Data processing agreement
Effective date: 2 November 2026
This agreement sets out how MB Croppick, company code 308104331, registered office Krivių g. 5, LT-01204 Vilnius, Lithuania ("ReminderClerk", "we", "us") processes personal data on behalf of the merchant that installs ReminderClerk ("you"). It is the data processing agreement that Article 28 of the EU General Data Protection Regulation (GDPR) — and the UK GDPR, where that applies to you — requires between a controller and its processor. It forms part of the terms of service and should be read together with the privacy policy.
The short version
- You are the controller of your customers' data; we are your processor.
- It applies from the moment you install the app. There is nothing to sign.
- We process only what the app needs, only on your instructions — the app's settings and your use of it — and only through the sub-processors listed in the privacy policy, and we tell you 14 days before that list changes.
- If personal data is breached on our side, you hear from us within 72 hours.
- Uninstall, and everything is deleted.
1. Parties and roles
You are the controller of the personal data of your customers that the app processes. We are your processor. Where we process data about you, the merchant, for our own purposes (your account, billing), we are a controller and the privacy policy applies instead of this agreement.
2. Subject matter, duration, nature and purpose
Subject matter: reminding your customers to pay orders they have not paid, as you configure the app. Duration: from installation until the data is deleted after uninstall (section 7). Nature: reading order records from Shopify, storing the records described in section 3, deciding when a reminder is due, composing its text, asking Shopify to send it, showing a payment page for the order, writing tags, payment terms and — if you switched it on or asked for it — cancellations to the order in Shopify. Purpose: collecting payment of your orders.
3. Personal data and data subjects
Data subjects: your customers who have unpaid orders or quotes in your store.
Personal data:
- identifiers: Shopify's id of the customer and of each of their unpaid orders or quotes, and the order number;
- order data: amounts due and total, currency, order and invoice dates, the payment method's name, payment terms and due date, part payment, fulfilment, the order's and the customer's language, whether Shopify can email the customer, and the tags no-reminder and customer-says-paid;
- reminder data: which reminders were sent, when, with what outcome, and when the customer pressed "I've already paid";
- the customer's first and last name, read from Shopify when shown to you or used in a greeting, and not stored.
No email address, postal address, phone number or payment card data is processed by us. Shopify addresses and sends every reminder. No special categories of data are processed.
4. Our obligations as processor
We:
- process the personal data only on your documented instructions — the app's settings and your use of it — including with regard to transfers, unless the law requires otherwise, in which case we tell you first where the law allows;
- ensure that anyone authorised to process it is bound to confidentiality;
- take the technical and organisational measures described in the privacy policy under "Security", and keep them appropriate to the risk;
- engage only the sub-processors listed in the privacy policy, under written terms that impose data-protection obligations no less protective than these; we notify you at least 14 days before adding or replacing one, and you may object by uninstalling before the change takes effect; we remain responsible for our sub-processors' performance;
- do not use the data for any purpose of our own, sell it, or use it for marketing or to train any model.
5. Assistance with data-subject rights and your own obligations
Through Shopify's privacy webhooks the app handles your customers' requests automatically: a data request is recorded and the data is visible to you in the app; an erasure request deletes the customer's order records and send-log entries. We assist you on request with any other data-subject request, and with your obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to us.
You remain responsible for having a lawful basis to remind your customers, for the wording, bank details and settings you choose, and for informing your customers where the law requires it.
6. Personal data breach
If we become aware of a personal data breach affecting your customers' data, we notify you without undue delay and in any case within 72 hours, with what we know of its nature, the data and people concerned, its likely consequences and the measures taken or proposed, and we keep you informed as we learn more.
7. Deletion at the end of the service
When you uninstall the app, sending stops and our access to your store is revoked at once. On Shopify's shop-deletion signal, about 48 hours later, we delete all personal data processed for you; if the signal does not arrive, we delete it three days after the uninstall. A record that a privacy request was carried out, which contains no personal data, is kept.
8. Information and audits
We make available to you the information necessary to demonstrate compliance with this agreement and allow for and contribute to audits, including inspections, by you or an auditor you mandate, on reasonable notice and at your cost, limited to what is needed to verify compliance. A written questionnaire answered by us is the first step.
9. Where the data is processed and international transfers
The data is stored in Cloudflare's Eastern Europe region and processed by Cloudflare's network in transit. Cloudflare's processing is covered by its data-processing addendum, which incorporates the EU standard contractual clauses. Reminders are sent by Shopify, which you already use for your store.
10. Term, precedence and law
This agreement applies as long as we process personal data for you. Where it conflicts with the terms on a data-protection matter, this agreement prevails. It is governed by the laws of the Republic of Lithuania.
Changes to this agreement
If this agreement changes materially, we will note it here with a new effective date and flag it in the app.