shopAds Data Processing Agreement
Effective date: 22 July 2026
1. Introduction and scope
This Data Processing Agreement (“DPA”) forms part of, and is subject to, the shopAds Terms of Service between shopAds LLC (“shopAds”) and the merchant that uses the shopAds service (“you” or “the merchant”). It applies where shopAds processes personal data about your customers and the visitors to your store on your behalf in providing the Service, and where that processing is subject to applicable data protection law.
This DPA governs only the personal data that shopAds processes as your processor, called “Merchant Personal Data” in this document. It does not govern the personal data about you and your business that shopAds processes as a controller, which is dealt with in the shopAds Privacy Policy. The allocation of these roles is described in the shopAds Controller and Processor Split.
By accepting the Terms of Service and completing onboarding, you enter into this DPA. If there is any conflict between this DPA and the rest of the Terms of Service on the handling of Merchant Personal Data, this DPA prevails.
2. Definitions
Terms such as controller, processor, data subject, personal data, processing, and personal data breach have the meanings given to them in applicable data protection law.
“Applicable data protection law” means the data protection and privacy laws that apply to the processing of Merchant Personal Data, including, where relevant, the EU General Data Protection Regulation, the UK General Data Protection Regulation and Data Protection Act, the Swiss Federal Act on Data Protection, and applicable United States state privacy laws.
“Merchant Personal Data” means personal data about your customers and store visitors that shopAds processes on your behalf to provide the Service.
“Sub-processor” means a third party engaged by shopAds to process Merchant Personal Data on shopAds’ behalf.
“Standard Contractual Clauses” means the standard data protection clauses approved for the transfer of personal data to processors established in countries that do not provide an adequate level of protection, including the European Commission’s clauses, the United Kingdom’s International Data Transfer Addendum, and any equivalent mechanism recognised under Swiss law.
3. Roles of the parties
You are the controller of Merchant Personal Data, and shopAds is your processor. You determine the purposes for which that data is processed, and shopAds processes it only to provide the Service to you and on your instructions.
Where the Service transfers Merchant Personal Data to a platform that you connect, being your store platform and your product listing account, that platform processes the data under its own terms and under your own relationship with it, and this DPA governs shopAds’ processing rather than theirs. Where the Service transfers Merchant Personal Data to an advertising or measurement platform that shopAds provisions and operates for you within shopAds’ own accounts, shopAds engages that platform as a sub-processor under section 7, except to the extent that the platform processes the data for its own purposes under its own terms, in which case it acts as an independent controller for that processing.
You are responsible for ensuring that you have a lawful basis for the processing, that you have made any required disclosures, and that you have obtained any consents required from your customers and store visitors, including consent for advertising and analytics where the law requires it.
4. Processing details and instructions
The subject matter, duration, nature and purpose of the processing, the types of Merchant Personal Data, and the categories of data subjects are set out in Annex 1.
shopAds will process Merchant Personal Data only on your documented instructions, which include this DPA, the Terms of Service, your configuration and use of the Service, and any further written instructions you give, unless required to process it by a law to which shopAds is subject, in which case shopAds will inform you of that requirement before processing, unless the law prohibits it.
shopAds will inform you if, in its opinion, an instruction infringes applicable data protection law. shopAds is not responsible for determining whether your instructions comply with the law that applies to you as controller.
5. Confidentiality
shopAds ensures that the people it authorises to process Merchant Personal Data are bound by an appropriate duty of confidentiality, and that access is limited to those who need it to provide the Service.
6. Security
shopAds implements appropriate technical and organisational measures to protect Merchant Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the risk to data subjects. Those measures are described at a general level in Annex 2.
7. Sub-processors
You give shopAds general authorisation to engage sub-processors to process Merchant Personal Data, subject to this section. The categories of sub-processor engaged are set out in Annex 3, and a list of the specific sub-processors is available to you on request from help@shopads.ai.
shopAds imposes on each sub-processor data protection obligations that are no less protective than those in this DPA, and remains responsible to you for the performance of each sub-processor’s obligations.
shopAds will give you reasonable prior notice of any intended addition or replacement of a sub-processor, and you may object on reasonable data protection grounds. If you object, the parties will work in good faith to resolve the concern, and if it cannot be resolved, you may cancel the Service.
8. Data subject rights
Taking into account the nature of the processing, shopAds will assist you by appropriate technical and organisational measures, so far as is possible, to respond to requests from data subjects to exercise their rights. If a request reaches shopAds directly, shopAds will, where it relates to Merchant Personal Data, direct the data subject to you and assist you in responding rather than responding itself.
9. Assistance to the merchant
Taking into account the nature of the processing and the information available to shopAds, shopAds will assist you in meeting your own obligations in relation to the security of processing, the notification of personal data breaches, the communication of breaches to data subjects, data protection impact assessments, and prior consultation with a supervisory authority.
10. Personal data breaches
shopAds will notify you without undue delay after becoming aware of a personal data breach affecting Merchant Personal Data, and will provide you with the information you reasonably need to meet your own breach notification obligations, to the extent that information is available to shopAds.
11. International data transfers
shopAds processes Merchant Personal Data from outside the European Economic Area, the United Kingdom, and Switzerland, and its sub-processors may process it in the United States and other countries. Where Merchant Personal Data originating in the European Economic Area, the United Kingdom, or Switzerland is transferred to a country that has not been recognised as providing an adequate level of protection, the Standard Contractual Clauses apply to that transfer and are incorporated into this DPA by reference, with you as the data exporter and shopAds as the data importer, and with the modules and options that fit a controller to processor transfer. Where onward transfers to a sub-processor occur, equivalent safeguards apply. If shopAds adopts an alternative transfer mechanism recognised under applicable data protection law, that mechanism will apply instead.
12. United States state privacy laws
Where applicable United States state privacy law applies to Merchant Personal Data, shopAds acts as your service provider or processor. shopAds will not sell or share that data, will not retain, use, or disclose it for any purpose other than providing the Service to you or as permitted by law, and will not combine it with data from other sources except as permitted for a service provider. shopAds certifies that it understands and will comply with these restrictions.
13. Return and deletion
On the ending of the Service, shopAds will delete or return the Merchant Personal Data it holds as processor, at your choice, and delete existing copies within 30 days, unless the law requires it to retain the data, in which case shopAds will keep it only for as long as, and only for the purpose for which, the law requires. This includes the Merchant Personal Data held within the advertising account and the analytics property that shopAds provisioned and operated for you, which shopAds removes by deleting the advertising audiences built from your customer data and deleting that analytics property. The advertising account itself is deactivated within the same 30 days, so that it can no longer serve or incur spend and holds no Merchant Personal Data, and is retired thereafter.
14. Audits and information
shopAds will make available to you the information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you appoint. To limit disruption, shopAds may satisfy an audit by providing relevant documentation and responding to reasonable questions, audits will take place on reasonable notice and no more than once a year unless a regulator requires otherwise or a breach has occurred, and each party bears its own costs.
15. Liability
Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service.
16. Term
This DPA takes effect when you accept it and continues for as long as shopAds processes Merchant Personal Data on your behalf. The provisions that are intended to survive termination, including those on return and deletion, confidentiality, and transfers, continue to apply after the Service ends for as long as shopAds holds Merchant Personal Data.
17. Governing law
This DPA is governed by the law that governs the Terms of Service, except that where the Standard Contractual Clauses apply, they are governed by the law their own terms specify.
18. General
This DPA, the Controller and Processor Split, the Privacy Policy, and the rest of the Terms of Service together set out how shopAds handles personal data. If any part of this DPA is found to be unenforceable, the rest remains in force. Notices under this DPA are given in the way set out in the Terms of Service, and you can contact shopAds about this DPA at help@shopads.ai.
Annex 1: Details of processing
Subject matter: the provision of the shopAds service, being the automated management of the merchant’s online advertising.
Duration: for as long as shopAds provides the Service to the merchant, followed by return or deletion as set out in this DPA.
Nature and purpose: processing Merchant Personal Data to build and manage the merchant’s advertising, to build advertising audiences for the merchant’s own campaigns, to measure conversions, and to report results to the merchant.
Types of Merchant Personal Data: customer name and email, order details, a click identifier that links an advertisement to a resulting order, and session and behavioural data collected on the merchant’s store. It does not include special categories of personal data, which the merchant must not direct shopAds to process through the Service.
Categories of data subjects: the merchant’s customers and the visitors to the merchant’s store.
Annex 2: Technical and organisational security measures
shopAds applies measures appropriate to the sensitivity of the data, including the encryption of data in transit and at rest, additional application layer encryption of the credentials that connect to your accounts, access controls that limit access to personal data to those who need it, logging of access to personal data, separation of test and production data, encrypted backups, and a documented process for responding to security incidents. These measures are reviewed and updated as the Service and the risks to it change.
Annex 3: Sub-processors
shopAds engages the following categories of sub-processor to process Merchant Personal Data on its behalf in providing the Service:
- advertising and measurement platforms, being the platforms on which shopAds builds, runs, and measures the merchant’s advertising, within the advertising account and the analytics property that shopAds provisions and operates for the merchant inside shopAds’ own accounts;
- cloud hosting and database providers, which run the application and store data;
- artificial intelligence service providers, which process product and account data for enrichment and for the support assistant, and which do not use the data to train their own models;
- a payment processing provider, in connection with the management fee; and
- a banking and settlement provider, in connection with fee settlement.
To the extent that an advertising or measurement platform processes Merchant Personal Data for its own purposes under its own terms, it acts as an independent controller for that processing rather than as a sub-processor of shopAds.
Separately, the platforms that the merchant connects, being the merchant’s store platform and the merchant’s product listing account, process Merchant Personal Data under their own terms and under the merchant’s own relationship with them, rather than as sub-processors of shopAds.
A list of the specific sub-processors is available on request from help@shopads.ai, and shopAds gives reasonable prior notice of changes as set out in section 7.