1. Parties and scope
This DPA forms part of the CartYatra Terms of Service between the merchant (“Controller”) and [COMPANY LEGAL NAME] (“Processor”). It applies to personal data that CartYatra processes about visitors to the Controller's Shopify store.
2. Details of processing
| Subject matter | Analytics of store visitor journeys |
|---|---|
| Duration | While CartYatra is installed, plus the deletion period |
| Data subjects | Visitors to the Controller's online store |
| Data categories | Pseudonymous browser ID, pages and products viewed, cart and checkout progress, order ID and value, device type, campaign tags, approximate location |
| Special categories | None |
3. Processor obligations
- Process personal data only on documented instructions from the Controller (including via the app's settings)
- Ensure people authorised to process data are bound by confidentiality
- Implement appropriate technical and organisational measures (Annex: encryption, access control, isolation, logging, backups)
- Assist the Controller with data subject requests and data protection impact assessments
- Notify the Controller without undue delay after becoming aware of a personal data breach
- Delete or return personal data at the end of the service, unless law requires storage
- Make available information needed to demonstrate compliance and allow reasonable audits
4. Sub-processors
The Controller authorises the sub-processors listed on our sub-processors page. We will give at least 30 days' notice of new sub-processors on that page, and the Controller may object on reasonable grounds.
5. International transfers
Transfers outside the EEA/UK use the Standard Contractual Clauses (Module 2 or 3 as applicable) and the UK Addendum, which are incorporated by reference, or another valid transfer mechanism.
6. US state privacy laws
For the CCPA/CPRA and similar laws, CartYatra acts as a service provider/processor, will not sell or share personal information, and will not use it outside the business purpose of providing the service.
7. Contact
Privacy contact: privacy@cartyatra.com. To receive a countersigned copy, email us with your store domain and legal entity name.