This agreement is between the business that installs POcatch (the “store”, the controller) and Hossein Karami, an individual developer in Istanbul, Türkiye, who makes and runs POcatch (“POcatch”, the processor; POcatch isn’t a company). It applies when POcatch processes personal data for the store, and it’s part of POcatch’s terms of service. If it conflicts with the terms, this agreement wins on data protection.
1. What’s processed, and why
The details are in Annex 1. In short: POcatch processes the store’s customers’ personal data, from the purchase orders the store sends it, only to read them, match them to the store’s products and customers, and prepare draft orders, as the store instructs through the app, for as long as the store uses POcatch.
2. POcatch’s commitments
POcatch:
- Instructions. Processes the data only on the store’s documented instructions (these terms, and how the store uses the app), including for transfers abroad, unless a law requires otherwise, in which case POcatch tells the store first unless that law forbids it. POcatch tells the store if it thinks an instruction breaks data protection law.
- Confidentiality. Lets only people bound by confidentiality process the data, and only to run and support POcatch. Today that’s Hossein Karami alone.
- Security. Keeps the technical and organisational measures in Annex 2.
- Subprocessors. Uses the subprocessors listed at pocatch.com/subprocessors, which the store authorises. POcatch gives at least 30 days’ notice of a new one, during which the store can object on reasonable data protection grounds; if it does, the store can stop using POcatch before the change. Each subprocessor is bound by a contract with data protection obligations at least as protective as these, and POcatch remains responsible for them.
- Help with requests. Helps the store answer its customers’ requests to use their rights. Shopify’s customer data requests are handled automatically: POcatch deletes a customer’s data, or gives the store an export of it, when Shopify forwards the request. Other requests can be sent to support@pocatch.com.
- Help with obligations. Gives the store the information it reasonably needs for its own security, breach notification, data protection impact assessments and consultations with authorities, about POcatch’s processing.
- Breaches. Tells the store without undue delay, and within 48 hours of becoming aware of a personal data breach affecting the store’s data, with what’s known, what’s being done, and a contact; and keeps the store updated.
- End. When the store stops using POcatch, deletes the store’s data as the privacy policy describes (everything within 48 hours of Shopify’s request after an uninstall), and keeps no copy unless a law requires it, except in the encrypted backups, which are deleted within 35 days. The store can export its customers’ data before then through Shopify’s data requests or by asking support@pocatch.com.
- Proof. Makes available the information needed to show it meets this agreement, and allows and contributes to reasonable audits by the store or an auditor it appoints, on 30 days’ notice, at the store’s cost, at most once a year unless a breach or an authority requires more. A written answer and documentation are offered first.
3. The store’s commitments
The store is responsible for having a lawful basis to send its customers’ purchase orders to POcatch, for telling its customers about it in its privacy policy, and for the lawfulness of its instructions.
4. Transfers abroad
POcatch is based in Türkiye, and some subprocessors are in the United States.
- From the EEA: to the extent the store sends personal data from the European Economic Area to POcatch, the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 (Module Two, controller to processor) apply and are incorporated here by reference, with: clause 7 (docking) included; clause 9(a) option 2 (general authorisation, with the notice in section 2.4); clause 11 without the optional wording; clauses 17 and 18 governed by and settled in the courts of Ireland; Annex I as in Annex 1 here; Annex II as in Annex 2 here; the competent supervisory authority as clause 13 provides.
- From the United Kingdom: the UK International Data Transfer Addendum to those clauses (version B1.0) applies, with the tables completed from this agreement.
- From Switzerland: the same clauses apply, with the Swiss Federal Data Protection and Information Commissioner as the authority and Swiss law references where needed.
- Onward transfers to subprocessors rely on their data processing terms, which use the Standard Contractual Clauses or the EU–US Data Privacy Framework.
- Türkiye’s KVKK: where it applies, transfers abroad use the safeguards it requires, such as its standard contracts.
5. US state laws
Where US state privacy laws apply (such as California’s CCPA), POcatch is the store’s service provider: it doesn’t sell or share the personal data, doesn’t keep, use or disclose it for any purpose other than providing POcatch, doesn’t combine it with data from elsewhere except as those laws allow, and tells the store if it can no longer meet these obligations.
6. Liability and duration
This agreement lasts as long as POcatch processes the store’s data. Liability under it is as in the terms of service, except where data protection law doesn’t allow a limit.
Contact
Hossein Karami, individual developer, Istanbul, Türkiye support@pocatch.com (a postal address for formal notices is available on request)
Annex 1: Description of the processing
| Controller (exporter) | The store that installs POcatch, as identified in Shopify; contact: the store owner’s email in Shopify |
|---|---|
| Processor (importer) | Hossein Karami, individual developer, trading as POcatch, Istanbul, Türkiye; support@pocatch.com |
| Data subjects | The store’s business customers and their staff who send purchase orders (buyers and contacts) |
| Categories of data | Names, email addresses, phone numbers, shipping and billing addresses, company names; the contents of purchase orders (products, quantities, prices, notes); the emails and files they come in; Shopify IDs |
| Sensitive data | None is intended. POcatch doesn’t ask for any; if an order contains some, it’s handled with the same measures and deleted on the same schedule |
| Frequency | Continuous, whenever the store sends or uploads purchase orders |
| Nature and purpose | Receiving, storing, reading (with AI), matching to the store’s products and customers, and preparing draft orders in the store, as the store instructs |
| Retention | Emails and their files, and the details read from them: 90 days after arrival (120 days at most in storage). Learned names and addresses: while the store uses POcatch, removable at any time. Everything: deleted within 48 hours of Shopify’s request after an uninstall. Encrypted backups of the database: 35 days |
| Subprocessors | As listed at pocatch.com/subprocessors |
Annex 2: Technical and organisational measures
- Encryption: customers’ details are encrypted in the database with AES-256-GCM; email addresses are looked up through a keyed hash (HMAC-SHA-256); all connections use TLS.
- Access: each store reaches only its own data, inside its Shopify admin, through Shopify’s sign-in. Original files open only through signed links that expire within an hour; data exports through signed links that expire after 7 days. Administrative access is limited to Hossein Karami, with multi-factor authentication on the hosting and email providers.
- Separation: production and development use separate email addresses, storage, secrets and databases.
- Minimisation: POcatch keeps what the orders contain and what’s needed to match them; it asks Shopify for names each time instead of keeping them; error reports exclude request contents, headers, cookies, local variables and AI inputs and outputs.
- Retention and deletion: automatic deletion of emails and the details read from them after 90 days, a storage rule deleting anything after 120 days, and deletion of everything after an uninstall.
- Integrity: incoming emails and file requests between POcatch’s email service and the app are signed (HMAC) and checked; the AI can’t act, only fill in a checked form, and nothing is created in the store without the store’s staff.
- Availability and monitoring: health checks every 5 minutes, error reporting, and a daily operations report.
- Backups: the database is copied every night, encrypted (AES-256-GCM) before it leaves the server, and kept for 35 days with a second provider (Cloudflare, in Eastern Europe), apart from the hosting provider. A restore has been tested.
- Logging: an audit log of significant actions (such as drafts created, settings changed, data deleted or exported), without the personal data itself.