Version 1.1 · Last updated: 2026-10-11

Data Processing Agreement for RETEX

Version 1.1 · Last updated: 2026-10-11

This Data Processing Agreement ("DPA") is made between ARSHIVE GROUP - FZCO, a Dubai free zone company, licence number 64407, IFZA Business Park, DDP, Premises no 64407-001, Dubai Silicon Oasis, Dubai, United Arab Emirates (the "Processor", "we") and the business that installs RETEX on its Shopify store (the "Controller", "you", "the merchant"). It forms part of the Terms of Service and takes effect when you accept the Terms or install the app. It is intended to meet the requirements of Article 28 of Regulation (EU) 2016/679 (the "GDPR"). Terms such as "personal data", "processing", "controller", "processor" and "personal data breach" have the meaning given in the GDPR.

1. Subject matter, duration, nature and purpose

1.1 Subject matter. We process personal data on your behalf in order to provide RETEX, a returns and exchanges application, to you.

1.2 Duration. This DPA applies from the day RETEX is installed on your store until your data has been deleted or returned under section 10.

1.3 Nature and purpose. Receiving, storing, retrieving, displaying, correcting, organising, transmitting to carriers and to Shopify, and deleting or anonymising data, in order to let your customers request returns, exchanges and withdrawals, and to let your team review and fulfil them (refund, store credit, replacement order, restock, return label, email communication). The details are in Annex 1.

1.4 Your relationship to us. For the personal data described in Annex 1 you are the controller and we are the processor. Where we process personal data about you and your staff for our own purposes (for example to manage your account and secure our service), we are a controller, and our Privacy Policy applies; that processing is not covered by this DPA.

2. Your instructions (Art. 28(3)(a))

2.1 We process personal data only on your documented instructions, including with regard to transfers to a third country or an international organisation, unless EU or Member State law to which we are subject requires otherwise; in that case we tell you of that legal requirement before processing, unless the law prohibits it.

2.2 Your instructions are: this DPA and the Terms; your configuration and use of RETEX (including its settings, the actions your team and your customers take in it, and the carriers and mailboxes you connect); and the notices that Shopify sends from your store on your behalf (customer data requests and customer or shop erasure). Any further instruction must be given in writing, and we may charge reasonable costs for one that goes beyond the normal operation of the service.

2.3 We tell you immediately if, in our opinion, an instruction infringes the GDPR or other EU or Member State data protection law. We may suspend carrying it out until you confirm or change it.

2.4 We do not process the personal data for our own purposes, do not sell it, and do not combine it across merchants. If we determined the purposes and means of processing ourselves, we would be a controller for that processing (Art. 28(10) GDPR).

3. Your responsibilities

You are responsible for having a legal basis for the processing, for informing your customers as Articles 13 and 14 GDPR require, for the lawfulness of your instructions, for what you enter in free-text fields, notes, ratings and flags (including any profiling of customers within your shop), and for the choice of carriers and mail providers you connect. You must comply with the conditions under which Shopify gives you access to protected customer data.

4. Confidentiality (Art. 28(3)(b))

We ensure that everyone we authorise to process the personal data has committed to confidentiality or is under a statutory duty of confidentiality, receives suitable training, and has access only to the extent needed for their role.

5. Security (Art. 28(3)(c), Art. 32)

We implement the technical and organisational measures in Annex 2, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risk to individuals. We review them regularly and may update them provided that the overall level of protection is not reduced.

6. Sub-processors (Art. 28(2), (3)(d), (4))

6.1 You give us a general authorisation to engage the sub-processors listed on our sub-processor page, which is part of this DPA (Annex 3).

6.2 We will give you at least 30 days' notice before adding or replacing a sub-processor, by email to the contact address stored for your shop and by updating that page. You may object on reasonable data protection grounds in writing within that period. We will then work with you in good faith to resolve the objection, for example by not using the new sub-processor for your data. If we cannot resolve it within 30 days, you may terminate the affected service on written notice, and we will refund any prepaid fees for the remaining period, to the extent Shopify's billing rules allow us to.

6.3 We impose on each sub-processor, in a written contract, data protection obligations equivalent to those in this DPA, and we remain fully liable to you for the sub-processor's performance.

6.4 Carriers and mail providers that you choose and connect with your own credentials are your processors or independent controllers, not our sub-processors. We transmit data to them on your instruction.

7. International transfers

7.1 We store and process the personal data in the European Economic Area (Belgium, Google Cloud region europe-west1). We do not transfer it to another country outside the EEA unless you instruct us to (for example by connecting a carrier outside the EEA), a sub-processor listed in Annex 3 requires it (7.4), or as set out in 7.2.

7.2 Access from the United Arab Emirates. We are established in the United Arab Emirates, and our personnel access the personal data from there, remotely, to operate, support and secure the service. The UAE has no adequacy decision of the European Commission, so this access is a transfer. To protect it, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), are incorporated into this DPA by reference, with you as data exporter and us as data importer. Their annexes are the annexes of this DPA: Annex I is Annex 1 (the parties are those named at the top of this DPA), Annex II is Annex 2, and Annex III is Annex 3. The following options apply: Clause 7 (docking clause) applies; in Clause 9(a), Option 2 (general written authorisation), with the notice period in section 6.2; the optional wording in Clause 11(a) does not apply; under Clause 13(a), the competent supervisory authority is the one that Clause 13(a) designates for your situation; in Clause 17, Option 1, the law of Ireland; in Clause 18(b), the courts of Ireland. If this DPA conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

7.3 Supplementary measures for 7.2: the data stays stored in the EEA and is accessed, not copied, from the UAE except where a support case needs an extract; connections are encrypted (TLS); access is limited to named personnel with individual accounts and multi-factor authentication; and we will challenge, and tell you about, any request by a public authority for your data as Clause 15 of the Standard Contractual Clauses requires.

7.4 If, and only if, a sub-processor in Annex 3 or its personnel processes or can access personal data from a country outside the EEA for which there is no adequacy decision, the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914 (Module Three, processor to processor) apply between us and that sub-processor, together with any supplementary measures needed to ensure an essentially equivalent level of protection. We will tell you in the sub-processor notice under 6.2 and give you a copy of the applicable clauses on request.

8. Assistance to you (Art. 28(3)(e), (f))

8.1 Data subject requests. Taking into account the nature of the processing, we assist you, by appropriate technical and organisational measures, in responding to requests from individuals to exercise their rights under Chapter III GDPR. The app lets you view, correct, export and delete a customer's data. If a person contacts us directly about data we process for you, we pass the request to you without undue delay and do not respond ourselves unless you instruct us to. Where Shopify sends us a customer data request or customer erasure notice for your store, we act on it within 30 days.

8.2 Security, breaches, impact assessments. We assist you in complying with Articles 32 to 36 GDPR (security, notification of a breach to the authority and to individuals, data protection impact assessments and prior consultation), taking into account the information available to us.

8.3 Personal data breaches. We notify you without undue delay, and we aim to do so within 24 hours, after we become aware of a personal data breach affecting your data, so that you can meet the 72-hour deadline in Article 33(1) GDPR. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of individuals and records concerned, the likely consequences, our contact point, and the measures taken or proposed. We will provide further information as it becomes available and will take reasonable steps to contain and remedy the breach. You decide whether and how to notify the supervisory authority and the individuals, except where we are required to notify by law.

9. Records and demonstration of compliance; audits (Art. 28(3)(h))

9.1 We keep a record of the processing we carry out on your behalf, as Article 30(2) GDPR requires.

9.2 We make available to you the information needed to demonstrate our compliance with Article 28, for example by answering a reasonable security questionnaire and giving a summary of our measures and, where available, relevant third-party reports.

9.3 You, or an auditor you appoint who is bound by confidentiality, may audit our compliance with this DPA, no more than once every 12 months (or sooner after a personal data breach affecting your data, or where a supervisory authority requires it), on at least 30 days' written notice, during normal working hours, without disrupting our business, subject to our reasonable security rules and without access to other merchants' data. Each of us bears its own costs. We will first offer to meet the request through the information in 9.2 and a remote review.

10. Deletion and return at the end (Art. 28(3)(g))

10.1 When the app is uninstalled we stop processing, and we delete all personal data we hold for your shop, including requests, photos, labels, messages, notes, ratings, settings and encrypted credentials, about 48 hours later, when Shopify sends its shop erasure notice. If you reinstall within that time, the deletion is cancelled. Backups expire within the period shown in our Retention Policy.

10.2 Before then, you can export what you need from the app. If you ask us in writing within 30 days of a notice by us ending the agreement, we will return the data in a common, machine-readable format before deleting it.

10.3 We delete or anonymise individual customers' data on the notices described in 8.1, and as set out in the Retention Policy.

10.4 After deletion we keep no copy, unless EU or Member State law requires us to keep personal data. In that case we tell you what we keep and why, keep it only as long as the law requires, and process it only for that purpose.

11. Liability

Each party's liability under this DPA is subject to the limits in the Terms, to the extent the law permits. Nothing in this DPA limits a person's right to claim compensation from a controller or processor under Article 82 GDPR, or the liability of either of us to a supervisory authority.

12. General

12.1 If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails.

12.2 We may change this DPA where the law, a supervisory authority or the European Commission requires it, or to reflect changes in the service, on 30 days' notice as set out in the Terms. We will not change it in a way that reduces your protection without your agreement.

12.3 This DPA, including the Standard Contractual Clauses incorporated in section 7.2, is governed by the law of Ireland, and the courts of Ireland have jurisdiction over any dispute arising from it. A data subject may also bring proceedings in the Member State of their habitual residence (Clause 18(c) of the Standard Contractual Clauses).

12.4 Contact for data protection matters: support@retexapp.com. We have not appointed a data protection officer, as Article 37 GDPR does not require one for our processing.

12.5 EU representative (Article 27 GDPR): not yet appointed. We will name it here and in our Privacy Policy when we appoint one.

Annex 1: Details of the processing

Annex 2: Technical and organisational measures (Art. 32)

Annex 3: Sub-processors

See the current list at /legal/subprocessors. It forms part of this DPA.