Version: 17 October 2026
This Data Processing Agreement ("DPA") forms part of the COM Inbound Terms of Service between Extelynx ("we", "us") and the store or business using the App ("Merchant"). By using COM Inbound on behalf of the Merchant, you agree to the Terms, including this DPA, and confirm your authority to bind the Merchant. No separate checkbox or signature is required by this contractual mechanism. This DPA takes effect on the Merchant's first use subject to these published terms and applies for as long as we process personal data on the Merchant's behalf. Changes for existing Merchants follow section 10 below; publication does not retroactively establish acceptance of an earlier version.
1. Roles and instructions
Where we process personal data on the Merchant's behalf, the Merchant is the controller and Extelynx is the processor. If the Merchant is itself a processor, it must have authority from its controller to appoint us as a subprocessor. Controller, processor, personal data, and personal data breach have the meanings given in applicable data protection law, including the GDPR where applicable.
We process that data only on documented instructions, including this DPA, the Terms, and the Merchant's configuration and use of the App. This includes instructions concerning international transfers. If law requires other processing, we will inform the Merchant before processing unless that law prohibits doing so. We will immediately inform the Merchant if, in our opinion, an instruction infringes applicable data protection law.
For processing we determine independently, such as handling direct business contact requests and meeting our own legal obligations, the Privacy Policy explains our role and practices. This DPA does not make all platform or provider activity processing on behalf of the Merchant.
2. Processing details
The subject matter and purpose are operating COM Inbound's order-linked material receiving, inspection, exception, and approval workflow. Processing includes reading, displaying, storing, updating, exporting, and deleting the limited records needed for that workflow and its security and privacy lifecycle.
Data may concern the Merchant's customers, suppliers, and other individuals identifiable through order references or information entered by the Merchant. It includes shop identifiers, order IDs/numbers, order dates and state, material and shipment references, receipt and inspection facts, notes, and activity records to the extent those records constitute personal data. A limited summary of order line-item names and quantities is read live and is not persisted.
The App does not intentionally request customer names, email addresses, phone numbers, postal addresses, or Shopify order-note contents. It uses offline shop sessions and does not store staff profile IDs, names, email addresses, locale, or owner/collaborator/email-verification attributes. Activity history records what happened and when, without staff authorship. Merchants must not enter unnecessary personal data, credentials, payment-card data, or special-category data in free-text fields.
Processing lasts for the service and applicable deletion periods in section 8. The Merchant determines the lawful purposes and instructions, provides required notices, establishes the applicable legal basis, and handles its customers' requests with our assistance. Acceptance of this DPA is not customer consent.
3. Confidentiality and security
We ensure that persons authorised to process Merchant personal data are bound by confidentiality obligations. We implement appropriate technical and organisational measures taking account of the processing and its risks, including TLS in transit, private application-to-database networking, encrypted Shopify access and refresh tokens, tenant-scoped access, limited API scopes, webhook authentication, and minimised operational logging. We assess and update these measures as needed to meet applicable data protection obligations. This agreement does not claim a security certification or guaranteed recovery objective. The documented recovery posture does not include configured managed database backups or point-in-time recovery.
4. Subprocessors
The Merchant gives general written authorisation to use subprocessors for the services described here. Railway provides application and PostgreSQL hosting and infrastructure in US East, Virginia. Better Stack provides monitoring, alerts, and minimised exception tracking in the United States; application exception reports exclude shop/user identity and merchant free text.
Shopify provides the Merchant's platform, authentication, API, and webhook services under its relationship with the Merchant. Listing Shopify as an integration does not classify every Shopify activity as our subprocessing.
We impose applicable data protection obligations on subprocessors by contract and remain responsible for their performance of those obligations. Before adding or replacing a subprocessor, we will notify the Merchant, including through an in-app notice, and provide a reasonable opportunity to object on data protection grounds by contacting support@extelynx.com. We will work to resolve an objection; if it cannot be resolved, the Merchant may discontinue the affected service.
5. International transfers
The App does not promise EU data residency. Transfers must comply with applicable data protection law. Where required, we will establish an applicable adequacy basis or appropriate safeguards, such as the European Commission's standard contractual clauses and applicable UK or Swiss adaptations, with any required supplementary measures. This DPA alone does not establish that a particular recipient is covered by an adequacy decision or execute unspecified transfer clauses. Merchants may request information about applicable safeguards at support@extelynx.com.
6. Assistance and incidents
Taking account of the nature of processing, we assist the Merchant with data subject requests through appropriate technical and organisational measures, including Shopify privacy webhooks and available privacy-request exports. We forward requests concerning the Merchant's data and do not independently answer them except on instructions or where required by law.
Taking account of the processing and information available to us, we assist with security, breach notifications, impact assessments, and prior consultations required by applicable law. We notify the Merchant without undue delay after becoming aware of a personal data breach affecting its data, share available information needed to meet its obligations, and provide further information as it becomes available. Contact security@extelynx.com for security incidents.
7. Information and audits
We make available information necessary to demonstrate compliance with our processor obligations and allow and contribute to audits, including inspections, by the Merchant or an auditor it mandates. The parties coordinate reasonable notice, confidentiality, and safeguards for other merchants' data without preventing statutory or supervisory-authority rights.
8. Return, retention, and deletion
At the Merchant's choice, we delete or return personal data after the service ends and delete existing copies unless law requires retention. Contact support@extelynx.com to arrange return before uninstalling; available customer privacy-request exports can be downloaded in Settings while authenticated and are not a general export of every App record.
Active cases are retained while needed for the workflow. Closed or cancelled cases are retained up to 12 months; operational and analytics records and minimised exception reports up to 90 days; privacy-request exports up to 30 days. Shopify order deletion and applicable customer redaction delete related cases. Uninstall invalidates sessions; following Shopify's shop-redaction request, we target deletion of remaining live shop data within seven days. Minimal privacy fences may remain only as needed to prevent stale deliveries from recreating erased data, without customer contact data or raw payloads. Legal retention requirements take precedence only to the extent applicable. Privacy deletion overrides ordinary append-only activity history.
9. Precedence and governing terms
This DPA prevails over the Terms and Privacy Policy for processing personal data on the Merchant's behalf. Mandatory applicable transfer clauses prevail over this DPA. The Terms govern other matters, including Polish law and disputes, subject to mandatory applicable law and data subjects' rights.
10. Changes and contact
We publish a dated version and notify existing Merchants of material changes before they take effect, stating the effective date in the notice. Continued use after that date constitutes acceptance to the extent permitted by applicable law. A Merchant that disagrees should stop using and uninstall the App, subject to the return and deletion provisions above. No separate acceptance checkbox is used. Contact Extelynx at support@extelynx.com for this agreement or privacy requests.
Credential rotation uses a controlled transition between current and previous keys or verification secrets. Previous runtime keys are removed after migration verification; operational rotation diagnostics exclude credentials and store identifiers. These measures do not change the processing purposes or retention periods stated in this DPA.