merchant remains responsible for notifications required of the controller.

8. Retention, deletion, and return

Orders use a 90-day default retention period; an order with a current or future production date remains until that exception no longer applies. Webhook receipts are retained for 30 days and are deleted only after successful dispatch to the queue; undispatched receipts remain until queued. Privacy-request status and exports and the agreement audit persist through the limited post-uninstall Shopify redaction lifecycle to demonstrate compliance, and are erased on shop redaction.

Session records carry Shopify session expiry and are removed through Shopify SDK session deletion; all sessions are deleted on uninstall and shop redaction. Shop redaction deletes the tenant’s shop record, privacy-request and acceptance records, webhook receipts, and export baselines. A minimal redaction marker remains to block stale restoration and is cleared only after a completed new OAuth installation. On request before deletion, we will reasonably assist with an export of data held by the app.

9. Compliance information

We will provide information reasonably necessary to demonstrate compliance with this DPA and allow proportionate audits where legally required, subject to confidentiality, security, reasonable notice, and avoiding disruption. Evidence from independent providers may be used where suitable.

10. Priority

If this DPA conflicts with the Terms on personal-data processing, this DPA controls. Changes to the current DPA version require acceptance by a merchant owner or administrator.

Contact