Data Processing Addendum

1. Introduction and parties

This Data Processing Addendum ("DPA") applies between the merchant using NORTHMAST ("Controller") and Satisfy & I B.V. ("Processor"), and forms part of the Merchant Terms of Service. It applies to the extent that we process personal data on the merchant's behalf under the GDPR or equivalent applicable data protection law.

Processor details: Satisfy & I B.V., Kloosterpark 12, 5554 GP Valkenswaard, The Netherlands. Chamber of Commerce number: 94013195. VAT identification number: NL866603839B01. E-mail: info@northmast.app.

NORTHMAST was formerly developed under the working name Clearboard Analytics. It is the same application, provided by the same legal entity, and this document replaces the corresponding document published under that working name.

The details of the processing — its subject matter and duration, its nature and purpose, the types of personal data and the categories of data subjects — are set out in Annex 1.

2. Roles

• For order data relating to the merchant's customers, for the supplier records the merchant enters, and for the contents of any file the merchant uploads as an attachment to a stock count or a supplier invoice, the merchant is the controller and we act as processor, with the exception in the third point.
• For merchant and staff account data — including the business details a merchant records for use on their own documents — as well as support correspondence, security records and our own legal and administrative records, we act as an independent controller. That processing is described in the Privacy Policy and falls outside this DPA.
• For the billing records we keep for usage-based charges — including the Shopify order identifiers we use to count billable orders and report them to Shopify — we act as an independent controller, because we keep them to bill our own service. That processing is described in the Privacy Policy and falls outside this DPA.

3. Rights and obligations of the controller

The merchant determines the purposes and means of the processing of their customers' order data and is responsible for the lawfulness of that processing. In particular the merchant is responsible for having a valid legal basis, for providing their customers with the information data protection law requires, for the accuracy of the source data, and for ensuring that their instructions to us are lawful.

The merchant has the right to give instructions within the scope of this DPA, to receive the information needed to demonstrate our compliance, to have their data deleted or returned on termination, and to object to a new subprocessor as described below.

4. Documented instructions

We process personal data only on the merchant's documented instructions. The Merchant Terms of Service, this DPA, and the merchant's configuration and use of the app constitute those instructions, including for transfers of personal data to a third country, which take place only as described in the International transfers section. Apart from the billing records described in the Roles section, we do not process the data for our own purposes, do not sell it, and do not use it for advertising. If we believe an instruction infringes applicable data protection law, we will inform the merchant. Where applicable law requires us to process personal data beyond those instructions, we will inform the merchant of that legal requirement before processing, unless the law prohibits that notification.

5. Confidentiality

Personnel authorised to process personal data are bound by an obligation of confidentiality, and access is limited to those who need it to operate and support the service. That obligation survives the end of their engagement.

6. Technical and organisational measures

We implement the measures described in the Data security section of the Privacy Policy, including per-store scoping of every database read and write, encryption of advertising platform tokens at rest using AES-256-GCM, HMAC verification of incoming Shopify webhooks, single-use hashed OAuth state values, multi-factor authentication for access to our internal operator console, logging designed to exclude tokens, payloads and personal data, and a daily backup of the database, kept for 7 days, so that the service can be restored after an incident. Connections to the app and to our website are encrypted in transit with TLS. Our database provider states that it encrypts the data it stores at rest. We may update these measures over time, provided the level of protection is not reduced.

7. Subprocessors

The merchant gives general authorisation for us to engage the subprocessors listed in the Privacy Policy.

Before we add or replace a subprocessor for processing carried out on the merchant's behalf, we will update the list in the Privacy Policy and give the merchant advance notice by e-mail to the address associated with their store, so that the merchant has a genuine opportunity to object first. A merchant who objects on reasonable data protection grounds may notify us at info@northmast.app; we will then discuss the objection in good faith and, if we cannot offer a reasonable alternative, the merchant may terminate by uninstalling the app, which triggers the deletion process below.

Before a subprocessor processes personal data on behalf of merchants under this DPA, we will ensure that appropriate written data protection terms required by applicable law are in place. We remain responsible for the performance of our subprocessors to the extent required by applicable law.

8. Assistance with data subject requests

Taking into account the nature of the processing, we assist the merchant by appropriate technical and organisational measures in fulfilling their obligation to respond to requests to exercise data subject rights.

The app handles the privacy requests that Shopify passes on to us. When a customer asks for a copy of their data, the app prepares an export of the orders concerned — the order and line item identifiers, the order date, the order total, discounts, refunded amount and currency, and for each line item the variant, SKU, quantity and price — which the merchant can retrieve in the app. Where the merchant needs further data we hold about those orders, as described in the Privacy Policy, we will provide reasonable assistance. When a customer asks for their data to be deleted, the app deletes the relevant order data and prevents it from being imported again. Where a request cannot be handled this way, we will provide reasonable assistance, taking into account the nature of the processing and the information available to us.

9. Assistance with security, breaches and impact assessments

Taking into account the nature of the processing and the information available to us, we assist the merchant in complying with their obligations regarding the security of processing, the notification of a personal data breach to a supervisory authority and to affected data subjects, and — where the merchant is required to carry one out — a data protection impact assessment and any prior consultation with a supervisory authority.

That assistance consists of the information reasonably available to us about the processing we perform: the data categories we hold, our retention limits, the measures described above, and what we can establish about an incident. We do not assess the merchant's own processing for them.

10. Personal data breaches

We will notify the merchant without undue delay after becoming aware of a personal data breach affecting personal data processed on their behalf, and will provide the information reasonably available to us so that the merchant can meet their own notification obligations. That information covers, as far as we can establish it, the nature of the breach, the categories and approximate volume of data concerned, the likely consequences and the measures taken or proposed.

11. Deletion and return

Detailed order data — orders and their line items, refunds and their components, shipping method metadata, payment and refund transaction metadata and any Shopify-provided transaction fee information — is kept for at most 24 calendar months, counted from the date the order was placed: the order date Shopify records for the sale, not the date the order was imported into Shopify and not the date it was shipped. Older records are deleted automatically, and orders older than the limit can no longer be imported or re-created.

Advertising cost data and the related import records are kept for at most 24 calendar months, the same reporting period as detailed order data, and are deleted automatically after that. Disconnecting an advertising platform stops further imports but does not delete this history early; it is always deleted in full when your store's data is deleted. On a valid request we also delete the imported history of one platform separately, without touching the store's other data; a platform that is still connected must be disconnected first, because the next synchronisation would otherwise import that history again.

When you uninstall the app, our access to your store ends and the Shopify session records for your store — which hold the staff account details and access tokens — are deleted immediately. Shopify then asks us to delete the rest of your store's data, normally 48 hours after the uninstall, and we delete it when that request arrives. We do not wait for it indefinitely: if Shopify's request does not reach us, we verify the uninstall ourselves and delete the remaining store data no later than 30 days after the uninstall, unless the law requires us to keep something, in which case we keep only what that law requires.

If your Shopify store is permanently closed or deleted, Shopify normally notifies us in the same way as when the app is uninstalled, and your store's data is deleted as described above. If, exceptionally, that notification does not reach us, we delete your store's data once we have confirmed that the store has been permanently closed or deleted, with the same legal exceptions. A temporary problem — such as an outage, a paused or frozen store, an expired or invalid access token, or a store website that cannot be reached — is never on its own treated as a closure.

When your store's data is deleted, all data the app holds for your store is deleted: orders and their line items, refunds and their components, advertising cost data and any advertising platform connection, products and variants, cost prices and their history, inventory quantities and locations, warehouses, suppliers and their contact details, purchase orders, receipts, supplier returns, stock counts, recorded operating costs, your own business details, settings and shipping rates, synchronisation logs, subscription and usage billing records and privacy request records. The files you uploaded — the attachments on your stock counts and supplier invoices — are removed from storage at the same time, and not only from our records of them.

When a customer asks for their data to be deleted and Shopify passes that request on to us, we delete the order data concerned immediately. We keep only the identifiers of those orders, for as long as the app is installed for the store, so that a later synchronisation cannot import the deleted orders again. No name, contact details, address, customer identifier or amount is kept with them.

Files you attach to a stock count or a supplier invoice have no separate time limit: they are your own documents, and they are kept for as long as the stock count or invoice they belong to. They are removed from storage when you remove or replace the file, when you delete the draft count it belongs to, and when your store's data is deleted. A file that is rejected, or whose upload is never completed, is removed automatically. Uploaded files are not part of any database backup, so a removed or replaced file cannot be restored.

A merchant who needs a copy of their data before termination can use the exports described in the Merchant Terms of Service while the app is still installed. After the deletion described above we keep no copy of the deleted data other than in the database backups described below, which expire within 7 days, except where applicable law requires us to keep something for a defined period, in which case we keep only what that law requires and continue to protect it under this DPA.

The service includes a daily backup of the database, and each backup is kept for 7 days. Backups exist to restore the service after an incident, not to recover records or files you deleted yourself. Data deleted from the app can remain in a backup until that backup expires. Uploaded files are not part of these backups.

The billing records described in the Privacy Policy are our own records, outside this DPA, and follow the retention described there.

12. Audits and information

We will make available to the merchant the information reasonably necessary to demonstrate compliance with this DPA, and will contribute to audits conducted by the merchant or an auditor they mandate. Audits are limited to once per year unless a supervisory authority requires otherwise or a personal data breach has occurred, must be requested with reasonable notice, must not unreasonably disrupt our operations, and are subject to confidentiality.

13. International transfers

Our hosting provider, Vercel, runs the app's serverless functions in its Frankfurt (Germany) region, but states that its primary processing facilities are in the United States and that data may be processed wherever it or its own subprocessors operate. Vercel's Data Processing Addendum incorporates the EU Standard Contractual Clauses and the UK Addendum where these are required for a transfer, and these are the safeguards relied on for that.

Our primary database and private object storage are hosted in a European Supabase project region (eu-central-1, Frankfurt, Germany). We have concluded a Data Processing Addendum with Supabase which incorporates the EU Standard Contractual Clauses where these are required for a transfer. We do not claim that all processing by Supabase takes place exclusively within the European Economic Area; supporting activities such as operations and support may take place elsewhere, and the Standard Contractual Clauses are the safeguard relied on for that.

We do not claim a specific transfer mechanism or certification for any subprocessor beyond what is stated above. A merchant who needs the current transfer details for a particular subprocessor can request them at info@northmast.app.

14. Order of precedence

In the event of a conflict between this DPA and the Merchant Terms of Service in relation to the processing of personal data on the merchant's behalf, this DPA prevails.

15. Changes to this DPA

Each document carries its own version number and effective date. A material change results in a new version number and a new effective date shown at the top of the page. Minor corrections that do not change your rights or our obligations — such as a typographical fix — do not.

16. Contact

Satisfy & I B.V., Kloosterpark 12, 5554 GP Valkenswaard, The Netherlands. Chamber of Commerce number: 94013195. VAT identification number: NL866603839B01. E-mail: info@northmast.app.

Annex 1: Details of processing

Subject matter and duration

The subject matter is the provision of the app for the merchant's Shopify store: profit and cost reporting together with the inventory, replenishment, product and cost, purchasing, receiving, supplier return and stock count administration that supports it. Processing continues for as long as the app is installed for that store, and ends in accordance with the section on deletion and return.

Nature and purpose of processing

We retrieve order, refund, product, cost and inventory data from Shopify, store it, and compute revenue, cost, margin and profit figures from it, together with advertising cost data where the merchant has connected an advertising platform.

On the merchant's instruction we also maintain the operational records they build up in the app — products and their cost history, stock positions and inventory value, replenishment proposals, suppliers and the purchasing conditions agreed with them, warehouses, purchase orders, receipts, supplier returns, stock counts and recorded operating costs — and produce the purchase documents the merchant generates from them.

Reporting, analysis and planning only read from Shopify. The app writes back in one narrow place: when you deliberately carry out an action that changes stock or cost — processing a stock count, posting or correcting a receipt, posting a supplier return, or changing a unit cost — it updates the corresponding inventory quantity or cost per item in your Shopify store. None of those writes happens automatically or in the background: each of them follows an action you took. The app holds no permission to create or change your orders, your customers, your products or your product prices, and issues no request of that kind anywhere. Separately from your store, while a paid plan with charges for additional orders is active, the app automatically reports each billable order to Shopify's billing system so that Shopify can calculate those charges; that report changes nothing in your store.

Processing operations comprise collection, retrieval, storage, organisation and structuring, consultation, use for the computations and the administration described, disclosure by transmission back to Shopify where the merchant carries out an action that requires it, restriction where a privacy request requires it, and erasure.

Types of personal data

Order-level financial data as listed in the Privacy Policy: order and line item identifiers, dates, quantities, currencies, prices, discounts, taxes, shipping amounts, the destination country code of the order, refunds and refund components. Shipping method metadata for the delivery option chosen at checkout. Payment and refund transaction metadata: the payment gateway, transaction type and status, test flag, amounts, currencies, transaction dates and transaction references. Shopify-provided transaction fee information where Shopify makes it available. Where Shopify passes on a customer's privacy request, the numeric Shopify customer identifier and the order identifiers contained in that request.

You can record the suppliers you buy from. A supplier record holds the company name and your own reference code for it, and optionally the name of a contact person, an e-mail address, a telephone number, an address and your own notes. Where you fill those fields in, they are personal data about that contact person — someone who is neither our customer nor yours — and you decide what to enter. We do not obtain supplier details from any other source, do not enrich or verify them, and do not use them for anything except showing them to you and placing them on the purchase documents you generate. A supplier's details are deleted with the supplier, and when your store's data is deleted.

A file you attach to a stock count or to a supplier invoice is your own document, and we do not know what is in it. A scan or photograph of a counted sheet or of an invoice may contain personal data — the name or the handwriting of whoever counted, or the contact details printed on a supplier's invoice, for example — because you chose to upload it. Before a file becomes an attachment, the app technically processes its contents to verify that it is a supported PDF, JPEG or PNG and that it is intact: it checks the actual file type and structure, and rejects files that are unsupported, damaged or not what their name says. A supported image is re-saved in a controlled form that removes metadata such as location and camera information. This is a file check, not an antivirus or malware scan. Apart from that check, the app does not index, analyse or extract anything from the contents, and nothing in the file is used in any calculation or in checking an invoice.

NORTHMAST does not request and does not store the customer name, customer e-mail address, customer telephone number, street address and house number, address line 2, postal or ZIP code, city, geolocation coordinates of your customers. None of these fields are queried from Shopify, none are stored in our database, and none appear in any export the app generates. We request no billing address at all.

From an order's shipping address we request exactly one field: the destination country code, a two-letter country code such as NL, BE or US. NORTHMAST may process and store that country code together with the order, to support the merchant's financial calculations — in particular the merchant-configured shipping-cost rules that can differ per destination country. Detailed shipping-address information such as street, house number, postal code, city or geolocation is not required for that calculation and is not requested. The country code is never used for profiling, marketing, personalisation or advertising, and is not shown per individual customer. It is stored on the order record and follows that record's lifecycle: it is deleted with the order, including when a customer's or a store's data is deleted.

We use the shipping and payment metadata described above to calculate and explain your order economics — which costs belong to which order, and what remains as profit — and to support the shipping-cost and transaction-cost settings you configure yourself. It is not used for customer profiling, advertising, personalisation, segmentation or any form of scoring.

NORTHMAST never receives or stores payment credentials. We do not request card numbers — not even masked or truncated ones — card security codes, cardholder names, bank account or bank login details, payment account passwords, or any other payment authentication secret. What we process is transaction economics: which gateway processed a payment, what type and status the transaction had, how much it was and in which currency. That is not the payment instrument itself. We also do not process payout, settlement or bank reconciliation data, and we hold no payout history.

The app is not designed for, and is not intended to process, special categories of personal data within the meaning of Article 9 GDPR — such as data revealing health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, or data concerning a person's sex life or sexual orientation. The app queries no field of that kind. Merchants must not knowingly supply such data to the app, including through free-text configuration fields, without a separate written agreement with us first.

Categories of data subjects

The processing under this DPA concerns the categories of data subject listed below. The merchant's own staff are not among them: the app's session and account data about them is processing for which we are an independent controller, described in the Privacy Policy and outside this DPA.

• Customers of the merchant's Shopify store, in respect of the order data described above.
• The contact people at the merchant's suppliers, where the merchant records a contact name, e-mail address, telephone number or address for a supplier.
• Any individual whose personal data the merchant happens to include in a file uploaded as an attachment to a stock count or a supplier invoice. We process the contents only to verify the file, so we cannot know in advance whether a given file contains such data; the merchant decides what to upload.