Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Terms of Service between MultiPixels ("Processor", "we") and the merchant who installs the MultiPixels Shopify app ("Controller", "you"). It covers the personal data of your store's visitors and customers that we process for you, and it starts when you install the app.

1. Scope and roles

You are the controller: you decide why and how your customers' data is used for advertising. We process it only to run the app, which sends the conversion events you set up to the ad platforms you connect. The "Data about your store's customers" section of our Privacy Policy lists the data, purposes and recipients, and is part of this DPA.

2. Instructions

We process personal data only as you instruct through your app settings: the pixels, platforms, events and tokens you set up. We will tell you if we think an instruction breaks data protection law. We do not sell personal data, use it for our own purposes or combine it with other merchants' data.

3. Your responsibilities

You are responsible for your lawful basis for the processing, your privacy notice to customers, setting up Shopify's customer privacy settings and cookie banner where consent is required, and your own agreements with the ad platforms you connect.

4. Consent

The app follows the consent your customers give through Shopify's customer privacy settings. Where you require consent, we send nothing until the customer accepts marketing cookies. We do not track customers who opt out of the sale or sharing of their data.

5. Confidentiality and security

Only people who need access to run the service can see personal data, and they must keep it confidential. We encrypt data in transit with TLS, and our hosting provider encrypts it at rest. Customer names, email addresses, phone numbers and addresses are hashed with SHA-256 in the customer's browser before they are sent.

6. Sub-processors

You authorise Cloudflare, Inc. as our hosting provider. The ad platforms you connect receive data as your recipients, under your own agreements with them, and are not our sub-processors. We will announce any new sub-processor on this page before it handles your data. You can object by uninstalling the app.

7. International transfers

When we transfer personal data outside the UK or EEA, we use the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or another lawful transfer mechanism.

8. Data subject requests

We keep store customer data only for the short periods in our Privacy Policy, so you handle requests to see or delete it. We respond to Shopify's customer data request and erasure webhooks, and we will help you answer any request we receive.

9. Personal data breaches

If we become aware of a breach affecting your customers' data, we will tell you without undue delay and within 72 hours, with the information we have to help you meet your own obligations.

10. Deletion

When you uninstall the app, we delete your store's settings and Conversions API tokens within 48 hours, when Shopify sends its shop erasure request. Any troubleshooting copy of your events expires within 7 days.

11. Audits

If you ask in writing, we will give you the information you reasonably need to show that we meet this DPA.

Contact

Contact details with MultiPixels:

Country: United Kingdom
E-mail: support@multipixels.com
Internet site: www.multipixels.com

E-mail: support@multipixels.com