Data Processing Agreement (Art. 28 GDPR)

Between the merchant who installs the Shopify app “Adressfix: Address Validator” (“Controller”) and Appsentials, Luis Benz, Comeniusstr. 4, 01307 Dresden, Germany (“Processor”). This agreement applies automatically while the app is installed and supplements the Shopify API terms and our privacy policy. Version: October 2026.

1. Subject, duration, nature and purpose

The Processor checks the shipping addresses of the Controller's orders for errors, informs the Controller's customers about errors and writes corrected addresses back to the order. Processing lasts as long as the app is installed.

2. Data and data subjects

Data subjects: the Controller's customers. Data: name, shipping address and e-mail address of an order, processed transiently. Stored permanently is only the order ID, the destination country and which check failed – no names, addresses or e-mail addresses.

3. Instructions

The Processor processes the data only on the documented instructions of the Controller, which are given through the app's settings (rules, order check, customer e-mails), and informs the Controller if an instruction infringes data protection law.

4. Confidentiality and security

Persons authorised to process the data are bound to confidentiality. Technical and organisational measures: TLS encryption in transit, encrypted storage and backups (Fly.io, Frankfurt, EU), access restricted to the Processor's own accounts with strong passwords, separation of test and production data, deletion as described in section 8.

5. Sub-processors

The Controller authorises these sub-processors:

• Fly.io, Inc. – hosting, region Frankfurt (EU)
• Sendinblue SAS (Brevo), France (EU) – sending correction e-mails to customers, only if enabled
• Shopify – the platform the app runs on

Postal reference data (OpenPLZ) is queried by postal code only; no personal data is sent. The Processor informs the Controller about intended changes of sub-processors in advance; the Controller may object by uninstalling the app.

6. Support of the Controller

The Processor supports the Controller in answering data subject requests (Shopify's customers/data_request and customers/redact are processed automatically), in security and breach notifications, and in data protection impact assessments, as far as the processing by the app is concerned.

7. Personal data breaches

The Processor notifies the Controller without undue delay after becoming aware of a personal data breach.

8. Deletion

Open correction links are deleted at uninstall; all remaining data of the shop is deleted when Shopify sends shop/redact (48 hours after uninstalling). Data of individual orders is deleted on customers/redact.

9. Audits

The Processor provides the information necessary to demonstrate compliance with Art. 28 GDPR on request.

Contact

hello@monetais.de · Appsentials, Luis Benz, Comeniusstr. 4, 01307 Dresden, Germany.