Green13 Sales Reports — a Shopify app by Green13 srl. Last updated: 9 October 2026.
This DPA takes effect when the Merchant installs the App and forms part of the terms under which the Merchant uses it. Our Privacy Policy describes the same processing in plain terms; if the two differ on how personal data is processed, this DPA prevails.
The subject matter is the provision of the App: daily, weekly or monthly sales reports of the Merchant's store, calculated from the store's orders and products and sent by email, through the Merchant's own email server, to the recipients the Merchant chooses. The processing lasts for as long as the App is installed, and ends with the deletion described in section 11.
Green13 reads, calculates, stores, sends and erases data, only to:
Orders and products are read when a report is prepared and are not copied into our database: only aggregated figures and product titles are kept. Personal data is never used for marketing, profiling, analytics or advertising, and is never sold. The App sends emails only through the Merchant's own email server, never through an email account or sending service of ours.
| Report recipients | The people the Merchant chooses to receive its reports, such as the store owner, staff or advisers: their email address, whether it is pending, confirmed or unsubscribed, when it was invited and confirmed, and the random code of its confirmation and unsubscribe links. Addresses other than the store's own get an invitation and receive no report until they confirm. |
|---|---|
| Unsubscribed addresses | An address that unsubscribes is kept on a block list for that store, so the store can't add it again. |
| Deliveries and invitations | For scheduled reports, which address received the report of which period, so that a retry never sends the same report twice; and the address and time of each invitation, to limit repeated invitations. |
| Store owner and app user | The store owner email and contact email read from Shopify, used to recognise the store's own address. For the person who opens the App, the session Shopify issues: name, email and "store owner" flag, used only to check that the App is used by the store owner. |
| Email server settings | The SMTP server name, port, security mode, username, sender address and sender name the Merchant enters, and the password, stored encrypted. |
| The Merchant's customers | None. Orders are read without any customer field: the App does not request customers' names, email addresses, phone numbers or postal addresses, and stores no data about them. From orders it reads only dates, totals, refunds, cancellation and test status, and the title, quantity, value and variant of each line item. |
The App does not process special categories of personal data or payment details.
These are the technical and organisational measures in place today (Article 32 GDPR):
| Aruba S.p.A., Italy | Hosting of the App's production server and its database (virtual server in a data centre in Italy). |
|---|
Shopify is not our sub-processor: it is the Merchant's own commerce platform. The App exchanges data with Shopify only through Shopify's APIs, on the Merchant's behalf, to read the orders, products and store details the reports need.
The Merchant's email server is not our sub-processor either: the Merchant chooses it and enters its settings in the App, and its provider works for the Merchant, under the Merchant's own agreement with it. The App only hands it the emails to deliver.
The Merchant authorises the sub-processor listed above. Before adding or replacing a sub-processor we will announce it on this page at least 30 days in advance; a Merchant who objects can stop using the App by uninstalling it, which triggers the deletion in section 11. Any sub-processor is bound by data protection obligations equivalent to those in this DPA.
The App helps the Merchant answer requests from the people whose data it processes:
If a data subject contacts us about data the App processes for the Merchant, other than a recipient asking to be removed, we will forward the request to the Merchant without responding to it ourselves. We also give the Merchant the information we have to help with data protection impact assessments and consultations with supervisory authorities.
If we become aware of a personal data breach affecting the Merchant's data, we will notify the Merchant without undue delay and in any case within 72 hours of becoming aware of it, with what is known at that time: the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, and the measures taken or proposed. We will add information as it becomes available and help the Merchant meet their own obligations to notify the supervisory authority and the people concerned.
When the Merchant uninstalls the App, the authentication session is deleted immediately and the reports
stop. Shopify then sends the shop/redact request 48 hours after the uninstall, and the App
deletes all of that store's data as soon as it arrives: email server settings and password, reports,
recipients, block list, deliveries, invitations, period totals, report history and sessions. Data in
the encrypted backups disappears as they roll over (section 9). We keep no copy of the Merchant's data
after that.
On written request to info@green13.agency, we make available the information needed to demonstrate compliance with Article 28 GDPR: a description of the processing and of the security measures, and answers to reasonable security questionnaires. Any further audit or inspection is agreed in writing in advance, with reasonable notice and without access to other merchants' data.
Green13 does not transfer the Merchant's personal data outside the European Union. The production server and its backups, including the off-site copy, are in Italy. Emails leave the App through the Merchant's own email server, whose location is part of the Merchant's agreement with its provider. Data that the Merchant's store holds on Shopify is governed by the Merchant's own agreement with Shopify.
If the processing changes (new data, a new sub-processor, a different retention period), this page will be updated before the change is released, and the date above will change.