Merchant data-processing terms

Updated 13 October 2026. These terms form part of the Loyalty Trails service terms for merchants. Processor: Buda Sándor EV, Budaweb.hu, 1196 Budapest, Fő utca 78., Hungary; hello@budaweb.hu. The installing merchant is the controller of customer loyalty data.

Scope and instructions

Processing lasts for the service relationship and its documented deletion/recovery periods. It consists of receiving Shopify events, recording eligible purchase values, calculating loyalty progress, issuing and reconciling rewards, authenticating access and handling privacy requests. Data subjects are store customers and merchant/staff users. Data categories and providers are listed in the privacy notice. No special-category data is required. Merchants must not upload such data in labels, icons or support requests.

We process personal data only on documented merchant instructions, including settings and authenticated requests in the app, unless applicable law requires otherwise. Where permitted, we inform the merchant of a legal requirement before processing. We notify the merchant if an instruction appears to infringe applicable data-protection law. Merchants are responsible for lawful collection, customer notices, consent where needed and the accuracy of their instructions.

Confidentiality and safeguards

Authorized persons are bound to confidentiality and access is restricted to service delivery and support. Measures include HTTPS, encrypted hosting storage, server-side secrets, signed Shopify requests, store/customer isolation, restricted backups, recovery integrity checks and deletion-aware restoration. We review and adjust safeguards to risk and investigate reported security issues. No method is a guarantee against all incidents.

Subprocessors and transfers

The merchant gives general authorization for infrastructure subprocessors necessary to operate the service. Render hosts the app and database in Frankfurt. Shopify provides the merchant platform, authentication, discount APIs and billing and may also act independently under its own terms. Nethely provides DNS; private source code is hosted on GitHub without production customer databases. Current purposes and links to provider terms appear in the privacy notice. We require applicable data-protection obligations from subprocessors and remain responsible for their performance of our processor obligations.

We give merchants at least 30 days’ notice of a planned new subprocessor that will process customer data, allowing reasonable data-protection objections. If an objection cannot be resolved, the affected service can be ended before the change. Necessary international transfers must use an applicable lawful transfer mechanism, including standard contractual clauses where required; selecting an EU hosting region alone does not establish such a mechanism.

Optional email and referral processing

Enabling Pro loyalty emails instructs us to check consent and pass the event data described in the privacy notice to Shopify Flow. The merchant installs and configures Shopify Flow and Shopify Messaging, its sender and the desired workflows. Shopify processes recipient addresses and campaign delivery under the merchant's Shopify terms; the app's Flow transport does not retrieve recipient addresses or forward them to Resend. Event acceptance does not establish delivery. App opt-out and current Shopify marketing consent are checked before event submission. Referrals process identifiers, attribution and bonus history as described in the privacy notice.

Resend is restricted to separately authorized internal test recipients and is disabled for merchant production sending. Historical test data remains subject to the Resend DPA and the privacy notice. A future production subprocessor change would follow the notice process above. No existing store is automatically opted into email sending. Provider-side deletion requests are coordinated through support.

Assistance, incidents and audit

Taking account of the processing and information available, we assist with access, correction, deletion and other data-subject requests, security obligations, breach notifications, impact assessments and prior consultation. Customers are directed to their merchant unless law requires a direct response. We notify the merchant without undue delay after becoming aware of a personal-data breach, provide available information in stages and cooperate on mitigation. The merchant remains responsible for its own regulatory and customer notifications.

We make information reasonably necessary to demonstrate compliance available and allow proportionate audits or inspections by the merchant or its independent auditor, subject to confidentiality, security and protections for other merchants’ data. Contact hello@budaweb.hu to arrange assistance or an audit.

Return and deletion

Merchants can retrieve customer-specific exports in the Privacy requests page and request service data through support. On termination, we delete or return personal data at the merchant’s choice, unless law requires retention. Shopify uninstall and redaction events drive app deletion as described in the privacy notice. Restricted backups expire through their documented rotation; deleted information must not be reintroduced into service from an older snapshot. An anonymous count of used launch-price places may remain without shop or subscription identifiers.

These terms govern processing obligations without reducing rights required by applicable law. For conflicts about processing, these terms prevail over general service descriptions. Contact hello@budaweb.hu for documented additional instructions or a signed copy.