Data Processing Addendum

Parties and roles

This addendum is between İzzet Uzunalioğlu, sole proprietorship trading as Caelus Technology ("we", "us", the "processor") and the business that installs the Shopify app "Reorderly" (the "merchant", the "controller"). It forms part of our Terms of Service and applies to personal data that we process on the merchant's behalf under data protection law, including the GDPR where it applies.

For personal data of the merchant's buyers that the app receives from Shopify, the merchant is the controller and we are the processor. For the merchant's own account data (for example support messages) we are a controller, as the Privacy Policy explains, and this addendum does not apply to that data.

Subject matter, duration, nature and purpose

Subject matter and purpose: providing the app to the merchant, that is, letting the merchant's B2B buyers search past orders, reorder, keep saved lists, export CSV, download invoices and see company pricing.

Nature of processing: receiving data from Shopify, indexing and storing it in a database, reading it back for the buyer, generating invoices on demand from live Shopify data, and deleting it.

Duration: while the app is installed, plus the deletion period described under "Deletion at the end" below.

Data subjects and personal data

Data subjects are the merchant's customers and buyers, and the merchant's staff who sign in to the app.

The personal data is the data listed in the Privacy Policy, which is the authoritative description. In summary: an order and order line index with Shopify identifiers (Level 1 protected customer data), the buyer's role at a company location, saved lists, an access log with buyer identifiers, download link and reorder reminder records, and, for staff, the name, e-mail, locale and user id in sign-in sessions.

Buyer name, billing address, e-mail and phone number (Level 2 protected customer data) are used only to produce invoices. They are read from Shopify when an invoice is requested and are not stored in database tables. The only copies that exist for a short time are inside bulk invoice ZIP files, which expire after 1 hour.

Documented instructions

We process the personal data only on the merchant's documented instructions. The merchant's configuration of the app, its use of the app's features, and this addendum are those instructions. We process the data for no other purpose, unless the law requires it, in which case we will tell the merchant first where the law allows.

If we believe an instruction breaks data protection law, we will tell the merchant.

Confidentiality

Only the founder of Reorderly has access to production data. Anyone authorised to process the personal data is bound by confidentiality.

Security measures

We apply these technical and organisational measures:

• Traffic to the app uses HTTPS (TLS).
• Buyer requests are authenticated with Shopify session tokens, and a buyer sees only orders that belong to them or to company locations where they are a Location admin.
• Download links are signed, short-lived and tied to the shop and the buyer.
• Application logs contain event names and internal identifiers, not buyer names, e-mail addresses, addresses or search text.
• Data minimisation: database tables have no columns for a buyer's name, address, e-mail or phone number, and short retention limits apply as the Privacy Policy states.
• Separate staging and production databases.
• Access to production systems is limited to the founder.
• Encryption at rest is provided by the hosting provider's encryption at rest.
• Access to buyer features is recorded in an access log kept for 90 days.

Sub-processors

The merchant gives general authorisation for these sub-processors, as listed in the Privacy Policy:

• Shopify: platform, sign-in, billing and the source of order and company data.
• Railway: application hosting and the Postgres database, in the EU (Amsterdam, the Netherlands).
• Sentry: error monitoring, configured to exclude request data, cookies, headers and user details.
• Google (Gemini API): language model for the Help assistant. It receives no buyer or order data.
• Google Workspace (Gmail): sends support e-mails.

Changes to sub-processors

We will keep the list in the Privacy Policy current and tell merchants about a new or replaced sub-processor through the Privacy Policy page (and in the app or by e-mail for material changes) before it starts processing buyer data. A merchant who objects on reasonable data protection grounds can uninstall the app, which ends processing as described below. We stay responsible for our sub-processors and bind them to data protection obligations no less protective than these.

Assistance with data subject requests

We assist the merchant, with appropriate technical and organisational measures, in answering requests from data subjects. These requests reach us through Shopify's mandatory webhooks:

• customers/data_request: we record the request and the data we hold about that customer, and provide it to the merchant.
• customers/redact: we delete that customer's data as the Privacy Policy describes.
• A data subject who writes to us directly is referred to the merchant.

Personal data breach

We will notify the merchant of a personal data breach affecting the merchant's data without undue delay and in any case within 48 hours of becoming aware of it. The notice will say what we know about the nature of the breach, the data and data subjects affected, the likely consequences and the measures taken, and we will add details as we learn them. We will help the merchant meet its own duty to notify authorities and data subjects.

Deletion at the end

When the merchant uninstalls the app, sessions are deleted immediately and all other data of the shop is deleted 48 hours after uninstall, through Shopify's shop/redact flow, as the Privacy Policy describes. The only exceptions are the trial ledger entry (shop domain and first trial end date) and the invoice number counter (shop domain and last invoice number), kept so a reinstall never reuses an invoice number. Neither holds buyer or staff data.

Audits and information

On reasonable request we give the merchant the information needed to show that we meet this addendum, and we allow reasonable audits, with reasonable notice, no more than once a year unless a breach has occurred, during business hours and under confidentiality. For a small service the first step is a written questionnaire answered by us.

International transfers

Our primary hosting and database are in the European Union (Railway, Amsterdam, the Netherlands).

Some of the providers listed above (for example Shopify itself and the e-mail and AI providers) may process data outside the European Economic Area or Türkiye. For such transfers we rely on the European Commission's Standard Contractual Clauses or an adequacy decision. For transfers of personal data from Türkiye we rely on the standard contracts or other safeguards under Article 9 of Turkish Law No. 6698 (KVKK). In each case this applies to the extent the provider offers them.

Liability and precedence

Liability under this addendum is subject to the limits in the Terms of Service, to the extent the law allows.

If this addendum and the Terms of Service conflict on the processing of personal data, this addendum prevails.

Contact

Questions about this addendum: support@caelustechnology.com.

İzzet Uzunalioğlu, sole proprietorship trading as Caelus Technology, KONUTKENT MAH. 2960 SK. ÖZDE EVLER NO: 2 /9 ÇANKAYA/ ANKARA

Tax ID: Doğanbey Tax Office, 9030071903