Fixed version 2026-11-05. Effective 5 November 2026. This copy preserves the published legal text for this version. The merchant agreement requires separate affirmative acceptance in the app.

FOR MERCHANTS

Data processing
agreement.

Version 2026-11-05 · Effective 5 November 2026

Data-use schedule ↗Privacy policy ↗Contact the operator ↗Fixed version & downloads ↗

Owner-adopted, effective 5 November 2026. Wndr.digital B.V. has adopted this agreement and Schedules A–C. It binds a merchant only when an authorized user affirmatively accepts this version as presented in the app for that installation. Viewing this page or installing the app is not acceptance.

1. Parties, scope and duration

The merchant identified by its Shopify store and agreement-acceptance record is the Controller. Wndr.digital B.V., operating Revuka, is the Processor for customer personal data processed to provide the merchant’s review service. Wndr.digital B.V. is registered at Ravenoord 1, 3523 DB Utrecht, the Netherlands, KvK 89116194. Contact: info@revuka.com.

On the merchant’s affirmative acceptance, this agreement supplements the merchant’s Revuka service terms and applies for the duration of the processing, including return and deletion. It concerns collecting, managing and merchant-directed publication of product and store reviews.

Processing includes necessary Shopify references, invitations and reminders, feedback and media collection, purchase evidence and source attribution, rating-neutral moderation, authorized review synchronization, opt-outs, support, security and privacy requests. Schedules A–C form part of the agreement. The operator’s own business-contact and subscription-administration processing is described separately in the privacy policy.

2. Instructions and lawful use

The Processor will process customer personal data only on the Controller’s documented instructions, including this agreement, authorized app settings and lawful support requests. It will not sell that data, use it for advertising audiences, train unrelated models on it or repurpose it for unrelated profiling.

If Union or Member State law requires other processing, the Processor will inform the Controller before processing unless legally prohibited. It will promptly identify an instruction it considers contrary to applicable data-protection law.

The Controller is responsible for a lawful basis, appropriate customer notices, necessary consent and lawful review publication and communications. Enabling a feature does not provide missing consent. The Processor will respect applicable consent and opt-out instructions; ordinary unsubscribe and a request for erasure are distinct operations.

3. Confidentiality and security

The Processor will ensure that authorized people are subject to confidentiality obligations and receive only the access needed for their task. It will apply appropriate technical and organizational measures under Article 32 GDPR, as specified in Schedule B.

Those measures must address confidentiality, integrity, availability and recovery, with proportionate assessment of their effectiveness. Changes must not materially reduce the agreed protection. Provider encryption does not mean every application field is separately encrypted or that Revuka has an independent security certification.

4. Subprocessors and international transfers

The Controller gives general written authorization for the subprocessors explicitly listed in Schedule C. The Processor will impose substantially equivalent data-protection obligations on them and remains responsible for their performance of those obligations.

Before an intended addition or replacement, the Processor will give advance notice through the merchant contact method recorded for the service, allowing the Controller to raise a substantiated data-protection objection before the change. The parties will seek a suitable alternative. If unresolved, the affected processing may be ended with return or deletion rather than continued under disputed authorization.

Transfers outside the European Economic Area require an applicable Chapter V GDPR mechanism. Schedule C identifies the relevant entities, locations and safeguards. This agreement is not itself a set of Standard Contractual Clauses. Applicable provider agreements and transfer safeguards are identified separately in Schedule C.

5. Assistance and personal-data incidents

Taking account of the nature of the processing and the information available, the Processor will assist with applicable access, correction, deletion, restriction, portability and other data-subject rights, and with security, breach assessment and notification, data-protection impact assessments and prior consultation under Articles 32–36 GDPR.

Direct customer requests will be routed to the relevant Controller unless law or documented instructions require another response. Authenticated export/privacy workflows and a secure support route must be used to disclose personal data; public comments and ordinary email attachments must not be used to expose another person’s information.

After becoming aware of a personal-data breach affecting the Controller’s data, the Processor will notify the Controller without undue delay. It will provide available information about scope, likely consequences, containment and remediation, a contact and updates as facts become known. It will cooperate with the Controller and preserve necessary evidence with restricted access. This agreement does not establish a fixed response-time promise or 24/7 monitoring service. Routine support hours do not postpone notification without undue delay.

6. Ending processing and retention

At the Controller’s choice, the Processor will securely return and/or delete customer personal data after the relevant services end, including existing copies unless Union or Member State law requires retention. Export should be requested or completed before uninstall so authenticated access remains available.

Uninstall removes installation credentials and stops ordinary review-collection jobs and mail; it does not mean every retained copy is erased immediately. Valid customer and Shopify deletion instructions and the adopted class-specific retention schedule apply to remaining records and media.

Local erasure must proceed even when Shopify no longer authorizes a separate deletion of its review object. In that case, external deletion remains unconfirmed. Restricted pseudonymous store, object and product references may be held solely to resolve the deletion instruction, with Len responsible for follow-up through fresh authorized access or controller/platform assistance. They are not anonymous data or an unlimited archive. Completed follow-up records are cleaned after 30 days. Store-data redaction removes the local follow-up records too; that local deletion is not proof that Shopify completed the external deletion.

Recovery copies will remain restricted, expire under the verified provider schedule and not be used for ordinary processing. Deletion and opt-out instructions will be reapplied before restored data returns to service. No general legal-retention exception is assumed for unsubscribe markers. Any actual legal exception must be identified, limited, documented and communicated as permitted by law.

7. Information and audit

The Processor will provide information reasonably necessary to demonstrate compliance and allow and contribute to audits and inspections by the Controller or an authorized independent auditor, with safeguards for other merchants’ information and service security.

It will disclose material deficiencies and cooperate in correction. A provider’s security reports relate to that provider and their stated scope; they are not certification of Wndr.digital B.V. or Revuka.

SCHEDULE A

The processing and its data

Data subjects: the merchant’s customers and review authors, and merchant staff who administer the service where relevant.

Nature and purpose: retrieval, storage, restricted access, delivery, collection, moderation, merchant-directed publication and authorized synchronization, correction, export and deletion, solely to provide the review service and its security/privacy controls.

The fixed data-use schedule, version 2026-11-05, describes the fields, sources, purposes, visibility and current retention rules. That fixed schedule forms part of this agreement; a later notice change does not silently authorize an unrelated use.

  • Private collection and purchase data: order/customer references, relevant item/product/variant details, order status and locale, order email, invitation state and dates, protected review-link material and purchase evidence.
  • Review data: chosen display name, rating, optional title/text and media, language, dates, source and verification context, moderation state and merchant reply. Public display is limited to published review fields. Authorized Shopify review synchronization can include required private purchase references; it is a separate data flow from the public storefront response.
  • Opt-out and operational data: per-store keyed email fingerprints, minimal job/delivery/event/audit records, agreement acceptance and privacy-request records. A fingerprint is pseudonymous personal data, not an anonymous or advertising profile.

The service does not intentionally request special-category information, postal addresses, phone numbers or payment-card details. Shopify customer names are not needed for the flow; the reviewer supplies a display name independently. Merchants and reviewers must avoid unnecessary sensitive or third-party information in free-text content and media. Validated original media files are retained without stripping embedded metadata; publication can expose that metadata as well as the visible content.

Review and evidence records can remain while the service needs them; no invented fixed expiry applies. The existing schedule includes invitation contact/link expiry, 7-day unattached-upload cleanup, conditional 30-day deleted-review cleanup, 30-day privacy exports/processed-event metadata and 365-day audit/completed-job/sent-mail records. Unresolved jobs, uncertain mail and failed minimal events require operator resolution, with the ownership and review duties in Schedule B. Recovery and end-of-service limits are described in the fixed data-use schedule and below.

SCHEDULE B

Security measures and operating responsibilities

These measures and operating duties apply from the effective date. Recurring reviews and exercises are commitments for ongoing operation, not claims that all future reviews or exercises have already occurred. A source implementation alone is not evidence that every control has passed a live test.

  • Application access and tenant isolation

    Revuka uses one production app service. Authenticated Shopify sessions, tenant-scoped APIs, active-installation checks and installation-generation checks restrict access and background work. QA uses a dedicated development-store tenant and marked test records; customer data from other stores must not be copied into those tests. Fresh identity tokens authorize admin calls. Public responses exclude private contact, purchase and access-link fields.

  • Encryption and limited disclosure

    Application encryption protects offline/refresh credentials, invitation contacts and delivery links, import provenance and privacy payloads/exports. High-entropy form tokens use hashed lookup. D1 and R2 also provide their documented storage encryption. Pending media remains request/admin-authorized; uploads have size and type limits.

  • Processing integrity

    Signed asynchronous events, duplicate prevention, bounded retries, sanitized errors, protected-data action/access records and scheduled cleanup support reliable processing. Application access records cover authenticated app operations; they do not establish complete provider-console or runtime data-read logging. The fixed data-use schedule distinguishes application records from provider records.

  • People and operations

    The owner has confirmed individual accounts, strong unique passwords and two-factor authentication for the involved Cloudflare, Shopify and business-email administrators. This is an owner confirmation, not an independent audit.

    Len van Essen is accountable for service, security, privacy, incidents and access, reached at info@revuka.com. An authorized substitute will be appointed before planned absence. Routine support is Monday–Friday, 09:00–17:00 Europe/Amsterdam, excluding public holidays. Discovered incidents are escalated immediately; support hours do not postpone notification without undue delay. No 24/7 monitoring or guaranteed response time is promised.

    Each business day, the owner will check service health and failed privacy/background work. Protected-access logs are reviewed weekly, accounts and permissions monthly, synthetic restoration quarterly, and an incident tabletop and policy review annually and after material changes. Len owns failed, uncertain and unresolved work until resolution, with still-open cases reviewed at least every 30 days. Ambiguous mail delivery must not be blindly resent.

    Access will use individual accounts with necessary permissions, strong unique passwords and two-factor authentication on privileged providers and business email. Staff access is recorded and removed promptly when no longer needed. Devices used for protected exports must have supported, updated software, disk encryption and screen locking; no fleet-management or full-device-audit claim is made.

    Customer exports use authenticated tenant-scoped workflows for a documented task. Downloaded support/export copies must be kept in restricted encrypted temporary storage and deleted on task closure, no later than seven days afterwards unless a separately documented legal requirement applies. This is an operating duty, separate from the server’s 30-day privacy-export expiry. Ordinary resolved support enquiries are deleted 90 days after resolution unless a specific continuing purpose is documented. Customer exports must not be ordinary email attachments.

    The canonical D1 database has a configured 30-day Time Travel window, with available history limited by its creation date. A synthetic database restore has been demonstrated; full-media recovery, an off-device encryption-key backup and an end-to-end recovery-time or recovery-point objective have not been established. Restore decisions must preserve the right keys and reconcile later deletion, opt-out, credential-revocation and mail-ledger changes before processing resumes. Provider history is restricted from ordinary use. No independent Revuka security certification is claimed.

SCHEDULE C

Providers, locations and transfers

This adopted schedule identifies the providers currently used. The owner confirmed Wndr.digital B.V. as the contract customer for Cloudflare and the receiving Google Workspace account on 5 November 2026. That confirmation is not an independent contract audit. The qualified standard-terms basis and global-processing limits below form part of this agreement.

  • Cloudflare, Inc.
    Service
    Workers hosting and request processing, D1 database, private R2 media storage, and Email Service delivery and routing.
    Relevant data
    Store, collection, review, media, operational and privacy data, limited to what each product needs. Support-message routing includes the addresses and message content needed to forward an enquiry.
    Contract & location
    The owner-confirmed customer is Wndr.digital B.V. Cloudflare’s self-serve terms incorporate its current customer DPA without requiring a separately signed PDF under those terms. Cloudflare operates global infrastructure; European database/media placement does not cover every request, support or provider-access activity. Relevant product terms and transfer safeguards apply.
  • Google Workspace — receiving support email
    Service & purpose
    Receive and answer support and private privacy enquiries addressed to info@revuka.com. Review invitations and reminders are delivered through Cloudflare’s email service.
    Relevant data
    Correspondents’ sender/recipient addresses and display names, message headers, message content and any attachments they choose to send. Customer exports must use the authenticated app workflow and must not be sent as ordinary support-email attachments.
    Customer & provider
    The owner confirmed Wndr.digital B.V. as the receiving Workspace account’s contract customer. Google’s published standard entity table identifies Google Cloud EMEA Limited, Dublin, Ireland, for a Netherlands-based Workspace customer unless a different agreement applies. This is the published standard-terms basis; the individual contract has not been independently audited.
    Location & retention
    Google operates globally. This schedule makes no EEA-only processing promise. Its applicable processing terms, transfer mechanisms and subprocessor arrangements govern the service. Ordinary resolved support enquiries are manually deleted 90 days after resolution unless a specific continuing purpose is documented. This is an operating procedure, not an automatic app-mailbox expiry. Provider deletion, recovery and retention terms also apply.
  • Shopify platform relationship

    Shopify is the merchant’s authorized commerce platform and source of order/product data, and a destination for permitted standard-review synchronization. Its platform processing is not automatically treated as subcontracting by Revuka. The merchant’s Shopify agreement and the applicable Shopify platform/partner terms govern that platform relationship. Revuka’s authorized exchange does not change those roles.

    Shopify’s processing terms ↗

Applicable provider terms must supply a valid Chapter V transfer mechanism, including the relevant adequacy decision or appropriate contractual safeguards where needed. This agreement does not itself execute separate Standard Contractual Clauses or promise that email, support and all provider access remain in the EEA.

Status and merchant acceptance

Wndr.digital B.V. adopted version 2026-11-05 on 5 November 2026. The owner’s adoption establishes the operating duties above. It does not record a merchant’s agreement or turn an earlier development acknowledgement into one.

The app must present the current published version to an authorized merchant user and record affirmative acceptance with the store, installation reference, Shopify staff reference, agreement version, URL and timestamp. A new installation requires acceptance again. Visiting the website, installing the app or a nonbinding QA acknowledgement is not acceptance. Later material terms changes require a new version and current-version acceptance.

Questions or requested instructions can be sent to info@revuka.com. The legal framework for this agreement is GDPR Articles 28, 32 and 33, with European Commission guidance on controller and processor roles. This page makes no claim of regulatory approval or completed legal-counsel review.