Data Processing Agreement (DPA)

Parties

Controller: The Customer (the business that has accepted Klirry's Terms of Service).

Processor: Per Philip Alexander Hjelmberg, a sole proprietorship (enskild firma), Drottninggatan 12, 352 29 Växjö, Sweden, Swedish VAT number SE850529273301 ("Klirry"), operated by its founder.

Together referred to as "the Parties".

When this DPA applies. This DPA is accepted together with the Terms of Service and is binding before any processing on the Customer's behalf takes place: it applies from the moment the Customer connects a store or uploads data, including during the 21-day Trial and on test accounts.

Scope note: This DPA governs Klirry's processing of Order Data only — the activity where Klirry acts as a processor on the Customer's documented instructions. Account Data (the Customer's own staff logging into Klirry) is processed by Klirry as an independent controller, determining its own purposes and means, and is governed by the Terms of Service and Privacy Policy, not this DPA — see the "Our two roles" section of the Privacy Policy. Where this DPA's operational sections (e.g. Section 7, deletion) describe a pipeline that deletes both Order Data and Account Data together, that describes the technical mechanism only; it does not extend Article 28 processor obligations to Account Data.

Definitions

Document structure

This DPA consists of the main body and four annexes:

• Annex 1 — Data Subjects and Personal-Data Categories
• Annex 2 — Technical and Organisational Measures (TOMs)
• Annex 3 — Sub-processors (generated from the vendor register)
• Annex 4 — Connected platforms: the Customer's own platforms that Klirry reads from or sends to on the Customer's instruction (generated from the same register; not sub-processors)

1. Subject matter, duration, nature and purpose

1.1 Subject matter

Klirry processes Personal Data on behalf of the Controller to provide the Services: computing true profit for the Controller's e-commerce business by combining order data, payment-fee and shipping-cost records, ad spend, VAT rates and the Controller's cost settings, and turning it into decisions on advertising, products, countries and markets, payment methods and shipping. Google Analytics 4 data, when connected, is a directional signal only and is never included in the profit figure.

1.2 Nature of processing

• Collection: Order Data and ad-spend data are collected through the Controller's integrations with its e-commerce platform and advertising accounts (read-only queries; see Terms §3 for the only objects Klirry creates on a platform) and from files the Controller uploads (for example payment-provider settlement files and carrier invoices).
• Storage: Data is stored in the EU on Klirry's infrastructure (see Annex 2).
• Aggregation: Order Data is aggregated per date, country, product, payment method, shipping method and campaign to compute profit and decisions.
• No processing for own purposes: Klirry does not use Order Data for its own marketing, resale, benchmarking or analytics purposes, and does not use it to train AI models.

1.3 Purpose of processing

The sole purpose of Processing under this DPA is to deliver the Services as described in the Terms of Service, §3 ("What the service does").

1.4 Duration

Processing starts when the Customer connects a data source or uploads data, and continues until the agreement ends and the retrieval period in Section 7 has ended.

2. Processor obligations

2.1 Documented instructions

Klirry processes Personal Data only on the documented instructions of the Controller. The Services as configured by the Customer constitute the complete set of instructions. If Klirry considers that an instruction infringes data protection law, it informs the Controller without undue delay.

2.2 Confidentiality and support access

Klirry ensures that all persons authorised to process Personal Data are subject to a confidentiality obligation. Access to production Personal Data is limited to the founder and any person with a documented operational need (least privilege). For support, the founder can open an account as the Customer (impersonation); each start and stop is recorded in the audit log with the acting founder and the account, and the impersonated session is shown as such inside the application. Impersonation is used only to answer a support request or investigate a fault.

2.3 No processing for own purposes

Klirry does not process Order Data for any purpose other than performing the Services.

2.4 International transfers

Klirry does not transfer Personal Data of the Controller to a country outside the EU/EEA, or to an international organisation, except on the Controller's documented instructions or where required by EU or Member State law (in which case Klirry informs the Controller beforehand unless the law forbids it). A permitted transfer is made only under a mechanism valid under GDPR Chapter V (an adequacy decision or Standard Contractual Clauses with supplementary measures where needed). Order Data is hosted in the EU; Annex 3 states the region of every sub-processor, including any transfer outside the EU/EEA.

2.5 Security and assistance (Articles 32–36)

Klirry implements the measures in Annex 2 (Article 32) and, taking into account the nature of the processing and the information available to it, assists the Controller in ensuring compliance with Articles 32 to 36: personal data breach notification (Section 5), data protection impact assessments and prior consultation, by supplying the information about the processing described in this DPA on written request within 30 calendar days.

3. Sub-processor authorization

3.1 General authorization

The Controller grants Klirry general written authorization to engage Sub-processors for the purposes of providing the Services, subject to this Section.

3.2 Current Sub-processors

The Sub-processors are listed in Annex 3, generated from the same register as the public page /legal/subprocessors, so the two cannot differ. Annex 3 is part of this DPA. A vendor marked "Not yet engaged" is added only after the notice in Section 3.3. Tools that Klirry uses as controller for its own purposes (billing, newsletter, website analytics) are not Sub-processors of the Controller's data; they appear on the public page for transparency only.

3.2a Flow-down and responsibility

Klirry imposes on every Sub-processor, by written contract, data protection obligations no less protective than those in this DPA (Article 28(4)), and remains fully liable to the Controller for the performance of its Sub-processors' obligations.

3.3 Changes to Sub-processors

Klirry informs the Controller of any intended addition or replacement of a Sub-processor at least 30 days in advance by email to the Controller's account email address.

3.4 Objection right

The Controller may object to a change by written notice to privacy@klirry.com within 14 days of the notice. If the Parties cannot resolve the objection within 30 days, the Controller may terminate the Services with a pro rata refund of prepaid fees for the unused period.

4. Data subject rights assistance

4.1 Scope of assistance

Klirry assists the Controller in answering requests under GDPR Art. 15–22 by:

• providing a data export of all Order Data and Account Data held for the Customer's tenant, in JSON or CSV, through the self-service export (Settings → Export your data; format documented at /legal/export-format);
• providing hard deletion under Section 7;
• answering written requests for technical assistance within 30 calendar days.

4.2 Limitation on end-consumer requests

Klirry does not store end-consumer names, emails, phone numbers or addresses, so an end consumer who contacts Klirry directly cannot be matched to a record. Such requests are handled by the Controller, who can identify the order in its own store and give Klirry the order identifier so that Klirry can assist. Order records remain pseudonymised personal data that the Controller can re-link (Annex 1, A1.2); this section narrows how a request can reach Klirry, not what the data is.

5. Personal data breach notification

5.1 Klirry's obligations

In the event of a Personal Data breach affecting the Controller's data, Klirry:

1. notifies the Controller without undue delay and at the latest within 24 hours of becoming aware of the breach. Notice may be given in stages: a first notice with what is known, followed by the rest as it becomes known; 2. provides the information required by GDPR Art. 33(3): the nature of the breach and the approximate number of Data Subjects and records, a contact point, the likely consequences, and the measures taken or proposed; 3. cooperates with the Controller in meeting its own duties towards supervisory authorities and Data Subjects; 4. does not inform third parties about the breach on the Controller's behalf, except where the law requires.

5.2 Internal procedure

Klirry keeps an incident procedure and an incident register that tracks the shortest clock that applies: 24 hours (Controller, Shopify), 48 hours (Stripe), 72 hours (supervisory authority, IMY, where Klirry is itself controller).

6. Technical and organisational measures (Annex 2)

The measures are set out in Annex 2. Klirry may update them provided the level of security is not reduced.

7. Deletion and return on termination

7.1 Retrieval period

After the agreement ends (cancellation by the Controller, a trial that is never paid, or a pause for non-payment), the Controller has a retrieval period in which it can download all Order Data and Account Data in JSON or CSV: at least 30 calendar days after cancellation; 30 calendar days from the end of the Trial for a Trial account that never becomes a paying account (deletion on day 51 after the account was opened); 60 calendar days from the pause for an account paused for non-payment. For a Shopify store, the data is deleted within 30 days of the redact request Shopify sends after uninstall.

7.2 What is deleted, and what is kept

After the retrieval period Klirry permanently deletes all Personal Data relating to the Customer's tenant: Order Data (orders, order lines, attribution results, decisions), ad-spend data, payment-fee and shipping-cost records, cost configuration, connections and their credentials, users, sessions and tokens, and the operational records generated by the Customer's use of the product (feedback, notification preferences, cost-review status, classification history, decision receipts, to-do items, the transactional email delivery log). Deletion is executed in batched transactions by the automated purge pipeline.

The only data that is kept is listed exhaustively below, each with its retention and legal basis. This is the one retention table used in the Privacy Policy, this DPA, the records of processing, the data inventory and the data-deletion page. Order Data is never in this table: it is deleted.

7.3 Deletion confirmation

Klirry sends a deletion confirmation to the Controller's account email address within 5 business days of the purge, stating the date and the tables affected (counts, not content).

7.4 Aborted termination

If the Controller reactivates its subscription within the retrieval period, the deletion is cancelled and nothing has been deleted.

8. Audit rights

8.1 Information

Klirry makes available to the Controller all information necessary to demonstrate compliance with GDPR Art. 28, including this DPA and its annexes, the relevant parts of its security documentation and, when available, summaries of third-party audits or penetration tests.

8.2 Audits and inspections

The Controller (or an auditor it appoints under a confidentiality undertaking) may audit Klirry's compliance with this DPA. Audits are carried out first by documentation and security reports; where that is not enough, by an inspection with reasonable notice (normally 30 days), during business hours, once a year unless there is a breach or a supervisory authority requires more, without unreasonably disturbing the service and without access to other customers' data. Klirry's consent is not required for an audit that the GDPR entitles the Controller to; these practical rules only regulate how it is done. Platform operators (for example Shopify) may also review Klirry as their terms require.

8.3 Liability

Klirry's liability under this DPA follows the limitation in the Terms of Service, §13 ("Liability") — the higher of the fees paid in the 12 months before the claim and SEK 10,000, with the same exceptions for intent, gross negligence and liability that cannot be limited by law — unless mandatory law requires otherwise.

9. Governing law and jurisdiction

This DPA is governed by Swedish law, like the Terms of Service (§20). Disputes are settled by the same court as under the Terms of Service: Växjö tingsrätt as court of first instance.

10. Platform-specific provisions

Google Ads (Google Ads API Terms §7(B)). Where the Controller connects a Google Ads account, this DPA is the written contract with the Google Ads program customer required by §7(B)(i): it describes the processing, and Klirry confirms that it processes personal data in line with the Controller's own obligations under Google's applicable data protection terms (§7(B)(ii)) — only to deliver the Services, with no onward use, sale or use for benchmarks or AI training.

Shopify, Meta and others. Platform data is used only for the Controller who connected it, is kept separate from every other customer's data and is not used across customers.

Execution

This DPA forms part of, and is entered into when the Customer accepts, the Terms of Service (including acceptance during sign-up or when installing from Shopify); no separate signature is required. A Customer that needs a signed copy can request one at privacy@klirry.com.

Annex 1 — Data Subjects and Personal-Data Categories

A1.1 Categories of Data Subjects

A1.2 Personal Data Categories — Order Data

A1.3 Explicit negative list — data NOT collected

Excluded at the adapter query level (not fetched, not mapped, not dropped after fetch):

• Customer name, email, phone, address (street, zip, city, postal code)
• IP address, user agent, browser details of end consumers
• Raw carrier tracking numbers and raw click identifiers
• Sub-country geographic data
• Swedish personal identity numbers or equivalents
• Payment card numbers or bank details
• Staff or seller names on refunds
• Custom attributes, order notes and other free-text customer-facing fields (except the product title, which passes the personal-data filter)

These exclusions are enforced in Klirry's data-ingestion code, not by policy alone.

A1.4 Account Data (controller scope, for information)

Account Data is processed by Klirry as controller and is outside this DPA's Article 28 scope.

Annex 2 — Technical and Organisational Measures (TOMs)

The following controls are implemented as of the date of this DPA.

Klirry may strengthen these measures at any time but will not materially reduce them.

Annex 3 — Sub-processors

A provider marked "Not yet engaged" is added only after the notice in Section 3.3, under a written agreement that meets Section 3.2a, and only if it processes data in the EU/EEA or under a valid Chapter V mechanism (Section 2.4).

Annex 4 — Connected platforms (data sources you choose)

The platforms below are the Customer's own: the Customer chooses to connect them and Klirry reads from them (or, for a messaging destination, sends to them) on the Customer's documented instruction under this DPA. They are data sources and destinations chosen by the Customer, not sub-processors of Klirry: Klirry does not engage them to process the Customer's data. Access is read-only wherever the table says so, and the Customer can revoke it at any time in the way the last column describes.

Changelog

Each entry names the version, the date it was written, and what changed. A change of the major version number is a material change: it is announced to customers by email at least 30 days before it takes effect.