Data Processing Agreement

Version: 1.0 · Effective date: 14 October 2026

1. Parties, scope and roles

1.1 Parties. This Data Processing Agreement ("DPA") is made between:

• (a) Price Fusion AI Ltd ("Price Fusion", "we", "us"), a company registered in England and Wales under company number 17504479, whose registered office is at 9 Alma Road, Stockport, SK4 4PU, England; and
• (b) the merchant that installs the Price Fusion app on its Shopify store and accepts the Price Fusion Terms of Service (the "Terms"), as identified on installation (the "Merchant", "you").

1.2 Acceptance. This DPA forms part of the Terms and takes effect when the Merchant accepts the Terms, as described in clause 2.1 of the Terms. No separate signature is needed.

1.3 Definitions. In this DPA:

• (a) "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and, where they apply to the processing, Regulation (EU) 2016/679 (the "EU GDPR") and any laws implementing or supplementing them, each as amended or replaced from time to time;
• (b) "controller", "processor", "data subject", "personal data", "personal data breach", "processing" and "supervisory authority" have the meanings given in Data Protection Law;
• (c) "Merchant Personal Data" means the personal data described in Annex 1 that Price Fusion processes on the Merchant's behalf in providing the Service;
• (d) "Service" means the Price Fusion app and related services described in the Terms;
• (e) "Shoppers" means visitors to, and customers of, the Merchant's Shopify storefront;
• (f) "Sub-processor" means a third party engaged by Price Fusion that processes Merchant Personal Data, as listed in Annex 3;
• (g) "Compliance Webhooks" means Shopify's mandatory privacy notifications: customers/data_request, customers/redact and shop/redact.

1.4 Roles: Price Fusion as processor. For Merchant Personal Data (the Merchant's store data and the personal data of its Shoppers and staff described in Annex 1), the Merchant is the controller and Price Fusion is the processor. The Merchant authorises Price Fusion to process Merchant Personal Data only as set out in this DPA.

1.5 Roles: Price Fusion as controller.

• (a) Account Data. Price Fusion is an independent controller of the personal data it processes to run its relationship with the Merchant as its customer: account, authentication, billing and support data, and records of how the Merchant and its staff use the Service, including in-app activity and login logs ("Account Data"). Account Data is covered by the Price Fusion Privacy Policy, not by this DPA.
• (b) Limited use of store data for Price Fusion's own purposes. The Merchant authorises Price Fusion to use data from the Merchant's store for the following purposes of its own, and for no others. Price Fusion is the controller of the resulting records and the Privacy Policy describes them:
  • (i) security and abuse prevention: rate-limiting counters and security logs, which may contain the shop domain and the IP address of the device calling the Service;
  • (ii) quality control of the AI features: a sample of about 10% of the inputs to and outputs from the AI features, kept while the app is installed and deleted with the store's data under clause 2.8. These contain store, catalogue and sales data and free text typed by the Merchant's staff. They do not contain Shoppers' contact details (unless the Merchant's staff typed them into free text) or the identifiers in Annex 1, rows 1 to 3;
  • (iii) the free-trial record: the record described in clause 2.8(b)(iii); and
  • (iv) service-wide counts and statistics that identify no store, product or person, used only to operate, secure, bill for, maintain and improve the Service as clauses 7.1 and 7.7 of the Terms describe. They are derived from app-usage events and store-level outputs (for example, how often a feature is used, or how often a job or check fails), not from Merchant Personal Data about Shoppers. Price Fusion uses them only inside the Service and never publishes, sells or shares them, uses them to compare merchants, or uses them to train, fine-tune or improve any model.
• (c) What Price Fusion will not do. Price Fusion will not use Merchant Personal Data about Shoppers (Annex 1, rows 1 to 5) for any purpose of its own. It will not sell or share Merchant Personal Data, use it for advertising, combine it with any other merchant's data (other than in the counts and statistics described in clause 1.5(b)(iv), which identify no store, product or person), use it to compare the Merchant with other merchants, or use it, in any form (including anonymous, aggregated or derived forms), to train, fine-tune or improve any AI or machine-learning model other than the models fitted for the Merchant's own store under clause 2.1(d). Any other use of the Merchant's data, including any pooled or benchmarking feature, needs the Merchant's separate opt-in under clause 7.8 of the Terms and is not offered today. This clause protects the Merchant's data; it does not restrict Price Fusion's right to develop, use and license its own software, methods and models that are built without the Merchant's data.
• (d) Free text. Free text typed by the Merchant's staff into the app is the Merchant's store data and Price Fusion processes it as processor, except as stated in (b)(ii).

1.6 The Merchant's obligations as controller. The Merchant:

• (a) is responsible for having a lawful basis for the processing it instructs, and for giving Shoppers any information required by Data Protection Law (including in its own privacy notice);
• (b) is responsible for obtaining any consent required for the storefront pixel described in Annex 1, using its storefront consent tools. The pixel runs inside Shopify's sandbox and Shopify's customer-privacy framework decides whether it runs. The pixel declares to Shopify that it requires analytics consent only: it does not require marketing or preferences consent, and it declares that it is not involved in the sale of data. Where the Merchant's store settings require consent for a visitor, the pixel runs only if that visitor has accepted analytics; where they do not (for example, for visitors in some regions outside the UK and EU), the pixel runs without a prompt; and
• (c) must not instruct Price Fusion to process special category data or criminal-offence data.

1.7 Order of precedence. If there is a conflict between documents, the following order applies (highest first): (a) any Transfer Mechanism under clause 3, as it applies to the transfer concerned; (b) this DPA, as to the processing of Merchant Personal Data; (c) the Terms. Otherwise the Terms govern.

2. Processor obligations (Article 28(3) UK GDPR and EU GDPR)

2.1 Documented instructions (Art. 28(3)(a)). Price Fusion will process Merchant Personal Data only on the Merchant's documented instructions, including about international transfers, unless required to do otherwise by UK law (or, where the EU GDPR applies, EU or Member State law), in which case Price Fusion will tell the Merchant of that legal requirement before processing unless the law forbids it. The Merchant's instructions are:

• (a) the Terms and this DPA;
• (b) the Merchant's installation and configuration of the app, including the Shopify access scopes it grants, and the storefront pixel that Price Fusion adds to the store when the app is installed;
• (c) the Merchant's use of the Service's features; and
• (d) the instruction, given in clause 7.7 of the Terms, to fit statistical and machine-learning models to the Merchant's own store data in order to produce the Merchant's recommendations. Those models are fitted only on the Merchant's data, used only for the Merchant's store, and deleted with the store's data under clause 2.8.

Price Fusion will tell the Merchant promptly if, in its opinion, an instruction infringes Data Protection Law.

2.2 Confidentiality (Art. 28(3)(b)). Price Fusion will ensure that everyone it authorises to process Merchant Personal Data is under a contractual or statutory duty of confidentiality. Production access is limited to the founders, who are bound by confidentiality; any contractor signs a confidentiality agreement before production access.

2.3 Security (Art. 28(3)(c), Art. 32). Price Fusion will implement and maintain the technical and organisational measures in Annex 2. Price Fusion may update those measures provided the overall level of protection is not reduced.

2.4 Sub-processors (Art. 28(2), 28(3)(d), 28(4)).

• (a) General authorisation. The Merchant gives Price Fusion general written authorisation to engage the Sub-processors listed in Annex 3.
• (b) Notice of changes. Price Fusion will give the Merchant at least 30 days' notice of any intended addition or replacement of a Sub-processor, by email to the Merchant's account contact and by updating the sub-processor list published at https://www.pricefusion.ai/legal/subprocessors. Price Fusion may replace a Sub-processor on shorter notice where that is needed urgently to keep the Service secure or available, and will then give notice as soon as it reasonably can.
• (c) Right to object. The Merchant may object on reasonable data-protection grounds within 14 days of the notice. The parties will discuss the objection in good faith. If it is not resolved before the change takes effect, the Merchant's only remedy is to end the Terms by uninstalling the app, and Price Fusion will refund or credit, through Shopify, any fees paid for the period after the uninstall.
• (d) Flow-down. Price Fusion will impose on each Sub-processor, by written contract, data-protection obligations that offer at least the same protection as this DPA, and remains liable to the Merchant for each Sub-processor's performance of those obligations, as Data Protection Law requires.
• (e) Planned demand-forecasting component. Price Fusion is building a demand-forecasting component that, when live, would use additional hosting and database services (see Annex 3, Part B). It is not live and no Merchant Personal Data flows to it today. Before any Merchant Personal Data flows to it, Price Fusion will add the relevant providers under clause 2.4(b). The component will fit models only as clause 2.1(d) allows, on the instruction and consent the Merchant gives in clause 7.7 of the Terms.

2.5 Data-subject rights (Art. 28(3)(e)). Taking into account the nature of the processing, Price Fusion will assist the Merchant by appropriate technical and organisational measures in responding to requests from data subjects to exercise their rights. In particular:

• (a) Access (customers/data_request). On receiving this Compliance Webhook for a Shopper, Price Fusion will record the request and, within 30 days, send to the Merchant's account email a machine-readable file of the Merchant Personal Data it holds that is linked to that Shopper: each matched order record (the orders Shopify names in the request, and any order holding that Shopper's customer reference), with its dates, totals, discount codes and lines; a list of any requested orders Price Fusion does not hold; and a statement about storefront pixel events. The statement will say that those events are stored with a per-browser identifier assigned by Shopify and a hashed checkout token, and not with a customer id, name, email address, telephone number or postal address; that Price Fusion holds nothing that links them to a customer and so cannot pick out the Shopper's events; and that the Merchant or Shopify may be able to.
• (b) Erasure (customers/redact). On receiving this Compliance Webhook for a Shopper, Price Fusion will, within 30 days and for the order records Shopify names in the request and any order holding that Shopper's customer reference: (i) remove the customer reference; and (ii) remove every discount code that, among the Merchant's orders held by Price Fusion, appears only on that Shopper's orders. Discount codes that also appear on any other order are kept. Discount codes are store data that Price Fusion copies from the Merchant's Shopify store: a removed code can come back when Price Fusion next syncs that order if it is still on the order in Shopify, so the Merchant should remove it in Shopify as part of its own response to the request. The order records are otherwise kept for the Merchant's pricing analysis as pseudonymous sales data, keyed by Shopify order id. Price Fusion holds no name or contact details for the Shopper. Storefront pixel data cannot be linked by Price Fusion to an identified customer and is deleted 90 days after collection under Annex 1.
• (c) Store erasure (shop/redact). See clause 2.8.
• (d) Other requests and complaints. If Price Fusion receives a request or a complaint directly from a data subject about Merchant Personal Data, it will acknowledge it, pass it to the Merchant within five working days and refer the data subject to the Merchant, and will not otherwise respond itself unless the Merchant instructs otherwise or the law requires. Price Fusion will give the Merchant reasonable help in handling a data-protection complaint about the processing covered by this DPA.

2.6 Assistance with security, DPIAs and consultation (Art. 28(3)(f)). Taking into account the nature of the processing and the information available to it, Price Fusion will provide reasonable assistance to the Merchant with its obligations under Articles 32 to 36, including any data protection impact assessment and any prior consultation with a supervisory authority, mainly by providing the information in this DPA and its Annexes and answering reasonable written questions. That assistance is free. Where the Merchant asks for substantially more, Price Fusion may charge its reasonable costs, agreed in advance.

2.7 Personal data breaches (Art. 33).

• (a) Price Fusion will notify the Merchant without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Merchant Personal Data.
• (b) The notice will include, so far as then known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed; and a contact point. Price Fusion may provide information in phases as it becomes available.
• (c) Price Fusion will take reasonable steps to contain and remedy the breach and will co-operate with the Merchant's reasonable requests. The Merchant is responsible for any notification to a supervisory authority or to data subjects that is required of it as controller.
• (d) Notices will be sent to the Merchant's account email address on record. The Merchant may contact Price Fusion at support@pricefusion.ai.

2.8 Deletion or return at the end of processing (Art. 28(3)(g)).

• (a) Uninstall. When the Merchant uninstalls the app, Price Fusion stops accessing the Merchant's store and deletes its Shopify access credentials at the moment of uninstall.

• (b) Purge. Price Fusion then deletes the Merchant's store data, including Merchant Personal Data, about 48 hours after uninstall, when Shopify sends its shop/redact Compliance Webhook. A daily check also starts the same deletion for uninstalled stores whose last data synchronisation was 48 hours or more ago, which can be before Shopify's webhook arrives. The following are not deleted by the purge:

  • (i) daily service-wide totals, which are not linked to any store;
  • (ii) storefront pixel events recorded under an earlier record of the store (for example before a reinstall), which the purge can miss; they are deleted by the 90-day deletion in Annex 1 instead; and
  • (iii) a keyed (HMAC) hash of the store's domain in the free-trial ledger, with the fact that the store has used its trial, kept for 12 months after uninstall, then deleted, solely to prevent repeat free trials, on the basis of Price Fusion's legitimate interests. The hash cannot be turned back into the domain. The ledger is written when a trial starts. At shop/redact the entry's other fields (plan, trial length and dates) are replaced with fixed neutral values, so the entry records only that the trial was used. It contains no Shopper data. Price Fusion holds it as controller (clause 1.5(b)(iii)).

  Registrations of AI assistants connected to Price Fusion (OAuth client records: an assistant's name and the address it returns to) are not linked to any store, and are not part of the store's data; the API keys, authorisation codes and access tokens issued for the Merchant's store are deleted with it.

• (c) Return. The Merchant's store data originates in its Shopify store and remains available to it there. The Service also offers the exports listed in clause 9.5(b) of the Terms. To switch providers, the Merchant can cancel its paid plan rather than uninstall: the store moves to the Free plan, its data stays, and the exports remain available on the Free plan for as long as the app stays installed (Full Price Intelligence and price-sensitivity estimates are on paid plans only, and on the Free plan the Monthly insights report leaves out insights that rest on a prediction, so the Merchant should export these before cancelling if it wants them). Uninstalling starts deletion under clauses 2.8(a) and (b). The exports are: its products as CSV or a printable PDF, and each product's figures and price history as CSV; the reports as CSV, including Price Fusion's price changes and the outcomes of the Merchant's campaigns; and Full Price Intelligence as CSV (not on the Free plan). The exports do not include the models fitted for the Merchant's store, or Price Fusion's software, methods or algorithms.

• (d) Backups. Merchant Personal Data in the database provider's point-in-time restore history is not deleted on demand. It is not used for any other purpose and expires when the restore window passes, which is 7 days. Data held by Sub-processors under their own retention settings expires on the schedules in Annex 3.

• (e) Legal retention. Price Fusion may keep Merchant Personal Data where UK law requires, and will keep it confidential and process it only for that purpose.

2.9 Information and audits (Art. 28(3)(h)).

• (a) Price Fusion will make available to the Merchant the information reasonably necessary to demonstrate compliance with Article 28.
• (b) The Merchant will first request information by written questionnaire, which Price Fusion will answer within 30 days.
• (c) If the questionnaire answers are reasonably insufficient to demonstrate compliance, or a supervisory authority requires it, the Merchant (or an independent auditor bound by confidentiality and not a competitor of Price Fusion) may carry out an audit, including an inspection: on at least 30 days' written notice; no more than once in any 12-month period, except after a personal data breach or at a supervisory authority's request; during business hours; in a way that minimises disruption and does not compromise other customers' data or Price Fusion's security; and at the Merchant's cost, unless the audit finds a material breach of this DPA by Price Fusion.
• (d) Audits of Sub-processors will be satisfied by the Sub-processor's own certifications or audit reports where available.

3. International transfers

3.1 Where data is held. Price Fusion's primary database, cache and application functions are hosted in London (see Annexes 2 and 3). Some Sub-processors are based in, or process data in, the United States or other countries outside the UK and EEA (Annex 3).

3.2 Restricted transfers by Price Fusion. Price Fusion will not make a restricted transfer of Merchant Personal Data (under UK GDPR Chapter V or, where it applies, EU GDPR Chapter V) unless one of the following applies to it:

• (a) for transfers subject to UK GDPR: UK adequacy regulations, including those for the United States that cover organisations certified under the UK Extension to the EU–US Data Privacy Framework; or the International Data Transfer Addendum to the EU Standard Contractual Clauses ("UK Addendum"); or the UK International Data Transfer Agreement ("IDTA");
• (b) for transfers subject to the EU GDPR: an adequacy decision, including the decision on the EU–US Data Privacy Framework for organisations certified under it; or the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("EU SCCs"), Module 3 (processor to processor) for onward transfers to Sub-processors

(each a "Transfer Mechanism"). The Transfer Mechanism for each Sub-processor is stated in Annex 3. Where a Sub-processor is certified under the Data Privacy Framework and its contract also contains the EU SCCs with the UK Addendum or the IDTA, the clauses apply if the certification or the adequacy decision ceases to have effect.

3.3 Transfers from an EU Merchant to Price Fusion. Where the Merchant is subject to the EU GDPR and transfers Merchant Personal Data to Price Fusion in the UK, the parties rely on the European Commission's adequacy decision for the United Kingdom while it remains in force. If it ceases to apply, the EU SCCs, Module 2 (controller to processor), are incorporated by reference with the Merchant as data exporter and Price Fusion as data importer, on these terms: clause 7 (docking) applies; clause 9, option 2 (general written authorisation) applies with the notice period in clause 2.4(b); the optional wording in clause 11 does not apply; under clause 13 the competent supervisory authority is that of the EU Member State where the Merchant is established; under clauses 17 and 18 the governing law is that of Ireland and the courts are those of Ireland; and Annexes 1 to 3 of this DPA complete the Annexes to the EU SCCs.

3.4 Transfer risk assessments. Where Price Fusion relies on the EU SCCs, the UK Addendum or the IDTA as the primary Transfer Mechanism for a Sub-processor, it will carry out and keep a documented transfer risk assessment before any Merchant Personal Data is transferred to that Sub-processor. Price Fusion will not transfer the Merchant Personal Data of a live merchant (a store that is not a Shopify development store) to Inngest before a documented transfer risk assessment for Inngest is in place.

4. Liability, term and governing law

4.1 Liability. Price Fusion's liability under or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms, and counts towards the total aggregate cap in clause 12.3 of the Terms, which includes data-protection claims. Nothing in this DPA limits either party's liability to data subjects or to a supervisory authority where Data Protection Law does not allow it to be limited.

4.2 Term. This DPA starts when the Merchant accepts the Terms and continues for as long as Price Fusion processes Merchant Personal Data, including after the Terms end until deletion under clause 2.8 is complete.

4.3 Survival. Clauses 2.2, 2.7, 2.8, 4 and any provision that by its nature should survive, survive termination.

4.4 Changes. Price Fusion may update this DPA where required by a change in Data Protection Law, a supervisory authority's guidance, or a change in Sub-processors under clause 2.4, by notice to the Merchant. Any other change is made under clause 14.1 of the Terms (30 days' notice) and must not reduce the protection given to Merchant Personal Data.

4.5 Governing law and jurisdiction. This DPA and any non-contractual obligations arising from it are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, as in clause 14.10 of the Terms, except where a Transfer Mechanism requires otherwise.

4.6 Contact. Questions about this DPA: support@pricefusion.ai.

Annex 1: Description of the processing

A1.1 Subject matter

The processing of the Merchant's store data and the personal data of its Shoppers and staff to provide the Service: a pricing and promotions app for Shopify that analyses the Merchant's products, orders and storefront activity to recommend and apply prices and campaigns.

A1.2 Duration

For as long as the app is installed on the Merchant's store, then until deletion under clause 2.8 (about 48 hours after uninstall), subject to backup expiry and Sub-processor retention (clause 2.8(d)).

A1.3 Nature of the processing

Collection (from the Shopify Admin API, Shopify webhooks and the storefront web pixel), recording, storage, pseudonymisation (hashing), aggregation, analysis (including fitting models to the Merchant's own data), retrieval, display to the Merchant, and deletion.

A1.4 Purpose of the processing

(a) Measuring demand and price elasticity from orders. (b) Measuring the storefront funnel (product views, add-to-cart and checkout) to inform pricing. (c) Planning, applying and auditing prices and campaigns, including keeping evidence of earlier prices. (d) Reporting the Merchant's full-price and discounted sales, discount given away and margin scenarios to the Merchant, from its own orders, prices and costs (Full Price Intelligence). (e) Generating AI insights and pricing strategy for the Merchant (see Annex 3: AI prompts contain store, catalogue and sales data but no Shopper fields).

A1.5 Categories of data subjects

(a) The Merchant's Shoppers: storefront visitors and customers. (b) The Merchant's staff who use the app.

A1.6 Categories of personal data

Price Fusion does not store any Shopper name, email address, telephone number, postal address or IP address in its database.

Aggregated daily pixel counts per product or variant, price and day contain no visitor, order or customer fields, and are not intended to be personal data.

A1.7 Special category and criminal-offence data

None. Price Fusion does not request or intend to process special category data or criminal-offence data.

A1.8 Frequency

Continuous. Pixel events arrive as Shoppers browse the storefront; order data arrives on each order or refund webhook and on periodic synchronisation; a historical order backfill runs on install.

A1.9 Retention per category

Annex 2: Technical and organisational measures

Part A: in place

A2.1 Encryption. (a) Shopify access and refresh tokens are encrypted at rest with AES-256-GCM, and are deleted at the moment of uninstall. (b) Data in transit is protected by TLS. (c) Production and non-production environments use separate encryption keys.

A2.2 Pseudonymisation and hashing. (a) The checkout token is stored only as a truncated SHA-256 hash. (b) API keys and OAuth tokens for agent access are stored as hashes. (c) The free-trial ledger identifies a store only by a keyed (HMAC-SHA256) hash of the shop domain, never the domain itself; after shop/redact, only that hash and the fact that the trial was used remain.

A2.3 Data minimisation. (a) Price Fusion's pixel endpoint keeps only the fields listed in Annex 1 and strips each event down to them before anything is queued or stored; the page URL and user agent are not kept. The checkout token is hashed on arrival and only the hash is kept. (b) Price Fusion's order queries do not request customer details. (c) Shopify webhooks are trimmed before queueing to the fields each job reads: order and refund webhooks to the order id; Compliance Webhooks to the shop domain, the Shopify customer id (a pseudonymous Shopper identifier), order ids and the data-request id; product updates to ids, variant prices and their timestamps; product deletions to the product id; inventory updates to the inventory item id and stock level; and every other topic to nothing beyond the store's internal id. No Shopper or store-owner contact details are queued. (d) Prompts sent to the AI model provider contain no Shopper fields (free text typed by the Merchant's staff is sent as typed; see clause 5.4 of the Terms).

A2.4 Storage limitation. (a) Automatic daily deletion of raw pixel events after 90 days, held until they have been counted into the daily aggregates. (b) Store data purged about 48 hours after uninstall on shop/redact, with a daily check for uninstalled stores (clause 2.8(b)), and with the exceptions in that clause. (c) AI insights deleted automatically after 13 months.

A2.5 Tenant isolation. All store data is keyed to the Merchant's store, and access is scoped to the authenticated store. Models are fitted per store; no model is fitted on more than one merchant's data.

A2.6 Access control. Access to Price Fusion's internal administration functions is limited to an allowlist of administrator accounts.

A2.7 Error monitoring hygiene. Error monitoring is hosted in Sentry's EU data region and configured to send no personal data: Sentry receives no user details, request headers, cookies or request bodies; paths lose their query strings; emails, tokens and shop domains are redacted before sending. No session replay is used.

A2.8 Data location. The primary database (Neon) and cache (Upstash) are hosted in AWS eu-west-2 (London), and application functions run in Vercel's London region.

A2.9 Webhook verification. Shopify webhooks, including the Compliance Webhooks, are verified by their HMAC signature before Price Fusion acts on them.

Part B: planned before the first merchant installs

A2.10 (a) Deletion of each Shopper's order records on customers/redact, after their quantities are added to daily sales totals that hold no order or customer identifiers, with a keyed hash of each deleted order id kept only to stop a later synchronisation restoring it. (b) Fixed retention periods for order records, the AI quality-control sample and operational logs while the app is installed. (c) A documented incident-response and breach-notification procedure supporting clause 2.7, including notice to Shopify within 24 hours as Shopify's API Terms require.

Until a measure in Part B is in place, this DPA does not rely on it, and the commitments elsewhere in this DPA describe what Price Fusion does today.

Annex 3: Sub-processors

Part A: current Sub-processors

Support correspondence is Account Data, for which Price Fusion is controller. Google is listed here because a Merchant may include Merchant Personal Data in an email.

Shopify is the source of the data and the billing provider for the app. It is not a Sub-processor of Price Fusion; its own terms with the Merchant and with Price Fusion (as a Shopify Partner) apply.

AI assistants that the Merchant itself connects to Price Fusion are not Sub-processors; the Merchant chooses them and their providers act for the Merchant.

Part B: planned, not current

A demand-forecasting component is planned. When live, it would use Google Cloud (London region) and a second Neon database, processing order lines, stock levels and aggregated pixel counts. No Merchant Personal Data flows to it today. These providers will be added under clause 2.4(b) before any Merchant Personal Data flows to them.

Annex 4: United States state privacy laws

A4.1 This Annex applies where a US state privacy law (such as the California Consumer Privacy Act, as amended) applies to the Merchant's use of the Service. Terms defined in that law have the same meaning here.

A4.2 Price Fusion is the Merchant's service provider or processor. Price Fusion will:

• (a) process Merchant Personal Data only for the limited and specified business purposes in Annex 1, and not retain, use or disclose it for any other purpose, including any commercial purpose other than providing the Service, or outside the direct business relationship with the Merchant;
• (b) not sell or share Merchant Personal Data;
• (c) not combine Merchant Personal Data with personal data it receives from another source or collects from its own dealings with a person, except as that law allows a service provider to do;
• (d) give Merchant Personal Data the level of privacy protection that law requires, and tell the Merchant if it decides it can no longer meet its obligations under it;
• (e) allow the Merchant to take reasonable and appropriate steps, through clause 2.9, to check that Price Fusion uses Merchant Personal Data consistently with the Merchant's obligations, and to stop and remedy any unauthorised use; and
• (f) engage Sub-processors only under clause 2.4 and under a written contract that requires them to meet these obligations.

A4.3 Price Fusion certifies that it understands the restrictions in this Annex and will comply with them.