Data Processing Addendum

Key terms

These short definitions apply throughout this Addendum. Terms not defined here have the meaning given in the GDPR.

BSS Commerce, BSS, we, us

The company that makes the Apps and offers them on the Shopify App Store. Contact details are in the Contact us section.

Merchant, you

The person or business that installs or uses an App on a Shopify store.

The Apps

BSS B2B Solution, BSS B2B Lock and BSS B2B Quote. This Addendum applies to each App you install or use.

Customer Personal Data

Personal data about the Merchant’s own customers, buyers, wholesale applicants and their staff that an App processes for the Merchant. Annex I lists the categories for each App.

Merchant Account Data

Personal data about the Merchant and its staff that BSS uses to run the Merchant’s account: account and billing details, support conversations, product analytics, internal notifications and marketing. BSS is an independent controller of this data. It is covered by the Privacy Policy, not by this Addendum.

Data Protection Law

The laws that apply to the processing of Customer Personal Data, including the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection and similar laws.

Sub-processor

A third party that BSS engages to process Customer Personal Data for the Merchant. Annex III lists them.

SCCs

The standard contractual clauses adopted by the European Commission for transfers of personal data to third countries.

App Terms

The terms that apply to the Merchant’s use of the Apps.

1. About this Addendum

This Data Processing Addendum (the “Addendum”) forms part of the App Terms and works together with the Privacy Policy. It applies when BSS processes Customer Personal Data for a Merchant through an App installed on Shopify.

This Addendum takes effect when the Merchant installs or uses an App. No signature is needed. A Merchant that needs a signed copy for its records can ask support (see Contact us). BSS then sends a copy of this Addendum signed by BSS. The signed copy has the same terms as this page.

2. Roles of the parties

• The Merchant is the controller of Customer Personal Data.
• BSS is the processor of Customer Personal Data.
• BSS is an independent controller of Merchant Account Data. That data is outside this Addendum.
• Shopify provides the commerce platform to the Merchant under the Merchant’s own agreement with Shopify. Shopify is not a Sub-processor of BSS.
• Services the Merchant turns on with its own account are directed and controlled by the Merchant. Examples are a Klaviyo integration, Google reCAPTCHA keys and Shopify Sidekick. They are not Sub-processors of BSS. The Merchant is responsible for its agreements with them.

3. Processing instructions

The Merchant’s configuration of an App (rules, forms, form fields, settings, notification emails) and its use of the App’s features are the Merchant’s documented instructions to BSS. BSS processes Customer Personal Data only on those instructions, unless the law requires otherwise. In that case BSS tells the Merchant first where the law allows.

BSS does not use Customer Personal Data for its own purposes. The exceptions are operating the Apps, keeping them secure, fixing errors, the product analytics described in Annex III, and improving the service using aggregated or anonymised data.

If BSS believes an instruction breaks Data Protection Law, BSS will tell the Merchant. BSS may pause the instruction until the Merchant confirms or changes it.

Annex I describes the subject matter, duration, nature, purpose, data categories and data subjects.

4. Access by personnel

BSS gives access to Customer Personal Data only to personnel who need it to run and support the Apps. Internal administration interfaces use separate credentials.

5. Security

BSS applies appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Annex II describes the main measures. They are commercially reasonable for the risk and for the nature of an app that runs on Shopify.

BSS may update these measures over time, provided the overall level of protection does not decrease.

No system is free of risk. BSS does not promise that every item of data is encrypted at rest, or that logs never contain personal data. Annex II states what BSS does.

6. Sub-processors

The Merchant gives BSS general authorisation to use the Sub-processors listed in Annex III. Annex III covers Customer Personal Data only. It shows the service, what is processed, the location and which Apps use it.

Where BSS engages a Sub-processor under a contract, the Sub-processor processes Customer Personal Data under its data processing terms. BSS requires data protection duties that are no less protective than this Addendum, to the extent that the Sub-processor’s standard terms allow. BSS stays responsible for that Sub-processor’s performance of those duties.

Public authority validation services (VIES, HMRC and ABR) are not engaged by contract. They receive only the tax ID that a customer enters. They act under their own published terms, and BSS is not responsible for how they process it. The Merchant enables this use through its form configuration.

When BSS adds or replaces a Sub-processor, BSS updates Annex III on this page and changes the “Last Updated” date. The Merchant can object in writing within 14 days of the update, with reasons based on data protection. If the objection cannot be resolved, the Merchant’s only remedy is to stop using the App by uninstalling it.

7. International transfers

BSS is based in Viet Nam. BSS and its Sub-processors process Customer Personal Data in the United States and in other countries where they operate. BSS does not promise to store data in the European Union.

For transfers of Customer Personal Data from the EEA, the United Kingdom or Switzerland to countries without an adequacy decision, the following are incorporated into this Addendum by reference:

• the EU SCCs, Module Two (controller to processor) where the Merchant is a controller, and Module Three (processor to processor) where the Merchant acts as a processor for its own customer;
• the UK International Data Transfer Addendum to the EU SCCs;
• the EU SCCs as adapted for Switzerland, with references to the GDPR read as references to the Swiss Federal Act on Data Protection.

Annexes I to III of this Addendum serve as the annexes to the SCCs.

8. Requests from data subjects

The Merchant handles requests from its customers, such as access, correction, deletion and objection. The Merchant can do this in its Shopify admin and through the Shopify privacy webhooks that Shopify sends to the Apps.

If a data subject contacts BSS directly about Customer Personal Data, BSS tells the data subject to contact the Merchant, and may inform the Merchant.

BSS helps the Merchant with these requests in two ways:

• Data request. When Shopify sends a customers/data_request webhook, BSS emails the Merchant a notice with the person’s name and email address, where BSS can match them. For BSS B2B Quote the email also includes the quote, Net Terms, Sales Rep, company account and Quick Order records that Quote holds for that person. BSS B2B Solution and BSS B2B Lock do not export their other records automatically. The Merchant can ask support for more (see Further help). The Merchant passes the data on to the person.
• Further help. On request through support, BSS gives reasonable help beyond these built-in tools. BSS may charge a reasonable fee for help that goes beyond them.

9. Personal data breach

BSS notifies the Merchant without undue delay after BSS becomes aware of a personal data breach affecting Customer Personal Data. BSS does not wait until the breach is fully investigated or formally confirmed before it sends the first notice.

The notice describes, as far as known, the nature of the breach, the categories and approximate number of people and records concerned, the likely effects and the steps taken or proposed. BSS adds details as it learns them.

BSS gives the Merchant this information in time for the Merchant to meet its own duties, including notifying the supervisory authority within 72 hours under the GDPR and the UK GDPR and informing affected people where required.

A notice is not an admission of fault or liability.

10. Deletion and retention

Shopify sends the customers/redact and shop/redact webhooks to the Apps. Shopify sends shop/redact 48 hours after an uninstall. BSS receives and processes both.

Customer redaction

After customers/redact, each App acts on that customer’s Customer Personal Data as follows:

• Solution deletes the wholesale registration record (permanently after 30 days), the customer timeline and queued emails. Order records linked to the customer are removed with the shop’s data under the shop deletion routine below. Shopify customer IDs listed in pricing rules stay (see below).
• Lock deletes passcode requests, access requests and passcode usage history for that customer, and removes customer, city and region details from analytics events.
• Quote anonymises the personal fields of the customer’s quotes, quote logs and notifications, and keeps the records themselves. It deletes Quick Order page visits and the customer’s records in the earlier modules (Net Terms, Company Account, Sales Rep, Reorder), apart from Sales Rep order rows, which lose only the customer ID.

Shop redaction

• Solution and Quote: a scheduled routine deletes or anonymises a shop’s data once the shop has been uninstalled for at least 30 days and Shopify no longer accepts the App’s access to the shop. The routine covers shops uninstalled after it was switched on. It was switched on 6 October 2026 for Solution and 15 August 2026 for Quote. It processes shops in batches, so deletion can take place later than that. For shops uninstalled before the routine was switched on, BSS intends to delete the data in separate batches. Until then, the measures in Annex II protect that data.
• Lock: deletes its main records for the shop when it receives shop/redact. These are passcode requests, access requests, usage history and the personal details of the shop owner.

Files and retained data

• Files that Solution keeps in BSS file storage are removed by the shop deletion routine.
• Files from the earlier Quote modules stay in BSS file storage until the Merchant asks support to remove them, or until the storage owner deletes them.
• Files in the Merchant’s Shopify Files stay with the Merchant.

BSS may keep:

• data needed for billing, legal duties, security and fraud prevention;
• configuration that does not identify a person;
• Shopify’s internal IDs that appear in rules (for example the customers a price rule applies to);
• backups, until they are overwritten in the normal backup cycle.

Data that an App wrote into the Merchant’s own Shopify store (for example customer tags, draft orders, orders and files in Shopify Files) is part of the Merchant’s store. The Merchant manages it there.

Written confirmation of deletion

When Customer Personal Data has been deleted or anonymised as described in this section, BSS confirms this in writing on request through support. If the deletion has not yet taken place, BSS says when it is expected. The confirmation lists any data that BSS keeps under this section and the reason it is kept.

11. Audits

BSS answers a written security questionnaire from the Merchant once per year at most, and provides summary documentation on request.

An on-site audit takes place only when a competent supervisory authority requires it. The Merchant gives 30 days’ notice. The audit runs during business hours, under confidentiality terms, and the Merchant bears the cost.

12. Merchant responsibilities

The Merchant is responsible for:

• having a legal basis for the processing, and giving its customers the privacy notices that Data Protection Law requires;
• consent for cookies and similar storage on its storefront. The Apps keep a small number of items in the browser’s localStorage and sessionStorage for functions such as forms, currency and carts (see Annex I, part D);
• choosing which form fields to collect. The Merchant defines the fields of registration and quote forms, so the Merchant decides what is collected;
• collecting tax IDs and uploaded files in line with the law that applies to it;
• the lawfulness of what it enters into the Apps and of the settings it chooses, for example the email marketing consent that Lock’s subscribe-to-access feature records in Shopify.

The Merchant must not use form fields or file uploads in the Apps to collect special categories of personal data under Article 9 GDPR, or payment card data.

13. Liability

BSS’s total liability arising out of this Addendum is limited to the fees the Merchant paid for the relevant App in the 12 months before the event that gave rise to the claim. This limit does not apply where the law does not allow such a limit.

14. Order of precedence and governing law

On data protection matters, this Addendum prevails over the App Terms. If the SCCs conflict with this Addendum, the SCCs prevail. This Addendum is governed by the laws of Viet Nam, and the courts of Hanoi have jurisdiction, except where Data Protection Law or the SCCs require otherwise. Where the EU SCCs apply, they are governed by the law of Ireland, disputes under them are resolved by the courts of Ireland, and the competent supervisory authority is the one determined under Clause 13 of the SCCs. The UK Addendum and the Swiss adaptation are governed by the law that each of them provides for.

15. Changes to this Addendum

BSS may update this Addendum to reflect changes in law, in the Apps or in Sub-processors. The “Last Updated” date at the top shows the latest version. The Merchant’s continued use of an App after an update means the Merchant accepts the updated Addendum, subject to the objection right in section 6.

Annex I: Description of processing

A. Parties, subject matter and duration

B. Categories of Customer Personal Data by App

The Merchant defines the fields of registration and quote forms. The Merchant decides what is collected.

C. Sources

The data comes from forms and pages on the Merchant’s storefront, from the Merchant’s configuration, and from Shopify through the permissions (scopes) the Merchant approved at installation.

D. Browser storage on the storefront

The Apps store the following kinds of items in the visitor’s browser, for functions only:

• Solution: selected currency, a copy of the cart, registration form progress (including entries and uploaded-file references), a reCAPTCHA pass flag, the applied discount code, an email address that pre-fills the login form after registration, internal state flags (page state, shared discount link, checkout and BOGO flags, last viewed variant) and the translation language.
• Lock: a random session ID, flags that stop duplicate analytics events, banner state, a price-hiding flag, and (in version 1) the login redirect state and the last blocked page. Lock also reads Shopify’s own _shopify_y cookie as a fallback session ID.
• Quote: the quote cart, selected products, entries typed in the quote form (so the form can be refilled), the customer ID in use, a visit session ID and the customer’s full name for the confirmation page. Form entries stay in the browser after a quote is sent, until the customer ID changes or the browser data is cleared. The earlier modules also keep order and navigation state.

Annex II: Technical and organisational measures

These measures are designed to protect Customer Personal Data. They apply across the three Apps unless a row names an App.

Annex III: Sub-processors

This list covers Customer Personal Data only. It was last updated on 21 October 2026. The Merchant can object to a change as described in section 6.

Tax ID validation runs when a customer enters a tax ID in a form field that the Merchant has set up for validation.

Shopify, and services the Merchant turns on with its own account (such as Klaviyo or Google reCAPTCHA), are not Sub-processors of BSS (section 2). When the Merchant uses Shopify Sidekick with BSS B2B Quote, the Quote tool can return the email addresses of up to three recent buyers to Sidekick. The Merchant directs that use.

Contact us

For questions about this Addendum, or to ask for a signed copy, contact BSS Commerce through the support channels below.