Data Processing Agreement (DPA)
Last updated: March 17, 2026
This Data Processing Agreement (“DPA”) forms part of the agreement between Rofoso Consumer Private Limited (“Polopan”, “Processor”) and the merchant using the Polopan Shopify app (“Merchant”, “Controller”).
1. Scope and Roles
- The Merchant is the Data Controller
- Polopan acts as a Data Processor
Polopan processes Shopify store and order-related data solely on behalf of the Merchant to provide conversion tracking, reporting, and billing/usage calculations.
2. Nature and Purpose of Processing
Polopan processes data for the following purposes:
- Conversion tracking and attribution
- Reporting and analytics
- Billing and usage calculations
- Service performance and security
3. Categories of Data
Polopan processes limited Shopify data, including:
- Store identifier (e.g., domain)
- Order identifiers (order ID, order number)
- Order metadata (timestamps, totals, currency)
- Line item data (product IDs, quantities, prices)
- Attribution identifiers (tracking/session/affiliate IDs)
Data Minimization
Polopan does not require or intentionally process customer personal data such as:
- Name
- Email address
- Phone number
- Shipping or billing address
4. Processing Instructions
Polopan will:
- Process data only in accordance with Merchant instructions
- Not use data for independent purposes outside this agreement
- Not sell or misuse Merchant data
5. Data Security
Polopan implements appropriate technical and organizational measures, including:
- Encryption in transit (HTTPS/TLS)
- Access controls and authentication
- Secure infrastructure and logging
- Data minimization practices
6. Subprocessors
Polopan may use subprocessors (e.g., hosting, analytics, logging providers) solely to operate the service.
Polopan ensures that all subprocessors:
- Are bound by data protection obligations
- Process data only for the intended purposes
7. Data Retention and Deletion
- Data is retained only as long as necessary for:
- Conversion tracking
- Reporting
- Billing
- Upon app uninstallation:
- Data flows from Shopify stop
- Data is deleted or anonymized within a reasonable timeframe
Polopan may retain limited data where required for:
- Legal compliance
- Fraud prevention
- Dispute resolution
8. Data Subject Rights
To the extent applicable:
- Merchants may request access, correction, or deletion of data
- Polopan will assist in fulfilling such requests where technically feasible
9. International Transfers
Data may be processed outside the Merchant’s country.
Polopan ensures appropriate safeguards are in place consistent with applicable data protection laws.
10. Data Breach Notification
In the event of a data breach affecting Merchant data, Polopan will:
- Notify the Merchant without undue delay
- Provide relevant information about the breach
- Take reasonable steps to mitigate impact
11. Term and Termination
This DPA remains in effect for as long as Polopan processes data on behalf of the Merchant.
Termination occurs upon:
- App uninstallation
- Termination of service
12. Contact
For any data protection inquiries:
Email: hey@polopan.com
By installing or using the Polopan Shopify app, the Merchant agrees to this Data Processing Agreement.