← Vihax · Home · Terms · Privacy
Last updated: 23 September 2026 · URL: https://vihax.com/dpa/
This Data Processing Addendum (“Addendum”) forms part of the Terms of Service between VIHAX Marketing Solutions (“Vihax,” “we”) and the business that uses Vihax (“you,” the “Merchant”). It applies whenever Vihax processes personal data about your customers or storefront visitors on your behalf. Where it conflicts with the Terms on personal data, this Addendum governs.
You decide why and how your customers’ personal data is processed, and you are the data fiduciary under India’s Digital Personal Data Protection Act, 2023, and the controller under the EU and UK GDPR where they apply. Vihax processes that data only on your behalf, as your data processor. Your configuration of Vihax (the platforms you connect, the events you switch on, the settings you choose) is your documented instruction to us. We process your customers’ data for no other purpose, and we tell you if we believe an instruction breaks the law.
| Data | Source | Purpose |
|---|---|---|
| Order records: order number, dates, amounts, line items, payment method, delivery and return status | Your Shopify store | Profit, return and attribution reporting for you |
| Shopify customer identifier; delivery postal code, city, state and country | Your Shopify store | Repeat-customer and regional return reporting |
| Customer email, phone and name | Your Shopify store, read at the moment of use | Hashed (SHA-256) to match storefront visits to orders and, where you connect them, to send conversions to your own Meta and Google accounts. The plaintext is never stored. |
| Storefront visits: a random visitor identifier, pages viewed, referrer, campaign and ad-click identifiers, IP address, browser user agent, and the visitor’s consent choices | The Vihax pixel on your storefront | Attribution, and conversion matching on your ad accounts |
| For each customer audience you switch on: the hashed email, phone, name, postal code and country of the customers it selects | Your Shopify store, read at the moment of each daily refresh | Refilling that audience in your own Meta or Google ad account. Nothing about its members is stored by Vihax; only counts are kept. |
Customers and storefront visitors of your store are the people this data is about. We do not process special-category data, and we do not ask Shopify for street address lines.
You are responsible for the lawful basis for collecting your customers’ data and for the consent banner on your storefront. Vihax reads the choice each visitor makes through Shopify’s Customer Privacy API and applies it:
Everyone at Vihax who can reach your data is bound by confidentiality. We maintain the following measures and will not reduce them during the term:
You authorise the sub-processors listed in section 5.1 of our Privacy Policy. Each is bound to data-protection obligations no weaker than this Addendum. We will email the account owner at least 14 days before adding or replacing a sub-processor; if you object on reasonable data-protection grounds and we cannot address the objection, you may end the Service without penalty before the change takes effect.
Your data is stored in India (MongoDB Atlas, Mumbai). Some sub-processors operate outside India, including Cloudflare, Google Cloud, Meta and Google Ads. Where GDPR applies to a transfer, it is made under the European Commission’s standard contractual clauses or another lawful mechanism.
| Data | Kept |
|---|---|
| Raw visitor IP address on pixel events | 30 days |
| Hashed email and phone on pixel events; hashed customer keys in the record of what was sent to Meta | 90 days |
| Delivery postal code, city and state | 90 days |
| Shopify customer identifier | Replaced with a one-way pseudonym at 90 days; the pseudonym is removed at 24 months |
| Log of who opened a single customer’s records | 400 days |
| Database backups | Up to 28 days |
When Shopify tells us a customer asked to be erased, we erase that customer’s records, and they leave every Vihax audience at its next daily refresh. When you uninstall and Shopify sends its shop deletion request, we delete all of your store’s data, and backups age out within 28 days. You can end the Service at any time.
When a customer asks your store for their data, Shopify tells us and Vihax assembles everything it holds about that customer for you to give them. Erasure requests are handled as in section 7. If a customer contacts Vihax directly, we pass the request to you.
If we become aware of a breach of your customers’ personal data, we will tell you without undue delay and within 24 hours, with what we know of what happened, the data and people affected, and what we are doing about it. We will update you as we learn more and help you meet your own notification duties. The details are in our incident response policy, which we provide on request.
On request we will give you the information reasonably needed to show that we meet this Addendum, including answers to security questionnaires. Vihax does not currently hold a third-party security certification.
This Addendum lasts as long as Vihax processes your customers’ data and survives the end of the Terms until that data is deleted.
Questions: vivek@vihax.com · VIHAX Marketing Solutions, Faridabad, Haryana, India