Data Processing Agreement
Yolkii · Last updated 31 July 2026
This Data Processing Agreement ("DPA") supplements the Terms of Service between Yolkii ("Processor") and the merchant using the Yolkii Shopify app ("Controller"). It governs the processing of end-customer personal data received via the Shopify integration.
1. Definitions
Terms not defined here have the meanings given in the General Data Protection Regulation (EU) 2016/679 (GDPR). "Personal data" means any information relating to an identified or identifiable natural person. "Data subject" means an end customer of the Controller.
2. Subject matter and duration
Yolkii processes personal data on behalf of the Controller for the duration of the Controller's use of Yolkii, plus applicable retention periods described in our Data Retention Summary.
3. Nature and purpose of processing
Fulfilment of Shopify orders — matching orders to production jobs, generating shipping labels, tracking dispatch status, and writing fulfilment updates back to Shopify.
4. Categories of data subjects and personal data
- Data subjects: Controller's end customers who place orders on the Controller's Shopify store.
- Personal data: name, email address, phone number, shipping address, order details, and any customer notes provided at checkout.
5. Yolkii's obligations as Processor
Yolkii will:
- Process personal data only on documented instructions from the Controller (including through the Shopify integration).
- Ensure staff authorised to process personal data are bound by confidentiality obligations.
- Implement appropriate technical and organisational security measures (see Section 8).
- Assist the Controller in responding to data subject requests to the extent technically feasible.
- Notify the Controller without undue delay after becoming aware of a personal data breach.
- Delete or return personal data at the end of the processing relationship per the retention policy.
- Make available all information necessary to demonstrate compliance with these obligations.
6. Sub-processors
Yolkii uses the following sub-processors:
- Supabase — database and backend hosting (Tokyo, Japan).
- Fly.io — Shopify app connector hosting (Sydney, Australia).
- Vercel — web application hosting (Washington, United States).
- Starshippit — carrier consignment platform (Sydney, Australia).
Yolkii will provide 30 days' notice of any new sub-processor. The Controller may object to a new sub-processor by terminating the Terms of Service.
8. Security measures
- Encryption at rest (AES-256 storage layer) and in transit (TLS 1.2+).
- Additional application-layer AES-GCM encryption on Shopify access tokens.
- Row-level security policies restricting data access to authorised users.
- Service-role credentials stored in Supabase secrets, never in source code.
- Automated compliance audit log recording all personal data access and redaction events.
- Regular security review of edge functions and RLS policies.
9. Assistance with data subject rights
Yolkii honours Shopify's compliance webhooks (customers/redact, customers/data_request, shop/redact) as the standard mechanism for assisting the Controller with data subject rights. Direct requests to Yolkii will be forwarded to the Controller for verification and instruction.
10. Data breach notification
In the event of a personal data breach, Yolkii will notify the Controller without undue delay and within 72 hours of becoming aware, providing (to the extent known): the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address it.
11. Return or deletion at end of processing
On termination of the Terms of Service and at the Controller's election, Yolkii will export personal data for return, then delete or redact it per the Data Retention Summary.
12. Audit rights
The Controller may request reasonable evidence of Yolkii's compliance with this DPA, including sub-processor lists and summaries of security controls. Formal on-site audits require reasonable notice and are at the Controller's expense.