Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the agreement between PunchRelay, operated from Hanoi, Vietnam ("PunchRelay", "we", "us"), and the business that installs or uses the PunchRelay Shopify app ("Merchant", "you") under our Terms of Service. It applies from the moment you accept the Terms and needs no separate signature. If you need a signed copy for your records, email hello@punchrelay.com.

1. Definitions and scope

1. "GDPR" means Regulation (EU) 2016/679. "UK GDPR" means the GDPR as it forms part of the law of the United Kingdom. "Data Protection Law" means the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection and any other data protection law that applies to the processing under this DPA. Terms such as "controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meaning given in the GDPR.
2. "Merchant Personal Data" means the personal data that PunchRelay processes on your behalf to provide the app, as described in Annex 1.
3. This DPA does not cover personal data that PunchRelay processes as a controller for its own purposes, such as your account, billing and the emails we send you about your trial, or visitors to punchrelay.com. Our privacy policy describes that processing.
4. If this DPA and the Terms conflict on the processing of Merchant Personal Data, this DPA prevails. If the Standard Contractual Clauses in section 12 apply and conflict with this DPA, the Standard Contractual Clauses prevail.

2. Roles

1. You are the controller of Merchant Personal Data and PunchRelay is your processor. Where you process that data as a processor for someone else, PunchRelay is your sub-processor, and you confirm that your controller has authorised you to appoint us on these terms.
2. You are responsible for having a lawful basis for the processing, for informing data subjects, and for the instructions you give. Do not send us special categories of personal data (Art. 9 GDPR) through the app; it is not built for them.

3. Processing on your instructions

1. We process Merchant Personal Data only on your documented instructions, including with regard to transfers to third countries, unless EU or Member State law to which we are subject requires otherwise. In that case we tell you about the legal requirement before processing, unless that law prohibits it.
2. Your instructions are the Terms, this DPA, the settings you choose in the app (for example which buyer connections exist, whether a purchase order becomes a Shopify order, and who receives email notices), and any further written instructions you send to hello@punchrelay.com that are consistent with the Terms.
3. We tell you immediately if, in our opinion, an instruction infringes Data Protection Law.

4. Confidentiality

We ensure that every person authorised to process Merchant Personal Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality.

5. Security of processing

1. We implement the technical and organisational measures in Annex 2 to ensure a level of security appropriate to the risk, as Art. 32 GDPR requires. The same measures are published on our security page.
2. We may change the measures as technology and risks develop, as long as the overall level of security does not decrease. We update Annex 2 and the security page when we do.

6. Sub-processors

1. You give us general written authorisation to engage the sub-processors listed in Annex 3.
2. We tell you at least 30 days before we add or replace a sub-processor, by email to your store's contact address and by updating Annex 3 on this page.
3. You may object to a new sub-processor on reasonable data protection grounds within those 30 days by email to hello@punchrelay.com. We will then discuss it with you in good faith. If we cannot resolve the objection, you may end the Terms by uninstalling the app before the change takes effect, and no further fees apply from then.
4. We impose on each sub-processor, by contract, data protection obligations that give at least the protection required by Art. 28(3) GDPR, in particular sufficient guarantees of appropriate technical and organisational measures. We remain fully liable to you for the performance of each sub-processor's obligations.

7. Data subject requests

1. Taking into account the nature of the processing, we assist you with appropriate technical and organisational measures to answer requests from data subjects exercising their rights under Chapter III GDPR.
2. The app answers Shopify's privacy requests for you: on customers/data_request we prepare an export of the data we hold about that customer and make it available to you in the app within 30 days, and on customers/redact we delete or anonymise that customer's data within 30 days.
3. If a data subject contacts us directly about Merchant Personal Data, we forward the request to you without undue delay and do not answer it ourselves unless you instruct us to.

8. Assistance with security, breaches and impact assessments

Taking into account the nature of the processing and the information available to us, we assist you in meeting your obligations under Art. 32 to 36 GDPR: security of processing, notification of personal data breaches to the supervisory authority and to data subjects, data protection impact assessments and prior consultation. For an impact assessment, this DPA and the security page describe the processing and the measures, and we answer reasonable further questions sent to hello@punchrelay.com.

9. Personal data breaches

1. We notify you without undue delay, and no later than 48 hours, after becoming aware of a personal data breach affecting Merchant Personal Data. We send the notice to your store's contact address and, if we cannot reach you there, through the app.
2. The notice describes, as far as we know at the time, the nature of the breach including the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and limit its effects, with a contact point for more information. Where we cannot give all of this at once, we give it in phases without further undue delay.
3. We take reasonable steps to contain the breach and limit its effects, and we keep a record of it.

10. Deletion and return at the end of the service

1. When you uninstall the app, your store's Shopify access tokens are deleted and its buyer connections are disabled at once. Shopify sends a shop/redact request about 48 hours later; when it arrives we delete your store's remaining Merchant Personal Data.
2. Two kinds of record remain after that. Deduplication records hold your store domain, a status, timestamps and two SHA-256 fingerprints, no order contents, so that the same purchase order never becomes two Shopify orders if you install the app again. Records of privacy requests (type, dates and status) remain to show that they were handled.
3. Copies in encrypted database backups expire within 30 days. The off-server erasure records, which hold only keyed hashes, expire after 45 days.
4. Return or deletion is your choice. Purchase orders that you turned into Shopify orders are already in your Shopify store. If you want a copy of other Merchant Personal Data returned, ask us at hello@punchrelay.combefore you uninstall and we will provide it in a common machine-readable format before deletion.
5. Apart from the records in point 2, we keep Merchant Personal Data longer only where EU or Member State law requires us to store it.

11. Information and audits

1. We make available to you all information necessary to demonstrate compliance with Art. 28 GDPR, starting with this DPA and the security page, and we answer a reasonable security questionnaire once a year.
2. We allow for and contribute to audits, including inspections, by you or an auditor you mandate who is bound by confidentiality. You give at least 30 days' notice, the audit takes place during business hours without disrupting the service or exposing other merchants' data, you bear its costs, and it happens at most once in any 12 months unless a personal data breach or a supervisory authority requires another.

12. International transfers

1. The app's server and primary database are in the EU (Vienna, Austria). PunchRelay is operated from Vietnam, and access from there to Merchant Personal Data is a transfer to a country without an adequacy decision.
2. For that transfer, where you are subject to the GDPR, you (as data exporter) and PunchRelay (as data importer) enter into the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, which are incorporated into this DPA by reference: Module Two where you are a controller and Module Three where you are a processor. For those clauses: Clause 7 (docking) applies; under Clause 9(a), Option 2 (general written authorisation) applies with the 30-day notice in section 6; the optional wording in Clause 11 does not apply; under Clause 13, the supervisory authority is the one competent for you under Clause 13(a); under Clause 17, Option 2 applies, the clauses are governed by the law of the EU Member State in which you are established, or by Irish law if you are not established in the EU; and under Clause 18, the courts of that Member State have jurisdiction. Annex 1 of this DPA is Annex I, Annex 2 is Annex II and Annex 3 is Annex III of the clauses.
3. Where you are subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner applies in addition, with the details in Tables 1 to 3 taken from this DPA and neither party able to end it under Table 4. Where the Swiss Federal Act on Data Protection applies, the clauses above apply with the Swiss Federal Data Protection and Information Commissioner as the competent authority and references to the GDPR read as references to that Act.
4. Annex 3 shows the transfer mechanism we rely on for each sub-processor outside the EU.

13. Liability

Each party's liability under this DPA is subject to the limitation of liability in the Terms, except where Data Protection Law does not allow liability to be limited. Nothing in this DPA limits the rights of data subjects under the Standard Contractual Clauses.

14. Term and changes

1. This DPA applies for as long as we process Merchant Personal Data, including after the Terms end until the deletion in section 10 is complete.
2. We may update this DPA to reflect changes in Data Protection Law, in our sub-processors (with the notice in section 6) or in the service. An update never lowers the protection of Merchant Personal Data. We announce material changes by email at least 30 days before they take effect.
3. Apart from section 12, this DPA is governed by the same law as the Terms.

Annex 1: Details of the processing

Parties

• Controller (data exporter): the Merchant, identified by the Shopify store that installed the app, with its store contact address as the contact point.
• Processor (data importer): PunchRelay, operated from Hanoi, Vietnam. Contact: hello@punchrelay.com.

Subject matter and duration

Processing needed to provide the PunchRelay app under the Terms, for as long as the Merchant uses the app and until deletion under section 10. The processing is continuous.

Nature and purpose

Receiving, storing, checking and transmitting procurement messages between the Merchant's Shopify store and its buyers' procurement systems: opening cXML and OCI punchout sessions, returning carts with contract prices, receiving cXML purchase orders and presenting them for the Merchant's review, creating an unpaid Shopify order when the Merchant chooses to, emailing notices to the Merchant's staff, keeping protocol logs for testing and troubleshooting, support at the Merchant's request, answering Shopify privacy requests, and backups and security of the service.

Categories of data subjects

• Employees and other users of the Merchant's B2B customers who punch out from a procurement system ("buyer users").
• Contacts of the Merchant's B2B customers named in Shopify B2B companies and on purchase orders, including ship-to and bill-to recipients.
• The Merchant's staff who use the app or receive its email notices.

Categories of personal data

• Identification and contact data: names, business email addresses, user identifiers sent by the procurement system, and Shopify customer and contact IDs.
• Postal addresses for shipping and billing on purchase orders.
• Order data: purchase order numbers, line items, prices, quantities, currency and classification codes. When a cXML purchase order carries a procurement card (PCard), the cardholder name and the card's last four digits; the rest of the number and the expiry date are removed before storage.
• Technical data: punchout session data, return URLs, cXML and OCI messages with credentials removed and card numbers masked, and IP addresses in server logs.
• Merchant staff data: Shopify staff user IDs in the audit log, and the name and email address of notice recipients.
• Content of support conversations, if the Merchant uses support.

The app does not request phone numbers from Shopify. No special categories of personal data are intended.

Retention

• Punchout sessions and protocol logs: 90 days.
• Requests that never authenticate, and our answers to them: 7 days.
• Purchase order contents, including addresses, and the order processing records built from them: 90 days, then a deduplication record without order contents (section 10).
• Support diagnostics: 30 days; the record of who looked them up: 1 year.
• Buyer connection settings: until Shopify's shop/redact.
• Encrypted database backups: 30 days.
• Off-server erasure records (keyed hashes only): 45 days.

Annex 2: Technical and organisational measures

These are the measures on our security page, repeated here.

Where the service runs

• The app and its database run in netcup GmbH's data centre in Vienna, Austria (EU). The database and the application listen only on the server itself.
• Requests to the app gateway (relay.punchrelay.com) pass through Cloudflare's proxy and firewall before they reach the server. Cloudflare also adds its Web Analytics beacon to the app's pages, which counts page views and measures load times without cookies.
• The marketing website, punchrelay.com, runs separately on Cloudflare and holds no merchant or buyer data.
• PunchRelay is operated from Hanoi, Vietnam. Authorised PunchRelay personnel reach the server from there to run the service and answer requests.

Encryption in transit

• The app is served over HTTPS only. Plain HTTP requests are redirected to HTTPS, and the gateway sends HTTP Strict Transport Security (one year, including subdomains).
• Calls from the app to Shopify's APIs use HTTPS. In production the app returns carts and posts back to buyer systems only over HTTPS return URLs.

Encryption of credentials and backups

• Shopify access tokens and buyer credentials (shared secrets and OCI passwords) are encrypted with AES-256-GCM. The key is kept outside the database and outside its backups.
• Database backups are encrypted before they leave the server (see below).

Backups and recovery

• The database is backed up daily. Each backup is encrypted with age on the server and copied to a private Cloudflare R2 bucket in Cloudflare's EU jurisdiction. After every upload the backup is downloaded again in full and its SHA-256 checksum compared. The key that decrypts backups is held separately from the server.
• Restore has been tested: on 13 September 2026 a production backup was downloaded from R2, decrypted with the separately held key and restored into a disposable database with the expected schema and record counts. The full recovery procedure, including re-applying privacy erasures, was rehearsed on disposable databases on 23 September 2026.
• Erasures do not come back with a restore. Every Shopify privacy erasure is also recorded off the server, in a separate R2 bucket in the EU, as keyed hashes with no readable personal data. After a restore those records are used to erase the same data again.

Access control and logging

• Merchant staff use the app inside the Shopify admin. Every request is checked against a Shopify session token, and every database query is limited to that merchant's store.
• Every read by merchant staff is recorded before the data is returned, with the store, the Shopify staff user ID and the route. Opening a purchase order document or downloading a privacy export is recorded with that record's ID. Audit records hold no order content.
• Protocol logs keep the cXML and OCI messages for troubleshooting. Shared secrets, passwords and authorization tokens are removed before a message is stored, and a procurement card (PCard) number on a purchase order keeps only its last four digits, with the expiry date removed. A request that never authenticates keeps only its metadata (time, size, claimed sender identity and outcome) and at most the first 4 KB of the redacted message. The web server keeps no access log, because OCI login URLs can carry passwords. Application and error logs, which can contain IP addresses, are rotated automatically.
• Administrative access to the server, the database and the backup storage is restricted to authorised PunchRelay personnel. Support lookups into a merchant's data need a grant and are recorded.

Monitoring and incidents

• A monitor runs every minute on the server. It checks the app's health endpoint, backup freshness and the R2 copy, disk space, the job queue, the daily retention job, privacy request deadlines and the off-server erasure records, and alerts PunchRelay when a check fails.
• Incidents follow a written runbook: record, contain, establish scope, notify, fix and review. Merchants affected by a personal data breach are told without undue delay.

Annex 3: Sub-processors

The Merchant authorises these sub-processors under section 6. Each processes Merchant Personal Data only to provide its service to PunchRelay.

Shopify is not on this list: it is your own commerce platform under your agreement with Shopify, and the app reads from and writes to it on your instructions.

Contact

For questions about this DPA, objections to a sub-processor or a signed copy, email hello@punchrelay.com.