REELUP

Data Processing Agreement

Updated at 01 Jan 2025

Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between ReelUp LTD. ("ReelUp", "we", "us") and its customers ("Merchant", "you", "your") who use ReelUp’s services, including the ReelUp Shopify app and related products.
This DPA outlines the terms under which ReelUp processes personal data on behalf of Merchants in compliance with the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other applicable data protection laws.

1. Definitions

  • Data Controller: The Merchant (Shopify store owner) who determines the purposes and means of processing personal data.
  • Data Processor: ReelUp LTD., processing personal data on behalf of the Data Controller.
  • Personal Data: Any information relating to an identified or identifiable natural person.
  • Processing: Any operation performed on personal data (e.g., collection, storage, usage, disclosure).

2. Scope of Data Processing

ReelUp LTD. processes personal data solely for the purpose of providing its services to Merchants, including but not limited to:

  • Displaying and managing shoppable videos on Shopify storefronts.
  • Collecting and analyzing user interactions with videos (e.g., views, play time, clicks, likes, conversions).
  • Tracking Shopify Customer ID and Customer Email (for logged-in customers) to provide Merchants with detailed attribution reports on customer interactions with ReelUp videos.
  • Enabling retargeting and personalization features, if configured by the Merchant.
  • Providing analytics, performance reports, and insights to Merchants.
  • Supporting operational functions such as customer support and technical improvements.

ReelUp LTD. processes this data strictly on behalf of the Merchant and does not use it for its own independent purposes.

3. Categories of Data Subjects & Data Types

Data Subjects:

  • Visitors of the Merchant’s online store (end-users).
  • Merchant’s authorized users (admin panel access).

Categories of Personal Data Processed:

  • Technical identifiers (e.g., anonymized IP addresses, device/browser information).
  • Video interaction data (views, play time, product clicks, likes).
  • Conversion data (e.g., purchases attributed to ReelUp video interactions).
  • Shopify Customer ID and Customer Email of customers who made a order from the reelup widget, used for analytics attribution and reporting.
  • Shopify store information relevant to video content display and engagement tracking.

ReelUp LTD. does not process sensitive personal data (special categories under GDPR).

4. Sub-processors

ReelUp LTD. engages third-party sub-processors to provide hosting, analytics, and infrastructure services essential for the delivery of its services.
All sub-processors are contractually bound to data protection obligations equivalent to those outlined in this DPA.
An up-to-date list of sub-processors can be provided upon request.

5. Security Measures

ReelUp LTD. maintains appropriate technical and organizational security measures to protect personal data, including:

  • Data encryption (in transit and at rest).
  • Access controls and multi-factor authentication.
  • Continuous monitoring and logging.
  • Incident detection and response processes.
  • Regular security audits and penetration testing.

6. Data Subject Rights

ReelUp LTD. assists Merchants in fulfilling their obligations to respond to data subject requests, including:

  • Requests for access, correction, or deletion of personal data.
  • Data portability requests.
  • Objections to processing and restrictions on processing.
  • Responding to customer data inquiries in compliance with GDPR and CCPA.

7. International Data Transfers

If personal data is transferred outside the European Economic Area (EEA), ReelUp LTD. ensures appropriate safeguards are in place, such as:

  • Standard Contractual Clauses (SCCs).
  • Data hosting in regions compliant with applicable data protection laws.
  • Sub-processor agreements aligned with GDPR standards.

8. Data Retention

ReelUp LTD. retains personal data only as long as necessary to fulfill its contractual obligations or as legally required. Retention periods are aligned with:

  • The Merchant’s configurations.
  • Shopify data retention policies.
  • Legal and regulatory requirements.

9. Audit & Compliance

Upon request, ReelUp LTD. will provide documentation necessary to demonstrate compliance with this DPA.
 Merchants may conduct audits or request third-party assessments, subject to reasonable notice, frequency, and scope limitations.

International Data Transfers

Your information may be processed outside of the country where you live. For individuals in the European Economic Area (EEA), this means that your data may be transferred outside of the EEA. Regardless of where we use, process, or store your data, we will comply with the protections set out in this Privacy Policy and relevant legislation. Where we disclose personal data to a third party in another country, we endeavor to put safeguards in place to ensure your personal data remains protected such as where we have approved transfer mechanisms in place to protect your personal data – i.e., by entering into the European Commission’s Standard Contractual Clauses.

10. Liability & Indemnification

Liability arising from data processing activities under this DPA shall follow the limitations and indemnification provisions outlined in the main service agreement between ReelUp LTD. and the Merchant.

11. Data Breach Notification

In the event of a personal data breach affecting Merchant data, ReelUp LTD. will:

  • Notify the Merchant without undue delay upon becoming aware of the breach.
  • Provide details regarding the nature, scope, and impact of the breach.
  • Assist the Merchant in fulfilling any applicable data breach notification obligations.

12. Customer ID & Email Attribution (Special Clause)

ReelUp LTD. processes Shopify Customer ID and Customer Email for the exclusive purpose of providing Merchants with detailed video interaction analytics and attribution reporting. 

This includes:

  • Associating video interactions (views, clicks, conversions) with identifiable customers who are logged into the Merchant's Shopify store.
  • Enabling Merchants to track customer-level engagement with ReelUp’s shoppable video content.

ReelUp LTD. acts solely as a Data Processor for this data, handling it under strict confidentiality and in accordance with applicable data protection laws.This data is not used for independent profiling, marketing, or shared with third parties beyond sub-processors necessary for service delivery.

13. Contact Information

For questions, requests, or concerns regarding this DPA, please contact:
ReelUp LTD. 

Email: support@reelup.io

Address: 171 Shirley Road, Croydon, England, CR0 8SS

Website: https://www.reelup.io

14. Acceptance of This DPA

By using ReelUp LTD.'s services, the Merchant agrees to the terms of this Data Processing Agreement.
 This DPA becomes effective upon the Merchant’s continued use of ReelUp’s services.