Customer data, processed on customer instructions.

This Data Processing Addendum (DPA) is between the Customer identified under the Marlo Terms of Service and Built by James Ltd. It applies where Marlo processes personal data contained in Customer Data on Customer's behalf (Customer Personal Data).

Customer is the controller and Built by James Ltd is the processor for Customer Personal Data, unless Customer acts as a processor for another controller, in which case Built by James Ltd is Customer's subprocessor. We remain a controller for our own account, billing, security and service-administration data as explained in the Privacy Notice.

• Subject matter: hosting, synchronizing, organizing, analysing, displaying, exporting, securing and supporting Shopify Partner reporting data and workspace content.
• Duration: the subscription term plus the deletion and backup period described below.
• Nature and purpose: automated and occasional authorized support processing needed to provide Marlo, protect it and follow Customer's documented instructions.
• Data subjects: Customer users and administrators, Shopify merchants or representatives, sole traders and other people identifiable in authorized Partner data or workspace content.
• Data types: names, emails, roles, identifiers, shop names and domains, location, app and subscription lifecycle records, transaction and payout references, uninstall feedback, notes, support content and related technical metadata. Customer must not intentionally submit special-category or criminal-offence data unless the parties first agree suitable written safeguards.

We will process Customer Personal Data only on Customer's documented instructions, including the Terms, Customer's configuration and authorized use of Marlo, unless UK law requires otherwise. If legally permitted, we will tell Customer before processing required by law.

We will promptly tell Customer if, in our reasonable opinion, an instruction infringes applicable data-protection law. Customer is responsible for its notices, lawful bases, data-subject instructions and authority to provide the data and instructions.

People authorized to process Customer Personal Data are bound by confidentiality and receive access only as needed. We maintain measures appropriate to the risk, including:

• transport encryption and encrypted storage of Shopify Partner credentials;
• Clerk authentication, organization-scoped authorization and administrative role checks;
• restricted production credentials, signed webhook verification and hashed service API keys;
• logical tenant separation, audit events, dependency review and controlled deployment checks; and
• processes to restore, investigate and improve service operation after an incident.

More detail is available on the Security page. Customer is responsible for its users, endpoint security, role assignments and safe handling of credentials and exports.

Customer gives general written authorization for the subprocessors below. We remain responsible for their performance of equivalent data-protection obligations. We will give reasonable advance notice through the service or account email before adding a subprocessor that materially changes the processing, where practicable. Customer may object on reasonable data-protection grounds by contacting us before the change takes effect; the parties will work in good faith on a solution.

Stripe processes billing data and Google processes optional sign-in data under their own service roles and terms. Shopify is the Customer-selected source system rather than a Marlo subprocessor.

Customer authorizes transfers needed to provide Marlo. Where Customer Personal Data is subject to a restricted transfer from the UK, we will use an applicable adequacy regulation or appropriate safeguards made available in the relevant supplier agreement, such as the UK International Data Transfer Agreement or UK Addendum, and take reasonable supplementary measures where required.

Customer may request available information about the applicable safeguard by emailing hello@builtbyjames.co.uk.

Taking into account the nature of processing, we will provide reasonable assistance through technical measures and support so Customer can respond to requests to access, correct, delete, restrict, object or port Customer Personal Data. If a data subject contacts us directly about Customer Personal Data, we will direct the request to Customer unless law prevents it.

We will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data and provide available information reasonably needed for Customer's assessment and notification duties. Notification is not an admission of fault.

Taking into account the processing and information available to us, we will reasonably assist with security obligations, breach notifications, data-protection impact assessments and prior consultation with a regulator. Customer will reimburse reasonable costs for exceptional assistance not caused by our breach.

During the subscription, Customer can use Marlo's available views and exports to retrieve reporting data. On written request made before termination, we will provide reasonable assistance with an available export.

After termination or a valid deletion instruction, we will delete or anonymise Customer Personal Data within 90 days unless UK law requires retention. Residual encrypted backups will expire through the provider's normal rotation and will remain protected and unavailable for ordinary use. We may retain limited security, dispute and legal records where required, with access restricted to that purpose.

We will provide information reasonably necessary to demonstrate compliance with this DPA. Customer may conduct one remote audit in a 12-month period, and additional audits where a regulator requires or a substantiated incident reasonably justifies one, on at least 30 days' notice where practicable.

Audits must avoid unreasonable disruption, protect other customers and confidential information, and use existing independent reports first where sufficient. Customer bears its audit costs unless the audit identifies our material breach.

This DPA is governed by the law and jurisdiction in the Terms. If it conflicts with the Terms on processing Customer Personal Data, this DPA controls. Liability under this DPA is subject to the liability provisions in the Terms except where applicable law prohibits that limitation.