Comuna Correcta Data Processing Agreement (DPA)

Last updated: October 16, 2026

This is an English translation provided for convenience. If it differs from the Spanish version, the Spanish version prevails.

Parties. The store that installs Comuna Correcta ("the Store"), as controller of its buyers' data, and Joel Suazo Integrasoft Consulting EIRL, Chilean tax ID (RUT) 77.212.314-0 ("ISC"), as processor.

Term. From the moment the Store installs the app until ISC finishes deleting its data under clause 10. This agreement is part of the Comuna Correcta Terms of Service.

1. Subject matter

ISC processes personal data of the Store's buyers only to validate and correct the shipping address of its orders, as described in Annex A.

2. Instructions

ISC processes the data only on the Store's documented instructions. Installing the app, its settings (comuna field, active rules) and this agreement are those instructions. If ISC believes an instruction infringes the law, it informs the Store and does not carry it out.

3. Confidentiality

Only the ISC personnel who need the data to operate the app have access to it, and all of them are bound by confidentiality.

4. Security

ISC applies the measures in Annex B and keeps them at the level required by law and by Shopify's protected customer data requirements.

5. Sub-processors

The Store authorizes ISC to use the sub-processors in Annex C. ISC notifies the Store at least 30 days before adding or replacing one. If the Store objects, it may uninstall the app, which ends this agreement. ISC imposes on each sub-processor data protection obligations equivalent to those in this agreement and remains liable for them.

6. International transfers

The sub-processors in Annex C are outside Chile. ISC transfers the data with the safeguards required by Chilean law, including data protection contractual clauses with each sub-processor. Buyer addresses are not stored in any country: they only pass through the app server's memory.

7. Data subject rights

ISC helps the Store respond to requests for access, rectification, deletion, objection and portability. Requests that Shopify sends as compliance webhooks (customers/data_request, customers/redact) are handled automatically or within 30 days. If a buyer writes to ISC directly, ISC forwards the request to the Store without answering it on its own.

8. Security breaches

ISC notifies the Store without undue delay after confirming a breach affecting its data, and no later than 48 hours after confirming it. The notice states what happened, which data and how many orders were affected, what measures were taken and whom to contact. ISC helps the Store notify the authority and buyers when required. The internal procedure is set out in ISC's incident response plan.

9. Assistance to the controller

ISC provides the Store with the information it needs for impact assessments or consultations with the authority about the processing performed by the app.

10. End of processing

When the app is uninstalled, ISC immediately deletes sessions and the access token, and deletes all other Store data upon receiving Shopify's shop/redact notice (48 hours later). Backups are deleted automatically after 7 days. Since the app does not store addresses, there is no buyer data to return; if the Store asks before uninstalling, ISC provides the records of reviewed orders.

11. Audits

ISC makes available to the Store the information needed to demonstrate compliance with this agreement, including the answers it gives Shopify in the protected customer data review. On-site audits are arranged with 30 days' notice, at the Store's cost, at most once a year unless there has been a breach.

12. Governing law

This agreement is governed by the laws of the Republic of Chile. Any dispute is submitted to the ordinary courts of Santiago.

Annex A: description of the processing

Annex B: security measures

• Data minimization: the address is never written to the database, backups or logs.
• TLS for all traffic; database encrypted at rest; backups encrypted with age before upload to R2, with automatic deletion after 7 days.
• Signature verification (HMAC) on all Shopify webhooks.
• Separate development and production environments (different apps, databases and credentials); tests use synthetic addresses.
• Production access limited to the responsible engineer, with named accounts (one for daily use and one for emergencies), unique passwords in a password manager and two-factor authentication on GitHub, Shopify Partners, Fly.io, Neon and Cloudflare.
• Log of every access to an address (store, order, operation, date).
• Incident response plan with notification deadlines for Shopify, stores and the authority.
• Automatic deletion according to the periods in Annex A and clause 10.

Annex C: sub-processors

Shopify is not listed as a sub-processor: it is the Store's platform and processes its data under its own contract with the Store.