Data Processing Addendum

Green13 Reseller Zone — a Shopify app by Green13 srl. Version 1.1, 14 October 2026.

This Data Processing Addendum ("DPA") applies to every merchant who installs Green13 Reseller Zone. It sets out how Green13 srl processes the personal data of the merchant's customers on the merchant's behalf, as required by Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"). The app never reads customers' addresses or phone numbers and does not store their names or email addresses.

1. Parties and roles

Controller: the merchant who installs the app on their Shopify store (the "Merchant"). The Merchant decides why customer data is processed: to take orders from their resellers through a reserved area of their online store.
Processor: Green13 srl, Via della Resistenza 129/c, 20090 Buccinasco (MI), Italy, VAT IT14697160969, REA MI 2801512 ("Green13", "we"), which provides the app (the "App") and processes personal data only on the Merchant's behalf. Contact: info@green13.agency.

This DPA takes effect when the Merchant installs the App and forms part of the terms under which the Merchant uses it. Our Privacy Policy describes the same processing in plain terms; if the two differ on how personal data is processed, this DPA prevails.

2. Subject matter and duration

The subject matter is the provision of the App: a reserved area in the Merchant's online store where customers with the Merchant's reseller tag order products at the Merchant's wholesale prices, see their orders and download the materials the Merchant shares; each order becomes a draft order in the Merchant's Shopify store; and a panel inside the Merchant's Shopify admin where the Merchant sets up the area and follows resellers and orders. The processing lasts for as long as the App is installed, and ends with the deletion described in section 11.

3. Nature and purpose of the processing

Green13 reads, stores, displays, sends and erases personal data, only to:

check that a customer logged in to the Merchant's store has the Merchant's reseller tag before showing them the reseller area;
turn the reseller's order into a draft order in the Merchant's Shopify store, with the Merchant's wholesale prices, inventory and minimums checked again on the server, the personalization chosen by the reseller and, in the note of the draft order, the company details and notes the reseller writes;
keep a record of each order and show its status (received, invoice sent, order, cancelled, shipped with tracking) to the reseller who sent it and to the Merchant;
show each reseller their complete order history with the Merchant, reading their own orders from every sales channel from Shopify at the moment the page is opened, so they can check status and tracking and reorder the same items;
show the Merchant, inside their Shopify admin, their resellers and their orders, with the resellers' names and email addresses read from Shopify at that moment;
send an email about each new order to the Merchant and an order confirmation to the reseller, through the Merchant's own email server (SMTP); the reseller area opens only after the Merchant has set up that server and a test email has been delivered.

Personal data is never used for marketing, profiling, analytics or advertising, and is never sold. The App sends emails only through the Merchant's own email server, never through an email account or sending service of ours.

4. Categories of data subjects and personal data

Data subjects	The Merchant's customers who are logged in to the store and open the reseller area; among them, the resellers (customers with the Merchant's reseller tag) who send orders from it.
Customer ID and tags	The Shopify customer ID, passed by Shopify in signed requests, and the customer's tags, read to check the reseller tag. Tags are not stored; nothing is stored about customers without the reseller tag.
Reseller orders	Stored for each order: the Shopify customer ID, the ID and name of the draft order and of the order it becomes, the status, total and currency, the lines (variant IDs, quantities, wholesale prices and personalization) and the storefront language.
Personalization	The text or option the reseller chooses for each personalized piece, in the fields the Merchant defines. Stored with the order lines and sent to Shopify as attributes of the draft order's lines.
Name and email address	Of resellers, read from Shopify to show them to the Merchant and to send the order confirmation through the Merchant's own email server. Not stored.
Resellers' orders in the store	The reseller's own orders from every sales channel (order number, date, payment and fulfillment status, total, tracking and ordered items), read from Shopify when the reseller opens their order history; and, for the Merchant's Resellers page, each reseller's number of orders, amount spent and date of the last order. Not stored.
Company details and notes	Company name, VAT number and notes the reseller writes, when the Merchant asks for them: passed to Shopify in the note of the draft order. Not stored.
Email server settings	The SMTP server name, port, security mode, username, sender address and sender name the Merchant enters, and the password, stored encrypted.

The App does not process postal addresses, phone numbers, payment details or special categories of personal data. Draft orders use the reseller's default address, which Shopify fills in inside the Merchant's store: the App never reads it.

5. Green13's obligations

Instructions. We process personal data only on the Merchant's documented instructions: this DPA, and the settings and actions the Merchant takes in the App. If we believe an instruction breaks the GDPR or other EU or Member State data protection law, we will tell the Merchant.
Confidentiality. Access to production data is limited to the people at Green13 who need it to run the App — today one person — who are committed to confidentiality. We access it only when needed to operate the App or fix a problem.
No other use. We do not process the data for our own purposes and do not disclose it to anyone except as described in this DPA.

6. Security measures

These are the technical and organisational measures in place today (Article 32 GDPR):

Encryption in transit: the App is served only over HTTPS (HTTP is redirected to HTTPS); calls to Shopify use HTTPS; webhooks and reseller area requests from Shopify are verified with HMAC signatures. Connections to the Merchant's email server always use TLS (SSL or required STARTTLS).
Email server password: stored encrypted in the database with AES-256-GCM and never shown again in the App. The key is kept outside the source code, the application image, the database and the backups.
Order lines: the lines of each reseller order (products, quantities, prices and personalisation texts) are stored encrypted in the database with AES-256-GCM, with a separate key kept, like the one above, outside the source code, the application image, the database and the backups.
Encrypted backups: nightly database backups are encrypted with GPG public-key encryption before being stored; the private key that can read them is kept only on the Green13 team's own server, not on the production server.
Restricted access: the production server accepts SSH logins with a personal key only (password login and root login disabled), by one person; its firewall allows only SSH, HTTP and HTTPS, and security updates are installed automatically. There is no internal admin panel: the data is shown only to the Merchant inside their Shopify admin and to each reseller for their own orders.
Access log: Green13 opens a production database only through a procedure that first records the date, the person, the app and the reason in an access log, and then opens the database read-only.
Isolation: every database query is limited to the Merchant's own store, and a reseller sees only their own orders. Development and tests use separate databases, a separate encryption key and a development store.
Minimisation: about customers, the App requests from Shopify only the customer ID, tags, name and email address; it never reads addresses or phone numbers, and an automated test, run before every release, fails if a query of the App asks for any other protected customer field. Names, email addresses, company details and notes are not stored.
Hosting in the EU: the production server is hosted in Italy.

7. Sub-processors

Aruba S.p.A., Italy	Hosting of the App's production server and its database (virtual server in a data centre in Italy).

Shopify is not our sub-processor: it is the Merchant's own commerce platform. The App exchanges data with Shopify only through Shopify's APIs, on the Merchant's behalf, to check the reseller tag, create the draft orders and follow their status. Files the Merchant shares with resellers are stored in the Merchant's own Shopify Files.

The Merchant's email server is not our sub-processor either: the Merchant chooses it and enters its settings in the App, and its provider works for the Merchant, under the Merchant's own agreement with it. The App only hands it the emails to deliver.

The Merchant authorises the sub-processor listed above. Before adding or replacing a sub-processor we will announce it on this page at least 30 days in advance; a Merchant who objects can stop using the App by uninstalling it, which triggers the deletion in section 11. Any sub-processor is bound by data protection obligations equivalent to those in this DPA.

8. Data subjects' requests

Customers exercise their rights with the Merchant. The App helps the Merchant answer them through Shopify's mandatory privacy webhooks:

customers/data_request: the App compiles every order it holds for that customer (found by Shopify customer ID), and we will provide the compiled records to the Merchant on request.
customers/redact: the orders the App holds for that customer are deleted as soon as Shopify forwards the request. Draft orders and orders in the Merchant's Shopify store are handled by Shopify.
shop/redact: all of the store's data is deleted (see section 11).

If a customer contacts us directly, we will forward the request to the Merchant without responding to it ourselves. We also give the Merchant the information we have to help with data protection impact assessments and consultations with supervisory authorities.

9. Retention

Reseller orders are kept while the App is installed, so that resellers keep their order history, until the customer's erasure (section 8) or the deletion in section 11.
The order form, wholesale prices, list of materials and email server settings are kept while the App is installed, until the Merchant deletes them or until the deletion in section 11.
Encrypted backups roll over: 14 days on the production server and 90 days for the copy kept by Green13, so deleted data disappears from backups within 90 days at most.

10. Personal data breaches

If we become aware of a personal data breach affecting the Merchant's data, we will notify the Merchant without undue delay and in any case within 72 hours of becoming aware of it, with what is known at that time: the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, and the measures taken or proposed. We will add information as it becomes available and help the Merchant meet their own obligations to notify the supervisory authority and the people concerned.

11. Deletion at the end of the processing

When the Merchant uninstalls the App, the reseller area closes immediately and the authentication session is deleted. Shopify then sends the shop/redact request 48 hours after the uninstall, and the App deletes all of that store's data as soon as it arrives: reseller orders, order form, wholesale prices, list of materials, settings, email server settings and password. Data in the encrypted backups disappears as they roll over (section 9). We keep no copy of the Merchant's data after that. Files in the Merchant's Shopify Files, and draft orders and orders in the Merchant's Shopify store, remain the Merchant's and are not touched.

12. Audits and information

On written request to info@green13.agency, we make available the information needed to demonstrate compliance with Article 28 GDPR: a description of the processing and of the security measures, and answers to reasonable security questionnaires. Any further audit or inspection is agreed in writing in advance, with reasonable notice and without access to other merchants' data.

13. International transfers

Green13 does not transfer the Merchant's personal data outside the European Union. The production server and its backups, including the off-site copy, are in Italy. Emails leave the App through the Merchant's own email server, whose location is part of the Merchant's agreement with its provider. Data that the Merchant's store holds on Shopify is governed by the Merchant's own agreement with Shopify.

14. Changes

If the processing changes (new data, a new sub-processor, a different retention period), this page will be updated before the change is released, with a new version number and date.