Data Processing Addendum (DPA)

Last updated May 16th, 2018

This Data Processing Addendum ("Addendum") amends the Shopify App Store Terms of Service (the "Agreement") by and between you, Shopify, Inc ("Shopify"), and Little Stream Software LLC ("Us", "We").

If there are conflicts between this Addendum, the Shopify App Store Terms of Service, Shopify Terms of Service, or the Shopify Privacy Policy, the terms of this Addendum shall prevail.

"Data Protection Legislation" means European Directives 95/46/EC and 2002/58/EC, and any legislation and/or regulation implementing or made pursuant to them, or which amends or replaces any of them (including the General Data Protection Regulation, Regulation (EU) 2016/679);

"Data Processor", "Data Subject", "Processor", "Processing", "Subprocessor", and "Supervisory Authority" shall be interpreted in accordance with applicable Data Protection Legislation.

"Personal Data" as used in this Addendum means information relating to an identifiable or identified Data Subject who uses your Shopify store, which Shopify processes as a Data Processor or Data Controller in the course of providing you with the services.

"Service" as used in this Addendum means the Third-Party App that we are licensing for your use.

All other capitalized terms in this Addendum shall have the same definition as in the Agreement.

We process Personal Data from Shopify or from you, only for the purpose of providing the Service in accordance with the documented instructions from you or Shopify. If We are required by law to process the personal data for any other purpose, We will provide you with notice of this requirement.

We will notify you promptly, to the extent permitted by law, when We receive an inquiry from a Data Subject or Supervisory Authority relating to our processing of the Personal Data.

We implement and maintain appropriate technical and organization measures to protect the Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, theft, alteration, or disclosure.

We will notify you promptly upon becoming aware of and confirming any accidental, unauthorized, or unlawful processing, disclosure, or access to the Personal Data.

We have appointed a Data Protection Officer who is disclosed on our privacy policy at

Upon termination of this Agreement, we will delete or anonymize the Personal Data not needed for legal obligations within 90 days from the termination date. Upon termination of this Agreement, you may contact the Data Protection Officer and request an earlier data deletion/anonymization.

You acknowledge that We may use Subprocessors to process the Personal Data. Any Subprocessor must be in compliance with Data Protection Legislation and must be governed by a contract between Us and the Subprocessor.

We may revise this Agreement at any time without notice by posting an updated version to Your continued use of the Services you are agreeing to be bound by the then current version of this Agreement. If you do not agree to the changes, do not continue to use the Services.

Any claim relating to this Agreement shall be governed by the laws of the State of Oregon without regard to its conflict of law provisions.