Data Processing Addendum

Effective 19 September 2026. Forms part of the Terms of Service for every store that installs Baton.

1. Parties and scope

This addendum is between the merchant that installs Baton (the "Controller" or "you") and the operator of Baton, an individual entrepreneur (sole trader, autónomo) established in Spain (the "Processor" or "we").

It applies to all personal data of your buyers that Baton processes to provide the service described in the Terms of Service, and it prevails over the Terms of Service where the two conflict on data protection. Terms such as "personal data", "processing", "controller" and "processor" have the meaning given in the GDPR.

2. Details of the processing

3. Our obligations

• We process buyer data only on your documented instructions. Installing Baton, configuring it and using its features are your instructions; the Terms of Service and this addendum document them. We will tell you if an instruction appears to infringe data protection law.
• We use buyer data for nothing else: no marketing, no profiling, no sharing between stores, no sale.
• Only the operator of Baton has access to the systems that process buyer data, is bound to confidentiality, and accesses buyer data only to provide, support and secure the service.
• We implement the security measures in section 6 and keep them up to date.
• We assist you with requests from your buyers (section 5) and with your own obligations on security, breach notification and impact assessments, taking into account the information available to us.
• We delete or return buyer data at the end of the service (section 9).
• We make available the information needed to demonstrate compliance with article 28 and allow audits as described in section 8.

4. Your obligations

You are responsible for the lawfulness of the processing you instruct, including telling your buyers how their data is used (your store's privacy policy), for the accuracy of the buyer data you send through Shopify, and for the staff accounts you allow into your Shopify admin and therefore into Baton. Every action your staff take in Baton is recorded in the app's Activity page so you can review them.

5. Requests from buyers

Shopify forwards data access and erasure requests to Baton automatically (the mandatory customers/data_request and customers/redact webhooks). For an access request, Baton compiles a report of everything it holds about the buyer and makes it available to you in the app, encrypted, so you can answer within your deadline. For an erasure request, Baton anonymises the buyer's deliveries, revokes their download links, deletes their download history and removes them from your suppression list. If a buyer contacts us directly, we will refer them to you and help you handle the request.

6. Security measures

• Encryption in transit: HTTPS for the app, the download pages and every call to Shopify, the email provider and storage.
• Encryption at rest: buyer email addresses and Shopify access tokens are encrypted with AES-256-GCM using keys that are kept outside the database; a copy of the database alone reveals neither. Files are stored in Cloudflare R2, encrypted at rest by the provider.
• Access control: download links are 32-character random tokens, each with the store's download limit and optional expiry, revocable at any time. Webhooks from Shopify and the email provider are authenticated before processing. Merchant access goes through Shopify's own authentication.
• Data minimisation: download history is deleted after 90 days, raw email provider notifications after 30 days, email events after one year, privacy request records after three years, the staff activity log after two years. Provider payloads are stripped of buyer addresses before storage.
• Logging: every staff action in the app and every view of a record with buyer data is written to an activity log available to you in the app.
• Availability and integrity: daily encrypted database backups kept for 14 days on the server and in EU object storage, restore procedure tested; the application runs under a process supervisor with automatic restart.
• Incident management: a written incident response procedure with a credential rotation runbook.
• Least privilege: separate credentials per provider with the minimum rights needed; secrets never live in the code repository.

7. Sub-processors and transfers

You authorise the sub-processors below. Each one is bound by a contract that meets the requirements of article 28. We will announce any addition or replacement in the app or by email at least 30 days before it takes effect; if you object on reasonable data protection grounds and we cannot resolve it, you may terminate by uninstalling Baton.

Shopify is your own provider, not our sub-processor: Baton receives buyer data from Shopify under the permissions you grant when installing the app.

8. Information and audits

On request, at most once a year unless a supervisory authority or a security incident requires otherwise, we will answer your reasonable written questions about the measures in this addendum and provide the documentation we hold (this addendum, our privacy policy, the incident response procedure, the list of sub-processors). If that is not enough to demonstrate compliance, you may audit the relevant systems, or mandate an independent auditor bound by confidentiality, at your cost and with at least 30 days' notice, during business hours and without disrupting the service.

9. Breaches, deletion and end of the service

• Breach notification: we notify you of a personal data breach affecting your buyers without undue delay and in any case within 48 hours of confirming it, with the information you need for your own notifications: what happened, which data and how many buyers, the likely consequences, the measures taken and a contact point.
• End of the service: when you uninstall Baton, Shopify sends us a shop redaction request 48 hours later. We then delete every record of your store, including your buyers' data, and queue your files for deletion from storage, which completes within a few days. Encrypted backups containing the data expire within 14 days after that. Before uninstalling, you can export what you need from the app.
• Legal retention: we keep only what applicable law requires us to keep (for example accounting records), for the period it requires.

10. Contact

Questions about this addendum: hello@batonsend.com. Our Privacy Policy describes the processing for which we are the controller ourselves.