Skip to content
Zonify
Add to Shopify

Data Processing Agreement

Last updated 5 October 2026

1. Parties and scope

This Data Processing Agreement (“DPA”) is between the merchant that installs Zonify (“Merchant”, “you”) and Frostleaf LLP (“we”, “us”). It forms part of the Terms of Service and applies whenever we process Visitor Personal Data to provide Zonify. You accept it when you accept the Terms.

In this DPA:

  • “Data Protection Law” means the laws that apply to the processing, including India’s Information Technology Act, 2000 and its rules, and the Digital Personal Data Protection Act, 2023 and its rules as they come into force.
  • “Visitor Personal Data” means personal data of people who visit your Shopify storefront, which we process on your behalf to provide the Service.
  • “Data Fiduciary”, “Data Processor”, “Data Principal” and “personal data breach” have the meanings given in the Digital Personal Data Protection Act, 2023. Where other laws use the words “controller” and “processor”, they mean the Data Fiduciary and the Data Processor.

2. Roles

For Visitor Personal Data, you are the Data Fiduciary and we are your Data Processor. You are responsible for having a lawful basis to record visits to your storefront, and for giving your Visitors any notice, and getting any consent, that the law where they are requires.

3. Details of the processing

  • Purpose: deciding, on each page load, whether a Visitor may use your storefront under the rules you set; showing you visits, blocks, countries and addresses in the app; and letting you export that record.
  • Data Principals: people who visit your Shopify storefront.
  • Personal data: IP address; the country worked out from the browser’s time zone and language, and that time zone and language; user agent, device type and browser; pages visited and referring pages; visit length and page views; whether the Visitor was blocked and why; a random visit identifier; and, where the browser reports them, screen size and page load timings.
  • What is not processed: Visitors’ names, email addresses, phone numbers, postal addresses, orders or payment details.
  • Duration: for as long as you use Zonify, and until the data is deleted under section 10.

4. Processing on your instructions

We process Visitor Personal Data only to provide the Service and on your documented instructions, which are the Terms, this DPA and the settings you choose in the app. We will tell you if we believe an instruction breaks Data Protection Law. We will not sell Visitor Personal Data, use it for our own marketing, or combine it across stores to profile Visitors.

We may process Visitor Personal Data where the law requires it. If so, we will tell you first unless the law prohibits it.

5. Confidentiality

We allow access to Visitor Personal Data only to staff and contractors who need it to provide or support the Service, and who are bound by confidentiality obligations.

6. Security

We maintain reasonable security safeguards appropriate to the risk, including encryption in transit and at rest, verification of every storefront request and webhook against Shopify’s signature, access controls limited to people who need access, backups and an incident response process.

7. Service providers (sub-processors)

  • You authorise us to use service providers to help provide the Service, in these categories: cloud hosting, a managed database and email.
  • We impose data protection obligations on each provider that are no less protective than this DPA, and we remain responsible for their performance.
  • We will give you the current list of providers on request, and at least 15 days’ notice by email or in the app before adding or replacing a provider. If you object on reasonable data protection grounds and we cannot resolve it, you may stop using the Service by uninstalling it.

8. Processing outside India

Visitor Personal Data is processed in India and in the United States, and may be processed in other countries where our providers operate, only as permitted by Data Protection Law and subject to any restrictions notified by the Government of India.

9. Assistance

  • Visitor requests. If a Visitor contacts us directly, we will pass the request to you. We will help you respond to requests to access or erase their data. Visit records hold no names or emails, so a request needs the Visitor’s IP address and the approximate time of the visit.
  • Shopify privacy requests. We answer Shopify’s privacy webhooks. Because visit records cannot be linked to a Shopify customer, a request about a specific customer has nothing to match, and we say so rather than claim to have deleted something.
  • Breaches. If we become aware of a personal data breach affecting Visitor Personal Data, we will notify you without undue delay, and within 48 hours where possible, with the information you need to meet your own obligations. We will take reasonable steps to contain and fix it.
  • Compliance. We will give you reasonable information and help so you can meet your obligations under Data Protection Law.

10. Retention and deletion

  • Visit records are deleted 90 days after the visit, as described in the Privacy Policy.
  • When you uninstall Zonify, we delete your store’s visit records straight away, and all other data we hold for your store after 48 hours, or when we receive Shopify’s request to delete your store’s data, except where the law requires us to keep it.
  • Deleted data may remain in backups for a short period until they are replaced, and is not used during that time.

11. Information and audits

On written request, not more than once a year unless required by a regulator or after a breach, we will answer reasonable questions about our security and data protection practices. Any audit must be on reasonable notice, during business hours, subject to confidentiality, and at your cost.

12. Liability and precedence

Each party’s liability under this DPA is subject to the limitations in the Terms of Service. If this DPA conflicts with the Terms about Visitor Personal Data, this DPA prevails.

13. Contact

Frostleaf LLP
Email: business@frostleaf.co