Last updated: March 23, 2026 — Effective Date: March 23, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service ("Agreement") between the Merchant ("Data Controller," "you," or "your") and Gemhubx and its affiliates, subsidiaries, successors, and assigns (collectively, "Gemhubx," "Data Processor," "we," "us," or "our") and governs the processing of Personal Data by Gemhubx on behalf of the Merchant in connection with the Gemhubx application, website at https://gemhubapp.com, APIs, and all related services (collectively, the "Service").
This DPA supplements and is incorporated into the Terms of Service and Privacy Policy. In the event of any conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to data processing matters.
BY INSTALLING OR USING THE SERVICE, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THIS DPA. THIS DPA IS EFFECTIVE UPON INSTALLATION OF THE GEMHUBX APPLICATION ON YOUR STORE.
For the purposes of this DPA, the following terms shall have the meanings set out below. Capitalized terms not defined herein shall have the meaning given to them in the Terms of Service or as defined in applicable Data Protection Laws.
The Merchant acts as the Data Controller with respect to Personal Data of its end customers and staff that is Processed through the Service. Gemhubx acts as the Data Processor, Processing Personal Data solely on behalf of and in accordance with the documented instructions of the Merchant as set forth in this DPA and the Agreement.
Gemhubx Processes Personal Data solely for the purpose of providing the Service to the Merchant, including but not limited to:
Gemhubx shall not Process Personal Data for any purpose other than those specified in this DPA unless required by applicable law, in which case Gemhubx shall inform the Merchant of such legal requirement before Processing (unless prohibited by law from doing so).
Gemhubx shall Process Personal Data only on documented instructions from the Merchant, including with respect to transfers of Personal Data to a third country or international organization, unless required to do so by European Union or Member State law to which Gemhubx is subject. In such a case, Gemhubx shall inform the Merchant of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest. The Merchant's instructions are documented in this DPA, the Terms of Service, and through the Merchant's use and configuration of the Service.
Gemhubx shall Process Personal Data for the duration of the Agreement between the Merchant and Gemhubx. Processing shall commence upon installation of the Gemhubx application on the Merchant's store and shall continue until the Agreement is terminated.
Upon termination of the Agreement:
The nature of Processing carried out by Gemhubx includes the following operations on Personal Data:
Gemhubx Processes the following categories of Personal Data on behalf of the Merchant:
| Data Category | Specific Data Elements | Purpose |
|---|---|---|
| Customer Identity | First name, last name | Order fulfillment, shipping labels, customer correspondence |
| Customer Contact | Email address, phone number | Order confirmations, shipping notifications, delivery coordination |
| Shipping Address | Street address, city, state/province, postal code, country | Order dispatch, shipping label generation, customs documentation |
| Billing Address | Street address, city, state/province, postal code, country | Order verification, fraud prevention |
| Order Details | Order ID, line items, product names, SKUs, quantities, unit prices, discounts, total amounts | Order processing, fulfillment routing, financial reconciliation |
| Payment Status | Payment status (paid, pending, refunded), payment method type (no card numbers) | Order release for fulfillment, refund processing |
| Shipping Information | Shipping method, carrier name, tracking number, estimated delivery date, delivery confirmation | Shipment tracking, delivery status updates |
| Merchant Account Data | Merchant name, email, store domain, store name, access tokens (encrypted), subscription details | Account management, API authentication, billing |
| Technical Data | IP addresses, browser type, device information, session identifiers | Security, fraud prevention, session management |
Gemhubx does not Process or store credit card numbers, CVVs, bank account numbers, or other sensitive financial instruments. Payment processing is handled entirely by the Merchant's payment gateway (e.g., Shopify Payments, Stripe, PayPal).
The following categories of Data Subjects may have their Personal Data Processed under this DPA:
Individuals who place orders through the Merchant's online store for products sourced via the Gemhubx platform. Their Personal Data is Processed for the purpose of order fulfillment, shipping, delivery, and post-sale support (such as returns and exchanges).
Individuals who access and use the Gemhubx Service on behalf of the Merchant, including store owners, administrators, and authorized team members. Their Personal Data is Processed for account management, authentication, and access control purposes.
Individuals designated as recipients of orders where the shipping address differs from the billing address. Their Personal Data (name and shipping address) is Processed solely for order delivery purposes.
Gemhubx, as the Data Processor, undertakes the following obligations:
Gemhubx shall Process Personal Data only on documented instructions from the Merchant, as set forth in this DPA and the Agreement. If Gemhubx believes that an instruction from the Merchant infringes applicable Data Protection Laws, Gemhubx shall immediately inform the Merchant and may suspend the relevant Processing until the Merchant issues corrected instructions.
Gemhubx shall ensure that all persons authorized to Process Personal Data have committed themselves to confidentiality obligations or are under an appropriate statutory obligation of confidentiality. This obligation shall survive the termination of this DPA and the employment or engagement of the relevant personnel.
Gemhubx shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as detailed in Section 9 of this DPA. These measures shall be regularly reviewed and updated as necessary to address evolving threats and vulnerabilities.
Gemhubx shall not engage a Sub-processor without the prior general written authorization of the Merchant, which is granted by the Merchant's acceptance of this DPA. Before engaging a new Sub-processor, Gemhubx shall:
The Merchant may object to the engagement of a new Sub-processor as described in Section 8.
Gemhubx shall assist the Merchant, by appropriate technical and organizational measures, insofar as possible, in fulfilling the Merchant's obligation to respond to Data Subject requests exercising their rights under Data Protection Laws, as further described in Section 11.
Gemhubx shall assist the Merchant in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (and equivalent provisions of other Data Protection Laws), taking into account the nature of Processing and the information available to Gemhubx. This includes assistance with:
Upon termination of the Agreement or upon the Merchant's written request, Gemhubx shall, at the Merchant's choice, delete or return all Personal Data to the Merchant and delete existing copies, unless European Union or Member State law requires storage of the Personal Data. Gemhubx shall certify deletion in writing upon the Merchant's request.
Gemhubx shall make available to the Merchant all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Merchant or an auditor mandated by the Merchant, as further described in Section 13.
The Merchant provides general authorization for Gemhubx to engage Sub-processors to assist in providing the Service, subject to the requirements of this Section.
As of the effective date of this DPA, Gemhubx engages the following categories of Sub-processors:
| Sub-processor Category | Purpose | Data Accessed |
|---|---|---|
| Cloud Infrastructure Provider | Hosting, storage, and operation of the Gemhubx platform and databases | All Personal Data stored within the Service (encrypted at rest) |
| Fulfillment Suppliers (QGold, GND) | Product sourcing, order fulfillment, and shipment dispatch | Customer names, shipping addresses, order details (line items, quantities) |
| Shipping Carriers | Package delivery, tracking, and delivery confirmation | Customer names, shipping addresses, phone numbers, package details |
| Payment Processors | Subscription billing and Merchant payment processing | Merchant billing information, subscription plan details |
| Content Delivery Network (Cloudflare) | Web application firewall, DDoS protection, content delivery, and SSL/TLS termination | IP addresses, request headers, session tokens (in transit) |
| Email Service Provider | Transactional email delivery (order notifications, account alerts) | Recipient email addresses, email content |
Gemhubx shall notify the Merchant at least thirty (30) days in advance before engaging any new Sub-processor or replacing an existing Sub-processor. Notification shall be provided via email to the address associated with the Merchant's account or through an update to the Sub-processor list published on the Gemhubx website.
The Merchant may object to the engagement of a new Sub-processor by notifying Gemhubx in writing within fifteen (15) days of receiving the notification described in Section 8.2. The objection must be based on reasonable grounds relating to data protection. Upon receipt of an objection, Gemhubx shall:
Gemhubx shall enter into written agreements with each Sub-processor that impose data protection obligations substantially equivalent to those set out in this DPA. Gemhubx shall remain fully responsible for the acts and omissions of its Sub-processors as if they were the acts and omissions of Gemhubx itself.
Gemhubx implements and maintains the following technical and organizational security measures to protect Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, damage, theft, or disclosure:
In the event of a Security Incident involving Personal Data Processed on behalf of the Merchant, Gemhubx shall notify the Merchant without undue delay and in any event within seventy-two (72) hours after becoming aware of the Security Incident. Notification shall be provided to the email address associated with the Merchant's account.
The notification shall include, to the extent reasonably available at the time of notification:
Where it is not possible to provide all information at the same time, Gemhubx shall provide the information in phases without undue delay as it becomes available.
Gemhubx shall:
Gemhubx maintains a Security Incident Response Policy that documents the procedures for detection, containment, investigation, notification, and post-incident review. Details are available in our Security Policy. The Merchant may request a summary of the Incident Response Policy at any time by contacting [email protected].
The Merchant, as the Data Controller, is responsible for responding to Data Subject requests exercising their rights under applicable Data Protection Laws, including rights of access, rectification, erasure, portability, restriction of Processing, and objection.
Gemhubx shall assist the Merchant in responding to Data Subject requests by:
Gemhubx shall respond to the Merchant's requests for assistance with Data Subject rights within forty-eight (48) hours of receiving the request. Where a request requires extensive technical work (such as extracting data from backup systems), Gemhubx shall acknowledge the request within forty-eight (48) hours and provide a timeline for completion.
Gemhubx implements automated processing for the following Shopify-mandated GDPR webhooks:
All GDPR webhooks are validated using HMAC-SHA256 signature verification before processing.
Personal Data Processed by Gemhubx may be transferred to, stored, and Processed in the United States and other countries where Gemhubx, its affiliates, or its Sub-processors maintain facilities. The Merchant acknowledges and consents to such transfers as necessary for the provision of the Service.
Where Personal Data originating from the European Economic Area (EEA), the United Kingdom, or Switzerland is transferred to a country that has not been deemed to provide an adequate level of data protection by the relevant authority, Gemhubx shall ensure that appropriate safeguards are in place, including:
Upon the Merchant's request, Gemhubx shall cooperate in conducting a transfer impact assessment to evaluate whether the laws and practices of the destination country may impinge on the effectiveness of the transfer safeguards, and to identify and implement supplementary measures where necessary.
The Merchant, or an independent third-party auditor appointed by the Merchant, may audit Gemhubx's compliance with this DPA. Audits may include inspections of Gemhubx's data processing facilities, systems, policies, and procedures relevant to the Processing of the Merchant's Personal Data.
The Merchant shall provide Gemhubx with at least thirty (30) days' prior written notice of an intended audit, including the proposed scope, duration, and start date. Audits shall be conducted:
Each party shall bear its own costs in connection with the audit. If an audit reveals a material breach of this DPA by Gemhubx, Gemhubx shall bear the reasonable costs of the audit and shall promptly remediate the identified deficiencies at its own expense.
In lieu of an on-site audit, Gemhubx may provide the Merchant with:
This DPA becomes effective upon the Merchant's installation of the Gemhubx application on their Shopify or WooCommerce store, or upon the Merchant's creation of a Gemhubx account, whichever occurs first.
This DPA shall remain in effect for the duration of the Agreement. If the Agreement terminates, this DPA shall automatically terminate, subject to the data retention and deletion obligations set forth herein.
Upon termination of the Agreement, Gemhubx shall:
Notwithstanding the foregoing, Gemhubx may retain Personal Data to the extent and for the duration required by applicable law, regulation, or legal process (including tax, accounting, and regulatory retention requirements). Any retained data shall be protected in accordance with this DPA and shall not be Processed for any purpose other than the purpose for which retention is required. Upon expiration of the applicable retention period, such data shall be securely deleted.
The total aggregate liability of each party under or in connection with this DPA shall be subject to the limitations and exclusions of liability set out in the Terms of Service. Nothing in this DPA shall be construed to limit or exclude liability to the extent such limitation or exclusion is not permitted by applicable law.
Each party shall indemnify, defend, and hold harmless the other party from and against any losses, liabilities, damages, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to the indemnifying party's breach of this DPA, to the extent permitted under the Terms of Service.
Where a Data Subject brings a claim directly against Gemhubx for a breach of this DPA, the Merchant shall indemnify Gemhubx for any costs, charges, damages, expenses, or losses arising from such claim to the extent that the claim arose from the Merchant's breach of its obligations under Data Protection Laws or this DPA.
This DPA shall be governed by and construed in accordance with the laws of the State of Delaware, United States, without regard to its conflict of law provisions, except to the extent that applicable Data Protection Laws require the application of the law of another jurisdiction.
For Merchants located in the European Economic Area, this DPA shall be governed by the law of the EU Member State in which the Merchant is established, to the extent required by the GDPR. For Merchants located in the United Kingdom, this DPA shall be governed by the laws of England and Wales, to the extent required by the UK Data Protection Act 2018.
Any disputes arising under or in connection with this DPA shall be resolved in accordance with the dispute resolution provisions set out in the Terms of Service.
This DPA, together with the Terms of Service and Privacy Policy, constitutes the entire agreement between the parties with respect to the Processing of Personal Data and supersedes all prior or contemporaneous representations, understandings, agreements, or communications relating to the Processing of Personal Data.
If any provision of this DPA is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, the remaining provisions shall continue in full force and effect. The invalid provision shall be modified to the minimum extent necessary to make it valid and enforceable while preserving the parties' original intent.
Gemhubx may amend this DPA from time to time to reflect changes in applicable Data Protection Laws, industry standards, or our Processing activities. Material changes will be communicated to the Merchant via email or through the Service at least thirty (30) days before they take effect. The Merchant's continued use of the Service after the effective date of any amendment constitutes acceptance of the amended DPA.
The failure of either party to enforce any right or provision of this DPA shall not constitute a waiver of such right or provision. Any waiver must be in writing and signed by an authorized representative of the waiving party.
The Merchant may not assign or transfer its rights or obligations under this DPA without Gemhubx's prior written consent. Gemhubx may assign this DPA to any affiliate, successor, or acquirer of all or substantially all of its business or assets, provided that the assignee agrees to be bound by the terms of this DPA.
If you have questions about this Data Processing Agreement, wish to exercise your rights, or need to report a Security Incident, please contact us:
Gemhubx — Data Protection
Email: [email protected]
Website: https://gemhubapp.com
Support: [email protected]
For urgent Security Incident reports, please email [email protected] with the subject line "URGENT: Security Incident Report" and include as much detail as possible.