How MobiLoud processes Customer Personal Data as a Processor under applicable data protection laws.
Last updated: May 18, 2026
This Data Processing Agreement ("DPA") forms part of the Terms and Conditions or other agreement between:
Processor: Fifty Pixels Ltd, trading as MobiLoud Company No. 07878352 209 High Road, London, England, N2 8AN ("MobiLoud", "Processor", "we", "us")
Customer: The entity that has agreed to MobiLoud's Terms and Conditions or another agreement for the Services ("Customer", "you")
This DPA applies only where MobiLoud processes Customer Personal Data on behalf of Customer as a Processor. It supplements and is incorporated into the Agreement. If there is a conflict between this DPA and the Agreement, this DPA prevails with respect to the processing of Customer Personal Data.
1.1 "Account Data" means Personal Data relating to Customer's employees, contractors, representatives, administrators, or other business contacts who interact with MobiLoud or use the Services on Customer's behalf. Account Data includes names, email addresses, phone numbers, company details, website URLs, billing details, dashboard usage, support messages, onboarding communications, app configuration information, app store credentials, website credentials, and similar business contact or account information.
1.2 "Applicable Data Protection Laws" means all laws and regulations relating to the processing of Personal Data that apply to MobiLoud's performance of the Services, including the UK GDPR, the Data Protection Act 2018, and, where applicable, the EU General Data Protection Regulation (EU 2016/679), Swiss data protection law, US State Privacy Laws, and any national implementing legislation.
1.3 "Customer Personal Data" means End-User Personal Data that MobiLoud processes on behalf of Customer as a Processor in connection with a Product Schedule. Customer Personal Data excludes Account Data.
1.4 "Customer-Controlled Service" means a third-party service, account, platform, integration, website, backend, app store account, analytics account, push notification account, ecommerce account, or similar system that Customer owns, controls, configures, or selects for use with the Services. Customer-Controlled Services include Shopify, Customer's OneSignal account, Customer's Klaviyo account, Customer's Firebase or analytics account, Customer's website and ecommerce backend, and Customer's Apple or Google developer accounts.
1.5 "End-User Personal Data" means Personal Data relating to an end-user, customer, visitor, buyer, subscriber, member, or other individual who interacts with Customer's website, ecommerce store, mobile app, or other Customer property.
1.6 "Product Schedule" means a schedule to this DPA that describes a specific MobiLoud feature, product, app, plugin, or integration through which MobiLoud processes End-User Personal Data on behalf of Customer.
1.7 "Services" means the services provided by MobiLoud to Customer under the Agreement.
1.8 "Sub-processor" means a third party engaged by MobiLoud to process Customer Personal Data on MobiLoud's behalf in connection with the Services. Customer-Controlled Services are not Sub-processors.
1.9 "UK GDPR" means the General Data Protection Regulation (EU 2016/679) as it forms part of domestic law in the United Kingdom by virtue of the European Union (Withdrawal) Act 2018, as amended.
1.10 "EU SCCs" means the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914.
1.11 "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner.
1.12 "UK IDTA" means the International Data Transfer Agreement issued by the UK Information Commissioner under Section 119A of the Data Protection Act 2018.
1.13 "US State Privacy Laws" means US state privacy laws that apply to MobiLoud's processing of Customer Personal Data as a service provider, processor, contractor, or similar role, including the California Consumer Privacy Act as amended by the California Privacy Rights Act.
1.14 "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing", "Process", and related terms have the meanings given to them in the UK GDPR, except where another Applicable Data Protection Law gives those terms a different mandatory meaning.
1.15 "Agreement" means the agreement between MobiLoud and Customer for the Services, including MobiLoud's Terms and Conditions and any executed Order Form, into which this DPA is incorporated.
2.1 Processor scope. This DPA applies only to Customer Personal Data. Most MobiLoud Services do not require MobiLoud to process End-User Personal Data on Customer's behalf. MobiLoud processes End-User Personal Data as a Processor only where Customer enables a feature, app, plugin, or integration described in a Product Schedule.
2.2 Account Data. MobiLoud processes Account Data as an independent Controller. Account Data is governed by MobiLoud's Privacy Policy, not by the processor obligations in this DPA, except where this DPA expressly states otherwise.
2.3 Customer role. Customer is the Controller of Customer Personal Data. If Customer processes Customer Personal Data on behalf of another Controller, Customer is responsible for ensuring that it has authority to instruct MobiLoud, and MobiLoud will act as Customer's Sub-processor for that processing.
2.4 MobiLoud role. MobiLoud is the Processor of Customer Personal Data. MobiLoud will process Customer Personal Data only for the purposes described in this DPA, the Agreement, Customer's documented instructions, and the applicable Product Schedule.
2.5 Customer-Controlled Services. Customer-Controlled Services are selected, owned, controlled, or configured by Customer. MobiLoud is not responsible for the privacy, security, or data processing practices of Customer-Controlled Services. Customer is responsible for its own agreements, permissions, notices, consents, and settings for Customer-Controlled Services.
2.6 Future product schedules. If MobiLoud adds another feature, app, plugin, or integration that requires MobiLoud to process End-User Personal Data as a Processor, MobiLoud may add a new Product Schedule or update an existing Product Schedule before that processing begins.
Customer will:
3.1 Lawful basis and notices. Ensure that it has a lawful basis for sharing Customer Personal Data with MobiLoud and that any notices, consents, and permissions required by Applicable Data Protection Laws have been provided or obtained.
3.2 Instructions. Ensure that Customer's instructions to MobiLoud comply with Applicable Data Protection Laws.
3.3 Push notification consent. Where Customer uses features involving push notifications, obtain and manage all notices, permissions, and consents required for those notifications.
3.4 Customer-Controlled Services. Configure and use Customer-Controlled Services in compliance with Applicable Data Protection Laws, including Shopify, OneSignal, Klaviyo, Firebase, analytics tools, app store accounts, reporting data sources, and Customer's website or ecommerce backend.
3.5 Sensitive data. Not submit or configure the Services to process special category data, criminal offence data, children's data, health data, prescription or pharmacy data, biometric data, precise geolocation data, government identifiers, payment card data, or other sensitive or regulated Personal Data unless MobiLoud has agreed in writing and the parties have agreed any additional safeguards required for that processing.
3.6 Support requests. Avoid including End-User Personal Data in support requests unless it is necessary for MobiLoud to provide the Services. Customer must not include sensitive or regulated Personal Data in support requests unless MobiLoud has agreed in writing.
MobiLoud will:
4.1 Instructions. Process Customer Personal Data only on Customer's documented instructions, including as set out in the Agreement, this DPA, and the applicable Product Schedule, unless required to do so by law. If MobiLoud is required by law to process Customer Personal Data for another purpose, it will inform Customer of that requirement before processing unless the law prohibits notice.
4.2 Unlawful instructions. Inform Customer if MobiLoud becomes aware that Customer's instructions infringe Applicable Data Protection Laws.
4.3 Confidentiality. Ensure that persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations.
4.4 Security. Implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, or damage, including the measures described in Schedule 2.
4.5 Sub-processors. Comply with Section 9 before engaging Sub-processors.
4.6 Data subject requests. Promptly notify Customer if MobiLoud receives a request from a Data Subject to exercise rights under Applicable Data Protection Laws in relation to Customer Personal Data. MobiLoud will not respond to such requests directly unless authorised by Customer or required by law.
4.7 Assistance. Taking into account the nature of the processing and the information available to MobiLoud, provide reasonable assistance to Customer with:
4.8 Deletion and return. Comply with Section 12 for Customer Personal Data in MobiLoud's possession or control.
4.9 Audit cooperation. Comply with Section 14.
5.1 Controller processing. MobiLoud processes Account Data as a Controller to operate its business and provide the Services, including account management, billing, support, onboarding, app configuration, app publication, service communications, analytics, security, fraud prevention, legal compliance, and customer relationship management.
5.2 Privacy Policy. Account Data is governed by MobiLoud's Privacy Policy. The Privacy Policy describes the categories of Account Data MobiLoud collects, the purposes of processing, the legal bases for processing, retention, third-party services, international transfers, and rights available to individuals.
5.3 AI tools. MobiLoud may use AI tools for internal sales, support, onboarding, and operations as described in its Privacy Policy. MobiLoud does not use AI tools to process Customer Personal Data under this DPA unless the relevant AI provider is listed as a Sub-processor or Customer has otherwise instructed and authorised that processing in writing.
5.4 No training on Customer Personal Data. MobiLoud will not use Customer Personal Data to train, fine-tune, or improve general AI models unless Customer has expressly agreed in writing.
6.1 Security measures. MobiLoud will maintain appropriate technical and organisational measures for Customer Personal Data as described in Schedule 2.
6.2 Updates. MobiLoud may update its security measures from time to time, provided that the update does not materially reduce the overall level of protection for Customer Personal Data during the subscription term.
6.3 Customer responsibilities. Customer is responsible for maintaining the security of Customer-Controlled Services, Customer credentials, Customer's website and ecommerce backend, Customer's app store accounts, and Customer's own privacy and consent settings.
7.1 Notice. MobiLoud will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.
7.2 Contents. The notification will include, to the extent reasonably available:
7.3 Updates. Where it is not possible to provide all information at the same time, MobiLoud will provide information in phases without further undue delay as it becomes available.
7.4 No admission. Notification of a Personal Data Breach does not constitute an admission of fault or liability by MobiLoud.
8.1 Legal requests. If MobiLoud receives a subpoena, court order, law enforcement request, governmental request, or other legal process requiring disclosure of Customer Personal Data, MobiLoud will notify Customer before disclosure unless prohibited by law.
8.2 Limited disclosure. MobiLoud will disclose only the Customer Personal Data it reasonably believes is required by the legal request.
8.3 Third-party requests. If MobiLoud receives a request from a third party, regulator, or Data Subject relating to Customer Personal Data, MobiLoud will direct the request to Customer unless MobiLoud is required by law to respond.
9.1 Authorisation. Customer authorises MobiLoud to engage the Sub-processors listed in Schedule 3 to process Customer Personal Data.
9.2 New Sub-processors. MobiLoud will keep the Sub-processor list up to date. Before a new or replacement Sub-processor processes Customer Personal Data, MobiLoud will update the Sub-processor list and provide at least 30 days' notice by posting an update or, where Customer has requested notice by email, by emailing Customer.
9.3 Email notice. Customer may request email notice of Sub-processor changes by contacting privacy@mobiloud.com.
9.4 Objection rights. If Customer has a reasonable, data-protection-related objection to a new or replacement Sub-processor, Customer may notify MobiLoud in writing at privacy@mobiloud.com during the notice period. The parties will discuss the objection in good faith. If no resolution is reached within 30 days, Customer may terminate the affected Services by giving written notice.
9.5 Sub-processor obligations. MobiLoud will enter into a written agreement with each Sub-processor imposing data protection obligations no less protective than those in this DPA, as applicable to the nature of the processing. MobiLoud remains liable to Customer for each Sub-processor's performance of its data protection obligations, subject to the limitations of liability in the Agreement.
9.6 Customer-Controlled Services. Customer-Controlled Services are not Sub-processors. For example, Shopify and Customer's OneSignal, Klaviyo, Firebase, analytics, app store, or ecommerce accounts are controlled by Customer and are not MobiLoud Sub-processors.
10.1 Authorisation. Customer authorises MobiLoud to transfer Customer Personal Data outside the United Kingdom, European Economic Area, and Switzerland where necessary to provide the Services, provided that appropriate safeguards are in place as required by Applicable Data Protection Laws.
10.2 Transfer mechanisms. Where Customer Personal Data is transferred to a country that has not received an applicable adequacy decision, MobiLoud will rely on one or more lawful transfer mechanisms, including the EU SCCs, the UK Addendum, the UK IDTA, or another mechanism permitted by Applicable Data Protection Laws.
10.3 EU SCCs. For transfers governed by the EU GDPR, the EU SCCs are incorporated by reference as described in Schedule 4.
10.4 UK transfers. For transfers governed by the UK GDPR, the UK Addendum or UK IDTA applies as described in Schedule 4.
10.5 Swiss transfers. For transfers governed by Swiss data protection law, the EU SCCs apply with the Swiss modifications described in Schedule 4.
10.6 Supplementary measures. MobiLoud maintains appropriate technical and organisational measures to protect transferred Customer Personal Data, including encryption in transit, access controls, data minimisation, and logging controls.
11.1 Service provider and processor role. To the extent MobiLoud processes Customer Personal Data subject to US State Privacy Laws, MobiLoud acts as Customer's service provider, processor, contractor, or equivalent role.
11.2 Limited purpose. MobiLoud will process Customer Personal Data only for the limited and specified purposes described in this DPA, the Agreement, Customer's documented instructions, and the applicable Product Schedule.
11.3 Prohibited uses. MobiLoud will not:
11.4 Compliance. MobiLoud will comply with applicable obligations under US State Privacy Laws for its role and will provide the same level of privacy protection required by those laws.
11.5 Notice and remediation. MobiLoud will notify Customer if MobiLoud determines that it can no longer meet its obligations under US State Privacy Laws. Customer may take reasonable and appropriate steps to stop and remediate unauthorised processing of Customer Personal Data.
11.6 De-identified data. If MobiLoud creates de-identified data from Customer Personal Data, MobiLoud will take reasonable measures to prevent the data from being used to identify a natural person, will publicly commit or contractually commit to maintain and use the data only in de-identified form, will not attempt to re-identify the data except to test the de-identification process, and will require any recipient to comply with the same restrictions.
12.1 Customer choice. Upon termination or expiration of the Agreement, or upon Customer's written request, MobiLoud will, at Customer's choice:
12.2 Timing. MobiLoud will complete the return or deletion within 30 days of receiving Customer's instruction, unless Applicable Data Protection Laws require continued storage.
12.3 No instruction. Where Customer does not provide an instruction under Section 12.1 within 30 days of termination or expiration, MobiLoud will delete Customer Personal Data in MobiLoud's possession or control, unless Applicable Data Protection Laws require continued storage.
12.4 Continued storage. Where continued storage is required by law, MobiLoud will inform Customer of the requirement unless prohibited by law, and will isolate and protect the stored data from further processing except as required by law.
12.5 No retained end-user database for Shopify App processing. For transient Shopify App processing described in Product Schedule 1, MobiLoud does not maintain a database of End-User Personal Data. Customer Personal Data is processed transiently and removed from job queues once processing completes. MobiLoud configures logs and error tracking tools to anonymise, strip, or replace Customer Personal Data before capture or transmission. If Customer Personal Data is inadvertently captured in internal logs despite those controls, those logs are automatically rotated and deleted within the period stated in the applicable Product Schedule. Where MobiLoud does not retain Customer Personal Data, return is not technically feasible and deletion will consist of confirming that no retained Customer Personal Data exists in MobiLoud's possession or control.
12.6 Account Data. Deletion and return of Account Data are governed by MobiLoud's Privacy Policy and applicable law, not this Section 12.
13.1 Product Schedules. The subject matter, purpose, nature, categories of Personal Data, categories of Data Subjects, duration, retention, and Sub-processors for Customer Personal Data are described in the applicable Product Schedule.
13.2 Current Product Schedule. As of the effective date of this DPA, the current Product Schedule covers Shopify App processing.
13.3 No general end-user processing. Except as described in a Product Schedule, MobiLoud does not directly collect, store, or access End-User Personal Data as a Processor for Customer.
14.1 Information. MobiLoud will make available to Customer, on request, information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the UK GDPR or EU GDPR.
14.2 Audit conditions. MobiLoud will allow and contribute to audits, including inspections, conducted by Customer or a qualified third-party auditor mandated by Customer, subject to the following conditions:
14.3 Documentation. MobiLoud may satisfy its audit obligations by providing relevant policies, written responses, security documentation, third-party security certifications, or audit reports where available and under appropriate confidentiality obligations. Where such materials are available, they will be the primary means of demonstrating compliance before any on-site audit.
15.1 Each party's total liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Agreement.
15.2 This Section 15 does not limit either party's liability to Data Subjects under Applicable Data Protection Laws, nor does it limit liability for breaches of the EU SCCs, the UK IDTA, or the UK Addendum.
16.1 Governing law. This DPA is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction over any dispute arising from this DPA, except where the EU SCCs, UK Addendum, UK IDTA, or Applicable Data Protection Laws require another governing law or forum.
16.2 Precedence. If there is a conflict between this DPA and the Agreement, this DPA prevails to the extent of the conflict with respect to the processing of Customer Personal Data. If there is a conflict between this DPA and the EU SCCs, UK Addendum, or UK IDTA, the applicable transfer terms prevail.
16.3 Amendments. MobiLoud may update this DPA from time to time to reflect changes in Applicable Data Protection Laws or MobiLoud's processing activities. Updates will be posted at mobiloud.com/dpa or another location notified to Customer. Continued use of the Services after an update constitutes acceptance of the updated DPA where permitted by applicable law.
16.4 Severability. If any provision of this DPA is found to be invalid or unenforceable, the remaining provisions will continue in full force and effect.
16.5 Entire agreement. This DPA, together with the Agreement and MobiLoud's Privacy Policy, constitutes the entire agreement between the parties regarding the processing of Customer Personal Data.
For questions about this DPA, contact:
Fifty Pixels Ltd (trading as MobiLoud) 209 High Road, London, England, N2 8AN Email: privacy@mobiloud.com
This Schedule applies only when Customer has installed the MobiLoud Shopify App and has enabled one or more of the following optional features:
If Customer installs the Shopify App but does not enable these features, MobiLoud does not process End-User Personal Data under this Schedule.
MobiLoud processes Customer Personal Data to:
When a relevant Shopify event occurs, Shopify sends a webhook to MobiLoud. MobiLoud processes the webhook and, depending on Customer's enabled features, either writes app attribution tags back to Shopify through the Shopify API or sends notification data to Customer's OneSignal account for push notification delivery.
Customer Personal Data is processed transiently. It is not written to MobiLoud's end-user database. Data exists temporarily in job queues during processing and is removed once the operation completes.
Production logging is configured at error level only, so Customer Personal Data is not logged during normal operations. MobiLoud configures logs and error tracking tools, including Laravel Nightwatch, to anonymise, strip, or replace Customer Personal Data before capture or transmission. If Customer Personal Data is inadvertently captured in internal logs despite those controls, those logs are automatically rotated and deleted within 24 hours.
Depending on Customer's Shopify configuration and enabled features, Customer Personal Data may include:
MobiLoud does not intentionally process payment card data or full payment credentials through this Schedule.
Data Subjects are end-users of Customer's mobile app or Shopify store whose order, customer, device, or notification data is processed when Customer enables the features described in this Schedule.
Transfers occur when relevant Shopify events are sent to MobiLoud and the enabled feature requires processing. Processing continues for the duration of Customer's active MobiLoud subscription and use of the enabled Shopify App features.
Customer Personal Data processed under this Schedule is transient. It is removed from job queues once processing completes. Logs and error tracking data are configured to anonymise, strip, or replace Customer Personal Data. If Customer Personal Data is inadvertently captured in internal logs despite those controls, those logs are automatically rotated and deleted within 24 hours.
MobiLoud may retain merchant-level configuration data, including encrypted OneSignal API credentials, notification templates, feature flags, Shopify store domain, and Shopify access tokens. That configuration data is Account Data or Customer configuration data and is handled under MobiLoud's Privacy Policy and security practices, except to the extent it contains Customer Personal Data.
Shopify and Customer's OneSignal account are Customer-Controlled Services. MobiLoud reads from or writes to those services on Customer's instructions, but they are not MobiLoud Sub-processors.
Customer is responsible for:
Customer must not enable the Shopify App features described in this Schedule for stores, products, orders, or workflows involving special category data, health data, prescription or pharmacy data, children's data, criminal offence data, biometric data, government identifiers, precise geolocation data, payment card data, or other sensitive or regulated Personal Data unless MobiLoud has agreed in writing and the parties have agreed any additional safeguards required for that processing.
MobiLoud's Shopify App is configured to receive Shopify's mandatory privacy webhook requests, including shop redaction, customer redaction, and customer data request webhooks. Because MobiLoud does not permanently store End-User Personal Data under this Schedule, there is generally no retained End-User Personal Data to export or delete in response to these webhooks. Where transient or associated records exist in MobiLoud's possession or control, they are removed.
MobiLoud maintains the following technical and organisational measures for Customer Personal Data, taking into account the nature, scope, context, and purposes of processing under this DPA.
The following Sub-processors are authorised for Customer Personal Data processed under Product Schedule 1:
DigitalOcean LLC Processing activity: Cloud hosting and application servers for processing under Product Schedule 1 Location: United States
Cloudflare, Inc. Processing activity: Content delivery network, traffic routing, and security for processing under Product Schedule 1 Location: United States and global network
For transparency, MobiLoud also uses Laravel Nightwatch, operated by Laravel Holdings Inc., for application performance monitoring and error logging. Customer Personal Data is anonymised or stripped before transmission to Nightwatch, and Nightwatch is not intended to process Customer Personal Data under this DPA. Data transmitted to Nightwatch is automatically purged after 30 days.
Customer-Controlled Services, including Shopify, Customer's OneSignal account, Customer's analytics accounts, Customer's app store accounts, and Customer's reporting data sources, are not MobiLoud Sub-processors.
Where Customer Personal Data protected by the EU GDPR is transferred to a country that has not received an adequacy decision from the European Commission, the EU SCCs are incorporated into this DPA as follows:
Where Customer Personal Data protected by the UK GDPR is transferred to a country that has not received an adequacy decision from the UK Secretary of State, the UK Addendum or UK IDTA applies as follows:
Where Customer Personal Data protected by Swiss data protection law is transferred to a country that has not received an applicable adequacy decision, the EU SCCs apply with the following modifications:
As of the effective date of this DPA, the Sub-processors listed in Schedule 3 are located in or operate from the United States or a global network. Where a Sub-processor is certified under the EU-US Data Privacy Framework, the Swiss-US Data Privacy Framework, or the UK Extension to the EU-US Data Privacy Framework, that certification may serve as an additional safeguard alongside the transfer mechanisms referenced in this Schedule.
This Schedule applies where US State Privacy Laws apply to MobiLoud's processing of Customer Personal Data.
MobiLoud acts as Customer's service provider, processor, contractor, or equivalent role for Customer Personal Data.
MobiLoud will process Customer Personal Data only for the limited and specified purposes described in this DPA, the Agreement, Customer's documented instructions, and the applicable Product Schedule.
MobiLoud will not:
MobiLoud will provide the same level of privacy protection required by applicable US State Privacy Laws for MobiLoud's role. MobiLoud will provide reasonable assistance to Customer for consumer rights requests relating to Customer Personal Data, taking into account the nature of the processing and the information available to MobiLoud.
MobiLoud will notify Customer if MobiLoud determines that it can no longer meet its obligations under applicable US State Privacy Laws. Customer may take reasonable and appropriate steps to stop and remediate unauthorised processing of Customer Personal Data.
If MobiLoud creates de-identified data from Customer Personal Data, MobiLoud will take reasonable measures to prevent the data from being used to identify a natural person, will publicly commit or contractually commit to maintain and use the data only in de-identified form, will not attempt to re-identify the data except to test the de-identification process, and will require any recipient to comply with equivalent restrictions.
Effective date: May 18, 2026
