Data processing agreement — Matrix Rewards
Between Matrix Health Group Ltd ("we", the processor) and the merchant who installs Matrix Rewards ("you", the controller).
Version 2. In force from 26 September 2026.
This is the agreement referred to by Shopify's protected-customer-data application. It takes effect when you install the app.
1. Who is who
You are the controller of your shoppers' personal data: it is your relationship with them and your decision what the loyalty programme does. We are your processor: we hold and use that data only to run the programme for you.
2. What we process, and nothing else
Personal data:
- Your shopper's email address, always — the wallet is keyed on it.
- The Shopify customer id they are known by at each of your stores.
- The day and month of their birthday, only if you offer a birthday bonus AND the shopper chooses to give it. We never ask for the year.
We do not request or store their name, phone number or address, or any payment details. Alongside those fields we hold the points balance, the ledger of movements behind it, the reward codes issued, the amount each order earned on and the amounts refunded, which shoppers invited which, the points-expiry warnings each shopper was shown, and any request a shopper makes to delete their rewards account.
If a shopper signs in on our website, app.matrixrewards.co.uk, to see their points, the sign-in records (their email address and the times they signed in) are ours, not yours: we are the controller of those.
If you create API keys, connect an AI assistant, or register webhooks, what your systems or the assistant read through them goes where you take it. Webhook events we send carry an internal member reference, never an email address; a connected assistant's access lasts up to 90 days unless you end it sooner.
We use the data for exactly one purpose: running your loyalty programme. We do not sell it, share it for anyone's marketing, use it to train models, or use it to build a profile of a person across merchants who are not yours.
3. Your instructions
We process on your documented instructions, which in practice are the settings you choose in the app and this agreement. If we ever believe an instruction breaks data protection law, we will tell you rather than carry it out.
4. Security
- TLS everywhere, with the database certificate verified rather than merely accepted.
- Encryption at rest by the hosting platform; your Shopify access token (and any webhook signing secret) separately encrypted by us with AES-256-GCM under a key that exists only in the server environment.
- The database accepts connections only from our application; everything else is rejected.
- Every read of a shopper's details — in your Shopify admin, on your merchant page at app.matrixrewards.co.uk, or through a key or assistant you connect — is logged first; if it cannot be logged, nothing is returned. The logs keep a member reference, never a shopper's email, and are deleted after 12 months.
- API keys are stored only as a salted one-way hash; a stolen copy of the database does not yield a usable key.
- Every shopper record carries the merchant account it belongs to, every read names that account, and our tests place a rival merchant's matching shoppers in the same tables and fail if anything crosses.
- Test and development runs never touch production data. There is no copy of it anywhere else.
5. Your staff, and ours
In your Shopify admin, your Shopify staff permissions decide who can open the app; we enforce them through Shopify's own session tokens. Your merchant page at app.matrixrewards.co.uk opens only for the email address Shopify names as the owner of every store on your account, signed in with a code we email to it. Any staff member who can open the app can create API keys; you can see and revoke every key and connection. We never see or hold your staff's passwords.
On our side, one person, the company director, can reach the production database. A small number of named people can open our staff console, which shows stores and totals, never a shopper's details.
6. Sub-processors
| Who | What for | Where |
|---|---|---|
| Shopify | Your store, orders and customer records; the app runs inside their admin | Their own terms apply, and you already have an agreement with them |
| DigitalOcean | Hosting and the database | London (LON1) |
| Cloudflare | Delivers the one-time sign-in codes we email (the email address and the code); our host serves the app through Cloudflare's network | Cloudflare's global network, under its data processing terms and UK transfer safeguards |
Data is stored only in the UK; sign-in emails pass through Cloudflare. We will tell you before adding or changing a sub-processor, and you may object.
7. Your shoppers' rights, and how we help
- Access or portability — when Shopify sends us a
customers/data_request, you download the shopper's record from your merchant page at app.matrixrewards.co.uk: their email address, balance, birthday, the stores they are known at, every points movement and what each order earned on, their orders' refunds, their reward codes and referral codes, the points-expiry warnings they were shown, and any request they made to delete their rewards account. (Their sign-ins on our own website are ours, not yours, and are answered by us.) - Erasure — we answer Shopify's
customers/redactby erasing the shopper, points history included. A shopper can also ask to delete their rewards account on the rewards page in their account at your shop; we carry that out as you choose in the app (automatically ten days after they ask, or when you approve it). That path keeps the movements of points without anything that identifies the shopper, only as totals in your reports. - Correction — through the app, or by asking us.
We answer these within Shopify's required windows, and we will help you meet any request that comes to you directly.
8. If something goes wrong
We will tell you without undue delay after becoming aware of a breach affecting your shoppers' data: what happened, what data was involved, what we have done, and what you should do. We will not wait until we have a complete picture to tell you there is one.
9. Retention, and what happens when you leave
While your programme is live, we keep what it needs. Your Shopify access token is destroyed at uninstall — a database rule makes an uninstalled store holding a live token impossible to represent.
When you uninstall, we erase your shoppers' data and your store's settings 30 days after you uninstall (Shopify tells us after 48 hours; we wait out the rest). It is later only if the store is still active through us, or we must keep it for a legal claim. Until then the store owner can download every customer and the full points history from app.matrixrewards.co.uk/merchant. You can also ask us to erase sooner; we complete it within 30 days of your request.
The access logs are kept for 12 months and then deleted automatically. They hold no email addresses.
10. Audit
You may ask us, once a year, for evidence that we do what this agreement says — the security measures, the sub-processor list, the retention behaviour. We will answer in writing. We hold no third-party certification (no SOC 2, no ISO 27001) and do not claim one.
11. Contact
support@matrixhealthgroup.co.uk — data protection questions, shopper requests, and security reports.
Matrix Health Group Ltd is registered in England and Wales, company number 17099304, VAT registration number GB 523 7816 82, registered office Paddock Business Centre, 2 Paddock Road, Skelmersdale, Lancashire, WN8 9PL.