MarginPatrol | Version 1.0 | Prepared 08 August 2026
Publication date: 02.09.2026. Effective date: 02.09.2026. Canonical page: https://marginpatrol.com/data-processing-addendum.
1. Parties, application and duration
This DPA forms part of the accepted MarginPatrol Terms of Service or an expressly incorporating signed order between the operator identified in the Legal Notice, trading as MarginPatrol (Processor), and the business identified in the acceptance record or order (Merchant). It applies only to personal data processed by MarginPatrol on that Merchant's behalf (Merchant Personal Data).
The Merchant acts as controller or, where duly authorised, as processor for another controller. In the latter case, references to its controller instructions include the authorised controller's instructions and MarginPatrol acts as subprocessor. The Merchant must identify and possess the authority necessary for that arrangement.
This DPA applies for as long as MarginPatrol processes Merchant Personal Data, including setup, trial, paid access, an instructed read-only archive, return and deletion. It does not treat a free archive as data outside data-protection law. For its separately determined account-administration purposes, MarginPatrol acts under the Privacy Policy as applicable controller, not under a disguised processor instruction.
Applicable Data Protection Law means binding law governing the relevant processing, including the Ukrainian Law On Personal Data Protection and, where applicable, the GDPR, UK GDPR and Data Protection Act 2018 as amended, together with applicable implementing law. Definitions of personal data, processing, controller, processor and personal-data breach have the meanings of the applicable regime.
2. Instructions and permitted purposes
The subject matter, duration, purposes, operations, data categories and individuals are described in Annex A. Documented instructions consist of the Agreement, lawful settings and actions of authorised users, and further instructions recorded through an agreed secure channel.
MarginPatrol will process Merchant Personal Data only on those instructions, including for international transfers, unless applicable law requires different processing. In that case it will inform the Merchant before processing unless prohibited by law on important public-interest grounds.
MarginPatrol will promptly inform the Merchant if it considers an instruction to infringe applicable data-protection law. It may suspend the affected processing while clarification is obtained, without unnecessarily stopping unaffected lawful processing. It will not expand the purpose, sell or share the data for behavioural advertising, combine it for unrelated customer profiles or train a general-purpose AI model on it.
Google-derived data remains subject to the additional limits in the Privacy Policy and applicable Google terms. A general instruction under this DPA does not override those limits.
3. Merchant responsibilities
The Merchant determines the lawful purpose and legal basis for its store processing, supplies appropriate notices, ensures lawful collection and transfer, limits unnecessary and sensitive data, maintains accurate instructions, appoints authorised users and responds to individuals as required. It must not ask MarginPatrol to conceal an unlawful operation behind the calculation service.
These responsibilities do not transfer MarginPatrol's own processor obligations to the Merchant or excuse a failure of agreed security, access control or assistance. The Merchant may inspect the processing description and obtain the information reasonably necessary to assess these arrangements before enabling the relevant data flow.
4. Personnel and confidentiality
MarginPatrol will ensure that each person authorised to process Merchant Personal Data has a contractual or statutory confidentiality duty and receives instructions appropriate to their role. Access will be limited to a legitimate need and removed when no longer authorised.
Support access is restricted to what is necessary for the request or another permitted purpose. Users are not asked to send credentials or unrestricted customer datasets. Human access to Google data requires the specific authority permitted by Google's policy, not merely a generic support-role assignment.
Confidentiality obligations continue after a person's access ends and after termination of the Agreement.
5. Security
MarginPatrol will implement appropriate technical and organisational measures under applicable law, taking account of risk, the nature of processing, implementation cost and available technology. Annex B sets contractual measures to be maintained, not a claim that an external certification or penetration-test report exists.
Measures may be updated without materially reducing the level of protection. A material reduction requires prior agreement or cessation of the affected processing. The Merchant will receive sufficient information to understand the measures, subject to protection of secrets and other customers' data.
MarginPatrol will assist the Merchant with its security obligations to the extent the information is available to MarginPatrol. It will not rely solely on a subprocessor's general marketing statement as evidence that the relevant controls apply to the deployed service.
6. Subprocessors
The Merchant gives general written authorisation only to the providers and processing functions identified in the adopted Subprocessors register, subject to the stated optional features. A preparation list marked unverified does not authorise an undisclosed data flow.
Before an ordinary material new subprocessor or material change begins handling affected Merchant Personal Data, MarginPatrol will update the register and provide the advance notice required by the applicable Agreement. The Merchant may object on reasonable data-protection grounds. MarginPatrol will consider the objection, provide relevant information and seek a reasonable alternative where practicable before the change takes effect.
Where no acceptable alternative is available, either party may end the affected feature or, if indispensable, the affected service without a termination penalty, with an appropriate pro-rata refund of prepaid unused service. An emergency change strictly necessary for security or legal compliance is notified as early as reasonably possible, with prompt explanation and the same substantive objection/remedy process; it is not a general exception from protection.
Each subprocessor must be bound in writing by data-protection obligations providing at least the protection required for its work under this DPA. MarginPatrol remains responsible to the Merchant for the subprocessor's performance of those obligations. A list of the provider's own vendors does not eliminate this responsibility.
A Merchant-directed third-party workspace or platform is not automatically classified as our subprocessor. Its role, contracts and the authorised disclosure must be assessed and recorded. Where it does process Merchant Personal Data on our behalf, the safeguards in this clause apply.
7. Individual requests
Taking account of the nature of processing, MarginPatrol will provide appropriate technical and organisational assistance for access, correction, deletion, restriction, portability, objection and other applicable rights. It will promptly forward a request concerning Merchant Personal Data to the Merchant or direct the requester to it, unless law requires another response.
MarginPatrol will not disclose another Merchant's records to a requester without verified authority. Assistance and existing privacy export/deletion mechanisms are not withheld merely because the paid plan has ended. Reasonable charges may be agreed for genuinely additional bespoke work, but not for required baseline assistance or correction of our own failure.
The parties will cooperate within the deadline applicable to the request. A platform acknowledgement is not completion of the underlying access or deletion instruction. Uninstall and Shopify privacy instructions must be handled under the applicable deletion schedule and platform requirements.
8. Personal-data breaches
MarginPatrol will notify the Merchant without undue delay after becoming aware of a personal-data breach affecting Merchant Personal Data. Notification is not postponed until a full investigation is complete or every detail is confirmed. A later ordinary support update is not a substitute for the initial breach notice.
The initial notice will include available information about the nature of the incident, affected data and individuals, approximate numbers where known, likely consequences, measures taken or proposed, and a contact for further information. Missing information will be supplied in phases without undue delay. MarginPatrol will preserve relevant evidence, investigate, contain and remediate within its control, and cooperate with the Merchant's notification duties.
Notification is not an admission of liability. The Merchant normally determines its own regulatory and individual notices; MarginPatrol will not notify individuals on its behalf unless instructed or legally required. Neither party may use this allocation to delay a mandatory notice.
9. DPIAs, consultation and records
Taking account of the processing and available information, MarginPatrol will reasonably assist the Merchant with data-protection impact assessments, prior consultation with a regulator, security assessment and demonstration of compliance. It will maintain records required of it as a processor and make relevant portions available as appropriate.
The Merchant provides sufficient context to identify the requested assistance. Each party remains responsible for assessments and decisions allocated to it by law.
10. Information and audits
MarginPatrol will make available the information necessary to demonstrate compliance and permit reasonable audits, including inspections, by the Merchant or a suitably independent auditor bound to confidentiality.
Routine reviews should first use relevant documentation and normally occur no more than once per year on at least 15 business days' notice during business hours. Those scheduling preferences do not restrict audits required by law, a regulator, a substantiated breach or a material compliance concern. No fixed frequency or notice period overrides an effective statutory audit right.
The audit must protect other customers' data, security secrets and service availability; access to relevant evidence cannot be replaced by a categorical refusal. The parties will cooperate on a proportionate method. Each bears its ordinary costs; the Merchant bears its appointed auditor's costs, while MarginPatrol bears reasonable remediation costs attributable to its breach. Additional charges require prior agreement and may not make mandatory scrutiny ineffective.
11. International transfers and government requests
MarginPatrol will not make a restricted transfer, including relevant remote access from a third country, without a lawful and applicable transfer route and required assessment. The location of a database alone does not establish the absence of international access. A statement in the Privacy Policy that safeguards are used does not execute them.
Annex C records the route, parties, roles, actual locations, instrument and assessment. Where standard clauses are required, the current official unmodified text and all necessary annexes/tables must be completed and validly adopted before the transfer. These documents do not assert that EU SCCs apply to every importer or that a provider is certified under any adequacy framework.
A transfer instrument controls over conflicting terms, including governing law, jurisdiction and beneficiary rights. MarginPatrol will disclose legal demands only as required, assess their validity, challenge them where there are reasonable grounds, and notify the Merchant unless legally prohibited. It will not provide voluntary unrestricted government access. It will document the response and disclose no more than necessary.
If the required protection cannot be maintained, the affected transfer must be suspended and a lawful alternative, return or deletion arranged. Routine operations will not be justified by generic consent or an exceptional derogation used as a permanent substitute for safeguards.
12. Return, archive and erasure
At the Merchant's choice, MarginPatrol will return available Merchant Personal Data in a commonly used machine-readable form and delete it, or delete it without return, at the end of the instructed processing, subject to a legal retention duty. Return/deletion support is not conditioned on upgrading an expired plan.
A cancelled paid subscription can be followed by a limited read-only archive when the Merchant has instructed that service under the Agreement. The archive remains processor activity under this DPA, not unrestricted independent retention. The Merchant can end it earlier. At archive expiry the deletion schedule applies without assuming a fresh instruction to retain indefinitely.
The Data Retention and Deletion Policy states the applicable deadlines for active copies, generated files and backups. A period needed to execute deletion is not permission to keep using data for analytics or new calculations. Where an applicable platform or legal deadline is shorter, it prevails. Deletion must cover relevant retained installation generations, not just the latest records if older personal data remain.
Where law specifically requires a retained category, MarginPatrol will identify the category, purpose, basis and duration to the extent permitted, isolate it, and restrict use to that duty. A broad desire to defend hypothetical claims is not a processor exception permitting indefinite retention of the Merchant's full dataset. Minimal controller records of our own billing, agreement or compliance obligations are addressed separately in the Privacy Policy.
Backups awaiting scheduled deletion must be protected from ordinary use. Deleted records must not reappear through restoration; deletion instructions must be reapplied before normal operation. MarginPatrol will provide an appropriate completion confirmation, identifying any lawful retained categories or backup expiry still pending rather than calling an incomplete operation complete.
13. US service-provider provisions, where applicable
If a Merchant is a business subject to a US state law requiring processor, service-provider or contractor terms, MarginPatrol processes the relevant data only for the specified business purposes of this DPA. It will not sell or share that data, retain/use/disclose it outside those purposes or outside the direct business relationship except as the applicable law permits, or combine it with other customers' or independently collected personal information except for a legally permitted purpose.
MarginPatrol will provide the required level of protection, cooperate with applicable consumer requests and assessments, notify the Merchant if it can no longer meet the obligations, and allow reasonable steps to verify compliance and stop/remediate unauthorised use. It will bind permitted subprocessors to corresponding obligations. Nothing here asserts that a Merchant or MarginPatrol meets a statutory threshold solely by using the Service; any required jurisdiction-specific additions must be adopted before affected processing.
14. Liability, conflicts and end of term
The Terms' lawful liability provisions apply, subject to their express data-protection carve-outs. No inter-party limitation reduces a data subject's rights under law or a valid transfer instrument, or prevents a regulator from exercising powers. This DPA controls a conflict about Merchant Personal Data.
Provisions necessary to protect retained data, respond to incidents, return/delete and demonstrate compliance survive for the relevant period. Changes to this DPA follow the Agreement's notice and valid-amendment process; publishing a less protective page does not silently replace the accepted version.
Annex A — Processing specification
Exporter/customer identity: the Merchant legal name, address, authorised signatory/contact and store(s) identified in the acceptance record or signed order. Importer/processor: the operator identified in the Legal Notice; address and contact are published there. Frequency: continuous or periodic while enabled, and occasional support/rights handling. Duration: setup and active service; the expressly instructed archive; then bounded return/deletion.
Subject and purposes: daily operating-profit calculation, source coverage, Data Quality, configured alerts, record review, permitted reports/exports, authorised notifications, restoration of relevant historical source records, support and security necessary to that service. No advertising targeting, unrelated profiling or general-purpose model training.
Operations: authorised collection/access, transmission, structuring, storage, retrieval, calculation, display to authorised users, source reconciliation, generation/delivery of requested outputs, correction, export, restricted archive, de-identification where effective, and deletion.
| Individuals | Relevant data |
|---|---|
| Merchant owners, staff and people authorised to act for the Merchant, to the extent processed on the Merchant's behalf | User/store identifiers, roles, permissions, invitations and configured delivery destinations; separate operator administration remains controller activity |
| Store customers and recipients represented in relevant records | Order/line identifiers, event dates, purchased items, quantities, monetary components, shipping-method/country/region data and refunds; unnecessary contact and exact-address fields are not required for the calculation |
| Advertising-account users or persons identifiable through business metadata | Account/campaign identifiers and names, permissions, dated spend and source status, only within authorised integration scope |
| Support or privacy-request participants | Minimum identifiers, evidence and relevant record references necessary to act on the Merchant's instruction |
Special categories: not requested or authorised as a normal feature. Product/free-text content can incidentally reveal sensitive information; the Merchant must minimise it and promptly notify MarginPatrol if unexpected data requires restricted handling. No intentional biometric templates, criminal-record processing or customer credit scoring is in scope. If such processing becomes necessary, a separate assessment and written amendment are required first.
Annex B — Required technical and organisational measures
These measures describe the controls verified for the reviewed release and the contractual standard for the Service. They are not a claim of a certification that is not expressly identified.
| Area | Required protection |
|---|---|
| Identity and access | Store/role-based checks, least privilege, prompt removal of revoked permissions, restricted administrative access, appropriate strong authentication for privileged access |
| Transmission and stored secrets | Encrypted transport; protection of stored personal data proportionate to risk; encrypted integration credentials with restricted key access; no credentials in public analytics or support output |
| Isolation and integrity | Separation of store contexts, authorisation on reads/exports/deep links, integrity controls for financial inputs and versioned published-result context |
| Devices and notification delivery | Store-level revocation of sessions/refresh/push permissions; financial amounts hidden in push by default; no promise of remote erasure of an offline screenshot |
| Logging and minimisation | Security-relevant logging with bounded retention, restriction/redaction of tokens and unnecessary payloads; limited product events without buyer content or raw financial amounts |
| Resilience and recovery | Protected backups with verified expiry, documented recovery/deletion restoration controls and reasonable ability to restore availability following an incident |
| Incident response | A reporting contact, assessment and escalation procedures, preservation of necessary evidence, timely Merchant notice and coordinated remediation |
| Lifecycle and suppliers | Controlled changes, review of relevant protections, contracted and assessed subprocessors, bounded deletion/return and documented legal holds |
| Verification | Periodic review and appropriate testing of effectiveness, with evidence available under clause 10; no invented audit frequency or certification |
Annex C — International transfer terms
Where Merchant Personal Data is subject to restricted-transfer rules, the parties will use the transfer mechanism required by the applicable law for the actual exporter, importer, roles and destination. This may include the official EU Standard Contractual Clauses, the current approved UK Addendum or IDTA, an applicable adequacy decision, or another legally valid mechanism.
The relevant record identifies the parties and roles, countries of storage and remote access, categories and frequency from Annex A, technical and organisational measures from Annex B, the adopted instrument, applicable authority and forum, transfer assessment, supplementary measures and onward providers. MarginPatrol does not claim that a provider's public template or certification has been adopted unless it applies to the actual service and account.
The current providers and service locations are listed in the Subprocessors register. If no valid route covers a restricted transfer, the affected data flow will not begin or will be suspended until a valid route is established.
Annex D — Electronic adoption record
For an online adoption, the authenticated MarginPatrol record identifies the Merchant organisation, accepting owner, relevant billing store, Terms revision and hash, DPA revision and hash, combined legal-bundle identifier and hash, acceptance time and acceptance method. The accepting owner must separately confirm that the Terms and this DPA have been read and that the owner is authorised to bind the Merchant.
Merchant identity, address, stores and enabled integrations are taken from the authenticated Shopify organisation and store context at the time of acceptance. A separately signed order may supplement or replace that electronic record where agreed. Installation, invitation acceptance, use of the app and Shopify billing approval are not assigned retroactively as acceptance of this DPA.
Provider: the operator identified in the Legal Notice, trading as MarginPatrol. The corresponding provider version is the version identified by the published bundle and its recorded hashes.