Data Processing Policy

This Data Processing Policy ("Policy") sets out the terms on which SR Innovations Private Limited ("SR Innovations", "we", "us") processes personal data on behalf of merchants ("Merchant", "you") who use the SR Innovations subscription management platform.

This Policy is intended to satisfy the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 (GDPR), applicable Indian data protection law, and the data processing agreement requirements of the Shopify Partner Programme.

By installing and using any SR Innovations application, the Merchant agrees to the terms of this Policy. This Policy forms part of and is incorporated into the SR Innovations Merchant Partner Agreement.

SR Innovations processes personal data to provide a subscription management platform for Shopify merchants. The processing activities include: creating and managing subscriber records, processing recurring billing events, sending subscription lifecycle communications (confirmation, renewal, failed payment, cancellation), and generating subscription analytics for the Merchant's dashboard.

Processing is carried out electronically and is automated for routine operations (billing runs, renewal notifications). Manual processing occurs only in the context of support interactions and is limited to the minimum necessary to resolve the support request.

We do not process special categories of personal data (health data, biometric data, racial or ethnic origin, political opinions, or similar sensitive categories) unless the Merchant explicitly provides such data, in which case a separate data processing addendum is required.

SR Innovations uses the following sub-processors to deliver its services. Each sub-processor is bound by a data processing agreement that provides at least the same level of protection as this Policy. We will notify Merchants of any changes to the sub-processor list at least 30 days before the change takes effect.

SR Innovations implements the following technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction:

Personal data processed by SR Innovations is primarily stored on AWS infrastructure located in India (ap-south-1 region). Where data is transferred to sub-processors located outside India or outside the European Economic Area (EEA), SR Innovations ensures that an adequate level of protection is in place through one or more of the following mechanisms:

Merchants who require data residency within the EEA or a specific jurisdiction should contact us at legal@srinnov.com to discuss available data residency options.

SR Innovations will assist the Merchant in responding to data subject rights requests, including requests to access, correct, restrict, or delete personal data. This assistance is provided through the automated mechanisms described in our Data Deletion Policy, and through manual support where required.

Where a data subject contacts SR Innovations directly with a rights request that should be directed to the Merchant as Controller, we will forward the request to the Merchant within 5 business days and notify the data subject accordingly.

Notification will include: a description of the nature of the breach; the categories and approximate number of data subjects affected; the categories and approximate number of personal data records affected; the likely consequences of the breach; and the measures taken or proposed to address the breach.

Where not all information is available within 72 hours, SR Innovations will provide information in phases as it becomes available. Merchants are responsible for notifying their end-customers and relevant supervisory authorities as required by applicable law.

The Merchant may, upon reasonable written notice of at least 30 business days, request an audit of SR Innovations' data processing activities to verify compliance with this Policy. Audits may be conducted by the Merchant or an independent third-party auditor appointed by the Merchant, subject to reasonable confidentiality obligations.

SR Innovations may, at its discretion, satisfy an audit request by providing up-to-date third-party audit reports (SOC 2 Type II or equivalent) in lieu of a direct audit. The cost of any audit not covered by such reports is borne by the Merchant.

Upon termination of the Merchant's subscription or upon written request from the Merchant, SR Innovations will, at the Merchant's choice, return all personal data to the Merchant in a machine-readable format (CSV or JSON) or delete all personal data from our systems.

Return or deletion will be completed within 30 days of the termination date or request, subject to the legal retention obligations described in the Data Deletion Policy. SR Innovations will provide written confirmation when deletion is complete.

For all data processing enquiries, including requests to review this Policy, to discuss specific processing activities, or to raise a complaint about how we handle personal data:

We respond to all data protection enquiries within 5 business days. Where a response requires legal review, we will acknowledge receipt within 24 hours and provide a substantive response within 14 days.