Draft data processing terms.
The processing agreement must match the actual pilot configuration and be reviewed before onboarding.
Draft — requires legal review before publication. This page summarises the working DPA template. It is not an executed agreement, an offer for signature or a compliance certification. Hosting, transfer details and contract schedules remain subject to confirmation and legal review.
Parties and instructions
The customer controls its visitor-data purposes and authorised store configuration. Blokk processes visitor evidence on that customer’s documented instructions to provide scoped assessments, merchant reporting and supported policies. The proposed processor is Work Anywhere VOF, 97 Niewstraat, Essen 2920 Belgium. Contact: g@blokk.bot.
Processing scope
The service receives bounded browser observations and server/platform events, applies versioned rules, stores reviewable assessments and records later outcomes and corrections. Shopify installation identity, permissions and encrypted platform credentials support the authorised shop integration. A browser claim does not establish customer identity.
Detection excludes checkout text fields, card details, passwords and raw form contents. Account references are site-scoped pseudonyms. Interaction telemetry stays off by default. Customer events are not reused across customers for training or tuning, and cross-customer identity tracking is disabled.
Customer and processor responsibilities
The customer must provide lawful instructions, appropriate visitor notices, required consent and authorised access. Blokk’s draft obligations cover confidentiality, documented access controls, assistance with data-subject requests and incidents, deletion or return, and information needed to review those measures. Response periods, audit arrangements and liability provisions require legal review in the signed agreement.
Retention, deletion and Shopify lifecycle
The privacy notice describes current retention categories. Shopify uninstall disables access and collection; privacy requests require scoped handling, and shop redaction must remove the applicable installation and associated records. The pilot must verify these paths and document backup deletion reconciliation. Uninstall and the later shop-redaction event are different steps.
Subprocessors and transfers
Hosting: DigitalOcean, AMS3, Netherlands. Shopify participates in its own platform authentication and event delivery. The applicable roles, recipients and any transfer arrangements must be recorded for the actual deployment; this draft does not claim that platform data stays in a single jurisdiction.
Before signature
- Identify both legal entities and contacts, hosting and processing locations.
- Agree scope, duration, retention, approved permissions and any paid terms.
- Confirm subprocessors, transfers, incident assistance and deletion arrangements.
- Review the complete DPA and pilot agreement with the appropriate legal adviser.