Data Processing Agreement
Topupsell by TH Global Vietnam · Last updated 2026-07-28
This agreement governs personal data that TH Global Vietnam (“the processor”) processes on behalf of a merchant (“the controller”) who installs Topupsell (“the app”). It supplements the Terms of Service and the Privacy Policy. Where this agreement and the Terms conflict on a data protection question, this agreement wins.
1. Roles
The merchant determines why and how buyer data is processed and is the controller. The processor acts only on the merchant’s documented instructions. Installing the app, configuring offer funnels and enabling optional features are the merchant’s instructions for the purposes of Article 28 GDPR.
2. Subject matter and duration
The processor shows post-purchase and cart offers to buyers, charges accepted offers through Shopify, delays fulfilment briefly so accepted offers ship in the same parcel, and reports conversion results to the merchant. Processing lasts as long as the app is installed, plus the retention periods in §6.
3. Categories of data and data subjects
Data subjects are buyers who complete a checkout in the merchant’s store. The processor handles order identifiers, checkout tokens, line item identifiers, purchased product identifiers, offer amounts and currency, and — where the merchant enables Meta Conversions API — the buyer’s IP address and browser user agent.
The processor does not receive or store buyer names, email addresses, phone numbers, postal addresses or payment card details. The app does not request those fields from Shopify.
4. Processor obligations
The processor: processes personal data only on the merchant’s instructions; ensures anyone with access is bound by confidentiality; implements the security measures in §5; assists the merchant in responding to data subject requests; assists with data protection impact assessments on request; and makes available the information needed to demonstrate compliance with this agreement.
If an instruction from the merchant appears to breach applicable data protection law, the processor will say so rather than carry it out.
5. Security measures
Data in the database is encrypted at rest by the hosting provider and in transit over TLS. Every database query is scoped to the requesting store, so one merchant’s configuration and results are not reachable from another. Third-party access tokens supplied by the merchant are encrypted with AES-256-GCM before storage and are never returned to the browser. Access to production systems is limited to personnel who need it to operate the service.
6. Retention and deletion
Order protection records are deleted 7 days after creation. Offer events lose their order reference after 180 days, leaving aggregate figures that cannot be traced to a person. Merchant configuration and Shopify access credentials are deleted when the app is uninstalled and again when Shopify sends its shop erasure request.
The processor honours Shopify’s mandatory customers/data_request, customers/redact and shop/redact webhooks, so a request the merchant receives reaches the processor automatically. Erasure requests are applied immediately rather than waiting for the periods above.
7. Sub-processors
The merchant authorises the following sub-processors. The processor will give notice on this page before adding another, and remains responsible for their performance.
| Sub-processor | Purpose | Data received |
|---|---|---|
| Shopify | Source of the order data and host of the checkout | Already holds the data as the store platform |
| Vercel | Application hosting | Request traffic to the app, including IP addresses |
| Supabase | Database storage, encrypted at rest | Funnel configuration, offer events, order protection records |
| Meta Platforms only if enabled | Conversions API — reports upsell revenue to the merchant’s own Meta pixel | Upsell amount, currency, order reference, buyer IP address and browser user agent |
Meta Conversions API is off by default. It sends data only after the merchant enters their own Meta pixel identifier and access token in the app’s tracking settings. Enabling it is the merchant’s instruction to share the listed data with Meta; the merchant is responsible for having a lawful basis for that sharing and for disclosing it in their own store privacy policy. Removing the token in the app stops the transfers.
8. International transfers
The processor operates from Vietnam and its sub-processors operate globally, so data may be processed outside the merchant’s country. Where the merchant or its buyers are in the EEA or the UK, the processor relies on the European Commission’s Standard Contractual Clauses, which are incorporated into this agreement by reference.
9. Personal data breaches
The processor will notify the merchant at the email address on their Shopify account without undue delay, and in any case within 72 hours of becoming aware of a breach affecting their data, describing what happened, which data is affected and what is being done about it.
10. Acceptance and changes
Installing or continuing to use the app constitutes acceptance of this agreement. Material changes will be published here with a new date above; continued use after that constitutes acceptance of the revised version. A merchant who does not accept a change should uninstall the app, which triggers the deletion described in §6.
11. Governing law
This agreement is governed by the laws of Vietnam, without prejudice to mandatory data protection rights the merchant or its buyers have under the law of their own country.
Contact
TH Global Vietnam — thvietnambtc@gmail.com