Data Processing Agreement

Version 1.8 · Last updated: 14 October 2026 · Effective: 14 October 2026

This Data Processing Agreement (“DPA”) governs our processing of personal data on behalf of a merchant who installs the Avis app for Shopify. It forms part of the agreement between us and applies automatically from installation. Nothing needs to be signed, but a countersigned copy is available on request.

1. Parties and how this agreement is entered into

Processor: Hoang Nguyen, a sole trader trading as Avis, of 62/8/1A - 5A, Binh Hung Hoa A, Binh Tan, Ho Chi Minh City 700000, Vietnam (“Avis”, “we”, “us”). There is no company number because there is no company: this is an unincorporated sole trader, and the individual named is personally the contracting party and personally bound by everything below.

Controller: the merchant that installs the Avis app on its Shopify store (“you”, “the merchant”). Your identity and address are those registered on your Shopify account.

By installing or continuing to use the app you accept this DPA. It takes effect on installation and continues for as long as we process personal data for you. Where you require a signed copy on your own paper, write to privacy@b2bgold.app.

2. Definitions

Data Protection Law means all laws applicable to the processing under this DPA, including the EU General Data Protection Regulation 2016/679 (“EU GDPR”), the UK GDPR and the Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”).

Controller, processor, data subject, personal data, processing and personal data breach have the meanings given in the EU GDPR. SCCs means the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914. UK Addendum means the International Data Transfer Addendum issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

Customer Personal Data means personal data relating to your customers and site visitors that we process through the app, as described in Annex I.

3. Roles

For Customer Personal Data, you are the controller and we are the processor. You determine the purposes and means; we act only on your instructions.

We are an independent controller for your own merchant account data — your store domain, store owner name, store contact email, plan and billing state, and support correspondence — which we process to provide, bill for, secure and support the service. That processing is described in our Privacy Policy and is not governed by this DPA.

Shopify Inc. is a separate controller and processor in its own right under your agreement with Shopify. This DPA does not alter that relationship.

4. Scope and instructions

We process Customer Personal Data only:

1. to provide the app in accordance with our agreement and the documented configuration you set in the app;
2. on your further documented instructions, where they are consistent with the app's functionality; and
3. where required by law that applies to us, in which case we will tell you before processing unless that law forbids it on important grounds of public interest.

This DPA, the app's own settings, and our documentation together constitute your complete documented instructions. We will tell you if, in our opinion, an instruction infringes Data Protection Law; we may suspend the affected processing until the instruction is withdrawn or amended.

You warrant that you have a lawful basis for the processing you instruct, including for sending review-request emails to your customers, that you have given your customers the information required by Articles 13 and 14 of the GDPR, and that any data you upload through the import feature, or have us read from a previous review application with API keys you give us, was lawfully collected and may lawfully be transferred to us.

4.1 Product decisions we do not permit you to instruct

Some behaviour is fixed in the app because it protects data subjects or consumers, and we will not implement an instruction to change it:

• We will not send a review request to a customer whose Shopify marketing consent state is unsubscribed or redacted, and we will not remove the unsubscribe link from request emails.
• We will not disclose a reviewer's email address, order reference, IP hash or moderation notes on your storefront or through the public API.
• We will not publish reviews selectively by rating. A setting that holds lower-rated reviews for checking only delays them: a held review publishes by itself after the waiting period you choose unless you reject it for a stated content reason. We will not make a reward depend on a review's rating, and required consumer disclosures on incentivised, store-verified and store-authored reviews cannot be suppressed.
• We will not delete or alter the moderation log, which is the audit record of what was moderated and by whom.

5. Confidentiality

We keep Customer Personal Data confidential. Anyone we authorise to process it is bound by a duty of confidentiality that survives the end of their engagement, and is granted access only to what their role requires. As at the date above, access to production systems holding Customer Personal Data is limited to the account owner.

6. Security

We implement and maintain the technical and organisational measures set out in Annex II, which are appropriate to the risk under Article 32 of the GDPR. We may update those measures, provided that the level of security is not reduced.

7. Sub-processors

You give general written authorisation for us to appoint sub-processors. Our current sub-processors are listed in Annex III.

We impose data protection obligations on every sub-processor that are no less protective than those in this DPA, and we remain fully liable to you for their performance.

We will give you at least 30 days' notice before adding or replacing a sub-processor, by email to your store contact address and by updating Annex III. If you reasonably object on data protection grounds within that period, tell us at privacy@b2bgold.app and we will work with you in good faith to find an alternative. If we cannot, you may terminate the affected part of the service without penalty and receive a pro-rata refund of any prepaid fees.

8. Assisting you with data subject rights

The app is built so that you can answer most requests yourself and immediately:

• Access and portability. The Data and privacy tab of the app's Settings page assembles a complete package of one customer's data as a file you can hand over. A full export of all your reviews is available at any time, on every plan, and is never restricted by your subscription.
• Erasure. Shopify's customer redaction request removes that customer's personal data from the app automatically. You can also delete an individual review at any time.
• Objection to marketing. A customer's unsubscribe takes effect immediately and permanently, without your involvement.

Where a request cannot be satisfied through the app, we will assist you by appropriate technical and organisational measures, taking into account the nature of the processing. If a data subject contacts us directly about your data, we will not respond substantively; we will tell them to contact you and forward the request to you without undue delay.

We will likewise assist you with data protection impact assessments and prior consultations under Articles 35 and 36, to the extent the information is within our control.

9. Personal data breach

We will notify you without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, so far as we know it at the time: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point. We will supplement it as more becomes known, and will cooperate with you and take reasonable steps to mitigate.

Notification is not an admission of fault. We will not notify a supervisory authority or data subjects on your behalf unless you ask us to in writing.

10. Deletion and return

On termination, or earlier if you ask:

• You may export all review data at any time while the app is installed, in a documented CSV format, together with a manifest of the re-hosted media. Export is never restricted by plan. Do this before you uninstall.
• When you uninstall, Shopify sends a shop redaction request 48 hours later. On receiving it we delete all Customer Personal Data we hold. Access tokens are deleted within 48 hours of uninstall.
• Reviews, ratings and review media that the app wrote into your own Shopify metafields and Shopify Files remain in your Shopify account, under your control. The Data and privacy tab of the app's Settings page reports exactly what exists there and can clear the metafield values before you uninstall.
• We retain a record of whether your store has used a free trial. It holds a numeric store identifier, a flag and a date, contains no personal data, and exists solely to prevent repeated trials through reinstallation.
• We retain an offer record: a numeric store identifier and dates saying whether your store holds a founding-store price, whether a charge has been made under it, and until when its trial was extended for moving from another review app. It contains no personal data, and exists so that the founding price stays with your store if you reinstall and an offer is given once.
• Unsubscribe records are retained as hashes of email addresses (see Annex II). They are the opt-out itself; deleting them would risk emailing someone who asked us to stop. They do not contain the address.
• Where law requires us to retain something for longer, we will tell you what and why, and will keep it only for that purpose.

11. Audit and information

We will make available to you the information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.

In practice, and to keep this proportionate for a service of this size: we will answer a written security questionnaire at no charge once in any twelve-month period, and will provide the documentation in Annex II. An on-site or hands-on inspection may be requested no more than once in any twelve-month period, on 30 days' notice, during business hours, subject to confidentiality, and must not unreasonably disrupt the service or compromise other customers' data. You bear your own costs and our reasonable costs. This limit does not apply where an audit is required by a supervisory authority or follows a personal data breach affecting your data.

12. International transfers

We do not transfer Customer Personal Data outside the UK or the EEA except with an appropriate safeguard in place.

Where we transfer personal data from the EEA to a country without an adequacy decision, the SCCs apply and are incorporated into this DPA by reference:

• Module Two (controller to processor) applies where you are established in the EEA or otherwise subject to the EU GDPR. You are the data exporter; we are the data importer.
• Module Three (processor to processor) applies where you act as a processor for another controller.
• Clause 7 (docking) applies. Clause 9 option 2 (general written authorisation) applies with the 30-day notice period in clause 7 above. Clause 11 does not include the optional independent dispute resolution body. Clause 17 selects the law of Ireland and clause 18(b) the courts of Ireland, unless your establishment makes another EU Member State's law applicable, in which case that Member State's law and courts apply.
• Annexes I, II and III to the SCCs are Annex I, Annex II and Annex III of this DPA.

For transfers subject to the UK GDPR, the SCCs apply as modified by the UK Addendum, with Tables 1 to 3 populated from this DPA and its annexes, and Table 4 selecting “neither party”. For transfers subject to Swiss law, the SCCs apply with references to the GDPR read as references to the Swiss FADP, the Swiss Federal Data Protection and Information Commissioner as the supervisory authority, and “member state” read so as not to deprive Swiss data subjects of their right to sue in Switzerland.

If an incorporated transfer mechanism is invalidated or superseded, we will implement a valid replacement without undue delay.

13. California

Where the CCPA applies, we act as a service provider and you are the business. We do not sell or share personal information, and we are prohibited from retaining, using or disclosing it other than for the specific purpose of performing the service under our agreement, or as otherwise permitted by the CCPA. We will not combine it with personal information received from another source, except as the CCPA permits. We certify that we understand these restrictions and will comply with them. You may take reasonable steps to ensure we use personal information consistently with your obligations, and we will notify you if we determine we can no longer meet them.

14. Liability, term and precedence

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the agreement between us, except that nothing limits liability that cannot be limited under applicable law, including a data subject's rights under Article 82 of the GDPR.

This DPA begins on installation and ends when we have deleted all Customer Personal Data under clause 10. Clauses 5, 10, 11 and 14 survive termination.

If this DPA conflicts with any other agreement between us, this DPA prevails on data protection matters. If this DPA conflicts with the SCCs, the SCCs prevail. This DPA is governed by Vietnam, save where clause 12 provides otherwise for the SCCs — those select Irish law for EU transfers and that selection governs, because a transfer mechanism that deferred to the importer's own law would not be a safeguard at all.

15. Our representative in the EU and the UK

We have not appointed one. Article 27 of the EU GDPR, and of the UK GDPR, asks a controller or processor established outside those territories to designate a representative within them. We are established in Vietnam and that obligation applies to us. We are working on it, and until it is done this clause tells you where we stand rather than leaving a name blank or implying an appointment that does not exist.

What this does not change: every obligation in this agreement, every commitment in clause 9 on breach notification, and every right your customers hold. A representative is a point of contact, not a substitute for any of that. In the meantime, privacy@b2bgold.app reaches us directly and is monitored.

If this is material to your own compliance position — and for some merchants it will be — you should weigh it before installing, which is why it is in the body of the agreement rather than a footnote.

Annex I — Description of the processing

A. Parties

Data exporter (controller): the merchant identified by the Shopify store on which the app is installed, at the address on its Shopify account. Contact: the store contact email. Activities: operating an online store and collecting product reviews from its customers. Role: controller.

Data importer (processor): Hoang Nguyen, a sole trader trading as Avis, of 62/8/1A - 5A, Binh Hung Hoa A, Binh Tan, Ho Chi Minh City 700000, Vietnam — a third country with no European Commission adequacy decision, which is why clause 12's Standard Contractual Clauses are not boilerplate here but the actual basis for every transfer. Contact: privacy@b2bgold.app. Activities: providing the Avis product-reviews app for Shopify. Role: processor.

B. Description of the processing

C. Competent supervisory authority

The supervisory authority of the EEA Member State in which you are established, or in which your EU Article 27 representative is established, or the Irish Data Protection Commission where neither applies. For UK transfers, the Information Commissioner's Office. For Swiss transfers, the Federal Data Protection and Information Commissioner.

Annex II — Technical and organisational measures

Pseudonymisation and minimisation

• IP addresses are stored only as salted hashes. Raw addresses are never written to the database.
• Vote deduplication uses a salted hash of IP address, user agent and store, which identifies a repeat vote without identifying a person.
• Unsubscribe records store a keyed hash of the email address (HMAC-SHA256 under a secret key that only the application holds), never the address. Records created before 6 October 2026 used an unkeyed SHA-256 hash; each is replaced by the keyed form, keeping its date, the next time the application checks that address against the list (for example before emailing it). Until then it stays in the unkeyed form.
• The app requests only the Shopify permissions it uses. Of an order's shipping address it reads only the country code, to time emails; nothing else from the address is stored, and phone numbers are never read.
• Only review text, ratings, the product title, the store's reply and reduced review photos are sent to AI models — never a reviewer name, an email address, an order reference or a customer identifier; addresses and phone numbers typed into review text are masked first. To match the columns of a file you import, a model sees the column names, the shape of each column and sample values only from columns that cannot identify a person. The models run on our infrastructure provider's own platform, except the review summary (with its story) and import column matching, which use Google's Gemini model through Google's paid Gemini API (Annex III). Each AI call is counted against a per-store daily budget.
• Public responses served to your storefront and through the public API are constructed field by field from an explicit allow-list, so that a new database column cannot leak into them. This is enforced by automated tests.

Encryption

• TLS for all data in transit, including between the app and Shopify and between the app and its database.
• Encryption at rest for the production database and its backups, provided by the infrastructure platform.
• API keys are stored as hashes and displayed once, at creation.
• The API keys of services you connect and the signing secrets of your webhook endpoints are encrypted at rest with AES-GCM; every webhook we send is signed (HMAC-SHA256) so the receiver can verify it.
• The API keys you give us to import your reviews from a previous review application are encrypted at rest with AES-GCM, used only to read those reviews, never displayed back, and deleted as soon as the reading ends, fails or is canceled.

Access control and authentication

• Every API route requires authentication by one of five verified mechanisms: a Shopify session token verified as a signed JWT; a webhook HMAC signature; a signed Shopify app-proxy request; a signed, time-limited token in an emailed link; or a hashed API key. The one exception is the reviews feed you may publish to Google, which is served to whoever holds the secret token in its address (you can replace that token at any time) and carries only published reviews. No route is served on the strength of a store domain alone.
• Administrative routes reject webhook signatures, so that a replayed webhook body cannot authenticate against the merchant API.
• Shopify access tokens are short-lived and refreshed before use.
• Rate limits apply per store and per route class to constrain enumeration and abuse.
• Request bodies are size-capped per route class.
• Production access is limited to the account owner. There are no shared credentials and no internal console that browses merchant data.

Segregation

• Development and production are separate applications with separate databases, separate credentials and separate domains. Live merchant data is never copied into development.
• All data is partitioned by store identifier, and every query is scoped to the authenticated store.

Logging and monitoring

• Logs contain no personal data by construction. The structured logger records store domains, record identifiers, status codes, durations and counts. Email addresses, names and review text are never passed to it, and rendered email subjects are excluded because they may contain a merged customer name.
• Every moderation action — creation, status change, reply, disclosure-label change and deletion — is written to an append-only moderation log, which the application layer can insert into and read but not update or delete.
• Operational logs are retained for up to 30 days.

Resilience and recovery

• The application is stateless and runs across the provider's global edge network.
• The database supports point-in-time recovery through the platform, with encrypted backups.
• Background jobs are leased and each state transition is a conditional update, so overlapping runs cannot duplicate an email or an import.
• Review media is stored in your Shopify Files, so it survives any failure of our service, and your storefront's first paint of reviews is served from your own Shopify metafields and does not depend on our API being reachable.

Governance

• Changes are reviewed and version-controlled; automated tests run on every change, including tests that assert privacy invariants.
• Data retention is enforced by a scheduled job, not by manual clean-up.
• Sub-processors are contracted under terms no less protective than these.

Incident response and data loss prevention

• We maintain a written security incident response policy: a severity ladder, a containment-first sequence for the first hour, runbooks for credential compromise and for cross-tenant exposure, and the notification clocks in clause 9. A failure in our background pipeline raises an alert to us automatically; that alert carries process names and counts only, never error text, so it cannot itself become a place personal data ends up.
• We maintain a written data loss prevention strategy covering both senses of the phrase. Against data escaping: the primary control is not collecting it, and the small number of paths by which data can leave are individually named and individually tested. Against data disappearing: point-in-time database recovery to any minute in the last 30 days, plus the fact that your reviews, your review media and your configuration also live in your own Shopify account, and your export is never restricted by plan.
• Both are available to you on request.

Annex III — Sub-processors

Shopify is your own platform provider and processes this data under your existing agreement with Shopify rather than under our appointment. It is listed for completeness, so that you can see every party that touches the data.

Services you choose to connect — Klaviyo, Omnisend, Mailchimp, Slack, Gorgias, Shopify Flow, your own webhook endpoints, and Google Merchant Center through your reviews feed — are not our sub-processors. They are your own providers, appointed by you; the app sends them only the events you choose, and only after you connect them. The same holds for a previous review application you import from through its API (Judge.me, Loox, Yotpo or Klaviyo Reviews): the app only reads your reviews from it, sending it nothing but the API keys you gave us and, for Judge.me, your store domain.

Our Privacy Policy names one further recipient, a messaging service that carries operational alerts to our own team. It is not in this Annex because it receives no Customer Personal Data — only your store domain, plan and country, and any feedback you choose to send us through the app. It is named here so that its absence from this table reads as a decision rather than an omission.

We will notify your store contact address at least 30 days before adding or replacing a sub-processor. To receive those notices at a different address, write to privacy@b2bgold.app.