Data Processing Agreement (DPA)

Version 2026-10-20 · pursuant to Art. 28(3) GDPR · Processor: Struxify — Inh. Dávid-Dennis Warning, Bürgermeister-Steenbock-Straße 21 a, 24558 Henstedt-Ulzburg, Deutschland · Contact: hello@struxify.io

This English translation is provided for convenience. The German version is legally binding: German version.

This agreement applies between the Merchant using the Shopify app “Struxify Inventory & PO” (controller) and Struxify — Inh. Dávid-Dennis Warning, Bürgermeister-Steenbock-Straße 21 a, 24558 Henstedt-Ulzburg, Deutschland (processor). It is concluded in electronic form (Art. 28(9) GDPR) by the Merchant accepting the Terms of Use, including this agreement, in the app. It applies for the entire duration of the use of the app.

1. Subject matter, nature and purpose of the processing

The processor calculates sales velocity, reorder points and order suggestions for the controller: via the Shopify API it reads product variants (inventory, prices) and the line items of the orders of the last 90 days (item, quantity, date), stores totals per item and, at the controller's request, generates purchase orders to the controller's suppliers. The processing serves this purpose exclusively.

2. Type of data and categories of data subjects

Customers of the controller: from orders only line items (item, quantity, order date) are read; name, address, e-mail and payment data are neither retrieved nor stored. Totals per item are stored without attribution to a person.
Contact persons at the controller's suppliers: business contact data (name, e-mail, phone, address) as far as the controller enters it in the app – to create and send purchase orders.

Special categories of personal data (Art. 9 GDPR) are not subject to the processing.

3. Instructions

The processor processes the data only on documented instructions from the controller (Art. 28(3)(a) GDPR). Instructions are this agreement, the Terms of Use and the settings and supplier data the controller stores in the app. The controller gives further instructions in text form to hello@struxify.io. If the processor considers an instruction to be unlawful, it informs the controller without undue delay (Art. 28(3), third sentence, GDPR). Processing outside these instructions takes place only if required by EU or Member State law; the processor informs the controller of this in advance, unless that law prohibits it.

4. Confidentiality

All persons at the processor who have access to the data are bound to confidentiality or are under a statutory obligation of confidentiality (Art. 28(3)(b) GDPR).

5. Technical and organisational measures (Art. 32 GDPR)

Encrypted transmission of all connections (HTTPS/TLS).
Hosting of app and database in a data centre in the EU (Netherlands).
Access to shop data only via the permissions granted by Shopify (OAuth, session tokens, read-only access to products, inventory and orders); verification of the signatures of all Shopify webhooks.
Strict separation of data per shop (tenant separation via the shop assignment in every query).
Data minimisation: from orders only line items are queried – customer data never reaches the app.
Access to server and database only for the processor via personal access accounts; no sharing of access credentials.
Regular review and updating of dependencies and security settings.

The processor may further develop the measures, provided the level of protection is not reduced.

6. Sub-processors

The controller gives general authorisation (Art. 28(2) GDPR) for the following sub-processors:

Railway Corporation (USA) – hosting of app and database, data centre in the EU (Netherlands).
Resend Inc. (USA) – sending purchase orders to suppliers by e-mail (recipient address, PO PDF, cover text, reply address of the controller), only when the controller triggers it; sending log up to 30 days.

Contracts are in place with the sub-processors imposing the same data protection obligations on them (Art. 28(4) GDPR). Transfers to the USA take place on the basis of the EU Standard Contractual Clauses (Art. 46 GDPR) and, where a provider is certified under the EU-US Data Privacy Framework, additionally on that (Art. 45 GDPR). The processor informs about intended changes at least 30 days in advance on this page and by email or a notice in the app; the controller may object for an important reason under data protection law and end the use. Shopify is not a sub-processor but the platform chosen by the controller itself.

7. Assistance to the controller

Data subject rights (Art. 12–22 GDPR): The processor forwards requests from data subjects to the controller without undue delay. For the controller's customers it stores no data attributed to a person; for contact persons at suppliers it supports the controller by providing information on the stored contact data and by rectifying or erasing it on instruction – the controller can also change or delete it in the app itself.
Data breaches (Art. 33, 34 GDPR): The processor reports a personal data breach without undue delay, if possible within 24 hours of becoming aware of it, with the information available to it.
Data protection impact assessment and prior consultation (Art. 35, 36 GDPR): The processor provides the information required for this.

8. Deletion and return after the end of use

Upon uninstallation of the app the processor deletes all of the shop's data (settings, suppliers, item data, purchase orders); deletion is completed at the latest upon Shopify's deletion request. The controller can request an export of the stored state before uninstallation (Terms of Use section 9); after deletion, return is no longer possible (Art. 28(3)(g) GDPR).

9. Evidence and audits

The processor makes available to the controller all information necessary to demonstrate compliance with these obligations and allows for audits, generally by written information; on-site inspections after reasonable prior notice (Art. 28(3)(h) GDPR).

10. Final provisions

Liability is governed by Art. 82 GDPR. In the event of contradictions, this agreement takes precedence over the Terms of Use in data protection matters. German law applies. Changes to this agreement are confirmed again in the app in the same way as the Terms of Use.