NDA Signal
Data processing agreement
Last updated: August 2026
This agreement applies between NDA Signal (the processor) and the merchant who installs the application (the controller). It takes effect on installation and remains in force while the app is installed.
1. Subject matter
The processor delivers conversion events, and the identifiers attached to them, from the controller's Shopify store to the advertising platforms the controller has connected.
2. Instructions
The processor acts only on the controller's documented instructions. Connecting a platform in the application is such an instruction. The processor will not process the data for any other purpose, including its own.
3. Categories of data and data subjects
Data subjects: visitors to and customers of the controller's store.
Categories: contact identifiers (email, phone, name, address), technical
identifiers (IP address, user agent, advertising click identifiers), and
transaction data (order value, currency, items, order status). No special
categories of data under Article 9 GDPR are processed.
4. Confidentiality
Everyone with access to the data is bound by confidentiality obligations. Access is granted only where it is needed to operate or support the service.
5. Security measures
- TLS in transit, encryption at rest for access tokens and credentials.
- SHA-256 hashing of personal fields before storage and before transmission.
- Strict per-store isolation at the data layer.
- Access logging, with automatic pruning of old log entries.
- Webhook signature verification on every inbound request from Shopify.
6. Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Compute, storage, queues, network | Global |
| Meta Platforms, Inc. | Conversion delivery, where connected | Global |
| TikTok Technology Ltd. | Conversion delivery, where connected | Global |
| Google LLC | Conversion delivery, where connected | Global |
The processor will give the controller notice before adding a sub-processor, and the controller may object.
7. International transfers
Transfers outside the EEA rely on the European Commission's standard contractual clauses, as incorporated in each sub-processor's own data processing terms.
8. Assistance to the controller
The processor will assist the controller in responding to data subject requests, in carrying out data protection impact assessments, and in notifying personal data breaches.
9. Breach notification
The processor will notify the controller without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting the controller's data, including what is known about its nature, likely consequences and the measures taken.
10. Deletion and return
On uninstall, or on written request, all personal data belonging to the controller is deleted within 30 days, except where retention is required by law. Shopify's mandatory redaction webhooks are honoured on receipt.
11. Audit
The processor will make available the information needed to demonstrate compliance with this agreement and will accept an audit, on reasonable notice and no more than once per year, unless a supervisory authority requires otherwise.