Legal
Data Processing Agreement
Last updated: September 14, 2026 · Governing law: New Mexico, United States
This agreement applies whenever Onyx Checkout processes personal data of your buyers on your behalf. It forms part of the Terms of Service and satisfies Article 28 of the GDPR. You are the controller; Horizon International LLC is the processor.
1.What we process, and why
Only what the checkout needs to work, and only on your instructions — which are these Terms and the settings you choose in the product.
- Buyer identity and contact: name, email address, phone number where you ask for it.
- Addresses: billing and shipping addresses entered at checkout.
- Order data: items, quantities, prices, currency, discounts, order status.
- Technical data: IP address, browser, and the advertising identifiers carried by the pixels you enable.
Card data never reaches us
2.Duration
We process buyer data for as long as your account is active, and delete or return it within 30 days of termination, unless the law requires us to keep it longer.
3.Confidentiality and security
Access is limited to the people who need it to run the service, each bound by confidentiality. Data is encrypted in transit, secrets are encrypted at rest, access to production is restricted and logged, and backups are taken daily.
4.Sub-processors
You authorise the following sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting and delivery | United States, EU |
| Supabase Inc. | Database, authentication and file storage | European Union |
| Whop Inc. | Payment processing and subscription billing | United States |
| Shopify Inc. | Store, catalogue and order data (your own account) | United States, Canada |
We give at least 30 days’ notice before adding one. If you object on reasonable data protection grounds, you may terminate without penalty for the remainder of your period.
5.International transfers
Where a sub-processor is outside the EEA, transfers are covered by the European Commission’s standard contractual clauses.
6.Helping you meet your obligations
- If a buyer exercises a right with us directly, we pass the request to you rather than answering it ourselves.
- We give you the tools and information you reasonably need for data subject requests, and for a data protection impact assessment where one is required.
- We notify you without undue delay, and in any case within 72 hours of becoming aware, of a breach affecting your buyers’ data, with what we know and what we are doing about it.
7.Audit
On reasonable written notice, and no more than once a year unless a regulator requires otherwise, we will provide the information needed to demonstrate compliance with this agreement.
8.Your side of it
You confirm that you have a lawful basis for the data you send us, that your privacy notice covers this processing, and that you obtain the consent required for the advertising pixels you enable.
Questions about this agreement: support@onyxcheckout.com.