Version 1.0
Effective November 15, 2026
This Data Processing Addendum (DPA) forms part of the agreement between Vencru Inc. (Vencru) and the customer (Customer) for Vencru’s services (Agreement). The Agreement includes the Vencru Terms of Service or another written services agreement between the parties. This DPA applies from November 15, 2026, or the date it becomes part of the Agreement, whichever is later.
Vencru Inc. is a Canadian corporation. Its mailing address is 246 Stewart Green SW, Unit #6043, Calgary, Alberta T3H 3C8, Canada. Contact Vencru about this DPA at privacy@vencru.com.
Terms such as controller, processor, service provider, sell, and share have the meanings given by applicable Data Protection Law.
2.1 Vencru acts as a processor or service provider when it processes Customer Personal Data. The Customer acts as a controller or business, or as a processor acting for another controller. If the Customer acts as a processor, it confirms it has authority to appoint Vencru as its subprocessor and to give the instructions in the Agreement.
2.2 Where Vencru determines the purposes and means of processing for its own account administration, billing, or other purposes, it acts as a controller. The Vencru Privacy Policy describes that processing.
2.3 Annex 1 describes the processing covered by this DPA. Annex 4 applies to Vencru’s Shopify app.
The Customer will provide lawful instructions, give any required notices, and obtain any permissions or consents required to use the services. The Customer is responsible for the accuracy of the data and instructions it provides and for observing the Agreement’s restrictions on the data it may submit.
4.1 Vencru will process Customer Personal Data only on the Customer’s documented instructions, including for international transfers, unless applicable law requires otherwise. The Agreement, this DPA, the Customer’s service settings, and any further lawful instructions agreed by the parties document those instructions. If law requires other processing, Vencru will inform the Customer before processing unless the law prohibits that notice. Vencru will promptly inform the Customer if it believes an instruction violates applicable Data Protection Law.
4.2 Vencru will use Customer Personal Data for the specific purposes in Annex 1. Vencru will not sell or share it, use it for targeted or cross-context behavioral advertising, or use it to market Vencru’s services to the Customer’s customers. Vencru will not profile the Customer’s customers or make automated decisions about them that have legal or similarly significant effects. Vencru may send invoices, receipts, statements, and payment reminders on the Customer’s instructions, subject to applicable law and platform rules.
4.3 Vencru will limit access to authorized personnel with a work need and require them to protect the confidentiality of Customer Personal Data. Vencru will maintain the safeguards in Annex 2.
4.4 The following obligations apply to Customer Personal Data subject to the CCPA or similar US state privacy laws.
Vencru certifies that it understands and will comply with these restrictions.
5.1 The Customer generally authorizes Vencru to engage the Subprocessors in Annex 3. Vencru will keep the list in Annex 3 current. The same requirements apply to a Vencru affiliate that processes Customer Personal Data on Vencru’s behalf.
5.2 Vencru will email the Customer’s account contact at least 30 days before adding or replacing a Subprocessor that will process Customer Personal Data. The Customer may object during that period on reasonable data protection grounds. The parties will work in good faith to resolve the objection. If they cannot resolve it, the Customer may end the affected service under the Agreement. This section is subject to any stricter notice or authorization rules that apply to the processing.
5.3 Vencru will impose materially equivalent data protection obligations on its Subprocessors by written agreement, including the applicable obligations in Annex 4. Vencru remains responsible to the Customer for its Subprocessors’ performance of those obligations.
6.1 Taking into account the nature of the processing, Vencru will use appropriate measures to help the Customer respond to individuals’ requests to exercise their rights. If Vencru receives a request about Customer Personal Data directly, Vencru will direct it to the Customer and assist the Customer with the response, subject to applicable law.
6.2 Taking into account the nature of the processing and the information available to it, Vencru will help the Customer meet its duties for security, breach notification, data protection impact assessments, and prior consultations with regulators. This includes assistance with Articles 32 through 36 of the EU GDPR or their equivalents where applicable.
7.1 Vencru will notify the Customer without undue delay after becoming aware of a Security Incident. Vencru will send the initial notice to the account contact and provide further details as they become available.
7.2 Vencru will take reasonable steps to contain and address the incident. The notice will include the information available about the nature of the incident, affected data and individuals, likely consequences, and actions taken or planned. Vencru will assist the Customer with any required notifications.
7.3 The separate notification rule for Shopify Data is in Annex 4.
8.1 During the Agreement, the Customer may use the service’s export tools or contact privacy@vencru.com to request a copy of its Customer Personal Data in a commonly used, machine-readable format.
8.2 At the end of the services involving processing, the Customer may choose return followed by deletion or deletion by contacting Vencru at that address. Vencru will carry out the chosen action without undue delay. If the Customer gives no instructions, Vencru will provide a reasonable opportunity to request return and then delete Customer Personal Data. This section yields to a shorter deadline that applies under law or Annex 4.
8.3 Vencru will delete remaining copies, including copies held by its Subprocessors, except to the extent applicable law requires storage. Vencru will isolate any legally retained data, restrict access and use to the required purpose, and delete it when the requirement ends.
8.4 Where permitted by the applicable deletion rules, residual copies in backups remain protected and isolated from routine use until they expire under the backup schedule. Vencru will reapply required deletions before restored data returns to ordinary use.
Vencru will make available information reasonably needed to demonstrate compliance with this DPA and applicable processor obligations. Where practical, the Customer will first review available compliance materials. Vencru will allow and contribute to audits and inspections by the Customer or its appointed auditor. The parties will coordinate reasonable scope, confidentiality, timing, and safeguards for other customers’ data.
The Customer may conduct one routine audit in any 12-month period at its own expense with at least 30 days’ written notice. These routine limits do not apply where a Security Incident, a regulator’s requirement, or applicable law makes a different arrangement reasonably necessary. This section preserves mandatory audit and oversight rights.
10.1 Vencru may process Customer Personal Data in Canada and in the countries listed in Annex 3, subject to applicable law, the Customer’s documented instructions, and the safeguards required for the transfer. Remote access by a separate entity is subject to the same assessment where it constitutes a restricted transfer.
10.2 If an adequacy decision covers the transfer, the parties may rely on it. If a restricted transfer requires another safeguard, the relevant parties will put an applicable safeguard in place before the transfer. Where required, they will execute the relevant EU Standard Contractual Clauses, UK International Data Transfer Addendum or Agreement, or Swiss provisions, with their completed annexes. Vencru will apply the same requirement to relevant onward transfers by its Subprocessors and affiliates.
10.3 Any mandatory transfer clauses that apply take precedence over this DPA and the Agreement to the extent of a conflict.
11.1 As between Vencru and the Customer, the Agreement’s liability provisions, including any applicable cap and exclusions, apply to claims under this DPA, including claims under Annex 4. This section is subject to applicable law, mandatory transfer clauses, and binding Shopify requirements.
11.2 This DPA takes precedence over the Agreement on matters involving the processing and protection of Customer Personal Data. Annex 4 takes precedence on matters involving Vencru’s handling of Shopify Data, subject to Section 11.1.
This DPA applies for as long as Vencru processes Customer Personal Data under the Agreement. Vencru will notify the Customer of material updates in accordance with the Agreement and applicable law. The obligations that apply to retained data continue until that data is deleted or returned as required.
| Item | Description |
|---|---|
| Parties | The Customer identified in the Agreement and Vencru Inc. |
| Subject matter and nature | Receiving, hosting, organizing, reconciling, retrieving, displaying, exporting, and deleting business records, including records from integrations the Customer connects |
| Business purposes | Maintaining the Customer’s books, invoices, receipts, payments, stock, and reports. Sending documents the Customer directs. Supporting the service, securing Customer Personal Data, and helping answer privacy requests |
| People whose data may be processed | The Customer’s customers, suppliers, other business contacts, staff, and authorized users |
| Types of data | Names, contact details, account and platform identifiers, transactions, invoice and payment details, and notes or documents supplied by the Customer or its connected integrations |
| Duration | The period needed to provide the services and complete return or deletion under Section 8 and Annex 4 |
| Restricted data | The restrictions in the Agreement apply to sensitive data and other restricted categories |
Vencru will maintain technical and organizational safeguards appropriate to the risks of the processing.
Vencru reviews and may update these measures without reducing the overall level of protection. Additional information needed for an audit or applicable transfer agreement is available under Sections 9 and 10.
| Subprocessor | Service | Processing country |
|---|---|---|
| Amazon Web Services, Inc. | Hosting, database services, and email delivery through Amazon SES | United States |
| Vercel Inc. | Hosting and serving the Shopify app interface | United States |
| Functional Software, Inc. (Sentry) | Error monitoring and diagnostics | United States |
| Vencru Nigeria Ltd | Engineering and support when authorized under Sections 5 and 10 | Nigeria |
Vencru processes store, order, payment, refund, payout, and inventory data to connect the Customer’s store and maintain its books and reports. Where Shopify grants access, order records can include the buyer’s Shopify identifier, name, and email. Vencru may also process merchant and staff identifiers for account access, notes that contain personal data, and contact or order information supplied through Shopify’s privacy requests. Shopify events can contain additional fields, including when an event must be held for troubleshooting. Vencru limits the processing of those fields to what is necessary for the app and its compliance obligations.
Vencru will process Shopify Data only as permitted by Shopify’s terms and applicable law. Vencru will maintain the applicable Shopify safeguards for protected customer data. Vencru will not use Shopify Data or data derived from it to train, fine-tune, or improve AI or machine learning models or permit its providers to do so.
Vencru will complete Shopify’s mandatory privacy requests within the time limits Shopify sets, currently 30 days from receipt, subject to any earlier applicable deadline or legal retention requirement. Vencru will provide requested customer data to the verified merchant through a secure channel so the merchant can respond. For a valid deletion request, Vencru will delete or redact the affected data across the app and connected records, subject to a specific legal obligation to retain it. Where law requires information to be retained on issued records, Vencru will restrict that information to the required purpose and remove it when the obligation ends. The retention of an issued document does not extend to a live contact record unless a separate lawful requirement applies.
Vencru will delete Shopify Data within the time limits set by the Shopify API Terms, including within 30 days from the date of uninstall, unless applicable law prohibits or varies deletion. The Customer may export its books before disconnecting the app. The Customer’s separate Vencru account remains subject to the Agreement.
Where applicable law requires specific records to be kept, Vencru will retain only the records and fields covered by that requirement, for the required period and purpose. Records independently supplied by the Customer remain subject to the Agreement and Section 8. If Vencru cannot comply with Shopify’s deletion requirement, it will promptly notify Shopify as required by the Shopify API Terms.
Vencru will notify Shopify immediately and within 24 hours after becoming aware of an actual or suspected breach or compromise of Shopify Merchant Data, including data that is not personal data. Vencru will also notify the Customer without undue delay and provide updates as more information becomes available.
As between Vencru and Shopify, Vencru is solely responsible for providing, operating, and supporting the app and for liability arising from the Customer’s access to or use of the app or Vencru’s handling of Shopify Data. Shopify is not responsible for faults in the app or harm from installing or using it. Except where Shopify expressly states otherwise, the Customer should direct questions about app installation, use, or support to Vencru.
