Data processing agreement

1. Parties and subject matter

This agreement governs the processing of personal data on behalf of the merchant who uses the “Zuarbito” app in their Shopify store (the “Controller”) by Engin Ucar, Overbruckstr. 73, 47166 Duisburg (the “Processor”). It forms part of the terms of service for the app and applies as soon as the Controller accepts it in the app.

The subject matter is the processing of the data described in Annex 1 to clarify personalized orders: requesting missing details and files, receiving customer input, managing proofs and approvals, and providing production documents.

2. Duration

This agreement applies for the duration of the terms of service. It ends when the app is uninstalled; the deletion obligations under section 9 continue beyond that.

3. Nature and purpose of processing, types of data, data subjects

The nature and purpose of the processing, the types of data and the categories of data subjects are set out in Annex 1. Special categories of personal data are not subject to this agreement.

4. Instructions

The Processor processes the data only on documented instructions from the Controller. The Controller gives instructions by installing the app, through the settings in the app (rules, automation, templates, retention periods, fulfillment holds) and in text form to support@zuarbito.com. If the Processor considers an instruction unlawful, it informs the Controller without delay.

Processing takes place in the European Union; section 7 applies to transfers to third countries.

5. Obligations of the Processor

• It binds all persons involved in the processing to confidentiality.
• It implements the technical and organisational measures in Annex 2 and reviews them regularly.
• It assists the Controller with requests from data subjects, with the security of processing, with notifying personal data breaches and with data protection impact assessments, as far as the nature of the processing and the information available to it allow. Access and erasure requests received through Shopify are handled by the app within 30 days.
• It notifies the Controller of personal data breaches without undue delay after becoming aware of them, to the email address stored in the store.
• It makes available to the Controller the information necessary to demonstrate compliance with this agreement and allows reviews under section 8.
• It maintains a record of processing activities carried out on behalf of the Controller.

6. Sub-processors

The Controller approves the sub-processors listed in Annex 3. The Processor binds them contractually in line with this agreement.

If the Processor intends to add or replace sub-processors, it informs the Controller at least 30 days in advance in the app or by email to the address stored in the store. The Controller may object to the change for good cause; if no agreement is reached, the Controller may end the terms of service by uninstalling the app.

Shopify is not a sub-processor of the Processor but the platform commissioned by the Controller itself.

7. Processing in third countries

Servers and database are located in Lauterbourg, France (EU), files in Nuremberg, Germany. For sending emails the Processor uses Resend (Plus Five Five, Inc.) (USA, sending via Ireland); the email address, name, order number and message text are transmitted to the provider. When emails are sent through Resend, account and message data is stored in the United States. According to the provider, this is based on the EU standard contractual clauses and its certification under the EU-US Data Privacy Framework. Servers and database are hosted by Contabo in Lauterbourg (France, EU); uploaded files are stored by Hetzner in Germany.

8. Review rights

The Controller may verify compliance with this agreement by requesting information and evidence, for example the description of the measures in Annex 2 and the evidence provided by the sub-processors. On-site reviews are possible after notice with a reasonable lead time and without disrupting operations; where equivalent evidence exists, the Processor may refer to it.

9. Deletion and return

During the term, the app deletes data according to the periods set in the app: files of completed or cancelled orders after the retention period (default 90 days), production exports after 24 hours, unused pre-uploads after 24 hours, customer links on expiry (at most 7 days). The Controller can export production documents and files through the app at any time.

After uninstallation, customer links and scheduled messages stop immediately. With the deletion request triggered by Shopify (usually 48 hours after uninstallation), the Processor deletes all data of the store including files; until then the data is kept for a possible reinstallation. Backup copies are overwritten after 30 days. Statutory retention obligations of the Processor remain unaffected.

10. Final provisions

Liability, applicable law and place of jurisdiction follow the terms of service. In case of conflict between this agreement and the terms of service, this agreement prevails in matters of data protection. The German version prevails; this English version is for information.

Version 1.0 (2026-11-04). Processor: Engin Ucar, Germany.

Annex 1: Overview of the processing

Annex 2: Technical and organisational measures

• Access control: server access only with key-based login, firewall limited to ports 22, 80 and 443, automatic security updates, lockout after repeated login attempts.
• Encryption: TLS for all connections; sensitive fields (contact data, input, proof notes, access tokens) additionally encrypted with AES-256-GCM in the database; keys kept separate from backups.
• Tenant separation: every record carries the store identifier; database rules prevent links between stores; access only through the verified Shopify session.
• Customer links: random tokens with at least 128 bits, stored only as a hash, expiring after at most 7 days, revocable, not indexed by search engines, no state changes through links.
• Files: quarantine until the malware scan is complete, type and size checks independent of the file name, delivery only through short-lived signed addresses.
• Logging: technical events with identifiers, without tokens, portal addresses or raw personal data; activity log per order in the app.
• Availability: daily backup of the database and mirror of the files at the object storage provider, retention 30 days, restore verified.
• Deletion: retention periods in the app, privacy requests via Shopify within 30 days, deletion of the store after uninstallation.
• Organisation: access to the production environment only by the Processor; credentials in a password manager; changes through versioned code with automated tests.

Annex 3: Sub-processors

Version 1.0 (2026-11-04). Merchants accept this version when they first open the app.