Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between you (“Merchant,” “Controller”) and CouponMesh (“CouponMesh,” “Processor”) under which CouponMesh provides the services described at couponmesh.com. It governs CouponMesh's processing of personal data on the Merchant's behalf and applies whenever the Merchant connects a store to the CouponMesh platform.

1. Definitions

• Personal Data has the meaning given in GDPR Article 4(1) and equivalent CCPA / state-law definitions.
• Controller, Processor, Subprocessor, Data Subject, Processing bear the meanings given in GDPR Article 4.
• Merchant Data means Personal Data submitted to CouponMesh by, or on behalf of, the Merchant, including data received from the Merchant's connected store.
• Services means the CouponMesh platform as described at couponmesh.com.
• Standard Contractual Clauses or SCCs means the European Commission's standard contractual clauses for the transfer of personal data to third countries adopted under Decision (EU) 2021/914.

2. Roles and scope

The Merchant is the Controller and CouponMesh is the Processor with respect to Merchant Data. The subject matter, duration, nature, and purpose of the processing are set out in the Privacy Policy and the Services description.

CouponMesh will process Merchant Data only:

• on documented instructions from the Merchant, which are deemed to include the Services as configured by the Merchant;
• to comply with applicable law (in which case CouponMesh will notify the Merchant first, unless prohibited from doing so);
• for the categories of data, categories of data subjects, and purposes set out in the Privacy Policy.

3. Categories of data and data subjects

The specific data CouponMesh processes from a connected store and the limited end-customer fields involved are described in the Privacy Policy and summarised here:

• Store identity: shop domain, store ID, store name
• OAuth access tokens (encrypted at application level)
• Order metadata: order ID, order total, currency, applied discount codes, order timestamp
• App lifecycle events: install and uninstall

CouponMesh does not request, store, or process customer names, email addresses, phone numbers, billing or shipping addresses, payment details, browsing data, or any other end-customer identifying field.

4. Confidentiality

CouponMesh will ensure that personnel authorised to process Merchant Data are bound by appropriate confidentiality obligations and have received privacy-and-security training relevant to their role.

5. Security measures

CouponMesh implements and maintains technical and organisational measures designed to protect Merchant Data, including:

• Encryption in transit using TLS 1.2 or newer.
• Encryption at rest: managed database encryption plus application-level AES-256-GCM encryption for OAuth tokens with keys stored separately from the data.
• Role-based access controls with least-privilege defaults.
• Strong password requirements and multi-factor authentication for staff accounts.
• Logging of access to systems containing Personal Data.
• Regular backups with encryption and tested point-in-time recovery.
• A documented security incident response policy with 72-hour breach notification commitments.
• Separation of test, staging, and production environments and data.

6. Subprocessors

The Merchant authorises CouponMesh to engage the subprocessors listed at couponmesh.com/subprocessors. CouponMesh will:

• Impose data protection obligations no less protective than those in this DPA on each subprocessor;
• Remain liable for the acts and omissions of its subprocessors;
• Provide the Merchant with at least 30 days' notice before engaging a new subprocessor.

The Merchant may object to a new subprocessor on reasonable grounds related to data protection by writing to privacy@couponmesh.com within the notice period. The parties will work in good faith to resolve the objection; if unresolved, the Merchant may terminate the affected portion of the Services.

7. Data subject requests

Taking into account the nature of the processing, CouponMesh will assist the Merchant by appropriate technical and organisational measures, insofar as possible, in fulfilling the Merchant's obligations to respond to requests from Data Subjects to exercise their rights. Specifically:

• CouponMesh honors Shopify's mandatory compliance webhooks (customers/data_request, customers/redact, shop/redact) and responds within 30 days.
• For other valid requests forwarded by the Merchant to privacy@couponmesh.com, CouponMesh will provide the requested action (access, correction, deletion, portability) within 30 days unless additional time is permitted by law.

8. Personal data breach notification

CouponMesh will notify the Merchant without undue delay, and in any event within 72 hours of becoming aware, of any Personal Data Breach affecting Merchant Data. The notification will include, to the extent known at the time:

• A description of the nature of the breach including, where possible, the categories and approximate number of Data Subjects and records affected;
• The likely consequences;
• The measures taken or proposed to address the breach and mitigate its possible adverse effects.

CouponMesh's full incident response procedure is documented in its internal Security Incident Response Policy, available on request.

9. International data transfers

Where Merchant Data is transferred outside the European Economic Area or the United Kingdom, CouponMesh will ensure an appropriate transfer mechanism is in place, such as the Standard Contractual Clauses, the UK International Data Transfer Addendum, or reliance on an adequacy decision. The Merchant authorises such transfers as necessary to provide the Services.

10. Audit rights

CouponMesh will make available to the Merchant all information reasonably necessary to demonstrate compliance with this DPA. Once per calendar year, on at least 30 days' written notice, the Merchant may request, at its own expense, an audit of CouponMesh's processing of Merchant Data, subject to reasonable confidentiality and scope limitations. The parties will agree on the auditor and audit scope in advance. CouponMesh may satisfy audit requests by providing copies of independent third-party audit reports (such as SOC 2 or ISO 27001) where available.

11. Return and deletion of data

On termination of the Services or at the Merchant's written request, CouponMesh will, at the Merchant's choice, delete or return all Merchant Data within 30 days, except where retention is required by applicable law. Backups containing Merchant Data are deleted in the normal course of the backup rotation cycle (within 30 days).

Uninstalling the CouponMesh app from a connected store automatically triggers deletion of associated access tokens within 24 hours and full deletion of associated Merchant Data within 30 days, in accordance with Shopify's shop/redact compliance webhook.

12. Liability

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the agreement between the Merchant and CouponMesh that incorporates this DPA. Nothing in this DPA limits a party's liability for breaches of data protection law to Data Subjects to the extent that such liability cannot be limited by law.

13. Governing law

This DPA is governed by the laws of the State of Delaware, United States, except where mandatory local law applies. The parties agree that the courts of Delaware have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this DPA.

14. Order of precedence

In the event of a conflict between this DPA and any other agreement between the parties, the terms of this DPA prevail with respect to the processing of Personal Data. Otherwise, the other agreement prevails.

15. Updates to this DPA

CouponMesh may update this DPA from time to time. Material changes will be notified to the Merchant at least 30 days before they take effect, by email to the contact address on the Merchant's CouponMesh account. The Merchant's continued use of the Services after the effective date constitutes acceptance of the updated DPA.

Contact

For questions about this DPA: legal@couponmesh.com
For privacy and data subject requests: privacy@couponmesh.com
For security incidents: security@couponmesh.com

See also our Privacy Policy and list of Subprocessors.