Data Processing Agreement
1. Scope and precedence
1.1 This Data Processing Agreement ("DPA") is between Cloudlift GmbH, Bächaustrasse 61, 8806 Bäch, Switzerland (CHE-309.805.112) ("Cloudlift", "we") and the merchant who installs one of our apps for Shopify ("Customer", "you").
1.2 It applies whenever Cloudlift processes personal data on your behalf while providing the apps listed in Annex 1 (the "Services"). It forms part of our Terms of Service (the "Agreement"), and you accept it when you install an app or accept the Agreement.
1.3 It is drafted to meet GDPR Art. 28, the Swiss Federal Act on Data Protection ("FADP") Art. 9, the UK GDPR and, for shoppers in California, the CCPA/CPRA rules for service providers (together "Data Protection Law"). Terms such as controller, processor, personal data and data subject have the meaning given in the GDPR.
1.4 If this DPA and the Agreement conflict on the processing of personal data, this DPA prevails. If Standard Contractual Clauses apply under section 10, they prevail over this DPA.
1.5 This table shows where this DPA covers each requirement of GDPR Art. 28(3):
| Art. 28(3) | Requirement | DPA section |
|---|---|---|
| (a) | Processing only on documented instructions | 3 |
| (b) | Confidentiality of authorised persons | 4.2 |
| (c) | Security of processing (Art. 32) | 6, Annex 3 |
| (d) | Conditions for engaging subprocessors | 7, Annex 2 |
| (e) | Assistance with data subject requests | 4.3 |
| (f) | Assistance with Art. 32 to 36 | 4.4, 9 |
| (g) | Deletion or return at the end of the Services | 11 |
| (h) | Information and audits | 8 |
2. Roles
2.1 For the personal data of your shoppers and customers that reaches the Services through your store ("Customer Personal Data"), you are the controller and Cloudlift is your processor. Annex 1 lists the data, the data subjects and the purposes.
2.2 For the data of you and your staff that we need to run your account, bill you, support you and improve the Services, Cloudlift is an independent controller. Our Privacy Policy covers that processing, not this DPA.
2.3 Shopify is your provider, not ours. Data that Shopify holds, and data that you send to other apps or tools, is outside this DPA.
2.4 Data protection representative of Cloudlift GmbH: Michael Hässig, privacy@cloudlift.app. All questions and requests under this DPA, including those of supervisory authorities, go to this address.
3. Instructions
3.1 We process Customer Personal Data only on your documented instructions. The Agreement, this DPA, your app settings and the actions you take in the app admin are your complete instructions at the time you accept.
3.2 Further instructions must be in writing (email is enough) and within the scope of the Services. If an instruction costs us extra effort outside the Services, we may charge for it after telling you the price.
3.3 We tell you without delay if we believe an instruction breaks Data Protection Law. We may then pause that instruction until you confirm or change it.
3.4 We may process Customer Personal Data without an instruction only where EU or Member State law, or Swiss law, requires it. We tell you first unless that law forbids it. If an authority asks us for Customer Personal Data, we disclose only the minimum the law requires and tell you, unless the law forbids it. This does not relieve us of our duties under this DPA.
4. Our duties as processor
4.1 Purpose limitation. We use Customer Personal Data only to provide, secure and support the Services. We do not sell or share it (as the CCPA defines these terms), use it for our own marketing, combine it with data from other customers, or use it to train AI models.
4.2 Confidentiality. Everyone at Cloudlift with access to Customer Personal Data is bound to confidentiality and gets access only where their work needs it.
4.3 Data subject requests. If a shopper contacts us directly, we refer them to you. The app lets you find and delete a shopper's files. For what the app cannot do, we help you on request, at your cost where the effort is significant.
4.4 Assistance. We give you the information you reasonably need for a data protection impact assessment, a prior consultation with an authority, or to show compliance with Art. 32 to 36 GDPR. This DPA and its annexes are the first source; help beyond them is at your cost.
4.5 Records. We keep a record of processing activities as Art. 30(2) GDPR and FADP Art. 12 require.
5. Your duties as controller
5.1 You are responsible for the lawfulness of the processing you instruct, including a legal basis for letting shoppers upload files and for any marketing consent you collect through the Services.
5.2 You inform your shoppers in your own privacy notice that you use Cloudlift as a processor, with a link to this DPA or our subprocessor list.
5.3 You do not ask shoppers to upload special categories of data (GDPR Art. 9) or data about criminal convictions, unless you have a legal basis and have told us in writing.
5.4 You keep your Shopify and app admin access secure and tell us without delay if you suspect that someone misuses it.
6. Security
6.1 We implement the technical and organisational measures in Annex 3. They take into account the state of the art, the cost, and the nature and risk of the processing.
6.2 We may improve the measures over time. We will not lower the overall level of protection.
7. Subprocessors
7.1 You give us general authorisation to engage the subprocessors listed in Annex 2. The current list is published at subprocessors, with the date of its last change.
7.2 We update the list at least 14 days before a new or replacement subprocessor starts processing Customer Personal Data. We announce each change with a notice in the app admin, and by email if you ask for it at privacy@cloudlift.app. You may object in writing within those 14 days on reasonable data protection grounds.
7.3 If we cannot address your objection, you may stop using the affected Service and uninstall the app.
7.4 We bind every subprocessor in writing to data protection duties that are no less protective than this DPA.
8. Audits
8.1 Once a year you may ask for the information you need to verify that we meet this DPA. We answer with this DPA, written replies and the audit reports of our hosting provider.
8.2 A further audit takes place only after a personal data breach affecting Customer Personal Data, when a supervisory authority requires it, or when that information does not show that we meet this DPA. It is done remotely where possible, by you or an independent auditor bound to confidentiality who does not compete with us, after 30 days' notice and without disrupting operations, and at most once a year unless a breach or an authority requires another. You bear the reasonable costs, including our time.
8.3 We do not allow on-site audits of our subprocessors' data centres. Their reports take that place.
8.4 Nothing in this section limits your rights under GDPR Art. 28(3)(h) or the powers of a supervisory authority.
9. Personal data breaches
9.1 We notify you without undue delay after we become aware of a personal data breach affecting Customer Personal Data, and where feasible within 48 hours.
9.2 The notice goes to the shop's contact email and gives, as far as known, the information Art. 33(3) GDPR requires. We add details as we learn them.
9.3 We take reasonable steps to contain the breach and help you meet your own notification duties. A notice from us is not an admission of fault.
10. International transfers
10.1 To Cloudlift. Cloudlift is established in Switzerland. The European Commission and the UK recognise Switzerland as providing adequate protection, so a transfer from the EEA or the UK to us needs no further safeguard.
10.2 Where the data is. Annex 1 lists the storage regions.
10.3 Onward transfers. Where a subprocessor sits in a country without an adequacy decision, we rely on, in this order:
- the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework, where the subprocessor is certified;
- otherwise the Standard Contractual Clauses of the European Commission (Decision 2021/914, Module 3, processor to processor), with the amendments the Swiss FDPIC requires for FADP transfers and the UK International Data Transfer Addendum for UK data.
10.4 Annex 2 names the safeguard for each subprocessor.
11. Deletion and return
11.1 While the app is installed, your settings and actions decide how long files are kept. Archived files stay until you delete them or your storage retention setting removes them.
11.2 We delete Customer Personal Data at the latest:
- temporary data (working copies of uploaded files, upload records, order data received from Shopify): 30 days after it is created;
- files you delete in the app, or that a Shopify
customers/redactrequest covers: offline at once, removed from storage within 7 days; - all other Customer Personal Data of the shop: deleted or made permanently inaccessible when we receive the
shop/redactnotice that Shopify sends after your uninstall, with files removed from storage within 7 days of that notice. Working copies still used by another of our apps on the shop follow the 30-day rule.
Database backups and application logs are kept for at most 30 days.
11.3 When the Services end, you choose whether we return Customer Personal Data (by export in the app, including your archived files one by one or as a ZIP, or on request at privacy@cloudlift.app) or delete it. You can change your choice until the Services end. If you make no choice, we delete it as set out in 11.2 and, on request, confirm the deletion in writing.
11.4 We keep Customer Personal Data longer only where Swiss or EU law requires it, and then only for that purpose. The log of deletion requests is kept for up to 365 days as proof of the deletion.
11.5 Periods that follow a Shopify request start when we receive it.
11.6 You can also delete files in the app at any time, or ask us at privacy@cloudlift.app to delete your shop's Customer Personal Data, independent of Shopify's requests.
12. Liability
12.1 Between the parties, the limitation of liability in section 11 of the Agreement applies to this DPA. One cap covers all claims under the Agreement and this DPA together.
12.2 Fines imposed on a party by an authority stay with that party, unless the other party caused them by breaching this DPA.
13. Term and termination
13.1 This DPA runs for as long as we process Customer Personal Data for you, including after you uninstall until the deletions in section 11 are complete.
13.2 Sections 11, 12 and 14 survive the end of the DPA.
13.3 We may update this DPA to follow changes in law or in the Services. We publish the new version with its effective date, and tell you in the app or by email at least 30 days before a change that reduces your rights takes effect.
14. Governing law and jurisdiction
14.1 This DPA is governed by Swiss law, excluding its conflict-of-law rules.
14.2 The courts of the Canton of Schwyz, Switzerland, have exclusive jurisdiction. Where SCCs apply, their own governing law and forum clauses prevail for matters under them.
14.3 This does not limit rights or remedies that mandatory data protection law gives you or your shoppers, or the competence of your supervisory authority. Where the GDPR applies to you, this DPA is to be read so that it meets GDPR Art. 28(3).
Annex 1: Details of the processing
Services: the Cloudlift apps for Shopify that let shoppers upload files and personalise or configure products. All services run on one shared platform and process the same categories of data.
Data subjects: visitors and customers of your Shopify store who use an upload field or product options.
Nature and purpose: receiving, storing, converting and rendering shopper files and option choices, attaching them to cart and order line items, archiving them with the order, showing them to you in the app, producing print exports, running the AI features you enable, and deleting them on the schedule in section 11.
Frequency and duration: continuous while the app is installed, then until the deletions in section 11 are complete.
Special categories: none intended (section 5.3).
| Category | Examples |
|---|---|
| Uploaded files | Images, PDFs and other files a shopper uploads, with their file names, size and type; previews, thumbnails, conversions and print exports made from them |
| Personalisation | Text, option choices and design configurations a shopper enters; AI images generated from a shopper's prompt or photo |
| Order references | Shopify order id, order number, line item, product and variant |
| Customer references | Shopify customer id and company id of a signed-in shopper, used for their library of saved files and items |
| Guest save email | An email a shopper types to save items as a guest. We pass it to Shopify to create the customer and do not store it |
| Technical data | IP address, browser user agent and request path in application logs; a session token cookie in the shopper's browser |
Storage regions: Customer Personal Data, including uploaded files and the previews, conversions and print exports made from them, is stored in the shop's storage location: the United States by default, or the European Union or Asia where offered and chosen. App configuration data is kept in the United States. AI features process data at the subprocessors in Annex 2, and only when used. If no AI feature is enabled, no uploaded files, file names or order data are sent to AI providers.
Annex 2: Subprocessors
The subprocessors that may process Customer Personal Data are listed at subprocessors, with their entity, purpose, data, location and transfer safeguard. That list is Annex 2 of this DPA, and section 7 governs changes to it.
Shopify is not our subprocessor: you contract with Shopify directly.
Annex 3: Technical and organisational measures
| Area | Measure |
|---|---|
| Encryption | Traffic is encrypted in transit (TLS). Stored data is encrypted at rest by our hosting provider. |
| File access | Uploaded files are stored under random identifiers that cannot be guessed and are served only over encrypted connections (HTTPS). The link to a working copy is shared only with the cart and order it belongs to. Working copies expire after at most 30 days, and deleting a file disables its link at once. The links do not rely on a sign-in because shoppers often order as guests without an account. Archived files are kept in private storage and are reachable only through the authenticated app admin. |
| Authentication | The app admin opens only through Shopify admin. Webhooks are accepted only with a valid Shopify signature. |
| Staff access | Production access is limited to authorised Cloudlift staff who need it for their work. |
| Availability | Managed cloud services, regular database backups, and a recovery window before deleted files are purged. |
| Logging | Deletion requests and Shopify privacy requests are logged per shop. |
| Incidents | Systems are monitored. Section 9 sets the breach process. |
| Subprocessors | Chosen for their security certifications and bound by written data protection terms. |
Effective date: 2026-11-01. Version 1.0.