PIING
Data Processing Addendum
How Piing processes data on your behalf
- Document
- Data Processing Addendum
- Clauses
- 12
- Updated
- 13 October 2026
On this page 12
- 01 Roles & Definitions
- 02 Scope of Processing
- 03 Purpose & Lawful Basis
- 04 Sub-Processors
- 05 Security Measures
- 06 Data Subject Rights
- 07 Shopify Privacy Webhooks
- 08 Breach Notification
- 09 International Transfers
- 10 Data Retention & Deletion
- 11 Audit Rights
- 12 Incorporation
On this page
Roles & Definitions
This Data Processing Addendum ("DPA") supplements the Piing Terms of Service and applies where Piing Technologies Ltd (" Piing", "Processor") processes personal data on behalf of the merchant ("Controller"). This DPA is incorporated into and forms part of the Terms of Service. Piing Technologies Ltd is registered in England and Wales under company no. 17036814. The registered office is Radley House Ground Floor, Richardshaw Road, Leeds LS28 6LE. Piing Technologies Ltd is not registered for VAT. This document is issued by Conor Stenner Jones, Director.
"Personal Data", "Processing", "Data Subject", "Controller", and "Processor" have the meanings given to them in the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR), as applicable.
Scope of Processing
Piing processes personal data solely as necessary to provide the services described in the Terms of Service. The categories of data processed include:
- Customer identifiers and contact details processed when needed to resolve a visit, issue a Wallet pass or show configured staff context
- Check-in and visit events, including timestamps, store, recognition source, device or location references, accepted visits and blocked duplicates
- Order, product and optional first-party browsing data processed from Shopify for attribution and Piing: Intelligence
- Loyalty vendor references, together with the point balance and tier read from the Controller's connected loyalty vendor
- Wishlist references read from a supported source, including Swym, Wishlist King or merchant-selected Shopify customer fields
- Wallet pass provisioning, instance and message data. Piing issues and signs Apple Wallet and Google Wallet passes with its own credentials by default, with merchant-owned issuing credentials available where configured
- Consent-gated storefront engagement events collected through a first-party pixel (for Piing: Alerts): impressions, clicks, and attributed orders. No third-party cookies are used
Data subjects are the Controller's end customers who interact with Piing services. Processing activities can include identity resolution, check-in event routing, visit-to-order attribution, AI-based profile analysis, writes to app-owned Shopify metafields, loyalty balance and tier reads, Wallet pass issuance and updates, Wallet messages, optional browser or app push, webhook delivery, Alerts engagement and analytics aggregation.
Purpose & Lawful Basis
Piing processes personal data solely for the purpose of providing the contracted services. The Controller is responsible for ensuring an appropriate lawful basis (e.g. legitimate interest, consent) exists for the processing of their customers' data through Piing services.
Sub-Processors
Piing engages the following sub-processors to deliver its services. Each is bound by a data processing agreement that imposes obligations no less protective than those in this DPA:
- Anthropic PBC (United States) provides the AI model used for AI-inferred Piing: Intelligence fields. The prompt contains product titles, variants, types, vendors, prices and order dates. Names, email addresses, postal addresses, payment details and raw customer identifiers are not included. Anthropic does not train on API inputs or outputs, and retention is short.
- Supabase provides database and backend hosting.
- Vercel (United States) hosts the Piing website and portal.
- Fly.io hosts the Piing Shopify applications.
- Resend (United States) delivers transactional email, such as a pass claim link sent at the merchant's instruction.
- Apple and Google provide Wallet. Piing issues and signs Apple Wallet and Google Wallet passes with its own credentials by default, and with merchant-owned credentials where configured. Where Piing: Alerts browser push is enabled, the shopper's browser push service delivers it, including services operated by Apple and Google. That push is not a Wallet notification.
- Shopify is the commerce platform, the source of merchant and order data, the billing channel for Shopify app subscriptions, and the sender of the mandatory privacy webhooks.
- Dot Origin processes data transmitted through its NFC reader platform for the Piing Tap Box. The scope of that processing is to be confirmed.
Where the Controller uses Retail ID, the system of record, data routes and commercial terms are defined in the implementation scope. Invoicing and payment arrangements follow the direct agreement rather than Shopify Billing.
Where the merchant connects its own tools, including a CRM, a loyalty vendor, a wishlist service, or the merchant's own OneSignal account, those providers act under the merchant's agreements. They are not Piing sub-processors. Piing: Alerts browser push does not use OneSignal.
Website tools used on piing.io, including Cookiebot, Google Analytics and Microsoft Clarity, are described in the Cookie Policy. They are not sub-processors under this DPA.
We will notify the Controller at least 14 days before engaging a new sub-processor, providing an opportunity to object. An up-to-date list is available at any time on request.
Security Measures
Piing implements appropriate technical and organisational measures to protect personal data, including:
- HTTPS for connections to Piing services
- Restricted administrative access for authorised personnel
- Merchant, store and integration scoping for operational records and requests
- Protection of sensitive credentials and stored data using the controls provided by the relevant infrastructure and platform services
- Webhook signing and request validation where supported by the destination
- Incident response procedures with defined escalation paths
- Employee security training and confidentiality obligations
Data Subject Rights
Piing will assist the Controller in responding to data subject requests (access, rectification, erasure, portability, objection) to the extent that such requests relate to data processed by Piing. Piing will notify the Controller promptly upon receiving any data subject request directly and will not respond to such requests without the Controller's authorisation, unless required by law.
Shopify Privacy Webhooks
For a merchant who installs a Piing Shopify app, Piing subscribes to Shopify's mandatory privacy webhooks. Each request is verified, logged and acted on. Piing acknowledges the request, carries out the export or deletion, and keeps an auditable record. Piing will not respond to a data subject directly without the merchant's authorisation, unless the law requires it.
Customer data request. Piing compiles what it holds for that customer so the merchant can fulfil the request. For Piing: Intelligence this includes app-owned metafields and pixel browsing data still held. The export notes that the inference path does not store raw name, email address, postal address or phone number. Where Piing holds a customer identifier or contact detail because it was needed to resolve a visit, issue a pass or show staff context, that record is included.
Customer redact. Piing removes the check-in and event records, Wallet pass instances, member links, attribution events and sync queue rows tied to that customer. Physical card records stay as the merchant's inventory, unlinked from the customer and set back to unassigned. Shopify removes that customer's app metafields.
Shop redact. About 48 hours after uninstall, Shopify sends a shop redact request. Piing then deletes the shop-tied records described under retention below.
Breach Notification
Piing will notify the Controller without undue delay (and in any event within 72 hours) upon becoming aware of a personal data breach that is likely to affect the Controller's data. The notification will include: the nature of the breach, the categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to mitigate the breach.
International Transfers
Where personal data is transferred outside the UK, Piing uses a transfer mechanism required by UK GDPR: an adequacy regulation where one applies, or the International Data Transfer Addendum issued by the UK Information Commissioner to the European Commission's Standard Contractual Clauses. Where personal data is transferred outside the EEA, Piing uses an adequacy decision or the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). A copy of the relevant transfer terms is available on request.
Data Retention & Deletion
Uninstalling a Piing Shopify app stops access immediately. Piing marks the shop uninstalled, revokes the stored access token and removes the active session. For Piing: Intelligence, analysis run records are deleted at uninstall.
About 48 hours later, the shop redact request deletes shop-tied data: check-ins and events, device, reader and store configuration, Wallet pass instances and member links, settings, mappings and audit records, the shop registry entry, pixel browsing data and analysis data. Shopify removes app-owned metafields as part of uninstall.
Piing: Intelligence also schedules deletion of any remaining shop configuration for 30 days after uninstall, unless shop redact has already removed it. Raw Piing: Intelligence pixel events follow the merchant's configured retention window. The current default is 90 days.
On termination of the agreement, including Retail ID, Piing deletes or returns personal data within 30 days, unless the law requires a longer period. Hardware the merchant has bought remains the merchant's property. Integration history and delivery logs age out on their own short windows. There is no single retention period for every record.
Audit Rights
The Controller may audit Piing's compliance with this DPA upon reasonable written notice (not more than once per year). Piing will make available all information reasonably necessary to demonstrate compliance, and will permit and contribute to audits conducted by the Controller or an independent auditor.
Incorporation
This DPA is incorporated into the Piing Terms of Service. In the event of conflict between this DPA and the Terms, this DPA shall prevail with respect to data protection matters. This DPA can be countersigned upon request for merchants who require a separately executed agreement.
DPA enquiries or countersigning requests: conor@piing.io