SiteGuarding Store Scanner Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the SiteGuarding Store Scanner Terms of Service (the "Terms") between SiteGuarding CY Ltd ("SiteGuarding", "Processor", "we") and the merchant that installs the SiteGuarding Store Scanner app (the "App") on its Shopify store ("Merchant", "Controller", "you"). It applies when we process Personal Data on your behalf through the App. It takes effect when you accept the Terms, and no separate signature is needed. If this DPA and the Terms conflict on the processing of Personal Data, this DPA prevails.

1. Definitions

• "Data Protection Law" means all laws on the protection of personal data that apply to the processing under this DPA, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of the law of the United Kingdom together with the UK Data Protection Act 2018 ("UK GDPR"), and other applicable national laws.
• "Personal Data" means any information relating to an identified or identifiable natural person that we process on your behalf through the App.
• "Controller", "Processor", "Data Subject", "Processing", "Personal Data Breach" and "Supervisory Authority" have the meanings given in the GDPR.
• "Sub-processor" means a third party we engage to process Personal Data on your behalf.
• "Restricted Transfer" means a transfer of Personal Data to a country outside the European Economic Area or the United Kingdom that is not covered by an adequacy decision.

2. Roles and scope

2.1. You are the Controller and we are the Processor of the Personal Data described in Annex 1. Where you are yourself a processor for another controller, we act as your sub-processor and you confirm that your instructions are authorized by that controller.

2.2. This DPA does not cover information for which we are a controller, such as account and plan status, support correspondence, billing records received from Shopify and security logs. Our Privacy Policy describes that processing.

2.3. The App is designed not to collect personal information of your customers. It does not have access to orders or customers. Personal Data processed under this DPA is mainly contact details of your staff and alert recipients, Shopify user IDs of your staff, and any personal information that happens to be present in your theme files or on the public pages of your store. Technical records of suspicious scripts and domains (Annex 1) are designed not to contain Personal Data; if any is present, this DPA applies to it.

3. Your instructions

3.1. We process Personal Data only on your documented instructions. The Terms, this DPA, your choice of plan and your settings in the App (including turning storefront scans and the checkout path check on or off) are your complete instructions. They include keeping technical records of suspicious scripts and domains and having them reviewed, with the help of the Sub-processors in Annex 3, to recognize threats and reduce false findings in the App. Other instructions require our written agreement.

3.2. We will tell you if, in our opinion, an instruction infringes Data Protection Law. We may then suspend the affected processing until you confirm or change the instruction.

3.3. We may process Personal Data otherwise only where the law that applies to us requires it. In that case we will tell you before processing, unless that law forbids it.

3.4. You are responsible for the lawfulness of the Personal Data you make available to the App and of your instructions, including having any notices and legal bases you need. You confirm that you are authorized to allow the App to scan every domain you enable for storefront scans.

4. Confidentiality

We ensure that every person we authorize to process Personal Data is bound by confidentiality, by contract or by law, and processes it only as needed to provide the App.

5. Security

5.1. We implement and maintain the technical and organizational measures described in Annex 2, which take into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing and the risks to Data Subjects.

5.2. We may update these measures over time, provided the overall level of protection does not decrease.

6. Sub-processors

6.1. You give us general authorization to engage Sub-processors. The Sub-processors we use on the date of this DPA are listed in Annex 3.

6.2. We will give you notice of any intended new Sub-processor or replacement by updating Annex 3 and by email to the store contact address at least 30 days before it starts processing Personal Data. You may object on reasonable data protection grounds within that period. If we cannot address your objection, you may stop using the affected part of the App or uninstall the App, and you will not be charged for any period after the change takes effect.

6.3. We impose on each Sub-processor, by written contract, data protection obligations that are no less protective than this DPA. We remain responsible to you for the performance of our Sub-processors.

6.4. Destinations that you choose and configure yourself, such as the Slack workspace behind a webhook you add, the email addresses you add as alert recipients, and Shopify Flow, are not our Sub-processors. Data sent to them is sent on your instruction and is governed by your own arrangements with those services.

7. Assistance

7.1. Taking into account the nature of the processing, we will help you, by appropriate technical and organizational measures and as far as possible, to respond to requests from Data Subjects to exercise their rights. If we receive such a request directly, we will pass it to you without undue delay and will not answer it ourselves unless you authorize us to.

7.2. You can view, export and delete much of the data yourself in the App: alert recipients and webhooks can be removed in Settings, reports can be exported on paid plans, and uninstalling the App starts the deletion of all your store's data.

7.3. We will provide reasonable information to help you with data protection impact assessments and prior consultations with Supervisory Authorities, where required by Data Protection Law and related to the App.

8. Personal Data Breaches

8.1. We will notify you without undue delay after becoming aware of a Personal Data Breach affecting Personal Data we process for you, and in any case within 48 hours. We will send the notice to the store contact email address and through the App where possible.

8.2. The notice will describe, as far as known at the time: the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. Where we cannot give all the information at once, we will give it in phases without further undue delay.

8.3. We will take reasonable steps to contain the breach, investigate it and reduce its effects, and we will cooperate with you. Our notification of a breach is not an admission of fault or liability.

9. Deletion and return

9.1. When you uninstall the App, its access token is deleted at once. Shopify then sends us a store deletion request, normally 48 hours after uninstallation, and we delete your store's data, including Personal Data, when we receive it, and in any case within 30 days of uninstallation. Backups that contain the data are deleted within 30 days of their creation. The link between technical records and your store is deleted when you uninstall the App. A technical record that no store is linked to any more is deleted within 30 days, unless public research confirms that the script or domain is malicious.

9.2. On paid plans you can export your latest report in CSV, JSON or PDF format before you uninstall. We do not keep data after deletion in order to return it later.

9.3. We may keep Personal Data after these periods only where the law that applies to us requires it, and then only for that purpose, protected under this DPA.

10. Audits and information

10.1. We will make available to you the information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA, in the form of written answers, policies and summaries of our measures.

10.2. If that information is not sufficient, or a Supervisory Authority requires it, you may audit our compliance once in any 12 months, at your cost, on at least 30 days' written notice, during normal business hours, without access to other customers' data or to information that would compromise our security, and through an independent auditor bound by confidentiality.

11. International transfers

11.1. We host the App in the European Economic Area, in Germany. We will not make a Restricted Transfer of Personal Data ourselves, or allow a Sub-processor to do so, unless an appropriate safeguard under Data Protection Law is in place, such as the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914) and, for the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner. Technical records reviewed by Anthropic leave the European Economic Area; our data processing agreement with Anthropic includes the Standard Contractual Clauses.

11.2. If you are located outside the European Economic Area in a country without an adequacy decision, and Data Protection Law requires a safeguard for the Personal Data we make available to you in the App, Module 4 (processor to controller) of the Standard Contractual Clauses is incorporated into this DPA by reference, with SiteGuarding as data exporter and you as data importer.

12. Liability and term

12.1. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms, except where Data Protection Law does not allow them.

12.2. This DPA remains in force for as long as we process Personal Data on your behalf through the App, and ends automatically when that processing ends and the data has been deleted under Section 9.

Annex 1: Details of the processing

Annex 2: Technical and organizational measures

• Encryption in transit: all connections to the App and from the App to Shopify use HTTPS (TLS). Alert email is sent over SMTP with STARTTLS.
• Encryption at rest: access tokens, theme file contents, alert email addresses, Slack webhook addresses, storefront passwords and crawler signatures are encrypted with AES-256-GCM; the key is stored outside the database and the application code, with key versioning for rotation.
• Least privilege: the App requests only the read_themes Shopify permission and does not request access to orders, customers or payments.
• Tenant separation: every store record is bound to one store, and the application refuses to read data without a store context; automated tests check that one store cannot see another store's data.
• Isolated scanning: storefront pages are opened only in a dedicated browser environment that is separated from the database and the application, without access to internal networks, and is recreated regularly. Code taken from stores is analyzed as text; it runs only inside the isolated scanning browser.
• No side effects: the scanner does not type into or submit forms, does not sign in to customer accounts, does not place orders and blocks common analytics and advertising requests during a scan. The only exceptions are the storefront password form, if you give us the password, and the add to cart form, if you turn on the checkout path check.
• Data minimization for AI review: the link to the store is left out and the store's myshopify and primary domain names are replaced before sending; addresses are sent without query values and with data values replaced by placeholders; excerpts are limited to 300 characters, have comments and longer text removed, and are sent only for code seen unchanged on at least two stores. The review service is given no tools.
• Access control: production access is limited to authorized SiteGuarding staff, using SSH keys.
• Logging: an append-only audit log records consent decisions, plan changes and administrative actions; application logs do not contain secrets or form contents; alert delivery records do not contain recipient addresses.
• Backups: database backups are kept for no more than 30 days, on the App server and in a second copy on a SiteGuarding server and a storage service of Hetzner Online GmbH, all in Germany. They are not encrypted at rest.
• Webhook integrity: every Shopify webhook is verified by its HMAC signature before processing.
• Embedded interface: the App interface authenticates each request with a Shopify session token and does not use cookies.
• Incident handling: a documented procedure covers detection, containment, investigation and notification of incidents.
• Ongoing review: dependencies and the scanning browser are updated regularly.

Annex 3: Sub-processors

Not Sub-processors: Shopify (platform provider and billing, independent of SiteGuarding), Slack and other destinations you configure yourself (see Section 6.4).