Skip to content

Data processing agreement

Last updated 6 November 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of service between the business using Heatwave (the Controller) and PixelFox Group AB, 559335-1157, Sweden (the Processor). It applies whenever Heatwave processes personal data about the Controller’s shoppers. You accept it by installing Heatwave. If you need a countersigned copy, email support@wearepixelfox.com.

1. Subject matter and duration

The Processor processes shopper data to provide Heatwave: heatmaps, session recordings, behaviour analysis, page speed reports and AI recommendations for the Controller’s Shopify store. Processing lasts as long as the app is installed, plus the deletion period in section 9.

2. Nature of the data

Data subjects: visitors to the Controller’s online store who allow analytics processing.

Categories of data (pseudonymous; no direct identifiers are collected):

  • a random visitor ID and visit ID stored in the shopper’s browser
  • device type, browser family, screen size and country (derived from the IP address, which is then discarded)
  • pages viewed (with query strings and tokens removed), referrer and campaign tags
  • clicks and taps, scroll depth, time on page sections, form field names and actions (never values)
  • cart and checkout events reported by Shopify, with product IDs and values
  • page speed measurements and website error fingerprints
  • for a share of visits, a replay of the page structure and the shopper’s movements, with typed input, hidden fields, emails, phone numbers, embedded frames and controller-specified elements masked in the browser

Special categories of data: none intended. The Controller must not configure Heatwave to collect them.

3. Controller instructions

The Processor processes personal data only on the Controller’s documented instructions. These instructions are this DPA, the Terms and the Controller’s settings in the app. The Processor will tell the Controller if it believes an instruction breaks data protection law.

4. Confidentiality

Everyone authorised to process the data is bound by confidentiality obligations.

5. Security

The Processor implements appropriate technical and organisational measures (GDPR Art. 32), including:

  • encryption in transit (TLS) and at rest
  • data minimisation and masking in the shopper’s browser before data is sent
  • consent gating through Shopify’s Customer Privacy API, plus Global Privacy Control and Do Not Track
  • removal of IP addresses on arrival, and redaction of tokens and personal data in URLs
  • separate encryption of storefront passwords
  • access limited to authorised staff on a need-to-know basis
  • per-store ingest keys and rate limits
  • automatic deletion at the end of each plan’s retention period

6. Sub-processors

The Controller gives general authorisation for the sub-processors listed on our sub-processors page. The Processor will give at least 30 days’ notice of new sub-processors. The Controller may object on reasonable data protection grounds; if the parties can’t resolve the objection, the Controller may terminate the affected service. The Processor remains responsible for its sub-processors.

7. International transfers

Where data is transferred outside the EU/EEA, the Processor ensures an adequate level of protection through an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses (2021/914), with supplementary measures where needed.

8. Assistance

Taking into account the nature of the processing, the Processor assists the Controller with:

  • responding to data subject requests; on request, the Processor will locate and delete data linked to a visitor ID the Controller provides
  • data protection impact assessments and prior consultations
  • security obligations and personal data breach notifications

9. Deletion and return

Data is deleted automatically at the end of the retention period of the Controller’s plan. When the app is uninstalled, all of the Controller’s data is deleted within 48 hours of Shopify’s shop deletion request. The Controller can delete all data at any time in Settings.

10. Personal data breaches

The Processor notifies the Controller without undue delay, and no later than 48 hours, after becoming aware of a personal data breach affecting the Controller’s data. The notice includes the information the Controller needs to meet its own obligations.

11. Audits

The Processor makes available the information needed to demonstrate compliance with this DPA. It allows audits, at most once a year, at the Controller’s cost and with 30 days’ notice, by an independent auditor bound by confidentiality. Written answers and existing reports are used first where they’re sufficient.

12. Liability and precedence

Liability under this DPA is subject to the limits in the Terms, except where the law doesn’t allow them. If this DPA and the Terms conflict on data protection, this DPA prevails.

13. Governing law

This DPA is governed by Swedish law.