Bundle Station — Merchant Data Processing Agreement

Published version approved by the Provider on September 27, 2026. Effective for a merchant upon express acceptance.

Version: 2026-09-27. Provider: Mohamed Abdelsalam Abdelhameed Abdelrahman, operating Bundle Station. Contact: mohamedabdelsalam@masriatextile.com.

Parties and scope

The merchant identified by the authenticated Shopify store is the controller of its shoppers’ personal data. The Provider processes that data for the merchant to deliver Bundle Station. This agreement covers bundle analytics, order attribution and associated support, throughout installation and the subsequent return or deletion of app records. It does not replace Shopify’s agreements with the merchant or govern data Shopify processes independently.

Processing schedule

- People: store visitors and shoppers whose activity or orders relate to bundle offers. - Data: store and offer identifiers; consented widget-event identifiers, types and timestamps; attributed order identifiers and dates; currencies, bundle-item values, refunds, cancellations and test-order flags; privacy-request identifiers and relevant order references. - Operations: collection from Shopify or consented widget events, validation, storage, attribution, reporting, correction, export and deletion. - Limits: no shopper names, contact details, addresses or payment-card data are stored in bundle analytics. No sale of shopper data, advertising profiles or automated decisions producing legal or similarly significant effects.

Merchant account sessions and support correspondence are separately described in the privacy policy. The Provider will not use shopper information for unrelated purposes.

Instructions and confidentiality

The merchant’s app settings, authenticated use and documented support requests are instructions. The Provider follows lawful instructions and alerts the merchant if an instruction appears unlawful. A legally required disclosure is notified in advance unless prohibited. People authorized to access data must be bound to confidentiality and limited to the access necessary for their work.

Merchant responsibilities

The merchant must have authority to provide the data, give appropriate shopper notices, maintain lawful processing grounds and configure Shopify’s privacy controls correctly. The person accepting must be authorized to bind the merchant. The merchant must not submit unnecessary sensitive information through support.

Security and incidents

The Provider maintains authenticated access, store-scoped application queries, HTTPS, verified webhook signatures and encrypted database connectivity, together with the hosting providers’ storage protections. Credentials must remain protected and access limited. The Provider will notify the merchant without undue delay after becoming aware of a personal-data breach affecting its data, share available information about impact and mitigation, and provide updates as the investigation develops.

Providers and international processing

The merchant authorizes Cloudflare for hosting and connectivity and Supabase for the application database, currently in Ireland. Cloudflare may process requests across its global network. Shopify supplies the commerce platform under its own merchant agreement. The Provider remains responsible for its subprocessors’ performance of applicable data-protection obligations and must put appropriate contractual protections in place.

Before adding or replacing a subprocessor, the Provider will give at least 30 days’ notice through the app or the merchant’s contact channel. The merchant may object on reasonable data-protection grounds. If no suitable alternative can be agreed, the affected processing must cease and the merchant may discontinue the app.

Where applicable law requires a transfer mechanism, the parties must establish and document that mechanism before the affected international processing. This agreement does not itself certify that standard contractual clauses, a UK addendum or another transfer instrument have been executed.

Assistance and verification

The Provider will reasonably assist with access, correction, deletion and other applicable rights requests, security obligations and required impact assessments or regulatory consultations. Direct shopper requests are referred to the merchant unless law requires another response. The Provider will make relevant compliance information available and allow reasonable audits, subject to confidentiality, security and protection of other merchants’ data.

Return, retention and deletion

Historical bundle records remain while the app is installed to support the merchant’s reporting. The merchant may request return or deletion through support. Customer-erasure webhooks remove the specified order records; a store-scoped fingerprint prevents re-import until store erasure. Uninstall notifications remove authentication sessions. Shopify’s subsequent store-erasure request removes the store’s app records. Where legally required retention applies, the Provider must identify the basis, restrict further use and delete when that duty ends. Backups expire under provider lifecycles and must not restore erased records into ordinary use without reapplying deletions.

Acceptance and changes

An authorized merchant must expressly accept this published version before activation. The app records the store, version, content fingerprint and UTC acceptance time and provides a printable copy. Installation alone must not be recorded as express acceptance. Material changes require notice and renewed acceptance. Statutory obligations and individual rights are not waived by this agreement.