Data processing agreement — Shopify age verification

Data processing agreement — EUDI Wallet Age Verification Proposed version: 2026-10-30-v1 1. Parties, effect and scope The provider is WEB3 DIGITAL WALLET, SAS, French company number 910 399 435, 112 rue des Tuileries, 28260 Saint-Ouen-Marchefroy, France, contact@talao.io. The merchant is the entity operating the store identified at acceptance through its authenticated Shopify session; the accepting person declares authority to bind it. This agreement takes effect after the provider approves its text and the merchant explicitly accepts it, for the duration of the hosted service. Supplying source code does not mean the provider operates a self-hosted instance. For the described operations, the merchant is controller and the provider processor. The provider’s own security/service administration purposes and Shopify’s independent processing are separate. 2. Instructions and merchant responsibilities Documented instructions cover installation, OIDC client and restricted-product configuration, customer-initiated age verification, daily authorization writing/checking, optional manual review, maintenance and assistance with rights. The provider processes data only for these instructions or an applicable obligation and alerts the merchant to instructions it considers contrary to data protection rules. The merchant determines purpose, legal basis, sales restrictions and customer information. The service does not guarantee compliance of every use or that the wallet holder legally owns the Shopify account. The app and its merchants’ bridge use are Free at launch; no paid plan or external fee is activated before Shopify billing and corresponding contractual information are in place. Manual review is off per store until the merchant enables it and acknowledges responsibility. If enabled, the merchant checks the queue each business day, hears the request or challenge, performs appropriate checks and personally provides a reasoned answer. Age is approved only after real examination. No automatic email alert is sent. The provider supplies the mechanism and does not decide on the merchant’s behalf. Disabling intake does not remove the duty to handle received cases. A request grants no access; approval grants a merchant authorization for the store day, not a wallet proof. 3. People and data Data subjects include customers/journey users, merchant representatives and people covered by rights webhooks. Categories include store/customer IDs, settings, technical credentials, temporary bindings, the 18+ result/date, rights and optional review cases, and acceptance receipts. The service notice describes processing and retention and forms part of the operational description. The manual form requests no files or identity documents. The provider does not sell these data or reuse them for advertising or AI training. 4. Confidentiality and security Authorized persons are bound by confidentiality, have only necessary access and lose access when no longer needed. The service administrator at this version date is Thierry Thevenet. AWS and Shopify’s own access is governed by their respective frameworks. Measures include HTTPS, encrypted connector payloads/backups, store isolation, CSRF/callback protections and server-side secrets. The provider commits to checking backup/cleanup alerts and results each business day, following up failed runs and reviewing administrative access monthly. The connector’s private recovery key stays off the server. Checks and corrective actions are documented without unnecessary customer data. A decryption/integrity test is not presented as a full service restore. 5. Hosting and subprocessors The provider operates the connector, bridge and Hub on AWS Paris. The merchant authorizes AWS hosting under the applicable AWS contractual framework, including its data processing agreement and transfer safeguards. The identified AWS entity is Amazon Web Services EMEA SARL, French branch. Shopify operates separately under the merchant’s platform contract. No other recipient service provider is planned for this journey. At least thirty days before adding or replacing a subprocessor, the provider gives written notice identifying its role, location and safeguards. The merchant may send a reasoned objection to contact@talao.io within that period. A disputed change is not applied to its data before resolution; if no solution is found, the parties arrange termination of the affected service and return or erasure. Subprocessors must provide equivalent contractual protection; the provider remains responsible to the merchant for their processing within this scope. French hosting does not guarantee the absence of access or transfers outside the EEA. Transfers follow documented instructions and applicable safeguards; a legal duty preventing notice is handled under that duty. 6. Rights, incidents and audits Thierry Thevenet monitors contact@talao.io each business day and acknowledges receipt within two business days, separately from actual completion. The provider verifies requesters and assists the merchant with rights, notices, impact assessments and consultations relevant to this service. Rights cases are closed only after actions are performed and checked; exports are encrypted and passwords sent separately. Known personal-data breaches are notified to the merchant without undue delay, with available information, measures taken and subsequent updates. The merchant’s notification duties remain separate. The provider maintains information needed to demonstrate its commitments and allows reasonable checks without exposing security secrets or other merchants’ data. 7. Termination and residual retention The merchant may request return of its data before uninstalling and erasure, subject to a documented legal retention requirement. Receipt of the webhook removes the installation and receipts; connector backups follow their seven-day cycle. Residual copies are not used for ordinary ongoing processing; necessary deletions are reapplied if a backup is restored. Dedicated history, cases and temporary data follow the notice. Earlier shared history, the OIDC registry and copies outside the managed backup scope require separate return/erasure assessment; connector cleanup does not erase them. Data retained for a separate legal duty is limited and protected for the justified period. Termination choices and actions are documented. Acceptance receipts record version, texts, digest, date, language, store and session type. They are not a qualified signature or an independent authority check. The merchant must keep its copy before uninstalling; the service promises no separate contract archive after uninstall.