shopAds Controller and Processor Split
Effective date: 14 July 2026
1. Purpose
This document records how shopAds LLC (“shopAds”) characterises its role under data protection law, as either a controller or a processor, for each category of personal data it handles in providing the shopAds service. It sits behind, and is consistent with, the shopAds Privacy Policy and the merchant Data Processing Agreement, and it is the reference point for how responsibilities are allocated between shopAds and each merchant.
2. How the roles are decided
A controller is the party that decides why personal data is processed and, in broad terms, how. A processor is the party that processes personal data on behalf of a controller and on that controller’s instructions, without deciding the underlying purpose for itself. The characterisation therefore turns on who determines the purpose of the processing, not on who holds the data or performs the technical work.
3. Where shopAds is the controller
For personal data about the merchant and the people who run the merchant’s business, shopAds decides the purpose and means of processing, so shopAds is the controller. This covers the account and contact details used to register and identify a merchant, the identifiers used to authenticate them, the references used to bill the management fee, the records of communications with them, and the technical data collected from visitors to shopads.ai. shopAds’ handling of this data is governed by the Privacy Policy, and requests from these individuals about their data come to shopAds directly.
4. Where shopAds is the processor
For personal data about the merchant’s own customers and the visitors to the merchant’s store, shopAds processes that data only to provide the service to the merchant, and on the merchant’s instructions. The merchant runs a store, holds the relationship with those customers, and decides to advertise to them, so the merchant determines the purpose and is the controller. shopAds carries out the processing needed to deliver the advertising service and is the processor. This covers the customer name and email used to build advertising audiences, order details, the click identifiers that connect an advertisement to a resulting order, and the session and behavioural data collected on the merchant’s store. shopAds’ handling of this data is governed by the Data Processing Agreement, and requests from these individuals are directed to the merchant, whom shopAds assists.
shopAds provisions and operates the advertising account and the analytics property used to deliver the service inside its own accounts rather than inside the merchant’s. That does not change the characterisation. The merchant still decides to advertise its own store to its own customers, and so sets the purpose, while shopAds carries that purpose out and puts the data to no independent use of its own. The advertising and measurement platforms that shopAds engages in order to do so are sub-processors of shopAds under the Data Processing Agreement, except to the extent that such a platform processes the data for its own purposes under its own terms, in which case it acts as an independent controller for that processing.
5. Why the split falls this way
The two categories differ in who sets the purpose. shopAds sets its own purposes for the account, billing, and site data it needs to run its business and provide the service, which makes it a controller of that data. For the store’s customer and visitor data, shopAds acts under the merchant’s direction to advertise that merchant’s store, and does not use that data for any independent purpose of its own, which makes it a processor. shopAds does not sell this data, does not use it to advertise anything other than the merchant’s own store, and does not repurpose it for its own ends. This allocation reflects how a service that operates a merchant’s advertising on the merchant’s behalf is characterised under data protection law.
6. What each role means in practice
Where shopAds is the controller, it is directly accountable under data protection law for that data, the Privacy Policy is the transparency notice for it, and shopAds responds to data subject requests itself.
Where shopAds is the processor, the merchant is accountable as the controller, and shopAds acts only on the merchant’s documented instructions under the Data Processing Agreement. The merchant is responsible for having a lawful basis and any required consents for that data. shopAds engages sub-processors only as permitted by the Data Processing Agreement, assists the merchant in meeting its own obligations, and deletes or returns the personal data it holds as processor within 30 days of the merchant ending the service, except where the law requires it to be retained.
7. Review
shopAds reviews this determination as the service changes, for example if new data categories or advertising channels are added, and updates it and the related documents where a change affects how the roles fall.
8. Contact
Questions about this document can be sent to help@shopads.ai.