Merchant Data Processing Addendum

1. Parties and scope

This Data Processing Addendum (“DPA”) forms part of the agreement between Arure LLC (“Processor”) and the Shopify merchant that installs Arure E-Invoicing (“Controller” or “Merchant”) for processing personal data in connection with the App.

By installing or continuing to use the App, Merchant agrees to this DPA. It covers only personal data Processor processes on Merchant’s behalf in E-Invoicing, not Arure’s corporate website or Shopify’s own processing as a platform.

2. Roles

• Merchant is the controller of customer and staff data and the taxpayer responsible for its invoices.
• Arure is the processor and processes personal data only on Merchant’s documented instructions (App configuration, and Shopify API and webhook events) and as the law requires.
• ZATCA receives documents as a public authority because Saudi e-invoicing law requires it; it is not a subprocessor. Shopify Inc. and its affiliates process platform data under Shopify’s merchant terms; this DPA does not bind Shopify.

3. Nature and purpose of processing

Processor issues e-invoices and credit notes for Merchant’s Shopify orders and refunds under ZATCA’s e-invoicing rules: building and cryptographically stamping each document with Merchant’s ZATCA device credentials, reporting or clearing it with ZATCA, publishing the buyer’s copy at an unguessable link, keeping the documents for Merchant, App billing, and fulfilment of Shopify’s mandatory privacy webhooks.

Purposes are limited to App functionality and Merchant’s legal and tax compliance. Processor will not process App personal data for sale, advertising or unrelated analytics.

4. Categories of data subjects and data

5. Merchant instructions and responsibilities

Merchant instructs Processor to:

• store and use the data above solely to issue, submit and keep Merchant’s e-invoices;
• respond to Shopify customers/data_request, customers/redact and shop/redact webhooks for App data;
• delete or anonymize personal data as described in section 11.

Merchant is responsible for the accuracy of its business details and product tax settings, for having a lawful basis to process customer data, for keeping its e-invoices for the period the law requires (including downloading them before uninstalling), and for answering customers’ privacy requests in the first instance.

6. Confidentiality and security

Processor ensures that people authorized to process personal data are bound by confidentiality, and applies technical and organizational measures appropriate to the risk, including Shopify authentication for Admin access, verified webhooks, encryption at rest of Shopify access tokens and of Merchant’s ZATCA private key and credentials, and HTTPS for all traffic. Merchant remains responsible for who can access its Shopify Admin and for sharing buyer links only with the buyer.

7. Subprocessors

Merchant authorizes Processor to use these subprocessors:

Processor will impose data-protection obligations on subprocessors no less protective than this DPA and will update this list before adding a new subprocessor.

8. International transfers

Where Processor transfers personal data from the EEA, UK or Switzerland to a third country, Processor will ensure an appropriate transfer mechanism (such as Standard Contractual Clauses) applies, unless another lawful basis exists.

9. Assistance with data subject rights

Taking into account the nature of processing, Processor will assist Merchant by (a) fulfilling Shopify privacy webhooks for App data, with data-request exports available to Merchant on the App’s Privacy page, and (b) providing reasonable cooperation if Merchant needs information from App records to answer a request. Customers should contact Merchant first.

10. Breach notification

Processor will notify Merchant without undue delay after becoming aware of a personal data breach affecting App-processed personal data, and will provide information reasonably available to help Merchant meet its own notification duties.

11. Retention and deletion

• During the subscription, issued e-invoices are retained so Merchant has its tax records.
• Stored order details are cleared once the document for them is issued.
• Customer data-request exports are cleared after 30 days.
• On customers/redact, Processor clears stored order details for that customer’s orders. Issued e-invoices are retained as statutory tax records that Merchant must keep.
• On app/uninstalled, all sessions end immediately; on shop/redact (about 48 hours later) Processor deletes all of Merchant’s App data, including e-invoices and ZATCA credentials.
• Nightly database backups are kept for 14 days, then deleted.

12. Audits

Upon reasonable written request, and no more than once per year unless required by a supervisory authority or following a breach, Processor will make available information reasonably necessary to demonstrate compliance with this DPA (e.g. descriptions of security measures and webhook fulfillment). On-site audits require mutual agreement on scope, timing, and confidentiality.

13. Liability and precedence

Liability under this DPA is subject to the limitations in the Merchant’s App subscription / Shopify App Store terms with Arure, except where prohibited by applicable data-protection law. If this DPA conflicts with other Arure App terms on data protection, this DPA prevails for that subject matter.

14. Contact

Data protection contact: privacy@arure.tech
Processor: Arure LLC, arure.tech

Related disclosure: E-Invoicing Privacy Policy