MikePrice Data Processing Agreement

Last updated: 2026-10-12

This Data Processing Agreement (“DPA”) applies between the merchant who installs MikePrice (“Merchant”, the controller) and Speedy Nordic Oy, Finland (“Provider”, the processor). It forms part of the terms under which the app is provided and is accepted by installing the app.

1. Subject matter and duration

The Provider processes data on behalf of the Merchant only to operate the MikePrice app for the duration of the installation.

2. Nature and purpose of processing

Showing and applying customer-group prices in the Merchant’s Shopify store. Price rules and groups are stored in the Merchant’s own store as metafields; the Provider’s servers hold only the Shopify session (shop domain and encrypted access token).

3. Categories of data and data subjects

Merchant staff: shop domain, Shopify access token (encrypted at rest).
Customers: customer tags are read to decide a shopper’s price group, inside Shopify and, for the optional customer price list, on the Provider’s server for the duration of a request. Wholesale application details entered by a customer (company name, tax ID, message) are relayed to the Merchant’s store and stored there as a customer metafield. No customer names, emails, phone numbers, addresses or orders are transmitted to or stored on the Provider’s servers.

4. Obligations of the Provider

Process personal data only on the Merchant’s documented instructions (the app’s functionality).
Ensure persons authorised to process data are bound by confidentiality.
Implement appropriate technical and organisational measures: encryption in transit (TLS) and at rest for access tokens, access restricted to the Provider’s administrators, server access via SSH keys only.
Not engage further processors other than the hosting provider listed below without informing the Merchant.
Assist the Merchant with data subject requests by honouring Shopify’s customers/data_request, customers/redact and shop/redact webhooks.
Delete the Merchant’s session data when the app is uninstalled and again on the shop redaction request.
Notify the Merchant without undue delay of a personal data breach affecting the Merchant’s data.

5. Sub-processors

Shopify Inc. — platform on which all price data is stored.
Hosting of the app server: Tencent Cloud (Hong Kong). Only session data is hosted there; no customer personal data.

6. International transfers

Session data (shop domain and access token) is stored on the Provider’s server in Hong Kong. No customer personal data leaves Shopify.

7. Return and deletion

Price rules and settings remain in the Merchant’s store and can be removed from the app’s Settings page. Session data is deleted on uninstall.

8. Audit

The Merchant may request a description of the Provider’s security measures by email. Contact: [email protected].