Data Processing Agreement
Shiply Notify · Last updated: 18 October 2026
Agreement under Article 28 GDPR between the merchant installing Shiply Notify (controller) and KRYVUM LABS SLU (processor). It forms part of the Terms and conditions.
1. Subject matter
The processor processes personal data of the controller's customers only to send them WhatsApp order status notifications configured by the controller, following its documented instructions, which are the app's settings.
2. Data and data subjects
Data subjects: customers of the controller's store. Data: name, phone, country, order number, amount, products, tracking details and opt-out replies. No special categories of data are processed.
3. Processor obligations
- Process the data only on the controller's instructions and not for its own purposes.
- Ensure the confidentiality of persons authorised to process it.
- Apply appropriate security measures: encryption in transit and at rest, application-level phone encryption, restricted access with two-step verification, separate environments and logs without personal data.
- Assist the controller in responding to data subject requests and meeting its security and impact assessment obligations.
- Delete the data at the end of the service and when the configured retention period expires.
- Make available to the controller the information needed to demonstrate compliance.
4. Sub-processors
The controller authorises the following sub-processors. We will give prior notice of any change so the controller can object.
| Sub-processor | Service | Data location |
|---|---|---|
| Google Cloud (Google Cloud EMEA Ltd.) | App servers (Cloud Run, Cloud Tasks) and QR mode server (Compute Engine) | Belgium (europe-west1), EU |
| Neon Inc. | PostgreSQL database | Frankfurt (AWS eu-central-1), EU |
| Shopify Inc. | Store platform and subscription billing | Canada (EU adequacy decision) |
5. WhatsApp
Messages are sent through the controller's own WhatsApp account (Meta official API or QR mode). WhatsApp processes that data under the controller's agreement with Meta or WhatsApp, not as a sub-processor of KRYVUM LABS SLU.
6. Personal data breaches
The processor will notify the controller without undue delay, and within 48 hours of becoming aware, of any security breach affecting its data, with the information available so the controller can notify the supervisory authority within 72 hours.
7. Term and termination
This agreement lasts while the app is installed. On uninstall, WhatsApp credentials and session are deleted, and the store's remaining data is erased when Shopify sends the deletion request (48 hours after uninstall).