Data Processing Addendum

Effective date: 31 July 2026

This Data Processing Addendum (“Addendum”) forms part of the Terms of Service between Slurvo FZ-LLC (“Store Huddle,” “we,” “us”) and the Shopify merchant using Store Huddle (“Merchant”). Where European, UK, or comparable data protection law applies, this Addendum reflects the terms on which Store Huddle processes personal data on the Merchant’s behalf. Terms not defined here have the meaning given in the Privacy Policy.

1. Definitions

Data Protection Laws means all data protection and privacy laws applicable to the processing of personal data under this Addendum, including the GDPR, the UK GDPR, and U.S. state privacy laws such as the CCPA, as applicable.
Merchant Data means personal data that Store Huddle processes on the Merchant’s behalf in connection with the Merchant’s use of Store Huddle.
Security Incident means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Merchant Data.
Sub-processor means a third party engaged by Store Huddle to process Merchant Data in order to provide the service.
The terms “controller,” “processor,” “data subject,” and “processing” have the meanings given in applicable Data Protection Laws.

2. Roles of the Parties

Where Data Protection Laws apply, the Merchant is the controller (or a processor acting for its own upstream controller) of Merchant Data, and Store Huddle is a processor acting on the Merchant’s documented instructions. Those instructions are the Terms of Service, the Merchant’s configuration and use of Store Huddle, and any additional written instructions the Merchant gives us.

For account administration, billing, service security, fraud prevention, and our own legal compliance, Store Huddle acts as an independent controller, as described in the Privacy Policy.

3. Sub-processors

The Merchant authorizes Store Huddle to engage sub-processors to process Merchant Data, including Shopify, Inc., which provides the underlying platform and APIs Store Huddle operates on, and a small number of infrastructure and communications providers that host Store Huddle and deliver transactional email. We impose data protection obligations on each sub-processor that are no less protective than this Addendum, to the extent applicable to the service that sub-processor provides.

We will give reasonable advance notice, generally at least 30 days where practical, before engaging a new sub-processor that will materially change how Merchant Data is processed. If a Merchant reasonably objects to a new sub-processor on data protection grounds, we will work with the Merchant in good faith to address the objection, which may include the Merchant discontinuing the affected feature. A current list of sub-processors is available on request.

4. Security

Store Huddle maintains administrative, technical, and organizational measures designed to protect Merchant Data, as described on our Security page. Personnel authorized to process Merchant Data are bound by confidentiality obligations.

5. Security Incident Notification

If we confirm a Security Incident affecting Merchant Data, we will notify the affected Merchant without undue delay, and in any case within 72 hours of confirming the incident, using the contact information on file. We will provide the information reasonably available to us about the incident and take reasonable steps to contain and investigate it. Notification is not an admission of fault or liability.

6. International Transfers

Store Huddle is operated from the United Arab Emirates, and our sub-processors may process Merchant Data in other countries, including the United States. Where a transfer of personal data requires a safeguard under Data Protection Laws, we rely on an appropriate legal mechanism, such as Standard Contractual Clauses or an equivalent transfer framework, and will provide information about the applicable safeguard on request.

7. Assistance and Data Subject Requests

Considering the nature of our processing, Store Huddle will provide reasonable assistance to help a Merchant respond to data subject requests and to fulfil its obligations relating to data protection impact assessments, to the extent Store Huddle’s systems and information are reasonably able to support that request.

If a data subject contacts Store Huddle directly about their personal data, and the request concerns a Shopify customer, we will generally direct that individual to the Merchant, since the Merchant controls the customer relationship, except where we are legally required to respond directly.

8. Government and Third-Party Requests

Store Huddle does not voluntarily provide government authorities with access to Merchant Data. If we receive a legally binding request for Merchant Data, we will assess its validity, disclose the minimum information reasonably required to comply, and, where legally permitted, notify the affected Merchant before disclosure so that the Merchant can seek a protective order or other remedy.

9. Deletion and Return of Data

On uninstallation or termination, Store Huddle will delete or anonymize Merchant Data within a commercially reasonable period, consistent with Shopify’s mandatory redaction webhooks and the retention terms in the Privacy Policy, except where we are required by law to retain some or all of that data. On written request made before deletion, we will return a copy of Merchant Data where technically feasible.

10. Demonstrating Compliance

On reasonable request, and subject to confidentiality restrictions owed to Store Huddle’s own sub-processors, Store Huddle will make available the information reasonably necessary to demonstrate compliance with this Addendum.

11. Precedence

This Addendum applies only to the extent Data Protection Laws apply to the processing of Merchant Data. If there is a conflict between this Addendum and the Terms of Service regarding the processing of personal data, this Addendum controls.

Annex A: Details of Processing

Subject matter: Store Huddle’s provision of a Shopify-embedded team collaboration service to the Merchant.
Duration: For as long as Store Huddle remains installed on the Merchant’s store, and thereafter until Merchant Data is deleted or anonymized as described in Section 9 above.
Categories of data subjects: The Merchant’s authorized users (staff, managers, and other invited team members) and, where the Merchant attaches Shopify resources to a conversation, the Merchant’s customers.
Categories of personal data: Names, email addresses, workspace roles, messages and files submitted to Store Huddle, and limited order, product, or customer details the Merchant chooses to attach, as described in the Privacy Policy.
Nature and purpose of processing: Hosting, storing, transmitting, and displaying Merchant Data to provide, secure, support, and improve Store Huddle, as instructed by the Merchant through its use of the service.

Contact

To request a countersigned copy of this Addendum for your own compliance records, email support@storehuddle.com with the subject Data Processing Addendum.

Slurvo FZ-LLC
SFFO0050, Compass Building, Al Shohada Road,
Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates
Email: support@storehuddle.com