Data Processing Addendum

This DPA applies when Dollflow Install processes personal data on the Merchant’s behalf. The Merchant is the Controller and Great Big AB is the Processor. Each party will comply with data-protection law applicable to its role. The Merchant’s use and configuration of the service are documented processing instructions.

If applicable law requires us to process data other than on the Merchant’s instructions, we will inform the Merchant before processing unless the law prohibits notice.

Subject and duration. Product-linked installation and repair scheduling, dispatch, communications, completion records, evidence, payment-state records, and optional calendar synchronization for the Merchant’s use of the service and the applicable retention period.

Nature and purpose. Collection, organization, storage, retrieval, transmission, matching, updating, restriction, export, redaction, and deletion needed to create and administer field-service jobs and secure the platform.

Data subjects. Customers and prospective customers; Merchant owners, staff, and administrators; technicians and contractors; and individuals whose information incidentally appears in authorized job evidence.

Data categories. Identity and contact details, addresses and access instructions, Shopify product/order references, service and appointment details, technician skills and schedules, communications and delivery records, payment-state metadata, private-link records, completion notes and checklists, job photographs, IP/security records, and optional Google Calendar identifiers, busy-time responses, OAuth tokens, and Dollflow-created event identifiers.

The Merchant must not instruct Dollflow to process special-category, criminal-offence, government-identity, payment-card, or other highly sensitive data unless the feature expressly supports it and the Merchant has established a lawful basis and suitable safeguards.

• Process personal data only on documented lawful instructions and notify the Merchant if an instruction appears to violate applicable data-protection law.
• Ensure authorized personnel are subject to confidentiality.
• Maintain appropriate technical and organizational measures proportionate to risk.
• Assist the Merchant, taking account of the processing and information available, with data-subject rights, security obligations, breach notifications, impact assessments, and regulator consultations.
• Delete or return personal data at the end of services as described in the Retention Policy, unless law requires retention.
• Provide information reasonably necessary to demonstrate compliance and cooperate with proportionate audits subject to confidentiality, security, and cost arrangements.

Measures include encrypted transport; authenticated Shopify administration and webhooks; tenant separation; role- and token-based access; hashed private-link tokens; encrypted Google refresh tokens; expiring technician and scheduling access; limited data returned from Google; logging of relevant operational and privacy actions; dependency maintenance; backups and managed infrastructure; and tested privacy-export and redaction logic.

Measures evolve with risk and technology. We may replace a measure with an equally or more protective control without materially reducing overall protection.

The Merchant gives general written authorization to use the subprocessors listed at /subprocessors. We will impose substantially equivalent data-protection obligations where required and remain responsible for subprocessor performance to the extent required by law.

We will post changes to the Subprocessor List before a new provider begins materially processing Merchant personal data where reasonably practicable. The Merchant may object on reasonable data-protection grounds by contacting us. The parties will try to resolve the objection; if no reasonable alternative is available, the Merchant may stop using the affected feature or terminate the service.

When processing involves a restricted international transfer, the parties will rely on a lawful mechanism such as an adequacy decision, the European Commission’s Standard Contractual Clauses, or another recognized safeguard. The Merchant authorizes us to complete and rely on the applicable module of those clauses and related supplementary measures where required.

We will notify the Merchant of a direct data-subject request relating to Merchant-controlled data unless prohibited. We will not respond as Controller for the Merchant. Shopify’s authenticated customers/data_request, customers/redact, and shop/redact webhooks support export, redaction, and shop deletion workflows.

Retention and deletion details are set out in the Data Retention and Deletion Policy. The Merchant remains responsible for determining whether longer retention is legally required outside Dollflow and for exporting any record it must preserve.

We will notify the Merchant without undue delay after becoming aware of a personal-data breach affecting data processed on the Merchant’s behalf. We will provide available information reasonably needed for the Merchant’s response and take appropriate steps to contain and remediate the incident. Notification is not an admission of fault.

The Merchant warrants that its instructions and collection are lawful, transparent, limited to what is necessary, and supported by an appropriate lawful basis. The Merchant is responsible for notices to customers and technicians, permissions for job photographs, access controls, user management, and deciding whether the service is appropriate for its processing.

If this DPA conflicts with the Terms on personal-data processing, this DPA controls. The liability provisions in the Terms apply to this DPA to the extent permitted by law.