Data Processing Addendum

Last revision: 6 October 2026 · Privacy and data

This Data Processing Addendum (“DPA”) forms part of the terms under which IFG eCommerce (sole proprietorship of Francesco Guiducci), Via Giacinto Pullino 72, 00154 Rome, Italy, VAT IT16879681001 (“Processor”) provides the IFG Reviews Shopify app to the merchant that installs it (“Controller”). It applies where the Processor processes personal data of the Controller’s customers under Regulation (EU) 2016/679 (“GDPR”) and applicable data protection law.

1. Subject matter, duration, nature and purpose

• Subject matter: collecting, moderating and publishing product and store reviews and customer questions about products; sending review request emails; verifying purchases.
• Duration: for as long as the app is installed, plus the deletion period in section 9.
• Nature: storage, retrieval, structuring, transmission by email, publication on the Controller’s storefront after the Controller’s moderation, erasure.
• Purpose: only the review functions configured by the Controller in the app.

2. Data subjects and categories of data

• Data subjects: the Controller’s customers who placed an order or submitted a review.
• Categories: name, email address, order identifiers and fulfilment date, review content (rating, title, text, display name), review photos, unsubscribe and bounce records (stored as a hash). No special categories of data are requested or intended.

3. Processor obligations (art. 28(3) GDPR)

The Processor shall:

1. process personal data only on documented instructions from the Controller, which are the app settings and these terms, unless required otherwise by law (in which case it informs the Controller first, unless the law forbids it);
2. ensure that persons authorised to process the data are bound by confidentiality;
3. implement the technical and organisational measures in Annex 2 (art. 32 GDPR);
4. engage sub-processors only under section 4;
5. assist the Controller, by appropriate measures, in responding to data subject requests, including through Shopify’s customers/data_request and customers/redact webhooks;
6. assist the Controller with security, breach notification, impact assessments and prior consultation (arts. 32–36), taking into account the nature of processing;
7. at the end of the service, delete the personal data under section 9;
8. make available the information necessary to demonstrate compliance and allow for audits under section 8.

4. Sub-processors

The Controller gives general authorisation to the sub-processors listed in Annex 1. The Processor will notify the Controller of any intended addition or replacement at least 30 days in advance through the app or by email, giving the Controller the opportunity to object; if the objection cannot be resolved, the Controller may uninstall the app. The Processor imposes on each sub-processor data protection obligations equivalent to this DPA and remains liable for them.

5. International transfers

Personal data is stored in the European Union. Where a sub-processor processes data outside the EEA, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework where the recipient is certified) or on the Standard Contractual Clauses. Annex 1 states the transfer basis of each sub-processor.

6. Personal data breaches

The Processor notifies the Controller without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting the Controller’s data, with the information available under art. 33(3) GDPR, and updates it as more becomes known.

7. Controller obligations

The Controller is responsible for the lawfulness of the processing it instructs, including the legal basis for review request emails and the information given to its customers, and for the content it chooses to publish after moderation.

8. Audits

The Processor makes available on request the documentation of the measures in Annex 2. On-site audits, where required by law, take place with reasonable notice, during business hours, at the Controller’s expense and subject to confidentiality.

9. Deletion

When the app is uninstalled, Shopify sends a shop erasure request 48 hours later; on receipt the Processor deletes all personal data of the Controller’s customers from its database and storage, except where retention is required by law. Hashes needed to keep honouring opt-outs are deleted with the rest of the shop’s data. Records of emails already delivered are kept by the email sub-processor (Annex 1) under its own retention terms; the Processor does not send it new personal data after the erasure request.

Annex 1 — Sub-processors

Annex 2 — Technical and organisational measures

• Isolation: every query, job and repository is scoped to the shop derived and verified on the server; cross-tenant tests are part of the build.
• Encryption: TLS in transit; encryption at rest by the provider; application-level encryption of direct identifiers; one-way hashes for suppression records.
• Access control: staff access to production data is just-in-time, least privilege and logged; the log of accesses to the Controller’s data is provided to the Controller on request; MFA on privileged accounts; no long-lived service account keys, credentials in Secret Manager.
• Minimisation: only name and email are requested from Shopify’s protected customer data; no personal data in application logs; photos are re-encoded and stripped of metadata, and kept in a private quarantine until approved.
• Integrity of requests: webhooks verified by HMAC before processing and de-duplicated; emails sent once per idempotency key, after re-checking installation, plan, suppression and frequency.
• Availability and recovery: managed, regionally replicated database operated by the provider, and a documented restore procedure.
• Incident response: written procedure, including notification to affected merchants within the time set in section 6.