Data Processing Addendum

Orderly Rescue — Quarata Consulting LLC

This addendum forms part of the Terms of Service accepted by the merchant. It governs personal data we process on your behalf to provide Orderly Rescue. It continues until that processing and the required deletion or return are complete.

Quarata Consulting LLC is a Florida limited liability company at 7901 4th St N Ste 300, St. Petersburg, FL 33702, United States. Data-protection contact: info@orderlyrescue.com.

1. Roles and scope

You are the controller of your shoppers' data and we are your processor. If you act as a processor for another controller, you confirm authority to appoint us as a subprocessor; the corresponding transfer module below applies.

We separately determine the purposes of our necessary merchant account administration, billing, security, support and agreement records. The Privacy Policy describes those limited activities and their retention. This does not authorise independent advertising, AI training, sale of shopper data or cross-store shopper profiling.

Shopify acts under its own agreements with you; it is not our subprocessor.

"Applicable data-protection law" includes the EU GDPR, UK GDPR and Data Protection Act 2018, Swiss Federal Act on Data Protection, and applicable US state privacy laws. Terms such as controller, processor, personal data and breach have their meanings under the applicable law.

2. Your instructions and our commitments

Your instructions are this agreement, the service you enable, your settings and lawful written requests. We process data only on those instructions, including for transfers, unless legally required otherwise. We will notify you of a legal requirement before processing unless prohibited, and comply with the transfer clauses where they apply.

We will immediately inform you if we believe any instruction infringes applicable data-protection law, including an instruction made through settings, and may suspend the affected processing while it is resolved. A setting is not a declaration that its use is lawful.

We will keep authorised personnel under confidentiality duties, restrict their access, maintain the safeguards in Annex II and assist you with rights requests and obligations concerning security, breaches, impact assessments and prior consultation with regulators, taking account of the processing and information available to us.

You are responsible for lawful instructions, customer notices and required permissions. Choosing longer retention does not establish necessity. Disabling customer details does not make remaining event identifiers anonymous.

3. Subprocessors

You generally authorise the providers in Annex III. We impose written data-protection obligations appropriate to their processing and remain responsible for their performance as required by applicable law.

We post added or replacement subprocessors here and show an in-app notice at least 30 days before they process your data. You may object during that period on reasonable data-protection grounds by contacting us. We will work to resolve the concern. If we cannot, you may discontinue the affected service without a termination penalty before processing begins. We will refund prepaid fees for the unused affected service period, where applicable.

Publication or use before the notice period expires does not shorten it. We keep the list current and provide information reasonably needed to assess our subprocessors.

4. Customer rights and breaches

We assist with access, correction, deletion, restriction, objection and portability requests. Shopify compliance webhooks initiate supported requests. We provide the merchant an authenticated route to retrieve matching records; the merchant verifies identity and responds to the individual.

Matching uses supplied identifiers and associated checkout context. We do not disclose a browser's entire history on the assumption that only one person uses it. Mistyped identifiers, historical unlinked events and information not supplied by Shopify can require manual investigation. A zero automated match does not establish that no relevant data exists. We will assist with additional information reasonably available, without collecting unnecessary identification.

Erasure removes matched event records and their dependent notification records. Separately calculated daily totals may remain where they do not identify a person. Access logs (no field values) are kept 90 days.

If someone contacts us about your shopper data, we direct the request to you where identifiable and assist you; we do not prevent that person from contacting a regulator or exercising rights directly where law requires.

We notify you without undue delay after becoming aware of a personal data breach affecting data processed for you. We provide known details about its nature, affected records and people, likely consequences, contact point and response measures. Incomplete details can follow promptly in phases. We assist your notification assessment and response; you remain responsible for your own required notifications.

5. Information and audits

We provide information reasonably needed to demonstrate compliance. Start with a written request; available security documentation may satisfy it. You may also conduct or appoint an independent confidential audit.

Normally audits occur once per year on 30 days' notice, during business hours and without exposing other customers' data. Those limits do not obstruct a regulator, mandatory audit right, suspected material non-compliance or breach investigation; in those cases we agree appropriate timing without undue delay. You bear ordinary audit costs, and we bear reasonable remediation and audit costs attributable to our established material non-compliance. We do not represent that we hold a security certification.

6. Return, deletion and retention

Event retention follows the merchant's plan: Free 7, Starter 30, Growth 90 and Pro 365 days. You may choose a shorter window in Settings, never a longer one than the plan keeps. We remove expired events through daily cleanup. Until Shopify first confirms a store's plan, cleanup uses a 30-day window for the first 30 days after install and the Free window after that, unless you chose a window in Settings. Browsing (journey) events are kept for at most 30 days on every plan, or for the plan window if that is shorter; error and checkout events follow the plan window. When a plan change, or the first application of plan-based windows to an existing installation, gives the store a shorter window, we stop showing events outside the new window once the change takes effect and delete them 72 hours later, with an in-app notice that gives the date; an upgrade before then keeps them. Details a plan does not display are still collected under your settings and stored within the window, and they are included in a complete return, which you may request on every plan. Shopify's customer data request and erasure webhooks and its store erasure webhook are handled the same way on every plan. You may stop new collection separately, or delete captured events in Settings. Changing a detail setting does not erase existing records.

While installed, you may export the available CSV or request a complete machine-readable return from Settings on any plan; we send it within 30 days. On termination, we delete or, at your request, return covered data and delete existing copies unless legally required to retain them. Request a return before uninstalling so that data is available before deletion. We will assist with later requests to the extent data still exists.

Shopify ordinarily requests store erasure approximately 48 hours after uninstall. We process that request and remove sessions as well as dependent store records. If the app is reinstalled before that request arrives, the store's data stays with the reinstalled installation and is erased on Shopify's request after a later uninstall. Daily cleanup also removes installations inactive for seven days if the Shopify request has not completed. Failures require retry and investigation, rather than being acknowledged as successful deletion.

We retain our limited security records for 90 days and agreement evidence for six years from each record for the separate purposes described in the Privacy Policy, with daily expiry cleanup. These are not retained checkout histories.

If backups are enabled, deleted data may remain until the documented backup expiry, for no more than 90 days. Such copies are restricted to recovery and security, are not used for ordinary service, and deletion instructions must be reapplied before restoring data to service. We do not enable a backup arrangement without confirming encryption and expiry. Specific legal holds must be limited, documented and lifted when no longer needed.

Copies you export or send to your own recipients are under your control. We assist with deletion from our subprocessors as required; deleting our database does not retract emails from your inbox.

7. International transfers

We operate in the United States. Where required, the unmodified EU standard contractual clauses in Decision 2021/914 are incorporated by reference: Module Two for controller-to-processor transfers and Module Three when you act as a processor.

You are the exporter and we are the importer. Clause 7 is included; Clause 9 uses Option 2 with 30 days' prior notice; the optional independent dispute-resolution wording in Clause 11 is not selected. Clause 17 uses Irish law and Clause 18 the courts of Ireland. Annexes I–III below supply the processing and security particulars. Acceptance of this addendum constitutes the parties' signature and date; the exporter's legal identity and contact details are those in its Shopify account and agreement record, supplemented on request.

For UK restricted transfers, the ICO International Data Transfer Addendum, version B1.0, applies: Table 1 uses these parties and acceptance date, Table 2 the applicable SCC module and options above, Table 3 these annexes, and Table 4 permits either party to end the Addendum under its Section 19. Its mandatory clauses remain unchanged.

For Swiss transfers, the clauses protect natural persons under Swiss law; references to GDPR include the Swiss FADP as applicable, and the Swiss Federal Data Protection and Information Commissioner is competent for Swiss matters. These adaptations do not limit EU rights where GDPR also applies.

We assess transfers and maintain any necessary supplementary safeguards. Onward transfers require the safeguards applicable to that relationship, including processor-to-subprocessor terms where appropriate. A provider's Data Privacy Framework certification may support a transfer only within its verified scope. We do not claim certification for Quarata or rely on a provider's certification to cover the transfer to Quarata.

8. Applicable US state privacy laws

Where we act as your service provider or processor under applicable US state law, we process personal information only for the specific service purposes in Annex I. We will not sell or share it for cross-context behavioural advertising, retain/use/disclose it outside our direct business relationship or specified purposes, or combine it with other clients' or independently collected personal information except as the law permits.

We provide the legally required level of protection, notify you if we can no longer meet these obligations, assist with consumer requests and required assessments, and permit reasonable steps to verify, stop and remedy unauthorised processing. Our subcontractors must accept corresponding written obligations. Both parties understand and will comply with these restrictions.

9. Precedence and changes

The SCCs and UK Addendum take precedence, followed by this DPA on data-protection matters, then the Terms. Nothing limits their mandatory rights or liabilities, including between the parties. Otherwise the Terms' liability provisions and Florida governing law apply.

Material changes follow the Terms' change procedure (posted at least 30 days ahead with an in-app notice), cannot reduce protection retroactively and cannot modify the mandatory transfer clauses. Subprocessor changes follow section 3. Obligations continue while covered data is retained.

Annex I — Processing particulars

The competent EU authority is determined under SCC Clause 13: the exporter's establishment, its required EU representative's location, or an eligible member state where affected individuals are located when the applicable representative exception applies. The ICO is competent for UK matters. Representative requirements are assessed separately from this authority selection.

Annex II — Security measures

We use HTTPS for the application and pixel endpoint, encrypted database transport, and hosting-provider encryption at rest. Merchant webhooks require HTTPS, public destinations and signatures; delivery validates and pins the destination address and does not follow redirects.

Shopify authentication protects merchant access. Queries are scoped to the authenticated store. Inbound compliance webhooks are authenticated, and erasure operations are transactional and retryable. Collection has size and rate limits, and a repeated delivery of the same event identifier is dropped without storing it again. The pixel re-checks the visitor's analytics permission before every resend of a kept payload. Privacy permissions, selective detail suppression, restricted payloads and finite retention reduce exposure.

Protected-data access is recorded in a separate database audit record containing identifiers and field names rather than customer field values, with 90-day expiry. Agreement evidence is stored separately with six-year expiry. Production access is restricted to authorised operators under confidentiality duties; strong unique passwords and available multi-factor authentication are required.

We maintain incident-response and deletion procedures, test relevant changes and review provider safeguards. Backups require verified encryption and bounded expiry before activation. We will not materially reduce these safeguards during processing. We hold no independent security certification or contractual uptime guarantee. Supporting operational evidence is available on reasonable request.

Annex III — Subprocessors

Our providers' terms are the Railway DPA, Resend DPA and Sentry DPA. The relevant role and transfer module depend on the processing, including Module Three where we act as a processor. Sentry's DPA relies on its EU-U.S. Data Privacy Framework certification, with the UK Extension and the Swiss-U.S. Framework, for transfers from Europe, and incorporates the EU standard contractual clauses (Module Two or Three), the UK Addendum and the Swiss adaptations where the Framework does not apply. We maintain evidence of applicable terms and transfer safeguards. Provider copies are subject to their service retention and our deletion obligations.

Changes

Material changes follow section 9. New merchants accept the version presented at activation.