Data Processing Addendum
Effective date: October 23, 2026
This Data Processing Addendum ("DPA") is part of the Terms of Service between the merchant ("you") and Deewang Ltd ("we"). It applies when we process personal data for you through Native Pledge Manager. It applies automatically; you do not need to sign anything.
1. Roles
For the personal data of your backers and store customers, you are the controller (data user) and we are your processor. We process that data only to provide Native Pledge Manager and only on your documented instructions, which are these terms and how you configure and use the app.
2. What we process
| Item | Details |
|---|---|
| Who it is about | Your backers and your store's customers who use the pledge manager |
| Kinds of data | Name, email address, crowdfunding backer number or id, pledge details and status, survey answers, delivery address and phone number, Shopify customer id, store credit and order details for pledge orders |
| Purpose | Running your pledge manager: import, account matching, pledge credit, campaign pricing, surveys, address collection, emails to backers and fulfilment |
| Duration | While the app is installed, then deleted as described in section 7 |
| Special categories | None are needed. Do not ask backers for sensitive data (such as health data) in surveys |
3. Our commitments
- Everyone who can access the data is bound by confidentiality.
- We keep appropriate security measures in place: encryption in transit (TLS), encrypted Shopify access tokens, verified webhooks, access limited to the people who operate the service, and backups kept no longer than 30 days.
- We help you answer requests from backers and customers who exercise their rights. Shopify's customer data request and deletion requests are handled automatically.
- We tell you without undue delay, and where possible within 72 hours, after we become aware of a personal data breach affecting your data, and we help you meet your own obligations.
- We provide the information reasonably needed to show we comply with this DPA.
4. Subprocessors
You authorise us to use these subprocessors. We impose data protection terms on each one that are no less protective than this DPA. We will update this list at least 14 days before adding or replacing a subprocessor. You may object by emailing ; if we cannot resolve the objection, you may stop using the app.
| Provider | What it does for us | Location |
|---|---|---|
| Shopify Inc. and its affiliates | The platform the Shopify app runs on: app installation, billing, store data the app reads and writes | Global (Shopify's own infrastructure) |
| Hetzner Online GmbH | Hosting of the Shopify app server and its database | United States (Hillsboro, Oregon) |
| PostShiba | Sending the app's transactional emails to backers (address confirmations, address review notices, shipment updates, pledge links) | See PostShiba's own documentation |
| Cloudflare, Inc. | Delivery and protection of the nativepledgemanager.com website and license service (not the Shopify app's backer data) | Global |
5. International transfers
Data is hosted in the United States and the service is operated from Hong Kong. Where personal data from the EU, EEA, UK or Switzerland is transferred to a country without an adequacy decision, the parties agree to the European Commission's Standard Contractual Clauses (Module 2, controller to processor, or Module 3 where you are yourself a processor), with the UK Addendum for UK data. These clauses are incorporated by reference, with the details in section 2 of this DPA.
6. Audits
On reasonable written request, at most once a year, we will answer your security questionnaire and give you the information you need to check our compliance.
7. Return and deletion
You can export your campaign data from the app at any time. When you uninstall the Shopify app, Shopify sends a store deletion request about 48 hours later and we delete your store's data. Backups that may still contain it are removed within 30 days. We keep nothing longer unless the law requires it.
8. Order of precedence
If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA wins. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses win.
Contact
Deewang Ltd, Suite A, 6/F, Ritz Plaza, 122 Austin Road, Tsim Sha Tsui, Kowloon, Hong Kong. Email: .