This Data Processing Addendum (“DPA”) forms part of the Makewright Configurator Terms of Service between the Shopify merchant (“Merchant”) and Parallel Studio LLC (“Processor”) when the app processes personal data for the Merchant.
Roles and instructions
Merchant is the controller or business and Processor acts only on Merchant’s documented instructions, including those expressed through app configuration and use. Processing is limited to providing, securing, supporting, and legally maintaining the service.
Processing details
Processing covers configuration and quote collection, transactional communications, draft orders, paid-order linkage, support, security, retention, export, and deletion. Data subjects can include Merchant staff, prospective customers, and customers. Data can include names, email addresses, phone numbers, company, configuration choices, project notes, files, and Shopify order references. Payment-card data is not processed by Makewright.
Security and confidentiality
Processor uses access controls, encrypted transport, provider encryption at rest, independently encrypted and archive-verified database backups, verified Shopify requests and webhooks, shop-scoped application access, private file storage, audit records, and deletion controls. Access is limited to people and providers who need it to operate or support the service and who are bound by confidentiality duties.
Subprocessors
Merchant authorizes the providers listed on the Subprocessors page. Processor remains responsible for their processing under applicable data-protection terms. Material changes will be reflected on that page.
Requests, incidents, and deletion
Processor will reasonably assist Merchant with verified data-subject requests, security incidents, and applicable assessments. Processor will notify Merchant without undue delay after confirming a personal-data breach affecting Merchant data. On termination, data is deleted according to the Privacy Policy and Shopify’s mandatory compliance-webhook workflow, except where retention is legally required.
International processing
Data may be processed in the United States and other locations used by the listed providers. The parties will use a legally recognized transfer mechanism where applicable law requires one.