Data Processing Agreement
Effective date: 2026-10-14
This Data Processing Agreement ("DPA") forms part of the agreement between Saaed Org ("Provider", "we") and the merchant that installs and uses saeed-app ("Merchant", "you") under which the Provider supplies the App (the "Agreement"). It applies whenever the Provider processes Personal Data on the Merchant's behalf through the App and takes effect when the Merchant installs the App. If this DPA conflicts with the Agreement, this DPA prevails with respect to the processing of Personal Data.
1. Definitions
"Data Protection Laws" means all laws applicable to the processing of Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended by the CPRA ("CCPA"). "Personal Data", "Controller", "Processor", "Data Subject", "processing" and "Personal Data Breach" have the meanings given in the GDPR. "Sub-processor" means any third party engaged by the Provider to process Personal Data on the Merchant's behalf.
2. Roles and scope
- For Personal Data contained in the emails received by the mailboxes the Merchant connects and in the Merchant's Shopify store, the Merchant is the Controller and the Provider is the Processor (and a "service provider" under the CCPA).
- The details of the processing — subject matter, duration, nature, purpose, types of Personal Data and categories of Data Subjects — are set out in Annex I.
- The Merchant is responsible for having a lawful basis for the processing, for the instructions it gives, and for informing its customers as required by Data Protection Laws.
3. Processing on documented instructions
The Provider processes Personal Data only on the Merchant's documented instructions, unless required otherwise by applicable law (in which case the Provider will inform the Merchant before processing, unless the law prohibits this). The Agreement, this DPA and the Merchant's configuration of the App — connected mailboxes, templates, data sources, uploaded files and send/approval settings — are the Merchant's complete instructions. The Provider will tell the Merchant if, in its opinion, an instruction infringes Data Protection Laws.
4. Confidentiality
The Provider ensures that every person authorised to process Personal Data is bound by an obligation of confidentiality and accesses Personal Data only as needed to provide, support or secure the App.
5. Security
The Provider implements the technical and organisational measures described in Annex II to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. The Provider may update these measures provided the overall level of protection is not reduced.
6. Sub-processors
- The Merchant gives general authorisation for the Provider to engage the Sub-processors listed in Annex III.
- The Provider will notify the Merchant of any intended addition or replacement of a Sub-processor by updating Annex III and informing the Merchant through the App or by email at least 14 days in advance. The Merchant may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, the Merchant may stop using the App and uninstall it.
- The Provider imposes data-protection obligations on each Sub-processor that are no less protective than those in this DPA and remains responsible for its Sub-processors' performance.
7. Assistance with Data Subject requests
Taking into account the nature of the processing, the Provider assists the Merchant in responding to requests from Data Subjects to exercise their rights. Requests received through Shopify's privacy webhooks (customer data requests and customer data erasure) are handled automatically by the App. If the Provider receives a request directly from a Data Subject, it will refer the Data Subject to the Merchant and will not respond itself unless instructed by the Merchant.
8. Personal Data Breaches
The Provider will notify the Merchant without undue delay after becoming aware of a Personal Data Breach affecting the Merchant's Personal Data, and will provide the information reasonably available to it to help the Merchant meet its own notification obligations, including the nature of the breach, the likely consequences and the measures taken or proposed.
9. Impact assessments and consultation
The Provider provides reasonable assistance, taking into account the nature of the processing and the information available to it, with data protection impact assessments and prior consultations with supervisory authorities that the Merchant is required to carry out in relation to the App.
10. Deletion and return
- The Merchant can delete connected mailboxes, templates and uploaded files in the App at any time. Removing a mailbox deletes its stored credentials and the emails processed for it.
- When the Merchant uninstalls the App, the Provider stops processing the store's mailboxes immediately and deletes all of the Merchant's Personal Data when Shopify sends its shop data-erasure request (48 hours after uninstalling), unless retention is required by law.
- Before uninstalling, the Merchant may request an export of its stored emails and replies by writing to info@zmailtrust.com.
11. Information and audits
The Provider makes available to the Merchant, on written request, the information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR. Where that information is not sufficient, the Provider allows and contributes to audits by the Merchant or an independent auditor bound by confidentiality, on at least 30 days' notice, during business hours, no more than once a year (unless required by a supervisory authority or following a Personal Data Breach), and at the Merchant's cost.
12. International transfers
Personal Data is processed in the location of the hosting infrastructure listed in Annex III. Where processing involves a transfer of Personal Data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the parties agree that the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914; Module Two, controller to processor), together with the UK International Data Transfer Addendum and the Swiss amendments where applicable, are incorporated into this DPA by reference, with the Merchant as data exporter and the Provider as data importer, and with Annexes I to III of this DPA completing the corresponding annexes of those clauses.
13. CCPA
Where the CCPA applies, the Provider acts as a service provider and will not: sell or share Personal Data; retain, use or disclose it for any purpose other than providing the App to the Merchant, or outside the direct business relationship with the Merchant; or combine it with personal information received from other sources, except as permitted by the CCPA. The Provider will notify the Merchant if it can no longer meet these obligations.
14. Liability, term and changes
Each party's liability under this DPA is subject to the limitations in the Agreement, to the extent permitted by Data Protection Laws. This DPA remains in force as long as the Provider processes Personal Data on the Merchant's behalf. The Provider may update this DPA to reflect changes in law or in the App; material changes will be communicated to Merchants in advance. Merchants who need a countersigned copy can request one at info@zmailtrust.com.
Annex I — Details of the processing
| Subject matter | Reading, classifying and answering customer emails sent to the Merchant's support mailbox, using the Merchant's templates, Shopify store data and uploaded files. |
|---|---|
| Duration | For as long as the App is installed, until deletion as described in section 10. |
| Nature and purpose | Retrieving new emails from connected mailboxes; classifying them and extracting details (such as order numbers) with AI models; looking up the sender's orders, products and store policies through read-only Shopify API access; generating reply drafts; sending replies from the Merchant's mailbox automatically or after the Merchant's approval; keeping a history of processed emails for the Merchant. |
| Categories of Data Subjects | The Merchant's customers and other people who email the connected mailboxes; the Merchant's staff who use the App. |
| Types of Personal Data | Names and email addresses; email subjects, contents and message identifiers; order details (order numbers, items, totals, payment and fulfilment status, tracking numbers and links); customer account details (number of orders, amount spent, tags); any personal data contained in files the Merchant uploads; mailbox credentials and OAuth tokens of the Merchant's mailboxes. |
| Special categories | None intended. The Merchant should not use the App for emails expected to contain special category data. |
| Frequency | Continuous, while the App is installed and processing is enabled. |
Annex II — Technical and organisational measures
- Encryption in transit: all access to the App is over HTTPS (TLS); connections to mail servers use TLS where the mail server supports it.
- Encryption at rest of credentials: mailbox passwords and OAuth tokens are encrypted with AES-256-GCM before storage.
- Least privilege: Shopify access is read-only (customers, orders, products, legal policies); the internal interface used by the processing service only allows read queries and is protected by a secret token.
- Data minimisation: store data is looked up only when needed to answer a specific email, and only orders belonging to the sender's email address are used.
- Separation: every record is tied to the Merchant's store, and each store can only access its own data in the App.
- AI processing: AI models run on infrastructure operated by the Provider; email content is not sent to third-party AI providers. Personal Data is not used to train or improve AI models.
- Human oversight: the Merchant decides per template whether replies are sent automatically or after approval; uncertain cases always wait for approval.
- Deletion: automated deletion on Shopify customer and shop erasure requests; manual deletion of mailboxes, templates and files in the App.
- Access control: access to production systems is restricted to authorised personnel using individual credentials.
Annex III — Sub-processors
| Sub-processor | Purpose |
|---|---|
| DigitalOcean (US) | Hosting of the App, its database and the email processing service. |
Shopify and the Merchant's own email provider (for example Google or Microsoft) are services the Merchant uses directly; the App accesses them on the Merchant's behalf and they are not engaged by the Provider as Sub-processors.
Contact
Data protection questions about this DPA: info@zmailtrust.com. See also our privacy policy.