--- title: Actorly data processing agreement (DPA) description: How ONDUTYOPS LLC processes personal data on your behalf when you use Actorly: the clauses, then annexes on processing, security and subprocessors. canonical: https://actorly.app/dpa --- Legal # Data processing agreement. How ONDUTYOPS LLC processes personal data on your behalf when you use Actorly, for stores that need a data processing agreement. It has the clauses, then three annexes: the processing, the security measures and the subprocessors. ONDUTYOPS LLC[team@actorly.app](mailto:team@actorly.app) Effective 2026-10-13 Effective 2026-10-13. This agreement takes effect when the Merchant installs Actorly, or on 2026-10-13 for a store that has already installed it. ### Contents 28 sections ## 1 Parties, and what this agreement is 1.1 This data processing agreement ("DPA") is between the merchant that installs Actorly in a Shopify store ("Merchant", "you") and ONDUTYOPS LLC, a Delaware limited liability company with its registered address at Coastal Highway, Lewes, Delaware 19958, United States ("Actorly", "we"). It forms part of the terms of service and applies whenever we process personal data for you. 1.2 It applies whether or not a specific privacy law requires one. Where a law requires particular terms and this DPA does not contain them, the parties will add them. 1.3 The Merchant accepts this DPA by installing or using Actorly, as part of the terms of service, and no separate signature is needed. A Merchant that wants a signed copy can ask at team@actorly.app. Back to contents ## 2 Definitions 2.1 Words in this DPA that are not defined here have the meaning they have in the terms of service. - "Data Protection Law" means the laws that apply to the personal data processed under this DPA, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act as amended. - "Customer Data" means personal data about the Merchant's customers that Actorly processes for the Merchant, as described in Annex I. - "Merchant Data" means all data from the Merchant's store that Actorly processes, including Customer Data. - "Controller", "Processor", "Data Subject", "Personal Data Breach" and "Processing" have the meaning they have in the GDPR. - "Subprocessor" means a company that Actorly uses to process Customer Data. - "Standard Contractual Clauses" means the clauses approved by the European Commission in Decision (EU) 2021/914. - "UK Addendum" means the international data transfer addendum issued by the UK Information Commissioner. - "Shopify privacy requests" means the three mandatory notices Shopify sends an app: a customer data request, a customer erasure request and a store erasure request. Back to contents ## 3 Roles of the parties 3.1 For Customer Data, the Merchant is the Controller and ONDUTYOPS LLC is the Processor. Actorly processes it only on the Merchant's behalf. 3.2 For the Merchant's own account details, such as the store owner's name and email, ONDUTYOPS LLC is a Controller, and the privacy policy applies. 3.3 Shopify is a separate party. It is the platform Actorly runs inside and the source of the data, and it has its own agreement with the Merchant. It is not Actorly's Subprocessor under this DPA. 3.4 The Merchant and Actorly are not joint controllers of Customer Data. Back to contents ## 4 Scope and duration of processing 4.1 Processing starts when the Merchant installs Actorly and ends when the Merchant's data has been deleted under section 12. Annex I describes the subject, nature, purpose, data and Data Subjects. 4.2 The Merchant has the right to give instructions and is responsible for having the legal basis to process Customer Data and to give it to us. Back to contents ## 5 Processing only on documented instructions 5.1 Actorly processes Customer Data only on the Merchant's documented instructions, which are: this DPA, the terms of service, the permissions the Merchant approved at installation, the settings and actions the Merchant takes in the app (for example confirming a restore), and Shopify privacy requests. 5.2 Actorly does not process Customer Data for its own purposes. It does not sell it, share it for advertising, or use it to contact customers or for marketing. 5.3 If Actorly believes an instruction breaks Data Protection Law, it will tell the Merchant. It may pause that processing until the Merchant confirms or changes the instruction. Back to contents ## 6 Confidentiality 6.1 Actorly will make sure that people who can access Customer Data are bound by a duty of confidentiality, and will bind its Subprocessors the same way. Access to Customer Data is limited to the people at Actorly who need it to operate the service. Back to contents ## 7 Security of processing 7.1 Actorly will keep the technical and organisational measures in Annex II, which are appropriate to the risk and consistent with Article 32 of the GDPR, and will not materially reduce them during the agreement. 7.2 Actorly does not hold a security certification, and this DPA does not say that it does. Back to contents ## 8 Subprocessors 8.1 The Merchant gives general authorisation for Actorly to use the Subprocessors in Annex III. Actorly will have a written agreement with each one that requires protection no less than this DPA gives, and remains responsible for it. 8.2 Where Actorly intends to add or replace a Subprocessor, it will update the list in Annex III, the privacy policy and the security page, and tell the Merchant in advance, in the app, through Shopify or by email to the store owner, before that Subprocessor starts to process Customer Data. If the Merchant has a reasonable objection on data protection grounds, it can write to team@actorly.app before the date in the notice. Actorly will work with the Merchant in good faith, which may include not routing the Merchant's data to that Subprocessor where that is technically possible or, if the objection cannot reasonably be resolved, letting the Merchant end the affected part of the service without penalty. If the Merchant does not object before that date, it is taken to have authorised the new Subprocessor. This is the notice period for Clause 9 of the Standard Contractual Clauses. 8.3 A webhook address the Merchant chooses for alerts is the Merchant's own and is not a Subprocessor. Back to contents ## 9 Assistance with Data Subject rights 9.1 Actorly will help the Merchant answer requests from Data Subjects, taking into account the nature of the processing. Most requests reach Actorly through Shopify privacy requests. 9.2 A customer erasure request is carried out automatically. Actorly removes that customer's personal values, and the personal values on the orders the request names, from the change history. Draft-order details are removed when the store's data is erased. Afterwards Actorly keeps the customer's Shopify ID, the time of the erasure and the numbers of that customer's orders until the store's data is erased, so the details are not stored again. 9.3 A customer data request is not automatic. Actorly receives it and shows it to the store owner under Settings, Privacy in the app. The store owner downloads a file of what Actorly holds about that customer and replies to the Data Subject within the time Shopify allows, which is 30 days. 9.4 If a Data Subject writes to Actorly directly, Actorly will tell the Data Subject to contact the Merchant, and will tell the Merchant, unless the law forbids it. Back to contents ## 10 Assistance with security, impact assessments and consultation 10.1 Taking into account the nature of the processing and the information available to it, Actorly will help the Merchant meet its duties under Articles 32 to 36 of the GDPR, including data protection impact assessments and consultation with authorities, by giving information about what Actorly holds and the measures in Annex II. 10.2 Actorly may ask the Merchant to pay reasonable costs for help that goes beyond what the service does, for the time reasonably spent, at rates agreed in advance. Back to contents ## 11 Personal Data Breach notification 11.1 Actorly will tell the Merchant without undue delay after it becomes aware of a Personal Data Breach affecting Customer Data, and will give the information it has, in stages if it cannot give it all at once: what happened, what data and which stores, the likely effects, and what Actorly has done and will do. 11.2 The notice goes to the store owner's email address and the store's contact email, as Shopify holds them. It is given so that the Merchant can meet its own duty to notify its supervisory authority within 72 hours of becoming aware of a breach, where Article 33 of the GDPR applies. 11.3 The notice is not an admission of fault. The Merchant is responsible for telling its own customers and regulators where the law requires it. Back to contents ## 12 Deletion or return of data on termination 12.1 When the Merchant uninstalls Actorly, Shopify tells Actorly at once and sends a store-erasure request 48 hours later. Actorly then erases the store's change history, its account records and its stored evidence, and lists the stored evidence again to confirm that none is left. If the Merchant reinstalls within those 48 hours, nothing is erased. A store that is currently installed is never erased. 12.2 On a downgrade from Restore to Watch, history older than 90 days is deleted after 14 days' notice. Saved evidence copies are not purged on a downgrade in this version and are erased with the store's data. 12.3 Export files are deleted three days after they are built. Where the Merchant's plan includes export, the Merchant can build an export before it uninstalls, and that is how a copy is returned. A Merchant that wants a copy in another form must ask at ${CONTACT} before it uninstalls, or promptly after, and in any event before the store's data is erased. 12.4 The Merchant can ask for earlier deletion by writing to team@actorly.app and naming the store, from the store owner's address. Actorly confirms the request and carries it out within 30 days. 12.5 Actorly may keep data where the law requires it, only for as long as it requires, and will keep protecting it. At the date of this DPA Actorly knows of no such requirement for Customer Data. 12.6 Two controls have a written rule but no recorded proof, so this DPA does not warrant them: that a customer erasure has been exercised end to end on a live store, and that no customer value survives in any saved snapshot. Back to contents ## 13 Audits and information 13.1 Actorly will give the Merchant the information needed to show it keeps to this DPA, and will allow and help with an audit by the Merchant or an auditor it appoints, under the following terms. - The Merchant first asks for information, such as a written answer to a questionnaire or a description of the measures in Annex II, and Actorly gives it. - An audit is made on reasonable notice, during working hours, no more than once a year unless a Personal Data Breach or a regulator requires more, and so as not to disrupt the service or expose another store's data. - The auditor is bound by confidentiality, and the Merchant pays its own costs. - An audit cannot reach Cloudflare's or another Subprocessor's own systems except as their own terms allow. 13.2 Actorly holds no certification of its own, so there is no certificate or audit report to hand over. It says so plainly. 13.3 Actorly may satisfy an audit request first by giving the information described above, the description of the measures in Annex II and answers to a written security questionnaire, before it agrees to an on-site inspection. Actorly may charge for time reasonably spent on an audit beyond that, at rates agreed in advance. Information obtained in an audit is confidential and is used only to check compliance with this DPA. Back to contents ## 14 International transfers 14.1 Actorly is based in the United States. Customer Data is stored and processed on Cloudflare's network, which is global, and Actorly does not restrict it to a country or a region. 14.2 Where Customer Data from the European Economic Area is transferred to a country without an adequacy decision, the parties agree that the Standard Contractual Clauses apply, with the Merchant as exporter and Actorly as importer, as follows. Standard Contractual Clauses choiceSelection ModuleModule Two, controller to processor. The Merchant is the controller and may be established in the EEA. Actorly is the processor and is established outside the EEA, in the United States. Clause 7, docking clauseNot used Clause 9, subprocessorsOption 2, general written authorisation, with the notice period in section 8 of this DPA Clause 11, independent dispute resolutionThe optional language is not used Clause 13, supervisory authorityThe supervisory authority of the EU member state in which the Merchant is established or, where the Merchant is not established in a member state, the one identified under Clause 13 of the Clauses Clause 17, governing lawThe law of Ireland Clause 18, courtsThe courts of Ireland 14.3 The full text of the clauses is at eur-lex.europa.eu, Decision (EU) 2021/914. Annexes I to III of this DPA are the annexes to the clauses. 14.4 Where the transfer is a Subprocessor's, Actorly will make sure a transfer mechanism the law recognises is in place, and Annex III names it for each Subprocessor. Back to contents ## 15 UK transfers 15.1 Where the UK GDPR applies to a transfer, the parties agree that the UK Addendum to the Standard Contractual Clauses applies and is part of this DPA. Table 1 is the parties and addresses at the head of this DPA. Table 2 is the Clauses as chosen in section 14, with Module Two and the same options. Table 3 is Annexes I, II and III of this DPA. In Table 4, either party may end the UK Addendum as its own terms allow, and Actorly is the importer. Back to contents ## 16 Swiss transfers 16.1 Where the Swiss Federal Act on Data Protection applies to a transfer, the Standard Contractual Clauses apply with the changes the Swiss Federal Data Protection and Information Commissioner requires: references to the GDPR mean the Swiss law, and Swiss Data Subjects keep their right to use their rights in Switzerland. Where the transfer is governed by the Swiss law alone, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner and the Clauses are governed by the law of Switzerland. Back to contents ## 17 US state privacy laws 17.1 For Customer Data subject to US state privacy laws, Actorly acts as the Merchant's service provider or processor. It processes the data only to provide Actorly to the Merchant, does not sell it, does not share it for cross-context behavioural advertising, and does not combine it with other data for purposes beyond the service, except as the law allows. 17.2 Actorly will tell the Merchant if it can no longer meet its duties under those laws. Back to contents ## 18 Liability 18.1 Each party's liability under this DPA is subject to the limits in the terms of service, as far as the law allows. Nothing limits a Data Subject's rights under the Standard Contractual Clauses or a liability that cannot be limited by law. 18.2 Data protection liability has no separate cap. It is within the limits in the terms of service, as far as the law allows. Back to contents ## 19 Order of precedence 19.1 If this DPA and the terms of service conflict about the processing of personal data, this DPA decides. If the Standard Contractual Clauses or the UK Addendum apply and conflict with this DPA, they decide. Back to contents ## 20 General 20.1 Term. This DPA starts when the Merchant installs Actorly and ends when all Merchant Data has been deleted under section 12. 20.2 Changes. We may change this DPA to follow a change in law or in the service, and will post the new version with a new date and tell the Merchant of a material change through the app, Shopify or email. This DPA takes effect on ${EFFECTIVE}. For a change to the Subprocessors, section 8 applies. 20.3 Severability. If a part is found unenforceable, the rest stays in force. 20.4 Governing law. Except where the Standard Contractual Clauses or the UK Addendum set their own governing law for what they cover, this DPA is governed by the laws of the State of Delaware, United States, as the terms of service are. Back to contents ## 21 The Merchant's responsibilities 21.1 The Merchant is responsible for the lawfulness of its instructions, for having a legal basis and any notice or consent it needs to collect Customer Data in Shopify and to use Actorly with it, and for the accuracy and content of what it puts in notes. 21.2 The Merchant will not give Actorly special-category data, such as health information, on purpose, and will tell its staff not to type it into notes that Actorly stores. 21.3 The Merchant is responsible for the people it lets into its Shopify admin and for the permissions it approves at installation. 21.4 The Merchant is responsible for replying to a Data Subject who asks for a copy of their data, using the file it can download in the app, within the time the law and Shopify allow. Back to contents ## 22 Records and compliance information 22.1 Actorly will keep the records Data Protection Law requires a Processor to keep about the processing it does for the Merchant, and will give a copy to the Merchant or an authority on request, as far as the law requires. 22.2 Actorly will make available the information the Merchant reasonably needs to show it has chosen a Processor that gives appropriate guarantees. Because Actorly holds no certification, that information is a description of the measures in Annex II, and Actorly's answers to a questionnaire. Back to contents ## 23 Requests from authorities 23.1 If an authority asks Actorly for Customer Data, Actorly will send the request to the Merchant where it can lawfully do so, will give only what it is legally bound to give, and will tell the Merchant before it does, unless the law forbids that. 23.2 Actorly will look at each request and, where it has reasonable grounds to think the request is unlawful, will challenge it, as the Standard Contractual Clauses require. Back to contents ## 24 Contact 24.1 ONDUTYOPS LLC. Email: team@actorly.app. Postal address: Coastal Highway, Lewes, Delaware 19958, United States. Use this for any question about this DPA, a request from a Data Subject, a Subprocessor notice or an audit request. Actorly has not appointed a data protection officer or a representative in the European Union or the United Kingdom. Back to contents ## Annex I Description of the processing ItemDescription Data exporterThe Merchant that installed Actorly. Contact and role as held by Shopify. Role: Controller. Data importerONDUTYOPS LLC, team@actorly.app. Role: Processor. Data SubjectsThe Merchant's customers whose details appear in a change Actorly records, the Merchant's staff and apps named by Shopify as having made a change, and any other person whose details the Merchant puts in a note. Categories of personal dataCustomers: first and last name (or the email address Shopify uses as the name), the customer note, tags, whether email and text marketing consent was given, and the default address with phone. Orders: the order note, and the shipping and billing addresses with phone. Draft orders: the draft order note. Fulfillments: status, quantity, the carrier's name and the order number. Staff and apps: the display name Shopify gives. Not processedA customer's account email address and account phone number, payment details, card numbers, tracking numbers, and browsing or storefront behaviour. Sensitive dataNot requested. Free-text notes may contain anything the Merchant or its staff type; the Merchant must not put special-category data in them. Actorly does not ask for or infer special-category data or criminal offence data. Nature of the processingReceiving change notifications from Shopify and re-reading records, storing old and new values in a per-store change history, matching Shopify's activity log to a change by fixed rules, showing the history to the Merchant, exporting it, and writing one field back during a restore the Merchant confirmed. PurposeRecording the Merchant's store change history, showing it, and running restores the Merchant confirms. FrequencyContinuous while installed. Duration and retentionWhile the app is installed, subject to the plan's history limit: 90 days on Watch, unlimited on Restore. Deleted as described in section 12. Subprocessor transfersAs in Annex III. I.1 Before Actorly saves its evidence copy of a notification from Shopify, it strips named personal keys at every depth. The values above come from a second read from Shopify and not from the saved copy. Back to contents ## Annex II Technical and organisational security measures MeasureDescription Encryption at restStored data is encrypted at rest by Cloudflare, per Cloudflare's published data-security statements for Durable Objects, R2 and D1. This is Cloudflare's statement. Encryption in transitCalls from the app to Shopify, and to a Merchant's alert address, use HTTPS only. Tenant separationEach store's change history is kept in its own separate database (one Cloudflare Durable Object per store). There is no shared table to reach another store's data. Account records are in a shared database and are always queried by store. SecretsA webhook signing secret is stored encrypted with AES-256-GCM, under a key held only as a Worker secret. Webhook integrityWebhook requests from Shopify are verified before they are used. Alert webhooks that Actorly sends are signed. Least privilegeActorly requests 25 permissions, 20 read and 5 write. The write permissions are used only for allowlisted restore fields, during a restore the Merchant confirmed. Writes are restores onlyActorly does not change a store on its own, and adds nothing to a storefront: no scripts, theme code, app blocks or pixels. Data minimisationActorly does not fetch a customer's account email or phone, payment details or tracking numbers. Named personal keys are stripped from saved copies of notifications. Protected valuesOrder notes and addresses are hidden from the Merchant's screens and redacted in exports; customer values are visible to the store owner. Export files are deleted after 3 days. No AI in the data pathRecording a change and working out who made it are done by fixed rules. Access controlAccess to production systems and Customer Data is limited to the people at Actorly who need it to operate the service. ReviewThe high-risk code paths are read by a security review step in Actorly's own process. This is an internal practice and not a certification. CertificationsActorly holds no certification of its own; the infrastructure it runs on is Cloudflare's, certified as described on the security page. Incident responseActorly investigates a suspected incident, contains it, and tells the Merchant as set out in section 11. Notices go to the store owner's email address and the store's contact email, as Shopify holds them. Vulnerability reportsEmail team@actorly.app with what you found and how to reproduce it. Back to contents ## Annex III Subprocessors III.1 These are the companies Actorly uses to process Customer Data or data about it. The list is the same as in the privacy policy and on the security page. CompanyWhat it does for ActorlyWhat it receives Cloudflare, Inc.Hosts Actorly and stores its data: the app itself, each store's change history, saved copies of what Shopify sent, and Actorly's account records.Everything described in the data table of the privacy policy. PostHogCounts product events about Actorly itself, for example that a plan was chosen or a first import finished. Not in use today: used only if product analytics is switched on, with notice first.Nothing today. If switched on: the store's myshopify.com domain, the plan name, counts and durations. No customer data and no store content. SlackDelivers operational notices to Actorly's own team workspace, so the team sees when an install or an import needs attention.The store's myshopify.com domain and a short status. No customer data and no store content. III.2 Location and transfer mechanism. Cloudflare: its global network, under the EU Standard Contractual Clauses incorporated into Cloudflare's own customer-facing addendum. PostHog: not in use today and used only if product analytics is switched on, with notice first, and then by default on its United States host, under the EU Standard Contractual Clauses (Module Two) and the UK Addendum in PostHog's data processing addendum. Slack: Slack's United States services, under the EU Standard Contractual Clauses in Slack's data processing addendum. PostHog and Slack receive no Customer Data. III.3 Shopify is the platform and the source of the data and is not listed above. Back to contents ## Annex IV Handling of Shopify privacy requests IV.1 This annex says how each privacy notice that Shopify sends to Actorly is dealt with. Request from ShopifyWhat Actorly doesWhat the Merchant does Customer data requestReceives it. It is not automatic. It appears for the store owner under Settings, Privacy in the app, with an overdue banner past the deadline.Downloads a file of what Actorly holds about that customer and replies to the Data Subject. Shopify allows 30 days. Customer erasure requestAutomatic. Removes that customer's personal values, and the personal values on the orders the request names, from the change history. Keeps the customer's Shopify ID, the time of the erasure and the numbers of that customer's orders until the store's data is erased, so the details are not stored again.Nothing is needed. Draft-order details are removed when the store's data is erased. Store erasure requestArrives 48 hours after an uninstall. Erases the store's change history, account records and stored evidence, and lists the stored evidence again to confirm that none is left. Reinstalling within the 48 hours keeps everything. A store that is installed is never erased.Nothing is needed. Build an export before uninstalling if a copy is wanted and the plan includes export. A request sent to Actorly directlyActorly tells the Data Subject to contact the Merchant and tells the Merchant, unless the law forbids it.Decides and replies. Back to contents [Privacy policy →](https://actorly.app/privacy)[Terms of service →](https://actorly.app/terms)[Data protection and your rights →](https://actorly.app/gdpr)[Cookie policy →](https://actorly.app/cookies)[Subprocessors →](https://actorly.app/subprocessors)