Data Processing Addendum
for EpicPilot Labs apps on the Shopify App Store
General terms: version 1, 21 October 2026
Annex 1 (Dingio - Telegram Order Alerts): version 1, 21 October 2026
Each app's annex has its own version. Adding an annex for another app does not change the general terms or the other annexes.
In short: some optional features of our apps put your customers' personal data, such as a name or a shipping address, into something we send for you. For that data you are the controller and we are your processor. This addendum is our agreement about it under Article 28 of the GDPR. It applies only to the features its annexes list, and only once you switch one on and accept it in the app. Our apps use that data only to do what you switched on, and do not store it.
1. Who this agreement is between, and when it applies
This Data Processing Addendum ("DPA") is between the Shopify merchant who accepts it in one of our apps ("you") and Marius Šiupšinskas, a natural person carrying out individual activity (individuali veikla) registered in Lithuania (European Union), trading as EpicPilot Labs ("we", "us").
It consists of these general terms and one annex per app. An annex describes the features of that app for which we process personal data on your behalf ("covered features"). This DPA applies to your store from the moment you accept it in the app, which the app asks you to do before you switch on a covered feature for the first time. We keep a record of when you accepted it and which versions.
This DPA forms part of the terms of service of the app concerned. It covers only the personal data an annex describes ("Customer Personal Data"). For all other data, such as your store's settings and contact details, we are the controller, as that app's privacy policy describes.
Words such as "controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meaning given in the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").
2. Roles and instructions
You are the controller of Customer Personal Data and we are your processor. We process it only on your documented instructions. Your instructions are this DPA and the settings you choose in the app: which covered features and which details you switch on, and where the app delivers them. Switching a covered feature or a detail off withdraws that instruction from then on.
If a law of the European Union or of an EU member state requires us to process Customer Personal Data in any other way, we will tell you before we do, unless that law forbids it. If we believe an instruction of yours breaks data protection law, we will tell you.
3. Your responsibilities
As the controller, you are responsible for:
- having a lawful basis to process Customer Personal Data as the covered features you switch on do, and for telling your customers about it in your store's privacy notice;
- choosing the destination the app delivers to (for example, a chat) and who has access to it;
- the data once it reaches that destination, including deleting it when you no longer need it;
- answering your customers' requests about their data, with our help as section 9 describes.
4. Confidentiality
Only people who need access to operate the app may process Customer Personal Data, and each of them is bound by confidentiality. Today that is one person: the operator of the app, Marius Šiupšinskas.
5. Security
We protect Customer Personal Data with technical and organisational measures appropriate to the risk, as Article 32 of the GDPR requires. They include:
- processing only the details you switched on, and discarding everything else as soon as it arrives;
- keeping Customer Personal Data in memory only, for as long as it takes to deliver it, and never writing it to a database, log, backup or error report;
- automated tests that fail if test customer details appear anywhere other than the message they belong in;
- encryption in transit (HTTPS/TLS) on every connection that carries it;
- access to production systems restricted to the operator;
- the ability to switch a covered feature off for every store at once, and a written procedure for security incidents.
Each annex describes the measures specific to that app.
6. Sub-processors
You give us general authorisation to use the sub-processors listed in each annex. We will tell you, through the app and/or by email, at least 30 days before we add or replace a sub-processor that processes Customer Personal Data, so you can object. If you object, you can switch the covered feature off before the change takes effect; if you do, the change never applies to your store. We bind every sub-processor to data protection obligations that are at least as protective as this DPA's, and we remain responsible to you for its work.
7. Destinations you choose
Some covered features deliver Customer Personal Data to a service that you choose and hold your own account with, such as your own Telegram bot and chat ("a destination you choose"). We deliver the data there on your instruction. A destination you choose is not our sub-processor: you choose it, you have your own agreement with its provider, and you decide who can see the data there. Once delivered, the data is held by that provider under your agreement with it, and it is your responsibility there, including any transfer outside the European Economic Area that holding it involves.
Each annex names the destinations you can choose and what you should know about each one before you switch a covered feature on.
8. Where the data is processed
We process Customer Personal Data in the European Union, on the servers each annex lists. We do not transfer it outside the European Economic Area ourselves. If a sub-processor ever needs to, we will make sure the transfer is covered by an adequacy decision or by the European Commission's standard contractual clauses, and we will tell you as section 6 describes. Delivery to a destination you choose follows section 7.
9. Help with requests and assessments
We will help you, taking into account what we process and the information we have:
- to answer your customers' requests to exercise their rights. Because the covered features do not store Customer Personal Data, we will normally be able to confirm that we hold none. If a customer contacts us directly about data we process for you, we will pass the request to you and not answer it ourselves;
- with the security of processing, personal data breach notifications, data protection impact assessments and prior consultations with a supervisory authority, as Articles 32 to 36 of the GDPR describe.
10. Personal data breaches
If we become aware of a personal data breach affecting Customer Personal Data, we will tell you without undue delay, and in any case within 48 hours. We will tell you what we know: what happened, which data and roughly how many of your customers are affected, the likely consequences, and what we have done or propose to do about it. Where we can't give all of this at once, we will give it in stages as we learn more. We keep a written record of every such breach.
11. Deletion at the end
The covered features do not keep Customer Personal Data after delivering it, so when you switch a covered feature off or uninstall the app, there is nothing to return. If a fault on our side ever left Customer Personal Data in our systems, we would delete it, unless a law of the European Union or an EU member state requires us to keep it.
You must not send us your customers' personal data, for example in support emails, Telegram messages or screenshots of your alerts. If you do, that is your decision: we use it only to answer your request, and keep and delete it together with the support conversation it is in. Support emails between you and us are kept until 2 years after your last email to us, and then deleted automatically, unless the law requires us to keep a particular email longer, for example because it is an invoice. Our Telegram conversations with you stay in Telegram until you or we delete them; you can delete a conversation for both sides at any time.
12. Information and audits
We will give you the information you reasonably need to show that this DPA is being met. Send your questions to the contact address in section 17 and we will answer in writing. If written answers are not enough, or if a supervisory authority requires it, you or an independent auditor you appoint, bound by confidentiality, may audit our compliance with this DPA, with at least 30 days' notice, at your own cost, and no more than once a year unless there has been a personal data breach affecting your store.
13. US state privacy laws
Where the California Consumer Privacy Act or a similar US state privacy law applies, we are your service provider (or processor) for Customer Personal Data. We do not sell or share it, and we do not keep, use or disclose it for any purpose other than providing the covered features to you, or outside our direct business relationship with you. We do not combine it with personal data we receive from anyone else.
14. Liability
The limitation of liability in the terms of service of the app concerned applies to this DPA, to the extent the law allows. Nothing in this DPA limits either party's liability to data subjects under Article 82 of the GDPR, or any liability that cannot lawfully be limited.
15. How long this DPA lasts
This DPA applies from the moment you accept it until you have switched off every covered feature of that app or uninstalled the app, and in any case for as long as we process Customer Personal Data for you. If you switch a covered feature on again later, the version of this DPA in force at that time applies, and the app asks you to accept it again if it has changed.
16. Changes, and which document applies
We may update these general terms or an annex. We will give at least 30 days' notice, through the app and/or by email, to the stores that have a covered feature switched on, before a change that affects your rights takes effect. You can switch the covered feature off before then. A change that only adds to our obligations or corrects a mistake may take effect at once. Adding an annex for another app does not change anything for the stores that use the apps already covered.
For Customer Personal Data, this DPA prevails over the terms of service and the privacy policy of the app concerned where they differ. This DPA is governed by the laws of the Republic of Lithuania.
17. Contact
Marius Šiupšinskas, trading as EpicPilot Labs
Individual activity (individuali veikla) registered in Lithuania
Lithuania, European Union
Email: support@epicpilotlabs.com, or the support address of the app concerned (for Dingio, dingio@epicpilotlabs.com)
Annex 1: Dingio - Telegram Order Alerts
Version 1, 21 October 2026. Read together with Dingio's privacy policy (section 2a) and terms of service.
| Item | Details |
|---|---|
| Covered feature | Customer details in alerts, on the plans that include it (Pro and Business). Off until you switch it on, and each detail is switched on separately. Also the order note, in your own custom templates (Pro and Business), when the App offers it and you add it to a template. |
| Subject matter and nature | When Shopify notifies Dingio of a new or cancelled order, Dingio copies the customer details you switched on from the notification, puts them into your alert message in memory, and sends the message to your Telegram chat through the bot you created. The details appear in new order and cancelled order alerts that use the Detailed style, and in your own custom templates where you add them. They never appear in the Standard, Compact or Items list styles, or in low-stock alerts. If you add the order note to a custom template, Dingio copies it from the notification in the same way and puts it into that alert. |
| Purpose | So that you and your staff can pack, label and deliver orders, and contact the customer about delivery, from the alert; and, for the billing address, so that you can check payment and invoicing details, for example when the billing address differs from the shipping address; and, for the order note, so that you and your staff can follow the customer's instructions for the order, such as delivery instructions. |
| Duration | For each alert, only for as long as it takes to send it: usually a second or two, and up to a few minutes if Telegram asks Dingio to slow down. For as long as you have a detail switched on, or the order note in a custom template. |
| Data subjects | Your customers, and the people they ship orders to (the shipping address can belong to someone other than the buyer, and the billing address to someone other than the recipient). |
| Personal data | Only the details you switched on: name (the customer's name from the order: the name on the shipping address or, if the order has no shipping address, the name on the billing address, or else the customer's name); addresses, one option covering both the shipping address and the billing address (address lines, city, region, postal code and country; not their geolocation); phone (the phone number on the shipping address or, if it has none, the order's phone number, or else the phone number on the billing address). Order note, if you add it to a custom template: the text your customer wrote in the order's note at checkout, which may contain any personal data they chose to write there. Never the customer's email address, the IP address or payment details. |
| Special categories of data | None intended. The order note is free text your customer writes, so it may contain special categories of data if the customer writes them there; Dingio does not read or filter what it says. Dingio does not process the details your customers enter for an item at checkout. |
| What Dingio stores | No Customer Personal Data. Dingio stores only which details you switched on, and when you accepted which versions of this DPA. These are part of your store's settings and are deleted with them after you uninstall. |
| Sub-processors | Fly.io, Inc.: application hosting. Dingio's servers run in Frankfurt, Germany (EU), and alerts are put together in their memory. No other sub-processor receives Customer Personal Data: Dingio's database host (Neon) never receives it, because Dingio does not store it. |
| Destination you choose (section 7) | Telegram: the bot you created under Telegram's terms and the chat you connected. Before you switch the feature on, please note that Telegram may store messages outside the European Economic Area, that Telegram offers no data processing agreement or standard contractual clauses for bots, that chats with bots are not end-to-end encrypted, that everyone in the chat can see every alert, and that messages stay in the chat until someone deletes them. Dingio does not keep the IDs of the messages it sends, so it cannot delete them for you. |
| Measures specific to Dingio | Customer details are copied only for the details your store switched on (the order note only when your custom template contains it), at the point where the order notification arrives; for other stores they are discarded there. They never appear in the standard message Dingio sends when your own message can't be built, in test messages (which use a made-up customer), in Recent alerts, in error reports or in notifications to the operator. Error reports sent to the operator have phone numbers removed. Just before each alert is sent, Dingio checks again that your store has the detail switched on (or, for the order note, a template that contains it), has accepted this DPA and is on a plan that includes the feature; if any of these is missing, the details are left out of that alert, whatever its template contains. |