Skip to content

Data Processing Addendum

Effective November 3, 2026

This Data Processing Addendum ("DPA") forms part of the Terms of service between Wells Software Consulting LLC ("Processor", "we") and the merchant using TagGap ("Controller", "you"). It applies to personal data that we process on your behalf when providing TagGap, and takes effect when you install the app. If it conflicts with the Terms, this DPA prevails.

1. Subject matter, duration, nature and purpose

  • Subject matter: reconciling your Shopify orders with purchases reported by analytics and ad platforms you connect.
  • Duration: while TagGap is installed, plus the deletion periods below.
  • Nature: collection from Shopify and connected platforms, storage, matching, scoring, alerting and deletion.
  • Categories of data subjects: your shoppers (only through order records) and your staff who use the app or receive alerts.
  • Categories of personal data: order identifiers, timestamps, values, sales channel and attribution data (landing page URLs, click ids in order attributes); staff alert email addresses. No names, customer emails, phone numbers, postal addresses or IP addresses of shoppers. No special categories of data.

2. Instructions

We process personal data only on your documented instructions: these terms, your configuration of the app, and requests through Shopify. We tell you if we believe an instruction infringes data protection law. We do not sell or share personal data, use it for targeted advertising, or retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing TagGap, and we do not combine it with data from other sources except as needed to provide the Service.

3. Confidentiality and security

Anyone we authorize to process personal data is bound by confidentiality. We maintain appropriate technical and organizational measures, including: encryption in transit (TLS) and at rest (encrypted disks; per-record envelope encryption of access tokens); no public inbound network ports; access restricted to the operator by key-based authentication from a single administrative network; separate test and production environments; data minimization at ingestion; automatic retention limits; encrypted, rotating backups; and logging of administrative actions.

4. Subprocessors

You authorize the subprocessors listed at taggap.com/subprocessors. We impose data protection terms on each that are no less protective than this DPA and remain responsible for them. We give at least 30 days' notice of a new subprocessor; if you object on reasonable data protection grounds and we cannot address it, you may stop using TagGap and uninstall it.

5. Assistance

Taking into account the nature of processing, we help you respond to data subject requests (Shopify's customers/data_request and customers/redact are processed automatically within 30 days), and with security, breach notification, data protection impact assessments and consultations with supervisory authorities.

6. Personal data breaches

We notify you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting your data, with the information you reasonably need to meet your obligations.

7. Deletion and return

On uninstall we stop processing and delete access tokens immediately, and delete all other personal data within 48 hours of Shopify's shop/redact request, except where law requires retention. Backups roll over within 30 days.

8. Audits

We make available information necessary to demonstrate compliance with this DPA, including written answers to reasonable security questionnaires once a year. Where that is insufficient, we allow audits by you or an independent auditor bound by confidentiality, on 30 days' notice, at your cost.

9. International transfers

Personal data is processed in the United States. For transfers of personal data from the EEA, the parties incorporate the EU Standard Contractual Clauses (Commission Decision 2021/914), Module 2 (controller to processor), with: Clause 7 included; Clause 9 option 2 (general authorization, 30 days' notice); Clause 11 optional language omitted; Clauses 17 and 18 governed by and resolved in the courts of Ireland; Annex I as in section 1 above; Annex II as in section 3. For the UK, the UK International Data Transfer Addendum applies; for Switzerland, the SCCs apply with references read as the Swiss FADP.

10. US state privacy laws

Where the CCPA/CPRA or similar US state laws apply, we are your service provider or processor, comply with them, provide the same level of protection they require, and notify you if we can no longer meet our obligations. You may take reasonable steps to stop and remediate unauthorized use.

11. Contact

Wells Software Consulting LLC · privacy@taggap.com