Data Processing Addendum
This addendum describes TicoSync's processing of personal data for a Shopify merchant.
Roles and instructions
The merchant is the responsible party for customer and order data; TicoSync processes that data only to provide the configured invoicing service, follow documented merchant instructions, meet legal obligations, and protect the service.
Data and purpose
Processing includes merchant configuration and signing credentials; customer identity, contact, address, and order data; tax XML, Hacienda responses, PDFs, delivery status, and security logs. Processing is limited to generating, signing, transmitting, storing, delivering, supporting, and securing electronic tax documents.
Security and assistance
TicoSync uses access controls, encryption in transit and at rest, authenticated encryption for signing secrets, private document storage, signed document links, backups, logging, and credential deletion controls. TicoSync will reasonably assist the merchant with data-subject requests, security incidents, and evidence needed to demonstrate compliance.
Subprocessors and transfers
Authorized subprocessors are Amazon Web Services (hosting, database, storage, and backup in the United States) and Resend (transactional email). Shopify is the merchant's commerce platform and source system. Hacienda is the government recipient of tax submissions. TicoSync remains responsible for directing subprocessors consistently with this addendum and will update this list when material providers change.
Return, deletion, and retention
Merchants can export available tax documents. TicoSync deletes active signing credentials on replacement, uninstall, or shop-redaction. Tax records that must be preserved remain subject to the retention period in the Privacy Policy; legally required retention takes priority over a deletion request. Backup copies age out through the applicable recovery cycle.
Effective date and contact
This addendum forms part of the TicoSync terms when a merchant uses the service. Contact miller.thomas.j@gmail.com for privacy or processing requests. Effective September 4, 2026.