Data Processing Agreement (GDPR Article 28)
Last updated: September 27, 2026
This agreement supplements the Panaché terms of service. It applies between the merchant who installs the app ("the controller") and Alexandre KHEFIF-DERAIN, individual (registration in progress), 15 boulevard de Verdun, 59000 Lille, France ("the processor"), for the processing of the store's customers' personal data carried out by the app on behalf of the merchant.
1. Subject and duration
The processor processes data on behalf of the controller solely to provide the Panaché service (case rule, statistics), for the whole time the app is installed, then until the data is deleted as set out in section 7.
2. Nature of the processing
| Processing | Data | Purpose |
|---|---|---|
Receiving orders (orders/create webhook) | Order content sent by Shopify; only the ID, date, currency and lines (product, quantity, price) are kept | Merchant statistics |
| Web pixel at checkout | Type and target of the messages displayed; no customer identifier | Counting blocked orders |
| Erasure requests forwarded by Shopify | IDs of the orders concerned | Deleting the matching statistics |
Categories of data subjects: the store's customers. No sensitive data is processed. No customer identification data (name, email, address, phone) is kept.
3. Instructions
The processor only processes data on the controller's documented instructions, which consist of the app's configuration and this agreement. It informs the controller if an instruction seems to breach the regulations.
4. Confidentiality and security
The processor ensures the confidentiality of the data, limits access to the people who need it and implements appropriate security measures: encrypted communications (HTTPS), encrypted database connections, secrets kept outside the code, technical logging without customer data, data minimisation.
5. Sub-processors
The controller authorises the following sub-processors: Railway (hosting, West Europe region) and Mailjet (emails to the merchant, without customer data). Any change will be notified at least 30 days in advance; the controller may object by uninstalling the app. Any transfers outside the European Union are covered by the standard contractual clauses.
6. Assistance
The processor helps the controller answer data subject requests (requests forwarded by Shopify are handled automatically) and, where necessary, carry out impact assessments.
7. Deletion and return
When the app is uninstalled, the store's data is deleted at Shopify's request (shop/redact webhook, within 48 hours). The merchant can export their settings from the app before uninstalling it.
8. Data breach
The processor notifies the controller of any personal data breach without undue delay, and no later than 48 hours after becoming aware of it, with the information needed for the controller's own notification.
9. Audit
The processor makes available the information needed to demonstrate compliance with this agreement, upon written request to support@getpanache.app.