OUR DOCUMENTS

Data processing agreement

Version 2026-10-05 — effective 5 October 2026. A professional legal review is planned; any changes will be published as a new version, with notice as described in the merchant terms.

This data processing agreement ("DPA") forms part of the Momentburst merchant terms. It applies when a merchant installs and uses the Momentburst: Football Sales Shopify app and accepts the merchant terms and this DPA in the app.

Parties and roles

Controller: the business that operates the Shopify store on which the app is installed ("Merchant"), as identified by its Shopify store in the acceptance record.

Processor: Ted Cane trading as Momentburst, a sole trader based in London, United Kingdom ("Momentburst"). Contact: support@momentburst.com. Momentburst is contactable by email only, and notices are given by email as described under "Notices".

The Merchant is the controller of the personal data of its customers that the app processes. Momentburst processes that data as the Merchant's processor. Momentburst is a separate controller for merchant account and contact data, as described in the Momentburst privacy policy; this DPA does not cover that data.

This DPA is intended to meet Article 28(3) of the UK GDPR and, where it applies, the EU GDPR. If this DPA conflicts with the merchant terms on personal data, this DPA prevails.

Details of processing

Subject matter: providing the app: creating timed Shopify discounts and storefront banners when the Merchant's chosen football team scores, wins or keeps a clean sheet; optionally sending the Merchant's Klaviyo campaigns and Shopify Flow triggers; and measuring which orders used a moment's discount.

Duration: while the app is installed, plus the deletion periods in the retention section below.

Nature and purpose: receiving Shopify order webhooks; extracting minimal order fields; matching orders to moments by discount title; storing and summarising results; reading past order totals on demand to estimate a sales baseline; creating, sending and cancelling Klaviyo campaigns in the Merchant's own account to the lists the Merchant selects; responding to Shopify data-request and redaction webhooks; and sending data-request exports to the Merchant by email.

Categories of data subjects: the Merchant's customers whose orders used a discount created by the app, customers whose orders fall in a baseline period, and, where the Merchant uses email moments, the members of the Klaviyo lists the Merchant selects. List members' details stay in the Merchant's Klaviyo account; the app handles only the list IDs and the campaign content.

Categories of personal data: Shopify order ID, order number, order total and currency, order creation time, and the discount titles applied. The order data can be linked to a customer by the Merchant and Shopify, so it is treated as personal data. Storefront requests forwarded by Shopify's app proxy include a logged-in customer's Shopify customer ID in the request address; the app does not read, store or log it (see the security schedule).

Klaviyo email: in production, the app sends a permitted store's moment emails only to the lists that store selects for each rule, in its own connected Klaviyo account. The Merchant is the controller of that email and its recipients, and Klaviyo is the Merchant's own provider under the Merchant's agreement with Klaviyo, not a sub-processor of Momentburst. Momentburst's development and staging environments can send only to Momentburst's own internal test list and never use a Merchant's Klaviyo account.

Data the app does not process: customer names, email addresses, phone numbers and postal addresses are not requested or stored. Klaviyo profiles and list members are not copied into the app. No special-category or criminal-offence data is processed, and the Merchant must not enter such data in rule, banner or email text.

Momentburst's obligations

1. Instructions. Momentburst processes the personal data only on the Merchant's documented instructions. The merchant terms, this DPA and the Merchant's settings in the app are the Merchant's complete instructions, including on transfers. Momentburst will tell the Merchant if it believes an instruction breaks data protection law, and will tell the Merchant before processing if the law requires other processing, unless the law forbids telling.

2. Confidentiality. Only Ted Cane has access to the personal data. Anyone later given access will be bound by confidentiality.

3. Security. Momentburst maintains the measures in the security schedule below and may improve them, but will not reduce overall protection.

4. Sub-processors. The Merchant gives general authorisation for the sub-processors listed below. Momentburst will give at least 30 days' notice of a new or replacement sub-processor by email to the store's contact email address and by updating the list. The Merchant may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, the Merchant may stop using the app and uninstall it, and no further fees will be charged after the end of the current billing period. The terms under which Momentburst uses each sub-processor are stated in the list below. Momentburst remains responsible to the Merchant for the performance of each sub-processor.

5. Data subject requests. Momentburst assists the Merchant through Shopify's mandatory compliance webhooks. For customers/data_request, Momentburst compiles the data it holds for the named orders and sends it to the Merchant's store contact email within 30 days of receipt. For customers/redact, the app deletes the named orders automatically on receipt, recalculates affected results and removes queued work for those orders. Momentburst will forward to the Merchant, without responding, any request it receives directly from a data subject.

6. Assistance. Taking into account the nature of processing and the information available, Momentburst will reasonably assist the Merchant with security, breach notification, data protection impact assessments and prior consultation with a regulator.

7. Personal data breaches. Momentburst will notify the Merchant without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Merchant's data, by email to the store's contact email address. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of records and data subjects, likely consequences and the measures taken or proposed, and will be updated as more information becomes available.

8. Deletion at the end of the service. The Merchant ends processing by uninstalling the app. On uninstall the app deletes Shopify access tokens immediately, stops all new moments and emails, pauses rules and cancels unsent Klaviyo campaigns before deleting the Klaviyo key. Shopify sends a shop redaction request 48 hours after uninstall, and the app then deletes the Merchant's remaining data automatically. Deleted data may remain in encrypted database backups for up to 3 days. Data-request exports already sent to the Merchant by email remain in Momentburst's support mailbox as set out in the retention schedule. If the Merchant wants a copy of its order data before deletion, it should ask before uninstalling or within 48 hours of uninstalling.

9. Information and audits. Momentburst will make available the information reasonably necessary to demonstrate compliance with this DPA, mainly by written answers and this DPA's schedules. Where that is not enough, or a regulator requires it, the Merchant may carry out an audit or inspection on at least 30 days' notice, no more than once a year, at its own cost, during business hours and subject to confidentiality.

10. Transfers. The app's servers and database are in the EU (Frankfurt). Momentburst will only transfer the personal data outside the UK or EU, or allow access from outside them, where an appropriate safeguard under applicable law is in place, such as the UK International Data Transfer Addendum, Standard Contractual Clauses or an adequacy regulation. For Render, transfers rely on the EU-U.S. Data Privacy Framework, including its UK Extension, and, if the Framework does not apply, on the EU Standard Contractual Clauses with the UK Addendum, as provided in Render's Data Processing Addendum. The sub-processor list below states the position for each provider.

Merchant's obligations

The Merchant confirms that it has a lawful basis for the processing, that its own privacy notice to customers tells them about it (including the use of service providers such as Momentburst), that it holds any consent its marketing requires, and that its instructions comply with the law. The Merchant is responsible for its own Shopify and Klaviyo accounts and the agreements it has with Shopify and Klaviyo.

Retention schedule

The app deletes data according to its code. A cleanup job runs daily at 03:30 UK time.

Security schedule

Hosting: Render, Frankfurt (EU): web service, background worker and managed PostgreSQL 17 database.

Encryption: the database and its backups are encrypted at rest with AES-256 by Render. The database accepts no public connections; the app connects over TLS on Render's private network. The app is served over HTTPS, and all calls to Shopify, Klaviyo and API-Football use HTTPS. Klaviyo keys and sender details are additionally encrypted by the app with AES-256-GCM, using a key held only in the hosting environment.

Access control: only Ted Cane can access the hosting account, database and production secrets. Admin pages require a valid Shopify session; the operator console requires a secret token of at least 32 characters, compared in constant time.

Request verification: every Shopify webhook is HMAC-verified and every storefront proxy request is signature-verified before use. Requests from stores that have not installed the app are rejected.

Data minimisation: the app requests four Shopify scopes (write_discounts, read_orders, read_products, write_app_proxy) and no protected customer name, email, phone or address fields. The order webhook handler discards everything except the minimal order fields before queueing.

Logging: application logs redact tokens, keys, passwords and email fields, and error reports are scrubbed of secrets. Since 5 October 2026 the web server's request log records only the method, path (without query string), status, size and response time, so Shopify customer IDs and session tokens carried in URLs are not logged. Request logs written before that change, which cover the development store only and may include those query strings, expire under Render's 7-day log retention. Render's own HTTP request logs are not available on Momentburst's workspace plan, so the only request logs are the app's own.

Separation and resilience: development and production use separate databases, credentials and Shopify app records. Render keeps 3 days of continuous point-in-time recovery. Failed background jobs are retried and then recorded for operator review. Dependencies are checked for known vulnerabilities in continuous integration.

Not used: no external error-tracking (such as Sentry) or third-party alerting service is configured.

Sub-processors

Render uses its own sub-processors under Render's Data Processing Addendum, currently Amazon Web Services, Google Cloud Platform, Cloudflare and ClickHouse, which Render lists as hosting or cloud-platform providers in the United States (Render's list). Render delivers requests to the app, including Shopify order webhooks and storefront requests, through its network edge, which uses Cloudflare as Render's sub-processor, so personal data in those requests passes through Cloudflare's network in transit.

These are not sub-processors: Shopify and Klaviyo, which are the Merchant's own services under the Merchant's agreements with them; API-Football, which supplies match data and receives no personal data; the website hosting and DNS that Momentburst's own Cloudflare account provides, which involve no personal data covered by this DPA; and GitHub, which holds source code only.

Notices

Notices under this DPA are given by email, as under the merchant terms. Notices to Momentburst must be sent to support@momentburst.com. Momentburst sends notices to the Merchant, including breach and sub-processor notices, to the store's contact email address in Shopify. An emailed notice is treated as received when it is sent, unless the sender receives a message saying that it was not delivered. In that case the notice has not been given, and the sender should check the email address and send it again.

Acceptance

The Merchant accepts this DPA, together with the merchant terms, by ticking the acceptance checkbox in the app. Any staff member with access to the app may accept and, by accepting, confirms that they are authorised to accept on behalf of the store. The acceptance record identifies the store, the document versions, the time of acceptance and the accepting staff member's Shopify user ID. After shop redaction, Momentburst keeps only a keyed hash (HMAC) of the store's domain, the document versions, the acceptance time and the time that record was written, for 6 years from when it was written.