Data Processing Agreement — Jojocode Checkout

Last updated: 5 November 2026

This Data Processing Agreement ("DPA") applies between the merchant who installs Jojocode Checkout ("the merchant") and Murat Zafer Karaaslan (Jojocode), the developer of the app ("we"). It is part of the terms under which the merchant uses the app. It takes effect when the app is installed and ends when the app is uninstalled and the merchant's data has been deleted as described below. Our Privacy Policy describes the same processing in plain terms.

1. Roles

For the personal data of the merchant's customers, the merchant is the data controller (veri sorumlusu under Türkiye's Law No. 6698 on the Protection of Personal Data, "KVKK", and the controller under the GDPR where it applies), and we process that data on the merchant's behalf as data processor (veri işleyen). For the merchant's own account and contact details, the Privacy Policy applies.

2. What we process and why

• Purpose: to show province, district and neighbourhood pickers and correct addresses, to record the buyer's agreement consent, and to save the final agreement texts on each order.
• Data subjects: the merchant's customers (buyers).
• Personal data: buyer name, email address, phone number, shipping and billing addresses, order contents, totals and payment method name, the consent record (which agreements were accepted and when), and the address text a buyer types when address autocompletion is used.
• How: buyer data is processed in memory to answer a request or to fill the order's agreement texts, and the result is written back to the merchant's Shopify store. We keep no copy of buyer data on our servers.
• Duration: while the app is installed, plus the retention periods in section 7.

3. Instructions

We process personal data only to provide the app as the merchant sets it up in the app and in Shopify; those settings are the merchant's documented instructions. We do not sell personal data or use it for advertising, profiling or any purpose of our own. If we believe an instruction breaks the law, we tell the merchant.

4. Confidentiality and security

Only named staff who are bound by confidentiality can access the systems that process personal data. We maintain:

• HTTPS for all traffic; a database reachable only on a private network;
• no buyer data stored on our side;
• daily database backups, encrypted at rest in a private storage bucket;
• separate test and production environments, with no production data copied into testing;
• unique strong passwords and two-factor authentication on every staff account, and access removed when it is no longer needed;
• access logs, secrets kept outside the source code, and regularly updated dependencies;
• a written security incident response procedure.

5. Sub-processors

The merchant authorises these sub-processors:

• Hostinger — the servers that run the app, in Frankfurt, Germany; buyer data passes through them in memory.
• Cloudflare — encrypted backups of the app's database (merchant settings; no buyer data).

The buyer data itself stays in the merchant's Shopify store, which Shopify processes under the merchant's own agreement with Shopify. We tell merchants by email before we add or replace a sub-processor that handles personal data, so they can object; if we cannot resolve an objection, the merchant may stop using the app.

6. Requests from customers

Customers exercise their rights with the merchant. We pass on any request we receive to the merchant and help them answer it. When Shopify sends a customer erasure request, we delete the agreement texts we saved on that customer's orders. There is nothing else to return for a customer data request, because we hold no buyer data and the saved texts are visible on the orders in the merchant's Shopify admin.

7. Retention and deletion

• Buyer data is not kept by us after the request or order it was processed for.
• The agreement texts saved on an order are part of the merchant's order record in Shopify and stay with the order, unless a customer erasure request removes them.
• On uninstall, sessions are deleted at once and all other store data 48 hours later, when Shopify sends the shop/redact request.
• Backups are kept for 30 days and technical logs for no longer than 30 days.

8. Personal data breaches

If a breach affects the personal data of the merchant's customers, we notify the merchant without undue delay and no later than 72 hours after we become aware of it. We tell them what happened, which data and people are affected, the likely consequences and what we have done. We also help them with any notifications they must make, for example to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) or to their customers.

9. Transfers abroad

The app's servers are in Frankfurt, Germany (European Union), so data is processed outside Türkiye. Customer data reaches us from Shopify, which also processes it outside Türkiye. Where the law requires safeguards for these transfers (for example the standard contracts under Article 9 of the KVKK), the parties put them in place.

10. Information and reviews

On request, we give the merchant the information needed to show that this DPA is followed, including a description of our security measures and answers to reasonable security questionnaires.

11. The merchant's part

The merchant makes sure it has a legal basis for the processing and tells its customers about it in its own privacy notice. It is responsible for the content of the agreement texts it publishes with the app, including any template text it chooses to use.

12. Changes and contact

We update this DPA when the app or the law changes; the date above shows the current version, and we tell merchants about material changes by email in advance. Questions: hello@jojocode.dev