Data Processing Addendum
Green13 Product Personalizer — a Shopify app by Green13 srl. Version 1.0, 15 October 2026.
This Data Processing Addendum ("DPA") applies to every merchant who installs Green13 Product
Personalizer. It sets out how Green13 srl processes the personal data of the merchant's customers on the
merchant's behalf, as required by Article 28 of the General Data Protection Regulation (EU) 2016/679
("GDPR"). The app never reads customers' names, email addresses, postal addresses or phone numbers.
1. Parties and roles
- Controller: the merchant who installs the app on their Shopify store (the "Merchant"). The
Merchant decides why customer data is processed: to let customers personalize products in the
Merchant's online store and to produce the personalized products they order.
- Processor: Green13 srl, Via della Resistenza 129/c, 20090 Buccinasco (MI), Italy, VAT IT14697160969, REA MI 2801512 ("Green13", "we"), which provides the app (the "App") and
processes personal data only on the Merchant's behalf. Contact:
info@green13.agency.
This DPA takes effect when the Merchant installs the App and forms part of the terms under which the
Merchant uses it. Our Privacy Policy describes the same processing in plain terms;
if the two differ on how personal data is processed, this DPA prevails.
2. Subject matter and duration
The subject matter is the provision of the App: a personalizer on the product pages of the Merchant's
online store, where customers enter texts, choices and photos and see a live preview of the product; the
preview images and the production files of each personalized order, saved in the Merchant's Shopify
Files; and a panel inside the Merchant's Shopify admin where the Merchant sets up fonts, colors and
templates. The processing lasts for as long as the App is installed, and ends with the deletion described
in section 11.
3. Nature and purpose of the processing
Green13 receives, stores, draws, displays and erases personal data, only to:
- save the design a customer makes when adding a personalized product to the cart, after checking it
again on the server against the Merchant's settings, and recalculate any extra price for the
personalization;
- draw the preview images of each view of the design on the App's server and link them in the cart
line;
- when the order is placed, make the production files of each view and save them in the Merchant's
Shopify Files, and show them to the Merchant on the order page;
- count the personalized orders of each month for the Merchant's plan and show the Merchant any problem
with an order (for example a missing extra price);
- delete the data as described in sections 9 and 11.
Personal data is never used for marketing, profiling, analytics or advertising, and is never sold.
4. Categories of data subjects and personal data
| Data subjects | The Merchant's customers who personalize a product in the Merchant's store,
and any person whose name or image a customer enters in a personalization. |
|---|
| Personalization | The texts a customer writes (which may include names), the font, color
and options they choose and, when the Merchant offers photo upload, the photos they upload, with
location and other metadata (EXIF) removed. |
|---|
| Previews and production files | Images and vector files drawn from the personalization:
previews on the App's server; production files in the Merchant's Shopify Files, with a copy on the
App's server for 30 days. |
|---|
| Order references | The ID and number of the order, the ID of the order line and the date,
for personalized orders only. No customer field of the order is read. |
|---|
| Store language | The language of the store the customer was using. |
|---|
The App does not process names, email addresses, postal addresses, phone numbers or payment details of
customers, and does not ask for special categories of personal data. A customer can write any text in a
personalization: the App treats it like any other personalization text.
5. Green13's obligations
- Instructions. We process personal data only on the Merchant's documented instructions: this
DPA, and the settings and actions the Merchant takes in the App. If we believe an instruction breaks
the GDPR or other EU or Member State data protection law, we will tell the Merchant.
- Confidentiality. Access to production data is limited to the people at Green13 who need it
to run the App — today one person — who are committed to confidentiality. We access it only when
needed to operate the App or fix a problem.
- No other use. We do not process the data for our own purposes and do not disclose it to
anyone except as described in this DPA.
6. Security measures
These are the technical and organisational measures in place (Article 32 GDPR):
- Encryption in transit: the App is served only over HTTPS (HTTP is redirected to HTTPS); calls
to Shopify use HTTPS; webhooks and storefront requests from Shopify are verified with HMAC
signatures.
- Server-side drawing: the App never stores an image or a price sent by the browser: it draws
every preview and production file itself, from the Merchant's settings and the values entered, and
recalculates every extra price.
- Preview links: each preview is reachable only through a link with a random identifier of 192
bits, which cannot be guessed or listed.
- Encrypted backups: nightly database backups are encrypted with GPG public-key encryption
before being stored; the private key that can read them is kept only on the Green13 team's own server,
not on the production server. Preview images and file copies are not in the backups.
- Restricted access: the production server accepts SSH logins with a personal key only
(password login and root login disabled), by one person; its firewall allows only SSH, HTTP and HTTPS,
and security updates are installed automatically. There is no internal admin panel: the data is shown
only to the Merchant inside their Shopify admin.
- Access log: Green13 opens a production database only through a procedure that first records
the date, the person, the app and the reason in an access log, and then opens the database
read-only.
- Isolation: every database query and every file on disk is limited to the Merchant's own store.
Development and tests use separate databases and a development store.
- Minimisation: the App requests no customer field from Shopify (name, email address, address,
phone number) and a design is not linked to a customer; IP addresses are used only in memory, to limit
abuse, and are not stored.
- Hosting in the EU: the production server is hosted in Italy.
7. Sub-processors
| Aruba S.p.A., Italy | Hosting of the App's production server, its database and its files
(virtual server in a data centre in Italy). |
|---|
Shopify is not our sub-processor: it is the Merchant's own commerce platform. The App exchanges data with
Shopify only through Shopify's APIs, on the Merchant's behalf, to read products and orders and to save the
production files in the Merchant's own Shopify Files, which are part of the Merchant's store.
The Merchant authorises the sub-processor listed above. Before adding or replacing a sub-processor we will
announce it on this page at least 30 days in advance; a Merchant who objects can stop using the App by
uninstalling it, which triggers the deletion in section 11. Any sub-processor is bound by data protection
obligations equivalent to those in this DPA.
8. Data subjects' requests
Customers exercise their rights with the Merchant. The App helps the Merchant answer them through
Shopify's mandatory privacy webhooks:
- customers/data_request: the App compiles every design it holds for the orders Shopify lists in
the request, and we will provide the compiled records to the Merchant on request.
- customers/redact: the designs of the orders Shopify lists in the request are deleted, with their
previews and the App's file copies, as soon as Shopify forwards the request. Orders and Shopify Files in
the Merchant's store are the Merchant's and are handled by the Merchant and by Shopify.
- shop/redact: all of the store's data is deleted (see section 11).
If a customer contacts us directly, we will forward the request to the Merchant without responding to it
ourselves. We also give the Merchant the information we have to help with data protection impact
assessments and consultations with supervisory authorities.
9. Retention
- Designs of carts that never become an order are deleted, with their previews, 30 days after
they were saved.
- The App's copies of production files are deleted 30 days after the files are saved in the
Merchant's Shopify Files.
- Designs of orders are kept while the App is installed, so that the production files can be made
again, until the customer's erasure (section 8) or the deletion in section 11.
- Fonts, colors, templates and settings are kept while the App is installed, until the Merchant deletes
them or until the deletion in section 11.
- Encrypted backups roll over: 14 days on the production server and 90 days for the copy kept by
Green13, so deleted data disappears from backups within 90 days at most.
10. Personal data breaches
If we become aware of a personal data breach affecting the Merchant's data, we will notify the Merchant
without undue delay and in any case within 72 hours of becoming aware of it, with what is known at that
time: the nature of the breach, the categories and approximate number of people and records concerned,
the likely consequences, and the measures taken or proposed. We will add information as it becomes
available and help the Merchant meet their own obligations to notify the supervisory authority and the
people concerned.
11. Deletion at the end of the processing
When the Merchant uninstalls the App, the personalizer disappears from the store immediately and the
authentication session is deleted. Shopify then sends the shop/redact request 48 hours after
the uninstall, and the App deletes all of that store's data as soon as it arrives: designs, previews,
file copies, order counts, fonts, colors, templates, product assignments and settings. Data in the
encrypted backups disappears as they roll over (section 9). We keep no copy of the Merchant's data after
that. Files in the Merchant's Shopify Files and orders in the Merchant's Shopify store remain the
Merchant's and are not touched.
12. Audits and information
On written request to info@green13.agency, we make available the
information needed to demonstrate compliance with Article 28 GDPR: a description of the processing and of
the security measures, and answers to reasonable security questionnaires. Any further audit or inspection
is agreed in writing in advance, with reasonable notice and without access to other merchants' data.
13. International transfers
Green13 does not transfer the Merchant's personal data outside the European Union. The production server,
its files and its backups, including the off-site copy, are in Italy. Data that the Merchant's store holds
on Shopify, Shopify Files included, is governed by the Merchant's own agreement with Shopify.
14. Changes
If the processing changes (new data, a new sub-processor, a different retention period), this page will be
updated before the change is released, with a new version number and date.