Auftragsverarbeitungsvertrag

Data Processing Agreement (DPA) — Caravel Suite

Translation; in case of discrepancy the Portuguese version prevails.

Version 1.0 · 30/10/2026

Parties

1. The Merchant — the natural or legal person who owns the Shopify store that installs one or more of the Applications below, identified by the details of its Shopify account and its store, acting as Controller (Art. 4(7) GDPR).
2. Jardim Idílico Unipessoal, Lda., operating under the brand Caravel Suite, NIF PT518764532, with registered office at Rua da Póvoa, n.º 775, Fração L, Zona Industrial de Amorim, 4495-121 Póvoa de Varzim, Portugal, contact caravel@caravelsuite.com, acting as Processor (Art. 4(8) and Art. 28 GDPR) — hereinafter "Caravel Suite".

Clause 1 — Subject matter and scope

1. This DPA governs the processing of personal data that Caravel Suite carries out on behalf of the Merchant when providing the Shopify applications Caravel Invoice PT, Caravel Track, Caravel Reviews and Caravel Packing Slips ("Applications"), and applies only to the Applications that the Merchant has installed.
2. This DPA forms an integral part of the Terms of Service of each Application. By installing or continuing to use an Application, the Merchant accepts the Terms and, together with them, this DPA. The Terms of each Application refer to this document.
3. Data relating to the business relationship with the Merchant itself (account, billing, support) is processed by Caravel Suite as controller and is governed by the Privacy Policy of caravelsuite.com, not by this DPA.

Clause 2 — Duration

Processing begins upon installation of the Application and lasts for as long as it remains installed, plus the time strictly necessary for the erasure provided for in Clause 10.

Clause 3 — Nature, purpose, categories of data and of data subjects

1. Data subjects: customers (buyers) of the Merchant's store; in administration sessions, also the Merchant's users (staff) who open the Application in the Shopify admin.
2. Nature and purpose by Application — see Annex I.
3. The Applications are not intended to process special categories of data (Art. 9) or data relating to criminal convictions (Art. 10) and do not request them. If a buyer includes them on their own initiative in the free text or photograph of a review, the Merchant may withhold or delete it using the moderation tools of Caravel Reviews.
4. Obligations and rights of the Merchant. The Merchant: (a) warrants that it has a lawful basis for the processing and that it informs buyers (including about the Applications it uses); (b) gives lawful instructions; (c) contracts and directly manages its own services that it connects to the Applications; (d) has the right to give instructions, to obtain the information referred to in Clause 11 and to request the erasure or export of the data under the terms of this DPA.

Clause 4 — Documented instructions

1. Caravel Suite processes the data only on documented instructions from the Merchant, including with regard to transfers to third countries, unless required to do so by Union or Portuguese law; in such a case it informs the Merchant of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
2. The following are documented instructions: (a) this DPA and the Terms; (b) the installation, configuration and use of the Applications by the Merchant (including the credentials for the Merchant's own services that it enters, such as InvoiceXpress, email provider or tracking service); (c) the privacy requests received through Shopify's mandatory webhooks (customers/data_request, customers/redact, shop/redact); (d) written instructions sent to caravel@caravelsuite.com.
3. Caravel Suite immediately informs the Merchant if it considers that an instruction infringes the GDPR or other Union or Portuguese data protection provisions.

Clause 5 — Confidentiality

Only persons authorised by Caravel Suite who need access in order to provide, maintain or support the Applications have access to the data, and all of them are subject to a contractual or statutory duty of confidentiality. Currently the only person with access is the managing director. The automated maintenance and development tools operate under the managing director's account and responsibility and, under an internal rule, do not query the databases or the key files of the Applications in production.

Clause 6 — Security of processing (Art. 32)

Caravel Suite adopts all measures required under Art. 32, including the technical and organisational measures in Annex II, which describe only controls that are in operation. It may update them with equivalent or better measures, provided that the overall level of security remains appropriate to the risk.

Clause 7 — Sub-processors

1. The Merchant gives general written authorisation for Caravel Suite to engage the sub-processors listed in Annex III.
2. Before adding or replacing a sub-processor, Caravel Suite updates Annex III at caravelsuite.com/legal/dpa/ and notifies the Merchant by email (Shopify account address) at least 30 days in advance. The Merchant may object in writing within that period on reasonable data protection grounds; failing agreement, it may uninstall the Application without penalty, and paid subscriptions end in accordance with Shopify's terms. Urgency exception: if the replacement is necessary to protect the data or to maintain the service (for example, a serious failure or security incident at a supplier), Caravel Suite may make it immediately and notifies the Merchant as soon as possible, the right to object and to uninstall without penalty being maintained.
3. Caravel Suite imposes on each sub-processor, by contract (including those suppliers' data processing agreements), the same data protection obligations as in this DPA, in particular the obligation to provide sufficient guarantees of appropriate technical and organisational measures (Art. 28(4)), and remains fully liable to the Merchant for their performance.
4. The following are not sub-processors of Caravel Suite: the services that the Merchant contracts and connects to the Applications with its own credentials (Annex I, column "Merchant's own services"): those suppliers process the data on behalf of the Merchant, under the Merchant's contracts. Shopify is the Merchant's own platform.

Clause 8 — Assistance to the Merchant

1. Data subject rights (Arts. 12 to 22): taking into account the nature of the processing, Caravel Suite assists the Merchant, by appropriate technical and organisational measures, in responding to all requests for the exercise of rights (information, access, rectification, erasure, restriction, portability and objection). In particular, the Applications automatically respond to Shopify's requests: customers/data_request generates, in Invoice PT, Track and Reviews, an encrypted export that the Merchant downloads from the Application's dashboard (available for 30 days; Packing Slips does not store buyer data); customers/redact deletes or anonymises that buyer's data; shop/redact deletes the store's data. Rectifications and other requests not covered by the webhooks are handled at the Merchant's request to caravel@caravelsuite.com. If a data subject contacts Caravel Suite directly, the request is forwarded to the Merchant within 5 business days and is not answered directly, unless instructed by the Merchant or required by law.
2. Arts. 32 to 36: taking into account the nature of the processing and the information available to it, Caravel Suite assists the Merchant in complying with the obligations relating to security, notification of breaches, impact assessments and prior consultation concerning the Applications.

Clause 9 — Personal data breaches

1. Caravel Suite notifies the Merchant without undue delay and, in any event, within 24 hours at the latest after becoming aware of a personal data breach affecting data processed on its behalf, by email to the Shopify account address.
2. The notification includes, to the extent known (being supplemented in phases): the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and the contact point for further information (caravel@caravelsuite.com).
3. Notification to the CNPD and to data subjects (Arts. 33 and 34) is the responsibility of the Merchant as controller; Caravel Suite provides it with the necessary information. The internal procedure is set out in Caravel Suite's Security Incident Response Policy, available on request.

Clause 10 — End of processing: erasure, return and retention

1. Merchant's choice (Art. 28(3)(g)): before uninstalling, the Merchant may obtain the return of the data by exporting what each Application makes available in the dashboard or by requesting it at caravel@caravelsuite.com until receipt of the shop/redact; by uninstalling without doing so, it chooses erasure.
2. Upon uninstalling an Application: store access sessions are deleted immediately and the Application stops processing new data from that store (pending jobs are cancelled). The remaining store data is deleted when Shopify sends the shop/redact request (Shopify sends it 48 hours after uninstallation). In Caravel Invoice PT, if for any reason the shop/redact request does not arrive, the data is purged no later than 30 days after uninstallation.
3. During use, the retention periods are those in Annex I.
4. Backups: deleted data disappears from the encrypted backups at the end of the backup retention cycle (up to 5 weeks: 14 daily + 4 weekly backups). Backups are not used for any purpose other than restoring the service.
5. This is without prejudice to retention required by EU or Portuguese law (for example, minimal records of compliance with privacy requests, without personal data in clear text).

Clause 11 — Demonstration of compliance and audits

1. Caravel Suite makes available to the Merchant all information necessary to demonstrate compliance with Art. 28 (in particular this DPA, the measures in Annex II, the Incident Response Policy and the Data Loss Prevention Strategy) and allows for and contributes to audits, including inspections, conducted by the Merchant, by an auditor mandated by it or by a supervisory authority.
2. If the information is not sufficient, the Merchant (or an auditor mandated by it, subject to confidentiality) may carry out an audit no more than once a year (except in the case of a data breach or a request from a supervisory authority, which are not subject to this limit), with 30 days' prior notice, on business days, without access to data of other merchants or to trade secrets, and at the Merchant's expense, unless it reveals material non-compliance by Caravel Suite.

Clause 12 — International transfers

1. The data is hosted on servers in the European Union (France) and in the United Kingdom (Annex III). The United Kingdom benefits from an adequacy decision of the European Commission (Art. 45).
2. Any transfer outside the EEA or a country with an adequacy decision only takes place with appropriate safeguards under Chapter V GDPR — an adequacy decision (including the EU-US Data Privacy Framework, for certified entities) or Standard Contractual Clauses of the European Commission (Art. 46(2)(c)) — and is indicated in Annex III.

Clause 13 — Liability, precedence, governing law and jurisdiction

1. The liability of each party is governed by Art. 82 GDPR and, between the parties, by the limitations of the Terms of Service to the extent permitted by law; no limitation affects the rights of data subjects.
2. In the event of conflict between this DPA and the Terms, this DPA prevails as regards the protection of personal data.
3. Portuguese law. Jurisdiction: the courts of the district (comarca) of Porto, without prejudice to mandatory rules.
4. Caravel Suite may update this DPA to reflect changes in the law or in the services; the changes maintain an overall level of protection appropriate to the risk, and material changes are notified by email 30 days in advance.

---

Annex I — Description of the processing by Application

Annex II — Technical and organisational measures in operation

1. Encryption in transit. All connections to external services use HTTPS/TLS (Shopify Admin API, InvoiceXpress, VIES, Postmark, Resend, 17TRACK, TrackingMore, AI provider — the latter is only accepted with an https URL and without redirects); the Merchant's own SMTP only with implicit TLS (port 465). The Applications listen only on 127.0.0.1 and are published only over HTTPS.
2. Field-level encryption at rest. Stored personal data is encrypted in the database with AES-256-GCM (random 96-bit nonce, authentication of the field name), with a key derived by HKDF-SHA256 from the Application's master key, which is never stored in the database or in the code: sessions (token and user data) in all 4 Applications; in Reviews, the buyer's email and name, review title and text, and photographs; in Track, transport events; privacy exports (Invoice PT, Track and Reviews; Packing Slips does not store exports). The credentials for the Merchant's services (InvoiceXpress, email, tracking) are also encrypted with AES-256-GCM. Emails used for lookup are stored only as HMAC-SHA256.
3. Minimisation. Invoice PT does not store the buyer's name, NIF, address or email; Packing Slips does not store buyer data; Track does not store the email in clear text. Each Application requests from Shopify only the scopes it needs (read-only).
4. Encrypted backups. Automatic daily backup (03:20 UTC) of the Applications' databases with restic, encrypted on the source server before leaving it (AES-256 + Poly1305), sent via SFTP/SSH to another server in another country (France). Retention: 14 daily + 4 weekly. Integrity verified on each backup; automatic weekly restore test with the result logged. The backup key is not on the destination server.
5. Logs without personal data. The Applications' logs automatically remove fields such as email, telephone, address, name, NIF, tokens and secrets; the server's HTTP request log is disabled (URLs could contain identifiers).
6. Access control. Access to the servers only by SSH key (password disabled), firewall active on the Applications' server, databases not exposed to the network. Shopify webhooks verified by HMAC. Access limited to the managing director.
7. Separation of test data. Development and testing use synthetic data and a dedicated development store; automated tests block real network connections.
8. Access log. Each Application logs who (Shopify user id, from the session token signed by Shopify), when and which dashboard page was opened, without storing the content or parameters; kept for 365 days and deleted together with the store.
9. Automatic erasure and retention in accordance with Annex I, carried out by periodic tasks of the Applications.
10. Incident response in accordance with the Security Incident Response Policy (notification to Shopify and to the Merchant within 24 hours, incident register, review).

Annex III — Sub-processors

Infrastructure as at the date of this version. The move to the definitive production hosting will be notified in accordance with Clause 7 before it comes into operation.