Data Processing Addendum
Last updated 14 Oct 2026 · InFrame Affiliates Ltd
This Data Processing Addendum ("DPA") forms part of the Master Subscription Agreement between InFrame Affiliates Ltd (company number 16332640, registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ) ("InFrame", the processor) and the brand using InFrame (the "brand", the controller). It applies automatically when a brand connects a Shopify store or runs a campaign that pays sales commissions, and meets the requirements of Article 28 of the UK GDPR.
1. Scope and roles
1.1 This DPA covers Shopper Data: personal data about the brand's customers that InFrame processes on the brand's behalf to attribute sales to creators and calculate commissions. Annex 1 describes it.
1.2 For Shopper Data, the brand is the controller and InFrame is the processor. For all other personal data (such as brand and creator account data), InFrame is a controller, as described in its Privacy Policy.
1.3 Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK GDPR. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and, where they apply to the brand, other data protection laws such as the EU GDPR.
2. InFrame's obligations
InFrame will:
(a) process Shopper Data only on the brand's documented instructions. The Master Subscription Agreement, this DPA and the brand's use of the Service are those instructions. If the law requires other processing, InFrame will tell the brand first unless the law prohibits it;
(b) tell the brand promptly if it believes an instruction breaks Data Protection Law;
(c) ensure that anyone authorised to process Shopper Data is bound by confidentiality;
(d) keep appropriate technical and organisational security measures in place (Annex 2);
(e) assist the brand, taking into account the nature of the processing, with responding to requests from data subjects, and with its obligations on security, breach notification, impact assessments and consultation with regulators;
(f) at the end of the service, delete or return Shopper Data at the brand's choice, except where the law requires InFrame to keep it (for example, as part of financial records of commissions paid);
(g) make available the information reasonably needed to demonstrate compliance with this DPA, and allow for and contribute to audits as set out in section 7.
3. The brand's obligations
The brand confirms that it has a lawful basis for the processing of Shopper Data described in this DPA, that it has given its customers the information the law requires (including in its own privacy policy), and that its instructions comply with Data Protection Law.
4. Sub-processors
4.1 The brand authorises InFrame to use sub-processors. The current list is in Annex 3.
4.2 InFrame will give at least 14 days' notice of a new sub-processor by email or in the Service. The brand may object on reasonable data protection grounds within that period. If InFrame cannot reasonably accommodate the objection, the brand may stop using the affected feature (for example, by disconnecting its store) without penalty.
4.3 InFrame imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible to the brand for each sub-processor's performance.
5. International transfers
Some sub-processors process data outside the UK (Annex 3). InFrame will transfer Shopper Data outside the UK only with a safeguard permitted by Data Protection Law: UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework for certified providers), or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.
6. Personal data breaches
InFrame will notify the brand without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Shopper Data. The notice will describe what happened, the data and people likely affected, the likely consequences, and the measures taken or proposed, and will give a contact for further information. Information may be provided in stages as it becomes available.
7. Audits
On reasonable written request, not more than once a year unless there has been a personal data breach or a regulator requires it, InFrame will provide written answers and documentation to demonstrate its compliance with this DPA. If that is not sufficient, the brand (or an independent auditor bound by confidentiality, who is not a competitor of InFrame) may carry out an audit on reasonable notice, at the brand's cost, at a time that minimises disruption.
8. Data subject requests
If InFrame receives a request from one of the brand's customers about Shopper Data, it will pass it to the brand without undue delay and will not respond itself, other than to say it has been passed on, unless the brand instructs otherwise. InFrame also responds to Shopify's mandatory privacy requests (customer data requests, customer redaction and shop redaction) received through the Shopify app.
9. Liability, duration and law
9.1 Each party's liability under this DPA is subject to the limits in the Master Subscription Agreement. Nothing limits a party's liability for fines imposed on it for its own breach of Data Protection Law, or any liability that cannot be limited by law.
9.2 This DPA lasts as long as InFrame processes Shopper Data for the brand. If this DPA and the Master Subscription Agreement conflict on data protection, this DPA applies.
9.3 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
Annex 1: Details of the processing
| Subject matter | Attributing the brand's online sales to creators' tracking links, and calculating, invoicing and paying commissions |
| Duration | While the brand's store is connected or commissions are outstanding, then as set out in section 2(f) |
| Nature of processing | Collection (through the Shopify app and tracking links), storage, matching, calculation, reporting to the brand, deletion |
| Data subjects | The brand's customers who reach its store through a creator's tracking link, or whose orders are processed for attribution |
| Personal data | Click data: date and time, IP address, browser user agent, referring page and tracking parameters. Order data: Shopify order ID and value, currency, payment status, refund status, Shopify customer ID and customer email address |
| Special category data | None |
| Disclosure | To the brand. Creators see only order counts and commission amounts, never customer details |
Annex 2: Security measures
- Encryption of all data in transit (HTTPS/TLS), and encryption at rest by our hosting providers
- Database access restricted by role, with row-level security separating each account's data
- Production access limited to authorised personnel, using strong authentication
- Shopify webhooks verified by HMAC signature before processing
- Secrets and API tokens held in managed secret stores, not in code
- Error monitoring and logging to detect and investigate incidents
- Backups maintained by our database provider
Annex 3: Sub-processors for Shopper Data
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database and storage | United Kingdom (London) |
| Vercel, Inc. | Application hosting and processing | United States |
| Google LLC (Google Cloud) | Processing Shopify order webhooks | United States |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Commission invoicing and payment | Ireland, United States |
| Shopify International Ltd. | Source of order data; billing for Shopify-installed brands | Ireland, Canada |