Skip to content

Data Processing Agreement

The German version is legally binding. Read the binding German version

Data Processing Agreement (DPA) under Art. 28 GDPR

This English version is provided for information only. The German version is legally binding.

between the merchant (operator of the Shopify store that installed the App), the “Controller”, and 401layers UG (haftungsbeschränkt), Dorothea-Erxleben-Straße 1a, 40721 Hilden, Germany, the “Processor”.

This agreement forms part of the Terms of Service for the use of the Shopify app “GPSR Compliance Manager” (the “Main Contract”). It is concluded together with the Main Contract, without any separate signature.

§ 1 Subject matter and duration

  1. The Processor processes personal data on behalf of the Controller to the extent necessary to perform the services agreed in the Main Contract (provision of the App). Subject matter, nature and purpose of the processing, the type of data and the categories of data subjects are set out in Annex 1.
  2. The duration of this agreement corresponds to the term of the Main Contract. Obligations which by their nature continue beyond the end of the agreement (in particular § 5) remain in force.
  3. To the extent that the Processor processes data for its own purposes (e.g. billing and shop data, security, product analytics), it is itself the controller; the Privacy Notice applies. Such processing is not the subject of this agreement.

§ 2 Instructions

  1. The Processor processes the data only on documented instructions from the Controller, unless required to do otherwise by Union or Member State law; in that case the Processor informs the Controller of that legal requirement before processing, unless that law prohibits this.
  2. The App is a standardised service. The Controller’s instructions are exclusively the Main Contract, this agreement and the Controller’s use of the App’s functions. Further individual instructions are effective only if the Processor confirms them in text form; they are treated as a change request and remunerated under § 8(4). The Processor is not obliged to carry out instructions that are technically impossible or possible only with disproportionate effort, that change the agreed scope of services, or that would impair the security or rights of other customers.
  3. The Processor informs the Controller without undue delay if it considers that an instruction infringes data protection law. It may suspend execution of the instruction until it is confirmed or changed. It does not owe a comprehensive legal review of instructions.

§ 3 Obligations of the Processor

  1. Confidentiality. The Processor uses only persons for the processing who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
  2. Security. The Processor implements the technical and organisational measures described in Annex 2 under Art. 32 GDPR. It may change and further develop the measures as long as the agreed level of protection is not materially undercut.
  3. Data subject rights. The Processor assists the Controller in responding to data subject requests through the App’s functions (export, editing, deletion). If a data subject contacts the Processor directly, it forwards the request to the Controller without undue delay or refers the person to the Controller, and does not respond on the substance except on instruction.
  4. Further assistance. Beyond this, taking into account the nature of the processing and the information available to it, the Processor assists the Controller in complying with Arts. 32 to 36 GDPR (security, breach notification, data protection impact assessment, prior consultation) to the extent the law requires and the Controller requests the assistance in text form. Assistance that goes beyond minor effort is remunerated under § 8(4).
  5. Breach notification. The Processor notifies the Controller of a personal data breach in its area of responsibility without undue delay after becoming aware of it, at the Controller’s e-mail address stored in Shopify, with the information available to it under Art. 33(3) GDPR. The notification is not an admission of a breach of duty or of liability. Notification of supervisory authorities and data subjects (Art. 33(1), Art. 34 GDPR) is the Controller’s responsibility.
  6. Records. The Processor maintains a record of processing activities under Art. 30(2) GDPR.

§ 4 Obligations of the Controller

  1. The Controller is the controller within the meaning of the GDPR. It alone is responsible for the lawfulness of the processing, for being entitled to use third-party data (in particular manufacturers, importers, responsible persons, visitors to its store) in the App, for informing the data subjects, and for the lawfulness of its instructions.
  2. In particular, the Controller informs visitors to its store in its privacy notice about the use of the App blocks and about the function “Hide GPSR widget for non-EU countries” (transmission of the IP address to geo.gpsrmanager.com, storage in sessionStorage) and obtains consent where required under § 25 TDDDG or Art. 6 GDPR.
  3. The Controller does not enter special categories of personal data (Art. 9 GDPR) or data relating to criminal convictions (Art. 10 GDPR) into the App.
  4. The Controller informs the Processor without undue delay if it finds errors or irregularities in the processing, and keeps the e-mail address stored in Shopify up to date for notifications under § 3(5).
  5. This agreement governs processing under the GDPR. Requirements of other legal systems applicable to the Controller (e.g. where it is established or has customers outside the EU/EEA) are not the subject of this agreement; the Controller alone is responsible for them.
  6. The Controller indemnifies the Processor against claims of data subjects, authorities and other third parties that are based on the Controller’s breach of this agreement, of data protection law or of other laws, in particular through missing legal bases, omitted information, unlawful instructions or the entry of prohibited data. The indemnification includes the reasonable costs of necessary legal defence. § 10(2) of the Terms applies accordingly.

§ 5 Deletion and return

  1. The Controller can export, edit and delete the data recorded in the App itself. The content is held in the metafields and metaobjects of its store at Shopify and is subject to Shopify’s rules. The Controller is itself responsible for backing up data before uninstalling.
  2. After the end of the Main Contract (uninstallation of the App), the Processor deletes the data stored for the shop at the latest upon the deletion notice triggered by Shopify (usually 48 hours after uninstallation), and deletes session data immediately upon uninstallation, unless Union or Member State law requires storage or the data is needed to establish, exercise or defend legal claims. Backups and logs are deleted in the regular cycles.
  3. The Processor does not separately hand over or restore data, because the Controller can hold the data in its store and through the export function. On request in text form, the Processor confirms deletion.

§ 6 Sub-processors

  1. The Controller grants the Processor general authorisation to engage sub-processors (including their affiliates and subcontractors). At the time of conclusion, the sub-processors listed in Annex 3 are authorised.
  2. The Processor informs the Controller of any intended change (addition or replacement) at least 30 days in advance in text form (e-mail or notice in the App), or by updating Annex 3 with a corresponding notice. If a replacement is urgent to maintain security, to remedy a disruption or for legal reasons, prompt notification is sufficient; the period is shortened accordingly.
  3. The Controller may object to the change only for an important data-protection reason, within 14 days after the notice, in text form and stating its reasons. After an objection, the Processor may refrain from the change or carry it out; in the latter case the Controller may terminate the Main Contract for cause when the change takes effect. Termination is the Controller’s sole remedy. Without a timely objection the change is deemed approved.
  4. The Processor imposes on each sub-processor by contract the same data protection obligations as set out in this agreement. It is liable to the Controller for their performance in accordance with § 9.
  5. Shopify’s services (platform, Shopify account, billing) are not sub-processing by the Processor. Shopify is engaged by the Controller itself.

§ 7 Transfers to third countries

The Processor transfers personal data to countries outside the EU/EEA only if the requirements of Arts. 44 et seq. GDPR are met, in particular through an adequacy decision or standard contractual clauses of the EU Commission. The Controller consents to the transfers listed in Annex 3 and instructs the Processor to carry them out. Transfers initiated by the Controller itself (e.g. retrieval of data from its store or disclosure by Shopify) are not the subject of this agreement.

§ 8 Evidence and audits

  1. Evidence. On request in text form, the Processor provides the Controller with the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, in particular the description of the measures (Annex 2), the list of sub-processors (Annex 3) and current certificates or reports of the sub-processors. One such request every twelve months is free of charge. Further requests and questionnaires going beyond these documents are remunerated under paragraph 4.
  2. Audits. Further audits (on-site, remote or online audits, including inspection of systems, configurations or logs, and interviews) are permitted only if
    • the evidence under paragraph 1 is insufficient in an individual case or there is a specific reason (e.g. a security incident or an order from a supervisory authority),
    • the Controller announces them at least 30 days in advance in text form with an audit plan and scope,
    • they take place at most once in twelve months, unless a security incident or an official order requires a further audit, and
    • they are carried out by independent auditors bound to confidentiality who are neither competitors of the Processor nor appointed by one.
  3. Scope. The audit covers only the Processor’s own systems and processes, to the extent necessary for processing the Controller’s data. Data, systems and information of other customers, trade secrets and source code are excluded. The data centres and systems of the sub-processors are not subject to the audit; their certificates and reports suffice in that respect. The audit takes place during normal business hours and without disrupting operations.
  4. Costs. The Controller bears all costs of every audit under paragraph 2 and of every further request under paragraph 1 sentence 3, including remote or online audits. These include the costs of its auditors and the Processor’s effort (remuneration on a time basis at a reasonable hourly rate that the Processor notifies in advance, plus VAT, and expenses). The Processor may require an advance payment on the estimated effort. If the audit reveals a material breach of this agreement for which the Processor is responsible, the Processor bears its own effort.
  5. The Processor’s obligations towards supervisory authorities remain unaffected.

§ 9 Liability

  1. The parties’ liability to each other is governed by the Main Contract (§ 7 of the Terms). The limitations of liability and maximum amounts set out there apply uniformly to the Main Contract and this agreement together and are not cumulative.
  2. Claims of data subjects under Art. 82 GDPR are not limited by this. As between the parties, each party is liable under Art. 82(5) GDPR only for the part of the damage corresponding to its responsibility. The Processor is liable only if it has not complied with obligations of the GDPR specifically directed to processors, or has acted outside or contrary to lawful instructions of the Controller.
  3. The Processor is not liable for damage resulting from following an instruction of the Controller, from the Controller’s breach of its obligations under § 4, or from data reaching unauthorised hands through actions of the Controller or its staff (e.g. disclosure of access data). § 4(6) remains unaffected.
  4. Fines imposed on a party are borne by that party; recourse against the other party is excluded to the extent permitted by law.

§ 10 Final provisions

  1. In case of conflict between this agreement and the Main Contract, this agreement prevails for the processing of personal data. Otherwise, in particular for remuneration, liability and term, the Main Contract applies. This agreement does not extend the scope of services of the App.
  2. The term of this agreement is tied to the Main Contract; it cannot be terminated separately. Amendments to this agreement are governed by § 9 of the Terms. The Processor may also adapt the agreement where required to comply with mandatory law, official requirements, case law or new standard contractual clauses, and notifies this at least 30 days in advance in text form.
  3. Notices under this agreement are given in text form: to the Controller at the e-mail address stored in Shopify or in the App, to the Processor at gpsrcompliancemanager@gmail.com.
  4. German law applies. The place of jurisdiction is governed by § 12(2) of the Terms.
  5. If a provision is invalid, the remaining provisions remain unaffected. The statutory provision replaces the invalid provision.

Annex 1 – Subject matter of the processing

Item Description
Nature and purpose Providing the App: recording, storing in the store’s metafields/metaobjects and displaying GPSR-related product information; automatic rules, bulk editing, import/export, guarantee/durability notices; delivery of label graphics; function “Hide GPSR widget for non-EU countries”; support.
Categories of data subjects (1) Staff and owners of the Controller who use the App; (2) natural persons whose data the Controller records in manufacturer, importer or responsible-person records or in text fields (e.g. sole traders, contact persons); (3) visitors to the Controller’s store.
Types of data Names, business addresses, e-mail addresses and websites; Shopify user identifier, name and e-mail address of store users; IP address, user agent, referrer and time of request of visitors; technical identifiers (session, request); free text entered by the Controller.
Special categories None. The Controller does not enter such data (§ 4(3)).
Customer and order data Not processed. The App does not request access to customer and order data.
Duration / deletion See § 5. Webhook events 7 days, background jobs 30 days, change log 180 days.

Annex 2 – Technical and organisational measures (Art. 32 GDPR)

  1. Confidentiality
    • Access to production systems and the database only for authorised persons, purpose-bound and on a least-privilege basis.
    • Authentication of App requests via Shopify session tokens; verification of the HMAC signature of incoming Shopify webhooks and of the signature of app proxy requests; protected endpoints for scheduled tasks.
    • Tenant separation: data access is always scoped to the shop domain.
    • Access tokens and secrets are removed from logs (redaction); secrets are held in environment configuration, not in source code.
  2. Integrity
    • Encrypted transmission (TLS) between browser, App, Shopify and database.
    • Change log of write operations on shop data (without content, with checksums).
    • Idempotent processing of webhooks (event ID), input validation.
  3. Availability and resilience
    • Operation on professionally hosted infrastructure (Vercel, AWS, Hetzner) with their own security and certification standards (e.g. ISO 27001, SOC 2).
    • Database with an upstream connection pooler (PgBouncer); recoverability of the database within the capabilities of the hosting provider.
    • Resumable background jobs and retry strategies for interface errors.
  4. Data minimisation and deletion
    • No storage of customer and order data; the content of the compliance data is held in the Controller’s store.
    • Automatic deletion after fixed periods and complete deletion after uninstallation (shop/redact).
  5. Organisation
    • Obligation of confidentiality; regular updating of dependencies and checks for known vulnerabilities; process for security incidents and notifications under Art. 33 GDPR.
    • Careful selection and contractual commitment of sub-processors.

Annex 3 – Sub-processors

Sub-processor Service Location / safeguards
Vercel Inc. Hosting of the App, edge delivery, server logs USA and global edge locations; standard contractual clauses and/or EU-US Data Privacy Framework
Amazon Web Services (AWS), contracting entity Amazon Web Services EMEA SARL Hosting of the PostgreSQL database with upstream PgBouncer pooler Frankfurt am Main region (eu-central-1), EU; standard contractual clauses for third-country transfers
Hetzner Online GmbH Server hosting of the service geo.gpsrmanager.com (mapping of the IP address to EU/non-EU) Gunzenhausen, Germany (EU)
Google Ireland Limited Mailbox for support correspondence (Gmail) Ireland / USA; standard contractual clauses and/or EU-US Data Privacy Framework

The service geo.gpsrmanager.com (mapping of the IP address to EU/non-EU; older installations: ipinfo.gpsrmanager.com) is operated by the Processor on a server of Hetzner Online GmbH. Its server logs (including IP address and time) are deleted after 30 days at the latest.

PostHog (product analytics) and Crisp (support chat) are used by the Processor for its own purposes (see Privacy Notice) and do not process the content of the compliance data on behalf of the Controller.

Last updated: 30 October 2026