Tagwright data processing agreement

Last updated: 15 October 2026

This agreement is not finished: some details below are still missing.

This agreement is part of the Tagwright terms of service between you, the merchant who installs Tagwright, and [not set: PRIVACY_BUSINESS_NAME], trading as Tagwright, a natural person carrying on individual activity in Lithuania, [not set: PRIVACY_BUSINESS_ADDRESS], registered in the Register of Taxpayers of the State Tax Inspectorate (Valstybinė mokesčių inspekcija) under individual activity certificate No. [not set: PRIVACY_BUSINESS_REGISTRATION] (“we”). It covers personal data that Tagwright processes for you: you are the controller of that personal data, and [not set: PRIVACY_BUSINESS_NAME] is your processor. It is the contract Article 28 of the EU General Data Protection Regulation (GDPR) requires between you and us; because we are established in Lithuania, the GDPR applies to our processing wherever your store is. Where the UK GDPR or the Swiss Federal Act on Data Protection also applies, this agreement is also the one they require of a processor. On personal data, this agreement takes precedence over the terms.

You accept this agreement, in electronic form, with the terms, by installing or using Tagwright. We keep a record of every notice of change we send to stores.

You are responsible for having a lawful basis for the personal data you have us process, for telling your customers about it, and for your instructions to us.

What we process

• Purpose: providing Tagwright’s features to your store: making labels, adding orders to your print list without counting an order twice, and answering Shopify’s requests about your customers’ data.
• Nature: reading your orders from Shopify; storing, showing and deleting the personal data listed here; and sending you answers about a customer’s data by email.
• Personal data: the Shopify ids and numbers (such as #1001) of the orders you add to your print list, which relate to your customers; of Shopify’s requests about a customer’s data, Shopify’s id for the request, when it came, and which of the orders it names are on your print list; and any personal data you type into a label note, a template name or a label size name.
• Read but not kept: your recent open orders, while you use Tagwright, to list them for you to add from: their name, date, fulfilment status and items, and nothing about the customer.
• People concerned: your customers, and anyone whose details you type into a label note, a template name or a label size name.
• Duration: while Tagwright is installed in your store, and until the data is deleted as described below.

The problems and ideas you send us are not covered by this agreement: we use them for our own purposes, as the privacy policy explains.

Our duties

• We process the personal data only on your documented instructions: these terms, this agreement, and what you do in the app, including where the data is sent. If EU or EU member state law (or, for UK or Swiss data, UK or Swiss law) requires anything else of us, we tell you first, unless that law forbids it on important grounds of public interest. If we think an instruction breaks data protection law, we tell you straight away, and we do not carry it out until it is settled.
• Everyone who can access the personal data is committed to confidentiality.
• We take the security measures Article 32 of the GDPR requires, including at least those described below. We review them regularly. We may add to them; we never make them weaker without telling you as for a change to this agreement.
• We help you answer people who use their data protection rights. When Shopify asks us to erase a customer’s data, Tagwright deletes the numbers of that customer’s orders; when Shopify asks what we keep about a customer, we tell you without undue delay, and within 14 days at the latest, which of their orders are on your print list, if any are. For anything else, write to us.
• As far as our part allows, we help you with the security of the processing, personal data breaches, data protection impact assessments, and consultations with a supervisory authority.
• We tell you without undue delay after we become aware of a personal data breach that affects your data, by email to your store’s email address in Shopify. We say what happened, which kinds of data and roughly how many people and records it concerns, its likely consequences, what we have done and will do about it, and whom to contact. If we do not know everything yet, we send what we know, and the rest as soon as we learn it.
• We give you the information you need to show that this agreement is kept. You, or an auditor you choose who is bound to confidentiality, may also check it, at most once a year and with 30 days’ notice, unless there are signs that we do not keep this agreement, a breach has happened, or a supervisory authority requires a check sooner. We first give you documents and answers that may make an inspection unnecessary; you decide whether you still want one. You bear the costs of an inspection, including our reasonable costs, unless it shows that we materially broke this agreement.

Sub-processors

You authorise us to use the sub-processors below. We bind each of them, by a written contract, to the same data protection obligations as this agreement sets for us, in substance, including sufficient guarantees of security, and we remain fully liable to you for their work as for our own.

• Hetzner Online GmbH: hosts Tagwright, its database and its backups, in Germany, in the European Union.
• Hetzner Online GmbH: carries our emails with you, such as answers about a customer’s data, and keeps them in our mailbox until we delete them as the privacy policy says under “Email”. It may process them outside the European Economic Area, in [not set: PRIVACY_EMAIL_COUNTRIES]; the transfer relies on the Standard Contractual Clauses in its data processing agreement.
• Sentry (Functional Software, Inc.), while we have error reporting turned on: receives a report when something goes wrong in the app. The reports are stored in the European Union, and Sentry may also process them in the United States. The transfer relies on the EU–U.S. Data Privacy Framework with its UK Extension and the Swiss–U.S. Data Privacy Framework, and on the Standard Contractual Clauses (with the UK Addendum, and adapted to Swiss law for Swiss data) where the frameworks do not apply. Sentry’s own sub-processors are listed at sentry.io/legal/subprocessors.

Each of our sub-processors lists its own sub-processors. We tell you about a new or replaced sub-processor of ours, or our moving the data to a new country, at least 30 days before it starts, by email to your store’s email address in Shopify, and list it on this page when it starts. If you object, email us before the change starts: we answer within 14 days, and before the change starts. If we cannot meet your objection, you may end the agreement by uninstalling Tagwright before the change starts; your data is then deleted as “When the agreement ends” describes.

Where a sub-processor processes the personal data outside the European Economic Area, the UK or Switzerland, the transfer relies on an adequacy decision (such as the EU–U.S. Data Privacy Framework) or on the Standard Contractual Clauses; for UK data, on the UK’s adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to those clauses; for Swiss data, on the Swiss Federal Council’s adequacy decisions or those clauses adapted to Swiss law. Shopify is not our sub-processor: it is the platform your store runs on, under your own agreement with Shopify.

Sending the data to you outside Europe

When your store is outside the European Economic Area, our showing you the personal data in Tagwright, or sending it to you by email, is a transfer out of the European Economic Area under the GDPR. If the European Commission has decided that your country protects personal data adequately (for example the UK, Switzerland or Canada), that decision covers it. Otherwise, the Standard Contractual Clauses for transfers from a processor to a controller (Module Four of the clauses adopted by Commission Implementing Decision (EU) 2021/914, https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj) apply between you, as the data importer, and us, as the data exporter, and are part of this agreement.

In those Clauses, the optional Clause 7 and the option in Clause 11 do not apply; they are governed by Lithuanian law (Clause 17), and disputes about them are decided by the courts of Lithuania (Clause 18). Annex I is completed by the parties named above and by “What we process”; the transfer is continuous while Tagwright is installed. Where the Clauses conflict with this agreement or the terms, including their limits of liability, the Clauses prevail. When the European Commission adopts clauses for importers that are themselves subject to the GDPR, those apply instead where they fit.

Security

• Information the app sends or receives over the internet always uses encrypted connections (HTTPS), and so do our backups on their way to separate storage (SSH).
• Shops’ Shopify access tokens, and the ids and numbers of the orders Tagwright keeps, are stored encrypted.
• The database cannot be reached from the internet: only the app, our backup and restore scripts, and we ourselves, all on the same server, connect to it.
• Each store sees only its own data. Only our own store, which only we use, can open the page that lists the problems and ideas stores send us and Shopify’s requests about customers’ data.
• The database is backed up every night to separate storage, encrypted: the key that opens the backups is locked with a passphrase that is never stored on the server. We test restoring the backups.
• Access to our systems is limited to what is needed to run the app.

When the agreement ends

You choose whether we return or delete the personal data we process for you. To get it back, before you uninstall Tagwright, download your data on its “Your data” page, or email us and keep Tagwright installed until we have sent you a file of it (within 30 days). Once you uninstall, we delete it as described below, and it cannot be returned.

When you uninstall Tagwright, we delete your store’s access tokens straight away. Shopify asks us to delete your store’s data 48 hours later, and we then delete all of it from our database. Anything we delete is gone from our backups within 30 days: of your uninstalling Tagwright, of the request to delete it, or otherwise of when we deleted it. Our server logs, which can name your store, are deleted automatically after 30 days at the latest. Our emails with you are deleted at the latest 21 days after they were sent or received, unless EU or Lithuanian law requires us to keep them, or we need them to establish or defend a legal claim between you and us (this agreement then still covers them, and we use them only for that purpose); our email provider keeps deleted email in its backups for the time its own terms set. When you ask, we confirm in writing that the deletion is done.

Liability

Between you and us, liability under this agreement is subject to the limits in the terms of service, as far as the law allows. Those limits never reduce what a person whose data it is can claim from either of us under data protection law, such as Article 82 of the GDPR.

Changes to this agreement

If we change this agreement, we update this page and the date at the top, and tell you about every change, other than corrections of spelling or layout, by email to your store’s email address in Shopify before it applies, and at least 30 days before a change that reduces the protection of your personal data, unless the law requires it sooner. If you do not agree, you may end the agreement by uninstalling Tagwright before the change applies; if you keep using Tagwright after it applies, the changed agreement applies to you.

Contact

Questions about this agreement or about personal data: support@countinghouseapps.com, or our contact form.