Data processing agreement

Version 1.0 of 12 October 2026

This agreement governs how we process personal data on your behalf when you use the Shopify app "DV Surcharge, Fees & Discounts" (the app). It meets the requirements of Art. 28 GDPR, is an annex to our terms of service and is concluded together with them when you install the app. You can save or print this page.

1. Parties

The provider named above is the processor ("we"). The controller ("you") is the merchant who installs the app in their Shopify store.

2. Subject and duration

We process personal data for you only to provide the app as described in our privacy policy. This agreement starts when you install the app and ends when the app has been uninstalled and the data have been deleted as set out in section 11.

3. Nature and purpose of the processing

We collect data through Shopify's interfaces, store, read, use and delete them in order to:

• calculate fees and discounts according to your rules and add them to carts, draft orders and orders;
• show the fees in the cart of your online store, through the app's script in your theme;
• keep the fee log, show its figures and provide it as a CSV file;
• mark fee lines as fulfilled together with the goods;
• answer your support requests.

4. Types of data and data subjects

• Data subjects: the customers of your store; your staff, as far as their data appear in support requests or in the session tokens of the Shopify admin that the app checks.
• Order data read from Shopify: IDs and numbers of orders and draft orders, their lines, quantities, amounts and the fulfillment status of lines.
• Fee log: order number and order ID, date, currency, rule, label, type, amount, quantity, how the fee reached the order, and a snapshot of the rule.
• Entries in your customers' browsers: cart ID, check values and times, as described in section 4 of the privacy policy. They stay in the browser; we do not receive them.
• Customer requests forwarded by Shopify: the customer's ID, email address and phone number and the order IDs concerned. The app uses only the order IDs and neither stores nor logs the rest.
• Support requests: the data of your customers or staff that you send us.

The app does not process special categories of personal data (Art. 9 GDPR).

5. Your instructions

We process the data only on your documented instructions, including with regard to transfers to a third country, unless EU or German law requires us to process them; in that case we inform you beforehand, unless that law prohibits it. Your instructions are this agreement, the rules and settings you make in the app, and instructions by email to the contact address below. If we believe that an instruction infringes data protection law, we tell you without delay.

6. Confidentiality

Only persons who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality have access to the data.

7. Security of processing

We take these technical and organisational measures (Art. 32 GDPR):

• Location: the server runs in a data center of Hetzner Online GmbH in Germany.
• Encryption: access tokens and the content of the fee log are stored encrypted (AES-256-GCM); all connections use TLS.
• Access: the app's pages in the Shopify admin open only with a valid session token from Shopify, and every query is limited to the store it comes from. Administrative access to the server is reserved to us.
• Data minimisation: Shopify sends the app only the ID of orders and draft orders; the fee log contains no names, addresses, email addresses or payment details; the server logs contain no IP addresses and are overwritten after about two weeks.
• Deletion: the app deletes data automatically on uninstallation and on Shopify's deletion requests (shop/redact, customers/redact).
• Testing: every change to the app passes automated tests before it is released.

We may adapt these measures to technical progress, as long as the level of protection does not fall.

8. Sub-processors

You agree that we use these sub-processors:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: hosting of the server in a data center in Germany.
• ALL-INKL.COM - Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany: mailbox for support requests.

We bind each sub-processor by contract to the same data protection obligations as in this agreement. We inform you at least 14 days in advance of any intended addition or replacement of a sub-processor, by email to the email address of your store at Shopify. You can object within this period; if we cannot reasonably meet your objection, you can end the contract by uninstalling the app.

Shopify is not our sub-processor: you have chosen Shopify as the platform for your store, and the data stored there are covered by your contract with Shopify.

9. Rights of data subjects

We support you in answering requests from data subjects (Art. 12 to 22 GDPR): you can see the fee log of each order in the app and download it as a CSV file, and the app deletes the log entries of an order automatically when Shopify forwards a customer's deletion request (customers/redact). If a data subject contacts us directly, we forward the request to you without delay.

10. Support with your other obligations

We support you in meeting your obligations under Art. 32 to 36 GDPR, taking into account the information available to us. We notify you of any personal data breach affecting your data without undue delay and at the latest within 24 hours of becoming aware of it, by email to the email address of your store at Shopify, with the information required by Art. 33(3) GDPR as far as we have it.

11. Deletion and return

When you uninstall the app, it deletes the access tokens and the entire fee log of your store; Shopify's request to delete a store's data (shop/redact) deletes the same. Before uninstalling, you can download the fee log as a CSV file. There are no backup copies. We delete support emails as soon as we no longer need them, unless the law requires us to keep them (Sec. 257 HGB).

12. Information and audits

We make available to you all information necessary to demonstrate compliance with Art. 28 GDPR, and we allow for and contribute to audits, including inspections, by you or by an auditor you mandate. Please announce audits at least 14 days in advance; they take place during business hours without disrupting operations. We may ask external auditors to sign a confidentiality agreement.

13. Liability

Liability towards data subjects is governed by Art. 82 GDPR. Otherwise, the liability provisions of our terms of service apply.

14. Final provisions

In matters of data protection, this agreement takes precedence over the terms of service. We may change this agreement where the law or a change of sub-processors requires it; we inform you in advance as set out in section 8. German law applies. This agreement is available in English and German; in case of differences, the German version prevails.

15. Contact

apps@dgtvsn.de