Data Processing Addendum
Version 1.1
1. Purpose & Scope
This Data Processing Addendum (“DPA”) describes how Safe-to-Ship processes merchant and customer information while providing the Safe-to-Ship Shopify application. Safe-to-Ship provides operational readiness evaluation and fulfillment coordination for Shopify merchants. The application processes only the information necessary to deliver these services.
2. Categories of Data Processed
Safe-to-Ship may process Shopify Order and Fulfillment Order information; order status; operational readiness information; operational event records; hold and release history; shop identifiers; and session information. Limited customer and order information made available through Shopify may also be processed where necessary, including customer contact details, shipping and billing addresses, browser IP address, device details, customer locale information, fraud assessment information, and other order-related information required to operate the application and satisfy Shopify privacy requirements.
3. Purpose of Processing
Data is processed solely to evaluate operational readiness; coordinate fulfillment holds and releases; maintain operational history and application audit records; provide application functionality; support merchants; and respond to Shopify privacy requests.
4. Data Minimisation & Security
Safe-to-Ship is designed to process only the minimum information necessary to operate the application. Certain customer and order information is synchronised from Shopify as part of Shopify order records and is used only to support application functionality and Shopify privacy request workflows. Safe-to-Ship does not use customer information for advertising, marketing, profiling, or selling personal information. We use reasonable technical and organisational measures including encryption in transit, encryption at rest where supported, secure authentication, access controls, monitoring and logging, and secure hosting infrastructure.
5. Data Retention, Sub-processors & Shopify Privacy Requests
Data is retained only for as long as necessary to operate the application, meet contractual or legal obligations, respond to technical issues, and comply with Shopify privacy requirements. Following the applicable retention period, information is securely deleted or anonymised where appropriate. Safe-to-Ship currently relies on Shopify and Gadget, its application hosting platform; additional providers may be used where necessary. Customer Data Requests are fulfilled by preparing application-owned data associated with the request and providing it to the merchant. Customer information is redacted where required, and shop-associated application-owned data is deleted following a valid Shop Redact request.
6. Merchant Responsibilities, Changes & Contact
Merchants remain responsible for maintaining an appropriate legal basis for processing customer information, providing their own privacy notices where required, complying with applicable privacy laws, and configuring Shopify appropriately. We may update this Data Processing Addendum from time to time. The latest version will always be made available. Safe-to-Ship: support@safetoshipapp.com.