This Data Processing & Security Schedule ("Schedule") describes how Motina currently processes, stores, protects and deletes personal data.

It is incorporated by reference into the Motina Data Processing Addendum and is also referenced by the Motina Privacy Policy.

This Schedule is intended to be Motina's primary source of factual information about:

• the data Motina processes;
• the purposes of processing;
• categories of data subjects;
• retention periods;
• processing and storage locations;
• storefront tracking technologies;
• relevant service providers and sub-processors;
• deletion procedures; and
• technical and organisational security measures.

This Schedule describes Motina's current production processing arrangements. Future or planned controls are not described as implemented until they are in operation.

Part A — Data Processing Schedule

1. Roles

Depending on the processing activity, Yoghurt Pot Limited may act as either a controller or processor.

Motina as controller

Yoghurt Pot Limited generally acts as controller for personal data used for Motina's own business purposes, including:

• merchant account administration;
• subscription administration;
• merchant authentication and sessions;
• merchant communications and notifications;
• customer support;
• security and fraud prevention;
• operation of Motina;
• legal and business administration.

Motina as processor

Yoghurt Pot Limited generally acts as processor where it processes information about a merchant's customers or storefront visitors in order to provide Motina to that merchant.

The merchant generally acts as controller for that processing.

2. Shopify access

Motina currently requests the following Shopify scopes:

• read_products;
• read_inventory;
• read_orders;
• write_pixels;
• read_customer_events.

The write permission is used for Motina's storefront analytics integration. Motina does not use these permissions to modify a merchant's products, inventory, orders, themes or other store content.

Motina does not request dedicated access to:

• customer records;
• themes;
• discounts;
• fulfilments.

Information relating to customers, discounts and fulfilment status may nevertheless be included within order information made available through read_orders.

Motina applies an ingestion allow-list so that information supplied by Shopify but not required by Motina is discarded rather than persistently stored.

3. Processing activities

Merchant account and store administration

Data subjects: Merchants and authorised merchant users.

Data processed may include:

• Shopify store domain;
• shop-owner email address;
• notification email address;
• account and subscription status.

Motina does not ordinarily store merchant or staff names received from Shopify.

Purpose:

• provide and administer Motina;
• associate the Motina account with the relevant store;
• communicate service information and reports;
• administer subscriptions and account status.

Motina's role: Controller.

Retention: While the account or store relationship remains active, subject to applicable deletion and business-record requirements.

Merchant authentication and sessions

Data subjects: Merchants and authorised merchant users.

Data processed may include:

• IP address;
• user agent;
• session identifier;
• authentication and session metadata.

Purpose:

• authentication;
• session management;
• account security;
• abuse prevention.

Motina's role: Controller.

Retention: Authenticated application sessions normally expire after approximately 120 minutes.

Products, variants and inventory

Data processed may include:

• product and variant identifiers;
• product title;
• handle;
• publication status;
• price;
• image URL;
• variant options;
• inventory quantity;
• inventory location.

This information will not normally constitute personal data, but forms part of the Merchant Data processed by Motina.

Purpose:

• product and inventory analysis;
• calculating metrics;
• identifying findings and opportunities;
• producing recommendations and supporting evidence.

Motina's role: Processor in relation to Merchant Data processed to provide the Service.

Retention: Current product, variant and inventory state is retained while the merchant uses Motina and is subject to deletion following uninstall or other applicable deletion instructions.

Orders and refunds

Data subjects: Customers and people associated with orders.

Data processed may include:

• Shopify order identifier;
• order timestamps;
• order values and totals;
• line items;
• product identifiers;
• product titles;
• quantity;
• price and subtotal;
• discount codes;
• refund information;
• Shopify customer identifier;
• customer email address.

Purpose:

• order and revenue analysis;
• product performance analysis;
• conversion analysis;
• calculating metrics and trends;
• linking storefront activity to resulting orders;
• generating findings, opportunities and recommendations.

Motina's role: Processor.

Retention: Up to 2 years.

Storefront analytics

Data subjects: Storefront visitors, prospective customers and customers.

Data processed may include:

• page views;
• product views;
• add-to-cart events;
• checkout-stage events;
• page path;
• page title;
• URL;
• referring URL;
• UTM parameters;
• product and variant identifiers;
• browser or user-agent information;
• pseudonymous visitor identifier;
• pseudonymous session identifier.

Purpose:

• understand storefront behaviour;
• measure product and store performance;
• identify conversion issues and opportunities;
• associate activity within and across relevant sessions;
• link storefront behaviour to resulting orders;
• generate findings and recommendations.

Motina's role: Processor.

Retention: Up to 2 years.

Visitor-to-customer association

Data subjects: Storefront visitors and customers.

Data processed may include:

• pseudonymous visitor identifier;
• pseudonymous session identifier;
• Shopify customer identifier;
• customer email address;
• order association.

Purpose:

• associate storefront activity with subsequent purchases;
• understand conversion journeys;
• calculate analytics used by Motina;
• support findings and recommendations.

Motina's role: Processor.

Retention: Up to 2 years.

Findings and recommendations

Motina derives findings, supporting evidence and recommendations from Merchant Data.

These records may include:

• calculated metrics;
• product information;
• store performance information;
• identified trends or anomalies;
• supporting evidence;
• recommended actions;
• diagnostic information relating to the analysis performed.

Purpose: Provide the core Motina analytics and recommendation service.

Motina's role: Generally Processor where findings are derived from data processed on behalf of a merchant.

Retention: Retained while required to provide Motina and removed through the applicable store/account deletion process.

A fixed automatic maximum retention period is not currently applied to this dataset.

To-dos and merchant feedback

Motina may store:

• tasks created by merchant users;
• references to related findings or products;
• feedback such as thumbs-up or thumbs-down;
• the merchant user associated with the action.

Purpose:

• provide task-management functionality;
• remember merchant actions and preferences;
• improve the usefulness and operation of Motina.

Motina's role: Controller for merchant-user/account interaction information; Processor to the extent user-entered content contains Customer Personal Data.

Retention: While reasonably required to provide the Service, subject to account deletion and applicable retention rules.

4. Data minimisation

Shopify order payloads can contain more customer information than Motina requires.

Motina uses an ingestion allow-list rather than storing the complete Shopify customer or order payload.

Motina does not persistently retain the following customer fields from Shopify order payloads:

• customer name;
• postal or billing address;
• telephone number;
• customer tags;
• marketing-consent state;
• lifetime customer order count.

Motina retains the customer information required for its analytics, including the Shopify customer identifier and customer email address where required.

Unrequired fields are discarded during ingestion rather than retained and filtered later.

5. Storefront identifiers and browser storage

Motina's storefront analytics currently use browser local storage for pseudonymous visitor and session identifiers.

The current identifiers are:

Motina may also associate a storefront session with Shopify cart or order information so that browsing activity can subsequently be connected to a resulting order.

These identifiers do not themselves contain a person's name or email address.

The identifier names may change as the Service evolves. The current names shown above reflect the deployed implementation at the date of this Schedule.

6. Storefront consent

Motina uses Shopify's customer privacy functionality to determine whether eligible storefront analytics may operate.

Where analytics consent is required and has not been provided:

• Motina does not create or use its normal pseudonymous analytics identifiers; and
• identifiable or linkable storefront analytics are not collected through those identifiers.

Motina may process anonymous aggregate event counts which do not identify or distinguish an individual visitor.

Where applicable law does not require prior analytics consent, processing may operate in accordance with the merchant's Shopify privacy configuration.

The merchant remains responsible for configuring its storefront privacy settings and providing any notices or consent mechanisms required for its use of Motina.

7. IP addresses

Storefront visitors

Motina does not ordinarily retain storefront visitor IP addresses as part of its analytics dataset.

An IP address may be processed temporarily for security, abuse-prevention, rate-limiting, diagnostic or operational purposes.

Motina does not use storefront visitor IP addresses to build visitor profiles.

Merchant users

An authenticated merchant's IP address and user agent may be processed as part of authentication, session management and account-security functions.

Active session records normally expire after approximately 120 minutes.

8. Processing and storage locations

Motina's currently verified principal production infrastructure is:

Customer Personal Data stored within Motina's analytics warehouse is currently hosted in the European Economic Area, including data relating to merchants outside the EEA.

Additional providers may process limited information where separately identified in this Schedule.

The location of primary storage does not necessarily mean that information can never be accessed or processed from another country. Motina and authorised providers may process information internationally subject to the safeguards described in the Data Processing Addendum.

9. Retention schedule

The following reflect Motina's currently implemented principal retention periods:

Where an automatic retention limit is stated, it reflects the retention control currently applied to that dataset.

Information may be retained longer where required by law or reasonably necessary to establish, exercise or defend legal claims.

10. Subscription expiry and uninstall

Ending a paid subscription and uninstalling Motina are treated differently.

Subscription ends but Motina remains installed

A temporary billing issue does not necessarily cause Motina to stop processing immediately.

Motina may continue providing some or all functionality for a reasonable grace period while a billing issue is resolved.

Where a subscription is cancelled or otherwise ends but Motina remains installed:

• functionality may continue for a limited continuity period;
• existing findings and opportunities may remain available temporarily;
• Motina may temporarily continue importing, processing or analysing store data to support continuity or reactivation.

These periods are operational rather than guaranteed contractual service periods.

Motina is uninstalled from Shopify

When a merchant uninstalls Motina:

1. Motina's access to the Shopify store ends;
2. monitoring stops;
3. the account enters the applicable deletion workflow;
4. Shopify sends the relevant privacy deletion request;
5. applicable Merchant Data and Customer Personal Data are erased from active Motina systems.

Deleted information may remain within protected backups for up to 30 days, after which the relevant backup copies are rotated out.

Backup copies are maintained for recovery purposes and are not used to continue ordinary processing after information has been removed from active systems.

11. Individual Shopify privacy requests

Motina supports Shopify's privacy mechanisms for:

• customer data requests;
• customer deletion requests;
• store deletion requests.

Motina can identify and remove relevant customer information from its applicable systems in response to valid deletion requests.

12. Service providers and sub-processors

This section identifies providers currently used in circumstances relevant to personal-data processing.

Providers are included according to their actual role rather than merely because Motina has an account or commercial relationship with them.

Core Service sub-processors

Controller-side service providers

Resend is used for communications with Motina merchants and is not ordinarily used to process the underlying customer data of merchants.

Other providers will be added to this Schedule when their processing of personal data in connection with the production Service has been confirmed.

Services used solely for functions such as domain-name resolution are not treated as Customer Personal Data sub-processors unless their actual use involves processing Customer Personal Data on Motina's behalf.

13. International processing

Although Motina's primary production infrastructure is currently located in the United Kingdom and European Economic Area, relevant providers may operate internationally or use sub-processors in other jurisdictions.

Personal data may therefore be processed outside its primary storage region.

Where a restricted international transfer occurs, an applicable transfer mechanism is used where required by law.

Further contractual provisions relating to international transfers are contained in the Motina Data Processing Addendum.

Part B — Technical & Organisational Measures

14. Security programme

Motina maintains technical and organisational measures designed to protect personal data against accidental or unlawful loss, destruction, alteration, disclosure or access.

The controls below are described at a high level. Detailed security configuration and operational procedures are maintained internally.

15. Transmission security

Motina uses encrypted connections for relevant production communications, including access to the Service and communications with ecommerce platforms and hosted data services.

16. Protection of stored information

Motina applies security controls intended to protect personal data stored within production systems against unauthorised access or disclosure.

Sensitive credentials and integration information receive additional protection appropriate to their nature.

The precise technical configuration of these controls is maintained internally.

17. Access control

Access to production systems and Customer Personal Data is restricted to authorised people with a legitimate operational need.

Motina maintains controls designed to ensure that:

• production access is appropriately authenticated;
• access is limited according to operational requirements;
• access can be removed when no longer required;
• reads of protected customer data through the application are recorded in an access log, retained as evidence and not removed when a store is deleted;
• relevant access and security events can be investigated;
• authorised personnel are subject to confidentiality obligations.

The access log records reads of protected customer data made through the application. Access to the underlying infrastructure is restricted to a single operator over key-based authentication and is logged by the operating system rather than by Motina.

18. Environment separation

Motina separates production systems from development and testing environments.

Production Customer Personal Data is not intentionally used as development or test data.

19. Application and integration security

Motina uses measures designed to:

• authenticate integrations with supported ecommerce platforms;
• validate relevant inbound communications;
• limit unauthorised or abusive access;
• protect authenticated application sessions;
• safeguard integration credentials.

Detailed authentication methods and security configuration are not published.

20. Data minimisation

Motina reduces the amount of personal data it processes where reasonably possible.

Measures include:

• limiting ecommerce data ingestion to required fields;
• discarding unnecessary customer information before persistent storage;
• avoiding persistent use of storefront visitor IP addresses for analytics;
• using pseudonymous identifiers where appropriate;
• applying implemented retention periods.

21. Logging

Motina maintains operational and security records used for purposes including:

• fault investigation;
• security investigation;
• abuse prevention;
• operational troubleshooting.

Application, diagnostic and security logs are currently retained for approximately 14 days.

22. Retention and deletion controls

Motina uses automated or operational controls to apply the retention periods stated in this Schedule.

Where a fixed automatic retention period is not currently implemented, this Schedule does not represent one as being in place.

Deletion processes support:

• customer privacy requests;
• store deletion requests;
• account deletion;
• downstream data deletion;
• removal from active systems;
• eventual expiry from backup systems.

23. Backups and resilience

Motina maintains backup and recovery arrangements for applicable production information.

Deleted information may remain within backup copies for up to 30 days before those copies are rotated out.

24. Production data handling

Motina maintains internal practices intended to restrict unnecessary access, copying or exporting of Customer Personal Data.

Production information is accessed only where reasonably required for legitimate operational purposes.

Detailed access and operational procedures are not published.

25. Security incident management

Motina maintains procedures for assessing and responding to suspected security incidents and Personal Data Breaches.

These include appropriate processes for:

• assessment;
• containment;
• investigation;
• remediation;
• escalation;
• determining whether notification is required.

Detailed incident-response procedures are maintained internally.

26. Service-provider management

Motina considers the nature of personal-data processing performed by relevant service providers and applies contractual data-protection arrangements where required.

A provider is not listed as a sub-processor merely because Motina uses that provider for an unrelated service.

27. Artificial intelligence

Motina does not currently send Merchant Data or Customer Personal Data to an external generative artificial-intelligence provider as part of the production Service.

If this changes, the relevant processing arrangements will be assessed and this Schedule updated where required.

28. Internal documentation

Motina maintains or develops non-public operational documentation relating to matters such as:

• production access;
• incident response;
• infrastructure security;
• data-loss prevention;
• vulnerability management;
• retention and deletion.

These documents may contain confidential operational or security information and are not incorporated into this public Schedule.

29. Changes to this Schedule

Motina may update this Schedule as its actual processing arrangements change.

The current version and effective date will be published with the Schedule.

Where a change affects rights or obligations under the Data Processing Addendum, including the appointment of a new relevant sub-processor, the applicable provisions of the DPA will apply.

Previous versions may be retained to provide a record of material historical processing arrangements.

30. Contact

Questions about this Schedule or Motina's processing of personal data can be sent to:

Yoghurt Pot Limited Company number: 12105928 Registered in England and Wales 45 Tameside Stokesley TS9 5PE United Kingdom

Privacy: privacy@motina.co.uk General enquiries: support@motina.co.uk Website: motina.co.uk