Data Processing Addendum

Last updated: April 4, 2026

Version 1.1 · Effective date: April 4, 2026 · GDPR Art. 28

This Data Processing Agreement ("DPA") is entered into between:

• Data Controller: The Merchant (Shopify store owner) who has installed the SafeRadar AI application ("you" / "Merchant").
• Data Processor: Radrly sp. z o.o., operating as SafeRadar AI, registered in Poland, providing the SafeRadar AI EU Compliance application ("we" / "us").

This DPA forms part of the SafeRadar AI Terms of Service and applies whenever SafeRadar AI processes personal data on behalf of the Merchant in connection with the SafeRadar AI service. For full Terms of Service, visit saferadar.radrly.com/terms-of-service.

Terms used in this DPA have the meanings given in Regulation (EU) 2016/679 (GDPR). In particular:

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on Personal Data.
• "Data Subject" means the individual to whom Personal Data relates (typically the Merchant's end customers).

SafeRadar AI processes Personal Data solely for the purpose of providing the SafeRadar AI services described in the Terms of Service, including:

• Processing and storing consumer withdrawal requests (EU Consumer Rights Directive 2011/83/EU).
• Sending transactional emails to consumers and merchants relating to withdrawal requests.
• Generating optional AI-assisted insights (AI Summary) and AI Support Chat for merchants.

Processing will continue for the duration of the Merchant's subscription to SafeRadar AI, unless terminated earlier.

SafeRadar AI shall:

1. Process Personal Data only on documented instructions from the Merchant (as defined by use of the Service).
2. Ensure that persons authorised to process the Personal Data are bound by appropriate confidentiality obligations.
3. Implement appropriate technical and organisational measures (Article 32 GDPR) to protect Personal Data.
4. Not engage sub-processors without prior written consent of the Merchant, except as listed in Annex A.
5. Assist the Merchant in responding to Data Subject rights requests to the extent technically feasible.
6. Assist the Merchant in ensuring compliance with Articles 32–36 GDPR (security, breach notification, DPIAs).
7. At the choice of the Merchant, delete or return all Personal Data upon termination of the service.
8. Make available all information necessary to demonstrate compliance with this DPA and permit audits conducted by or on behalf of the Merchant.

SafeRadar AI has implemented the following security measures (Article 32 GDPR):

• Encryption in transit: All data transmitted between the Merchant, consumers, and SafeRadar AI infrastructure uses TLS 1.2+ (HTTPS).
• Encryption at rest: Database-level encryption via Supabase (AES-256).
• Access control: Role-based access controls; production data accessible only to authorised personnel.
• Data minimisation: Only data strictly necessary for the Service is collected and stored.
• Pseudonymisation: Internal identifiers are used where possible instead of directly identifying data.
• Audit logging: All access and modifications to withdrawal request data are logged.
• Incident response: Data breach notification to the Merchant within 72 hours of becoming aware of a breach.

The Merchant hereby grants general written authorisation for SafeRadar AI to engage the following sub-processors. SafeRadar AI will notify the Merchant of any intended changes (addition or replacement of sub-processors) with reasonable notice to allow the Merchant to object.

Where the AI Summary feature is used, SafeRadar AI sends only the minimum information needed to generate the requested output. The Merchant remains responsible for deciding whether to rely on AI-generated output and for reviewing the underlying request records.

Where sub-processors are located outside the EEA (e.g., USA), SafeRadar AI ensures that appropriate safeguards are in place for the transfer of Personal Data, including:

• Standard Contractual Clauses (SCCs) adopted by the European Commission (2021/914/EU).
• Transfer Impact Assessments (TIAs) where required.

SafeRadar AI supports the Merchant in fulfilling Data Subject rights requests. Upon request,SafeRadar AI will:

• Provide an export of all Personal Data held about a specific consumer (right of access, Art. 15).
• Delete all Personal Data relating to a specific consumer (right of erasure, Art. 17), subject to legal retention obligations.
• Correct inaccurate Personal Data (right of rectification, Art. 16).

Shopify mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact) are processed automatically by SafeRadar AI within the timeframes required by Shopify's Partner Programme.

In the event of a Personal Data breach (Article 33 GDPR), SafeRadar AI will notify the Merchant without undue delay and no later than 72 hours after becoming aware of the breach. The notification will include:

• A description of the nature of the breach.
• Categories and approximate number of Data Subjects and records affected.
• Likely consequences of the breach.
• Measures taken or proposed to address the breach.

• Withdrawal request records: retained for 5 years from submission date (EU audit obligation — Directive 2011/83/EU).
• Email customization settings and merchant configuration: retained for the duration of the subscription, deleted within 30 days of app uninstallation.
• Transactional email logs: retained for 90 days for delivery verification and customer support.
• API logs and audit trails: retained for 12 months for security and debugging purposes.
• Store and merchant account data: deleted within 30 days of app uninstallation.
• All store data: permanently deleted within 30 days of receiving a verified shop/redact webhook.

This DPA is governed by the laws of the Republic of Poland, which is an EU Member State subject to GDPR. Any disputes shall be subject to the exclusive jurisdiction of the courts of Poland.

For questions about this DPA or to exercise your rights, contact us: