Data Processing Addendum
Last updated: 31 October 2026. This page is available in English only.
Working draft. This document is provided for transparency. It is not legal advice and has not yet been reviewed by counsel. SMALLROCKS STUDIO LTD will update it before relying on it for compliance purposes.
This Data Processing Addendum ("DPA") forms part of the Terms of Service between the Shopify merchant ("Controller", "you") and SMALLROCKS STUDIO LTD, company no. 17261473, 128 City Road, London, EC1V 2NX, United Kingdom ("Processor", "we"). It applies to personal data we process on your behalf through the OmniBuzz App.
1. Roles and scope
OmniBuzz is designed so that it does not process personal data of your customers. It reads product and price data and does not read customer or order records. The only personal data we process for you is limited to the staff users of your store, as Shopify provides it in sessions (name, email address and locale of a logged-in staff member). For that data you are the controller and we are your processor. For account and billing relations, we act as a controller as the Privacy Policy says. We process personal data only to provide the App and only on your documented instructions, which you give through your use of the App and these terms.
2. Details of processing
- Subject matter
- Operating a price-history and reference-price display for your store
- Duration
- While the App is installed, plus the purge period after uninstall (see the Privacy Policy)
- Nature and purpose
- Authenticating the App to your store through Shopify, reading product prices, storing price history and writing a result to a product variant metafield
- Categories of data subject
- Staff users of your Shopify store who open the App
- Categories of personal data
- Staff name, email address, locale and Shopify user id, as contained in Shopify sessions
- Special-category data
- None
3. Our obligations
- Process personal data only on your instructions and for the purposes above.
- Make sure persons authorized to process the data are bound by confidentiality.
- Apply appropriate technical and organizational measures: TLS in transit, EU-hosted infrastructure, containers with reduced privileges and restricted production access.
- Help you answer data-subject requests and meet your security, breach-notification and impact-assessment duties, taking the nature of the processing into account.
- Tell you without undue delay after we become aware of a personal-data breach.
- Delete the personal data when the service ends, as the Privacy Policy describes, unless the law requires us to keep it.
- Make available the information needed to show we comply with this DPA.
4. Sub-processors
Shopify International Ltd and Shopify Inc. provide the platform the App extends. Shopify is an independent controller of its own data and is not our sub-processor. You authorize the following sub-processors. We will tell you about intended changes and give you the chance to object.
| Sub-processor | Purpose | Location |
|---|---|---|
| netcup GmbH | Application server and PostgreSQL database hosting | Germany (EU) |
| Object storage provider for database backups | Off-site copy of database backups | Region to be confirmed by us before launch |
5. International transfers
Processing infrastructure is in the EU. A transfer outside the UK or the EEA is covered by an adequacy decision or by Standard Contractual Clauses together with the UK International Data Transfer Addendum.
6. Shopify privacy webhooks
The App receives Shopify's mandatory privacy webhooks. customers/data_request and
customers/redact are acknowledged because the App stores no customer personal data.
shop/redact, sent about 48 hours after uninstall, purges the shop's data.
7. Contact
Data-protection matters under this DPA: privacy@smallrocks.studio.