Shopify Partner / Shopify Plus Expert

Contact

Data Processing Agreement (DPA) – Datora | Multi Discounts

Last updated: November 12, 2026 · Version 1.0

Datora GmbH & Co. KG, Efeuweg 8a, 33335 Gütersloh ("we", "us"), develops and operates the Shopify app "Datora | Multi Discounts" (the "App"). This Data Processing Agreement (the "DPA") governs how we process personal data of your customers on your behalf when you grant the App optional read access to customers. It constitutes the separate agreement pursuant to Art. 28 GDPR referenced in Section 6.2.2 of our Terms of Service. In the event of any conflict between our Terms of Service and this DPA, this DPA shall take precedence regarding the processing of personal data on your behalf.

Please read this DPA carefully. You enter into this agreement by clicking "Accept and grant access" in the App. In doing so, we store the timestamp, the version of the DPA, and your shop's ID.

Subject Matter and Scope

As the shop operator, you are the controller within the meaning of Art. 4 No. 7 GDPR. We are the processor within the meaning of Art. 4 No. 8 GDPR and process the data described below solely on your behalf and in accordance with your instructions.

This DPA applies only to the processing triggered by the optional Shopify permission "read_customers". Without this permission, all of the App's discounts function in exactly the same way. For all other use of the App, our Terms of Service and our Privacy Policy apply.

Data that we process as an independent controller is not covered by this DPA. This includes your contact details as a merchant and records of the conclusion and termination of this DPA.

This DPA is concluded in electronic form (Art. 28 (9) GDPR). It applies to the shop in which you accept it within the App.

Nature, Purpose, and Duration of Processing

At each checkout, a Shopify Function of the App calculates the discounts. In doing so, it checks whether the person at checkout has the customer tags you use in your discount rules. Shopify executes the Function on its own infrastructure and logs each execution with input and result (the "Function logs").

With the "read_customers" permission, two things change:

  • Function logs. Without this permission, Shopify only shows us in your shop's Function logs that an execution has taken place. With this permission, we can see the full details.
  • Privacy webhooks. If a customer requests information or erasure from you, Shopify notifies all apps with access to customer data via the webhooks "customers/data_request" and "customers/redact". With this permission, our App also receives these notifications (the "privacy webhooks").

We process the data exclusively for the following purposes:

  • Troubleshooting. Understanding why a discount was applied or not applied at checkout.
  • Support. Answering your inquiries regarding discount calculations.
  • Data subject requests. Receiving and confirming privacy webhooks to Shopify.

We do not use access to retrieve customer data via the Shopify Admin API, and we do not store any of your customers’ data on our own systems. We do not use the data for advertising, profiling, analytics, or any other purposes of our own.

Processing begins when you accept this DPA and grant access. It ends when you revoke the DPA in the app’s settings or uninstall the app. In both cases, access is automatically revoked.

Types of data and data subjects

The data subjects are individuals who access a checkout in your store or request access to or erasure of their data from you (your customers).

The function logs contain the following data for each invocation:

  • Customer tags. For each customer tag from your discount conditions, whether the logged-in customer has it (yes/no). Other tags are not queried.
  • Cart. Product and variant IDs, quantities, prices, subscription details, and currency.
  • Discount details. Discount codes and tokens stored in the cart, as well as the checkout market.

The privacy webhooks contain the following data for each request:

  • Personal details. Customer ID, email address, and phone number of the individual requesting access or erasure.
  • Request details. The affected order IDs and the request identifier.

The app does not receive names, addresses, or payment details. It receives email addresses and phone numbers only via the privacy webhooks, not via the function logs.

We do not process special categories of personal data (Art. 9 GDPR), unless you use customer tags that describe such data. This is not permitted under this DPA (see “Your obligations”).

Instructions

We process the data solely on your documented instructions. This also applies to transfers to a third country or an international organization. Your instructions result from this DPA and from the configuration of your discounts in the app. The transfers described in this DPA are deemed instructed. You can provide further instructions to us by email at mail@datora.de.

An exception applies if European Union or Member State law requires us to process the data. In this case, we will inform you of the legal requirements prior to processing, unless the relevant law prohibits such notification on important grounds of public interest.

If we consider an instruction to be unlawful, we will inform you immediately (Art. 28(3) sentence 3 GDPR). We may suspend execution until you confirm or modify the instruction. If we cannot technically implement an instruction with the app, we will let you know. You may then terminate the DPA at any time.

Our obligations

We specifically undertake to do the following:

  • Confidentiality. Only employees responsible for support and development who have committed to confidentiality have access to the data. This commitment continues even after their employment has ended.
  • Security. We implement the technical and organizational measures described below pursuant to Art. 32 GDPR.
  • Assistance with data subject rights. We assist you with requests regarding access, rectification, erasure, and other rights under Art. 12 to 23 GDPR. If such a request reaches us directly, we will forward it to you without undue delay and will not answer it ourselves.
  • Privacy webhooks. We acknowledge receipt of every privacy webhook to Shopify. Since we do not store any of your customers' data, there is nothing for us to disclose or delete.
  • Assistance with your obligations. We assist you within the scope of Art. 32 to 36 GDPR, for example with a data protection impact assessment.
  • Notification of breaches. We will inform you without undue delay, and at the latest within 24 hours of becoming aware of a personal data breach affecting your data. The notification will contain the information pursuant to Art. 33(3) GDPR to the extent available to us. Missing information will be provided without undue delay.
  • Inquiries from authorities. If an authority requests access to your data, we will inform you to the extent legally permitted.
  • Proof of compliance. We provide you with all information necessary to demonstrate compliance with Art. 28 GDPR.
  • Records. We maintain a record of processing activities pursuant to Art. 30(2) GDPR.

Your obligations

As the controller, you have the following obligations:

  • Lawfulness. You are responsible for ensuring that the processing is lawful. This includes having a legal basis, informing your customers in your privacy policy, and fulfilling data subject rights.
  • No sensitive customer tags. You do not use customer tags in discount conditions that describe special categories of personal data (Art. 9 GDPR) or data relating to criminal convictions and offences (Art. 10 GDPR). This includes information such as health, religion, or trade union membership.
  • Authority. Anyone who accepts the DPA in the app warrants that they are authorized to represent the store.
  • Notification. You will notify us without undue delay if you notice any errors or irregularities during processing.

Technical and organizational measures

We take measures in accordance with Art. 32 GDPR that are appropriate to the risk. The risk is low because we only process a few types of data and do not store any of your customers' data. These measures include:

  • Data minimization. The app only checks whether specific customer tags are present, and retrieves no other customer data.
  • No separate storage. Function logs are hosted with Shopify. We do not copy them to our own systems. We verify and acknowledge the contents of privacy webhooks, but do not store or log them.
  • Support without customer data. In tickets, chats, and emails, we only share excerpts from function logs redacted so that they cannot be linked to any individual. We remove discount codes and tokens beforehand.
  • Access control. Access to function logs is granted exclusively via personal Shopify accounts of our team members using two-factor authentication. If someone leaves or changes roles, access is revoked.
  • Work devices. Our team works remotely. Access is restricted to password-protected devices with encrypted drives and an automatic screen lock.
  • Encryption. Transmission between Shopify, the app, and our team members is encrypted (TLS). The app’s database is encrypted at rest.
  • Webhook verification. For every webhook, the app verifies Shopify’s signature and rejects any requests without a valid signature.
  • Automatic revocation. If the DPA is revoked or the app is uninstalled, access is revoked. If access is granted without a valid DPA, the app automatically revokes it again.
  • Records. We record acceptance, revocation, and uninstallation with a timestamp and the version of the DPA.
  • Review. We review the effectiveness of these measures at least once a year.

We may adapt these measures to reflect technological advancements, provided the level of protection is not reduced.

Role of Shopify

Your store runs on the Shopify platform. For your customer data, Shopify acts as your own data processor, based on your agreement with Shopify and Shopify's Data Processing Addendum. Therefore, Shopify is not our sub-processor.

Shopify executes the app's function and stores the function logs, regardless of whether you grant us access. By granting “read_customers” access, you permit Shopify to do two things: display the details of these function logs to us in the Shopify Dev Dashboard and send the privacy webhooks to the app. We view the function logs directly on Shopify without transferring them to our own systems.

Shopify transfers data within the Shopify group, such as to Canada, based on its Binding Corporate Rules. For transfers to other third countries, Shopify uses the 2021 Standard Contractual Clauses (European Commission Decision 2021/914). Details are set out in Appendix C, Section II.B.8 of Shopify's Data Processing Addendum as of July 7, 2026.

Sub-processors and international data transfers

You grant us general authorization to engage sub-processors (Art. 28(2) GDPR). Upon conclusion of this DPA, we engage one sub-processor:

  • Fly.io, Inc., 2261 Market Street, Suite 4990, San Francisco, CA 94114, USA. Hosting of the app in the Frankfurt am Main data center. Privacy webhooks run through Fly.io's servers. They are processed there, but not stored.

Data from the function logs does not reach Fly.io's systems. The app's database contains no customer data. Its hosting is therefore not part of this DPA.

Fly.io processes data in Frankfurt am Main. Access from the US, such as by Fly.io support, cannot be ruled out. Fly.io is certified under the EU-U.S. Data Privacy Framework. Where this does not apply, the Standard Contractual Clauses from Fly.io's data processing agreement apply.

We will notify you of any new or modified sub-processors at least 30 days in advance by email or within the app. You can object within this period by revoking the DPA in the app. Your discounts will then continue to work unchanged. If you do not object, the engagement is deemed approved.

We contractually bind each sub-processor to the same data protection obligations that apply to us under this DPA (Art. 28(4) GDPR). If a sub-processor fails to fulfill its obligations, we remain liable to you for their compliance.

Audit rights

You may verify that we comply with this DPA. The audit takes place in two stages.

Stage 1: Information and documentation. We will demonstrate compliance to you through written information and evidence, such as a description of our technical and organizational measures. This is free of charge for you.

Stage 2: Audit. You may only request a further audit if the evidence from Stage 1 is insufficient to assess compliance with this DPA, or if there are specific indications of a breach of this DPA or the GDPR. You must notify us of the reason in text form.

You can audit us yourself or appoint an auditor. Appointed auditors must be bound by confidentiality and must not be in competition with us. Our team works remotely, and we do not store any of your customers' data on our own systems. The audit therefore takes place via video conference with access to systems and documentation, unless an audit at our registered office is required.

You must give at least 30 days' prior notice of an audit. In the event of a breach of the protection of your data, a reasonably shorter notice period will suffice. The audit will take place during our business hours, last no longer than one business day, and must not disproportionately disrupt our operations. Without a specific new reason, a maximum of one audit per calendar year is permitted.

Costs. You bear the costs of the audit, including the costs of appointed auditors. You will reimburse our expenses for a Level 2 audit based on time spent at €179 per hour plus VAT. If the audit reveals a more than minor breach by us of this DPA or the GDPR, we will bear our expenses ourselves.

The rights of supervisory authorities remain unaffected.

Deletion and Return

Following the end of processing, we will delete all of your customers' data or return it to you, depending on your choice (Art. 28(3)(g) GDPR). Since we do not store any data from function logs and privacy webhooks, we have nothing to delete or return at this point.

After termination, we will only see new function logs without details. Function logs that have already been created are deleted by Shopify after 30 days. The app will no longer receive privacy webhooks once access is revoked.

Records of acceptance, revocation, and uninstallation do not contain any of your customers' data. We retain them for the duration of the DPA and thereafter until the end of the sixth calendar year following its termination, even after the app has been uninstalled. This allows us to demonstrate the conclusion and termination of this DPA (Art. 5(2) GDPR, Section 257 HGB). We delete them afterwards.

Term and Termination

The DPA takes effect upon your consent in the app. You can withdraw it at any time in the app settings using "Withdraw agreement". It also terminates automatically when you uninstall the app. Your discounts will continue to work unchanged after termination.

We may terminate the DPA with 30 days' notice, for example if we no longer offer optional access. Access will then be revoked. The confidentiality obligation survives the termination of the DPA.

Changes to this DPA

We may update this DPA, for example if the app, Shopify, or legal requirements change. Each version has a version number. In the event of material changes, we will ask you in the app to agree to the new version. Until then, the version you agreed to applies.

Liability and Final Provisions

Liability between you and us is governed by the provisions of our Terms and Conditions, unless Art. 82 GDPR provides otherwise. The rights of data subjects under Art. 82 GDPR remain unaffected.

Internal contribution. If a data subject brings a claim against you or us, each party shall, as between us, bear the damages to the extent that it is responsible for them (Art. 82(5) GDPR).

Indemnification. You indemnify us against third-party claims to the extent that they arise from you breaching your obligations under this DPA or the GDPR. This applies in particular if you use sensitive customer tags, lack a legal basis for the processing, or fail to inform your customers. The indemnification includes the reasonable costs of our legal defense. It does not apply to the extent that we contributed to the claim ourselves or you are not responsible for the breach of duty. We will notify you promptly if any such claim is brought against us.

German law applies. The place of jurisdiction is governed by our Terms and Conditions. Should any provision of this DPA be invalid, the remainder of this DPA shall remain effective.

Contact

If you have any questions about this DPA or data privacy, or if you wish to issue instructions to us, please send an email to mail@datora.de. You can reach us by mail at Datora GmbH & Co. KG, Efeuweg 8a, 33335 Gütersloh. All further details about us can be found in our Legal Notice.

© 2026 Datora GmbH & Co. KG.