Data Processing Addendum
Version 2.0, effective date: October 29, 2026
This Data Processing Addendum ("DPA") is entered into between:
- Controller: the merchant who has installed the AgenticRadar AI Shopify application ("Merchant", "you").
- Processor: Radrly sp. z o.o., ul. Tarczyńska 68, Krakowiany, 05-831 Młochów, Poland (KRS 0001215510, NIP 5342706013, REGON 543658680) ("Radrly", "we", "us").
This DPA forms part of the Terms of Service and applies whenever Radrly processes personal data on behalf of the Merchant when providing AgenticRadar AI(the "App"). It is intended to meet the requirements of Art. 28 of Regulation (EU) 2016/679 (GDPR). Personal data that Radrly processes as a controller (for example the store owner's contact details) is described in our Privacy Policy and is not covered by this DPA.
1. Definitions
Terms such as "personal data", "processing", "data subject", "controller", "processor" and "personal data breach" have the meanings given in the GDPR. "Customer Data" means personal data of the Merchant's customers that the App processes on the Merchant's behalf.
2. Subject matter, nature and purpose
Radrly processes Customer Data only to provide the App to the Merchant. Customer Data is processed mainly through the App's MCP Server: when an AI agent that the Merchant has given an MCP token calls a tool (for example to look up an order status, a customer's order history or loyalty balance, or to create a loyalty discount code for a customer), the App reads the requested data from the Merchant's Shopify store, returns it to that agent and records the tool call in the Agent Interaction Log. Customer Data is also processed when the App handles Shopify privacy webhooks for the Merchant.
Processing continues while the App is installed and ends when the data is deleted as described in section 9.
3. Categories of data and data subjects
| Data subjects | Categories of personal data | Processing |
|---|---|---|
| The Merchant's customers | Email address, name, phone number, Shopify customer ID, order numbers and status, shipping address, order history and totals, customer tags, loyalty information, discount codes created for the customer | Read from the Merchant's store and returned to the AI agent that requested it; stored as part of the MCP tool call record (request parameters and response) in the Agent Interaction Log |
| The Merchant's customers | Email address, phone number and customer ID contained in Shopify privacy webhooks | Used to find, export or delete the matching Agent Interaction Log records |
The App is not designed to process special categories of personal data (Art. 9 GDPR). The Merchant should not configure AI agents to request such data through the App.
4. Obligations of Radrly
Radrly shall:
- process Customer Data only on the Merchant's documented instructions, which are given by this DPA, the Terms of Service and the Merchant's configuration and use of the App, unless required to do otherwise by EU or Member State law, in which case Radrly will inform the Merchant before processing unless that law prohibits it;
- inform the Merchant if, in its opinion, an instruction infringes the GDPR;
- ensure that persons authorised to process Customer Data are bound by confidentiality;
- implement the measures described in section 5 (Art. 32 GDPR);
- engage sub-processors only as described in section 6;
- assist the Merchant, taking into account the nature of the processing, in responding to data subject requests (section 8) and in meeting its obligations under Art. 32 to 36 GDPR;
- delete Customer Data at the end of the processing as described in section 9; and
- make available to the Merchant the information necessary to demonstrate compliance with Art. 28 GDPR and allow for and contribute to audits, including inspections, conducted by the Merchant or an auditor it mandates, on reasonable prior notice and subject to confidentiality.
5. Technical and organisational measures
- Encryption in transit: the App, its API and the MCP Server are served over HTTPS.
- Authentication: Shopify session tokens are verified for every App request; App session tokens expire after 2 hours; every Shopify webhook is checked against its HMAC signature.
- MCP tokens: agent tokens are stored only as SHA-256 hashes and can be revoked by the Merchant at any time.
- Store isolation: every query is limited to the store of the authenticated session or MCP token.
- Log hygiene: access tokens and session tokens are not written to application logs, and email addresses are shortened in mail logs.
- Retention limit: Agent Interaction Log records are deleted automatically after 90 days.
- Access control: access to the production server and database is limited to authorised Radrly personnel.
- Hosting: the App, its database and its mail server run on a server in the European Union (see section 6).
6. Sub-processors
The Merchant gives Radrly general written authorisation to engage the sub-processors listed below. Radrly will inform the Merchant of any intended addition or replacement of a sub-processor by email or in the App, giving the Merchant the opportunity to object before the change takes effect. If the Merchant objects, it may stop using the App and uninstall it. Radrly imposes on each sub-processor data protection obligations equivalent to those in this DPA and remains liable to the Merchant for their performance.
| Sub-processor | Purpose | Location |
|---|---|---|
| Contabo GmbH, Munich, Germany | Virtual server hosting the App, its database, its logs and Radrly's own mail server (used to email customer data exports to the Merchant) | Data centre in Lauterbourg, France (EU) |
| OpenAI Ireland Ltd., Dublin, Ireland, and its affiliates | Generating answers in the in-App AI assistant. Customer Data reaches OpenAI only if the Merchant types it into a message to the assistant | EEA and United States (see section 7) |
Radrly also uses OpenAI for Content Audit suggestions and AI Visibility checks. These features send product data and prompts entered by the Merchant, not Customer Data. The store summary that the AI assistant can include contains scores and usage counts, not Customer Data. The App does not send Customer Data from MCP tool calls to OpenAI or to any other AI provider.
Shopify is the platform on which the Merchant runs its store and from which the App reads data. Shopify processes data under its own agreement with the Merchant and is not a sub-processor of Radrly.
7. International transfers
Radrly stores Customer Data in the European Union. Radrly uses the OpenAI API under OpenAI's Data Processing Addendum, which for customers in the EEA is concluded with OpenAI Ireland Ltd. and under which OpenAI transfers data outside the EEA on the basis of the European Commission's Standard Contractual Clauses or an adequacy decision under Art. 45 GDPR. Radrly will not make any other transfer of Customer Data outside the EEA without first updating this DPA and putting in place a transfer mechanism recognised by Chapter V GDPR.
8. Data subject requests
Radrly processes the Shopify privacy webhooks automatically:
customers/data_request: Radrly finds the Agent Interaction Log records that contain the customer's email address, phone number or customer ID and emails a summary to the Merchant's store email address, so that the Merchant can answer the customer.customers/redact: Radrly deletes the Agent Interaction Log records that contain the customer's email address, phone number or customer ID.shop/redact: Radrly deletes all data it holds for the store (section 9).
The Merchant can also export the Agent Interaction Log as a JSON file in the App. For any other request, the Merchant can contact Radrly at the address in section 12, and Radrly will assist without undue delay. If a data subject contacts Radrly directly about Customer Data, Radrly will refer the request to the Merchant.
9. Retention and deletion
- Agent Interaction Log records and the related agent session records are kept for 90 days. Once a day, the App automatically deletes records older than 90 days.
- Uninstall: when the Merchant uninstalls the App, Radrly immediately deletes the Shopify access token, refresh token and storefront token, so the App can no longer read the store.
- Store deletion: when Shopify sends the
shop/redactwebhook (48 hours after uninstall), Radrly immediately deletes all data it holds for the store, including the Agent Interaction Log. - Backups: Radrly takes a database backup before deploying a new version of the App. Backups are stored on the server described in section 6, are accessible only to Radrly and are deleted when they are no longer needed to restore the service. Deleted data can remain in such a backup until the backup is deleted.
10. Personal data breaches
Radrly will notify the Merchant without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting Customer Data. The notification will include, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Radrly will provide further information as it becomes available.
11. Governing law
This DPA is governed by the laws of Poland. The courts competent for Radrly's registered office have jurisdiction over disputes arising from it, without prejudice to mandatory provisions of law.
12. Contact
Radrly sp. z o.o.
ul. Tarczyńska 68, Krakowiany, 05-831 Młochów, Poland
Privacy: privacy@radrly.com
Support: hello@agenticradar.io