Draft – pending legal review. Text in [brackets] still has to be completed.

Data processing agreement

Gang Sheet Builder · Last updated 20 October 2026

This agreement forms part of the terms of service between [Bee Creative legal name] ("Processor") and the merchant who installs Gang Sheet Builder ("Controller"). It applies when the Processor processes personal data of the Controller's customers through the app.

1. Subject, purpose and duration

The Processor processes personal data only to provide the app: building gang sheets, saving drafts, adding sheets to the cart and creating print files. Processing lasts while the app is installed, then ends as described in section 8.

2. Data and data subjects

Data subjects: the Controller's customers and storefront visitors who use the builder. Data: uploaded designs and file names, order numbers and order/line item IDs, fingerprints of Shopify customer IDs and of guest browser tokens. No special categories of data are intended to be processed.

3. Instructions

The Processor processes personal data only on the Controller's documented instructions, which are given by installing and configuring the app, unless the law requires otherwise; in that case the Processor informs the Controller first where the law allows.

4. Confidentiality

Everyone authorised to process the data is bound by confidentiality.

5. Security

The Processor applies appropriate technical and organisational measures, including encryption in transit (TLS), encryption of stored personal data (AES-256-GCM) and keyed fingerprints for identifiers, private storage reachable only through short-lived signed links, data minimisation, and access limited to [authorised staff].

6. Sub-processors

The Controller authorises the following sub-processors: Shopify (platform) and Contabo GmbH (hosting and storage, [region]). The Processor will give notice of new sub-processors [30 days] in advance, during which the Controller may object, and imposes data protection obligations on each sub-processor equivalent to this agreement.

7. Assistance and breaches

The Processor helps the Controller respond to data subject requests (customer data requests and deletions sent through Shopify are handled automatically) and with security and impact assessments. The Processor notifies the Controller without undue delay, and within [72 hours], after becoming aware of a personal data breach.

8. Deletion

Personal data is deleted on the retention schedule in the privacy policy. After the app is uninstalled, files are deleted within 48 hours and remaining data when Shopify requests erasure of the shop's data, unless the law requires keeping it.

9. Audits

The Processor makes available the information needed to show compliance with this agreement and allows reasonable audits, [with notice and at the Controller's cost].

10. International transfers

[Describe transfer mechanisms, e.g. standard contractual clauses, where data leaves the EEA/UK.]

11. Governing law

[Governing law and jurisdiction.]