Data Processing Addendum

1. Scope and acceptance

This DPA applies automatically when you install or use the App and stays in force for as long as we process personal data for you. It supplements the Shopify Partner Program Agreement and Shopify API terms under which the App is offered, and our Privacy Policy. If those documents conflict on the protection of personal data, this DPA takes precedence.

2. Roles

For personal data processed through the App about your shoppers and your staff, the Merchant is the controller and Novogroup is the processor. You are responsible for having a lawful basis for the processing and for giving your shoppers the required privacy notices. Shopify is the platform on which your store and the App run; it processes data under your own agreement with Shopify and is not a party to this DPA.

3. Subject matter, duration, nature and purpose

The subject matter is the provision of the App. Processing lasts while the App is installed and then until deletion under Section 10. We collect, store, analyse, transmit and delete personal data only to:

• calculate 3D print quotes from files your shoppers upload;
• store uploaded files so you can download them and fulfil orders;
• send a quote by email when a shopper asks for it, and send the notifications you enable;
• verify order lines created by the App and produce purchase analytics, once Shopify approves the App's access to order data for your store;
• fulfil privacy requests that Shopify forwards to us.

4. Data subjects and personal data

• Shoppers: 3D model files they upload and the file names, with the measurements, options and prices calculated from them; an email address, only if the shopper types it into the quote form to receive a quote; and, for order lines created by the App, the Shopify order ID and name, order time, line ID, title, price, quantity and the App's own line properties.
• Merchant staff: your shop domain and the staff or contact email addresses you enter for notifications or support.

We do not request or store Shopify's protected customer name, email, phone or address fields. The App is not designed to process special categories of personal data.

5. Our obligations as processor

We will:

• process personal data only on your documented instructions, which are this DPA and your configuration and use of the App (for example your retention settings), unless EU or Member State law requires otherwise; we will tell you if we believe an instruction breaks data protection law;
• ensure that everyone we authorise to process the data is bound by confidentiality;
• apply appropriate technical and organisational measures under Article 32 GDPR, including:
  • application-level AES-256-GCM encryption of stored shopper email addresses and privacy-request payloads before they are written to the database; the key is held in the hosting environment, separate from the database and its storage;
  • HTTPS for all traffic to the App and to file storage, and verification of Shopify webhook signatures;
  • a database reachable only by the application over a private network, never exposed to the internet;
  • uploaded files held in private object storage and accessed through time-limited signed links;
  • access control and least privilege: production access is limited to authorised personnel who need it to run, secure or support the App;
  • error reports scrubbed of IP addresses, cookies, request headers and bodies, query strings, email addresses, phone numbers and tokens before they leave our server;
• follow Sections 6 to 11 on sub-processors, assistance, breaches, deletion and audits.

6. Sub-processors

You give us general written authorisation to use the following sub-processors:

• Hetzner Online GmbH (Germany): hosting of the application, PostgreSQL database and operational logs.
• Cloudflare, Inc.: R2 object storage for uploaded 3D files.
• Resend: transactional email (quotes a shopper requests, merchant notifications and privacy-request reports to the shop owner).
• Functional Software, Inc. (Sentry): server error diagnostics, in its EU data region, receiving only scrubbed reports kept for no more than 90 days.

Shopify processes data as the platform operator under your agreement with Shopify. We bind each sub-processor to data protection terms no less protective than this DPA and remain responsible for its performance. We announce changes by updating this page and its date before a new sub-processor starts processing your data. You may object by contacting us; if we cannot resolve the objection, you may stop using and uninstall the App.

7. International transfers

Our application and database are hosted in Germany. Some sub-processors are based outside the European Economic Area. Where personal data is transferred outside the EEA, the transfer relies on a European Commission adequacy decision or on the Standard Contractual Clauses included in the provider's data processing terms.

8. Assistance with requests and assessments

We help you answer data subject requests. The App supports Shopify's mandatory privacy webhooks: for customers/data_request we build a minimised report of the data we hold about the shopper and email it to the shop owner; for customers/redact we delete the shopper's quote-email records and clear order identifiers and purchase analytics for the orders Shopify names; for shop/redact we delete the shop's data. If a shopper contacts us directly, we refer them to you. We also give you the information you reasonably need for a data protection impact assessment or a consultation with a supervisory authority.

9. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and where feasible within 72 hours. The notice will describe, as far as known, the nature of the breach, the data and people affected, likely consequences, and the measures taken or proposed. We will take reasonable steps to contain the breach and limit its effects.

10. Retention and deletion

• Uploaded files are kept for the period you select, 1 to 90 days (30 days by default), then deleted through a queue that retries until deletion succeeds.
• Shareable quote links and any shopper email given for quote delivery are deleted after 1 to 90 days (7 days by default).
• Order-linked purchase analytics are anonymised after 24 months.
• Pending privacy-request reports are deleted after delivery, and at the latest after 30 days.
• When the App is uninstalled from your store, or Shopify sends shop/redact, we delete your shop's data and queue its files for deletion.

We keep personal data longer only where EU or Member State law requires it.

11. Audits and information

On reasonable request, we will provide the information necessary to demonstrate our compliance with Article 28 GDPR, such as a description of our security measures and sub-processors. Where that information is not enough, we will allow for and contribute to audits by you or an auditor you mandate, with reasonable notice, subject to confidentiality and at your cost.

12. Liability and governing law

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Shopify terms and App terms that govern your use of the App. This DPA is governed by the laws of Romania, and the courts of Romania have jurisdiction over any dispute. This does not limit the rights data subjects have under the GDPR or other mandatory law.

13. Changes and contact

We may update this DPA when the App or the law changes; the current version is always published on this page with its date. Last updated: September 25, 2026. For questions about this DPA, contact Novogroup Systems SRL, Romania, at contact@novo.ro.