Blink OneBlink One — Data Processing Addendum (DPA)
Parties. This DPA is between the merchant that installed Blink One ("Controller", "Merchant") and Noam David Elbaz, a licensed dealer (osek murshe; sole proprietor) in Israel, business ID 322313735, Ramat Motsa 30, Jerusalem, Israel ("Processor", "Blink"). It forms part of the Blink One Terms of Service (the "Agreement") and applies from 13.10.2026.
1. Definitions
"Personal Data", "Processing", "Controller", "Processor", "Data Subject", "Personal Data Breach" and "Supervisory Authority" have the meanings in Regulation (EU) 2016/679 ("GDPR"). "Israeli Law" means the Protection of Privacy Law, 5741-1981 as amended (including Amendment 13, in force since 14 August 2025) and its regulations, including the Data Security Regulations, 5777-2017, the Transfer of Data to Databases Abroad Regulations, 5761-2001 and the regulations on data transferred to Israel from the EEA, 5783-2023. "Data Protection Law" means GDPR, UK GDPR, Israeli Law and any other law applicable to the Processing. "Shopper Data" means Personal Data about the Merchant's customers or store visitors processed by Blink under the Agreement.
2. Roles and scope
2.1. For Shopper Data, the Merchant is the Controller (database controller under Israeli Law) and Blink is the Processor (holder/processor under Israeli Law).
2.2. Blink is an independent controller only for the Merchant's own account and business data, as the Privacy Policy describes; this DPA does not cover that data.
2.3. Annex 1 describes the Processing.
3. Processor obligations (GDPR art. 28(3))
Blink will:
(a) process Shopper Data only on the Merchant's documented instructions — the Agreement, the App's settings chosen by the Merchant, and Shopify's privacy webhooks — including for international transfers, unless the law requires otherwise (Blink will then inform the Merchant unless prohibited);
(b) ensure that persons authorised to process Shopper Data are bound by confidentiality;
(c) apply the security measures in Annex 2 (GDPR art. 32; Israeli Data Security Regulations at the level that applies);
(d) engage sub-processors only under section 4;
(e) assist the Merchant, by appropriate technical and organisational measures and taking into account the nature of the Processing, to respond to Data Subject requests (access, correction, deletion, objection) — in particular through Shopify's customers/data_request and customers/redact webhooks;
(f) assist the Merchant with security, breach notification, DPIAs and prior consultation (GDPR arts. 32–36), taking into account the information available to Blink;
(g) at the Merchant's choice, delete or return Shopper Data at the end of the services — uninstalling the App triggers deletion (app/uninstalled, repeated at shop/redact), save where the law requires storage;
(h) make available the information necessary to demonstrate compliance and allow audits under section 7;
(i) inform the Merchant immediately if, in its opinion, an instruction infringes Data Protection Law.
4. Sub-processors
4.1. The Merchant gives general authorisation to the sub-processors listed in the Privacy Policy (section 4): Shopify, Render Services, Inc. (hosting, Frankfurt, EU), Anthropic, PBC (AI, USA — only product/brand texts and review texts, no shopper identifiers), Meta Platforms (only if the Merchant connects; no Shopper Data sent).
4.2. Blink will give at least 14 days' notice (in the App or by email) of an added or replaced sub-processor. The Merchant may object on reasonable data-protection grounds; if no solution is found, the Merchant may stop using the affected feature or uninstall.
4.3. Blink imposes data-protection obligations on each sub-processor no less protective than this DPA and remains liable for its sub-processors.
5. International transfers
Shopper Data is hosted in the EU (Frankfurt). Where Shopper Data is transferred to a country without an adequacy decision, Blink relies on a valid transfer mechanism (EU Standard Contractual Clauses, the EU-US Data Privacy Framework where the recipient is certified, or as permitted by Israeli transfer regulations).
6. Personal Data Breach
Blink will notify the Merchant without undue delay, and where feasible within 48 hours, after becoming aware of a Personal Data Breach affecting Shopper Data, with the information reasonably available (nature, categories and approximate numbers, likely consequences, measures taken), and will update it as more becomes known.
7. Audits
Blink will answer reasonable written security questionnaires once a year and provide its current security summary. On-site audits only where required by a Supervisory Authority or after a confirmed breach, on 30 days' notice, during business hours, at the Merchant's cost, under confidentiality.
8. Merchant obligations
The Merchant warrants that it has a lawful basis and has given the notices (including in its own privacy policy and cookie banner) needed for Blink's Processing, in particular analytics consent for Blink Optimizer and notice for the cancellation form and reviews, and that its instructions comply with Data Protection Law. The Merchant also warrants that it has the right to use any third-party content it imports (for example reviews imported from a file or from a supplier's product-page link). Reviews imported from a product-page link are stored without the original buyer's name (a generic display name is used), which minimises the personal data processed for that feature.
9. Liability and precedence
Liability under this DPA is subject to the limits in the Agreement (Terms of Service s. 10: the fees paid in the 12 months before the event, no indirect or consequential loss), except where Data Protection Law forbids such limits. If this DPA conflicts with the Agreement on Shopper Data, this DPA prevails. Governing law and courts follow the Agreement (Israel, Tel Aviv-Jaffa), unless the SCCs require otherwise.
Annex 1 — Description of the Processing
| Item | Description |
|---|---|
| Subject matter and duration | Providing Blink One for the duration of the installation, plus deletion periods below |
| Nature and purpose | Storing and displaying cancellation requests; collecting and moderating product reviews; linking reviews of logged-in customers; thank-you page survey and codes; impact measurement; A/B experiments (version assignment, exposure, add-to-cart, checkout, order attribution); price-test discounts; profit analytics on order money fields |
| Data Subjects | The Merchant's customers and storefront visitors |
| Categories of data | Cancellation form: name, email, phone, order number, items, reason, last 4 digits of Israeli ID, consent time · Reviews: display name, rating, text, media, Shopify customer id (logged-in only) · Orders: order id, money fields, line items (no name/email/phone/address/IP) · Experiments: random visitor id (stored hashed), device type, version shown, funnel events, order id |
| Special categories | None intended. Merchants must not ask shoppers for special-category data in review or cancellation fields |
| Retention | Cancellation requests 24 months · pending reviews ~90 days · orders ~13 months · experiment visitors 30 days after a decision · all data deleted on uninstall and shop/redact; per-customer deletion on customers/redact |
| Location | EU (Frankfurt) — Render; US sub-processors as in section 4 |
Annex 2 — Technical and organisational measures
- TLS for all traffic; HMAC verification of Shopify webhooks; storefront endpoints only through Shopify's signed app proxy; rate limiting.
- Encryption at rest of third-party tokens (AES-256-GCM); Claude-connection secrets stored as SHA-256 hashes; experiment visitor ids stored as salted hashes; only the last 4 digits of an ID number.
- Data minimisation: Shopify protected customer data Level 1 (orders only), no name/email/phone/address fields requested; IP addresses not stored.
- Least-privilege production access limited to support needs.
- Automatic retention limits and webhook-driven deletion as in Annex 1.