Data Processing Addendum — MatchAudit for Shopify

Effective date: August 27, 2026

This Data Processing Addendum applies where MatchAudit processes personal data on behalf of a Shopify merchant in connection with the MatchAudit app distributed via the Shopify App Store. It is intended to satisfy Article 28 GDPR and similar processor requirements under applicable data protection law.

1. Parties and Role Allocation

This Data Processing Addendum ("DPA") forms part of the agreement between MatchAudit UG (haftungsbeschränkt) ("MatchAudit" or "Processor") and the Shopify merchant using the App ("Merchant" or "Controller").

This DPA applies only to the extent MatchAudit processes personal data on behalf of the Merchant in order to provide the App.

• For Shop Data received from the Merchant's Shopify store and related workflow data, the Merchant generally acts as controller and MatchAudit generally acts as processor.
• For MatchAudit's own account administration, billing records held for MatchAudit's own legal obligations, fraud prevention, abuse prevention, App security, and legal compliance activities, MatchAudit generally acts as controller and those activities are not governed by this DPA.

2. Scope, Subject Matter, and Duration

MatchAudit processes personal data solely to provide sanctions screening and compliance-evidence functionality to the Merchant, including receiving, screening, matching, storing, exporting, logging, maintaining, securing, and supporting the App.

Processing under this DPA begins when the Merchant installs the App and authorizes it to access Shop Data, and continues for the duration of the App's installation, unless earlier terminated in accordance with the Terms of Use or this DPA.

In the event of conflict between this DPA and the Terms of Use, this DPA prevails with respect to data protection matters only.

3. Nature and Purpose of Processing

MatchAudit processes personal data for the limited purpose of providing the contracted App to the Merchant. Depending on the Merchant's module configuration, such processing includes:

• receiving order and customer data from the Shop via the Shopify Admin API and webhooks (orders/create, orders/updated, customers/create, customers/update);
• comparing billing/shipping party names and related identifiers against sanctions data and configured high-risk-geography rules;
• generating potential matches, applying a Fulfillment Hold and order tag where a match exceeds the configured threshold, and creating case records for human review;
• maintaining a per-Shop Directory that links repeated screenings and decisions for the same customer or order party, and performing merchant-requested or snapshot-triggered re-screening;
• where evidence records are enabled: recording human decisions, optionally assisted by AI-drafted rationale, policy acknowledgements, and periodic reviews, in an append-only evidence-record chain;
• generating evidence exports (PDF/JSONL) at the Merchant's request;
• processing Shopify's mandatory privacy-compliance webhooks (customers/data_request, customers/redact, shop/redact) described in Section 12;
• securing, troubleshooting, monitoring, and supporting the App where necessary to perform the processor services.

4. Categories of Data and Data Subjects

The categories of personal data processed under this DPA are determined by the Merchant's use of the Shopify platform and may include:

• names of natural persons (billing/shipping contacts, customers) and legal entities (company names on orders);
• country and postal-address data made available in Shopify order or customer records;
• order, fulfillment, and case-review identifiers and status;
• for evidence records: decision records, rationale text (human-authored or AI-drafted and human-approved), and reviewer identity (the Shopify staff member's verified session identifier).
• limited public sanctions-source attributes used as comparison evidence, which may include a listed person's name, aliases, nationality, date of birth, address, source identifier, source version, and checksum.

The App's current screening queries do not request customer email addresses, telephone numbers, payment-card data, bank data, passwords, or customer-account credentials.

Data subjects are the Merchant's own customers whose orders are screened, and the Merchant's staff members whose decisions are recorded.

5. Controller Instructions and Controller Obligations

MatchAudit shall process personal data only on documented instructions from the Merchant unless otherwise required by applicable law. The Merchant's installation of the App, its module and threshold configuration, its API authorization scope, and its written support instructions constitute documented instructions for purposes of this DPA.

If MatchAudit is required by Union or Member State law to process personal data outside the Merchant's instructions, MatchAudit will inform the Merchant before that processing unless the law prohibits notice on important grounds of public interest. MatchAudit will promptly inform the Merchant if, in MatchAudit's opinion, an instruction infringes applicable data-protection law and may suspend the affected instruction while the parties resolve it.

The Merchant remains solely responsible for determining whether personal data may lawfully be processed through the App, establishing the legal basis for that processing under its own relationship with its customers, providing required privacy notices to its customers, and ensuring its instructions to MatchAudit do not violate applicable law.

6. Processor Obligations

MatchAudit shall process personal data only in accordance with the Merchant's documented instructions and applicable law; ensure persons authorized to process personal data are bound by confidentiality obligations; implement technical and organizational measures appropriate to the risk of the processing (Section 8); assist the Merchant, taking into account the nature of the processing and information available to MatchAudit, with data-subject requests and the obligations described in Articles 32 to 36 GDPR where applicable; notify the Merchant without undue delay after becoming aware of a personal data breach affecting data processed under this DPA; and make available information reasonably necessary to demonstrate compliance with this DPA.

For U.S. state privacy laws where applicable, MatchAudit acts as a service provider or processor for Shop Data. MatchAudit shall not sell or share Shop Data for cross-context behavioral advertising, retain or use it outside the business purposes specified in this DPA, or combine it with personal data obtained from another person except as permitted by applicable law to provide the App. MatchAudit does not use Customer Data obtained through Shopify to train generalized AI or machine-learning models.

7. Confidentiality and Authorized Personnel

MatchAudit shall ensure that access to personal data is limited to personnel, contractors, subprocessors, and service providers who need such access to provide, secure, maintain, or support the App, and that such persons are subject to confidentiality obligations appropriate to the nature of the data.

8. Technical and Organizational Measures

MatchAudit implements the following measures, specific to the infrastructure operating this App:

• Tenant isolation enforced at the database layer. Every tenant-scoped table has row-level security (RLS) enabled and enforced by PostgreSQL itself, not by application-level filtering alone. Queries run through a transaction-scoped wrapper that sets the acting shop's identity as a database session parameter before any tenant-table access.
• Least-privilege database role. The application's runtime database role is a dedicated, non-administrative role that cannot bypass row-level security, distinct from the administrative role used only for schema migrations.
• Column-level encryption of personal data. Stored customer names, postal-address fields, and Shopify offline access tokens are encrypted with AES-256-GCM at the application layer before being written to the database; the encryption key is held in the hosting provider's secret store, not in the database.
• Append-only, hash-chained evidence records. Evidence records cannot be updated or deleted by the application's database role — corrections are new records, not edits to history — and each record's hash is derived from the prior record's hash, making the chain tamper-evident.
• Private evidence-export storage with signed URLs. Evidence export files (PDF/JSONL) are stored in a private object-storage bucket; downloads are served only via short-lived signed URLs generated server-side, never a public path.
• Primary EU hosting. App compute is configured for Fly.io Frankfurt, and the dedicated Supabase database/storage project is configured for an EU region. Vendor support, security, routing, backup, and optional AI processing can involve other locations under Section 10.
• Reviewer identity from verified session token. Decision attribution is taken from Shopify's own cryptographically verified session token, not from client-submitted form data, and is enforced as a non-nullable database constraint.
• Idempotent webhook processing. Inbound Shopify webhooks are deduplicated by a unique constraint on the webhook's topic and delivery ID, preventing duplicate processing of retried deliveries.

MatchAudit may update or replace these measures over time, provided the overall level of security is not materially reduced.

9. Subprocessors

The Merchant grants MatchAudit a general authorization to engage subprocessors for the provision of the App. Current subprocessor categories are listed on our Subprocessors page.

MatchAudit remains responsible for the performance of its subprocessors to the extent required by applicable law and shall impose data protection obligations on subprocessors no less protective than the relevant obligations in this DPA.

If the Merchant reasonably objects to a new subprocessor on documented data protection grounds, the parties will discuss the objection in good faith; if no reasonable solution can be reached, either party may terminate the affected processor services to the extent required by applicable law.

MatchAudit will provide reasonable advance notice of a materially new subprocessor through the App, the Merchant's Shopify contact address, or the public Subprocessors page. Emergency substitutions required for security or service continuity may be notified after the change where advance notice is not reasonably possible.

10. International Transfers

Primary App compute and database/storage are configured for EU regions. Where MatchAudit or a subprocessor transfers personal data outside the EEA without an adequacy decision, MatchAudit uses an applicable transfer mechanism, including the European Commission's Standard Contractual Clauses where appropriate, and supplementary measures where required. The Merchant authorizes transfers necessary to provide the App subject to those safeguards.

11. Assistance with Data Subject Rights, DPIAs, and Investigations

Taking into account the nature of the processing, MatchAudit provides reasonable assistance to the Merchant in responding to data subject requests concerning Shop Data, and, to the extent required by law, with security incident assessment and notification, data protection impact assessments, and regulatory or audit requests related to processor services, subject to the Merchant reimbursing MatchAudit for significant additional effort outside standard support.

12. Shopify Privacy-Compliance Webhooks

MatchAudit implements Shopify's three mandatory compliance webhook topics as part of its processor obligations under this DPA:

• customers/data_request — MatchAudit assembles the Shop Data held about the named customer for delivery to the Merchant.
• customers/redact — MatchAudit erases or irreversibly de-identifies the named customer's personal data while preserving non-identifying evidence-chain integrity data where necessary.
• shop/redact — Shopify sends this request after its post-uninstallation waiting period. MatchAudit then erases or irreversibly de-identifies the Merchant's Shop Data, subject to documented legal-retention obligations.

MatchAudit acknowledges valid compliance webhooks promptly and completes the required action within 30 days after receipt unless applicable law requires retention.

13. Personal Data Breach Notification

If MatchAudit becomes aware of a personal data breach affecting personal data processed under this DPA, MatchAudit shall notify the Merchant without undue delay, including, to the extent available at the time, the nature of the breach, categories of affected data, likely consequences, and measures taken or proposed.

14. Deletion or Return of Data

At the Merchant's choice, MatchAudit will delete or return Shop Data after the end of the processor services, unless applicable law requires storage. The App provides merchant-initiated exports while installed. Shopify sends shop/redact after its post-uninstallation waiting period; MatchAudit completes the corresponding erasure or irreversible de-identification within 30 days of receipt. Evidence-chain structure may remain only in non-identifying form where needed to preserve integrity. MatchAudit deletes existing copies unless applicable law requires limited retention and informs the Merchant of that requirement where legally permitted.

15. Information Rights and Audits

MatchAudit shall make available information reasonably necessary to demonstrate compliance with this DPA. Audits or inspections by the Merchant or a mandated auditor are subject to reasonable prior written notice, no more than once per twelve-month period absent a personal data breach or regulator request, use of questionnaires or remote review before any on-site review, appropriate confidentiality protections, no access to other merchants' data, and the Merchant bearing its own costs.

16. Liability and Relationship to Terms of Use

Liability between the parties under this DPA is governed by the liability provisions of the Terms of Use, except to the extent mandatory data protection law requires otherwise. This DPA does not expand MatchAudit's role beyond processor obligations required by applicable law and does not transfer the Merchant's underlying compliance or controller responsibilities to MatchAudit.

17. Contact

MatchAudit UG (haftungsbeschränkt) Turmstrasse 7, 65611 Brechen, Germany Commercial register: Amtsgericht Limburg a.d. Lahn, HRB 7665

DPA and privacy inquiries: info@matchaudit.io