Data Processing Agreement

1. Parties and scope#

Processor: Kevin Urbaum – Ahoi Apps, Marksweg 23A, 21502 Geesthacht, Germany, service@ahoiapps.com (“Ahoi Apps”, “we”).

Controller: the merchant who installs one of our apps in their Shopify store (“Merchant”, “you”).

This DPA governs the processing of personal data of visitors to your online store that we carry out on your behalf when features of our apps run in your storefront (Art. 28 GDPR). Annex 1 describes this processing per app. It does not cover data we process as a controller, such as your shop domain, access tokens and subscription data; that processing is described in our Privacy Policy.

This DPA forms part of the agreement between you and us for the use of our apps. It takes effect when you install an app and remains in force as long as we process personal data on your behalf.

2. Instructions#

We process personal data only on your documented instructions. Your instructions are this DPA and your configuration and use of our apps, for example enabling a feature in a theme block. We do not process the data for our own purposes.

If we are required by EU or Member State law to process data differently, we will inform you beforehand unless the law prohibits this. If we believe an instruction infringes data protection law, we will tell you without undue delay.

You are responsible for the lawfulness of the processing in your store, in particular for informing your visitors and, where required, obtaining their consent, for example under § 25 TDDDG for information stored in their browser.

3. Confidentiality#

Ahoi Apps is operated by one person. Anyone we authorize to process personal data in the future will be bound to confidentiality.

4. Security#

We implement the technical and organizational measures described in Annex 2. We may update them as long as the overall level of protection is not reduced.

5. Sub-processors#

You authorize us to engage the sub-processors listed in Annex 3. We bind each of them by contract to data protection obligations equivalent to those in this DPA and remain responsible for them.

We will announce any intended addition or replacement of a sub-processor at least 30 days in advance by updating Annex 3 on this page. You may object on reasonable data protection grounds by emailing us within that period. If we cannot resolve your objection, you may uninstall the affected app; any prepaid fees for the remaining period will be refunded.

6. International transfers#

We process personal data in the EU/EEA wherever possible. Where a sub-processor transfers data to a country without an adequacy decision, the transfer is based on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) or, for certified US recipients, on the EU-US Data Privacy Framework (Art. 45 GDPR). Annex 3 states the basis for each sub-processor.

7. Assistance#

Taking into account the nature of the processing, we assist you with:

• responding to requests from data subjects exercising their rights under Art. 15 to 22 GDPR. Requests we receive directly are forwarded to you without undue delay;
• your obligations under Art. 32 to 36 GDPR (security, breach notification, data protection impact assessments, prior consultation).

As our apps store hardly any visitor data (see Annex 1), many requests can be answered from your own Shopify data.

8. Personal data breaches#

We notify you without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting the data covered by this DPA. We send the notification to the email address of your Shopify store owner account, or through another channel available to us. The notification describes the nature of the breach, the likely consequences, and the measures taken or proposed, as far as this information is known.

9. Deletion#

The data covered by this DPA is deleted automatically within the periods stated in Annex 1. When you uninstall an app, any remaining data is deleted at the latest when Shopify sends us its deletion request (shop/redact), 48 hours after uninstalling. Copies in backups are overwritten after 14 days. Return of data is not applicable, as no data is retained beyond these periods.

10. Audits#

We make available to you all information necessary to demonstrate compliance with Art. 28 GDPR, in particular this DPA and its annexes. Where this is not sufficient, you may audit us yourself or through an auditor bound to confidentiality, once per year, with at least 30 days' notice, during normal business hours and at your own expense.

11. Final provisions#

In case of conflict, this DPA takes precedence over other agreements between us regarding the processing of personal data. Liability is governed by the limitations agreed for the use of our apps, unless the law does not permit them. This DPA is governed by German law. If you are a merchant within the meaning of the German Commercial Code, the place of jurisdiction is the seat of Ahoi Apps. If a provision is invalid, the remaining provisions remain in effect.

Annex 1: Description of the processing#

Categories of data subjects:

visitors to your online store, including logged-in customers.

Special categories of data (Art. 9 GDPR):

none.

Nature of the processing:

collection through storefront requests, short-term storage, use for the app feature, deletion.

Frequency:

continuous while the app is installed and the feature is active.

Annex 2: Technical and organizational measures#

Hosting and physical security:

Application servers and databases are hosted by Hetzner Online GmbH in data centers in Germany, which are certified under ISO/IEC 27001.

Access control:

• Server access only via SSH with key authentication; no password logins.
• Access is limited to the operator of Ahoi Apps and, for deployment and server management, Hatchbox.
• Admin accounts are protected with two-factor authentication where the provider supports it.

Transmission security:

• All connections to our apps are encrypted with TLS (HTTPS).
• All traffic is routed through Cloudflare, which provides DDoS protection and filtering of malicious requests.
• Storefront requests are verified with Shopify's App Proxy signature.

Data minimization:

• Visitor identifiers are random values, not names or email addresses.
• Like and rating counts are stored as aggregates in your store.
• Selected sensitive parameters are filtered from application logs.

Retention and deletion:

• Server logs are rotated daily and deleted after 7 days.
• Visitor interaction records are deleted after 3 days.
• App sessions are deleted after 30 days of inactivity.
• All shop data is deleted on uninstall or shop/redact.

Availability and resilience:

Databases are backed up daily to Cloudflare R2 storage in the EU, with encryption at rest; backups are deleted after 14 days.

Maintenance:

• Operating system security updates are installed automatically.
• Application dependencies are kept up to date.

Annex 3: Sub-processors#