TempSureShip Data Processing Addendum

Effective date: 24 October 2026 Last updated: 24 October 2026

1. Scope and roles

1.1 This Data Processing Addendum ("DPA") forms part of the TempSureShip Terms of Service (the "Terms") between you, the merchant ("you"), and TempSureShip LLC, a Colorado limited liability company, 73 Baylor Dr, Longmont, CO 80503, United States ("TempSureShip", "we", "us"). It applies automatically when you install the App. No signature is needed, but we will sign a copy on request ([email protected]).

1.2 Customer Personal Data means the personal data about your customers, and about the people your orders are shipped to, that the App processes on your behalf. It is described in Annex 1.

1.3 Roles. For Customer Personal Data you are the controller (or, where you act for another controller, a processor) and we are your processor (or sub-processor). Under the California Consumer Privacy Act, you are the "business" and we are your "service provider".

1.4 Out of scope. This DPA does not cover:

• information about you as a merchant (your shop domain and any contact details you send us). We are the controller of that information, as described in our Privacy Policy; or
• the free public Ship Check at https://tempsureship.com/check, where visitors enter a ZIP code directly and we act as controller under our Privacy Policy.

1.5 Definitions. "Data Protection Laws" means all laws that apply to the processing of Customer Personal Data under the Terms. These include, where applicable, the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act ("CCPA"). "Controller", "processor", "personal data", "personal data breach", "data subject" and "supervisory authority" have the meanings given in the GDPR. "Sub-processor" means a third party we engage to process Customer Personal Data.

2. Processing on your instructions

2.1 We process Customer Personal Data only on your documented instructions, unless the law requires otherwise. If it does, we will tell you before processing unless the law forbids that.

2.2 Your instructions are these Terms and this DPA, the settings you choose in the App (including the automation mode), and the actions you take in the App and in Shopify Flow. Any other instruction must be in writing and consistent with the Terms.

2.3 We will tell you promptly if we believe an instruction infringes Data Protection Laws. We may suspend the processing affected until you confirm or change the instruction.

2.4 We do not sell or share Customer Personal Data, use it for advertising, or use it for any purpose other than providing, securing and supporting the App for you. We do not combine it with personal data we receive from other merchants or sources, except to provide the App (for example, a shared weather cache keyed by postal code holds no order or merchant identifiers).

2.5 You are responsible for having a lawful basis for the processing, and for giving your customers any notice the law requires, including that you use service providers to process order and shipping information.

3. Confidentiality

Only people authorised by us may process Customer Personal Data, and only to the extent needed to provide the App. Today that is one person, the sole member of TempSureShip LLC. Anyone we authorise in future will be bound by a written duty of confidentiality. AI coding assistants used to develop the App do not have access to production systems or secrets.

4. Security

4.1 We implement the technical and organisational measures described in Annex 2. These are designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, as required by GDPR Article 32.

4.2 We may update these measures as long as the overall level of protection does not decrease.

5. Sub-processors

5.1 General authorisation. You authorise us to engage the sub-processors listed in Annex 3.

5.2 Changes. We will tell you about any new or replacement sub-processor at least 30 days before it starts processing Customer Personal Data. We will notify you by email to your store's contact address and update Annex 3. You may object on reasonable data protection grounds within that period. If we cannot address your objection, you may end the Terms by uninstalling the App. Your data is then deleted as described in section 10.

5.3 Flow-down and responsibility. We impose data protection obligations on each sub-processor that are no less protective than this DPA, to the extent its service allows. We remain responsible to you for its performance. Some of the services in Annex 3 offer no data processing agreement; Annex 3 says which. We send those services only what the App needs, as described there, and never names, street addresses or order identifiers: US postal codes are converted to coordinates inside the App from public US Census data, so only postal codes outside the United States reach the postal-code lookup services, and the US National Weather Service receives only coordinates rounded to about 1 km.

6. International transfers

6.1 We are based in the United States. Customer Personal Data is stored and processed in the United States (Annex 3). Postal codes of customers in the European Economic Area, the United Kingdom and Switzerland are therefore transferred to the United States.

6.2 For those transfers, you (as data exporter) and we (as data importer) enter into the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914, which are incorporated into this DPA by reference:

• Module Two (controller to processor) where you are a controller, and Module Three (processor to processor) where you are a processor;
• Clause 7 (docking clause): included;
• Clause 9(a): Option 2 (general written authorisation), with the notice period in section 5.2;
• Clause 11(a): the optional independent dispute resolution language is not used;
• Clause 13: the supervisory authority is the one competent for you as data exporter;
• Clauses 17 and 18: the law and courts of Ireland;
• Annex I is Annex 1 of this DPA, Annex II is Annex 2, and Annex III is Annex 3.

TempSureShip is not certified under the EU-US Data Privacy Framework. If it becomes certified, transfers may rely on that instead.

6.3 For transfers from the United Kingdom, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (version B1.0) applies, completed with the details above. For transfers from Switzerland, the Standard Contractual Clauses apply with the changes the Swiss Federal Data Protection and Information Commissioner requires: references to the GDPR are read as references to the Swiss FADP, and the competent authority is the FDPIC.

6.4 Where a sub-processor outside the EEA, UK or Switzerland receives Customer Personal Data, we rely on its own transfer mechanism, listed in Annex 3.

7. Requests from data subjects

7.1 Shopify's privacy webhooks. The App handles the mandatory privacy requests Shopify sends:

• customers/data_request. Shopify sends this when one of your customers asks you for their data. We compile the Customer Personal Data the App holds for the orders named in the request. We send it to your store's contact address within 30 days of receiving the request, so that you can pass it on.
• customers/redact. Shopify sends this when you ask for a customer's data to be erased. Within 30 days, and in practice as soon as the request arrives, the App replaces every location value in the named orders' records with [REDACTED]: postal code, city, state/province, country, coordinates, place names and weather-alert areas. This covers both the evaluation records and the audit history. The App also deletes the notifications for those orders. The record of the decision (order number, result, product titles and your overrides) is then kept, without location data, until you uninstall the App (section 10). If you ask us in writing to delete those records too, we will do so within 30 days.
• shop/redact. Shopify sends this 48 hours after you uninstall. The App deletes all data for your store, as it already did on uninstall.

7.2 Other requests. If a data subject contacts us directly about Customer Personal Data, we will not answer the request ourselves. Shopify's API Terms (§6.2.6) restrict direct contact with your customers. We will forward the request to you within 5 business days. For any other request you need help with, write to [email protected]. We will help within 10 business days, taking into account the nature of the processing and the information available to us.

8. Assistance

Taking into account the nature of the processing and the information available to us, we will give you reasonable help with your obligations under GDPR Articles 32 to 36. These cover security, breach notification, data protection impact assessments and prior consultation with a supervisory authority. In practice, we will give you the information in this DPA and answer reasonable questions about how the App processes Customer Personal Data.

9. Personal data breaches

9.1 We will notify you without undue delay, and in any case within 48 hours of confirming a personal data breach affecting your Customer Personal Data. We will send the notice to your store's contact email address.

9.2 The notice will describe, as far as we know at the time:

• the nature of the breach, including when it happened and when we found it;
• the categories and approximate number of data subjects and records concerned;
• the likely consequences;
• the measures we have taken or propose to take, including to reduce harm; and
• a contact point for more information.

Where we cannot provide all of this at once, we will provide it in phases without undue delay.

9.3 You, as controller, decide whether to notify a supervisory authority (GDPR Article 33 sets a 72-hour deadline for controllers) and your customers. We will not notify your customers or a supervisory authority on your behalf unless you ask us to or the law requires it.

9.4 Shopify's API Terms (§6.2.10) require us to notify Shopify within 24 hours of becoming aware of any actual or suspected breach or compromise of merchant data, and to cooperate with Shopify's investigation. That notice may therefore reach Shopify before we have confirmed the breach and notified you.

9.5 Notifying you of a breach is not an admission of fault or liability.

10. Retention, deletion and return

10.1 While the App is installed we keep Customer Personal Data for as long as the App is installed, so that you can see each order's evaluation history, and delete it on uninstall (section 10.2) or when Shopify sends a privacy request (section 7). We plan to delete older records automatically while the App is installed as well, and will update this section, under section 13.4, before that starts.

10.2 On uninstall the App deletes all data for your store, including all Customer Personal Data, immediately. It deletes it again when Shopify's shop/redact request arrives 48 hours later.

10.3 Backups and logs.

• Our hosting plan keeps no automated database backups. Any manual snapshot that holds your data is encrypted at rest by our hosting provider and deleted within 30 days, so deleted data leaves every copy within 30 days.
• Application logs are kept by our hosting provider for 7 days (the retention of our current plan). Application logs do not contain customers' destination postal codes.

10.4 Return. Before you uninstall, you can export your evaluations as CSV and print shipping decision records from the App. On written request made before you uninstall, we will also give you a copy of the Customer Personal Data the App holds for your store, in a common machine-readable format, within 30 days.

10.5 Data in your store. Order tags and tempsure.* metafields the App wrote to your orders are stored in your Shopify store, not by us. One of these, the arrival-weather metafield, includes the destination postal code. These stay in your store after uninstall, under your control. You can remove them like any other tag or metafield.

10.6 We may keep Customer Personal Data longer only where the law requires it. In that case we will protect it under this DPA and use it for no other purpose.

11. Audits and information

11.1 We will make available the information reasonably necessary to show that we comply with this DPA. We will start with written answers, this DPA's annexes, and summaries of our sub-processors' security certifications where they allow us to share them.

11.2 If that information is not enough, or a supervisory authority requires it, you may audit our compliance, subject to these conditions:

• you give at least 30 days' written notice to [email protected];
• you hold no more than one audit in any 12 months, unless a personal data breach or a supervisory authority requires another;
• the audit is done remotely (we have no premises open to visits), during business hours, by you or an independent auditor bound by confidentiality;
• it does not give access to other merchants' data or to our sub-processors' systems; and
• you bear your own costs.

12. California (CCPA) terms

As your service provider we:

• process personal information only for the business purposes in Annex 1;
• do not sell or share it, or retain, use or disclose it outside our direct business relationship with you;
• do not combine it with personal information from other sources, except as the CCPA permits;
• give it the level of protection the CCPA requires; and
• will tell you if we can no longer meet our CCPA obligations.

You may take reasonable steps to stop and remediate any unauthorised use. We certify that we understand and will comply with these restrictions.

13. Liability, term and precedence

13.1 Each party's liability under this DPA is subject to the limitations and exclusions in the Terms, except where Data Protection Laws or the Standard Contractual Clauses do not allow limitation (for example, rights of data subjects as third-party beneficiaries).

13.2 This DPA lasts as long as we process Customer Personal Data for you. Sections 9 and 10 survive until all Customer Personal Data has been deleted.

13.3 If documents conflict, this order applies: the Standard Contractual Clauses, then this DPA, then the Terms, then the Privacy Policy.

13.4 We may update this DPA under the change process in the Terms. We will not reduce the protection it gives Customer Personal Data without your agreement, unless the law requires us to.

14. Contact

Privacy and data protection questions: [email protected] TempSureShip LLC, a Colorado limited liability company, 73 Baylor Dr, Longmont, CO 80503, United States

Annex 1 — Description of the processing

Annex 2 — Technical and organisational measures

In place

Planned

Annex 3 — Sub-processors

The App's code repository (GitHub), uptime monitoring and synthetic checks receive no Customer Personal Data. Shopify is your platform, not our sub-processor.