Delink Data Processing Agreement

Last updated September 14, 2026 · Dhavira LLC, a North Carolina limited liability company · https://storeapp.getdelink.com

1. Parties and roles

This DPA is between Dhavira LLC ("Delink") and the merchant that accepts it ("Customer") when subscribing to Delink. It supplements our Terms and Privacy Policy.

In typical use, you (the merchant) are the data controller and Delink is your processor for compliance webhook ingest, verification, logging, customer-account deletion intake, and related app features. You remain responsible for fulfilling data subject requests in Shopify and your connected systems.

"Customer Personal Data" means personal data Delink processes on Customer's behalf. "Data Protection Laws" means privacy and data-protection laws applicable to that processing, including, where applicable, the GDPR, UK GDPR, Swiss data-protection law, Canadian private-sector privacy law, and U.S. state privacy laws.

2. Processing scope

This DPA applies only to Customer Personal Data Delink processes on Customer's behalf to provide the Service, for the duration of the subscription and documented post-termination retention. It does not govern shop contact, billing, support, or security data for which Delink independently determines purposes and means; the Privacy Policy governs that Delink Controller Data.

Data categories and minimization rules are described in the Privacy Policy (§3–4). Delink does not persist customer contact information from webhook payloads at rest.

• Subject matter and purpose: hosted compliance-webhook ingest, HMAC verification, operational records, workflow status, exports, customer-account deletion intake, security, and support;
• Duration: the subscription plus documented post-termination retention and deletion periods;
• Data subjects: Customer personnel, store customers, and other people represented in a compliance request;
• Data: shop identifiers, shop domain, webhook topic, timestamps, Shopify resource identifiers, workflow/audit data, optional pseudonymous subject hash, and transient payload fields used during verification;
• Special data: not intentionally requested; Customer must not intentionally submit special-category data beyond fields Shopify supplies in mandatory webhooks; and
• Frequency: continuous or event-driven, as Customer and Shopify use the Service.

3. Customer instructions

Delink processes personal data on your instructions as set out in this DPA, the Terms, Privacy Policy, and your Service configuration, unless required by applicable law — in which case we will inform you unless prohibited.

Customer is responsible for the lawfulness, accuracy, and transparency of its instructions, for required notices and consents, and for determining whether the Service is appropriate for its processing. Delink will promptly inform Customer if, in our reasonable opinion, an instruction infringes applicable Data Protection Laws.

4. Delink obligations

Delink will:

• process Customer Personal Data only on documented instructions, including for international transfers, unless law requires otherwise;
• implement and maintain the technical and organizational measures in §8;
• bind authorized personnel to confidentiality;
• taking account of the nature of processing, reasonably assist with data-subject requests and Customer's security, breach, DPIA, and regulator-consultation obligations;
• notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data;
• maintain records required of processors and cooperate with competent regulators as required by law; and
• at Customer's choice and on authenticated written instruction, either delete Customer Personal Data or return it using the compliance event-record export format supported by the Service, then delete existing copies except where law requires retention.

Delink's notice of an incident is not an admission of fault. Customer remains responsible for notifications to individuals and authorities unless law assigns that duty directly to Delink.

5. Subprocessors

You authorize Delink to use subprocessors required to operate the Service, including Google Cloud for hosting and databases and Shopify for authentication, webhooks, and billing. Delink will provide at least 30 days' notice before an intended addition or replacement that materially changes how we process Customer Personal Data. Customer may object during that period on reasonable data-protection grounds. Delink will impose materially equivalent data-protection obligations on subprocessors and remains responsible for their performance to the extent required by law.

6. International transfers

The Service is operated from the United States. This online DPA alone does not complete the party details, selections, annexes, governing law, forum, competent authority, signatures, or transfer assessment required for the European Commission Standard Contractual Clauses or the UK International Data Transfer Addendum.

Before a restricted EEA, UK, or Swiss transfer to Delink that is not covered by another lawful mechanism, the parties must execute a transfer addendum. That addendum is not included in the standard subscription. Contact us before enabling such processing.

7. U.S. state privacy terms

For Customer Personal Data governed by U.S. state privacy law, Delink acts as a service provider or contractor. Customer discloses data only for the limited and specified business purposes in §2. Delink will not sell or share it; retain, use, or disclose it outside those purposes or the direct business relationship except as permitted by law; or combine it with personal information from other persons except as legally permitted to provide and secure the Service.

8. Security measures

Delink maintains the following measures while processing Customer Personal Data, taking account of risk, implementation cost, and the nature of processing:

• TLS in transit; provider-supported encryption at rest for managed database storage;
• tenant-scoped authorization, least-privilege production access, confidentiality obligations, and administrative action logging;
• HMAC verification of Shopify webhooks, customer-account session tokens for deletion intake, and Shopify session-token authentication in Admin;
• data minimization that avoids persisting raw webhook bodies and customer contact fields, plus documented retention and weekly purge routines; and
• structured operational logging, health checks, monitoring, and periodic review of safeguards. Delink may update controls without materially reducing overall protection.

9. Audit, liability, and order of precedence

Upon reasonable written request, Delink will make available information reasonably necessary to demonstrate compliance with this DPA, including responses to a reasonable security questionnaire. Customer will use such documentation before requesting further review. If documentation is insufficient and applicable Data Protection Laws require additional verification, Customer may appoint an independent auditor bound by confidentiality to review Delink's relevant controls remotely on reasonable notice, normally limited to once every twelve (12) months.

Liability caps in the Terms apply except to the extent Data Protection Laws or an executed transfer addendum prohibit that limitation. If this DPA conflicts with the Terms regarding Customer Personal Data, this DPA controls.

10. Acceptance

You accept this DPA when you check the agreement box before your first paid Shopify subscription charge or when you otherwise indicate acceptance in writing. Current version: 2026-09-13.

Material DPA changes will be communicated before taking effect. Delink will require affirmative reacceptance before a materially changed DPA governs existing Customer Personal Data, except an urgent change strictly required by law may take effect when required with prompt notice.

11. Contact

DPA questions: support@getdelink.com.