DRAFT — NOT YET APPROVED FOR PUBLICATION

This is the full working Data Processing Addendum (“DPA”) for Utfix. It is structured to cover controller-to-processor requirements for UK GDPR / EU GDPR-style processing, but bracketed factual items must be completed before publication or contractual use. In particular: legal provider identity/address, production hosting, subprocessor list and locations, international-transfer mechanism, final retention/deletion schedule, production security measures, and completion of the Shopify deletion/data-map verification.

Version: 1.0
Effective date: [EFFECTIVE DATE]

This DPA forms part of the agreement governing use of Utfix between the merchant or other business using the Services (“Merchant”, “Controller”, “you” or “your”) and [LEGAL NAME], trading as Utfix (“Utfix”, “Processor”, “we”, “us” or “our”).

Utfix privacy contact: Utfix@Utfix.shop
Website: https://utfix.shop
Business/service address: [BUSINESS / SERVICE ADDRESS]

This DPA applies only to the extent that Utfix processes Personal Data on behalf of the Merchant as a Processor in providing the Services. It does not govern processing for which Utfix acts as an independent Controller, such as certain account administration, security, fraud-prevention, legal-compliance or direct business-administration activities described in the Utfix Privacy Policy.

For this DPA:

Applicable Data Protection Law means the data-protection and privacy law applicable to the relevant processing, including, where applicable, the UK GDPR, the Data Protection Act 2018, the EU GDPR and any legislation implementing, replacing or supplementing them.

Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Processing and Supervisory Authority have the meanings given by Applicable Data Protection Law.

Merchant Personal Data means Personal Data processed by Utfix on behalf of the Merchant in connection with the Services.

Subprocessor means another Processor engaged by Utfix to process Merchant Personal Data on behalf of the Merchant.

Services has the meaning given in the Utfix Terms and includes supported diagnostics, Repair Proposals, approved Repairs, verification, Monitoring, History, audit evidence and related functionality made available by Utfix.

Restricted Transfer means a transfer of Personal Data that requires a specific transfer mechanism under Applicable Data Protection Law.

Capitalised terms not defined here have the meanings given in the Utfix Terms and Conditions.

2.1 This DPA applies where the Merchant acts as Controller (or as a Processor authorised to appoint Utfix as a further Processor) and Utfix processes Merchant Personal Data on the Merchant’s behalf.

2.2 The subject matter, duration, nature and purpose of processing, types of Personal Data and categories of Data Subjects are described in Annex 1.

2.3 If there is a conflict between this DPA and the Utfix Terms concerning Processor obligations for Merchant Personal Data, this DPA takes priority for that subject.

2.4 Nothing in this DPA changes the parties’ roles where Applicable Data Protection Law determines that a party acts as an independent Controller for a particular processing activity.

2.5 Where the Merchant is itself a Processor for another Controller, the Merchant confirms that it is authorised to appoint Utfix as a Subprocessor and to give the instructions described in this DPA.

3.1 Utfix will process Merchant Personal Data only on the Merchant’s documented instructions, unless Applicable Data Protection Law requires otherwise.

3.2 The Merchant’s documented instructions include:

• the Utfix Terms, this DPA and applicable purchase/feature terms;
• installing and configuring Utfix;
• permissions and supported connections authorised by the Merchant;
• running supported Diagnostics;
• creating Findings, Repair Proposals and merchant-facing evidence;
• carrying out Repairs specifically approved by the Merchant;
• verifying approved work and recording the outcome;
• operating Monitoring rules activated by the Merchant;
• providing History, receipts, audit evidence and downloadable records;
• support instructions and other written instructions accepted by Utfix; and
• processing reasonably necessary to secure, maintain and provide those Processor activities.

3.3 A Shopify or connected-service permission does not by itself constitute authority for a live Repair. Repair authority remains subject to the applicable Utfix approval boundary.

3.4 If Utfix is required by law to process Merchant Personal Data outside the Merchant’s instructions, Utfix will inform the Merchant before doing so unless the law prohibits that notification.

3.5 Utfix will inform the Merchant if, in its reasonable opinion, an instruction infringes Applicable Data Protection Law. Utfix may suspend the affected processing while the parties clarify the instruction.

4.1 The Merchant is responsible for determining that its instructions to Utfix comply with Applicable Data Protection Law.

4.2 The Merchant is responsible for:

• having an appropriate lawful basis for the Personal Data it instructs Utfix to process;
• providing any privacy information required to Data Subjects;
• obtaining any consent required by law;
• ensuring that users who configure or approve Utfix are authorised to act for the Merchant;
• ensuring that Personal Data supplied to Utfix is relevant and reasonably necessary for the Services; and
• not placing unnecessary customer, payment, special-category or other sensitive Personal Data into free-text or generic Utfix fields.

4.3 Utfix is not designed to require shopper/customer, order or payment data as a routine input to its core diagnostic model. The Merchant should not provide such information unless a supported feature specifically requires it and the Merchant is authorised to provide it.

5.1 Utfix will ensure that persons authorised to process Merchant Personal Data are subject to confidentiality obligations or an appropriate statutory duty of confidentiality.

5.2 Access to Merchant Personal Data will be limited to persons and service providers who need that access to provide, secure, maintain or support the applicable Services.

5.3 Utfix remains responsible for ensuring that its authorised personnel process Merchant Personal Data consistently with this DPA.

6.1 Utfix will implement and maintain appropriate technical and organisational measures designed to protect Merchant Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking account of:

• the state of the art;
• implementation costs;
• the nature, scope, context and purposes of processing; and
• the likelihood and severity of risks to individuals.

6.2 The current intended security framework includes measures concerning authenticated Shopify sessions and webhooks, store-scoped access controls, least-privilege permissions, read/write separation, merchant approval for supported write activity, constrained outbound Shopify connections, and controlled access to merchant audit artifacts.

6.3 Utfix will review its security measures as the Services and risk profile change.

6.4 Annex 2 contains the security-measure schedule for this DPA.

[BEFORE PUBLICATION: Annex 2 must be reconciled against the production deployment, including infrastructure/IAM, encryption, database access, secrets management, logging, monitoring, backups, deletion, incident response and recovery. Do not represent source-code controls as complete production security until verified.]

7.1 Utfix will notify the Merchant without undue delay after becoming aware of a Personal Data Breach affecting Merchant Personal Data.

7.2 Taking into account the information available to Utfix, the notification will include information reasonably necessary for the Merchant to assess its notification obligations, such as:

• the nature of the breach;
• the categories of Personal Data and Data Subjects affected, where known;
• the likely consequences, where reasonably ascertainable;
• measures taken or proposed to address the breach; and
• an appropriate contact point for follow-up.

7.3 Where all information is not available at once, Utfix may provide it in phases without undue further delay.

7.4 Utfix’s notice of an incident is not an admission of fault or liability.

7.5 The Merchant remains responsible for determining whether it must notify a Supervisory Authority, Data Subjects or another person, except where the law imposes a direct obligation on Utfix.

8.1 The Merchant gives Utfix general written authorisation to engage Subprocessors necessary to provide the Services, subject to this section.

8.2 Utfix will maintain a current list of Subprocessors that process Merchant Personal Data on its behalf.

8.3 Before appointing a new Subprocessor that materially affects the processing of Merchant Personal Data, Utfix will provide reasonable notice where required by Applicable Data Protection Law and give the Merchant a reasonable opportunity to object on legitimate data-protection grounds.

8.4 If the Merchant raises a substantiated objection, the parties will work in good faith to identify a reasonable solution. If no reasonable solution is available, either party may terminate the affected Service where legally and contractually permitted.

8.5 Utfix will impose written data-protection obligations on each Subprocessor that provide an appropriate level of protection for Merchant Personal Data and cover the applicable Article 28-style obligations.

8.6 Utfix remains responsible to the Merchant for a Subprocessor’s performance of its Processor obligations to the extent required by Applicable Data Protection Law.

[FINAL SUBPROCESSOR SCHEDULE REQUIRED BEFORE PUBLICATION: provider name, service/purpose, data involved, processing location(s), and applicable transfer mechanism. Hosting/database/logging/backup providers must be verified against the production stack.]

9.1 Utfix will not make a Restricted Transfer of Merchant Personal Data except in accordance with Applicable Data Protection Law and the Merchant’s documented instructions.

9.2 Where a lawful transfer mechanism is required, Utfix will use an appropriate mechanism, which may include:

• an applicable adequacy regulation or adequacy decision;
• the UK International Data Transfer Agreement (“IDTA”);
• the UK Addendum to the EU Standard Contractual Clauses;
• applicable EU Standard Contractual Clauses; or
• another lawful transfer mechanism recognised by the applicable jurisdiction.

9.3 Where a transfer mechanism requires supplementary measures or an assessment of transfer risk, the parties will provide reasonable cooperation appropriate to their respective roles.

9.4 A merchant’s direct use of an independent Third-Party Service may also be governed by that provider’s own transfer arrangements.

[BEFORE PUBLICATION: identify production hosting/subprocessor locations and select the transfer mechanism(s) actually required. This draft does not itself claim that any particular SCC, IDTA or Addendum is currently incorporated.]

10.1 Taking into account the nature of the processing, Utfix will provide reasonable technical and organisational assistance to help the Merchant respond to requests by Data Subjects exercising rights under Applicable Data Protection Law.

10.2 If Utfix receives a request relating to Merchant Personal Data for which the Merchant is Controller, Utfix may direct the requester to the Merchant and will not independently respond on the Merchant’s behalf unless authorised or legally required.

10.3 Shopify may send mandatory privacy-compliance webhooks concerning customer data access, customer data deletion and shop data deletion. Utfix will handle authenticated Shopify privacy requests consistently with Applicable Data Protection Law, Shopify requirements and the final approved data-classification/deletion design.

10.4 [FINAL TECHNICAL SIGN-OFF REQUIRED: customer-data classification, customer access/redaction handling, shop-redact fault behaviour and complete data-map/deletion coverage must be proved before this clause is relied on in production.]

11.1 Taking into account the nature of processing and information available to Utfix, Utfix will provide reasonable assistance to the Merchant with obligations concerning:

• security of processing;
• Personal Data Breach assessment and notification;
• data-protection impact assessments (“DPIAs”); and
• prior consultation with a Supervisory Authority where required.

11.2 Utfix may provide available information about its processing, security measures, Subprocessors and relevant product architecture to support the Merchant’s assessment.

11.3 The Merchant remains responsible for its own compliance decisions, DPIAs and regulatory submissions.

11.4 If a Merchant requests assistance materially beyond the ordinary information and support reasonably included with the Services, the parties may agree reasonable additional arrangements or charges where permitted by law, provided this does not reduce assistance that Applicable Data Protection Law requires Utfix to provide.

12.1 Utfix will make available information reasonably necessary to demonstrate compliance with its obligations under this DPA and Applicable Data Protection Law.

12.2 Where reasonable, Utfix may satisfy information requests through current documentation, security/privacy materials, independent reports, questionnaires or other evidence before requiring an on-site audit.

12.3 Where Applicable Data Protection Law gives the Merchant a right to audit or inspect Processor compliance, Utfix will allow and contribute to a reasonable audit by the Merchant or an independent auditor appointed by the Merchant, subject to appropriate confidentiality and security safeguards.

12.4 Unless an urgent audit is reasonably required because of a material incident, regulator request or credible evidence of material non-compliance, audits must:

• be requested on reasonable advance notice;
• occur during normal business hours;
• avoid unreasonable disruption to Utfix or other merchants;
• be limited to systems and information relevant to the Merchant’s Personal Data; and
• protect the security, confidentiality and rights of other customers and third parties.

12.5 An auditor must not be a direct competitor of Utfix unless required by law or approved by Utfix acting reasonably.

12.6 Each party bears its own ordinary audit costs unless Applicable Data Protection Law requires another allocation or an audit identifies material non-compliance by Utfix that justifies reasonable remediation costs.

13.1 At the end of the Processor Services, Utfix will, at the Merchant’s choice where required by Applicable Data Protection Law, delete or return Merchant Personal Data and delete remaining copies, unless law requires continued storage.

13.2 The method and timing of return/deletion may take account of:

• the nature of the relevant records;
• active secure backups and normal backup overwrite cycles;
• accounting, legal-claims or regulatory retention requirements;
• Shopify mandatory privacy processes; and
• technical limitations that Applicable Data Protection Law permits to be addressed through controlled retention and access restriction.

13.3 Personal Data retained because of a legal obligation will remain protected by this DPA and will not be processed for unrelated purposes.

13.4 The Merchant should export merchant-facing records it wishes to retain before uninstalling or terminating Utfix where the product provides that functionality.

13.5 [FINAL RETENTION/DELETION SCHEDULE REQUIRED BEFORE PUBLICATION: ordinary TTLs, post-uninstall treatment, SHOP_REDACT completion, logs, backups, Credit/accounting records, audit artifacts and any legally required retention must be reconciled with the production implementation.]

13.6 This DPA must not be interpreted as promising immediate deletion of all Utfix data merely because the Shopify application is uninstalled unless and until the production implementation and retention schedule support that statement.

14.1 Utfix may process limited data as an independent Controller where it determines the purposes and means of processing for its own legitimate business/legal purposes, such as:

• direct account/business administration;
• billing, Credit-account administration and accounting;
• service security and abuse/fraud prevention;
• defending or establishing legal claims;
• compliance with law or binding authority; and
• direct support/website enquiries addressed to Utfix.

14.2 Such processing is governed by the Utfix Privacy Policy and Applicable Data Protection Law rather than the Processor instructions in this DPA.

14.3 Utfix will not reclassify merchant-instructed Processor data as Controller data merely to avoid its obligations under this DPA.

15.1 Liability arising under this DPA is subject to the applicable liability provisions of the Utfix Terms to the extent permitted by Applicable Data Protection Law.

15.2 Nothing in the Utfix Terms or this DPA excludes liability that Applicable Data Protection Law does not permit the parties to exclude or limit.

15.3 This DPA does not create rights for a Data Subject beyond those provided by Applicable Data Protection Law, except where an incorporated transfer mechanism expressly provides otherwise.

16.1 We may update this DPA where reasonably necessary to reflect changes in the Services, Subprocessors, Applicable Data Protection Law, regulator guidance or Shopify/platform requirements.

16.2 Where a change materially affects Processor obligations or the protection of Merchant Personal Data, we will provide notice where required by Applicable Data Protection Law or the parties’ agreement.

16.3 A change will not retrospectively remove protection required by Applicable Data Protection Law.

17.1 Unless an applicable transfer mechanism or mandatory data-protection rule requires otherwise, this DPA follows the governing-law and jurisdiction provisions of the Utfix Terms.

17.2 [CURRENT PROPOSED DEFAULT IN TERMS: England and Wales — final confirmation required before publication.]

Data-protection questions concerning this DPA may be sent to:

Utfix Privacy
Email: Utfix@Utfix.shop
Legal provider: [LEGAL NAME]
Business/service address: [BUSINESS / SERVICE ADDRESS]
Website: https://utfix.shop

Processing of Merchant Personal Data necessary to provide supported Utfix diagnostics, Findings, Repair Proposals, approved Repairs, verification, Monitoring, History, Credit/audit records, support and related Processor functionality.

For the duration of the Merchant’s use of the relevant Services and thereafter only for the period required to return/delete data, maintain permitted secure backups, satisfy legal obligations or carry out other processing permitted by this DPA.

[FINAL RETENTION SCHEDULE TO BE INSERTED.]

Depending on the Merchant’s configuration and instructions, processing may include:

• authenticating and associating authorised merchant users with a Shopify store;
• reading supported Shopify/store configuration and connected-service evidence;
• normalising, comparing and evaluating store configuration;
• creating Diagnostics and Findings;
• preparing proposed Repairs;
• executing live changes expressly approved by the Merchant;
• independently verifying the result;
• preparing rollback/recovery information where supported;
• operating Monitoring/event-triggered checks;
• maintaining merchant-facing History, receipts and audit evidence;
• administering Credit records associated with Processor work; and
• providing support for the operation of Utfix.
• 
  

Primarily:

• Merchant owners, staff, contractors and authorised Shopify/Utfix users;
• business contacts associated with supported connected services where such contact information is exposed and relevant.

Customer/shopper Data Subjects are not intended as a routine category for Utfix’s core diagnostic model. Incidental customer personal data could enter generic/free-text/evidence fields if supplied by a merchant or provider; the final production data classification and Shopify customer-request handling must be verified before publication.

Depending on the Service:

• name, business email and business contact information;
• Shopify authenticated-user identifiers and associated authorised-user account information;
• shop/domain and Merchant account associations;
• permissions/scope records and connected-account identifiers;
• merchant decisions, approvals, acknowledgements and user-entered notes;
• business policies/settings where linked to an identifiable user;
• support communications;
• provider/event identifiers and operational evidence that may be linked to a merchant user; and
• incidental Personal Data that may appear in generic evidence, error, note or structured-data fields.

Store configuration such as products, variants, shipping, Markets, catalogues, identifiers, prices and channel states is generally business/operational data, but portions may constitute Personal Data where they identify or relate to an individual.

Utfix does not intend to collect or require special-category Personal Data, criminal-offence data, payment-card data, passwords, one-time codes, private API keys or full access tokens as ordinary Merchant inputs.

The Merchant must not place such information in Utfix unless a specifically supported feature lawfully requires it and appropriate safeguards have been agreed.

The Merchant retains the rights and obligations of Controller under Applicable Data Protection Law, including determining purposes/lawful basis, giving lawful instructions, providing required transparency, handling Data Subject requests and supervising Processor compliance.

The following describes the current intended/inspected control categories and must be finalised against the production environment before publication.

• Shopify-authenticated merchant sessions for embedded application access.
• Merchant/store identity derived from authenticated Shopify context.
• Store-scoped service access checks for merchant-facing resources.
• Least-privilege approach to Shopify scopes and feature permissions.
• Separate approval boundary before supported live Repair work.
• 
  

• Shopify SDK authentication for supported Shopify webhooks.
• Store association based on the authenticated Shopify shop.
• Fixed HTTPS Shopify Admin endpoints in inspected outbound clients.
• Validation of Shopify shop domains in inspected direct HTTP clients.
• Redirect refusal and bounded timeouts in inspected Shopify clients.
• Event/idempotency controls for supported webhook processing.
• 
  

• Merchant routes begin from authenticated store context.
• Store ownership checks are used by merchant-facing service wrappers.
• Audit-artifact access is store scoped.
• Cross-store access testing is intended as a release gate.

[Production tenant-isolation/data-integrity controls require final sign-off, including the outstanding plain-string-reference/provenance findings.]

• Core diagnostic design does not intentionally require customer/order/payment ingestion.
• Product/store content is treated as operational evidence rather than authority to expand permissions.
• Merchant-facing artifacts are designed to use bounded/sanitised historical snapshots where applicable.
• Credentials and access tokens are not intended for ordinary support/contact channels.
• 
  

• No committed production secrets were identified in the inspected source.
• Inspected application logging did not expose raw access tokens or customer payload bodies.
• Production log destination, access controls, retention and backup treatment remain to be verified.
• 
  

• Bounded execution/checkpoint concepts are used for supported Repair workflows.
• Fresh authoritative verification is used after supported Repairs.
• Rollback/recovery is disclosed and verified where supported.
• Production database backup, restore, continuity and disaster-recovery measures: [TO CONFIRM].
• 
  

• Store-isolation and authentication controls are subject to automated/release testing.
• Security/privacy findings are tracked for closure before beta/publication.
• Production vulnerability management, dependency-management, incident-response and periodic control-review process: [TO CONFIRM/INSERT FINAL OPERATING PROCEDURE].
• 
  

[FINAL SCHEDULE TO BE COMPLETED BEFORE PUBLICATION]

For each Subprocessor that processes Merchant Personal Data on behalf of Utfix, record:

SubprocessorService / purposeCategories of dataProcessing location(s)Transfer mechanism[TO CONFIRM]Production hosting / infrastructure[TO CONFIRM][TO CONFIRM][TO CONFIRM][TO CONFIRM]Database / storage[TO CONFIRM][TO CONFIRM][TO CONFIRM][TO CONFIRM]Logging / monitoring[TO CONFIRM][TO CONFIRM][TO CONFIRM][TO CONFIRM]Backup / recovery[TO CONFIRM][TO CONFIRM][TO CONFIRM][TO CONFIRM]Other Processor service[TO CONFIRM][TO CONFIRM][TO CONFIRM]

Shopify and merchant-selected connected services may act in their own roles rather than as Utfix Subprocessors depending on the particular data flow and contractual relationship. The final schedule must classify each provider according to the actual processing arrangement rather than assuming every integration is a Subprocessor.

No specific restricted-transfer module is incorporated by this draft merely by being listed here.

Before contractual publication, Utfix must identify the actual production data locations and, where a Restricted Transfer exists, specify the mechanism that applies. Depending on the facts, that may require an adequacy mechanism, EU Standard Contractual Clauses, the UK IDTA, the UK Addendum to the EU SCCs, and/or other recognised safeguards.

[FINAL TRANSFER MODULE / INCORPORATION WORDING TO BE COMPLETED AFTER HOSTING AND SUBPROCESSOR LOCATIONS ARE VERIFIED.]