Fulfillment Invoice Control

Data Processing Agreement

Version 1.2 · Effective 12 October 2026 · Between Orumio and the merchant

1. Parties and definitions

“Processor”, “we”, “us”: Orumio, represented by Masanori Iwata, Mitsuhashi Building 3F, 1-3-3 Kita-Aoyama, Minato-ku, Tokyo 107-0061, Japan, contact support@orumio.com.

“Controller”, “you”, “Merchant”: the operator of the Shopify store in which the app is installed.

“App”: Fulfillment Invoice Control. “Personal Data”, “Processing”, “Data Subject”, “Personal Data Breach” and “Supervisory Authority” have the meanings given in the GDPR. “Data Protection Law” means every privacy or data protection law applicable to the Processing under this DPA, including the EU GDPR, the UK GDPR, Japan’s Act on the Protection of Personal Information (APPI), and the US state privacy laws addressed in Annex IV. “Merchant Commercial Data” means the non-personal business data the App processes for you — your ShipBob invoices, charges and fee schedules, your confirmed expected rates, and the reconciliation results computed from them.

2. Roles and scope

You are the Controller of the data in your Shopify store and in your ShipBob account. We are your Processor, and we process that data only to provide the App to you.

Shopify and ShipBob are independent parties to this DPA. Your relationships with them — including their own roles in respect of your data on their platforms — are governed by your agreements with them, not by this document. The App accesses your ShipBob account as your authorised integration, under credentials you grant it through ShipBob’s own consent flow, and you may revoke that access at any time in either the App or your ShipBob dashboard.

This DPA applies for as long as the App is installed in your store and survives uninstallation for as long as we hold any of your data.

3. Instructions

We process data only on your documented instructions, including in respect of transfers to a third country. Your instructions are: (a) this DPA, including Annex I; (b) the App’s documented functionality, which you direct by connecting your accounts, confirming rates and running audits; and (c) any further written instruction you give us that we accept.

We will tell you if, in our opinion, an instruction infringes Data Protection Law. We will not process your data for our own purposes — specifically not for marketing, advertising, profiling, resale, cross-merchant benchmarking, or the training of machine-learning models.

If we are required by law to process data beyond your instructions, we will inform you of that legal requirement before processing, unless the law forbids us from doing so on important grounds of public interest.

4. Confidentiality

The App is operated by a single person, who is bound by a duty of confidentiality in respect of all data processed under this DPA. There are no staff accounts, contractors, or support agents with access to Merchant data. If that ever changes, we will ensure that any person authorised to process your data is placed under an equivalent obligation of confidentiality before access is granted.

Merchant Commercial Data is confidential business information even where it is not Personal Data. We apply the measures in Annex II to it in full, and we do not disclose it, aggregate it across merchants, or use it for any purpose other than providing the App to you.

5. Security

We implement and maintain the technical and organisational measures set out in Annex II, which are appropriate to the risk, having regard to the state of the art, the costs of implementation, and the nature, scope, context and purposes of the Processing.

The primary measure is minimisation: the App does not store Personal Data at all — customer identity fields are never requested from Shopify, and fulfillment recipient details are never persisted from ShipBob. We may update the measures in Annex II over time, but we will not reduce the overall level of security.

6. Sub-processors

You give us general written authorisation to engage sub-processors. The sub-processors engaged as at the effective date of this DPA are listed in Annex III.

Before we add or replace a sub-processor we will update Annex III and announce the change to installed merchants at least 30 days in advance. You may object on reasonable data protection grounds within that period; if we cannot resolve your objection, you may terminate by uninstalling the App, and we will delete your data in accordance with §10.

We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain fully liable to you for each sub-processor’s performance.

7. Assistance with data subject rights

Because the App stores no Personal Data, requests to access, rectify, erase, restrict, port, or object usually require no action from us — the data lives in Shopify and ShipBob, under your control.

Where a Data Subject nonetheless contacts us directly, we will not respond substantively ourselves. We will refer them to you, and tell you promptly. Taking account of the nature of the Processing, we will assist you by appropriate technical and organisational measures, so far as possible, in fulfilling your obligation to respond.

We honour the Shopify mandatory compliance webhooks: customers/data_request (we return nothing, because we hold nothing customer-keyed), customers/redact (no action required, for the same reason), and shop/redact (we delete your entire tenant, per §10).

8. Personal data breach

We will notify you of a Personal Data Breach affecting your data without undue delay after becoming aware of it, and in any event targeting within 72 hours of confirming it. The notification will describe, so far as it is known at the time: the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. Where the information cannot be provided at once, we will provide it in phases without further undue delay rather than waiting for a complete root-cause analysis. We apply the same notification commitment to incidents affecting Merchant Commercial Data or your platform credentials.

We maintain a written security incident response policy covering detection, containment, assessment, notification, remediation and post-incident review, and we review it after every significant incident.

9. Data protection impact assessments

Taking into account the nature of the Processing and the information available to us, we will provide reasonable assistance with your data protection impact assessments and any prior consultation with a Supervisory Authority.

10. Deletion and return

Because no Personal Data is retained, there is nothing of that kind to return or delete at the end of the relationship. For the data we do hold:

• On uninstallation, we immediately delete the stored Shopify session credentials and destroy the stored ShipBob token pair, so no further Processing can occur. Disconnecting ShipBob inside the App destroys those tokens the same way at any time.
• On receipt of Shopify’s shop/redact request (approximately 48 hours after uninstallation), we delete your installation and everything attached to it — invoices, charges, operational facts, attributions, rates and their version history, audit runs, findings and their evidence, subscription records and the audit trail. If you reinstalled before it arrived, your data is retained — it is in active use again.
• As a backstop against a lost webhook, the App deletes any installation that has been uninstalled for more than 30 days, with the same cascade.
• You may request earlier deletion at any time by writing to support@orumio.com.

Operational logs contain identifiers, classifications, counts and timestamps only, and no Personal Data; they expire on our hosting provider’s ordinary schedule.

11. Audits and information

We will make available to you all information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.

In the first instance we will respond to a reasonable written request with our data protection policy, our incident response policy, and a written description of the measures in Annex II. An on-site inspection may be requested where that is not sufficient, on reasonable notice, no more than once in any twelve-month period except following a Personal Data Breach, and subject to confidentiality.

12. International transfers

We are established in Japan, and the App’s database and application servers are located primarily in the United States (the database is placed with a North-American location hint); requests are served from our hosting provider’s global network (Annex III).

Where Personal Data protected by the EU GDPR is transferred to a country without an adequacy decision, the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914), Module Two (controller to processor) are incorporated into this DPA by reference and take precedence over it in the event of conflict. For the purposes of those Clauses: you are the data exporter and we are the data importer; the optional docking clause applies; the general authorisation for sub-processors in §6 applies with 30 days’ notice; the governing law is that of Ireland; disputes are resolved in the courts of Ireland; and Annexes I, II and III below serve as Annexes I, II and III to the Clauses.

Where Personal Data protected by the UK GDPR is transferred, the UK International Data Transfer Addendum to the EU SCCs (version B1.0) is incorporated by reference, with the information in Annexes I–III below completing its Tables.

Japan has received an adequacy decision from the European Commission, and the United Kingdom has made an equivalent finding.

13. Japan (APPI)

Where Japan’s Act on the Protection of Personal Information applies, we act as a party entrusted with the handling of personal data (委託先) under Article 27(5)(i), and you retain the supervisory obligation under Article 25. The measures in Annex II are the measures we take for that purpose, and §12 records the locations of the servers on which the data is held.

14. Term, precedence and liability

This DPA takes effect when you install the App and continues until we hold no data of yours. Where it conflicts with any other agreement between us, this DPA prevails on data protection matters; where it conflicts with the Standard Contractual Clauses, those Clauses prevail.

Nothing in this DPA limits either party’s liability to a Data Subject or to a Supervisory Authority under Data Protection Law.

15. Governing law

This DPA is governed by the laws of Japan, and the Tokyo District Court has exclusive jurisdiction as the court of first instance over any dispute arising from it. §12 governs the law and forum applicable to the Standard Contractual Clauses themselves.

Annex I — Details of the processing

A. Parties

Data exporter / Controller: the Merchant, being the operator of the Shopify store in which the App is installed. Contact details are those held in the Merchant’s Shopify account. Role: controller.

Data importer / Processor: Orumio, represented by Masanori Iwata, Mitsuhashi Building 3F, 1-3-3 Kita-Aoyama, Minato-ku, Tokyo 107-0061, Japan, contact support@orumio.com. Activities: providing the Fulfillment Invoice Control application. Role: processor.

B. Description of the processing

C. Competent supervisory authority

The supervisory authority of the EU/EEA Member State in which the Merchant, as data exporter, is established; or, where the Merchant is not established in the EU/EEA but is subject to the GDPR under Article 3(2), the supervisory authority of the Member State in which the Merchant’s Article 27 representative is established.

Annex II — Technical and organisational measures

These are the measures actually implemented in the App, in order of how much risk each removes.

1. Data minimisation as the primary control. Personal Data is never written to the database. Customer identity fields are not requested from Shopify at all, and ShipBob recipient details are extracted out before persistence. Data that was never stored cannot be exfiltrated from storage, exposed in a backup, or disclosed by a database compromise.
2. Encryption in transit. The App is served exclusively over HTTPS/TLS, and all connections to Shopify and ShipBob use TLS. The database is reached through a binding internal to the hosting provider (Annex III) rather than a network connection: no database endpoint, credential or connection string exists to be exposed.
3. Encryption at rest. The hosting provider (Annex III) encrypts all data and its point-in-time history at rest (provider-managed). No self-managed backup, export or snapshot pipeline exists, so no unencrypted copy of the database exists anywhere.
4. Application-layer encryption of provider credentials. ShipBob access and refresh tokens are encrypted with AES-256-GCM before they reach the database, cryptographically bound to the installation and connection they belong to, so a record lifted into another tenant fails to decrypt. Shopify access tokens are short-lived (~60 minutes) and rotated automatically.
5. Tenant isolation. Row-level tenancy: every record is keyed to the installation and every query filters through it, verified by automated cross-tenant tests covering reads, writes, background jobs and credential access.
6. Bounded egress. Server-side, the App communicates with the Shopify Admin API, the Shopify Partner API (subscription status only), and the ShipBob API — nothing else. There is no analytics SDK, no error-reporting service receiving payloads, no email service, and no third-party script in the server path.
7. Log hygiene. Logs and metrics record identifiers, classifications, counts and timestamps only. Token material and raw payloads are excluded by rule; credential columns are structurally excluded from interface-path database reads.
8. Endpoint authorisation. Merchant routes require an authenticated Shopify admin session and an active entitlement; webhook routes reject unauthenticated requests with 401; the ShipBob connection flow requires a single-use, HMAC-signed, expiring connect token.
9. Client exposure boundary. Credentials never leave the server. Route loaders return only the fields the interface renders; raw platform responses are never shipped to the browser.
10. Deterministic, immutable audit results. Historic findings are immutable and reproducible; money is handled in exact integer arithmetic. Integrity of the reconciliation output is treated as a security property.
11. Separation of test and production data. Production and development use separate databases. Production credentials exist only in the hosting provider’s environment configuration and are never written to a developer machine or to source control.
12. Access control. Single operator; no staff accounts, contractors or support agents. Every account in scope is protected by two-factor authentication and a unique password generated and stored in a password manager. Access is reviewed whenever the operator set changes.
13. Governance. A written data protection policy and a written security incident response policy are maintained and reviewed at each release gate and after every significant incident.

Annex III — Sub-processors

Shopify and ShipBob are not listed as sub-processors: they are the platforms your store and fulfillment run on and the sources from which we read, under your own separate agreements with them.

Annex IV — United States state privacy laws

Where the California Consumer Privacy Act as amended (CCPA/CPRA) or a comparable US state privacy law applies, we act as a service provider (or processor, where that is the statutory term) and:

• we do not sell or share personal information, as those terms are defined in the CCPA, and we receive no consideration for it;
• we do not retain, use, or disclose personal information for any purpose other than the business purposes specified in this DPA, including not for our own commercial purposes;
• we do not combine personal information received from you with personal information received from any other source, except as permitted by the CCPA;
• we will notify you if we determine we can no longer meet these obligations;
• you may take reasonable and appropriate steps to stop and remediate any unauthorised use of personal information.

The App performs no cross-context behavioural advertising, no profiling, and no automated decision-making producing legal or similarly significant effects.

Fulfillment Invoice Control · Version 1.2, 12 October 2026 · Privacy Policy
Fulfillment Invoice Control is an independent product of Orumio and is not affiliated with, endorsed by, or sponsored by ShipBob, Inc. or Shopify Inc.