Data Processing Addendum
A concise statement of data-processing responsibilities for merchants using Chargeback Recovery.
Effective 30 August 2026 · Version 1.0
Application and parties
This Data Processing Addendum is effective from 30 August 2026 as version 1.0 and forms part of the Chargeback Recovery Terms of Service. It applies when a merchant installs, accesses, or uses the service and Chargeback Recovery processes personal data on that merchant’s behalf. Chargeback Recovery is operated by Marc Best of 58 Ramilles Close, London, SW2 5DG, United Kingdom.
Roles
For customer and order data supplied through a merchant’s Shopify store, the merchant determines the recovery purpose and remains the controller or business responsible for its data and recovery decisions. Marc Best, operating Chargeback Recovery, acts as processor or service provider and processes that data only to provide the documented service, subject to applicable law and Shopify’s terms.
Documented instructions and purpose limitation
We process personal data only to authenticate the merchant, identify and prepare eligible chargeback recoveries, maintain merchant-approved recovery records, provide support, secure the service, and comply with lawful obligations. We do not sell the data or use it for unrelated advertising or personalization.
Security and confidentiality
We apply the current technical and organisational measures described in our Privacy, Data Retention, Security, and access-control policies. Administrative access is limited to the authorised sole operator, credentials remain server-side and out of source control, and accounts are required to use least privilege, strong unique passwords, and multi-factor authentication where available.
Service providers
Shopify, Vercel, Supabase, and Resend support the current service for the purposes described in the Privacy Policy and processor inventory. No debt collection agency receives RecoveryCase, customer, order, or evidence data. Subprocessors may process personal data only to operate the service under their applicable contractual safeguards. Material changes will be reflected in the processor inventory and merchant disclosures before taking effect where reasonably practicable.
International transfers
Infrastructure subprocessors may process data outside the merchant’s country. Where applicable law requires transfer safeguards, Chargeback Recovery relies on the contractual transfer mechanisms offered by those subprocessors and records the current providers and purposes in the processor inventory.
Rights requests and incidents
We assist with applicable access, correction, deletion, restriction, and security-incident obligations using Shopify privacy webhooks and the support channel, taking account of the nature of the processing and available information.
Return and deletion
Personal data is deleted or anonymised under the Data Retention Policy, valid Shopify redaction requests, and verified merchant requests, unless continued retention is legally required. On termination, the merchant may request deletion through the published support channel, subject to those documented obligations.
Duration and changes
This Addendum applies for as long as Chargeback Recovery processes personal data on the merchant’s behalf. Data-protection, confidentiality, deletion, and assistance obligations continue for retained data. Material changes will be published with an updated effective version; a merchant that does not accept them must stop using the service.
Contact
Chargeback Recovery is operated by Marc Best, 58 Ramilles Close, London, SW2 5DG, United Kingdom. Questions and privacy requests can be sent to support@aithorapp.co.uk.