Handpicked data processing agreement

Last updated: 3 November 2026

This data processing agreement ("DPA") is between the merchant who installs Handpicked (the controller) and Alexander Storgaard, Irisparken 18, Ikast, Denmark (the processor, "we"). It applies to the personal data of the merchant's customers that Handpicked processes for the merchant, from the moment the merchant installs Handpicked, is part of the Terms of service, and is published in the app's Settings and on this page. It meets Article 28 of the EU General Data Protection Regulation (GDPR).

Contact for this agreement: [email protected].

1. Subject matter, duration, nature and purpose

• Subject matter: writing, sending and measuring email marketing campaigns that the merchant creates and approves in Handpicked.
• Duration: for as long as the app is installed, and until the data is deleted as set out in section 10.
• Nature: collection from Shopify, storage, generating email text with an AI provider, sending, recording delivery reports and unsubscribes, and measuring orders.
• Purpose: only to run the merchant's campaigns and show their results.

2. Personal data and data subjects

• Data subjects: the merchant's customers (stored only for those who subscribed to email marketing; the customer list and the orders in a measurement window are read in memory to choose recipients and count results); the merchant's staff who use the app.
• Personal data:
  • first name, email address and Shopify customer ID;
  • order history (products and dates); during the measurement window, the window's orders with buyer email and totals, in memory only;
  • email marketing consent;
  • addresses the merchant imports from another email tool's do-not-email list, read once and kept only as one-way hashes so they are never emailed;
  • the email written for each customer and its delivery reports;
  • for staff: the Shopify user ID in the access log.
• No special categories of personal data are processed.

3. Instructions

We process the data only on the merchant's documented instructions: the app's settings and the campaigns the merchant creates and approves. This holds also for transfers to third countries, unless EU or Member State law requires otherwise, in which case we tell the merchant first unless the law forbids it. If we think an instruction breaks data protection law, we tell the merchant.

4. Confidentiality

Only the processor, and the tools the processor operates, have access to the personal data. Anyone else who is ever given access will be bound by confidentiality.

5. Security

We take the technical and organisational measures in Annex 1 (Article 32 GDPR), and keep them up to date.

6. Subprocessors

The merchant authorises the subprocessors in Annex 2. We give notice in the app at least 30 days before adding or replacing one; the merchant may object, and may uninstall the app if we cannot meet the objection. Each subprocessor is bound by a written agreement with data protection obligations no less protective than this DPA. We remain responsible for our subprocessors.

7. Transfers outside the EU/EEA

Some subprocessors process data in the United States (Annex 2). These transfers are covered by the EU Standard Contractual Clauses in each provider's data processing agreement, and, where the provider is certified, by the EU-US Data Privacy Framework.

8. Help with data subject rights

Taking into account the nature of the processing, we help the merchant answer requests from data subjects.

• Shopify's customers/data_request is answered in the app with what we hold about the customer.
• customers/redact deletes that customer's data.
• One-click unsubscribe stops further emails at once; the customer's consent in Shopify is updated shortly after and retried until Shopify confirms.
• After customers/redact, only the one-way hash that keeps an unsubscribed customer from being emailed again is kept.

9. Personal data breaches and other help

We notify the merchant of a personal data breach without undue delay, and at the latest within 48 hours of becoming aware of it. The notice describes what happened, the data and people affected, the likely consequences and the measures taken. We also help the merchant with data protection impact assessments and prior consultations as far as they concern Handpicked.

10. Deletion at the end

• During use: a campaign's personal data is deleted 30 days after its 14-day measurement window ends. A campaign approved but never measured is cleared 90 days after approval, and one never sent after 90 days without changes.
• Return before deletion: at the merchant's choice, we return the personal data we hold for the store (as a file), if the merchant asks at [email protected] before uninstalling. Otherwise it is deleted.
• When the app is uninstalled: all the store's data is deleted when Shopify's shop/redact request arrives, 48 hours after uninstall, or by our scheduled check if it never comes.
• What is kept: a keyed one-way hash of the shop domain with the date its free campaign was used, which holds no personal data of customers.

11. Information and audits

We make available the information needed to show compliance with Article 28 GDPR: this DPA, the privacy policy, and on request our security documents. We allow and contribute to audits by the merchant or an auditor mandated by them, with reasonable notice, at most once a year unless a breach gives cause. Audits are done in a way that protects the confidentiality of other merchants' data.

12. Liability, law and order of precedence

• Liability: each party's liability follows the GDPR.
• Governing law: this DPA is governed by Danish law, and disputes go to the Danish courts.
• Order of precedence: if this DPA and other terms conflict about personal data, this DPA prevails.

Annex 1: Technical and organisational measures

• Encryption:
  • all traffic uses TLS;
  • the database connection requires a verified certificate (sslmode=verify-full);
  • data at rest, backups included, is encrypted by the database provider (AES-256).
• Access control:
  • only the processor, and the tools the processor operates, have access to production systems;
  • every service that holds or reaches production data uses a strong, unique password and two-factor login;
  • the app checks Shopify's session for every merchant page.
• Access logging:
  • every opening or export of customer data in the app is logged (who, when, how many; no customer data in the log);
  • the processor records a reason before looking at production data outside the app.
• Data minimisation:
  • at the start of each campaign only first name, email, Shopify customer ID, consent and order history are read, and only subscribed customers are stored; orders in the measurement window are read in memory and only totals per group are stored;
  • the AI provider receives only first name, order history and product data, never email addresses or IDs;
  • AI data collection is turned off for every request.
• Separation:
  • development and test use separate databases and a separate Shopify app;
  • outside production, email can only go to listed test addresses.
• Availability:
  • point-in-time recovery of the database;
  • health monitoring with alerts;
  • automatic alerts on failed background jobs;
  • a written backup and restore plan.
• Deletion: automatic deletion on the schedule in section 10.
• Incidents: a written incident response policy with the 48-hour notice in section 9.

Annex 2: Subprocessors

Shopify is the platform the merchant chose and from which the data comes. It isn't a subprocessor engaged by us.