Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") is between you, the Aplon customer ("Controller"), and Hallway Ltd, incorporated in Cyprus, operating as Aplon ("Processor", "we", "us"). It applies where we process personal data on your behalf in providing the Aplon service, and it governs that processing for as long as we do.

It gives effect to Article 28(3) of Regulation (EU) 2016/679 ("GDPR"), and to the UK GDPR and the Data Protection Act 2018 where those apply to you. Terms used here — personal data, processing, controller, processor, data subject, personal data breach, supervisory authority — have the meanings given in the GDPR.

Which role applies to which data. For personal data about the people who use your Aplon account — your own account and billing data — we are the controller, and our Privacy Policy governs it; this DPA does not. For personal data about your customers and storefront visitors, which reaches us from your Shopify store and your connected tools, you are the controller and we are your processor. This DPA governs that.

2. Subject matter and duration

The subject matter is the provision of the Aplon analytics service. The nature and purpose of the processing, the types of personal data, and the categories of data subject are set out in Annex 1. Processing lasts for as long as your account is open, and ends as set out in section 10.

3. Your instructions

We process the personal data covered by this DPA only on your documented instructions, including on transfers to a third country, unless required to do otherwise by law that applies to us — in which case we will tell you before processing, unless that law prohibits it on important grounds of public interest.

Your instructions are: this DPA, the Terms of Service, and the actions you take in the product — connecting a store or a marketing tool, running a report, exporting data, asking Aplo a question, or configuring how the service behaves. We will tell you if, in our opinion, an instruction infringes data protection law.

We do not sell this data, use it for our own marketing, or use it to train AI models. We do not use it to build profiles or datasets across customers.

4. Your responsibilities

You are responsible for having a lawful basis for the processing you instruct, for giving your customers the information data protection law requires, and for obtaining any consent needed — including consent for the storefront analytics pixel where your storefront collects consent. You confirm you are entitled to disclose the personal data you connect to Aplon, and that your instructions comply with applicable law.

5. Confidentiality and staff

We keep the personal data confidential. Access is limited to personnel who need it to provide, support, and secure the service; they are bound by confidentiality obligations, and their access is logged. Personnel access to a customer account is read-only and recorded in an internal access log.

6. Sub-processors

You give us general authorisation to engage sub-processors. Our current sub-processors, what each does, and where each is located, are listed in the sub-processor table in our Privacy Policy, which is the single, maintained list.

Before adding or replacing a sub-processor that processes personal data covered by this DPA, we will give you at least 30 days' notice by email to your account address. If you reasonably object on data protection grounds within that period, tell us and we will work with you in good faith to find an alternative. If we cannot, you may terminate your subscription for the affected part of the service and receive a pro-rata refund of fees paid in advance for the unused remainder.

We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain fully liable to you for their performance.

7. Security

We implement and maintain appropriate technical and organisational measures under Article 32, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to individuals. Those measures are described in Annex 2. We may update them, provided the level of protection is not reduced.

8. Personal data breaches

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting personal data we process for you. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned so far as known, the likely consequences, the measures taken or proposed, and a contact point. Where we cannot provide all of that at once we will provide it in phases, without undue further delay. We will assist you with your own notification obligations under Articles 33 and 34.

9. Assistance

Data subject rights. Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, so far as possible, in responding to requests to exercise rights under Chapter III. In practice much of this is self-service: your Aplon account lets you view, export, and delete the data we hold for you. Where a request reaches us directly from one of your customers, we will not respond to it ourselves — we will refer them to you and tell you promptly.

We also act on the mandatory data requests and deletion requests Shopify forwards on a shopper's behalf, and on a store's deletion request when you uninstall the app. We will also assist you with data protection impact assessments and prior consultation under Articles 35 and 36, taking into account the information available to us.

10. Deletion and return

At your choice, we will delete or return the personal data at the end of the provision of the service, and delete existing copies, unless law requires us to keep it. Deleting your account from Settings deletes it immediately, and you can export your data from the product beforehand. Backups are overwritten on our providers' normal rolling cycles. Records we must keep for tax and accounting are retained for the periods set out in the Privacy Policy, and remain subject to this DPA for as long as we hold them.

11. Audits

We will make available the information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate. In the first instance we will respond to a reasonable written request for information, including any third-party audit reports or certifications our sub-processors have made available. Where that is genuinely not sufficient, an on-site audit may take place on 30 days' notice, no more than once in any twelve months unless required by a supervisory authority or following a breach, during business hours, subject to confidentiality, and conducted so as not to disrupt our operations. You bear your own costs and ours.

12. International transfers

Some of our sub-processors are outside the European Economic Area, as shown in the Privacy Policy's table. Where personal data covered by this DPA is transferred out of the EEA or the UK, we rely on an appropriate safeguard under Chapter V: an adequacy decision where one covers the transfer, and otherwise the Standard Contractual Clauses approved by the European Commission (Decision 2021/914), together with the UK International Data Transfer Addendum where the UK GDPR applies. Where those clauses apply, module two (controller to processor) applies between you and us, and module three (processor to processor) between us and our sub-processors; docking is permitted; the governing law and forum are those of the Republic of Cyprus; and Annexes 1 and 2 of this DPA populate the corresponding annexes of the clauses. You can request a copy of the relevant transfer mechanism from contact@aplon.io.

13. Liability and precedence

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service. This DPA does not limit any right a data subject has under the GDPR. If this DPA conflicts with the Terms of Service or the Privacy Policy on a question about processing personal data on your behalf, this DPA prevails. If it conflicts with the Standard Contractual Clauses, the Clauses prevail.

Annex 1 — Details of the processing

Subject matter and duration

Provision of the Aplon analytics service, for the term of your subscription and until deletion under section 10.

Nature and purpose

Collecting, storing, organising, structuring, aggregating, analysing and displaying data from your connected Shopify store, your storefront, and your connected advertising and marketing accounts, in order to produce the analytics, reports, alerts, digests and AI-generated answers you ask for; and providing support in relation to that service.

Categories of data subject

• Your customers — people who have placed an order with your store
• Visitors to your storefront, including people who did not buy
• Subscribers to your email marketing, where you connect a marketing tool
• Your own staff, where you give them a seat on your Aplon account

Types of personal data

• Customer records: name, email address, location to city level, order history, order value, currency, and the products bought
• Order and fulfilment data: order identifiers, timestamps, discounts, refunds, returns, shipping and payment metadata
• Storefront behaviour: a randomly generated visitor and session identifier, page URLs viewed, referrer, campaign parameters, device type, approximate country, and purchase events
• Marketing engagement: where you connect a tool such as Klaviyo, aggregate engagement such as opens, clicks and attributed revenue
• Seat data: the email address and access settings of staff you invite

No special category data. The service is not designed to process data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data about sex life or sexual orientation, and you must not instruct us to. It does not process payment card numbers or bank details belonging to your customers — those stay with your payment provider. Note that a product name in an order can itself reveal sensitive information about a buyer; if your catalogue is of that kind, consider that before connecting the store.

Frequency and location

Continuous, for the term of the subscription. Primary storage is in the European Union. Sub-processor locations are listed in the Privacy Policy.

Annex 2 — Technical and organisational measures

The measures in force at the date above. They may be updated, but not weakened.

Encryption

• All data in transit encrypted with TLS 1.2 or higher
• Data at rest encrypted by our database and hosting providers
• Third-party access tokens and API keys — Shopify, Meta, Google, Snapchat, Klaviyo — separately encrypted at rest with AES-256-GCM before storage, so a database copy alone does not yield a usable credential
• Sensitive personal details such as bank account information encrypted at rest by the same mechanism

Access control and separation

• Row-level security enabled on every table, with direct access revoked for anonymous and general authenticated roles, so data is reachable only through the application's own authorisation logic
• Each customer's data is keyed to their account and separated at query level; no shared, cross-customer datasets are built
• Four separate authentication realms — merchant, staff, affiliate, administrator — with tokens from one unable to access another
• Passwords stored only as salted PBKDF2 hashes; two-factor authentication available and required for administrative accounts
• Per-device sessions that can be revoked individually; sessions expire after 30 days
• Administrative actions recorded in an audit log; access to customer personal data recorded in a separate access log; support access to a customer account is read-only
• Production credentials held only in the hosting providers' secret stores, never in source control

Integrity and resilience

• Managed database hosting with automated backups and point-in-time recovery
• Cryptographic signature verification on all inbound webhooks, so data cannot be injected by a third party
• Rate limiting and input validation on public endpoints
• Security headers and a content security policy on all web surfaces
• Automated dependency vulnerability scanning, with security updates applied on a regular cycle
• Changes reviewed and tested before release, against a separate development environment that holds no live customer data

Monitoring and organisation

• Application error monitoring, with payloads scrubbed of personal data before they leave our systems
• Periodic internal security review, with findings tracked to resolution
• Personnel bound by confidentiality obligations, with access granted on a need-to-know basis and removed when no longer required
• A documented process for handling and notifying personal data breaches

We are a small company and do not currently hold an ISO 27001 or SOC 2 certification. We say so rather than implying otherwise: several of our sub-processors do hold them, and their reports are available through them.

Contact

Hallway Ltd (operating as Aplon)
Tefkrou Anthia 90, Ayia Napa, 5330, Ammochostos, Cyprus
contact@aplon.io