Data processing agreement

Effective date: 28 October 2026

This data processing agreement ("DPA") is part of the terms of service for POClerk, an app for Shopify stores that turns emailed and uploaded purchase orders into draft orders. It sets out how MB Croppick, company code 308104331, registered office Krivių g. 5, LT-01204 Vilnius, Lithuania ("POClerk", "we", "us") handles personal data on behalf of the store that installs the app ("you", the "merchant"), as Article 28 of the EU General Data Protection Regulation (GDPR) requires. Questions: privacy@poclerk.com.

The short version

When your buyers' names and email addresses pass through POClerk, you are the data controller and we are your processor.
This DPA applies automatically the moment you install the app. There is nothing to sign and nothing to negotiate — it is the same for every store.
We process buyer data only to run the app for you, keep it only as long as the privacy policy says, use only the subprocessors listed there, tell you without undue delay if something goes wrong, and delete everything when you uninstall.

1. Who is who

You, the merchant, are the controller of the personal data in the purchase orders your customers send you, and in the order history and order sheets POClerk handles for you.
MB Croppick is your processor: we handle that data only to provide POClerk to you.
For the data about your own store and account — store domain, contact email, settings, plan — we are the controller ourselves, and the privacy policy, not this DPA, governs.

This DPA takes effect when you install POClerk and applies for as long as the app is installed, plus the deletion period in section 9. Nothing needs to be signed. If you need a countersigned copy for your records, write to privacy@poclerk.com.

2. What we process, and why

Subject matter — the purchase orders your customers send to your POClerk address or that you upload in the app; and, if you turn on order sheets, your customers' recent orders in your store and the order sheets sent to them, with their answers.
Nature and purpose — receiving the documents, extracting the order lines, matching them to your product catalog, presenting them for your review, creating the draft order in your Shopify store, sending a confirmation reply to the buyer when you (or, if you enable it, autopilot) send one, having Shopify email a draft order's invoice to a buyer who asked for a quote when you send one, reading your customers' recent orders in your store to build their order sheets, sending those sheets on the schedule you set, with a reminder if you set one, reading their answers, and answering your staff's questions about your purchase orders through Shopify Sidekick while Sidekick access is on. All as described in the terms and the privacy policy, and for nothing else.
Duration — while POClerk is installed on your store.
Types of personal data — the buyer's company and contact name, the sender's email address and subject line, and whatever else appears on the purchase order itself (for example a delivery address, a phone number, or the name of the person who placed the order). Names and email addresses are extracted as fields; everything else stays inside the original document and its extracted text. For order sheets, also the products and quantities of their recent orders in your store, their Shopify customer and company, and whether they stopped the sheets.
Categories of data subjects — your wholesale customers, and the people at those companies who send or are named on purchase orders, or who receive your order sheets.

3. Your instructions

We process buyer data only on your documented instructions. Your instructions are:

installing the app and keeping it installed;
the settings you choose in it — the retention window for original documents, the sender-authentication check, automatic confirmation replies, alias memory, per-customer autopilot, Sidekick access, and order sheets — who receives them, on which schedule, and what a sheet carries;
the actions you and your staff take in it — reviewing, fixing and reprocessing documents, creating draft orders, sending confirmation replies and quotes, starting, pausing and stopping order sheets, removing learned aliases — and the questions you and your staff ask Shopify Sidekick about your purchase orders, once POClerk is approved in that conversation; and
anything further you tell us in writing at privacy@poclerk.com.

We do not process buyer data for any purpose of our own, and we never sell it, use it for advertising, or use it to train AI models. If we believe an instruction of yours would break data-protection law, we tell you before acting on it.

If EU or Lithuanian law requires us to process the data in some other way, we tell you beforehand — unless that law forbids us from doing so.

4. Confidentiality

Access to buyer data is limited to the people who operate POClerk for MB Croppick, each of whom is bound by a duty of confidentiality.

5. Security

We apply the measures described in the privacy policy's "Security" section and keep them under review: Shopify access tokens encrypted at rest, TLS on all traffic, webhooks verified against Shopify's signatures, sender authentication (DMARC) on inbound mail, files stored under per-store keys and served only through signed URLs, the minimum Shopify permissions the app needs, and a documented incident-response process. In deciding what is appropriate we take into account the state of the art, the cost of implementation, and the risks the processing carries for the people concerned.

6. Subprocessors

We use only the subprocessors listed in the privacy policy — currently Cloudflare, Anthropic, Shopify, and Google (Gmail) for email correspondence with you — and you authorise those by installing the app.

Cloudflare and Anthropic process data under their data-processing agreements, which put the same kind of data-protection obligations on them that this DPA puts on us and include the EU standard contractual clauses. Shopify acts under its agreements with you and with us. Google LLC, which handles our mailboxes, is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. DPF, and processes that mail under Google's own terms. We remain responsible to you for what our subprocessors do with your data.

Before we add or replace a subprocessor, we update the list in the privacy policy and give that policy a new effective date, giving you the opportunity to object. If you object, you can uninstall before the change takes effect, and everything is deleted as described in section 9.

7. Helping you with your obligations

Requests from buyers. If a buyer asks you for access, correction, erasure or any other right, POClerk helps you answer:

Shopify's customers/data_request signal is recorded on our side. The buyer's documents and entered lines are visible to you in the app, and we assist on request at privacy@poclerk.com.
Shopify's customers/redact signal erases that buyer's data automatically — their identity record, learned aliases, the identifying fields on their documents, all their original files, and their order sheets.
For a request that reaches you directly, write to privacy@poclerk.com and we do our part promptly.

Breach notifications, impact assessments, consultations. Given what we know about our own processing, we help you notify your supervisory authority or your buyers of a personal-data breach, prepare a data-protection impact assessment, and consult an authority beforehand where you need to.

8. If there is a personal-data breach

If we become aware of a personal-data breach affecting your data, we tell you without undue delay: what happened, what data and whose, what we have done about it, and what — if anything — you should do. Where we cannot yet say everything, we tell you what we know and follow up as the picture becomes clear. We keep a record of the incident and share what you need to meet your own notification duties.

9. When you uninstall

Uninstalling revokes our access to your store immediately. About 48 hours later Shopify sends the shop-deletion signal (shop/redact), and on it we delete everything — every file and every database record for your store. Deleted records drop out of our database's automatic restore history within 30 days; we use that history only to recover the service from a failure, never to look up individual records, and if we ever restore it we repeat every erasure and scheduled deletion made since the restore point. That is the end of the processing; we keep no other copy of buyer data. Usage metrics keyed to your store expire on their own within about three months, as the privacy policy describes.

If you want a copy of your data first — the entered lines, learned aliases, or documents — ask us at privacy@poclerk.com before uninstalling and we will provide it. Draft orders POClerk created are part of your Shopify store and remain yours.

10. Showing you that we comply

On request we make available what you reasonably need to check that we meet this DPA: this document, the privacy policy, the security measures described there, and the data-processing terms of our subprocessors (Cloudflare's and Anthropic's are public). If that is not enough, you — or an auditor you appoint who is bound by confidentiality — may audit our processing at reasonable notice, during business hours, at your cost, no more than once in any twelve months unless a supervisory authority requires otherwise or a breach affecting your data has occurred.

11. International transfers

Your data is stored in Cloudflare's Eastern Europe region. Where a subprocessor is outside the EU/EEA:

Anthropic (United States) reads purchase-order content, and answers to order sheets, under its data-processing agreement, which incorporates the EU standard contractual clauses (Modules Two and Three) and the UK addendum. Anthropic states that it deletes API inputs and outputs from its systems within 30 days of receipt or generation, except where it must keep them longer to enforce its usage policy or to comply with law; we have no custom retention arrangement with Anthropic, so that standard period applies.
Cloudflare processes data under its data-processing addendum, which incorporates the EU standard contractual clauses, and stores our database and files in its Eastern Europe region.
Google (United States) handles our email correspondence; Google LLC is certified under the EU-U.S. Data Privacy Framework.

12. Term, precedence, law

This DPA applies for as long as POClerk is installed on your store and until the deletion in section 9 is complete. If it conflicts with the terms of service on a data-protection matter, this DPA prevails. Like the terms, it is governed by the laws of the Republic of Lithuania. If the data-protection law of your own country requires more of a processor than this DPA provides, tell us and we will work through it with you.

Changes to this agreement

If this DPA changes materially, we will note it here with a new effective date and say what changed.

28 October 2026. Weekly order sheets: added to the subject matter, the purpose, the types of data, the people concerned and your instructions, and to what a customer's erasure deletes.

Contact

privacy@poclerk.com — or support@poclerk.com for anything else.