Data Processing Agreement

This Data Processing Agreement (“DPA”) is part of the Function Studio Terms of Service (the “Terms”). It applies when we process personal data for you as a processor under Art. 28 of the EU General Data Protection Regulation (GDPR).

In this DPA, “we” and “us” means EasyLogicTools, Osadná 2, Bratislava, 831 03, SK, the provider of the Function Studio app for Shopify (the “App”). “You” means the merchant that installs or uses the App.

When you install or use the App, you accept this DPA. You do not need to sign it. If you need a signed copy for your records, contact us at support@easylogictools.com.

1. Definitions

• Data Protection Laws means the GDPR (Regulation (EU) 2016/679), the UK GDPR, the Swiss Federal Act on Data Protection (FADP), and all other data protection laws that apply to the processing of Customer Personal Data.
• Customer Personal Data means the personal data that we process for you when we provide the App. Annex 1 describes this data.
• Sub-processor means a third party that we engage to process Customer Personal Data.
• SCCs means the standard contractual clauses in the Annex to Commission Implementing Decision (EU) 2021/914 of June 4, 2021.
• Other terms, for example “controller”, “processor”, “data subject”, “processing” and “personal data breach”, have the meanings that the GDPR gives them.

2. Roles and scope

2.1 You are the controller of Customer Personal Data, and we are your processor. If you process the data as a processor for a third party, we are your sub-processor.

2.2 Annex 1 gives the subject matter, duration, nature and purpose of the processing. It also gives the types of personal data and the categories of data subjects.

2.3 This DPA does not apply to personal data that we process as a controller. Examples are your account data, billing data, support contact data, and data about how your staff use the App. Our Privacy Policy applies to this data.

2.4 The Shopify Functions that you create with the App run on Shopify’s servers. Shopify processes the data of these functions under your agreement with Shopify. Shopify is not our sub-processor.

2.5 The AI features of the App process your prompts and your function settings. They do not read data about your customers. Do not put personal data of your customers into AI prompts.

3. Your instructions

3.1 We process Customer Personal Data only on your documented instructions. The Terms, this DPA and the settings that you make in the App are your complete instructions. You can give more instructions in writing if they agree with the Terms.

3.2 If law requires us to process Customer Personal Data for a different purpose, we tell you before we do so, unless that law prohibits it.

3.3 If, in our opinion, an instruction infringes Data Protection Laws, we tell you immediately.

3.4 You are responsible for the lawfulness of the processing. For example, you must have a legal basis for the processing, and you must inform your customers (for example, in the privacy policy of your store).

4. Confidentiality

All persons who can access Customer Personal Data are bound to confidentiality. They process the data only on your instructions.

5. Security

5.1 We use the technical and organizational measures in Annex 2 to protect Customer Personal Data (Art. 32 GDPR).

5.2 We can update these measures. The updated measures must give at least the same level of protection.

6. Sub-processors

6.1 You give us a general authorization to engage sub-processors. Annex 3 lists our current sub-processors.

6.2 We tell you at least 30 days before we add or replace a sub-processor. We update Annex 3 and send a notice to the email address of your Shopify store.

6.3 You can object to a new sub-processor on reasonable data protection grounds within these 30 days. If we cannot find a solution together, you can uninstall the App before the change takes effect.

6.4 We make a written contract with each sub-processor. This contract gives the same level of data protection as this DPA (Art. 28(4) GDPR). We are liable to you for the performance of our sub-processors.

7. Transfers outside the EEA

7.1 We and our sub-processors transfer Customer Personal Data outside the European Economic Area (EEA) only in compliance with Chapter V of the GDPR.

7.2 A transfer to a country with an adequacy decision of the European Commission (Art. 45 GDPR) needs no other safeguard. This includes transfers to companies in the USA that are certified under the EU-U.S. Data Privacy Framework.

7.3 If a transfer from you to us needs a safeguard under Art. 46 GDPR, the SCCs apply and are part of this DPA, with these choices:

• Module 2 (controller to processor) applies if you are a controller. Module 3 (processor to processor) applies if you are a processor.
• Clause 7 (docking clause) applies.
• Clause 9: Option 2 (general written authorization) applies. The notice period is 30 days.
• Clause 11: the optional wording does not apply.
• Clause 13: the competent supervisory authority is the authority that Clause 13(a) gives for you.
• Clause 17: the SCCs are governed by the law of Ireland.
• Clause 18: the courts of Ireland are competent.
• Annexes I, II and III of the SCCs contain the information in Annexes 1, 2 and 3 of this DPA. In Annex I of the SCCs, you are the data exporter and we are the data importer.

7.4 For transfers to our sub-processors, we use the EU-U.S. Data Privacy Framework or the SCCs. Annex 3 gives the safeguard for each sub-processor.

7.5 For transfers from the United Kingdom, the SCCs apply together with the International Data Transfer Addendum of the UK Information Commissioner. For transfers from Switzerland, the SCCs apply with these changes: references to the GDPR also refer to the FADP, and the Swiss Federal Data Protection and Information Commissioner (FDPIC) is the competent supervisory authority.

8. Assistance

8.1 If a data subject asks us to exercise their rights (for example, access or deletion), we send the request to you without undue delay. We do not answer the request ourselves unless you tell us to.

8.2 We help you to answer requests from data subjects with appropriate technical and organizational measures. We store very little Customer Personal Data (Annex 1). Thus, you can answer most requests with the data in your Shopify store.

8.3 We help you to comply with Art. 32 to 36 GDPR (security of processing, notification of personal data breaches, data protection impact assessments and prior consultation). This help depends on the nature of the processing and on the information that we have.

9. Personal data breaches

9.1 We tell you without undue delay, and not later than 48 hours, after we become aware of a personal data breach that affects Customer Personal Data.

9.2 Our notice gives the information in Art. 33(3) GDPR, as far as we have it. If we do not have all the information at the same time, we give it in steps.

9.3 We take reasonable steps to stop the breach and to decrease its possible effects.

10. Deletion

10.1 When you uninstall the App or the Terms end, we delete Customer Personal Data within 30 days. There are two exceptions:

• Data that expires automatically on a fixed schedule. Annex 1 gives these periods. For example, promotion report data expires after 3 months.
• Data that law requires us to keep.

10.2 If you want a copy of Customer Personal Data before we delete it, tell us before you uninstall the App.

11. Audits

11.1 We give you all information that is necessary to show that we comply with Art. 28 GDPR. This includes this DPA, Annex 2 and the certifications of our sub-processors, as far as they let us share them.

11.2 If this information is not sufficient, or if a supervisory authority requires it, you can audit our compliance with this DPA. You or an independent auditor who is bound to confidentiality can do the audit once per year, with 30 days’ notice, during normal business hours. You pay the costs of the audit.

12. General terms

12.1 The limitations of liability in the Terms also apply to this DPA, as far as Data Protection Laws permit.

12.2 If this DPA and the Terms conflict, this DPA applies. If the SCCs and this DPA conflict, the SCCs apply.

12.3 This DPA applies as long as we process Customer Personal Data for you.

12.4 We can change this DPA to comply with changes in law or in our processing. We tell you about material changes before they take effect. A change cannot decrease the protection of Customer Personal Data below the level that Data Protection Laws require.

12.5 This DPA is governed by the laws of [Country], except where the SCCs or Data Protection Laws require different laws.

Contact

For questions about this DPA, contact us at support@easylogictools.com.

Last updated: September 28, 2026

Annex 1: Details of the processing

Subject matter: The provision of the App to your Shopify store.

Duration: As long as the App is installed on your store, plus the retention periods in the table below.

Data subjects: Visitors and customers of your Shopify store.

Special categories of personal data (Art. 9 GDPR): None. Do not put special categories of personal data into the App.

Frequency: Continuous, while the App is installed.

We do not store names, email addresses, postal addresses or payment data of your customers, unless you send this data to us in a support request.

We process data for promotions only for shops that are on our Advanced plan and that activated the Function Studio app embed (Promotions runtime) in their theme.

Annex 2: Technical and organizational measures

1. Data minimization: Your Shopify Functions run on Shopify’s servers. We do not store names, email addresses, postal addresses or payment data of your customers, except in support requests that you send to us. We keep other data only for the periods in Annex 1.
2. Hosting: We host the App on Cloudflare. Cloudflare controls physical access to its data centers. Cloudflare has ISO/IEC 27001 and SOC 2 Type II certifications.
3. Encryption in transit: All connections to the App and to our API use HTTPS (TLS).
4. Encryption at rest: Our storage services (Cloudflare KV, D1, Durable Objects and R2) encrypt stored data.
5. Access control for merchants: Access to the App requires Shopify authentication. Each store can access only its own data.
6. Access control for our staff: Only authorized persons can access production systems. They use personal accounts with multi-factor authentication. We remove access when a person no longer needs it.
7. Availability: Cloudflare’s global network gives redundancy and protection against DDoS attacks.
8. Logs: Our hosting provider keeps technical logs for up to 7 days for troubleshooting and security.
9. Change management: We test changes with automated tests before we release them.
10. Incident response: We monitor errors and logs. We handle personal data breaches as Section 9 describes.
11. Confidentiality: All persons with access to Customer Personal Data are bound to confidentiality.

Annex 3: Sub-processors