Data Processing Agreement

CartHound — cart recovery app for Shopify · Last updated September 16, 2026

This Data Processing Agreement (“DPA”) is between the merchant who installs or uses the CartHound app (the “Merchant”, acting as controller) and PE Hrin Tamara, Ostafia Dashkevycha street, 22, Kyiv, 02139, Ukraine, operator of CartHound (“we”, acting as processor). It forms part of the Terms of Service and is accepted together with them. Terms not defined here have the meaning given in the EU General Data Protection Regulation (“GDPR”).

1. Subject matter, duration, nature and purpose

We process personal data of the Merchant’s customers and prospective customers only to provide the App: detecting abandoned carts, sending the reminder emails, SMS and discount codes the Merchant configures, honouring opt-outs, and attributing recovered orders. Processing lasts for as long as the App is installed, plus the deletion periods in section 9.

2. Personal data and data subjects

• Data subjects: the Merchant’s customers, prospective customers and storefront visitors who start a checkout or sign up through the App’s popup.
• Personal data: email address and phone number; cart and order contents and totals; consent and opt-out status; and, where the Merchant enters them, first name, last name and country.
• We do not process special categories of personal data.

3. Instructions

We process the personal data only on the Merchant’s documented instructions, which are these Terms, this DPA, and the Merchant’s configuration of the App — including for transfers to a third country. We will tell the Merchant if, in our view, an instruction infringes data protection law.

4. Confidentiality

Everyone we authorise to process the personal data is bound by confidentiality. Our staff see a Merchant’s data only through a read-only view that the Merchant must switch on, for a period the Merchant chooses; every such view is recorded in the Merchant’s audit log.

5. Security

We maintain appropriate technical and organisational measures under GDPR Art. 32, including:

• encryption of data at rest (AES-256), of backups, and in transit (TLS);
• least-privilege access, role-based permissions within the Merchant’s team, and audit logging of staff access and of subscriber exports;
• a strong-password policy and lockout on repeated failed sign-ins for our staff accounts;
• separation of test and production data;
• a data loss prevention strategy and a security incident response policy.

6. Sub-processors

The Merchant authorises us to engage the sub-processors below. We impose on each obligations no less protective than this DPA, and remain responsible to the Merchant for their performance. We will publish any intended change to this list on this page at least 30 days before it takes effect; the Merchant may object by writing to us, and may uninstall the App if the objection cannot be resolved.

• Shopify — source of store and shopper data.
• Resend — email delivery (United States).
• Telnyx — sms delivery.
• Neon — database hosting (United States).
• Fly.io — application hosting (United States).

7. International transfers

We are established in Ukraine, and our infrastructure is hosted in the United States. Where personal data subject to the GDPR is transferred to a country without an adequacy decision, the transfer is made under the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914) — Module Two between the Merchant and us, and Module Three between us and our sub-processors — which are incorporated into this DPA by reference.

8. Assistance to the Merchant

• Data subject requests. We act on the access and erasure requests Shopify forwards on a shopper’s behalf, and help the Merchant respond to any other request, within 30 days.
• Security incidents. We notify the Merchant without undue delay after becoming aware of a personal data breach affecting its data, with the information the Merchant needs to meet its own obligations, including notification to a supervisory authority within 72 hours where required.
• Impact assessments. We provide reasonable information the Merchant needs for a data protection impact assessment or prior consultation concerning the App.

9. Deletion and return

During the service, personal data is deleted automatically when no longer needed: abandoned carts 90 days after the last activity; customers who opted out of every channel 30 days after opting out; discount codes 30 days after expiry. When the Merchant uninstalls the App, Shopify sends an erasure request and we delete the Merchant’s customer data. The Merchant can export its subscriber list from the App at any time before uninstalling. We keep records that no longer identify any customer, such as order totals and billing history, where the law requires.

10. Demonstrating compliance and audits

We make available to the Merchant the information necessary to demonstrate compliance with this DPA and GDPR Art. 28, and allow for and contribute to audits, including inspections, by the Merchant or an auditor it mandates — on reasonable written notice, no more than once a year unless required by a supervisory authority or following a personal data breach.

11. Order of precedence and governing law

If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails; the Standard Contractual Clauses prevail over both. This DPA is governed by the laws of Ukraine, except where the Standard Contractual Clauses require otherwise.

Contact

Questions about this DPA: info@thecarthound.com.