Oxpeka Inventory – Data Processing Addendum

Effective date: October 16, 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Nahom Accorsi, trading as Oxpeka ("Processor", "we") and the business that installs Oxpeka Inventory ("Merchant", "you"). It applies to personal data we process on your behalf when providing the app ("Merchant Personal Data") and is designed to meet Article 28 of the EU GDPR and UK GDPR, the service-provider requirements of US state privacy laws (including the CCPA as amended by the CPRA) and the accountability principle of Canadian privacy law (PIPEDA and Quebec's Law 25). It applies automatically; no signature is needed.

1. Roles and instructions

You are the controller (or "business") of Merchant Personal Data; we are your processor (or "service provider"). We process it only to provide the app, as described in Annex I, and on your documented instructions: these terms, the DPA and the actions you take in the app. We will tell you if we believe an instruction breaks the law.

2. Our obligations

We will:

• keep Merchant Personal Data confidential and ensure everyone who processes it is bound to confidentiality;
• apply the security measures in Annex II;
• not sell or share it, not retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing the app, and not combine it with personal data from other sources except as the law allows service providers to do;
• help you, taking into account the nature of the processing, to answer requests from individuals exercising their rights, and with security, breach notifications, impact assessments and prior consultations;
• notify you without undue delay, and within 48 hours of becoming aware of a personal data breach affecting Merchant Personal Data, with the information you need to meet your own obligations;
• delete Merchant Personal Data when the app is uninstalled (when Shopify sends the deletion request 48 hours after uninstall), or return it on request before then, unless the law requires us to keep it; backups are overwritten within the period stated in the Privacy Policy;
• make available the information needed to show compliance with this DPA and allow audits, by answering your written questions or, where that is not enough, by an independent auditor bound by confidentiality, at your cost, with 30 days' notice and no more than once a year.

3. Sub-processors

You give us general authorization to use the sub-processors in Annex III. We impose on each of them data protection obligations equivalent to this DPA and remain responsible for them. We will announce new sub-processors in the app or by email at least 30 days in advance; you may object on reasonable data protection grounds, and if we can't resolve the objection you may stop using the app and uninstall it.

4. International transfers

Where Merchant Personal Data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply, Module Two (controller to processor) or Module Three (processor to processor) as relevant, with the UK International Data Transfer Addendum for UK data. For these clauses: Clause 7 (docking) applies; Clause 9 option 2 (general authorization, 30 days' notice); Clause 11 optional language does not apply; Clause 17 and 18: the law and courts of Italy. Annexes I–III of this DPA complete the clauses. Transfers from Canada are protected by contractual safeguards comparable to Canadian standards.

5. Liability and order of precedence

Liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow it. If this DPA conflicts with the Terms of Service, this DPA prevails for Merchant Personal Data; the Standard Contractual Clauses prevail over both.

Annex I – Description of the processing

Annex II – Technical and organisational measures

• Encryption in transit (HTTPS/TLS) for all traffic; encryption at rest of the database and backups by the hosting provider.
• Authentication through Shopify (OAuth and session tokens); every request is tied to one store and every database query is filtered by store; automated tests check that stores can't see each other's data.
• Least-privilege access scopes on Shopify; no access to customer fields.
• Secrets kept in the hosting provider's secret store, never in source code; access to production limited to authorized personnel with strong authentication.
• Webhooks verified with Shopify's HMAC signature; rate limits on AI features, emails and support.
• Input validation, protection of exported files against formula injection, and escaping in emails.
• Error reports without IP addresses, cookies, headers or request bodies.
• Daily backups with point-in-time recovery; deletion of a store's data on Shopify's request.
• Dependency updates and security review before each release; an incident response procedure with breach notification as set out above.

Annex III – Sub-processors