Legal
Data Processing Addendum
Last updated: 19 September 2026
This Data Processing Addendum ("DPA") forms part of our Terms of service and applies where we process personal data of your customers on your behalf through the Zesty Options app. It is between Jokolomo Pte. Ltd. (UEN 202537155H, 18 Boon Lay Way #02-120, Singapore 609966) ("we", "us") and the merchant that installs the app ("you"). By installing and using the app, you accept this DPA.
It does not cover your own account and contact details, or how you use the app. We are the controller of that data, and our Privacy Policy explains what we do with it.
1. Definitions
- Customer Data means personal data of your customers and other individuals that we process on your behalf through the app, as described in Annex A.
- Data Protection Laws means the data protection laws that apply to that processing, which may include the EU GDPR, the UK GDPR, Singapore's Personal Data Protection Act 2012 (PDPA), and applicable US state privacy laws.
- Personal data, controller, processor, processing, data subject and personal data breach have the meanings given in the applicable Data Protection Laws.
2. Roles and scope
2.1 For Customer Data, you are the controller and we are your processor. Under the PDPA we act as a data intermediary.
2.2 You are responsible for having a lawful basis for the processing and for giving your customers the notices the law requires, including that files and personalisation details are collected through your store.
2.3 Annex A describes the processing. If you give us an instruction we believe breaks Data Protection Laws, we will tell you rather than follow it.
3. Our obligations
3.1 Instructions. We process Customer Data only to provide the app to you and on your documented instructions. Your use of the app's features and these terms are your instructions.
3.2 Confidentiality. Anyone who can access Customer Data is bound by confidentiality obligations.
3.3 Security. We use the technical and organisational measures in Annex B. We may update them, but not in a way that reduces the overall level of protection.
3.4 Sub-processors. You authorise us to use the sub-processors in Annex C. We bind them to data protection terms no less protective than this DPA, and we stay responsible for what they do. We will tell you before we add or replace a sub-processor that handles Customer Data. You may object on reasonable data protection grounds by uninstalling the app.
3.5 Requests from individuals. Individuals should contact you first. We do not respond directly to a request about Customer Data unless the law requires it. We will help you respond to access, correction, deletion and similar requests to the extent the app holds the data, including by acting on Shopify's customer data request and redaction notices within 30 days.
3.6 Personal data breaches. If we become aware of a personal data breach affecting Customer Data, we will notify you without undue delay, with the information we have and that you need to meet your own legal obligations.
3.7 Assistance. We will give you the information you reasonably need for a data protection impact assessment or a consultation with a regulator, taking into account the information we hold and the nature of the processing.
3.8 Deletion and return. When you uninstall the app we keep Customer Data for at least 48 hours, so that an accidental uninstall can be reversed. After Shopify's shop-data deletion request we delete it within 30 days, and backups are removed on their normal cycle, as described in our Privacy Policy. You can ask for earlier deletion at hello@ludicas.app. We may keep data we are legally required to keep, protected and used only for that purpose.
3.9 Audits. We will give you the information reasonably necessary to show we meet this DPA. If that is not enough, you may ask for an audit no more than once a year, on 30 days' notice, during business hours, at your cost, subject to confidentiality and without unreasonable disruption to us or our other merchants.
4. Your obligations
You will use the app in line with Data Protection Laws, make sure your instructions to us are lawful, tell your customers what you collect and why, and give us only the personal data needed to use the app. You must not use option fields or upload fields to collect special category data or other data you are not entitled to collect.
5. International transfers
5.1 We store Customer Data in Singapore with Neon, Inc. and use sub-processors that may process it in other countries, including the United States. Where Data Protection Laws restrict transfers, we use an approved transfer mechanism.
5.2 For Customer Data subject to the EU GDPR or the UK GDPR that is transferred to a country without an adequacy decision, the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), Module Two (controller to processor), apply between you as data exporter and us as data importer, together with Annexes A and B of this DPA. For UK data, the UK Information Commissioner's International Data Transfer Addendum to those clauses applies instead. We will provide the completed clauses on request.
5.3 Customer Data covered by the PDPA is protected in line with the PDPA's transfer limitation obligation.
6. Liability and order of precedence
6.1 The liability terms in the Terms of service (Section 7) apply to this DPA, except where the law does not allow them to.
6.2 If this DPA conflicts with the Terms of service about the processing of Customer Data, this DPA prevails. If the Standard Contractual Clauses apply, they prevail over both.
7. Contact
Privacy and DPA questions: hello@ludicas.app. We will send you a signed copy of this DPA on request.
Annex A: Details of processing
| Item | Description |
|---|---|
| Subject matter | Providing the Zesty Options app: custom product options, add-on pricing and file uploads on the merchant's Shopify store |
| Duration | From installation until deletion under Section 3.8 |
| Nature of processing | Storage, transmission, retrieval and deletion. Text and choice values live in Shopify's line item properties rather than our database; uploaded files live in the merchant's own Shopify Files library |
| Purpose | To display option fields, calculate prices, accept and store customer-supplied text and files, and support the merchant |
| Types of personal data | Text customers type into option fields; files customers upload, which may contain images or personal details and may be visible to the merchant in Shopify Files; Shopify user ids and account details of merchant staff |
| Special categories | None intended. Merchants must not use option, text or upload fields to collect special category data |
| Data subjects | The merchant's customers and visitors to the merchant's storefront |
| Frequency | Continuous while the app is installed |
Annex B: Security measures
- Encryption in transit (TLS) for traffic to and from the app, the storefront extension and our providers.
- Encryption at rest by our infrastructure providers, Cloudflare and Neon.
- Requests to app admin routes are authenticated with Shopify session tokens, and webhook requests are verified by HMAC signature before we act on them.
- Shopify access scopes are limited to what the app needs, and access tokens are used only for the store they belong to.
- Each merchant's data is isolated by shop identifier, and database access is restricted to the app connecting through Cloudflare Hyperdrive.
- Secrets and API keys are kept out of source code, in environment settings.
- Production access is limited to authorised personnel.
Annex C: Sub-processors
The current sub-processor list - Shopify, Cloudflare and Neon, with what each one does, where it processes data and the data involved - is published in our Privacy Policy and forms part of this DPA. We will tell you before we add or replace a sub-processor that handles Customer Data, as described in Section 3.4.