Data Protection Agreement
Effective date: October 13, 2026
This Data Protection Agreement ("DPA") forms part of the agreement between the Shopify merchant that installs DamageDesk ("Merchant", "Controller") and CNR Consulting Services, Inc. ("Processor") for the DamageDesk service. By installing or using DamageDesk, Merchant accepts this DPA.
1. Roles
Merchant is the controller of customer personal data processed through DamageDesk. CNR Consulting Services, Inc. processes that data only as a processor to provide the app functionality described in the Privacy Policy.
2. Scope of processing
Subject matter: damage-claim evidence and workflow for Merchant's Shopify store. Duration: while the app is installed and thereafter only as needed to complete deletion obligations. Nature: storage, retrieval, transmission (notifications/webhooks), and deletion. Categories of data subjects: Merchant's customers and staff users of the app. Types of personal data: as listed in the Privacy Policy.
3. Instructions
Processor will process personal data only on documented instructions from Merchant, including through app settings, Admin/portal use, API/MCP access Merchant enables, and Shopify platform webhooks, unless required by applicable law.
4. Retention and deletion
Merchant may configure a retention period in days for resolved claim data
(default 1,825 days). Processor deletes expired resolved claims
automatically. Processor also deletes or redacts personal data upon Shopify
customers/redact and shop/redact webhooks and
when Merchant deletes eligible unused claims in the app.
5. Security
Processor implements appropriate technical and organizational measures, including encryption in transit, hashed invite tokens, environment separation (local/qa/prod), access controls via Shopify session tokens and API keys, and access logging for reads of protected customer data.
6. Subprocessors
Merchant authorizes use of Cloudflare as a subprocessor for hosting, storage, queues, Pages, and transactional email. Processor will remain responsible for subprocessors it engages to provide DamageDesk.
7. Assistance
Processor assists Merchant with data subject requests via Shopify mandatory privacy webhooks (data request export storage, customer redact, shop redact) and by providing Merchant tools to review and manage claims in Admin.
8. International transfers
Personal data may be processed in regions where Cloudflare operates infrastructure selected for the service. Merchant is responsible for ensuring its use of DamageDesk is lawful for its customers and jurisdictions.
9. Contact
[email protected]
CNR Consulting Services, Inc.
This page is provided for transparency with merchants and customers. It is not legal advice. Contact [email protected] with privacy questions.