Data Processing Addendum

Effective date: September 21, 2026
Last updated: September 23, 2026

This Data Processing Addendum (“DPA”) forms part of the Merchant Agreement (as defined in the Terms of Service) between Bulki, LLC (“Company” or “Processor”) and the accepting Merchant. It applies to Personal Data processed on Merchant's behalf through the Service, including data submitted directly through enabled storefront modules. Company offers to be bound by this DPA as part of that agreement, and Merchant accepts through the recorded acceptance process in the Terms. Reliance on incorporated transfer clauses also requires completed Appendix information and binding execution by both parties as described in Section 16 and Annex A. This does not make a Shopper a contracting Merchant.

1. Definitions

"Applicable Data Protection Law" means the privacy, data-security and electronic-marketing laws applicable to the processing, including the CCPA, other applicable U.S. state laws and EU/UK GDPR. "Personal Data" is information processed on Merchant's behalf that those laws protect; "Processing" and role definitions have their applicable statutory meanings. A "Subprocessor" is a provider Company engages for that processing.

A "Security Incident" is a breach causing accidental or unlawful destruction, loss, alteration, disclosure or access to covered Personal Data. Unsuccessful blocked attempts are excluded, without limiting separate duties to report suspected compromise.

2. Roles and documented instructions

Merchant ordinarily determines purposes and means; Company acts as its processor, service provider or contractor. Company follows documented lawful instructions in this DPA, the accepted Schedule, enabled configuration and agreed written instructions, including for transfers. If law requires other processing, Company gives advance notice unless prohibited. Company immediately reports an instruction it considers unlawful and may suspend it while resolved.

Company's separately disclosed, lawful processing for its own website, accounts and necessary corporate/security records falls outside this processor role; it does not authorize repurposing Merchant data.

3. Specific limited business purposes

Processing is limited to authenticating and administering accounts, providing and supporting enabled features and integrations, authorized synchronization, security and abuse prevention, backup/recovery and reliability, and valid requests or legal/Shopify obligations. The Feature and Data Schedule and Annex A identify the data, subjects, purposes and duration and are incorporated into this DPA. Company retains the accepted version. New purposes or materially expanded uses require documented instructions and any necessary amendment, notice and consent; updating a webpage alone is insufficient.

4. CCPA service-provider / contractor terms

For covered CCPA service-provider/contractor processing, Company certifies that it understands and will comply with these restrictions:

• No sale or sharing of covered Personal Information.
• Use, retention and disclosure only for the limited purposes in Section 3 and Annex A or other purposes expressly permitted by the CCPA and its regulations; no other commercial use or use outside the direct Merchant relationship except as expressly permitted by those rules.
• No combining with information from other clients or Company's own consumer interactions except as expressly permitted by those rules.
• Compliance with applicable CCPA duties and the required level of privacy protection, including request assistance.
• Notice if Company can no longer meet those obligations; Merchant may take reasonable and appropriate steps to verify compliant use and stop and remediate unauthorized use, subject to Section 14's lawful audit safeguards.
• Written downstream service-provider/contractor restrictions meeting applicable requirements.

5. Regional processor obligations and assistance

Where processor duties apply, Company maintains confidentiality and security, supports rights requests and required assessments, binds subprocessors, demonstrates compliance and returns/deletes data as provided below. For EU/UK GDPR processing, Company assists with security, breach notices, impact assessments and prior regulatory consultation, considering the processing and available information, and cooperates with competent authorities. A Merchant acting as processor must have controller authorization and pass on lawful instructions.

6. Shopify platform restrictions

Company will comply with applicable Shopify requirements: minimum necessary data access and retention; permitted service purposes; required privacy webhooks, requests and consent mechanisms; required Shopify synchronization or merchant-enabled synchronization; and no sale, unauthorized disclosure or use of Shopify customer contacts for Company's own purposes. Providers receiving Merchant Data must have written purpose, security and confidentiality restrictions at least as protective as Shopify requires. Section 15 governs deletion.

7. AI and machine-learning restriction

Merchant Data, Customer Data, Personal Data under this DPA and derived information, including aggregated or de-identified information, must not be used to create, train, fine-tune or improve AI/ML models without separate written, feature-specific authorization meeting Shopify requirements and applicable law, with updated notices, lawful basis, required consent and vendor terms. Ordinary agreement acceptance, silence, automation or inference does not supply training authorization. No AI-provider integration is used.

8. Confidentiality

Processor will ensure personnel authorized to Process Personal Data are subject to confidentiality obligations or an appropriate statutory duty of confidentiality and receive access only where reasonably necessary for their role.

9. Security

Company will maintain Annex B's measures and other safeguards required by law and Shopify, appropriate to the processing risks and in place before processing begins. It will review effectiveness without materially reducing overall protection. No certification, independent audit or incident-free guarantee is implied.

10. Security incidents

Company will notify Merchant without undue delay upon awareness of a Security Incident; it will not await a completed investigation or a decision about regulatory notification. Notice includes available incident facts, affected data/people, likely consequences, response measures and a contact, with material updates as information develops. Company will contain, investigate and remediate, preserve evidence and assist Merchant's required response. Notice does not admit liability.

Company separately notifies Shopify of actual or suspected covered compromise immediately and no later than 24 hours after awareness where its terms require, or within a shorter binding deadline. Required earlier suspected-compromise notices and direct legal notices remain applicable; Company coordinates with Merchant where lawful.

11. Consumer and data-subject requests

Company will promptly route Merchant-data requests and provide technical and organizational assistance in time for applicable deadlines, reporting impediments. It responds substantively only on documented instructions or legal/Shopify requirements. Assistance covers applicable access, correction, deletion, portability, restriction, objection, withdrawal and opt-outs. Remedying Company's breach is at its expense; additional-work charges require advance agreement and cannot prevent required responses. Commercial disputes do not suspend mandatory Shopify requests.

12. Assessments and regulatory cooperation

Company will provide accurate, sufficient information for legally required privacy, security, transfer and automated-decision assessments and regulatory consultations concerning this processing. Confidentiality arrangements may protect sensitive material but cannot defeat mandatory information rights.

13. Subprocessors

Merchant generally authorizes the identified entities and processing in the Subprocessor List. Company assesses vendors, binds them to written obligations required by this DPA, law and Shopify, and remains responsible for their delegated data-protection performance.

Company gives at least 30 days' advance notice of additions or replacements by email to Merchant's store contact address, identifying function, data and location. Merchant may reasonably object on data-protection grounds during that period. Company works to resolve objections and will not send the objecting Merchant's affected data to the proposed vendor while unresolved.

If no reasonable solution exists, either party may end the affected feature, or the Service if inseparable, before the change applies, with the prepaid-unused-fee refund under Terms Section 13. Urgent protective suspension may be necessary but does not waive required authorization or notice.

14. Audits and information rights

Company will supply compliance information and allow and contribute to legally required audits/inspections by Merchant or its appointed independent auditor. Adequate current reports or questionnaires may be used first; nonexistent certifications are not represented as held.

Reasonable notice, scope, scheduling, security and confidentiality apply. Audits are ordinarily annual, except for incidents, substantiated concerns, authority requests or legal requirements. Safeguards protect unrelated data, privilege and secrets without defeating mandatory information access. Each party bears ordinary participation costs; extraordinary costs require agreement. Company bears remediation and reasonable verification costs caused by its material noncompliance. Fees cannot prevent required audits.

15. Return and deletion

On ending processing, Company will return data in a reasonably available structured, commonly used format or delete it, at Merchant's choice, and delete remaining copies unless law requires retention. Without return instructions, Company deletes within applicable deadlines. It confirms completion on reasonable request and requires relevant subprocessors to comply.

Shopify-covered originals and copies, including backups/logs, must be deleted within 30 days of uninstall, no longer being needed, or an enforceable deletion request, except where law prohibits or varies that requirement. Return requests and backup cycles do not extend deadlines. Company promptly notifies Shopify of inability to comply where required.

Legally required retention must have a documented basis and period, restricted access/use and deletion when the basis ends. Restoring backups must preserve required deletions. Company-controller records cannot be used to evade these restrictions.

16. International transfers

Processor will identify relevant processing and remote-access countries in Annex A and the Subprocessor List. Before a restricted transfer occurs, the parties will document its scope, their roles, the applicable transfer mechanism, any required assessment and supplementary measures, and the completed Annex A, Annex B and vendor information. Where contractual safeguards are used, the required selections and binding execution must also be completed. Processor will not begin or continue an affected transfer while a required safeguard is missing or ineffective.

For a transfer of Merchant Personal Data from Merchant to Processor subject to EU GDPR Chapter V that is not covered by applicable adequacy and falls within their permitted scope, the unmodified Standard Contractual Clauses in the Annex to Commission Implementing Decision (EU) 2021/914 (“SCCs”) are incorporated into this DPA. Module Two applies where Merchant is controller and Processor is processor; Module Three applies where Merchant is processor and Processor is subprocessor. Clause 7 applies; Clause 9 uses general written authorization with 30 days' advance notice; the optional Clause 11 wording is not selected. Clause 17 uses Option 1 with Irish law, and Clause 18 selects the courts of Ireland, without limiting data subjects' permitted venues. The competent supervisory authority is determined under Clause 13 and identified in Annex A. Annexes A and B below and the Subprocessor List, completed for the covered transfer, provide the Appendix information.

For a corresponding restricted transfer subject to UK GDPR, the ICO International Data Transfer Addendum, version B1.0 in force 21 March 2022, including its Mandatory Clauses, is incorporated. Table 1 uses the parties and start date in Annex A; Table 2 uses the SCC modules and selections above; Table 3 uses Annex A, Annex B and the Subprocessor List; Table 4 permits either party to end the Addendum as provided in its Section 19. Its required changes, including applicable UK law, courts and regulator, apply to the UK transfer. Any mandatory successor applies as required by the Addendum.

The parties' completed transfer record forms part of this DPA and supplies the transfer-specific Appendix information and, where applicable, UK Addendum Tables. It must identify the covered transfers, accepted document versions, each party's authorized signatory and date, and execution evidence. For EU SCCs, each party must provide a legally valid signature, which may be electronic where permitted by applicable law. For the UK Addendum, the parties may also use another method that satisfies its binding-contract requirements. Shopify technical authorization or an incomplete form does not establish execution of the transfer terms. Processor will retain the executed terms and completed Appendix and make a copy available to Merchant. Data subjects may obtain copies to the extent required by the transfer terms, subject only to redactions those terms permit.

The transfer terms prevail over conflicting arbitration, liability, audit or other commercial restrictions, including restrictions on liability between their parties; third-party beneficiary rights are not waived. Processor will comply with applicable government-access, onward-transfer and transfer-assessment obligations, notify Merchant if it cannot comply, and suspend or end affected transfers when required. Where these clauses do not lawfully cover a transfer, the parties must establish another valid mechanism before it begins. Missing transfer information or suspension does not waive the parties' other data-protection duties. No certification under a data privacy framework is asserted by this DPA.

17. Merchant obligations

Merchant must have lawful collection, disclosure and processing instructions, notices and required permissions, and configure features accordingly. Company may suspend instructions it reasonably considers unlawful or contrary to binding Shopify requirements while the parties resolve the issue.

18. Order of precedence

Mandatory transfer clauses prevail for their subject matter; this DPA prevails over commercial terms for covered processing. Signed data-protection amendments remain subject to mandatory protections. Commercial limits cannot override protected data-subject rights or transfer liability, including liability between the parties. A privacy-notice update does not reduce the DPA's protection or authorize a new purpose.

Annex A - Parties, processing and transfer details

Annex B - Contractual security measures

Processor will maintain the following baseline for covered Processing. Any implementation details Company supplies will accurately describe the production environment. This Annex is not a claim of certification.

• Access and confidentiality: role-based, least-privilege access; individual accounts where practicable; strong authentication, including multi-factor authentication for privileged access; timely access revocation; and confidentiality obligations for authorized personnel.
• Data protection: encryption of Personal Data in transit and at rest, including backups where required; controlled access to encryption keys and secrets; logical separation of merchant data; and restrictions on unnecessary production data in development environments.
• Collection and disclosure: data minimization, validation of authorized requests, protection against unauthorized public access to private submissions, and configuration of public fields to the instructed purpose.
• Engineering and monitoring: documented change control, security review appropriate to changes, dependency/vulnerability management, timely risk-based remediation, access/security logging, and monitoring designed to detect unauthorized activity. Logs must avoid unnecessary sensitive content.
• Availability and recovery: protected backup and recovery procedures, periodic recovery checks, and continuity arrangements appropriate to the Service. Recovery must preserve deletion obligations.
• Incident response and assurance: documented response responsibilities and escalation, vendor diligence, personnel training appropriate to access, and periodic assessment of the effectiveness of the measures.
• Lifecycle: retention controls, secure deletion, support for data requests, and periodic review of access, vendor and retention settings.

Processor will supply an environment-specific implementation description for covered transfers, including the backup/deletion method, review cadence and any additional safeguards for separately approved sensitive data. Before relying on transfer clauses, the completed record must describe the measures actually implemented for the covered transfer; this general baseline alone does not complete a transfer-specific security annex. Necessary details may be supplied through a suitable secure channel and incorporated into the completed record without publishing secrets. Such details may not reduce the baseline or mandatory protections, and confidentiality must not defeat the information and audit rights in Section 14 or the transfer terms.