Our processor terms.
Ready to sign.

Last updated: October 2026 · Effective date: October 6, 2026 · Operator: Verdikx LLC

1. Parties and scope

This Data Processing Addendum (“DPA”) is between the merchant identified in the signature block (“Customer”) and Verdikx LLC, address 111 Town Square Place, Suite 1201, PMB 1270, Jersey City, NJ 07310 (“Verdikx”, “Processor”). It forms part of the Verdikx Terms of Service (the “Agreement”) and applies where Verdikx processes personal data on Customer’s behalf in providing the service. Terms such as “controller”, “processor”, “personal data”, “processing”, “data subject” and “personal data breach” have the meanings given in the EU General Data Protection Regulation (2016/679) (“GDPR”), and include the equivalent terms in the UK GDPR, the Swiss Federal Act on Data Protection and US state privacy laws (where Verdikx acts as a “service provider” or “processor”).

2. Roles

Customer is the controller, and Verdikx is the processor, of personal data of Customer’s end customers that Verdikx processes to provide the service (“Customer Personal Data”). Verdikx is the controller of merchant account data, as described in the Privacy Policy.

3. Details of the processing (Annex I)

• Subject matter and duration: providing Verdikx under the Agreement, for its term and until deletion under section 10.
• Nature and purpose: storing and analysing order, customer and dispute records to keep an evidence history, screen orders for fraud, review returns, and prepare and submit dispute responses on Customer’s instructions.
• Data subjects: Customer’s end customers (buyers), and people who appear in records Customer connects, such as customer-support conversations.
• Categories of personal data: names, email addresses, phone numbers, billing and shipping addresses, order and payment details (card brand, BIN and last four digits only; never full card numbers), fulfillment and tracking details, checkout IP address and device signals, and customer-support messages.
• Special categories: none are intended. Customer will not send special-category data to Verdikx.

4. Customer’s instructions

Verdikx processes Customer Personal Data only on Customer’s documented instructions, which are the Agreement, this DPA and the settings, connections and actions Customer chooses in Verdikx, unless the law requires otherwise, in which case Verdikx will tell Customer first unless the law prohibits it. Verdikx will inform Customer if it believes an instruction infringes data protection law. Verdikx does not sell Customer Personal Data, share it for cross-context behavioural advertising, or use it outside the direct business relationship with Customer, except the Verdikx Network fraud-prevention signals described in the Privacy Policy, which apply only if Customer opts in under the Verdikx Network terms and stop as soon as Customer leaves in Settings.

Verdikx Network (optional)

The Verdikx Network is off unless Customer joins it in Settings by agreeing to the Verdikx Network terms (section 22 of the Terms of Service), and Verdikx records the terms version and the date of that agreement. While Customer participates, Verdikx shares fraud outcomes (chargebacks, won disputes, refund abuse and undisputed orders) with other participating stores only as one-way keyed hashes of buyer identifiers, for the sole purpose of fraud and abuse prevention, never for credit, employment, insurance or housing eligibility decisions. Participating stores receive only aggregate counts, shown when at least three other participating stores reported the same kind of outcome. Hashed identifiers are kept up to 200 days and outcome events up to three years. If Customer leaves, contributions and lookups stop immediately and Customer’s past contributions are deleted.

5. Confidentiality

Verdikx ensures that everyone authorised to process Customer Personal Data is bound by an obligation of confidentiality.

6. Security (Annex II)

Verdikx implements appropriate technical and organisational measures under Article 32 GDPR. The measures in place are described on our Security page, including encryption in transit, encryption of stored credentials, database row-level security, two-factor sign-in and privacy-preserving error monitoring. Verdikx may update these measures provided the overall level of protection is not reduced.

7. Subprocessors (Annex III)

Customer gives Verdikx general authorisation to engage the subprocessors listed on our Subprocessors page. Verdikx will update that page and notify Customer by email or in the app at least 14 days before a new subprocessor begins processing Customer Personal Data. Customer may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, Customer may terminate the affected part of the service. Verdikx imposes data protection obligations on each subprocessor that are no less protective than this DPA and remains responsible for its subprocessors’ performance.

8. Assistance

• Data subject requests: Verdikx helps Customer respond to requests to exercise data subject rights. Shopify customer data requests produce an automatic export, and customer redaction requests are carried out automatically, as described in the Privacy Policy. If Verdikx receives a request directly, it will refer the data subject to Customer.
• Impact assessments: Verdikx provides reasonable information Customer needs for data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing.

9. Personal data breaches

Verdikx will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Verdikx will provide further information as it becomes available and take reasonable steps to contain the breach.

10. Deletion and return

When the Agreement ends, including when Customer uninstalls Verdikx from Shopify, Verdikx deletes Customer Personal Data as described in the Privacy Policy (store data is deleted on Shopify’s store deletion request), unless the law requires it to be kept. On written request before deletion, Verdikx will help Customer export the evidence packets and case data available in the service. Other deletion requests are completed within 30 days.

11. Information and audits

Verdikx makes available the information reasonably necessary to demonstrate compliance with Article 28 GDPR, including answers to security questionnaires. If that information is not sufficient, Customer may, at its own cost, on at least 30 days’ written notice and no more than once a year (or after a personal data breach), audit Verdikx’s compliance with this DPA through an independent auditor bound by confidentiality, in a way that does not disrupt the service or disclose other customers’ data.

12. International transfers

Verdikx and its subprocessors process data in the United States and other countries. Where Customer Personal Data is transferred from the European Economic Area to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated by reference with Customer as data exporter and Verdikx as data importer: clause 7 (docking) applies; under clause 9 option 2 (general authorisation) applies with the notice period in section 7; the optional language in clause 11 does not apply; clauses 17 and 18 select the law and courts of Ireland; and Annexes I to III are sections 3, 6 and 7 of this DPA. For transfers from the United Kingdom, the UK International Data Transfer Addendum to those clauses applies; for transfers from Switzerland, the clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection. Verdikx relies on equivalent safeguards in its subprocessors’ data processing terms.

13. Liability and precedence

Each party’s liability under this DPA is subject to the limitations in the Agreement, except where the law does not allow it. If this DPA conflicts with the Agreement, this DPA controls for the processing of Customer Personal Data; the Standard Contractual Clauses control over both. Except where the Standard Contractual Clauses require otherwise, this DPA is governed by the law that governs the Agreement (New Jersey).

Signatures