Data Processing Agreement (DPA)

Version 2026-10-20 · pursuant to Art. 28(3) GDPR · Processor: Struxify — Inh. Dávid-Dennis Warning, Bürgermeister-Steenbock-Straße 21 a, 24558 Henstedt-Ulzburg, Deutschland · Contact: hello@struxify.io

This English translation is provided for convenience. The German version is legally binding: German version.

This agreement applies between the Merchant using the Shopify app “Struxify Clearance & Bundles” (controller) and Struxify — Inh. Dávid-Dennis Warning, Bürgermeister-Steenbock-Straße 21 a, 24558 Henstedt-Ulzburg, Deutschland (processor). It is concluded in electronic form (Art. 28(9) GDPR) by the Merchant accepting the Terms of Use, including this agreement, in the app. It applies for the entire duration of the use of the app.

1. Subject matter, nature and purpose of the processing

The processor detects slow movers for the controller, executes the controller's markdown rules and manages virtual bundles: via the Shopify API it reads product variants (inventory, prices), collections, locations and the line items of orders (item, quantity, date; new orders via webhook), stores figures per item and, at the controller's request or according to its rules, changes prices, collection assignments, bundle products and stock in the shop. The processing serves this purpose exclusively.

2. Type of data and categories of data subjects

Customers of the controller: from orders only line items (item, quantity, order date) and the order number are evaluated; name, address, e-mail and payment data are not stored. Figures per item are stored without attribution to a person, plus the numbers of orders already booked (90 days).

Special categories of personal data (Art. 9 GDPR) are not subject to the processing.

3. Instructions

The processor processes the data only on documented instructions from the controller (Art. 28(3)(a) GDPR). Instructions are this agreement, the Terms of Use and the settings, markdown rules and bundles the controller creates in the app. The controller gives further instructions in text form to hello@struxify.io. If the processor considers an instruction to be unlawful, it informs the controller without undue delay (Art. 28(3), third sentence, GDPR). Processing outside these instructions takes place only if required by EU or Member State law; the processor informs the controller of this in advance, unless that law prohibits it.

4. Confidentiality

All persons at the processor who have access to the data are bound to confidentiality or are under a statutory obligation of confidentiality (Art. 28(3)(b) GDPR).

5. Technical and organisational measures (Art. 32 GDPR)

Encrypted transmission of all connections (HTTPS/TLS).
Hosting of app and database in a data centre in the EU (Netherlands).
Access to shop data only via the permissions granted by Shopify (OAuth, session tokens; read access to orders and locations, write access only to products and inventory); verification of the signatures of all Shopify webhooks.
Strict separation of data per shop (tenant separation via the shop assignment in every query).
Data minimisation: via the API only line items are queried from orders; orders arriving via webhook are immediately reduced to line items and order number – customer data is not stored.
Access to server and database only for the processor via personal access accounts; no sharing of access credentials.
Regular review and updating of dependencies and security settings.

The processor may further develop the measures, provided the level of protection is not reduced.

6. Sub-processors

The controller gives general authorisation (Art. 28(2) GDPR) for the following sub-processor:

Railway Corporation (USA) – hosting of app and database, data centre in the EU (Netherlands).

A contract is in place with the sub-processor imposing the same data protection obligations on it (Art. 28(4) GDPR). With Railway Corporation the processor has concluded the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); processing takes place in the EU. The processor informs about intended changes at least 30 days in advance on this page and by email or a notice in the app; the controller may object for an important reason under data protection law and end the use. Shopify is not a sub-processor but the platform chosen by the controller itself.

7. Assistance to the controller

Data subject rights (Art. 12–22 GDPR): The processor forwards requests from data subjects to the controller. Since the processor does not store any data attributed to a person apart from the numbers of booked bundle orders (90 days), assistance is generally limited to this information and to the immediate deletion of these order numbers upon an erasure request (Shopify webhook “customers/redact”).
Data breaches (Art. 33, 34 GDPR): The processor reports a personal data breach without undue delay, if possible within 24 hours of becoming aware of it, with the information available to it.
Data protection impact assessment and prior consultation (Art. 35, 36 GDPR): The processor provides the information required for this.

8. Deletion and return after the end of use

Upon uninstallation of the app the processor deletes all of the shop's data (settings, rules, item data, log, bundles); deletion is completed at the latest upon Shopify's deletion request. On request before uninstallation the processor provides the stored state as an export (Art. 28(3)(g) GDPR); after uninstallation no export is possible any more.

9. Evidence and audits

The processor makes available to the controller all information necessary to demonstrate compliance with these obligations and allows for audits, generally by written information; on-site inspections after reasonable prior notice (Art. 28(3)(h) GDPR).

10. Final provisions

Liability is governed by Art. 82 GDPR. In the event of contradictions, this agreement takes precedence over the Terms of Use in data protection matters. German law applies. Changes to this agreement are confirmed again in the app in the same way as the Terms of Use.