Summary
Data Processing Agreement (DPA)
Overview
This Data Processing Agreement ("DPA") is entered into between Rofoso Consumer Private Limited (operating as "PoloPan"), acting as a Data Processor, and the Merchant (Shopify store owner / brand partner), acting as a Data Controller. This DPA supplements the PoloPan Shopify Merchant Terms and governs the processing of store and conversion verification data in connection with the PoloPan Shopify App.
Last Updated
2026-10-12
Data Subject Rights
PoloPan will reasonably assist the Merchant, via technical measures, in responding to data subject rights requests under GDPR, CCPA, or DPDP where applicable.
Termination
This DPA remains in effect as long as the Merchant utilizes the PoloPan Shopify App and terminates automatically upon app uninstallation and completion of data purge.
Grievance Officer
Name
Shekhar Chatterjee
s@polopan.com
Role
Global Privacy & Grievance Officer
Roles
Controller
Merchant (Shopify store owner / brand partner)
Processor
Rofoso Consumer Private Limited (operating as PoloPan)
Scope
PoloPan acts as a Data Processor and processes limited Shopify store and order verification telemetry solely on behalf of the Merchant to deliver first-party conversion attribution, analytics reporting, and merchant billing/usage calculations.
Processing Purposes
- First-party conversion tracking and referral attribution verification
- Catalog synchronization and inventory availability status indexing
- Merchant analytics dashboard and conversion reporting
- Billing, commission settlement, and usage calculations
- Service performance, fraud prevention, and infrastructure security
Categories Of Data
Processed Data
- Store identifier (e.g., domain, myshopify.com URL, merchant ID)
- Order identifiers (order ID, order number)
- Order financial metadata (order timestamp, currency, gross/net order totals)
- Line item identifiers (product IDs, variant IDs, quantities, unit prices)
- PoloPan internal referral tokens (first-party session/click attribution IDs)
Data Minimization
PoloPan strictly enforces data minimization principles and processes only the minimum non-PII technical fields required to deliver attribution services.
Data Not Processed
- Customer personal names
- Customer personal email addresses
- Customer personal phone numbers
- Customer shipping addresses or residential street addresses
- Customer billing street addresses
- Payment card numbers, CVVs, or financial instrument details
- Any other consumer personally identifiable information (PII)
Processing Instructions
PoloPan processes data only in accordance with the Merchant's documented instructions (including installation of the Shopify app and webhook authorization) and does not use Merchant customer data for independent advertising, profile building, or data reselling.
Compliance
PoloPan complies with all applicable global data protection laws, including Regulation (EU) 2016/679 (GDPR), UK GDPR, California Consumer Privacy Act (CCPA/CPRA), and the Indian Digital Personal Data Protection Act, 2023 (DPDP Act) when acting as a Data Processor / Service Provider.
Data Security
Measures
- End-to-end encryption in transit (HTTPS / TLS 1.3)
- Encryption at rest for all stored telemetry using AES-256
- Strict role-based access control (RBAC) and mandatory multi-factor authentication (MFA)
- Isolated cloud infrastructure with automated intrusion detection and logging
- Regular vulnerability assessments and code security reviews
Subprocessors
Description
PoloPan may engage reputable enterprise subprocessors (such as Microsoft Azure and Google Cloud) solely for cloud hosting, database clustering, and security monitoring.
Obligations
All subprocessors are bound by written agreements requiring them to maintain equivalent technical and organizational security measures.
Data Retention And Deletion
Retention
Attribution data is retained only as long as necessary for conversion verification, merchant reporting, and statutory billing compliance.
Uninstallation
Upon uninstallation of the PoloPan Shopify app, data ingestion ceases immediately, and previously ingested webhook logs are deleted or anonymized within thirty (30) days, except where limited retention is required for accounting audits or dispute resolution.
Exceptions
Limited non-PII financial records may be retained strictly for tax, accounting, and legal audit compliance.
International Transfers
Where data transfers involve personal data from the EEA, UK, or Switzerland, the parties agree that the European Commission's Standard Contractual Clauses (Module 2: Controller-to-Processor) and the UK International Data Transfer Addendum (IDTA) are incorporated into this DPA by reference.
Data Breach
In the event of a confirmed personal data security incident affecting Merchant data, PoloPan will notify the Merchant without undue delay (within 48 to 72 hours) and provide reasonable mitigation assistance.
Contact
hey@polopan.com