Data Processing Addendum

Effective date: October 18, 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between the Shopify merchant ("Merchant") and Pingmerce for WhatsApp Restock Alert. It applies when Pingmerce processes personal data on the Merchant's behalf.

Roles and instructions

The Merchant is the controller or business and Pingmerce is the processor or service provider. We process personal data only on documented instructions in the Terms, this DPA, app configuration, and Merchant use of the service, unless applicable law requires otherwise.

Processing details

• Subject: collection and delivery of one-time restock notifications.
• Duration: while installed and for the limited retention periods in the Privacy Policy.
• Data subjects: Merchant shoppers and prospective customers who request an alert; authorized Merchant users.
• Personal data: phone number, consent and notification timestamps, product/variant context, delivery status, and authorized-user audit identifiers.
• Operations: collection, validation, encrypted storage, matching, transmission to the selected provider, display/export to the Merchant, deletion, and auditing.

Confidentiality and security

Authorized personnel are bound by confidentiality and least-privilege access. We maintain encryption, environment separation, access logging, retention, backup protection, data-loss prevention, and incident-response controls described in the Security page.

Subprocessors

Merchant authorizes Shopify, Cloudflare Workers and D1 for production hosting and transient processing, merchant configuration storage, and legacy data pending the transition in the Privacy Policy. New shopper records in the Shopify-storage version are stored in the Merchant's Shopify account, not Pingmerce D1. Merchant also authorizes the Merchant-selected Twilio or Meta WhatsApp Cloud API as subprocessors needed to provide the service. We require appropriate data protection obligations and remain responsible for our subprocessors as required by applicable law. Merchant can request the current subprocessor list at ghasankececi@gmail.com.

International transfers

Where a transfer mechanism is required, the parties will rely on an applicable adequacy decision, contractual clauses, or another lawful safeguard. Merchant is responsible for selecting and configuring a messaging provider permitted for its use case and locations.

Data-subject requests

We provide reasonable assistance with access, deletion, restriction, and portability requests. Verified Shopify privacy webhooks prepare encrypted data responses for the Merchant and delete matching records. Merchant remains responsible for communicating with the requester and determining the response.

Incidents, deletion, and audits

We will notify the Merchant without undue delay after confirming a personal-data breach affecting Merchant data and provide available information needed for its obligations. On termination or verified deletion request, we delete or return personal data subject to documented retention and backup lifecycle requirements. We will provide reasonable documentation demonstrating these controls, subject to confidentiality and security limitations.

Contact

Data protection questions can be sent to ghasankececi@gmail.com.