Last updated: 3 August 2026
This Data Processing Agreement ("DPA") forms part of the terms under which JB CONSULTING SAS, 22 rue Spontini, 75116 Paris, France (the "Processor") provides services to the merchant (the "Controller") who installs the Allocator app on their Shopify store. It applies to the extent the GDPR or similar data protection laws apply to the processing.
The Processor processes store data solely to provide the Allocator service (stock allocation suggestions, transfer execution and tracking, outcome measurement), for as long as the app is installed, plus the 48-hour redaction window after uninstall. Retention during that period is bounded per category of data, as set out in section 6 of the privacy policy; those durations are read from the code that enforces them.
The Processor does not collect customer personal data from Shopify. Sales are read aggregated per product variant, location and day, with no customer identifier, and the app does not request the scopes that would return one. The only personal data the Processor handles on its own account is the Controller's store identity (store domain, contact email provided by Shopify).
One exception, stated plainly. The app exposes a single free-text field — the optional note on an in-store restock request, on the store page and on the Shopify POS tile — into which a member of the Controller's staff types context in their own words. The interface instructs them not to enter customer names or contact details, and the Processor strips email addresses and digit runs bearing the marks of a phone or reference number from the note before storing it. That filter is a safety net and is described as such in section 9 of the privacy policy: it cannot detect a name written in prose, and it deliberately does not touch digits written in the same shape as a run of garment sizes. Any personal data that nevertheless reaches that field is entered on the Controller's own instruction and under the Controller's responsibility; the Processor stores it, displays it only to the Controller's own head office, deletes it with the rest of the Controller's data, and will erase it earlier on request.
shop/redact webhook), or on request at any time — except the minimal compliance record described in section 7 of the privacy policy, which is what evidences the deletion, and in which the store domain is kept only as a one-way keyed fingerprint.The Controller authorizes the following subprocessors:
The Processor will inform the Controller of any intended change to this list.
Klaviyo — withdrawn from this list on 3 August 2026. Until that date, Klaviyo received data only when the Controller entered their own Klaviyo API key in the app settings; in that case Allocator sent product and store metadata (product title, size, SKU, store name, quantity received) to the Controller's own Klaviyo account. No customer data was sent, and the event was attached to a service profile, never to a customer. The integration has since been removed from Allocator: no data is sent to Klaviyo any longer, and the app no longer offers a way to enter a Klaviyo key. A key entered before that date is read by no part of the app; as with all Controller data, it is erased on request at support@getallocator.com (section 4).
The subprocessors listed above are established outside the European Union. The Controller may request the current transfer documentation at any time at support@getallocator.com.
The Processor assists the Controller in fulfilling data subject requests (not applicable in practice, as no customer personal data is stored) and makes available the information necessary to demonstrate compliance with this DPA.