Data Processing Addendum.

1. Parties and scope

This Data Processing Addendum (“DPA”) is between Blue Sky PPC Ltd, trading as Vunda (“Vunda”, “we”, “us”), and the merchant using Vunda (“you”). It forms part of our Terms of Service and applies whenever we process personal data on your behalf to provide Vunda. If this DPA and the Terms conflict on the processing of personal data, this DPA wins.

For personal data about your shoppers that we process to run your app, you are the controller and we are your processor. For your own account details and for data we use to run our business, we are the controller, as described in our Privacy Policy.

2. Definitions

“Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and, where it applies to you, the EU GDPR. “Personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given in Data Protection Law. “Sub-processor” means a third party we engage to process personal data on your behalf.

3. Details of the processing

• Subject matter and purpose: building, publishing and operating your branded mobile app, including shopper accounts, push notifications and the integrations you switch on. Where you choose Vunda push, this includes running your push campaigns and automated flows and measuring their results (notifications sent and opened, and orders placed after a shopper opened one).
• Duration: for as long as you use Vunda, then until deletion under section 9.
• Data subjects: your shoppers and app users.
• Categories of personal data: Shopify customer identifiers; reviewer names and review text relayed from Judge.me where you enable it; and, where you enable a push provider, the shopper's name, email address, phone number, push subscription and in-app activity, which your app sends directly to that provider; and, where you choose Vunda push, device push tokens with platform, app version, language, time zone and a pseudonymous customer reference, which Vunda stores to deliver your notifications, together with a record of each notification sent to a device and whether it was opened; and, where you add a sign-up form, the shopper's email address and, where the form asks, first name and mobile number with their marketing consents, which pass to the destination you choose without being stored by Vunda, together with an opaque app install id for each reward code handed out and, for sign-ups sent through Vunda's server, a pseudonymous reference to the email address. Cart summaries collected before 24 September 2026 are no longer used and are kept only until they expire.
• Vunda push in-app activity: this applies only when in-app activity tracking is turned on for your store; until then none of it is collected. Once it is on, and only for shoppers who allowed both notifications and usage analytics in your app, Vunda stores these in-app activity events: product viewed, product added to wishlist, items added to cart, checkout started and order completed. Each event holds the time, the Shopify product ids involved, a pseudonymous reference to the shopper's device and, where the shopper is signed in, a pseudonymous customer reference. Checkout and order events also hold a pseudonymous cart or order reference, and order events hold the order total and currency and the notification the shopper opened before ordering, if any. No name, email address, phone number, postal address or product title is stored with them. Vunda uses them only to run your push flows (such as browse abandonment, abandoned checkout, back in stock, price drop and post-purchase) and to measure their results. From them Vunda also keeps the products each device is waiting on for back-in-stock and price-drop notifications, each shopper's progress through a flow, and the orders credited to a notification.
• Shopify customer and order data for push: only where you grant Vunda access to your Shopify customers or orders, which Vunda does not ask for today. If you do, Vunda will also store, for each customer, a pseudonymous customer reference, the time of their last order and an order count, to run win-back and post-purchase flows and to credit orders to notifications.
• Vunda push retention: in-app activity events are deleted 90 days after the event, product interest 30 days after the device last viewed or wishlisted the product, notification records 90 days after they are created, a shopper's progress through a flow 120 days after it ends, orders credited to a notification 400 days after they are credited, and last-order records 400 days after the customer's last order. All of these are erased sooner: for one device when the shopper turns notifications off in your app, for one shopper when Shopify sends a customer redaction request, and for your whole store when Shopify sends a shop redaction request. The only exception is a pseudonymous marker that a device has already received a once-per-device flow such as welcome, which is kept for up to 400 days when the shopper turns notifications off, so that turning them off and on again cannot repeat it. A customer redaction request erases the markers of the devices still registered to that shopper.
• Special category data: none. Do not configure Vunda to process it.

4. Your instructions

We process personal data only on your documented instructions. Your instructions are these Terms, this DPA and the settings you choose in Vunda. We will not process it for our own purposes, and we do not sell it. If we believe an instruction breaks Data Protection Law, we will tell you. If the law requires us to process personal data otherwise, we will tell you first unless the law forbids it.

You are responsible for having a lawful basis for the processing you instruct, for the notices you give your shoppers, and for any consent you rely on, including the consent settings you choose for push notifications and shopper events.

5. Confidentiality

Everyone we authorise to process your personal data is bound by a duty of confidentiality, and only people who need access to provide Vunda are given it.

6. Security

We keep appropriate technical and organisational measures in place to protect personal data, taking into account the risks of the processing. They include:

• encryption in transit (HTTPS) for every connection, and encryption at rest for stored data;
• additional application-layer encryption for store access tokens and provider credentials;
• least-privilege access limited to people who need it, with multi-factor authentication;
• separation of test and production data;
• retention limits, including automatic expiry of stored shopper data;
• a written security incident response policy, reviewed regularly.

We may update these measures, but not in a way that lowers the overall level of protection.

7. Sub-processors

You give us general authorisation to use sub-processors. The current list is in the “Third-party services and sub-processors” section of our Privacy Policy. We bind each sub-processor to data protection terms that protect personal data at least as well as this DPA, and we stay responsible for their performance.

We will tell you about any intended addition or replacement by updating that list and notifying you by email or in the app at least 14 days before it takes effect. You may object on reasonable data protection grounds within that period; if we cannot address your objection, you may stop using the affected feature or end your use of Vunda.

Push and analytics providers that you connect using your own account, such as OneSignal, Klaviyo or Google Analytics, process data under your agreement with them. They are your processors, not our sub-processors.

8. International transfers

Some sub-processors are outside the UK. Where personal data is transferred outside the UK, we make sure an appropriate safeguard applies, such as UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU-US Data Privacy Framework where the recipient is certified.

9. Assistance, deletion and records

• Data subject requests:we will help you respond to requests from your shoppers. If a shopper contacts us directly, we will pass the request to you. Shopify's customer data request and customer redaction webhooks are handled automatically.
• Other assistance: we will reasonably help you with security, breach notification, data protection impact assessments and consultation with a supervisory authority, taking into account the nature of the processing and the information available to us.
• Deletion: when you uninstall Vunda, your store data is erased when Shopify sends its shop redaction request (about 48 hours later), unless the law requires us to keep it. You can ask us to delete it sooner at support@vunda.app.
• Information and audits: we will make available the information reasonably needed to show we meet this DPA, and allow for audits by you or an auditor you appoint, on reasonable written notice, no more than once a year unless a personal data breach or a regulator requires it. We may meet this first with written answers and documentation.

10. Personal data breaches

If we become aware of a personal data breach affecting your personal data, we will notify you without undue delay, and in any event within 48 hours. We will tell you what we know about the nature of the breach, the data and shoppers affected, the likely consequences, and the steps we have taken or propose, and we will keep you updated as we learn more. Notifying you is not an admission of fault.

11. Liability and term

Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where Data Protection Law does not allow liability to be limited. This DPA lasts for as long as we process personal data on your behalf.

12. Contact

For questions about this DPA, or to request a signed copy, contact us at support@vunda.app.