Green13 Returns & Exchanges — a Shopify app by Green13 srl. Version 1.1, 1 October 2026.
This DPA takes effect when the Merchant installs the App and forms part of the terms under which the Merchant uses it. Our Privacy Policy describes the same processing in plain terms; if the two differ on how personal data is processed, this DPA prevails.
The subject matter is the provision of the App: a self-service page on the Merchant's store where customers ask to return items or exchange them for another variant, and a panel inside the Merchant's Shopify admin where the Merchant reviews and processes those requests. The processing lasts for as long as the App is installed, and ends with the deletion described in section 11.
Green13 collects, stores, encrypts, retrieves, displays to the Merchant, and erases personal data, only to:
Personal data is never used for marketing, profiling, analytics or advertising, and is never sold. The App sends no emails: notifications to customers are sent by Shopify with the Merchant's templates.
| Data subjects | The Merchant's customers who use the returns page, or whose orders are looked up through it. |
|---|---|
| Order email | The email address of the order, compared with the one the customer types and stored with the request (encrypted), together with a keyed one-way code of it used for searching. |
| Country code | Only the two-letter country code of the order's shipping address, or of the billing address when the order has no shipping address. Name, phone, street, city and postal code are never read. |
| Order and items | Order number and identifiers, the items selected (product, variant, quantity, price), the variant chosen for an exchange, and the amounts of the request. |
| Free-text notes | The reason picked from a list, any note the customer writes, and the internal note the Merchant's staff may add (all notes encrypted). |
| Pseudonymised IP address | The IP address is never stored: only a keyed one-way pseudonym, used to count failed look-ups. |
| Failed look-ups | To protect orders from repeated guessing, a keyed one-way code of the email address and of the order number typed in a failed look-up (never the values themselves), used only to count failed attempts and kept for 24 hours at most. |
| Request history | Status changes and the actions taken on the request, with their dates. |
The App does not process special categories of personal data, payment details, passwords, phone numbers or postal addresses.
These are the technical and organisational measures in place today (Article 32 GDPR):
| Aruba S.p.A., Italy | Hosting of the App's production server (virtual server in a data centre in Italy). |
|---|
Shopify is not our sub-processor: it is the Merchant's own commerce platform. The App exchanges data with Shopify only through Shopify's APIs, on the Merchant's behalf, to read the order and create and process the return.
The Merchant authorises the sub-processor listed above. Before adding or replacing a sub-processor we will announce it on this page at least 30 days in advance; a Merchant who objects can stop using the App by uninstalling it, which triggers the deletion in section 11. Any sub-processor is bound by data protection obligations equivalent to those in this DPA.
Customers exercise their rights with the Merchant. The App helps the Merchant answer them through Shopify's mandatory privacy webhooks:
If a customer contacts us directly, we will forward the request to the Merchant without responding to it ourselves. We also give the Merchant the information we have to help with data protection impact assessments and consultations with supervisory authorities.
If we become aware of a personal data breach affecting the Merchant's data, we will notify the Merchant without undue delay and in any case within 72 hours of becoming aware of it, with what is known at that time: the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, and the measures taken or proposed. We will add information as it becomes available and help the Merchant meet their own obligations to notify the supervisory authority and the people concerned.
When the Merchant uninstalls the App, the customer returns page closes immediately. Shopify then sends
the shop/redact request 48 hours after the uninstall, and the App deletes all of that
store's data as soon as it arrives: requests, items, notes, history, look-up attempts, settings and the
Shopify session. Data in the encrypted backups disappears as they roll over (section 9). We keep no copy
of the Merchant's data after that.
On written request to info@green13.agency, we make available the information needed to demonstrate compliance with Article 28 GDPR: a description of the processing and of the security measures, and answers to reasonable security questionnaires. Any further audit or inspection is agreed in writing in advance, with reasonable notice and without access to other merchants' data.
Green13 does not transfer the Merchant's personal data outside the European Union. The production server and its backups, including the off-site copy, are in Italy. Data that the Merchant's store holds on Shopify is governed by the Merchant's own agreement with Shopify.
If the processing changes (new data, a new sub-processor, a different retention period), this page will be updated before the change is released, with a new version number and date.