Blazier Wishlist

Data processing addendum

Last updated: November 10, 2026

This data processing addendum (“DPA”) forms part of the Terms of service between DRG Technologies and Consultancy (“Blazier”) and the merchant using Blazier Wishlist (“you”). It applies to personal data about your shoppers that Blazier processes on your behalf (“Shopper Data”). It is intended to meet the requirements of the GDPR, the UK GDPR, and US state privacy laws such as the CCPA, to the extent they apply.

1. Roles

You are the controller (or “business”) of Shopper Data. Blazier is your processor (or “service provider”) and processes Shopper Data only to provide the App.

2. Details of processing
Subject matter Providing wishlist features on your Shopify store
Duration While you use the App, plus the deletion periods below
Nature and purpose Storing, syncing, displaying, and sharing shoppers’ wishlists; merging guest lists into customer accounts; giving you aggregate wishlist statistics for your store
Data subjects Shoppers who use the wishlist on your store
Categories of data Shopify customer ID (logged-in shoppers); random guest identifier (guests); wishlist contents (list names, product and variant IDs, a snapshot of product title, price, currency, handle and image link); timestamps; share tokens; IP address and request details in security logs
Special categories None. The App does not collect names, email addresses, postal addresses, phone numbers, or payment details.

3. Blazier’s commitments

Blazier will:

  1. process Shopper Data only on your documented instructions, which are these Terms, this DPA and your App settings, unless the law requires otherwise (in which case we’ll tell you unless the law forbids it);
  2. not sell or share Shopper Data, use it for cross-context behavioral advertising, combine it with data from other stores, or use it for any purpose other than providing the App;
  3. ensure that staff with access are bound by confidentiality;
  4. apply the security measures described in section 10 of the privacy policy, including encryption in transit and at rest;
  5. use only the sub-processors listed on Sub-processors, under written terms at least as protective as this DPA, and give at least 30 days’ notice of a new sub-processor, during which you may object;
  6. help you respond to shoppers’ rights requests, including requests Shopify forwards to us through the customers/data_request and customers/redact webhooks;
  7. notify you without undue delay after becoming aware of a personal data breach affecting your Shopper Data, with the information you need to meet your own obligations;
  8. give reasonable help with data protection impact assessments and consultations with regulators, where needed;
  9. delete Shopper Data as described below; and
  10. make available the information reasonably needed to show compliance with this DPA, and allow reasonable audits, no more than once a year, with reasonable notice, unless required by a regulator or after a breach.

4. Deletion

  • Guest wishlists are deleted after 180 days without activity by default; you can change this in Settings.
  • A shopper’s data is deleted when Shopify sends a customers/redact request.
  • All of your store’s data is deleted within 48 hours after you uninstall the App, and when Shopify sends a shop/redact request.
  • Encrypted backups expire on a rolling schedule.

5. Location and transfers

Shopper Data is stored with Amazon Web Services in the United States (us-east-1, with encrypted backups in a second US region). Where Shopper Data of people in the EEA, UK, or Switzerland is transferred to the United States, the Standard Contractual Clauses (Module 2, controller to processor, and the UK addendum where applicable) are incorporated into this DPA by reference.

6. Your commitments

You are responsible for having a lawful basis for the processing, for telling your shoppers about the wishlist in your store’s privacy policy, and for the instructions you give us through your settings.

7. Liability and precedence

This DPA is subject to the limitation of liability in the Terms. If this DPA and the Terms conflict on the processing of Shopper Data, this DPA wins.

Requesting a signed copy

To request a countersigned copy of this DPA, email support@blazier.app with your store’s .myshopify.com address and legal entity name.