Huntry Data Processing Agreement
Version 2
This Data Processing Agreement ("DPA") is between NYTT AB, Malmskillnadsgatan 44, 111 57 Stockholm, Sweden ("NYTT"), and the business that installs Huntry on its Shopify store and accepts this DPA ("Merchant"). It applies whenever NYTT processes personal data of the Merchant's customers on the Merchant's behalf through Huntry.
How it is agreed. The Merchant accepts this DPA together with the Huntry Terms of Service, of which it forms part, by clicking Accept in the Huntry admin. Huntry doesn't activate a hunt for a store until it has accepted the current version of both documents. NYTT records the store, the Shopify staff account that accepted, the version of each document and the time.
1. Scope and roles
1.1 NYTT processes personal data of the Merchant's customers who play the Merchant's hunts ("Players") on the Merchant's behalf, to provide Huntry. For that data, described in Annex 1, the Merchant is the controller and NYTT is the processor.
1.2 NYTT's own records of running Huntry are not covered by this DPA: the store's account and plan records, server logs, records of handled privacy requests, and the record of this acceptance. NYTT is the controller for them, as described in the Privacy Policy.
1.3 Shopify is not NYTT's subprocessor. The Merchant's store, customers, orders and the reward discounts live in Shopify under the Merchant's own agreement with Shopify; Huntry writes the reward discounts into the store through Shopify's Admin API.
2. Instructions and purpose
2.1 NYTT processes Player data only on the Merchant's documented instructions, including with regard to transfers of personal data outside the EEA. The Merchant's instructions are this DPA and the Merchant's configuration of Huntry (hunts, treasures, rules, rewards and access codes).
2.2 NYTT processes Player data only to provide and secure Huntry and to comply with the law. NYTT doesn't sell Player data, use it for advertising, or use it for any purpose of its own. The automated checks described in Annex 1 (distance, GPS accuracy, travel speed and claim limits) are part of the service the Merchant configures, and decide only whether a claim is accepted.
2.3 NYTT tells the Merchant if, in its opinion, an instruction infringes data protection law, unless the law prohibits that.
2.4 If the law requires NYTT to process Player data in another way, NYTT informs the Merchant first, unless that law prohibits it.
3. Confidentiality
NYTT limits access to Player data to the people who need it to provide or secure Huntry, and they are bound by confidentiality.
4. Security
NYTT applies the technical and organisational measures in Annex 2 and may improve them, as long as protection isn't reduced.
5. Subprocessors
5.1 The Merchant authorises the subprocessors in Annex 3.
5.2 NYTT gives at least 30 days' notice of a new or replacement subprocessor before it starts processing Player data. NYTT publishes a new version of this DPA with the updated Annex 3 on this page, and emails the shop owner's address that Shopify holds for the store. The Merchant accepts the new version in the Huntry admin before its next hunt goes live. If the Merchant objects on reasonable data protection grounds and this can't be resolved, the Merchant may stop using Huntry and uninstall it.
5.3 NYTT imposes data protection obligations on each subprocessor equivalent to those in this DPA, and remains responsible to the Merchant for them.
6. Requests from Players
6.1 NYTT assists the Merchant in answering Players' requests to exercise their rights, taking into account the nature of the processing.
6.2 Requests reach NYTT in two ways: through Shopify's privacy webhooks, which Huntry handles automatically for deletion and records for data exports; or from the Merchant by email to support@huntry.io, with the store and the Player's Shopify customer ID. NYTT acts on each request without undue delay, and in any event within 30 days of receiving it, so that the Merchant can meet its own deadlines.
6.3 If a Player contacts NYTT directly about Player data, NYTT refers them to the Merchant and doesn't answer the request itself without the Merchant's instruction, unless the law requires otherwise.
7. Personal data breaches
7.1 NYTT notifies the Merchant without undue delay after becoming aware of a personal data breach affecting Player data, with the information Article 33(3) GDPR requires as it becomes available.
7.2 NYTT assists the Merchant with notifications to supervisory authorities and Players, and with data protection impact assessments and prior consultations where required, taking into account the information available to NYTT.
7.3 NYTT keeps a record of personal data breaches and contacts the Merchant at the shop owner's email address that Shopify holds for the store. Huntry reads it from Shopify when the store signs in and when it accepts this DPA.
8. End of service: deletion and return
8.1 When the Merchant uninstalls Huntry, Shopify sends NYTT a shop deletion request 48 hours later, and NYTT deletes the data it holds for that store, Player data included. If the store appears to have reinstalled Huntry, or the uninstall can't be confirmed, NYTT checks before deleting. Point-in-time recovery and scheduled backups are not enabled for Huntry's database.
8.2 Before uninstalling, the Merchant may ask support@huntry.io to return its Player data. NYTT confirms the request with the shop owner's email address that Shopify holds for the store, and sends the Player data described in Annex 1, in a machine-readable format (JSON), to that address through a private channel within 30 days. Otherwise NYTT deletes it as in 8.1.
8.3 NYTT may keep Player data only where EU or Swedish law requires it, and only for that purpose.
8.4 Reward discounts already created in the Merchant's Shopify store stay there; they are the Merchant's data in Shopify.
9. Information and audits
9.1 NYTT answers the Merchant's reasonable written questions and provides the documents needed to show compliance with Article 28 GDPR.
9.2 If that isn't enough, the Merchant, or an independent auditor it appoints who is bound by confidentiality, may carry out an audit once a year, with at least 30 days' written notice, during business hours and at the Merchant's cost. An audit is limited to Huntry's processing of the Merchant's Player data and to what is necessary for it, and never gives access to other customers' data.
9.3 These limits don't apply where a supervisory authority or applicable law requires an audit, or after a personal data breach affecting the Merchant's Player data.
10. Location and international transfers
Player data is stored in the European Union (Google Cloud, region europe-west1, Belgium). Server logs are stored in Google Cloud Logging's global location, which isn't limited to the EU, and the platform's request logs can include the Shopify customer ID. Where Google processes Player data outside the EEA, Google's data processing terms for Google Cloud and Firebase provide the transfer safeguards, such as the EU Standard Contractual Clauses; which safeguard applies to a given transfer is set by those terms (Google's Cloud Data Processing Addendum and Firebase Data Processing and Security Terms).
11. Liability, term and precedence
This DPA applies while NYTT processes Player data for the Merchant. If it conflicts with the Huntry Terms of Service on data protection, this DPA prevails. Liability under this DPA is subject to the limitations in the Terms of Service, except where the law doesn't allow them to be limited, including liability to Players under Article 82 GDPR.
12. Governing law
This DPA is governed by Swedish law, and disputes are settled by the courts of Stockholm, Sweden, subject to mandatory law.
Annex 1: Description of the processing
| Data subjects | The Merchant's customers who are logged in to the Merchant's store and play a Huntry hunt. |
|---|---|
| Personal data | Shopify customer ID (the only identifier; Huntry stores no names, emails, phone numbers or postal addresses). Location consent: given or withdrawn, time, text version. Hunt participation: hunts joined, treasures claimed, number of claims, whether the hunt's access code was entered (not the code). Claims: treasure, time, rounded distance to the treasure, phone GPS accuracy. The position and time of the Player's last claimed treasure (the treasure's position, used for the travel-speed check). Rewards won: a copy of the reward, the single-use Shopify discount code and ID, and its state. Claim attempts: treasure, outcome, time. Short-lived rate-limit counters. |
| Location data | The phone's position is sent to Huntry only when a Player claims a treasure, to check the distance; it is used and not stored. Claims and the last-claim record still show that the Player was near a given treasure at a given time. |
| Special categories | None intended. |
| Nature and purpose | Running the Merchant's hunts: joining, access codes, automated claim checks (within the treasure's claim radius, sufficient GPS accuracy, travel speed since the last claimed treasure, claim limits), creating each reward as a single-use, customer-locked Shopify discount, the Player's treasure chest, the Merchant's claims view, and protecting the hunt from abuse. |
| Duration | As in Annex 4, and in any case until the Merchant uninstalls Huntry (8.1). |
| Location | Google Cloud region europe-west1 (Belgium) for the database and servers; server logs in Cloud Logging's global location, kept 30 days (section 10). |
Annex 2: Technical and organisational measures
- Minimisation: the Shopify customer ID only; no names or contact details; raw GPS positions not stored; access codes stored only as a one-way hash. Huntry's own log entries contain no customer IDs, access codes or discount codes; the platform's standard request logs can contain the customer ID (section 10).
- Shopify access: Huntry asks Shopify only for
write_discountsandwrite_files; no customer or order scopes. - Store isolation: every record is stored under the store it belongs to, and every server path is built from the request's verified store.
- Request authenticity: storefront requests come through Shopify's App Proxy and are checked against Shopify's signature; webhooks are checked by HMAC; admin requests use Shopify session tokens.
- Database access: browsers can't write to the database, and can read only a hunt's public layout (once the hunt has started) and its live state, neither of which holds customer data.
- Secrets and encryption: the app's Shopify API secret is held in Google Secret Manager; stores' Shopify access tokens are kept in the database, which Google Cloud encrypts at rest; all traffic uses HTTPS.
- Abuse limits: per-Player rate limits on claims, joining, access codes and applying rewards; server-side distance, accuracy, speed and claim-limit checks.
- Deletion: privacy webhooks for customer and shop deletion, and automatic deletion after fixed retention periods, once a day (Annex 4).
Annex 3: Subprocessors and other recipients
| Recipient | Role | What it receives | Location |
|---|---|---|---|
| Google (Google Cloud and Firebase: Firestore, Cloud Functions and Cloud Run, Cloud Logging, Cloud Scheduler, Secret Manager, Firebase Hosting) | Subprocessor: hosting, database, servers and logs (terms: section 10) | All Player data in Annex 1 | Database and servers in europe-west1 (Belgium); logs in Cloud Logging's global location; Hosting serves static files from Google's global network |
| OpenFreeMap, the free default map service bundled with Huntry, operated by Hyperknot Software Kft., Hungary | Not a subprocessor: it doesn't process data on NYTT's behalf. Players' browsers load map tiles directly from it, and NYTT sends it no data and gives it no instructions; it handles those requests under its own privacy policy and terms. Its performance and future availability aren't guaranteed. The Merchant can choose Google Maps instead in Settings. | Players' IP addresses, browser details and the map area viewed, from their browsers | Not stated by OpenFreeMap; it says it may use Cloudflare |
| Google Maps Platform (only if the Merchant chooses it) | Not a subprocessor: used with the Merchant's own Google Maps API key and Map ID, under the Merchant's own Google account, which Google charges | As above, from browsers | Google's |
Annex 4: Retention of Player data
NYTT deletes Player data automatically, once a day:
- claims and hunt participation: 120 days after the hunt ends;
- claim attempts: after 120 days;
- short-lived counters of attempts (rate limits): after 2 days;
- rewards won: kept while the Player can still use them. Once 120 days have passed since the hunt ended, a reward is deleted only after Shopify confirms its discount can no longer be used (expired, used, or removed). NYTT doesn't delete the discount itself: it stays in the Merchant's Shopify admin;
- location consent records: until the Merchant or a Player asks for deletion (section 6), or the Merchant uninstalls Huntry (section 8).
A deletion request (section 6) or an uninstall (section 8) deletes Player data whatever these periods.