Data Processing Agreement (DPA)

Version 2026-10-24 (as of 24 October 2026: billing in euros for stores billed in euros, otherwise in US dollars; final prices 19 / 39 / 69; optional feature “suggestions from previous orders”) · pursuant to Art. 28(3) GDPR · Processor: Struxify — Inh. Dávid-Dennis Warning, Bürgermeister-Steenbock-Straße 21 a, 24558 Henstedt-Ulzburg, Deutschland · Contact: hello@struxify.io

This English translation is provided for convenience. The German version is legally binding: German version.

This agreement applies between the Merchant using the Shopify app “Struxify Freight & Tiers” (controller) and Struxify — Inh. Dávid-Dennis Warning, Bürgermeister-Steenbock-Straße 21 a, 24558 Henstedt-Ulzburg, Deutschland (processor). It is concluded in electronic form (Art. 28(9) GDPR) by the Merchant accepting the Terms of Use, including this agreement, in the app. It applies for the entire duration of the use of the app.

1. Subject matter, nature and purpose of the processing

The processor calculates shipping prices for the controller: it receives the requests transmitted by Shopify during the shipping calculation (delivery address and cart), determines the delivery zone from country and postcode and the weight, number of pallets and oversize from the cart, and returns the price according to the controller's tables to Shopify. In addition, from the cart items transmitted by the theme block it calculates hints on freight, pallet and tier utilisation that are displayed in the store's cart. If the controller has switched on suggestions from previous orders (from the Pro plan), it reads, for logged-in customers, their own previous order lines via the Shopify API and calculates suggestions in the cart from them. The processing serves these purposes exclusively.

2. Type of data and categories of data subjects

Customers and prospective customers of the controller (buyers in the checkout): delivery address as transmitted by Shopify (street address, city, postcode, country) and cart items (name, SKU, quantity, weight, price). Only country, postcode and the cart items are used; country and the first two digits of the postcode are stored together with shipment figures, without being attributed to a person.
Store visitors with a filled cart (booster): cart items (SKU, quantity, weight, unit price), language, for logged-in customers the customer ID sent by Shopify (not evaluated) and a truncated hash of the IP address (abuse protection, in memory only). None of this is stored.
Logged-in customers of the controller (only if suggestions from previous orders are switched on, from the Pro plan; added on 23 October 2026): customer ID (transmitted signed by Shopify) and order lines of their own previous orders from the last up to six months (item or variant, quantity, order date; title, SKU, price, availability and weight of the variant). Purpose: suggestions in the cart that still fit into the rate band or onto the started pallet. Processing in memory only, no storage in the database, no log; cache per store and customer for at most 10 minutes. Name, email, phone number and address are not requested. Switching the feature on in the app is the controller's documented instruction (clause 3); the time is recorded in the store's settings.

Special categories of personal data (Art. 9 GDPR) are not subject to the processing.

3. Instructions

The processor processes the data only on documented instructions from the controller (Art. 28(3)(a) GDPR). Instructions are this agreement, the Terms of Use and the tables and settings the controller stores in the app. The controller gives further instructions in text form to hello@struxify.io. If the processor considers an instruction to be unlawful, it informs the controller without undue delay (Art. 28(3), third sentence, GDPR). Processing outside these instructions takes place only if required by EU or Member State law; the processor informs the controller of this in advance, unless that law prohibits it.

4. Confidentiality

All persons at the processor who have access to the data are bound to confidentiality or are under a statutory obligation of confidentiality (Art. 28(3)(b) GDPR).

5. Technical and organisational measures (Art. 32 GDPR)

Encrypted transmission of all connections (HTTPS/TLS).
Hosting of app and database in a data centre in the EU (Netherlands).
Access to shop data only via the permissions granted by Shopify (OAuth, session tokens); verification of the signatures of all Shopify webhooks and of the app proxy calls from the store (cart block). The requests from the checkout are protected by a secret address unique to each shop and by Shopify's signature verification.
Strict separation of data per shop (tenant separation via the shop assignment in every query).
Data minimisation: address data is processed only in memory and is not stored or logged; the log contains only the country and the first two digits of the postcode. Cart items from the cart block are processed in memory only and are not stored. For suggestions from previous orders only order lines are requested (no contact details), the customer ID is taken only from the signed app proxy request, and the in-memory cache expires after at most 10 minutes.
Abuse protection: rate limiting per store and IP address, IP addresses only as a truncated hash in memory.
Access to server and database only for the processor via personal access accounts; no sharing of access credentials.
Deletion periods: the log is deleted after 7 to 90 days depending on the plan.
Regular review and updating of dependencies and security settings.

The processor may further develop the measures, provided the level of protection is not reduced.

6. Sub-processors

The controller gives general authorisation (Art. 28(2) GDPR) for the following sub-processor:

Railway Corporation (USA) – hosting of app and database, data centre in the EU (Netherlands).

A contract is in place with the sub-processor imposing the same data protection obligations on it (Art. 28(4) GDPR). Transfers to the USA take place on the basis of the EU-US Data Privacy Framework, where the provider is certified, otherwise on the basis of the EU Standard Contractual Clauses (Art. 45, 46 GDPR). The processor informs about intended changes at least 30 days in advance on this page and by email or a notice in the app; the controller may object for an important reason under data protection law and end the use. Shopify is not a sub-processor but the platform chosen by the controller itself.

7. Assistance to the controller

Data subject rights (Art. 12–22 GDPR): The processor forwards requests from data subjects to the controller. Since the processor does not store any data attributed to a person, assistance is generally limited to this information.
Data breaches (Art. 33, 34 GDPR): The processor reports a personal data breach without undue delay, if possible within 24 hours of becoming aware of it, with the information available to it.
Data protection impact assessment and prior consultation (Art. 35, 36 GDPR): The processor provides the information required for this.

8. Deletion and return after the end of use

Upon uninstallation of the app the processor deletes all of the shop's data (settings, tables, log); deletion is completed at the latest upon Shopify's deletion request. The controller owns its tables as its own files; on request the processor provides the stored state prior to uninstallation (Art. 28(3)(g) GDPR).

9. Evidence and audits

The processor makes available to the controller all information necessary to demonstrate compliance with these obligations and allows for audits, generally by written information; on-site inspections after reasonable prior notice (Art. 28(3)(h) GDPR).

10. Final provisions

Liability is governed by Art. 82 GDPR. In the event of contradictions, this agreement takes precedence over the Terms of Use in data protection matters. German law applies. Changes to this agreement are confirmed again in the app in the same way as the Terms of Use.