UploadDrop Data Processing Agreement

1. Roles and instructions

1.1. Controller determines the purposes of processing Controller Personal Data. Processor processes that data on Controller’s behalf. The processing details are set out in Annex 1.

1.2. The Agreement, this DPA, and Controller’s configuration and use of UploadDrop constitute documented instructions to provide, operate, secure and support the service, including the transfers described in section 5. Storage and retention settings apply subject to the features available under Controller’s plan.

Processor shall process Controller Personal Data only on documented instructions, unless required by Union or Member State law to which Processor is subject. In that case, Processor shall inform Controller of the legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

1.3. Additional instructions may be sent to support@uploaddropapp.com. The parties shall discuss instructions requiring changes outside UploadDrop’s standard functionality. This does not limit Processor’s obligations under this DPA or applicable law.

1.4. Processor shall immediately inform Controller if, in its opinion, an instruction infringes the GDPR or other applicable Union or Member State data protection provisions.

1.5. Controller is responsible for its lawful basis, required notices to Data Subjects, the content it permits customers to submit, and its use and disclosure of files and file links.

1.6. Processing for which Processor acts as an independent controller, such as administration of its merchant relationship and business contact records, is described in the Privacy Policy. Customer content processed on Controller’s behalf for support remains subject to this DPA.

2. Confidentiality and security

2.1. Processor shall ensure that persons authorised to process Controller Personal Data are subject to an appropriate contractual or statutory obligation of confidentiality.

2.2. Processor shall implement and maintain appropriate technical and organisational measures under Article 32 GDPR, taking account of the processing and its risks. Measures are described in Annex 2.

2.3. Processor may update these measures as its systems evolve, provided the overall level of protection is not materially reduced.

3. Assistance and incidents

3.1. Taking account of the nature of processing, Processor shall assist Controller, through appropriate technical and organisational measures insofar as possible, in responding to Data Subjects exercising their GDPR rights. Assistance is provided through available service functionality, Shopify privacy workflows, and requests to support@uploaddropapp.com. Controller shall provide information reasonably needed to identify the relevant store, orders or files.

3.2. Taking account of the processing and information available to Processor, Processor shall assist Controller with its obligations under Articles 32–36 GDPR by providing relevant information about the service, security measures and incidents, and cooperation with assessments and consultations concerning UploadDrop’s processing.

3.3. Processor shall notify Controller without undue delay after becoming aware of a Personal Data Breach affecting Controller Personal Data. Processor shall provide available information about its nature, affected data, likely consequences, measures taken or proposed, and a contact for further information. Information may be supplied in stages without undue further delay.

3.4. Processor shall promptly forward a Data Subject request concerning Controller Personal Data to the relevant Controller where identifiable, and may direct the Data Subject to Controller. Processor shall not otherwise respond substantively without Controller’s instructions unless legally required.

4. Sub-processors

4.1. Controller gives Processor general written authorisation to engage Sub-processors under this section, including those disclosed when Controller accepts this DPA.

4.2. Processor maintains its current Sub-processor information in the UploadDrop Privacy Policy. Processor shall make available information about relevant entities, their functions, processing locations and transfer safeguards, including the identities and contact details of Sub-processors in the processing chain.

4.3. Processor shall inform Controller of an intended addition or replacement of a Sub-processor processing Controller Personal Data before processing begins, giving reasonable advance notice and an opportunity to object on legitimate data protection grounds. Notice may be given by email or a direct electronic notice in UploadDrop. Updating the public list alone does not constitute notice. Objections may be sent to support@uploaddropapp.com.

4.4. Processor shall impose the data protection obligations required by Article 28 GDPR on its Sub-processors by written agreement and remains responsible for their performance as required by Article 28(4).

4.5. If Controller objects, the parties shall seek a reasonable solution. If none is available, Controller may terminate the affected service before its data is processed by the proposed Sub-processor. Processor shall not entrust that data to the proposed Sub-processor while the objection remains unresolved and the affected service continues.

5. International transfers and storage

5.1. Processor shall ensure that transfers of Controller Personal Data outside the European Economic Area comply with Chapter V GDPR, using an appropriate transfer mechanism and supplementary measures where required. Applicable European Commission Standard Contractual Clauses or an applicable adequacy decision may provide the transfer mechanism.

5.2. Controller instructs Processor to use the Sub-processors and processing locations disclosed under section 4, subject to this DPA and applicable law.

5.3. Where Controller selects European Union storage and its plan supports that feature, new uploaded files and newly generated export archives are stored in a Cloudflare R2 bucket configured with Cloudflare’s EU Jurisdictional Restriction. Otherwise, they use the default R2 bucket described in the Privacy Policy. The setting in effect when a file or archive is created determines its bucket; changing the setting does not automatically move existing files.

5.4. The region setting concerns storage in the selected R2 bucket. It does not guarantee that all application processing, metadata, image preview processing and delivery, or provider support takes place within the EU. Any associated international transfers remain subject to section 5.1.

6. Retention, return and deletion

6.1. Controller can access and download available uploaded files and use supported export functionality. Earlier deletion or return of Controller Personal Data may be requested through support@uploaddropapp.com or applicable Shopify privacy workflows.

6.2. Original uploads are automatically deleted from Cloudflare R2 object storage using object lifecycle rules after the retention period applicable when uploaded, currently 30, 60 or 90 days depending on Controller’s settings and plan. This period runs from upload, including for files never attached to an order. Setting changes apply to subsequent uploads.

Generated ZIP exports are temporary. Downloads through UploadDrop expire after two hours, and a scheduled cleanup process deletes export archives older than two hours on its next successful run. Automatic deletion may complete after the expiry time because of normal processing delays. Related metadata and operational records shall not be retained longer than necessary for their purpose.

6.3. After the processing services end, Processor shall, at Controller’s choice, return or delete Controller Personal Data and delete existing copies, unless Union or Member State law requires storage. Controller may download or export available data before termination, or request its return through support before deletion. Return shall be in a commonly used electronic format.

Unless Controller requests return, Controller instructs Processor to delete the data without undue delay following termination. Shopify’s shop/redact workflow is a mechanism used for deletion; Processor’s obligations do not depend solely on receipt of that webhook. Processor is not required to recover data already lawfully deleted.

6.4. Deletion includes relevant service-generated copies under Processor’s or its Sub-processors’ control. Any remaining copies temporarily held in managed backups shall be protected, unavailable for ordinary use and deleted without undue delay through the applicable scheduled deletion or overwrite process, unless legally required to be retained. Applicable deletion instructions shall be reapplied if a backup is restored.

6.5. Processor shall provide electronic confirmation of completed deletion on request. Controller remains responsible for copies it downloads or retains separately, including records held in its Shopify store under its agreement with Shopify.

7. Compliance information and audits

7.1. Processor shall make available information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits, including inspections, by Controller or an auditor appointed by Controller.

7.2. The parties shall first consider whether documentation, written responses, provider assurance information or a remote review adequately address Controller’s request. This does not remove Controller’s right to an inspection where needed.

7.3. Where circumstances permit, audits shall be arranged on reasonable notice, during normal business hours and subject to confidentiality, with a scope and method that avoid unnecessary disruption and protect other customers’ data and system security.

8. Duration and precedence

8.1. This DPA applies for as long as Processor processes Controller Personal Data on Controller’s behalf.

8.2. This DPA prevails over conflicting Agreement terms concerning Controller Personal Data. Applicable Standard Contractual Clauses prevail over conflicting terms of this DPA.

8.3. The Agreement’s governing-law and liability provisions apply only to the extent permitted by applicable law. This DPA does not limit Data Subjects’ rights, supervisory authorities’ powers or liability that cannot lawfully be limited.

Annex 1 — Details of processing

Subject matter and purpose

Receiving customer uploads through Controller’s Shopify storefront, linking them to orders and line items, and providing previews, downloads, exports, support and deletion. Processing serves to provide, operate, secure and support this functionality.

Duration

During Controller’s use of UploadDrop and until data is returned or deleted under section 6. Original-file retention is determined at upload, currently 30, 60 or 90 days according to settings and plan.

Nature of processing

Receiving, transmitting and storing files and metadata; linking files to orders and line items; generating and serving previews and export archives; displaying and returning files and metadata; handling privacy instructions; maintaining and securing the service; and deleting data and copies.

Categories of Data Subjects

Controller’s customers and prospective customers, persons depicted or otherwise identifiable in uploaded files, and other persons whose Personal Data appears in submitted content.

Categories of Personal Data

• Uploaded images, their contents and embedded metadata.
• Filenames, file types, sizes, storage identifiers and links.
• Shop identifiers, order IDs, order names and line-item references.
• Upload timestamps, export metadata and related technical data.
• Privacy-request identifiers, customer IDs and outcome records.

UploadDrop does not intentionally retain customer names, addresses, payment details or contact information from Shopify order payloads for its upload functionality. Such information may be received transiently through Shopify requests or appear in uploaded content.

Special categories of Personal Data

UploadDrop is not specifically designed for processing data covered by Articles 9 or 10 GDPR. Uploaded content may contain such data. Controller is responsible for determining whether its submission and processing are lawful and appropriate.

Annex 2 — Technical and organisational measures

Access and confidentiality

Administrative access to production infrastructure is restricted to authorised persons with an operational or support need and appropriate confidentiality obligations. Merchant admin access uses Shopify authentication, and application access to merchant records is scoped to the relevant shop.

Uploaded files are made available through links containing randomly generated file identifiers. A person possessing a file link may access the file without signing into the merchant admin. Controller should limit sharing to intended recipients. Processor remains responsible for appropriate security measures under Article 32.

Transmission security

Traffic to and from UploadDrop uses HTTPS. Infrastructure operations use authenticated connections, and Shopify compliance webhooks are validated through Shopify’s authentication mechanism.

Data minimisation and storage separation

Retained order data is limited to information needed for the service. Stored customer data-request payloads are sanitised. Uploaded files are stored in object storage separately from application records.

Retention and deletion

File storage and retention settings are recorded at upload. Original files and temporary export archives use automated deletion processes as described in section 6. Support requests and Shopify privacy workflows support earlier deletion and other privacy instructions.

Managed infrastructure and EU storage

UploadDrop uses managed hosting, database, object storage and image delivery services. Providers are identified in the Privacy Policy. EU storage operates as described in section 5.

Processor details

Privacy contact: support@uploaddropapp.com

Privacy Policy and Sub-processor information · Terms of Service