Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between Dogfluence.com LLC ("Dogfluence", "Processor") and the merchant ("Merchant", "Controller") that installs and uses the Dogfluence Creator Gifting app.

1. Roles

In respect of Personal Data processed through the app, the Merchant is the Controller and Dogfluence is the Processor. Each party complies with applicable data protection law, including the GDPR and UK GDPR.

2. Subject matter, nature and purpose

Dogfluence processes Personal Data solely to provide the app's functionality: (a) creating and managing Shopify draft orders so the Merchant can send gifted products to creators as part of a collaboration, and (b) reading the resulting order's carrier tracking details once the Merchant fulfils it, to display live delivery status to the creator. Processing lasts for the duration of the Merchant's use of the app.

3. Categories of data and data subjects

Personal Data is limited to gift recipients (creators): name, email address, phone number, and shipping address, provided by the creator through their Dogfluence profile and written to the draft order. From the fulfilled order, Dogfluence reads only the shipment tracking number/URL and an internal collaboration identifier; it does not read or store the buyer's name, email, phone or address. No special-category data is processed.

4. Documented instructions

Dogfluence processes Personal Data only on the Merchant's documented instructions, including as set out in the app's functionality and these terms, unless required otherwise by law (in which case Dogfluence informs the Merchant unless legally prohibited).

5. Confidentiality

Dogfluence ensures that personnel authorised to process Personal Data are bound by confidentiality obligations.

6. Security (Art. 32)

Dogfluence implements appropriate technical and organisational measures, including encryption of Personal Data in transit and at rest, restriction and logging of privileged access, separation of test and production environments, and a security incident response process (see https://dogfluence.com/.well-known/security.txt).

7. Sub-processors

The Merchant provides general authorisation for Dogfluence to engage sub-processors to process Personal Data, provided Dogfluence imposes data protection obligations no less protective than this DPA and remains liable for their performance. Current sub-processors include: managed application and database hosting (Laravel Cloud, operated on Amazon Web Services infrastructure in the United States, encrypted at rest and SOC 2 Type II certified), application performance monitoring (Laravel Nightwatch), object storage and CDN (Cloudflare R2), and carrier shipment tracking (17TRACK, which receives only the shipment tracking number to return delivery status — no other Personal Data). Dogfluence will inform the Merchant of intended changes to its sub-processors and give the Merchant the opportunity to object.

8. Assistance

Taking into account the nature of processing, Dogfluence assists the Merchant, by appropriate measures, in fulfilling its obligations to respond to data subject rights requests and to ensure security, breach notification, and data protection impact assessments.

9. Personal data breach

Dogfluence notifies the Merchant without undue delay after becoming aware of a Personal Data breach affecting the Merchant's data.

10. Deletion or return

On termination of the app, and at the Merchant's choice, Dogfluence deletes or returns the Personal Data processed on the Merchant's behalf, and deletes existing copies unless retention is required by law. Recipient Personal Data held in the Dogfluence platform is deleted or anonymised in line with Dogfluence's retention policy.

11. Audits

Dogfluence makes available to the Merchant information necessary to demonstrate compliance with this DPA and allows for and contributes to reasonable audits.

12. International transfers

Where Personal Data is transferred outside the EEA/UK, Dogfluence relies on an appropriate transfer mechanism (e.g. Standard Contractual Clauses) as required by applicable law.

Questions?

For questions about this Data Processing Addendum, contact us at bark@dogfluence.com .