Data Processing Agreement

Last updated: August 2026

This Data Processing Agreement (“DPA”) forms part of the agreement between the merchant who installs the Indexly app (“Controller”) and Heath Digital Ltd (“Processor”), and applies wherever the Processor processes personal data on behalf of the Controller in connection with the Indexly service.

1. Parties

1.1 Controller

The merchant entity that installs and uses the Indexly app (“you”, “your”). By installing and using Indexly you agree to the terms of this DPA.

1.2 Processor

Heath Digital Ltd
3 Lambourne Place, London, SE3 7BH, United Kingdom
Email: [email protected]

2. Definitions

In this DPA:

• “Applicable Data Protection Law” means UK GDPR and the Data Protection Act 2018, and where applicable EU GDPR (Regulation 2016/679), and any successor legislation.
• “Personal Data” has the meaning given in Applicable Data Protection Law.
• “Processing” has the meaning given in Applicable Data Protection Law.
• “Data Subject” means the identified or identifiable natural person to whom Personal Data relates.
• “Subprocessor” means any third party engaged by the Processor to carry out processing activities on behalf of the Controller.
• “Services” means the Indexly search indexing application provided by the Processor.

3. Subject matter and nature of processing

The Processor provides the Controller with a search indexing service that copies selected Shopify store data into a dedicated search index, enabling fast, unified search within the Shopify admin interface. The Processor processes Personal Data only to the extent necessary to deliver and maintain this service, and strictly in accordance with the Controller's documented instructions.

4. Categories of personal data and data subjects

4.1 Data subjects

• The Controller's end customers.
• The Controller's staff who use the Indexly admin interface.

4.2 Categories of personal data

The following categories may be processed, depending on the index settings enabled by the Controller:

• Customer name, email address, and phone number.
• Order data including order number, status, line items, order notes, note attributes, and line item properties (which may contain customer-provided free text such as gift messages or personalisation).
• Customer and order metafield values (merchant-defined; may include special-category data if the merchant stores such data in Shopify metafields).
• Product titles, variants, SKUs, and associated metafield values.
• Metaobject record field values as defined by the Controller.
• Saved search query strings entered by Controller's staff.
• Staff OAuth session data (name, email, Shopify user ID) for authentication purposes.

5. Purpose and duration of processing

Personal Data is processed solely for the purpose of providing the Indexly search service to the Controller. Processing continues for the duration of the Controller's use of the Indexly app (from installation to uninstall and completion of post-uninstall data deletion).

6. Processor obligations

6.1 Instructions

The Processor shall process Personal Data only on the documented instructions of the Controller, including as set out in this DPA, unless required to do so by applicable law. If required by law to process Personal Data other than as instructed, the Processor shall notify the Controller before processing unless prohibited from doing so by law.

6.2 Confidentiality

The Processor shall ensure that persons authorised to process Personal Data are subject to appropriate obligations of confidentiality.

6.3 Security

The Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including as a minimum:

• Encryption of data in transit (TLS/HTTPS).
• Access controls and authentication for database infrastructure.
• Regular security reviews of application code and dependencies.
• Logical isolation of each Controller's data within the shared database by shop identifier.

6.4 Subprocessors

The Processor shall not engage a Subprocessor without the prior general written authorisation of the Controller. By accepting this DPA, the Controller provides general authorisation for the Processor to use the Subprocessors listed in Schedule 1 below.

The Processor shall inform the Controller of any intended changes concerning the addition or replacement of Subprocessors by updating Schedule 1 and notifying installed merchants via the app or email. The Controller may object to a new Subprocessor within 14 days of notification. Where the Processor is unable to accommodate the objection, the Controller may terminate their use of the Services.

The Processor shall impose data protection obligations on each Subprocessor equivalent to those set out in this DPA, and shall remain liable for the acts and omissions of its Subprocessors.

6.5 Assistance with data subject rights

The Processor shall assist the Controller by appropriate technical and organisational measures, insofar as possible, to fulfil the Controller's obligations to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Law, including rights of access, rectification, erasure, restriction, and portability.

The Processor implements Shopify's mandatory compliance webhooks (customers/data_request, customers/redact, shop/redact) and responds as required.

6.6 Data breach notification

The Processor shall notify the Controller without undue delay (and in any event within 72 hours where feasible) upon becoming aware of a personal data breach affecting the Controller's data, providing sufficient information for the Controller to meet its own notification obligations to supervisory authorities and Data Subjects.

6.7 Data protection impact assessments

The Processor shall provide reasonable assistance to the Controller with data protection impact assessments and prior consultations with supervisory authorities where required by Applicable Data Protection Law.

6.8 Audit

The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA and shall permit audits conducted by the Controller or a mandated auditor, subject to reasonable notice and confidentiality obligations. The Controller agrees to exercise this right no more than once per year except where required by a supervisory authority.

7. Deletion and return of data

Upon termination of the Services (uninstall) and completion of the post-uninstall shop/redact webhook processing, the Processor shall permanently delete all Personal Data processed on behalf of the Controller, unless retention is required by applicable law. The Processor will confirm deletion upon written request.

8. International transfers

All Personal Data processed under this DPA is stored and processed within the United Kingdom. The Processor does not transfer Personal Data outside the United Kingdom or the European Economic Area. UK GDPR and the Data Protection Act 2018 apply.

Where EEA merchants are subject to EU GDPR, the equivalent protections are maintained by virtue of the UK adequacy decision and the Processor's UK-based infrastructure.

9. Controller obligations

The Controller warrants and represents that:

• It has a valid legal basis for the processing of Personal Data instructed under this DPA.
• It has provided all necessary notices to, and obtained all necessary consents from, Data Subjects as required by Applicable Data Protection Law.
• Its instructions to the Processor do not violate Applicable Data Protection Law.

10. Term and termination

This DPA comes into effect upon installation of the Indexly app and remains in force until all Personal Data processed under it has been deleted in accordance with clause 7. Termination of the Services constitutes termination of this DPA, subject to any surviving obligations.

11. Governing law and jurisdiction

This DPA is governed by and construed in accordance with the laws of England and Wales. The parties submit to the exclusive jurisdiction of the courts of England and Wales.

Schedule 1 — Approved Subprocessors

Contact

For questions about this DPA or to exercise your rights, contact Heath Digital Ltd at [email protected] or by post at: