Data Processing Addendum (DPA)
Last updated: March 15, 2026
This Data Processing Addendum forms part of the Terms of Service.
1. Roles
Merchant: Data Controller
SkillQuest: Data Processor
2. Categories of Personal Data
The Service may process:
- email addresses submitted by store visitors
- browser and device information
- widget interaction data
- analytics data
3. Purpose of Processing
Data is processed only to:
- operate the widget
- provide analytics
- transmit email addresses to the merchant or configured marketing platforms
- maintain and improve the Service
4. Subprocessors
Subprocessors may include:
- Shopify
- Google Cloud Platform (Firestore, BigQuery)
- Klaviyo (if configured by merchant)
- Mailchimp (if configured by merchant)
A current list is maintained at Subprocessors.
All subprocessors are required to maintain appropriate safeguards.
5. Security Measures
Security measures include:
- HTTPS encryption
- access control
- secure infrastructure
- encrypted credential storage
6. Data Subject Requests
If SkillQuest receives a data subject request, we will direct the request to the merchant acting as data controller.
7. Data Deletion
Upon app uninstallation, session data is deleted immediately. All remaining merchant data is deleted when Shopify issues the shop data erasure request, typically within 48 hours.
8. International Transfers
Personal data may be transferred outside the EEA when necessary to operate the Service.
Appropriate safeguards are implemented when required.