Data Processing Addendum

Draft for counsel review. This technical draft is not approved and not effective. It does not amend any agreement until legal counsel approves it and Docket publishes an effective version.

Parties and roles

This Data Processing Addendum applies between the Shopify merchant accepting Docket's Terms and Tactic Consulting Services LLC. The merchant is the controller or business for personal data it provides through Shopify. Docket is the processor or service provider acting on the merchant's behalf, except where law assigns a different role for a specific activity.

Scope, duration, and instructions

Processing covers installation, authentication, subscription verification, and generation, storage, retrieval, delivery, export, support, security, and deletion of invoices, packing slips, credit notes, and quotes. Processing lasts while Docket remains installed and for the limited retention and deletion periods in the Privacy Policy. The Terms, merchant settings, Shopify actions, and written merchant requests are documented instructions. Docket will notify the merchant if an instruction appears unlawful unless law prohibits notice.

Data and people

Data can include merchant account and configuration data; Shopify order, draft order, refund, fulfillment, and subscription data; customer name, billing and shipping addresses, and email; selected tax information; generated documents and immutable snapshots; and deliberately submitted support text. Data subjects can include merchants, merchant personnel, customers, order recipients, and support contacts.

Purpose limitation and confidentiality

Docket processes personal data only for the documented instructions and service purposes above, applicable law, and protection of the service. People authorized to process personal data are bound by confidentiality and receive access only for their role. Docket does not sell personal data, share it for cross-context behavioral advertising, or use it for significant automated decisions.

Security measures

Docket maintains data minimization, authenticated access, least privilege, strong credentials, encrypted transport and provider-managed encryption at rest, pseudonymous access logging, environment separation, protected export controls, retention enforcement, deletion-final generation fencing, and R2-authoritative reconciliation. Protected customer data does not enter language-model prompts or tool results. Security measures are reviewed at least annually and after a material change.

Subprocessors

The merchant gives general authorization for subprocessors needed to operate Docket. Current providers are Shopify for the commerce and app platform, Cloudflare for infrastructure and model processing or gateway services, and Anthropic only for explicitly requested authenticated-support escalation. Docket remains responsible for applicable subprocessor obligations and will maintain a current register and give notice of a material change as required by the effective agreement or applicable law.

International transfers

Personal data can be processed in the United States and other countries. Where an international transfer requires a safeguard, the parties and relevant subprocessors will use an applicable lawful transfer mechanism and supplementary measures appropriate to the risk.

Data subject rights and assistance

Taking into account the nature of processing, Docket will reasonably assist the merchant with data subject rights requests, security assessments, breach obligations, and required privacy impact work. Docket routes Shopify privacy requests through verified merchant delivery and will not respond as controller for the merchant's underlying Shopify records.

Deletion or return

During installation, a merchant can request a private archive export. On uninstall or Shopify shop redaction, Docket deletes shop data and invalidates former links. Customer redaction deletes the matching customer's Docket records. At termination, Docket deletes or returns personal data as described in the Privacy Policy unless applicable law requires a documented exception. Current object storage remains authoritative after deletion; separately authorized recovery cannot recreate a missing object and may only remove stale database pointers.

Audit

Docket will provide information reasonably necessary to demonstrate compliance and permit an audit required by applicable law or the effective agreement. Audits require reasonable notice, confidentiality, scope proportionate to risk, and safeguards for other merchants, security, and privileged information. Available independent evidence should be used before an intrusive audit.

Security incident

Docket will notify the merchant without undue delay after confirming a personal-data breach affecting merchant data and will provide available information needed for the merchant's obligations. Docket reports an actual or suspected merchant-data breach to Shopify immediately and no later than 24 hours after awareness. Notice is not an admission of fault.

Termination and priority

This addendum terminates when Docket has completed required processing and deletion or return, except obligations that must survive. Once effective, it controls over conflicting Terms only for its subject matter. Questions about the draft can be sent to support@docketpdf.com.