Data processing agreement
Last updated: October 21, 2026
This Data Processing Agreement (DPA) forms part of the Terms of Service between the store that installs LumiOffer ("Store") and UNQ SOFTWARE ("we"). It applies to the personal data of the Store's shoppers that we process to provide LumiOffer.
1. Roles
The Store is the controller of its shoppers' and customers' personal data. We act as processor and process it only on the Store's documented instructions, which are the Store's use and configuration of LumiOffer.
2. Subject matter, data and purposes
Data subjects: visitors, shoppers and customers of the Store. Categories: a pseudonymous holdout-group value in a first-party cookie and a cart attribute; offer IDs in cart line properties; anonymous counts of offer views, clicks, adds to cart and visits; email addresses, mobile numbers, birth dates and interests entered in popups, passed to the Store's Shopify customer list and not stored by us (except an email address or phone number kept encrypted until its permission is registered with İYS), together with keyed one-way hashes of the email, phone number or a random browser ID, the issued code, its expiry, and a consent record per permission (channel, text version and fingerprint, time, offer, keyed hashes of IP address and browser); order line prices, quantities, discounts and subtotals without customer fields, with a keyed hash of the order ID; failure reports with page paths; IP addresses in web server access logs. Purposes: showing offers and applying discounts, issuing popup codes and adding customers to the Store, measuring the offers' effect and keeping offers working. No special categories of data are processed.
3. Duration and deletion
Processing lasts while LumiOffer is installed. Retention: daily offer totals 730 days, order ID hashes 400 days, popup code and consent records while installed, health reports 90 days, webhook contents 30 days, access logs a few days, backups about five weeks. After the Store uninstalls LumiOffer and Shopify sends the shop deletion request (48 hours later), all of the Store's data is deleted; deletions are re-applied if a backup is restored.
4. Security measures
Data is stored in the EU (Hetzner, Germany). Access tokens and webhook contents are encrypted at application level (AES-256-GCM); order IDs and popup email addresses and phone numbers are stored as keyed hashes (encrypted only while a permission waits for İYS); backups are encrypted (AES-256) before leaving the server; all traffic uses TLS. Server access is limited to authorised personnel with key-based authentication and IP restrictions. We keep tested backups with point-in-time recovery.
5. Confidentiality and sub-processors
Persons who process the data are bound by confidentiality. Sub-processors: Hetzner Online GmbH (hosting, backups), Shopify Inc. (platform) and our email provider (emails to the Store, and verification codes to its shoppers when a popup asks for them). We notify the Store before adding a sub-processor; the Store may object.
6. Assistance
We help the Store answer shoppers' requests through Shopify's data request and redaction process within 30 days, and provide the information needed for a data protection impact assessment.
7. Personal data breaches
We notify the Store without undue delay and at the latest within 72 hours of becoming aware of a personal data breach affecting the Store's data, with the information the Store needs to meet its own obligations.
8. Audits
On reasonable request we provide information showing compliance with this agreement.
9. International transfers
Data is stored and processed in the EU. Any transfer by a sub-processor outside the EU/EEA relies on an adequacy decision or the European Commission's Standard Contractual Clauses.
10. Acceptance
The Store accepts this agreement together with the Terms of Service and the Privacy Policy in the LumiOffer app. The accepted version and date are recorded.