Data Processing Terms

1. Scope

These terms summarize how HappifyApps processes personal data on behalf of a Shopify merchant. They supplement the applicable order, product terms, and Privacy Policy. They do not replace a mutually signed data processing agreement where one is required.

2. Roles and instructions

For merchant data processed by a HappifyApps Shopify app, the merchant is generally the controller or data fiduciary and Udaan Technologies Pvt. Ltd., operating HappifyApps, acts as processor or data processor. We process that data only to provide, secure, support, and improve the contracted app, on the merchant’s documented instructions and applicable Shopify requirements. The product configuration, support requests, and lawful use of the service form part of those instructions.

3. Processing details

• Subject matter: operation of the installed app and requested support.
• Nature and purpose: collection, retrieval, organisation, analysis, display, transmission to a merchant-connected service, support, security, and deletion as required by the selected features.
• Duration: the installation or service term plus the documented deletion period.
• People: merchants, staff, customers, and recipients whose data is made available through permitted Shopify scopes.
• Data: the store, product, inventory, order, customer, and operational fields described in the Privacy Policy and installation scopes for the applicable app.

4. Our commitments

• Process merchant data only on documented instructions unless applicable law requires otherwise.
• Require personnel with access to protect confidentiality.
• Maintain data-minimisation, access-control, encryption, logging, and incident-response measures described on the Security page.
• Provide reasonable assistance with data-subject requests, impact assessments, security inquiries, and regulator consultations, considering the nature of the processing and information available to us.
• Notify the merchant without undue delay after confirming a personal-data incident affecting merchant data, and provide available information needed for the merchant’s response.
• Delete or return merchant personal data after termination, subject to verified legal retention duties and documented backup cycles.

5. Merchant responsibilities

• Use the service lawfully and provide the notices, choices, and legal basis required for merchant-controlled data.
• Configure access scopes and integrations appropriately, limit user access, and protect account credentials.
• Send only data needed for the selected service and respond to individuals and authorities where the merchant is responsible.
• Tell us promptly about an instruction that affects processing or a suspected incident involving the service.

6. Sub-processors and transfers

We may use the providers listed on our Sub-processors page to deliver the service. We require data-protection obligations appropriate to each provider’s role. Where data crosses borders, we use the provider and contractual mechanisms available for the relevant service and jurisdiction. Merchants with a signed DPA receive the notice and objection process stated in that agreement.

7. Review and audits

On reasonable request, we will provide information needed to evaluate our controls, subject to confidentiality, security, proportionality, and third-party restrictions. If that information is not sufficient and applicable law requires further review, the parties will agree a scoped, non-disruptive assessment that protects other customers and confidential systems.

8. Signed DPA and contact

Merchants can request the current DPA and applicable transfer terms at privacy@happifyapps.com. The signed agreement controls if it conflicts with this public summary.