Terms of use

Data Processing Addendum (DPA)

Effective 7 October 2026. This addendum is part of the Terms of Use.

1. PARTIES AND SCOPE

This Data Processing Addendum (DPA) is between the merchant identified by its Shopify store and business account (Merchant) and InnovaPulse d.o.o., Kornatska ulica 1E, 10000 Zagreb, Croatia, OIB 06112740973 (Provider). It forms an integral part of the Nuvopop Terms of Use accepted by Merchant and applies whenever Provider processes personal data on Merchant’s behalf. Merchant is the controller of customer personal data; Provider acts as processor when operating Nuvopop on Merchant's behalf. If Merchant is itself a processor, it confirms its authority to appoint Provider as a subprocessor.

Applicable Data Protection Law means the GDPR and other privacy laws applicable to the relevant processing. Personal data, controller, processor, processing, personal data breach and supervisory authority have the meanings given by those laws. This DPA prevails over conflicting Terms regarding the processing covered here. It does not govern Provider's separate controller activities, such as its own business contacts, described in the Privacy Policy.

2. DOCUMENTED INSTRUCTIONS AND PURPOSE

Provider will process personal data only on Merchant's documented instructions, including this DPA, the selected app configuration and lawful support instructions, to deliver, maintain and secure Nuvopop. This includes reading eligible recent purchases, filtering the notification feed, displaying Merchant-selected product/time/location information, handling privacy requests and deleting app records. Provider will not sell customer data, build advertising profiles, use it to train AI models or use it for unrelated purposes.

If law requires processing outside those instructions, Provider will inform Merchant beforehand unless legally prohibited. Provider will promptly inform Merchant if an instruction appears to infringe Applicable Data Protection Law, and may suspend the affected processing pending clarification.

3. MERCHANT RESPONSIBILITIES AND PUBLIC NOTIFICATIONS

Merchant determines its lawful basis, provides required notices and obtains consent where required. Merchant must instruct only lawful processing, respect objections and withdrawals, choose appropriate location detail and avoid disclosure of sensitive purchases. Removing a buyer's name does not guarantee anonymity: product, purchase time and location can still identify someone in context.

The selected notification feed is public to storefront visitors. Merchant can omit location, select country or city, disable purchase notifications or uninstall the app. Nuvopop does not determine each purchaser's legal basis or obtain that purchaser's consent for Merchant. Merchant must not enable processing where required notices, consent or other legal prerequisites are missing. Merchant can exclude orders by adding the exact Shopify order tag nuvopop-exclude; exclusions take effect after Shopify indexing and feed refresh and do not automatically cover future orders or content already loaded in a visitor’s tab. For an urgent request, Merchant should disable purchase notifications while applying exclusions and contact Provider for assistance. Merchant should notify Provider promptly of an objection or withdrawal requiring assistance; a Shopify customer-redaction event conservatively excludes all purchases predating that event, rather than identifying just one customer's records.

4. CONFIDENTIALITY AND SECURITY

Provider will limit access to authorized persons who need it for the service and are subject to confidentiality obligations. Provider will maintain technical and organizational safeguards appropriate to the risks and review their effectiveness. These include authenticated Shopify access, signed webhook and app-proxy validation, separation of stores' records, restricted administrative and database access, encrypted public and database transport, encrypted managed database storage, data minimization, backup/recovery arrangements and an incident-response process. Schedule 2 describes the implementation baseline. No provision promises absolute security.

5. SUBPROCESSORS

Merchant generally authorizes subprocessors needed to provide the service, initially those in Schedule 3. Provider will impose applicable data-protection obligations by written agreement and remains responsible to Merchant for their performance under this DPA.

Provider will notify Merchant of a proposed new or replacement subprocessor at least 30 days before it processes Merchant data, using an appropriate account or service notice. Merchant may object on reasonable data-protection grounds within that period. The parties will seek a reasonable alternative; if unresolved, Merchant may terminate the affected service before the change takes effect, with unused prepaid fees for that terminated service refunded where applicable. This does not restrict urgent protective steps required by law; Provider will notify Merchant as soon as reasonably possible.

6. INTERNATIONAL TRANSFERS

The primary app and database region is Frankfurt, Germany. Provider and infrastructure/support suppliers may nevertheless process data outside the EEA. Provider will make restricted transfers only with a lawful transfer mechanism, such as an applicable adequacy decision or valid standard contractual clauses and any necessary supplementary measures. This DPA does not itself constitute completed EU standard contractual clauses. Provider will provide information on relevant destinations and safeguards on request and complete required transfer documentation before such a transfer.

7. RIGHTS REQUESTS AND ASSISTANCE

Taking account of the nature of processing, Provider will reasonably assist Merchant with access, correction, deletion, restriction, portability, objection and consent-withdrawal requests, and with security duties, breach notifications, impact assessments and supervisory-authority consultations under applicable law. Provider will forward requests received directly where appropriate and will not independently respond on Merchant's behalf without authorization, unless legally required.

Shopify data-request events create a minimal in-app record for follow-up. An HTTP acknowledgement is not a completed response. Provider will review received requests promptly and provide the assistance needed for Merchant to meet applicable deadlines. Merchant remains responsible for deciding and communicating the substantive response about its own Shopify records.

8. PERSONAL DATA BREACHES

Provider will notify Merchant without undue delay after becoming aware of a personal data breach affecting data processed under this DPA. Available information will include the nature of the breach, affected data and individuals where known, likely consequences, mitigation and a contact point. Incomplete information may be supplied in phases. Provider will investigate, contain, remedy and cooperate reasonably with Merchant. Notice does not by itself admit liability. Merchant determines any notifications it must make to authorities and individuals.

9. RETURN, DELETION AND RETENTION

At the end of processing, Provider will, at Merchant's choice, return available personal data processed on its behalf or delete it, and delete existing copies unless retention is legally required. Merchant should request return before uninstalling, since uninstall events trigger deletion. Original orders remain in Shopify under Merchant's control; Nuvopop is not an order archive.

Valid uninstall events delete app sessions/settings and invalidate cached notifications. Shop-redaction events also remove privacy-workflow records and the shop-level suppression cutoff. Raw order payloads are not written to the app database. Filtered feed data is held in bounded server memory with a 30-second freshness window; an expiry timer removes entries even without a new request, although runtime scheduling and memory reclamation mean expiry is not immediate physical erasure. Privacy request references, dates and the suppression cutoff persist until shop redaction or another authorized deletion process. Retention, including backup and log cycles, must remain limited to what is necessary.

Backup copies that cannot be individually altered will remain protected, unavailable for ordinary use and expire through the established backup cycle. Following restoration, Provider will reapply applicable deletion/suppression instructions before restoring ordinary processing. Any legally required retention will be isolated and used only for the required purpose.

10. INFORMATION AND AUDITS

Provider will make available information reasonably necessary to demonstrate compliance with this DPA and allow and contribute to audits, including inspections, by Merchant or a qualified independent auditor mandated by Merchant. Reasonable notice, confidentiality and measures protecting other customers apply; they must not frustrate statutory audit rights. Evidence and remote review should be used where sufficient. Restrictions do not prevent urgent investigation of a credible incident or regulatory access.

11. TERM, CHANGES AND CONTACT

This DPA applies while Provider processes personal data for Merchant, including protected residual copies. Changes must not reduce legally required protection. Material changes will be notified through an appropriate service channel. The Terms' governing-law and liability provisions apply only insofar as consistent with mandatory data-protection law; this DPA does not limit individuals' or authorities' statutory rights.

Privacy contact: kposavce@gmail.com; InnovaPulse d.o.o., address above, marked Nuvopop — privacy.

SCHEDULE 1 — PROCESSING DETAILS

Subject matter: Merchant-configured Shopify storefront notifications and related service/privacy administration.

Duration: installation and service use, plus limited residual retention described in section 9.

Nature: access, retrieval, filtering, transient caching, public display of selected fields, minimal workflow recording, suppression and deletion.

Data subjects: Merchant customers, prospective customers/store visitors and, insofar as processed on Merchant's behalf, authorized store staff.

Data: eligible order timestamps, payment/cancellation/test status, product/line-item and availability information, optionally shipping country and city; Shopify shop/session identifiers and authorization information; minimal privacy request references and dates. Ordinary order/product/refund events are limited to resource IDs and applicable timestamps. Mandatory privacy events and previously queued events may contain additional customer data, which is not retained or logged as a full payload. Providers may process technical connection/log information such as IP addresses and request timestamps.

Excluded from deliberate purchase queries/display: buyer names, emails, telephone numbers, street addresses, payment-card details and order/customer identifiers. No sensitive categories are intended; Merchant must not use the service to disclose sensitive purchases.

Public recipients: storefront visitors receive product, relative purchase time and optional location as configured. Product notifications and manually entered campaigns are also public.

SCHEDULE 2 — IMPLEMENTATION BASELINE AND OPERATIONS

Shopify session-token authentication for embedded administration; validated Shopify signatures for proxy and webhook traffic.

Per-shop queries and settings; explicit owner/user allowlists for privileged privacy administration.

Render-managed HTTPS, TLS-required PostgreSQL connections and encrypted managed PostgreSQL storage; restricted database network access. Application request logs omit query strings and arbitrary URL paths; infrastructure providers may maintain their own technical logs.

No persistent raw-order archive, buyer analytics or popup click/view/CTR reporting. Local session storage remembers widget dismissal/rotation state.

Database migrations, bounded caches, event invalidation and privacy suppression logic.

Backup export and isolated restoration were exercised on 2 October 2026. This is not a guarantee of continuous recovery testing or zero data loss.

Authorized staff must operate least-privilege account access, confidentiality, incident response, privacy follow-up and retention procedures. These are ongoing operational commitments, not claims of certification.

SCHEDULE 3 — PROVIDERS

Render: application and managed PostgreSQL hosting, backups and operational delivery/logging; primary service region Frankfurt, Germany. The applicable infrastructure processing terms and transfer safeguards are described at https://render.com/dpa and https://render.com/privacy.

Shopify: Merchant's commerce platform, APIs, app authentication, billing and content delivery, operating under the relevant Shopify agreements. Merchant's direct Shopify relationship is distinct from Provider's appointment of a subprocessor; Shopify’s role is governed by the agreements applicable to the relevant processing activity.

Support contact: kposavce@gmail.com is for administrative enquiries. Do not send customer order exports, identity documents or other customer datasets to this mailbox. If investigation needs customer data, Provider will first arrange an appropriately contracted secure support channel and give instructions. The ordinary email contact is not an authorized channel for routine processing of Merchant customer datasets.