Data processing addendum
When you connect your store and channels, you share your customers' personal data with us. Under the DPDP Act you are the Data Fiduciary and we are your Data Processor. This addendum sets out how we handle that data.
1. Scope
| Data principals | Your customers, shoppers who abandoned a checkout, and contacts you import for WhatsApp |
|---|---|
| Personal data | Name, phone number, email, city, state, pincode, order history, return and delivery outcomes, WhatsApp consent and message status |
| Purpose | Profit and operations reporting, customer segments, and the WhatsApp messages you configure |
| Duration | Your subscription, plus the export and deletion period in the Terms, and the retention periods in the Privacy policy |
2. Our commitments
- Process personal data only on your documented instructions: your connections, settings and actions in the app are those instructions.
- Not sell it, use it for our own marketing, or combine it with other customers' data.
- Limit access to staff who need it to support you. Every time our staff open your workspace it is logged, and you can ask for that log.
- Apply the safeguards described on our Security page, as required by Rule 6 of the DPDP Rules, 2025.
- Help you answer your customers' access, correction and erasure requests. You can export or erase a customer from their page in the app.
- Tell you of any personal data breach affecting your data without undue delay, and within 48 hours of becoming aware, with what we know, so you can notify the Data Protection Board within 72 hours.
- Delete or return your data when the subscription ends, as the Terms describe, and on Shopify's
shop/redactrequest. - Keep security and access logs for at least one year.
3. Your commitments
- Have a lawful basis and give your customers a clear notice for the data you share with us.
- Collect specific, separate opt-in before you send WhatsApp marketing, and record where it came from.
- Tell us promptly if a customer withdraws consent in a channel we can't see, and use the in-app erase action for erasure requests.
4. Sub-processors
You authorise these sub-processors. We'll give 30 days' notice in the app before adding one, and you may object.
| Service | Purpose | Location |
|---|---|---|
| Render Services, Inc. | Application hosting | Singapore |
| Neon (Databricks, Inc.) | Managed PostgreSQL database, encrypted at rest | Singapore |
| Meta-authorised WhatsApp Business Solution Provider | Sending WhatsApp messages you set up (named in your order form) | India |
| Meta Platforms, Inc. (WhatsApp Business Platform) | Delivering WhatsApp messages | Global |
Platforms you connect yourself (Shopify, marketplaces, couriers, Meta Ads, Google Ads, Google Analytics) are your own providers, not our sub-processors. We only read from them with the permissions you grant, and act on them only when you press an action.
5. Audits
Once a year, or after a breach, you may ask for a written summary of our security controls and staff-access log for your workspace. On-site audits can be agreed at your cost with reasonable notice.
6. Contact
Grievance Officer, support@suprfree.com