Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of, and is incorporated into, the PrintKit Terms of Service between Big Chato's Apparel LLC ("PrintKit," "Processor," "we") and the merchant ("you," "Controller") who installs PrintKit. It governs PrintKit's processing of personal data on your behalf and reflects PrintKit's obligations under Shopify's Protected Customer Data requirements and applicable data-protection law (including GDPR/UK GDPR and US state privacy laws, where they apply).

Where this DPA and the Privacy Policy differ on data-processing specifics, this DPA controls for the processing of personal data.

---

1. Roles

You are the Controller of the shopper personal data processed through PrintKit. PrintKit is the Processor, acting only on your documented instructions (which include your configuration choices in the app and these terms). For your own Shopify account data, Shopify is the platform provider; PrintKit processes only what it needs to operate.

2. Subject matter, duration, nature, and purpose

• Subject matter: providing the PrintKit design-builder and order-fulfillment app.
• Duration: for as long as PrintKit is installed, plus the retention windows in Section 6.
• Nature and purpose: to generate production print files and the merchant's work ticket, create draft orders for checkout through Shopify, and let shoppers save/resume designs. Personal data is never used for marketing, advertising, resale, profiling, or model training.

3. Categories of data subjects and personal data

• Data subjects: your shoppers (and, incidentally, your own admin identity via Shopify).
• Personal data processed:
  • Customer name — shown on the merchant's work ticket.
  • Order data — Shopify order number and line items (product, quantity, options).
  • Saved-design data — a shopper's design state and uploaded artwork, and, only when a signed-in shopper clicks "save my design," their email or customer ID as a retrieval key.
  • Order-direct requests — when a shopper uses the "Order direct" form under a builder: their name, email, optional phone number, and message, stored encrypted and deleted automatically after 30 days.
• Not processed: PrintKit does not process customer email, phone, or shipping/billing address on the work ticket, and never processes payment-card data (that stays in Shopify checkout).

4. Sub-processors

You authorize PrintKit to use the following sub-processors:

We will inform you of any intended addition or replacement of a sub-processor before it begins processing your data, giving you a reasonable opportunity to object. PrintKit imposes data-protection obligations on its sub-processors substantially equivalent to those in this DPA and remains responsible for their performance.

5. Security measures

PrintKit maintains technical and organizational measures appropriate to the risk, including:

• Encryption in transit — all traffic over HTTPS/TLS (HSTS enabled).
• Encryption at rest — shopper design state and uploaded artwork encrypted with AES-256-GCM using per-shop envelope encryption; each shop's data key is stored wrapped by a master key held only in the server environment, never in the database or source control.
• Crypto-shredding — deleting a shop's wrapped key renders that shop's ciphertext permanently unreadable.
• Hashed lookup tokens — saved-design tokens stored only as SHA-256 hashes.
• Multi-tenant isolation — each merchant's data scoped to its own records in code.
• Least-privilege access — production access limited to authorized personnel via SSH-key authentication; decryption gated by the master key.
• Encrypted, tested backups — automated daily backups of app data, encrypted at rest with a dedicated backup key separate from the master key, with a documented restore procedure.
• Data minimization — only name + order id + line items are taken from the order.

6. Retention and deletion

• Saved shopper designs and artwork auto-purge after the retention window you select (7, 30, or 90 days; default 30), enforced by an automated daily job.
• Shop configuration and order records are retained while PrintKit is installed.
• On uninstall, PrintKit deletes the shop's records via Shopify's shop/redact webhook (48h after uninstall), including configuration, designs, artwork, order logs, session rows, and the shop's encryption key (crypto-shredding).

7. Data subject requests and Shopify privacy webhooks

PrintKit implements all three mandatory Shopify GDPR webhooks, HMAC-verified and audited:

• customers/data_request — logged for fulfillment of an access request.
• customers/redact — hard-deletes the shopper's saved designs and artwork and scrubs the corresponding stored order details.
• shop/redact — deletes the shop's data and crypto-shreds remaining ciphertext.

Every such request is recorded in an internal audit log (gdpr_requests). PrintKit will assist you, taking into account the nature of the processing, in responding to data-subject requests you receive directly.

8. Personal data breach

PrintKit maintains a written incident-response policy. In the event of a personal data breach affecting your data, PrintKit will notify you without undue delay after becoming aware (target: within 72 hours), with the information reasonably available to help you meet your own notification obligations, and will cooperate with Shopify's incident processes. Contact for incident matters: support@printkit.tech.

9. International transfers

PrintKit hosts data in the United States. Where you are subject to EU or UK data-transfer rules and personal data is transferred outside the EEA or the UK, the parties incorporate by reference the EU Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914, Module Two (Controller-to-Processor), with you acting as data exporter and PrintKit as data importer. The clauses' optional docking clause applies, and the governing-law and forum options are completed in accordance with the customer's EU member state where required.

For transfers subject to UK law, the parties incorporate the UK Information Commissioner's International Data Transfer Addendum to the EU Standard Contractual Clauses (the UK Addendum). For transfers subject to Swiss law, the EU Standard Contractual Clauses apply with the amendments necessary under the Swiss Federal Act on Data Protection.

Where the Clauses conflict with any other term of this DPA, the Clauses prevail with respect to the transfer they govern.

10. Audit and cooperation

PrintKit will make available to you information reasonably necessary to demonstrate compliance with this DPA and will cooperate with reasonable audit requests, subject to confidentiality and without compromising other merchants' data or PrintKit's security.

11. Return and deletion on termination

On termination, PrintKit deletes your personal data as described in Section 6, unless retention is required by law. The Shopify order record remains your system of record in Shopify.

12. Contact

Big Chato's Apparel LLC — Reva, Virginia, USA
Data-protection contact: support@printkit.tech