Last Updated: May 8, 2025

This Data Processing Addendum (“DPA”) is incorporated by reference into the Terms of Service or any other agreement (“Agreement”) between you (“Customer”) and CartKit (“Processor”, “we”, “us”, or “our”) regarding the use of any of our Shopify apps.

This DPA reflects the parties’ agreement with respect to the processing of Personal Data under applicable data protection laws.

1. Definitions

• “Personal Data” means any information relating to an identified or identifiable natural person that is Processed by Processor on behalf of Customer.
• “Processing” means any operation or set of operations performed on Personal Data.
• “Sub-Processor” means any third party engaged by the Processor to assist in Processing Personal Data.
• “Applicable Laws” means all data protection laws applicable to the Processing of Personal Data, including but not limited to the California Consumer Privacy Act (CCPA/CPRA), and other U.S. state laws.

2. Roles of the Parties

• Customer is the Data Controller and determines the purposes and means of the Processing of Personal Data.
• Pop Convert is the Data Processor and processes Personal Data solely on behalf of and in accordance with Customer’s instructions.

3. Nature and Purpose of Processing

Pop Convert processes Personal Data for the purpose of providing the Customer with marketing tools such as popups, smart bars, and related features through our Shopify app.

The categories of data may include:

• Shopify customer information (e.g. name, email, location)