Data Processing Terms
Last updated: 12 October 2026
These Data Processing Terms (“DPA”) are part of the Terms of Service between you, the merchant, and Peter Coolen Creative Developer (“we”, “us”). They apply when we process personal data on your behalf through Cool& - Post Purchase Survey (“the App”), and they meet the requirements of Article 28 of the EU and UK GDPR. If these terms and the Terms of Service conflict on personal data, these terms win.
1. Roles
For your customers’ survey responses, you are the controller and we are your processor. For your own account data, such as your shop domain and settings, we are the controller, as described in our Privacy Policy.
2. What we process
- Purpose: choosing which survey a customer sees, showing your surveys on the Thank You page, storing the answers, showing you the results, letting you export them and, if you turn them on, syncing answers to your Klaviyo account and sending them to your Shopify Flow workflows.
- People: your customers who see or answer a survey.
- Data: survey answers, order ID, order total and currency, whether it is the customer’s first order, Shopify customer ID, email address (when Shopify makes it available), country, language, market, timezone, and when the survey was shown and completed. To choose the survey only, without storing them: the products, collections and discount codes of the order, and the customer’s tags.
- Sensitive data: none intended. You agree not to ask for health data, payment details or other special categories of data.
- Duration: while the App is installed, plus up to 48 hours after you uninstall it.
3. Your instructions
We process the data only to provide the App, following your documented instructions: these terms, your settings in the App, and requests you send us in writing. We don’t sell the data or use it for advertising or our own purposes. If we think an instruction breaks the law, we’ll tell you. If the law requires us to process data in another way, we’ll tell you first, unless the law forbids it.
4. Confidentiality
Only people who need access to run and support the App can access the data, and they are bound by confidentiality.
5. Security
We protect the data with measures that fit the risk, including:
- Encryption in transit (HTTPS) for all traffic to and from the App.
- Encryption at rest of the database and its backups, and extra encryption of your Klaviyo private key.
- Data separated per shop, and checkout requests verified with Shopify session tokens.
- Two-factor authentication and unique passwords on every account with access to the data.
- Separate development and production data.
- Automated backups and a written incident response policy.
6. Subprocessors
You authorise us to use the subprocessors below. Each is bound by data protection terms at least as protective as these. We’ll tell you at least 30 days before adding or replacing one. If you object on reasonable data protection grounds and we can’t resolve it, you can stop using the App by uninstalling it.
| Subprocessor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting the App | United States / EU |
| Prisma Data, Inc. (Prisma Postgres) | Storing surveys and responses | United States (AWS us-east-1) |
| Resend, Inc. | Emailing the store owner, including the answers to a customer’s data request | United States |
Shopify runs the platform the App is built on. Klaviyo is not our subprocessor: when you connect it, we send answers to your own Klaviyo account under your agreement with Klaviyo.
7. Transfers outside the EEA and UK
Where data is transferred to a country without an adequacy decision, we rely on the EU–US Data Privacy Framework where the recipient is certified, or otherwise on the European Commission’s Standard Contractual Clauses and the UK Addendum.
8. Helping you
- Customer requests: when Shopify sends us a customer’s data request, we email you their survey responses. When it sends a deletion request, we delete their responses. You can also export or ask us to delete responses at any time.
- Compliance: we help you with data protection impact assessments and questions from supervisory authorities, as far as they concern the App.
9. Security incidents
If we become aware of a breach of your customers’ personal data, we’ll tell you without undue delay, and within 24 hours where possible. We’ll tell you what happened, what data and roughly how many people are affected, what we’ve done, and what you should do, and send updates as we learn more. This helps you meet your own 72-hour deadline.
10. Deletion
When you uninstall the App, Shopify asks us to delete your shop’s data 48 hours later, and we then delete all of it, including your customers’ responses. If you reinstall within those 48 hours, the data is kept. Backups are overwritten in the normal backup cycle. Export your responses before uninstalling if you want to keep them.
11. Audits
On request, we’ll give you the information you reasonably need to show that these terms are being met, such as a written description of our security measures. If that isn’t enough, or a supervisory authority requires it, you may audit us at your own cost, once a year, with 30 days’ notice.
12. Liability and law
The liability limits in the Terms of Service apply to these terms, as far as the law allows. These terms are governed by the laws of the Netherlands.
Contact
Questions about these terms, or want a signed copy? Email support@post-purchase-survey.com.