Privacy policy

Last updated: 12 October 2026

This policy explains what the Shopify app "DV Surcharge, Fees & Discounts" (the app) does with data. The app adds surcharges, deposits and discounts to the carts, draft orders and orders of a Shopify store, based on rules the merchant sets, and keeps a log of them. This policy is addressed to merchants who install the app. Customers of those stores can read here what the app keeps in their browser; the store is responsible for their data (see "Who is responsible").

1. Who is responsible

We are the controller for the data about your store and about you that we need for our contract with you: store address, access tokens, plan, server logs and support emails. All data about your customers and your staff that the app processes for you (orders, draft orders, the fee log, entries in your customers' browsers) we process only on your behalf and on your instructions; you as the merchant are the controller for it (Art. 28 GDPR). The details are set out in our data processing agreement, which is part of our terms of service.

We are not required to appoint a data protection officer (Sec. 38 BDSG). For data protection questions, write to the email address above.

2. What the app stores

• Your store: the store address (for example example.myshopify.com) and the access token and refresh token Shopify issues at installation; both tokens are stored encrypted. The app signs in for the store, not for a person: it stores no names or email addresses of you or your staff. When you open the app in the Shopify admin, Shopify sends a short-lived session token with each request; the app checks it and does not store it.
• Fee log: for each order in which a fee or discount of the app applies: order number and order ID, date, currency, rule, label, type, amount, quantity, how the fee reached the order, and a snapshot of the rule at that time. The store, the order ID, the order date and the time the entry was written stay readable, so that entries can be found and deleted; everything else is stored encrypted. No names, addresses, email addresses, phone numbers, customer IDs or payment details. Through the order number, an entry can be linked to a customer in your Shopify admin; we therefore treat the fee log as personal data of your customers that we process on your behalf.

3. What the app reads but does not store

• Your rules are saved in your own store at Shopify (as a metafield), not on our server.
• Orders, draft orders and fulfillment: when an order or a draft order is created or changed, or an order is partly fulfilled, Shopify sends our server a notice that contains only its ID. The app then reads from Shopify what it needs: the fee lines of the order, the lines and amounts of the draft order to add the matching fees, or the lines being fulfilled to mark fee lines as fulfilled together with the goods. Only the fee log described above is stored.
• Products: the app checks product changes, so that a deleted fee product does not block the cart.
• Customer requests: when Shopify forwards a customer's request for access or deletion (section 11), the notification also contains the customer's ID, email address and phone number. The app uses only the order IDs named in it and neither stores nor logs the rest.
• The cart: what a customer chooses in the cart (a ticked fee, the payment or delivery method) is handled by Shopify in the cart and at checkout. The calculation runs at Shopify (Shopify Functions); our server does not receive it.

The app receives all data in this and the previous section from Shopify, through its interfaces and notifications (webhooks).

4. In the online store and in your browser

• As soon as a customer adds something to the cart, the app's script keeps up to four technical entries in the customer's browser (localStorage, only for the store's domain), each with the cart ID in its name: a check value of the discount rules last applied, the time the app last changed the cart, a counter that stops a fee line from being added and removed again and again, and a lock of a few seconds against duplicate fee lines when the store is open in several tabs. The lock is removed right afterwards; the script deletes the other entries of a cart the next time a page of the store is opened in that browser, once the cart is no longer in use and the app has not changed it for 14 days. The entries do not leave the browser; our server never receives them. They serve only to calculate and show the fees correctly in the cart the customer is using; no consent is needed for this (Sec. 25(2) no. 2 TDDDG). The app sets no cookies and uses no tracking or analytics.
• As the merchant, you are responsible for these entries towards your customers. A text for your own privacy policy is in section 12 (text for your privacy policy).

5. Server logs

The server writes operating messages: time, request method, requested address without parameters, status and duration; when the app signs in for a store or processes a notification from Shopify, also the address of the store and, where relevant, the ID or number of the order or draft order concerned, the fees added and the number of log entries written or deleted; for errors, the error message. They contain no IP addresses; the app writes no names, addresses or email addresses of customers into them. The purpose is to keep the service running securely and to find errors; this is our legitimate interest (Art. 6(1)(f) GDPR). The server keeps at most the latest 3 MB of messages and overwrites older ones automatically, usually after about two weeks.

6. Support by email

If you write to us, we process your email address, your name and the content to answer your request. The legal basis is our contract with you for questions about your use of the app (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering requests (Art. 6(1)(f) GDPR). The mailbox is hosted by ALL-INKL.COM - Neue Medien Münnich, Friedersdorf, Germany, as our processor. We keep emails as long as we need them for the request; business emails we keep for up to six years as required by law (Sec. 257 HGB) and then delete them. If you send us data of your customers (such as order numbers or screenshots), we process it only on your behalf and only to solve your issue.

7. Purposes and legal bases

We process data only for these purposes:

• Your store data and your plan: to provide the app to you and apply your plan. The legal basis is our contract with you for using the app (Art. 6(1)(b) GDPR). Without the store address and access token the app cannot work; you are not obliged to provide them, but you cannot use the app without them.
• Server logs: operation and security, Art. 6(1)(f) GDPR (section 5).
• Support emails: see section 6.
• Data of your customers and staff: calculating and showing fees and discounts, keeping the fee log and its figures, marking fee lines as fulfilled and adding fees to draft orders. We do this on your behalf; you as the controller determine the legal basis, usually the purchase contract with your customer (Art. 6(1)(b) GDPR).

We use no data for other purposes: not for advertising, not for our own analyses and not to train AI models.

8. Where the data is kept

On a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data center in Germany. Hetzner acts as our processor under a contract pursuant to Art. 28 GDPR. Access tokens and the content of the fee log are stored encrypted (AES-256-GCM); only the store address and the store, order ID, order date and time of each log entry stay readable. Data is transferred only over encrypted connections (TLS).

9. How long

• Until you uninstall the app. On uninstall, the app deletes the access tokens and the whole fee log of your store. Shopify's request to delete store data (shop/redact) deletes the same.
• When Shopify forwards a customer's deletion request (customers/redact), the app deletes the fee log entries of the orders named in it.
• Server logs: about two weeks (section 5). Support emails: section 6. Entries in your customers' browsers: deleted on the next visit to the store once the cart is no longer in use and the app has not changed it for 14 days (section 4).
• There are no backups of the app's data; what is deleted is gone. Before uninstalling, you can download the fee log as a CSV file.

10. Recipients

We do not sell or rent data and do not use it for advertising. Only these receive data:

• Hetzner Online GmbH, Gunzenhausen, Germany: server hosting, as our processor.
• ALL-INKL.COM - Neue Medien Münnich, Friedersdorf, Germany: mailbox for our support address, as our processor.
• Shopify: the app works through Shopify's interfaces. What the app reads or writes (orders, draft orders, rules, discounts) is held by Shopify, which you engaged yourself as your platform (for merchants in Europe Shopify International Ltd., Dublin, Ireland). To determine your plan, the app queries the Partner API of Shopify Inc., 151 O'Connor Street, Ottawa, Canada, and sends only the ID of your store; Canada is covered by an adequacy decision of the European Commission (2002/2/EC). Shopify bills you for the app; we receive no payment details.

Apart from this, we transfer no data to countries outside the EU. The app makes no automated decisions within the meaning of Art. 22 GDPR.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20); you can download the fee log as a CSV file at any time. You can lodge a complaint with a supervisory authority, in particular where you live or work, or with the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia), Postfach 20 04 44, 40102 Düsseldorf, Germany.

Right to object: where we process data based on our legitimate interest (Art. 6(1)(f) GDPR: server logs, support), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Customers of a store please contact the store. If a customer writes to us directly, we forward the request to the store. Shopify forwards customer requests to the app (customers/data_request, customers/redact); the merchant can see the fee log of an order on the app's log page and download it as CSV.

12. Text for your privacy policy

You may copy this text into your own privacy policy:

Fees and discounts in the cart: we use the app "DV Surcharge, Fees & Discounts" by digitvision, Eike Brandt-Warneke, Hevener Straße 65, 44797 Bochum, Germany, as our processor. Once you add something to the cart, a script of the app stores up to four technical entries about your cart in your browser's local storage (localStorage), so that fees and discounts are calculated and shown correctly; the entries do not leave your browser and are deleted on your next visit to the store once the cart is no longer in use and the app has not changed it for 14 days. The legal basis for storing them is Sec. 25(2) no. 2 TDDDG, for further processing Art. 6(1)(b) GDPR. For orders with a fee, the app keeps a log (order number, fee, amount) without name, address or email address.

13. Contact

apps@dgtvsn.de

14. Changes

If the app changes what it does with data, we update this page and its date.