Data Processing Addendum

Pollfold — Data Processing Addendum Effective: 15 October 2026

This DPA is part of the Terms between the Merchant ("Controller") and Lazy Labs (레이지 랩스) ("Processor"). Where the Merchant itself processes buyer data for another business, we act as its sub-processor on the same terms. Terms not defined here have the meaning in applicable data protection law, including the GDPR, UK GDPR, the California Consumer Privacy Act as amended (CCPA), the Australian Privacy Act 1988 and the Korean Personal Information Protection Act (PIPA).

1. Details of processing. - Subject matter and nature: collecting multiple-choice survey answers, and optional short comments on answers the Controller allows, on Shopify order pages, linking them to orders, storing, comparing and reporting them, and sending Flow events the Controller turns on. - Purpose: providing, securing and supporting Pollfold under the Terms. - Duration: while the app is installed, then until deletion under section 9. - Categories of data subjects: buyers who place orders on the Controller's stores. - Types of personal data: Shopify order identifiers, order amount and currency, selected answers, display language, timestamps, optional comments of up to 200 characters on answers that allow one (stored after email addresses and phone numbers are masked), and, when Shopify provides it, whether the order is the buyer's first or a repeat order. We don't request names, email addresses, phone numbers, postal addresses or special category data. A comment may still contain personal data the buyer chooses to write, including data masking doesn't detect.

2. Instructions. We process personal data only on the Controller's documented instructions, which are the Terms, this DPA and the Controller's settings in the app, unless the law requires otherwise (in which case we'll tell the Controller first unless the law forbids it). We'll tell the Controller if we believe an instruction breaks data protection law. Comparing stores is part of these instructions: it covers only stores that each approved the connection and confirmed common ownership in their own Shopify admin, and we do not use one Controller's data for any other customer.

3. Confidentiality. Anyone authorised to process the data on our behalf is bound by confidentiality.

4. CCPA service provider terms. We act as a service provider. We won't sell or share personal data, won't retain, use or disclose it outside the direct business relationship or for any purpose other than the business purposes in section 1, and won't combine it with personal data from other sources except as the CCPA permits. We'll comply with the CCPA, provide the same level of protection it requires, and notify the Controller if we can no longer meet these obligations. The Controller may take reasonable steps to stop unauthorised use. We certify that we understand and will comply with these restrictions.

5. Security. We maintain appropriate technical and organisational measures, including masking email addresses and phone numbers in comments on our servers before storage, never storing or logging comments before masking, encryption in transit (TLS), an encrypted storage volume for the database, backups and deletion records, encryption of any off-site backup copy before it leaves our server, restricted operator access, and controls that stop collection on a store when its integrity checks fail. We review these measures when the service changes.

6. Sub-processors. The Controller authorises these sub-processors: Shopify Inc. (app platform and billing), Hetzner Online GmbH (hosting, Germany), Cloudflare, Inc. (network delivery). We impose data protection terms on each sub-processor that are no less protective than this DPA and remain responsible for them. We'll give at least 14 days' notice in the app before adding or replacing a sub-processor that handles buyer data; the Controller may object on reasonable grounds and, if we can't address the objection, cancel. Support email routing (Cloudflare) and the support mailbox (Google) handle Merchant correspondence only, not survey data.

7. Data subject requests. Shopify forwards customer data and deletion requests to us. Requests cover the buyer's answers and comments. We complete them within 30 days and make reports available in the app's protected privacy inbox. If a buyer contacts us directly, we'll refer them to the Controller.

8. Assistance and breach notification. We'll reasonably help the Controller with security obligations, breach notifications, data protection impact assessments and prior consultations, taking into account the nature of the processing. If we become aware of a personal data breach affecting the Controller's data, we'll notify the Controller without undue delay and within 72 hours where possible, with the information available and the steps taken.

9. Deletion and return. Survey responses, including comments, are kept for up to 12 months. When the app is uninstalled, or when Shopify asks us to delete store data, we delete the data within the period Shopify requires. Backups expire within 7 days, and any restore re-applies deletions before data becomes available again. Before uninstalling, the Controller can export its responses as CSV. We keep data longer only where the law requires it.

10. International transfers. Data is hosted in the EU (Germany). The Processor accesses it from the Republic of Korea, relying on the European Commission's adequacy decision for the Republic of Korea and the UK's corresponding adequacy regulations. For transfers from Australia, the Processor applies the protections in this DPA as the reasonable steps required by APP 8. Wherever data is processed, the protections in this DPA apply.

11. Audits. We'll make available the information reasonably needed to demonstrate compliance with this DPA and answer reasonable written questions. Where the law requires an audit, it will be at the Controller's cost, on reasonable notice, no more than once a year unless a breach has occurred, and subject to confidentiality.

12. Liability. Liability under this DPA is subject to the limits in the Terms, except where the law doesn't allow it.

13. Order of precedence. If this DPA conflicts with the Terms on the processing of personal data, this DPA applies.