Data Processing Addendum

This Addendum forms part of the Terms of Service between Kadosh (카도쉬), proprietor Kang Seung-hyun (강승현) ("Processor", "we") and the merchant installing cadosy GPSR Shield (also referred to as GPSR Shield) ("Controller", "you"). It applies where we process personal data on your behalf and, to that extent, reflects Article 28 GDPR. If it conflicts with the Terms on data processing, this Addendum controls.

1. Roles

You are the controller of the personal data you enter and publish through the App (including economic-operator contact details and reviewer identities). We act as processor, processing that personal data only to provide the App.

2. Subject-matter, duration, nature and purpose

• Subject-matter / nature: storing, organising, displaying and gap-checking GPSR Article 19 data on your storefront, and recording the current review and last product publication.
• Saved gap-check progress contains product IDs, titles and detected gap descriptions, not copied operator contact details or authored warning text. The latest Pro scan and latest Free 50-product sample are retained separately as described in the Privacy Policy.
• Reusable profiles and bulk-work records contain profile names, product/reference identifiers, titles, technical fingerprints, proposed reference assignments, progress and results. Original operator contact fields, warning text and publication snapshots are not copied into these records. Job-history and management removal, access after a Pro downgrade, and retention limits are described in the Privacy Policy.
• Saved CSV work additionally retains selected model/type and batch/serial values, before/after comparisons, row numbers and input-validation notices, not the original uploaded file.
• An optional review inbox retains product IDs/titles, minimal notification identity, technical fingerprints, observed states, timestamps and acknowledgments. It does not copy full webhook bodies or safety-contact text. Opt-in, stopping capture, downgrade access and activity-based retention limits are described in the Privacy Policy. These records are not a complete history of publication actions or a legal certification.
• Duration: for as long as the App is installed, plus the retention period in the Privacy Policy.
• Optional merchant-reported display checks retain minimal product/template identifiers, technical state fingerprints, view type, optional country/language, timestamp and development classification. They do not copy safety-contact or warning text and are not independently verified visibility evidence. Their Free access and activity-based retention/clearing rules are described in the Privacy Policy.
• Purpose: providing the App's functionality.
• Optional, default-off workflow measurement stores only fixed stage names, first-observed times and development-store classification, with installation-scoped technical identifiers and preferences. It does not copy safety content, product identifiers or staff identities. Its purpose is to identify setup steps needing improvement. Merchant choice, downloads, clearing, installation separation and activity-based retention are described in the Privacy Policy; participation is not required for Free or Pro access. It is not payment evidence.

3. Categories of data and data subjects

• Data subjects: your economic operators (manufacturers, importers, responsible operators — including sole traders / natural persons) and your staff who review/publish.
• Personal data: names, postal addresses, electronic addresses, phone numbers, role; reviewer identifier and timestamps. No special-category data is required or intended.

4. Our obligations as processor

We will: (a) process personal data only on your documented instructions (the Terms, this DPA, and your use of the App), including for international transfers; (b) ensure persons authorised to process the data are bound by confidentiality; (c) implement appropriate technical and organisational security measures (Art. 32); (d) engage sub-processors only under written terms with equivalent obligations, and inform you of intended changes so you may object (current list: Shopify (app platform and merchant-store data), Vercel (application hosting, compute, and service logs), Neon (PostgreSQL session and saved scan/bulk-work storage), and Google (support email when you contact us)); (e) assist you, taking into account the nature of processing, with data-subject requests and with your obligations under Arts. 32–36 (security, breach notification, DPIA); (f) notify you without undue delay after becoming aware of a personal-data breach; (g) at your choice, delete or return the personal data we hold at the end of the services, and delete existing copies unless retention is legally required; and (h) make available information necessary to demonstrate compliance and allow reasonable audits.

5. Your obligations as controller

You warrant that you have a lawful basis to process and to publicly display the personal data you enter (Article 19 requires public display of operator contact details), that your instructions are lawful, and that you will respond to data-subject requests for which you are responsible.

6. International transfers

Where personal data is transferred outside the EU/EEA (including to Republic of Korea), the parties rely on an appropriate transfer mechanism (e.g. EU Standard Contractual Clauses), which are incorporated by reference where applicable.

7. Sub-processors

Current sub-processors: Shopify (app platform and merchant-store data), Vercel (application hosting, compute, and service logs), Neon (PostgreSQL session and saved scan/bulk-work storage), and Google (support email when you contact us). We remain responsible for their performance.

8. Liability

Liability under this Addendum is subject to the limitation of liability in the Terms of Service.

Signatures / acceptance: acceptance of the Terms of Service constitutes acceptance of this DPA.