Landed Data Processing Addendum

Last updated: 27 October 2026

This Data Processing Addendum ("DPA") forms part of the agreement between the merchant who installs the Landed: Profit Tracker & COGS app and AHMAD MIBAYYAD IT SERVICES CO. L.L.C. It reflects the requirements of Article 28 of the General Data Protection Regulation (GDPR).

1. Parties and roles

• The Controller is the merchant who installs and uses Landed.
• The Processor is AHMAD MIBAYYAD IT SERVICES CO. L.L.C, licence number 1098855, issued by Dubai Economy (Department of Economy and Tourism), Dubai, of Office J63, Al Murar, P.O. Box 123, Dubai, United Arab Emirates.

The Processor processes personal data only on behalf of the Controller, as described in this DPA. Privacy contact: support@adspypro.net.

2. Subject matter, duration, nature and purpose

• Subject matter: providing the Landed app, which calculates profit and costs for the Controller's Shopify store.
• Duration: from installation until the Controller uninstalls the app and the data is deleted under section 10.
• Nature: storing, retrieving, calculating on and displaying data, and emailing the Controller's chosen recipients.
• Purpose: to provide the services the Controller requests through the app.

3. Categories of data and data subjects

The app stores no customer personal data. Orders are stored without customer names, emails, phone numbers or addresses.

• Data subjects: the Controller's staff and the people the Controller lists as email recipients.
• Personal data: the shop's contact email address and the email recipients the Controller enters. Other stored data (orders without customer data, product costs, cost settings, Meta ad spend, plan state, the daily email log) is business data about the shop and is not personal data about individuals.

4. Instructions

The Processor processes personal data only on the Controller's documented instructions, which are this DPA and the Controller's use and configuration of the app. If the Processor believes an instruction breaks data protection law, it will tell the Controller.

5. Confidentiality

The Processor makes sure that people authorised to process the personal data are bound by confidentiality obligations.

6. Security measures (Annex 1)

The Processor applies appropriate technical and organisational measures, including:

• Data in transit is encrypted with TLS: database connections require TLS, and calls to Resend, Meta and Shopify use HTTPS.
• Each shop's data is stored and queried separately, by shop ID.
• The Meta access token is encrypted at rest with AES-256-GCM.
• Shopify webhooks are verified by their HMAC signature before they are processed.
• API keys and secrets are kept in environment variables, not in code.

7. Sub-processors (Annex 2)

The Controller gives general authorisation to the following sub-processors:

• Neon: Postgres database hosting, EU region (eu-central-1).
• Resend: transactional email.
• Meta Platforms: Marketing API, read-only ad spend.
• Fly.io: application hosting, servers in Frankfurt, Germany.

The Processor will tell the Controller before adding or replacing a sub-processor, through the app or by email, so the Controller can object. The Processor imposes data protection obligations on each sub-processor that are no less protective than this DPA.

8. Assistance

Taking into account the nature of the processing, the Processor will help the Controller respond to data-subject requests and meet its obligations on security, breach notification, impact assessments and consultation with authorities, as far as the Processor holds relevant data. Requests can be sent to support@adspypro.net.

9. Personal data breach

The Processor will notify the Controller of a personal data breach without undue delay and in any case within 48 hours of becoming aware of it, with the information it then has: what happened, the data affected, likely consequences and the measures taken or proposed.

10. Deletion or return

When the Controller uninstalls the app, Shopify sends a `shop/redact` notice 48 hours later and the Processor then deletes all of that shop's data. The Controller can also ask for deletion at any time by emailing support@adspypro.net.

11. Audits

The Processor will give the Controller the information needed to show compliance with this DPA and will allow and contribute to audits, including inspections, by the Controller or an auditor the Controller appoints, on reasonable notice and during normal business hours.

12. International transfers

The Processor is based in the United Arab Emirates, and the EU has no adequacy decision for the UAE. Transfers of personal data from the EU to the Processor are therefore made under the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (controller to processor), which are incorporated into this DPA by reference. For those clauses: the Controller is the data exporter and the Processor is the data importer; the details in sections 2 to 7 serve as the annexes; and the competent supervisory authority and governing law are those of the EU Member State in which the Controller is established.

Some sub-processors are based in the United States: Resend (email delivery), Meta Platforms (ad spend) and the hosting provider, Fly.io. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses.

13. Liability and term

This DPA applies from the moment the Controller accepts the app terms by installing Landed, and its liability terms are those of the app terms, by reference. It stays in force for as long as the Processor processes personal data for the Controller.