Data processing agreement (DPA)

Version 2026-10-24 · pursuant to Art. 28(3) GDPR · Processor: Dávid-Dennis Warning (Struxify), Bürgermeister-Steenbock-Straße 21 a, 24558 Henstedt-Ulzburg, Germany · Contact: hello@struxify.io

This English version is a convenience translation. Only the German version is legally binding; in the event of any discrepancy, the German version prevails.

This agreement applies between the merchant using the Shopify app “Struxify B2B Quote & Agent” (controller) and Dávid-Dennis Warning (Struxify), Bürgermeister-Steenbock-Straße 21 a, 24558 Henstedt-Ulzburg, Germany (processor). It is concluded in electronic form (Art. 28(9) GDPR) by the merchant agreeing in the app to the terms of use including this agreement. It applies for the entire duration of use of the app.

1. Subject matter, nature and purpose of the processing

The processor evaluates customer requests for the controller (pasted, forwarded by email or via the storefront chat) with AI, matches them against the store's catalogue and order history, creates drafts (draft orders) in the controller's Shopify account at the controller's instigation, sends quotes by email, distributes requests to team members, verifies merchant registrations (VAT number with VIES, proof document) and applies the approval in the Shopify customer account, receives quick orders and identifies slow movers from stock and sales. The processing serves this purpose exclusively.

2. Type of data and categories of data subjects

Customers and prospects of the controller: name, company, email address, Shopify customer ID, content of requests (emails, chat messages, follow-up questions on the quote), quick orders (items, quantities, voluntary details), order history (products, quantities, dates, prices), B2B company assignment.
Visitors of the storefront chat: chat messages, voluntarily provided contact details, truncated hash of the IP address (abuse protection).
Business customers in the verification procedure: company name, contact person, email address, country, VAT number, result of the VIES check (validity, registered company name and address, consultation number), uploaded proof of business activity (until the decision, at most 90 days), decision and log of the approval.
Employees of the controller: name and email address of the persons created in the distribution centre, assignments.

Special categories of personal data (Art. 9 GDPR) are not the subject of the processing; the controller does not deliberately transmit such data.

3. Instructions

The processor processes the data only on documented instructions from the controller (Art. 28(3)(a) GDPR). Instructions are this agreement, the terms of use and the settings the controller makes in the app (e.g. retention period, autopilot, sender approvals, team, rules for verification and counter-offers). Further instructions are given in text form to hello@struxify.io. If the processor considers an instruction to be unlawful, the processor informs the controller without undue delay (Art. 28(3) sentence 3 GDPR). Processing outside these instructions only takes place if required by the law of the EU or a Member State; the processor informs the controller beforehand unless the law prohibits this.

4. Confidentiality

All persons at the processor who have access to the data are bound to confidentiality or are subject to a statutory duty of confidentiality (Art. 28(3)(b) GDPR).

5. Technical and organisational measures (Art. 32 GDPR)

Encrypted transmission of all connections (HTTPS/TLS), including to Shopify, the AI service and the email service.
Hosting of app and database in a data centre in the EU (Netherlands).
Access to store data only via the permissions granted by Shopify (OAuth, session tokens); verification of the signatures of all Shopify webhooks and proxy calls as well as the email webhooks.
Strict separation of data per store (tenant separation via the store assignment in every query).
Access to server and database only for the processor via personal accounts; no sharing of credentials.
Abuse protection: rate limiting per IP, daily limits per store, IP addresses only as truncated hashes.
Data minimisation: only the content necessary for recognition goes to the AI service; no use of the data for training.
Retention periods: requests are anonymised after the period chosen by the controller (12, 24 or 36 months from receipt; default 24 months): request text, email address, customer assignment and free texts are removed, follow-up questions and replies on the quote are deleted. Chat histories are deleted 90 days after the last message.
Regular review and updating of dependencies and security settings.

The processor may develop the measures further, provided the level of protection is not reduced.

6. Sub-processors

The controller grants general authorisation (Art. 28(2) GDPR) for the following sub-processors:

Railway Corporation (USA) – hosting of app and database, data centre in the EU (Netherlands).
Google Ireland Ltd. / Google LLC (USA) – AI evaluation of the request texts (Gemini API, paid use without training).
Resend Inc. (USA) – sending and receiving emails (email inbox, quotes, notifications to team members and to the controller about new verification applications).

A contract imposing the same data protection obligations is in place with every sub-processor (Art. 28(4) GDPR). Transfers to the USA are based on the EU-US Data Privacy Framework where the provider is certified, otherwise on the EU standard contractual clauses (Art. 45, 46 GDPR). The processor informs about intended changes at least 30 days in advance on this page and by email or notice in the app; the controller may object for good data protection reasons and end the use. Shopify is not a sub-processor but the platform chosen by the controller itself.

7. Assistance to the controller

Data subject rights (Art. 12–22 GDPR): the processor forwards requests from data subjects to the controller. The app automatically implements erasure requests transmitted by Shopify. On request, the processor supports access requests with the stored data.
Data breaches (Art. 33, 34 GDPR): the processor reports a personal data breach without undue delay, if possible within 24 hours of becoming aware of it, with the information available to the processor.
Data protection impact assessment and consultation (Art. 35, 36 GDPR): the processor provides the information required for this.

8. Erasure and return after the end of use

On uninstallation of the app, the processor deletes all data of the store (settings, catalogue copy, requests, chat histories, slow-mover data, verification applications, team); erasure is completed at the latest upon Shopify's erasure request. The drafts created in Shopify remain in the controller's store. If the controller wishes to receive data beforehand, it can view it in the app or request it by email before uninstalling (Art. 28(3)(g) GDPR).

9. Evidence and audits

The processor makes available to the controller all information necessary to demonstrate compliance with these obligations and allows for audits, as a rule by written information; on-site audits after reasonable advance notice (Art. 28(3)(h) GDPR).

10. Final provisions

Art. 82 GDPR applies to liability. In the event of contradictions, this agreement takes precedence over the terms of use in data protection matters. German law applies. Changes to this agreement are confirmed again in the app in the same way as the terms of use.