Data Processing Addendum

Last updated on 14 October 2026. This version replaces the version of 21 December 2020.

This Data Processing Addendum ("DPA") supplements the Terms of Service or other written or electronic agreement (the "Agreement" or "Principal Agreement") between SellerSmith Technology Joint Stock Company (SELLERSMITH TECHNOLOGY .,JSC), trading as PageFly, No 4, Lane 62, Nguyen Hong Road, Lang Ward, Ha Noi City, 10000, Viet Nam, enterprise and tax code 0106980380 ("PageFly", "Processor", "us" or "we") and the merchant that uses the PageFly app ("Customer" or "Company"; each a "Party", together the "Parties"). It sets out the Parties' responsibilities for the Processing of Customer Personal Information under the CCPA and of Personal Data under Data Protection Laws.

Capitalized terms not defined here have the meaning given in the Principal Agreement. Except as modified below, the Principal Agreement remains in full force and effect.

1. Definitions

1.1 In this DPA:
1.1.1 "Agreement" means this Data Processing Addendum and its Annexes;
1.1.2 "Company Personal Data" means any Personal Data Processed by a Contracted Processor on behalf of the Company under or in connection with the Principal Agreement;
1.1.3 "Contracted Processor" means PageFly or a Subprocessor;
1.1.4 "Data Protection Laws" means EU Data Protection Laws, the UK GDPR and, to the extent applicable, the data protection or privacy laws of any other country;
1.1.5 "EEA" means the European Economic Area;
1.1.6 "EU Data Protection Laws" means the GDPR and laws implementing or supplementing it;
1.1.7 "GDPR" means Regulation (EU) 2016/679, and "UK GDPR" means the GDPR as it forms part of the law of the United Kingdom;
1.1.8 "Data Transfer" means a transfer of Company Personal Data from the Company to a Contracted Processor, or an onward transfer between Contracted Processors, where the transfer would otherwise be restricted by Data Protection Laws;
1.1.9 "Services" means the PageFly page building and analytics services provided under the Principal Agreement;
1.1.10 "Subprocessor" means any person appointed by or on behalf of PageFly to Process Personal Data on behalf of the Company in connection with the Agreement;
1.1.11 "Standard Contractual Clauses" means the clauses adopted by Commission Implementing Decision (EU) 2021/914, and "UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner.

1.2 "Commission", "Controller", "Data Subject", "Member State", "Personal Data", "Personal Data Breach", "Processing" and "Supervisory Authority" have the meaning given in the GDPR.

2. Processing of Company Personal Data

2.1 Processor shall:
2.1.1 comply with all applicable Data Protection Laws in the Processing of Company Personal Data; and
2.1.2 not Process Company Personal Data other than on the Company's documented instructions.

2.2 The Company instructs Processor to Process Company Personal Data to provide the Services, as described in Annex 1.

3. Processor personnel

Processor shall take reasonable steps to ensure the reliability of any employee, agent or contractor of any Contracted Processor who may access Company Personal Data, that access is limited to those who need it for the purposes of the Principal Agreement, and that all such individuals are bound by confidentiality obligations.

4. Security

4.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risks for the rights and freedoms of natural persons, Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR.

4.2 In assessing the appropriate level of security, Processor shall take account in particular of the risks presented by Processing, in particular from a Personal Data Breach.

5. Subprocessing

5.1 The Company gives general authorization for Processor to engage Subprocessors. The current Subprocessor for Company Personal Data is Amazon Web Services, Inc. (United States), for cloud hosting, storage and analytics processing.

5.2 Processor shall impose on each Subprocessor data protection obligations that offer at least the same level of protection as this DPA and meet the requirements of Article 28(3) of the GDPR.

5.3 Processor shall update the list in section 5.1 at least 30 days before a new Subprocessor starts Processing Company Personal Data. The Company may object on reasonable data protection grounds by emailing happytohelp@pagefly.io within that period.

6. Data Subject rights

6.1 Taking into account the nature of the Processing, Processor shall assist the Company by appropriate technical and organizational measures, insofar as possible, to respond to requests to exercise Data Subject rights under Data Protection Laws.

6.2 Processor shall:
6.2.1 promptly notify the Company if it receives a request from a Data Subject in respect of Company Personal Data; and
6.2.2 not respond to that request except on the documented instructions of the Company or as required by applicable law, in which case Processor shall, to the extent permitted by law, inform the Company of that legal requirement before responding.

7. Personal Data Breach

7.1 Processor shall notify the Company without undue delay after becoming aware of a Personal Data Breach affecting Company Personal Data, with enough information for the Company to meet any obligation to report the breach or inform Data Subjects.

7.2 Processor shall cooperate with the Company and take reasonable commercial steps, as directed by the Company, to assist in the investigation, mitigation and remediation of each Personal Data Breach.

8. Data protection impact assessment and prior consultation

Processor shall provide reasonable assistance to the Company with any data protection impact assessment and prior consultation with Supervisory Authorities that the Company reasonably considers required by Article 35 or 36 of the GDPR or equivalent provisions, solely in relation to Processing of Company Personal Data and taking into account the nature of the Processing and the information available to the Contracted Processors.

9. Deletion or return of Company Personal Data

9.1 When the Company or a Data Subject requests deletion of Company Personal Data through Shopify, Shopify notifies Processor through its mandatory privacy webhooks (customers/redact and shop/redact). Processor shall act on the request and complete deletion within 30 days of receipt, unless Processor is legally required to retain the data.

10. Audit rights

10.1 Processor shall make available to the Company on request all information necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits, including inspections, by the Company or an auditor mandated by the Company in relation to the Processing of Company Personal Data.

10.2 The Company's information and audit rights arise under section 10.1 only to the extent the Agreement does not otherwise give it information and audit rights that meet the requirements of Data Protection Laws.

11. Data Transfer

11.1 When the Company uses PageFly analytics on a store that serves visitors in the EEA, the UK or Switzerland (Shopify admin, Settings, Customer privacy), the Company acknowledges that Processor Processes Company Personal Data outside the EEA: by PageFly in Viet Nam and by its Subprocessor in the United States.

11.2 To the extent a Data Transfer from the EEA is not covered by an adequacy decision, the Parties agree that the Standard Contractual Clauses, Module Two (controller to processor), are incorporated into this DPA, with the Company as data exporter and PageFly as data importer. For Data Transfers from the UK, the UK Addendum applies, and for transfers from Switzerland the Standard Contractual Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection.

11.3 For the Standard Contractual Clauses: Clause 7 (docking clause) applies; under Clause 9, Option 2 (general written authorization) applies with the notice period in section 5.3; the optional wording in Clause 11 does not apply; Clauses 17 and 18 are governed by and subject to the courts of Ireland; Annex I is completed by Annex 1 of this DPA and by the parties' details in the heading of this DPA; Annex II is completed by section 4 of this DPA. This DPA and the Terms of Service are the Company's complete and final documented instructions to PageFly. By entering into this DPA, the Parties are deemed to sign the Standard Contractual Clauses and, where relevant, the UK Addendum.

12. General terms

12.1 Confidentiality. Each Party must keep this Agreement and information it receives about the other Party and its business in connection with this Agreement ("Confidential Information") confidential and must not use or disclose that Confidential Information without the prior written consent of the other Party, except to the extent that:
(a) disclosure is required by law; or
(b) the information is already in the public domain.

12.2 Notices. Notices under this Agreement must be in writing and delivered by email: to PageFly at happytohelp@pagefly.io, and to the Company at the email address of its PageFly account.

Annex 1: details of the processing

Parties. Data exporter: the Company (the merchant, identified by its Shopify store). Data importer: SellerSmith Technology Joint Stock Company, trading as PageFly, contact happytohelp@pagefly.io.

Subject matter and nature. Use of PageFly analytics (heatmaps, page and section statistics, A/B tests, order attribution) under the Principal Agreement.

Duration. For the duration of the Principal Agreement, and until deletion under section 9.

Types of Personal Data. Page visits, clicks on tracked elements of the page, purchases happening on the page (order ID and order total), device type, country and pseudonymous session identifiers.

Categories of Data Subjects. Visitors to the Company's pages built with PageFly.

Retention. Heatmap data 30 days, element click data 90 days, section statistics 2 years, other page statistics for the duration of the Principal Agreement, and in all cases deleted within 30 days of a Shopify deletion request.

Location. Amazon Web Services, United States (us-east-1), accessed by PageFly in Viet Nam.

Obligations and rights of the Company. As set out in this DPA.

Addendums

The California Consumer Privacy Act Addendum is at pagefly.io/pages/california-consumer-privacy-act-addendum. Our Privacy Policy explains how we handle personal data as a controller. Questions about this DPA: happytohelp@pagefly.io.