Data Processing Addendum

Green13 Product Personalizer — a Shopify app by Green13 srl. Version 1.3, 22 October 2026.

This Data Processing Addendum ("DPA") applies to every merchant who installs Green13 Product Personalizer. It sets out how Green13 srl processes the personal data of the merchant's customers on the merchant's behalf, as required by Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"). The app never reads customers' names, email addresses, postal addresses or phone numbers.

1. Parties and roles

Controller: the merchant who installs the app on their Shopify store (the "Merchant"). The Merchant decides why customer data is processed: to let customers personalize products in the Merchant's online store and to produce the personalized products they order.
Processor: Green13 srl, Via della Resistenza 129/c, 20090 Buccinasco (MI), Italy, VAT IT14697160969, REA MI 2801512 ("Green13", "we"), which provides the app (the "App") and processes personal data only on the Merchant's behalf. Contact: info@green13.agency.

This DPA takes effect when the Merchant installs the App and forms part of the terms under which the Merchant uses it. Our Privacy Policy describes the same processing in plain terms; if the two differ on how personal data is processed, this DPA prevails.

2. Subject matter and duration

The subject matter is the provision of the App: a personalizer on the product pages of the Merchant's online store, where customers enter texts and choices, upload photos and files when the Merchant offers it, and see a live preview of the product; the preview images and the production files of each personalized order, saved with the uploaded files in the Merchant's Shopify Files; and a panel inside the Merchant's Shopify admin where the Merchant sets up fonts, colors, images and templates. The processing lasts for as long as the App is installed, and ends with the deletion described in section 11.

3. Nature and purpose of the processing

Green13 receives, stores, draws, displays and erases personal data, only to:

receive the photos and files a customer uploads, check them, save images again without their metadata, and keep them for the design;
save the design a customer makes when adding a personalized product to the cart, after checking it again on the server against the Merchant's settings, and recalculate any extra price for the personalization;
draw the preview images of each view of the design on the App's server and link them, with any uploaded file, in the cart line; when the Merchant turns on the print file option, also link the print image of each view, drawn on request and kept like the previews;
when the order is placed, make the production files of each view and save them, with the uploaded files, in the Merchant's Shopify Files, and show them to the Merchant on the order page;
when an order line has no design because the customer paid with an express payment button that skips the cart (for example PayPal), rebuild the design from the values in the line's properties;
when the Merchant personalizes an item of a draft order from the App, save the design the Merchant's staff fills in and write it, with its extra price, on the draft order's lines;
count the personalized orders of each billing cycle for the Merchant's plan and show the Merchant any problem with an order (for example a missing extra price);
delete the data as described in sections 9 and 11.

Personal data is never used for marketing, profiling, analytics or advertising, and is never sold. The App does not use artificial intelligence: images are drawn by the App's own code, and photos are never analysed to recognise people.

4. Categories of data subjects and personal data

Data subjects	The Merchant's customers who personalize a product in the Merchant's store, and any person whose name or image a customer enters in a personalization.
Personalization	The texts a customer writes (which may include names) and the font, color, options and values (such as a date or a number) they choose.
Uploaded photos and files	When the Merchant offers upload: photos and other images, saved again by the App without location and other metadata (EXIF, XMP, IPTC, color profiles) and at most 4,000 pixels per side; TIFF files, saved again the same way; PDF, EPS, PSD and ZIP files, kept exactly as uploaded, including any metadata they contain. The original file name is never received.
Previews and production files	Images and vector files drawn from the personalization: previews on the App's server; production files in the Merchant's Shopify Files, with a copy on the App's server for 30 days.
Order references	The ID, number and date of the order and, for each order line, its ID, product, variant, quantity, title and properties, for personalized orders only. No customer field of the order is read.
Draft order references	Only for draft orders the Merchant personalizes from the App: the ID, name and status of the draft order and, for each line, its ID, product, variant, quantity, title, price, discount and properties. The values are entered by the Merchant's staff; no customer field of the draft order (customer, email address, addresses, phone number, note) is read.
Store language	The language of the store the customer was using.

The App does not process names, email addresses, postal addresses, phone numbers or payment details of customers, and does not ask for special categories of personal data. A customer can write any text or upload any image in a personalization: the App treats it like any other personalization.

5. Green13's obligations

Instructions. We process personal data only on the Merchant's documented instructions: this DPA, and the settings and actions the Merchant takes in the App. If we believe an instruction breaks the GDPR or other EU or Member State data protection law, we will tell the Merchant.
Confidentiality. Access to production data is limited to the people at Green13 who need it to run the App — today one person — who are committed to confidentiality. We access it only when needed to operate the App or fix a problem.
No other use. We do not process the data for our own purposes and do not disclose it to anyone except as described in this DPA.

6. Security measures

These are the technical and organisational measures in place (Article 32 GDPR):

Encryption in transit: the App is served only over HTTPS (HTTP is redirected to HTTPS); calls to Shopify use HTTPS; webhooks and storefront requests from Shopify are verified with HMAC signatures.
Server-side drawing: the App never uses a preview or a price sent by the browser: it draws every preview and production file itself, from the Merchant's settings, the values entered and the uploaded photos, and recalculates every extra price.
Uploads: each upload needs a single-use permission signed with HMAC and valid for 10 minutes, which the Merchant's storefront asks for through Shopify; it has a size limit (20 MB at most) and is recognised from its content, never from its name; images are decoded and saved again by the App, and files that are not images are only ever served as downloads.
Preview and file links: each preview and each uploaded file is reachable only through a link with a random identifier of 192 bits, which cannot be guessed or listed.
Encryption at rest: the personalization values of every design are encrypted in the database with AES-256-GCM, each value bound to its own record, and previews, uploaded photos and files and the App's copies of production files are encrypted on the server's disk the same way; they are decrypted only in memory, to draw an image or to serve a link. The key is kept in the production environment, apart from the database, the data folder and the backups; a copy for recovery is kept offline by Green13.
Encrypted backups: nightly database backups are encrypted with GPG public-key encryption before being stored; the private key that can read them is kept only on the Green13 team's own server, not on the production server. Preview images, uploaded photos and files and production file copies are not in the backups.
Restricted access: the production server accepts SSH logins with a personal key only (password login and root login disabled), by one person; its firewall allows only SSH, HTTP and HTTPS, and security updates are installed automatically. There is no internal admin panel: the data is shown only to the Merchant inside their Shopify admin.
Access log: Green13 opens a production database only through a procedure that first records the date, the person, the app and the reason in an access log, and then opens the database read-only.
Isolation: every database query and every file on disk is limited to the Merchant's own store. Development and tests use separate databases and a development store.
Minimisation: the App requests no customer field from Shopify (name, email address, address, phone number) and a design is not linked to a customer; the original names of uploaded files are never received; IP addresses are used only in memory, to limit abuse, and are not stored; the App's access log records no IP address and no link identifier.
Hosting in the EU: the production server is hosted in Italy.

7. Sub-processors

Aruba S.p.A., Italy	Hosting of the App's production server, its database and its files (virtual server in a data centre in Italy).

Green13 uses no other provider: no content delivery network, analytics, email or tracking service. Shopify is not our sub-processor: it is the Merchant's own commerce platform. The App exchanges data with Shopify only through Shopify's APIs and through the requests Shopify forwards from the Merchant's storefront, on the Merchant's behalf, to read products and orders and to save the production files and uploaded files in the Merchant's own Shopify Files, which are part of the Merchant's store.

If the Merchant turns on the print file option and connects a print-on-demand app, each order line also carries a link to the print image of the design. That app downloads the print file through the link in the order line, under the Merchant's own agreement with it: it is chosen and instructed by the Merchant and is not our sub-processor.

The Merchant authorises the sub-processor listed above. Before adding or replacing a sub-processor we will announce it on this page at least 30 days in advance; a Merchant who objects can stop using the App by uninstalling it, which triggers the deletion in section 11. Any sub-processor is bound by data protection obligations equivalent to those in this DPA.

8. Data subjects' requests

Customers exercise their rights with the Merchant. The App helps the Merchant answer them through Shopify's mandatory privacy webhooks:

customers/data_request: the App compiles every design it holds for the orders Shopify lists in the request, with the list of the files uploaded for them, and we will provide the compiled records to the Merchant on request.
customers/redact: the designs of the orders Shopify lists in the request are deleted, with their previews, uploaded photos and files and the App's file copies, as soon as Shopify forwards the request. Orders and Shopify Files in the Merchant's store, including the production files and uploaded files saved there, are the Merchant's and are handled by the Merchant and by Shopify.
shop/redact: all of the store's data is deleted (see section 11).

If a customer contacts us directly, we will forward the request to the Merchant without responding to it ourselves. We also give the Merchant the information we have to help with data protection impact assessments and consultations with supervisory authorities.

9. Retention

Uploaded photos and files that are never added to a cart are deleted 24 hours after the upload.
Designs of carts that never become an order are deleted, with their previews and uploaded photos and files, 30 days after they were saved.
Designs of draft orders that never become an order are deleted, with their previews and uploaded photos and files, 90 days after they were saved.
The App's copies of production files, previews and uploaded photos and files of an order are deleted 30 days after the files are saved in the Merchant's Shopify Files; if they cannot be saved there, the copies are kept with the design until they are.
Designs of orders are kept while the App is installed, so that the production files can be made again, until the customer's erasure (section 8) or the deletion in section 11.
Fonts, colors, images, templates and settings are kept while the App is installed, until the Merchant deletes them or until the deletion in section 11.
Encrypted backups roll over: 14 days on the production server and 90 days for the copy kept by Green13, so deleted data disappears from backups within 90 days at most.

10. Personal data breaches

If we become aware of a personal data breach affecting the Merchant's data, we will notify the Merchant without undue delay and in any case within 72 hours of becoming aware of it, with what is known at that time: the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, and the measures taken or proposed. We will add information as it becomes available and help the Merchant meet their own obligations to notify the supervisory authority and the people concerned.

11. Deletion at the end of the processing

When the Merchant uninstalls the App, the personalizer disappears from the store immediately and the authentication session is deleted. Shopify then sends the shop/redact request 48 hours after the uninstall, and the App deletes all of that store's data as soon as it arrives: designs, previews, uploaded photos and files, file copies, order counts, fonts, colors, images, templates, product assignments and settings. Data in the encrypted backups disappears as they roll over (section 9). We keep no copy of the Merchant's data after that. Files in the Merchant's Shopify Files and orders in the Merchant's Shopify store remain the Merchant's and are not touched.

12. Audits and information

On written request to info@green13.agency, we make available the information needed to demonstrate compliance with Article 28 GDPR: a description of the processing and of the security measures, and answers to reasonable security questionnaires. Any further audit or inspection is agreed in writing in advance, with reasonable notice and without access to other merchants' data.

13. International transfers

Green13 does not transfer the Merchant's personal data outside the European Union. The production server, its files and its backups, including the off-site copy, are in Italy. Data that the Merchant's store holds on Shopify, Shopify Files included, is governed by the Merchant's own agreement with Shopify.

14. Changes

If the processing changes (new data, a new sub-processor, a different retention period), this page will be updated before the change is released, with a new version number and date.

Version history

1.3 — 22 October 2026: encryption at rest of personalization values, previews, uploaded photos and files and production file copies; print-on-demand apps connected by the Merchant download the print file through the link in the order line.
1.2 — 22 October 2026: draft orders personalized by the Merchant (draft order references, no customer field, designs kept 90 days); designs rebuilt from orders paid with an express payment button.
1.1 — 22 October 2026: photos and files uploaded by customers (categories, metadata, upload security, links, retention of 24 hours and 30 days, copies in Shopify Files); previews of orders; order references; plan counted on the billing cycle; no artificial intelligence.
1.0 — 15 October 2026: first version.