1. Definitions and scope
Data Protection Law means privacy or data-protection law applicable to the processing, including the Australian Privacy Act 1988 (Cth), GDPR, UK GDPR and US state privacy laws where applicable. Merchant Personal Data means personal data Marvello processes for the merchant as processor, service provider or contractor. The terms controller, processor, business, consumer, personal data, process, sale and share have the meanings given by applicable Data Protection Law.
The merchant is controller or business and appoints Marvello as processor, service provider or contractor. Processing supports announcement configuration, country targeting, scheduling, storefront delivery, consent-aware analytics, security, support and deletion. Data may include store identifiers, content settings, country/date/event context and shop-specific pseudonymous visitor identifiers. Data subjects may include merchant users and storefront visitors. Processing lasts for the service term and the deletion period described in this DPA.
2. Instructions and each party’s duties
We process Merchant Personal Data only on documented instructions in the Terms, the merchant’s configuration and use of the service, and lawful written directions, unless law requires otherwise. We will inform the merchant if an instruction appears to infringe Data Protection Law, unless prohibited. Authorised personnel are bound by confidentiality.
The merchant is responsible for the lawfulness, accuracy and transparency of its instructions and Merchant Personal Data, including notices, consent and another lawful basis required for storefront analytics. The merchant will not instruct us to process unnecessary sensitive data, payment-card data or children’s data.
3. Security measures
Taking account of the state of the art, implementation cost, nature, scope, context and purposes of processing, we maintain measures appropriate to risk. These include logical tenant separation; role-based and least-privilege access; authentication of Shopify sessions, proxies and webhooks; encryption in transit; managed secret storage; logging and monitoring; vulnerability and dependency maintenance; backup controls where configured; incident response; and tenant-scoped deletion. Measures may evolve provided overall protection is not materially reduced.
4. Subprocessors
The merchant generally authorises providers listed at Subprocessors. We require materially equivalent data duties and remain responsible as required by law. We will give required notice of material additions and allow good-faith data-protection objections.
5. Requests, compliance and incidents
Taking account of the processing and information available, we reasonably assist with data-subject requests, security obligations, impact assessments and regulator consultations. If we receive a request concerning Merchant Personal Data, we will direct it to the merchant unless law permits or requires us to respond, and will not independently respond except on the merchant’s instruction or as legally required.
We notify the merchant without undue delay after becoming aware of a confirmed personal-data breach affecting Merchant Personal Data and provide available information reasonably needed for the merchant’s obligations, including the nature of the incident, affected data and subjects, likely consequences and mitigation, as information becomes available. Notification is not an admission of fault.
6. Restricted transfers
For a restricted international transfer, the parties incorporate the legally required transfer mechanism. For EEA transfers, this includes the then-current EU Standard Contractual Clauses using the module appropriate to the parties’ roles; for UK transfers, the applicable UK addendum or agreement. The parties adopt the governing law and forum required by those terms and will implement reasonably necessary supplementary measures. A mandatory transfer mechanism prevails over conflicting terms.
7. US state privacy commitments
Where US state privacy law applies, Marvello acts as a service provider or contractor. We will not sell or share Merchant Personal Data, retain, use or disclose it outside the business purposes in the agreement, combine it with personal data received from another person except as permitted by law, or use it for our own cross-context behavioural advertising. We will provide the same level of privacy protection required by applicable law, notify the merchant if we can no longer comply and allow reasonable steps to stop and remediate unauthorised use.
8. Return, deletion and audit
On termination or valid instruction, we delete or return Merchant Personal Data as required by law and service processes, except where law requires retention. Shopify uninstall and mandatory-redaction events may independently trigger deletion. Isolated backup copies expire under normal backup cycles and remain protected and unavailable for ordinary use.
We provide information reasonably necessary to demonstrate compliance. No more than annually, unless an incident or regulator reasonably requires otherwise, the merchant may request a proportionate audit. The parties will first use current certifications, summaries and written responses where sufficient. Any further audit must protect confidentiality and security, avoid unreasonable disruption, use an independent qualified auditor and be paid by the merchant unless it identifies material non-compliance.
9. Priority and liability
This DPA prevails over conflicting Terms only for its subject. Mandatory transfer terms prevail over both. Liability arising under this DPA is subject to the Terms except where Data Protection Law prohibits limitation.