PromoLock · WEBx47
Data Processing Agreement
Last updated: 30 July 2026 · Effective from the date you install PromoLock
This Data Processing Agreement (“DPA”) governs PromoLock’s access to and processing of personal data on behalf of the merchant who installs it, in accordance with Article 28 of the UK and EU General Data Protection Regulation. It takes effect when you install PromoLock and forms part of the terms under which you use the app.
1Parties
This DPA is entered into between:
- The Processor: Akash Chaterjee, trading as WEBx47, of Mansarovar, Jaipur, RJ, 302020, IN (“we”, “Processor”), operator of the PromoLock Shopify app.
- The Controller: the merchant that has installed PromoLock (“Controller”), being the Shopify store on whose behalf personal data is processed.
This DPA forms part of, and is subject to, the terms under which the Controller uses PromoLock (the “Main Agreement”).
2Roles & definitions
The Controller determines the purposes and means of processing the personal data. The Processor processes that personal data only on the Controller’s behalf. “Personal data”, “processing”, “data subject”, “controller” and “processor” have the meanings given in the GDPR. “Applicable Data Protection Law” means the EU GDPR, the UK GDPR, and the UK Data Protection Act 2018, as applicable.
3Details of processing
| Subject matter | Provision of the PromoLock app: discount and gift card control, bulk discount codes, discount fraud prevention, and analytics. |
|---|---|
| Duration | For the term of the Main Agreement. Fraud-prevention records are kept for a rolling maximum of 365 days from the order date. All data associated with a store is deleted on uninstall. |
| Nature & purpose | Accessing order data to produce analytics for the Controller and — where the Controller enables fraud protection — to detect repeated redemptions of single-use discount codes; accessing and creating customer records to operate gift-card customer locking; and operating the app’s discount and gift card controls. |
| Categories of data subjects | The Controller’s store staff, and the Controller’s customers. |
| Personal data stored | Merchant account data (store owner / staff name and email), and the fraud-prevention data below where enabled. |
| Fraud-prevention data stored | Where the Controller enables discount fraud protection: per discount-code redemption, the customer ID, email address, phone number, first and last name, street address, and postal code, with the order reference, discount code, and order date. Used solely to decide whether a discount code may be redeemed; deleted on customer redaction, order cancellation, uninstall, and after 365 days at the latest. |
| Order data accessed | Order data (which may include customer name and email) is accessed to produce analytics; for analytics, only non-identifying fields (order ID, variant ID, discount amount, payment method, code, title) are stored. Customer identifying fields are stored only as fraud-prevention data, and only where the Controller has enabled fraud protection. |
| Customer data accessed | To set up gift-card customer locking, existing customer records are read and, at the Controller’s choice, new customer records (name, email) are created. Customer data is held in the Controller’s Shopify store, not stored by the Processor. |
4Processor obligations
- Process personal data only on the Controller’s documented instructions, including as set out in this DPA and the Main Agreement, unless required to do otherwise by law.
- Ensure that personnel authorised to process the personal data are bound by an obligation of confidentiality.
- Implement appropriate technical and organisational measures to protect the personal data (see Section 5).
- Not sell the personal data or use it for any purpose other than providing the service.
- Assist the Controller, taking into account the nature of processing, in responding to data subject requests and in meeting its obligations regarding security, breach notification, and impact assessments.
- On termination, delete the personal data within a reasonable period, unless retention is required by law.
- Make available information reasonably necessary to demonstrate compliance with this DPA.
5Security measures
The Processor maintains measures appropriate to the risk, including encryption of personal data at rest and in transit, access controls restricting who can access stored data, separation of production and test environments, automatic retention limits, and data minimisation limiting stored data to what each feature requires.
6Sub-processors
The Controller authorises the Processor to engage the sub-processors listed below. The Processor remains responsible for their performance and will inform the Controller of intended changes, giving the Controller the opportunity to object.
| Amazon Web Services, Inc. | Database hosting — United States (us-east-1) |
|---|---|
| PlanetScale, Inc. | Database platform — United States |
| Mantle | Billing & subscription management — receives merchant account data |
| Upstash, Inc. | Background job scheduling & message queue (QStash) for PromoLock’s scheduled and background tasks — United States |
7International transfers
Personal data is stored in the United States, and the Processor operates from India. Where personal data of UK or EU data subjects is transferred outside the UK or EEA, such transfers are made under appropriate safeguards, including the Standard Contractual Clauses adopted by the European Commission and the UK International Data Transfer Addendum, which are incorporated into this DPA by reference.
8Personal data breach
The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s data, and will provide information reasonably available to help the Controller meet its own notification obligations.
9Data subject rights
The Processor will, taking into account the nature of the processing, assist the Controller by appropriate measures in fulfilling the Controller’s obligation to respond to requests from data subjects exercising their rights under Applicable Data Protection Law, and honours Shopify’s mandatory privacy webhooks: on a customer data request it provides the Controller with the data held for that customer, and on a redaction request it deletes that data.
10Deletion & return
On expiry or termination of the Main Agreement, or on uninstall of the app, the Processor will delete the data associated with the Controller’s store within a reasonable period, unless applicable law requires storage.
11Liability & governing law
Each party’s liability under this DPA is subject to the limitations and exclusions of liability set out in the Main Agreement. This DPA is governed by the same law as the Main Agreement under which the Controller uses PromoLock.
12Acceptance
By installing or continuing to use PromoLock, the Controller accepts this DPA. No signature is required for it to take effect; it is incorporated into the Main Agreement under which the Controller uses the app. A merchant that requires a counter-signed copy for its records may request one from the Processor.
PromoLock is a product of WEBx47. This DPA works alongside the PromoLock Privacy Policy.