Download TXTDATA PROCESSING AGREEMENT — Radius Pickup Scanner
Version 2026-09-13.1
1. Parties and formation
The merchant identified by the authenticated Shopify store accepting this Agreement is the Controller. The Processor is Multikapitał sp. z o.o., ul. Krośnieńska 24, 87-100 Toruń, Poland; VAT/NIP PL9562302202; REGON 341398889; KRS 0000448302, District Court in Toruń. Contact: hello@radiusdelivery.app.
This Agreement forms part of the contract for Radius Pickup Scanner and prevails on matters concerning processing on the Controller's behalf. The store owner accepts electronically on behalf of the merchant. This English text is the contractual text; translated interface explanations assist the user.
2. Instructions, purpose and duration
The Processor processes data only on documented instructions from the Controller, including authorised configuration and use of Radius: preparing pickups, publishing customer QR codes after readiness, verifying orders, recording collection, preventing duplicate handover, reports and optional notification requests through Shopify Flow. No sale of customer data, advertising profiling or unrelated use is permitted. Processing continues for the service duration subject to the retention schedule below.
The Processor informs the Controller if an instruction infringes data protection law. Legally required processing is notified beforehand unless prohibited by law. The Controller is responsible for its lawful basis, customer information and instructions. This Agreement is not customer consent and does not grant marketing permission.
3. Data and people
Data subjects are customers placing pickup orders and merchant personnel using Radius. Data includes shop, order and fulfillment identifiers, order status, products and quantities, customer names displayed from Shopify, pickup stations, personnel identifiers and access permissions, pickup credentials and timestamps. Operations include retrieval, verification, display, restricted storage, transmission, export and deletion. Customer names and product lists are read from Shopify for authorised display, not stored in the pickup-record database. Radius is not intended for special-category data; the Controller must not instruct unnecessary processing of such data.
4. Confidentiality and security
Access is restricted to authorised personnel bound by confidentiality. The Processor maintains appropriate technical and organisational measures, assesses their effectiveness and assists the Controller with security obligations. Measures include shop and station access checks, verified Shopify sessions, revocable staff credentials, hashed pairing secrets, limited pairing attempts, HTTPS endpoints, encrypted managed database storage and backups, separated test and production environments, restricted infrastructure access, strong authentication policies and incident procedures.
5. Subprocessors and international transfers
The Controller authorises Render as the hosting and managed PostgreSQL subprocessor. The operational database is located in Frankfurt, Germany. Render is a US provider; this location is not a promise that all support or infrastructure processing is exclusively within the EEA. The Processor must maintain an applicable data processing agreement with Render and lawful safeguards for any restricted international transfer, such as applicable adequacy coverage or standard contractual clauses. See https://render.com/dpa and https://render.com/security for Render's terms and downstream providers. Acceptance of this Agreement alone is not a transfer safeguard.
The Processor imposes equivalent data protection obligations on subprocessors and remains responsible for their performance. Before adding or replacing a subprocessor, it gives at least 30 days' notice through the app or the merchant's designated contact, allowing an objection on reasonable data protection grounds. If unresolved, the affected service may be terminated with return/deletion under clause 8. Shopify operates the merchant's platform; messaging providers independently selected by the merchant operate under the merchant's arrangements. Flow handoff does not establish delivery of a message.
6. Assistance and incidents
Taking account of the processing and information available, the Processor assists with data-subject requests, security, breach obligations, impact assessments and consultation with supervisory authorities. It forwards requests to the Controller unless instructed or legally required to respond. The Processor notifies the Controller without undue delay after becoming aware of a personal data breach and provides available details of the event, affected data, likely consequences, measures and contact, with updates as information becomes available.
7. Information and audits
The Processor provides information necessary to demonstrate compliance and allows and contributes to audits and inspections by the Controller or its authorised auditor. Practical arrangements protect security and other merchants' confidentiality without preventing the Controller's statutory audit rights.
8. Retention, export and deletion
Collected pickups are retained for 365 days after collection for reporting and verification. Cancelled or invalidated records are retained for 365 days after their last update. Open pickups remain while needed for fulfilment; there is no automatic age-based deletion of a live, non-expiring QR. The Controller should review obsolete open pickups and instruct cancellation or deletion.
Details of completed Bulk jobs and terminal Flow payloads are retained for 90 days after completion/update. Minimal deduplication records needed to avoid repeated notification requests remain while the related pickup exists. Pending work remains until resolved or cancelled. Privacy requests remain until completed; completed request details are removed after 365 days. Expired pairing attempt buckets are removed after one day. Staff configuration remains while the service is used or until deletion is requested. Revoking access immediately prevents further use; it does not automatically erase collection history.
Routine cleanup runs at least daily while the service is operating and resumes after outages. Reports show a rolling 365-day collection window. This does not change Shopify's own order retention. Obtain report exports or request a return of application data before uninstalling; for other return requests contact support through a verified store-owner process. On termination, at the Controller's choice the Processor returns or deletes the data and deletes existing copies unless law requires retention. Uninstall instructs deletion of active application data; Shopify privacy webhooks and verified deletion requests are also supported. Request any required return before uninstalling because deletion is irreversible.
Managed Render recovery copies rotate out within seven days under its current backup service. No longer-lived customer database archive is part of the service. Restores must occur in isolation and repeat applicable deletions before processing resumes. Application log output omits URL query strings and customer payloads; operational runtime logs expire after 7, 14 or 30 days according to the Render workspace plan, with a maximum of 30 days. They are not a customer archive.
A minimal record of this Agreement (shop, accepting Shopify user ID, version, document fingerprint and timestamps) is kept separately for the contract's duration and three years after termination to evidence the contract and handle claims. For this limited purpose Multikapitał acts as controller, restricts access, and accepts rights requests at the above contact. It contains no customer order data. A legal preservation requirement may extend retention only for the necessary data and purpose.
9. Rights after termination
Confidentiality and required assistance continue while any data remains. Obligations under applicable data protection law, including Article 28 GDPR, are not reduced by this Agreement. Each party remains responsible for its own compliance.