Data Processing Addendum

Version 2026-09-10

1. Parties, scope and precedence

This DPA is between 95 Info Services, Block no-67, Jetpur Road, Gujarat Housing Board, Gondal, Rajkot, Gujarat, 360311, India ("Savrena", "Processor", "we"), and the merchant identified by the merchant's Shopify account and acceptance record ("Merchant", "Controller", "you"). Notices to Savrena must be sent to support@savrena.com.

This DPA governs Savrena's processing of Customer Personal Data on the Merchant's behalf. If it conflicts with the Merchant Terms on a data-protection question, this DPA prevails. The Standard Contractual Clauses described in section 15 prevail over this DPA and the Merchant Terms where those clauses require it.

The processing begins when Savrena first receives Customer Personal Data for the Merchant and continues until the service ends and the data has been deleted or returned under section 12. The subject matter, nature, purpose, data types and data subjects are described in Annex A.

2. Roles and Merchant responsibilities

The Merchant is controller and Savrena is processor for Customer Personal Data. This DPA and the Merchant's configuration, destination choices and documented support requests are the Merchant's documented instructions. Savrena is an independent controller for merchant account, contract and billing records, which are governed by the Privacy Policy rather than this DPA.

The Merchant must have authority and a lawful basis for every instruction, provide legally required notices, collect consent where required, configure Shopify Customer Privacy accurately, and use the service only for its own store. The Merchant is responsible for its relationship with every advertising or analytics destination it connects.

If Savrena believes an instruction appears to infringe applicable data protection law, Savrena will inform the Merchant promptly and may suspend only the affected processing while the parties resolve it. Savrena will process outside the Merchant's documented instructions only when required by applicable law and, unless that law prohibits notice, will inform the Merchant before doing so.

3. Processing instructions and destinations

Savrena may capture, recover, deduplicate, reconcile, report and deliver ecommerce events; maintain attribution and identity links; provide test-mode evidence; respond to privacy requests; secure and support the service; and create usage evidence. Savrena will not use Customer Personal Data for its own advertising, sell it, build cross-merchant profiles or train an artificial-intelligence model with it.

Meta, Google Ads and Google Analytics 4 are recipients selected and configured by the Merchant. They are not engaged by Savrena to process Customer Personal Data on Savrena's behalf and are not Savrena subprocessors. Their legal roles depend on the destination service and the Merchant's agreement with them. Configuring a destination instructs Savrena to transmit eligible data to it, subject to the Merchant's consent settings. Those recipients are governed by their own terms and may process data beyond the promises in this DPA.

4. Confidentiality

Savrena will ensure that every person authorised to process Customer Personal Data is bound by confidentiality, receives access only where necessary for the service, and processes the data only under Savrena's instructions. Savrena is operated by one authorised operator at this version. The same requirements apply before any additional person receives access.

5. Security

Savrena will implement and maintain appropriate technical and organisational measures proportionate to the processing risk, including the measures in Annex B. Savrena may update a measure where the replacement does not materially reduce the protection of Customer Personal Data.

Current boundary: this DPA does not represent that the production database volume or backups are encrypted. Shopify App Store submission and any affirmative protected-data encryption declaration remain gated on separately verified production work. The Merchant may request the current security-measures summary before accepting this DPA.

6. Subprocessors

The Merchant gives Savrena general written authorisation to use the subprocessors in the public Subprocessor Register. Savrena will:

• give at least 30 days' advance notice before a new subprocessor begins processing Customer Personal Data;
• impose the same data-protection obligations in this DPA on each subprocessor by written contract, to the extent applicable to the processing it performs;
• limit its access to what is needed for that service; and
• Savrena remains fully liable to the Merchant for each subprocessor's performance of its data-protection obligations.

The Merchant may object during the notice period on reasonable data-protection grounds. Savrena will work in good faith on a reasonable alternative. If none is available, either party may end only the affected service without penalty before the new subprocessor begins processing.

7. Data subject rights

Considering the nature of the processing, Savrena will provide reasonable assistance for data subject rights, including access, correction, deletion, restriction, portability and objection. Savrena will not respond to a shopper as controller of the Merchant's data. It will direct the person to the Merchant unless law requires otherwise.

Savrena supports Shopify's mandatory customers/data_request, customers/redact and shop/redact workflows. The Merchant remains responsible for verifying the request and communicating with the data subject.

8. Security incidents and regulatory assistance

Savrena will notify the Merchant without undue delay after becoming aware of a personal-data breach affecting the Merchant's Customer Personal Data. As facts become available, the notice will describe the nature of the incident, likely consequences, affected data, containment and remediation. Savrena will notify Shopify of an actual or suspected compromise of Merchant Data immediately and no later than 24 hours after awareness where Shopify's terms require it.

Savrena will reasonably assist the Merchant with security obligations, breach notifications, a data protection impact assessment and prior consultation with a supervisory authority, taking into account the nature of processing and information available to Savrena.

9. CCPA service-provider and contractor terms

For personal information governed by the California Consumer Privacy Act, Savrena acts as a service provider or contractor for the limited and specific business purposes in Annex A. Savrena:

• does not sell or share Customer Personal Data;
• does not retain, use or disclose it outside the direct business relationship or those specific business purposes;
• does not combine it with personal information received from another person or from Savrena's own consumer interactions, except as legally permitted to perform those purposes;
• will provide the same level of privacy protection required by the CCPA;
• will notify the Merchant if Savrena determines it can no longer meet those obligations; and
• will allow the Merchant to take reasonable steps to stop and remediate unauthorised use.

On reasonable written request no more than once each year, Savrena will provide information needed to verify this section. Subprocessor contracts will carry equivalent restrictions where applicable.

10. Compliance information and audits

Savrena will make available information reasonably necessary to demonstrate compliance with this DPA. No more than once per year, unless a breach or regulator requires more, the Merchant may request relevant policies, test summaries and redacted evidence. If that is insufficient, the Merchant may conduct or appoint an independent auditor to conduct a proportionate audit on at least 30 days' notice during normal business hours.

An audit must protect other merchants, security information and trade secrets, avoid production disruption and use existing independent reports first. The Merchant pays its audit costs unless the audit identifies Savrena's material breach of this DPA, in which case Savrena pays reasonable audit costs attributable to that breach.

11. Retention

Required deletion takes precedence over these periods and any Merchant choice. Contract, tax and payment records Savrena holds as an independent controller are not Customer Personal Data under this DPA and may be retained where law requires.

12. End of service: delete or return

Before termination, the Merchant may use Savrena's available exports to return its data. At the Merchant's choice communicated before deletion, Savrena will delete or return Customer Personal Data and delete remaining copies when the service ends, unless applicable law requires retention. If no choice is communicated, deletion is the default.

Savrena deletes Store data within 30 days after uninstall and ordinarily after a 14-day reinstall period. A non-reversible deletion marker may remain solely to stop deleted data from being restored or replayed; it contains no Customer Personal Data. Data in a backup is put beyond ordinary use and deleted on the backup's expiry schedule, and required deletions must be replayed before restored intake resumes.

13. Liability, duration and changes

The liability provisions in the Merchant Terms apply to this DPA except where applicable law or the Standard Contractual Clauses prohibit that result. This DPA remains in force for as long as Savrena processes Customer Personal Data for the Merchant.

Savrena will provide direct in-app notice of a material change and require explicit acceptance of the new material document set before further Shopify billing approval. Publishing a new date alone is not notice. A change to a subprocessor follows section 6.

14. Governing law

Except where the Standard Contractual Clauses or mandatory law specify otherwise, this DPA is governed by the laws of India and disputes are subject to the courts of Gujarat, India.

15. International transfers

15.1 EEA transfers

Where the Merchant transfers personal data protected by the GDPR to Savrena in India and no adequacy decision or other lawful mechanism applies, the parties incorporate the European Commission Standard Contractual Clauses issued under Decision (EU) 2021/914. Module Two applies, with the Merchant as controller/data exporter and Savrena as processor/data importer.

• Clause 7 does not apply.
• For Clause 9, Option 2 applies with general authorisation and 30 days' advance notice.
• Clause 11 does not apply.
• Under Clause 17, Option 1 applies and the laws of Ireland govern the SCCs.
• Under Clause 18, disputes under the SCCs are resolved by the courts of Ireland.
• The competent supervisory authority is determined under Clause 13, normally from the Merchant's EEA establishment or representative.

Annexes A, B and C of this DPA complete Annexes I, II and III of the SCCs. The parties' explicit electronic acceptance is deemed a signature to the SCCs and their annexes. The Merchant remains responsible for assessing whether the transfer is lawful in its circumstances. Savrena will provide information reasonably available for the Merchant's transfer impact assessment and will comply with Clause 14.

15.2 United Kingdom transfers

For a restricted transfer governed by UK data-protection law, the UK International Data Transfer Addendum to the EU SCCs, version B1.0 in force 21 March 2022 (the "UK Addendum"), is incorporated. The Parties complete its Part 1 Tables as follows.

Table 1 - Parties

Table 2 - Selected SCCs, modules and clauses

The Approved EU SCCs are the clauses issued under Commission Implementing Decision (EU) 2021/914. Module Two and the selections in section 15.1 apply. No optional docking or independent-redress clause applies. General subprocessor authorisation applies with 30 days' notice.

Table 3 - Appendix information

Annex A supplies the transfer description and the Parties' Activities relevant to the transfer; Annex B supplies the technical and organisational measures; and Annex C together with the Subprocessor Register supplies the Parties and subprocessor information.

Table 4 - Ending the Addendum

Neither Party may end the UK Addendum solely because the UK Information Commissioner issues a revised approved addendum under section 18 of its mandatory clauses.

Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

Data subjects may enforce the rights granted to them by the UK Addendum. The Merchant remains responsible for completing the applicable UK data protection test; Savrena will provide reasonably available information and cooperation.

15.3 Other countries

The parties will use another valid transfer mechanism where the law governing a transfer requires one. This version does not claim that a Swiss-specific addendum or another country's instrument has been executed.

Annex A - Processing details

Annex B - Technical and organisational measures

• TLS for public application and webhook transport.
• HMAC or shared-secret verification for supported server webhook sources.
• SHA-256 normalisation and hashing of supported matching identifiers; redaction of readable contact and street-address fields from diagnostic payloads.
• AES-256-GCM application-level encryption for stored destination credentials.
• Tenant-scoped application authorisation, owner gates for sensitive actions, mandatory TOTP for the platform super-admin and actor-attributed protected-data access logs.
• Consent evaluation before destination enrichment and delivery, with full, restricted, reduced and withheld outcomes.
• Test-mode separation from live reporting, destination delivery and billing.
• Bounded detail retention, transactional required deletion, non-reversible replay prevention and deletion replay before restored intake.
• Documented incident response, least-privilege access, data-loss prevention and production/test separation requirements.

The production disk and backup encryption boundary is stated in section 5 and is not enlarged by this Annex.

Annex C - SCC parties and subprocessors

Data exporter

Name: the Merchant legal person identified by its Shopify Store, authenticated account and acceptance record. Address: the Merchant address recorded by Shopify for the Store at the time of acceptance. Contact person's name, position and contact details: the Authorised representative who accepts this DPA, in that person's capacity as the Merchant's authorised representative, using the contact details associated with the authenticated Shopify account. Activities relevant to the transfer: operating the Store and instructing Savrena to perform the processing in Annex A. Role: controller. Signature and date: the recorded electronic acceptance and timestamp.

Data importer

Name and address: 95 Info Services, Block no-67, Jetpur Road, Gujarat Housing Board, Gondal, Rajkot, Gujarat, 360311, India. Contact person's name, position and contact details: Savrena Privacy, data-protection contact, support@savrena.com. Activities relevant to the transfer: providing the capture, recovery, deduplication, attribution, reconciliation, reporting and merchant-configured delivery service described in Annex A. Role: processor. Signature and date: Savrena's publication of this version and the Merchant's recorded electronic acceptance.

Competent authority

The supervisory authority determined under Clause 13 of the SCCs.

Subprocessors

The current Subprocessor Register forms Annex III. No subprocessor receives permission to use Customer Personal Data for its own purposes.

Contact

Contract, privacy, security and subprocessor notices: support@savrena.com
95 Info Services
Block no-67, Jetpur Road, Gujarat Housing Board
Gondal, Rajkot, Gujarat 360311
India