Data Processing Agreement

Last updated: 8 October 2026

This Data Processing Agreement ("DPA") is part of the terms of service of Sheets for Shopify. It applies between the merchant that installs Sheets in a Shopify store ("you", the controller) and 4Cs BV, Lindekensweg 3, 2160 Wommelgem, Belgium, company number BE 1014.832.509, publisher of Drop Top Sheets ("we", the processor). By installing or using Sheets you accept it on behalf of the store. It meets Article 28 of the EU General Data Protection Regulation (GDPR) and applies equally under other data protection laws that apply to you.

1. Subject, purpose and duration

We process personal data only to provide Sheets to you: reading your store data through Shopify's Admin API to compute the spreadsheets, pivot tables, charts, exports, scheduled reports and alerts that your staff set up. The processing lasts as long as Sheets is installed in your store, plus the deletion period in section 8.

2. Data and data subjects

  • Data subjects: your store's customers, and the staff members of your store who use Sheets.
  • Customer data: customer ID, orders and order lines (dates, amounts, products, quantities, status), number of orders and amount spent, and the city and country of the shipping and default address. Sheets has Shopify's protected customer data access (level 2) because Shopify requires it for its analytics API, but it does not read customers' names, e-mail addresses, phone numbers, street addresses, postcodes or regions: its queries do not ask Shopify for them. The fields are listed on How Sheets handles Shopify data.
  • Staff data: name, e-mail address and Shopify user ID of the staff members who open Sheets.
  • No special categories of data (Article 9 GDPR) are processed.

3. Your instructions

We process personal data only on your documented instructions: these terms, this DPA and the settings and spreadsheets your staff create in Sheets. We do not use it for our own purposes, do not sell or share it, do not use it for advertising or profiling and do not use it to train AI models. If we believe an instruction breaks data protection law, we tell you.

4. Confidentiality

Only people authorised by us who need it to run and support Sheets can access personal data, and they are bound to confidentiality. We do not look at a store's data unless you ask us to (for example in a support request) or the law requires it.

5. Security

We apply the technical and organisational measures in the annex, and keep them at least at that level.

6. Sub-processors

You authorise the following sub-processors:

  • Cloudflare, Inc.: network and TLS for the traffic between Shopify, your browser and our servers (data in transit).
  • Your chosen e-mail provider: when your staff connect a mailbox (Google, Microsoft or SMTP) to send scheduled reports, reports are sent through it to the recipients you choose.

Our servers are in the European Union and operated by us. We announce a new or replaced sub-processor on this page at least 30 days before it starts; if you object, you can uninstall Sheets before the change takes effect. Each sub-processor is bound to data protection obligations at least as strict as this DPA.

7. Help with your obligations

We help you answer data subject requests: Shopify's customer data requests and customer redaction requests are handled automatically, and we answer any other request you send to [email protected] within 10 days. We also give you the information you need for data protection impact assessments and consultations with authorities.

8. Deletion

When Sheets is uninstalled we delete the store's access token at once, and all of the store's Sheets data (spreadsheets, version history, settings, schedules, alerts and share links) within 48 hours of Shopify's store redaction request. Store data read from Shopify is held only in memory for a short time. We keep no backups of store data.

9. Personal data breaches

We notify you without undue delay, and at the latest within 48 hours of becoming aware of a personal data breach affecting your data, with what we know about its nature, the data and people concerned, its likely consequences and the measures taken. We also inform Shopify where its terms require it, and help you meet your own notification duties.

10. Audits

We make available the information needed to show compliance with this DPA. You may request a written description of our measures, or an audit by an independent auditor bound to confidentiality, at your cost and with 30 days' notice, at most once a year unless a breach or an authority requires otherwise.

11. Transfers

We store and process data in the European Union. Where a sub-processor processes data outside the European Economic Area, the transfer is covered by the EU Standard Contractual Clauses or an adequacy decision.

12. Liability, law and changes

Liability follows the terms of service. This DPA is governed by Belgian law; the courts of Antwerp have jurisdiction. If this DPA and the terms conflict on the processing of personal data, this DPA prevails. We announce changes on this page and change the date above.

Annex: technical and organisational measures

  • Encryption: all traffic uses TLS (HTTPS). Server disks are encrypted, and Shopify access tokens are additionally encrypted with AES-256-GCM using a key kept outside the data volume.
  • Data minimisation: Sheets has read-only access to the store. Of customers' personal details it reads only the city and country of an address, never names, e-mail addresses, phone numbers, street addresses or postcodes; automated tests fail if any query asks for more. Store traffic is read as totals, never per visitor. Store data is read live and kept in memory for at most one minute.
  • Access control: only authorised personnel can reach the servers and administration tools, through personal accounts with strong unique passwords and two-factor authentication. Inside Sheets, every request is checked against the Shopify session of the staff member, and each store's data is kept separate.
  • Separation: development and testing use separate Shopify development stores and separate servers; production data is not used for testing.
  • Verified requests: Shopify webhooks are verified with HMAC signatures, and Shopify session tokens are verified on every request.
  • Deletion: uninstalling and Shopify's redaction requests delete data automatically (section 8).
  • Incident response: a written procedure covers detecting, containing and investigating incidents, revoking access tokens and notifying merchants and Shopify (section 9).