Data Processing Agreement
This DPA forms part of, and is incorporated into, the Terms of Service (/legal/terms) (the "Agreement"). It is effective upon the Customer's acceptance of the Agreement, or upon first transmission of Merchant Personal Data to the service, whichever is earlier.
What this DPA is about, in one paragraph. DeploTeka creates and releases the Customer's dedicated Shopify apps and delivers their credentials to the Customer's own backend. The Customer's apps send their business data to the Customer's systems. DeploTeka does not retain shopper-event analytics. Its limited installation and extension verification may fetch configured storefront pages and assets. Processing on the Customer's behalf is described in Annex I: token delivery and verification, and the privacy requests Shopify sends about a store, which DeploTeka forwards to the Customer. This DPA exists for that processing.
1. Definitions
- "Data Protection Law" — all laws applicable to the processing of personal data under this DPA, including, where applicable, Regulation (EU) 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, and the Swiss FADP. "Controller", "processor", "data subject", "personal data", "personal data breach", and "processing" have the meanings given there.
- "Merchant" — a merchant store on which a dedicated app provisioned through the service is installed.
- "Merchant Personal Data" — personal data DeploTeka processes on the Customer's behalf in respect of a Merchant, as described in Annex I: (a) the Merchant's offline Admin API access token, with the store domain, the permissions granted and the install, delivery and uninstall timestamps, held in transit under token delivery; and (b) the content of the privacy webhooks Shopify sends about that Merchant (customer data request, customer redaction, shop redaction), which DeploTeka forwards to the Customer. Every obligation in this DPA — security, breach notification, sub-processing, deletion, assistance with data-subject requests — applies to both.
- "Sub-processor" — any third party engaged by DeploTeka to process Merchant Personal Data.
- "SCCs" — the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914, as amended or replaced.
2. Roles and scope
2.1 Roles. For Merchant Personal Data: the Merchant is the controller; the Customer acts as the Merchant's processor under its own arrangement with the Merchant; and DeploTeka processes Merchant Personal Data on the Customer's behalf as the Customer's (sub-)processor. DeploTeka's obligations in this DPA are those of a processor under Art. 28(3) GDPR regardless of its exact position in the chain.
2.2 Out of scope. This DPA does not cover data for which DeploTeka is a controller — the Customer's workspace and account data, the connected Shopify dashboard session and operational keys, billing data, contact-form submissions, and the records of the Customer's apps, stores, setup runs and audit log. Those are governed by the Privacy Policy (/legal/privacy). Where those records incidentally contain personal data of a Merchant's personnel (e.g. a store contact email or the identity of the person who approved an install, where Shopify supplies it), DeploTeka processes it only to provide the service. This exclusion does not remove the obligations for transient verification or the contents of forwarded Shopify privacy requests described in Annex I.
2.3 Instructions. DeploTeka will process Merchant Personal Data only on the Customer's documented instructions, including with regard to transfers, unless required to do otherwise by law to which DeploTeka is subject — in which case DeploTeka will inform the Customer of that legal requirement before processing, unless the law prohibits it on important grounds of public interest. The Agreement, this DPA, and the Customer's configuration of the service (in particular whether an app uses token delivery and which backend endpoint receives credentials and forwarded requests) constitute the Customer's complete documented instructions at signature. Additional instructions require written agreement. DeploTeka will immediately inform the Customer if, in its opinion, an instruction infringes Data Protection Law.
3. Details of processing
The subject matter, duration, nature and purpose of processing, the categories of data subjects and personal data, and the processing operations are set out in Annex I.
4. Customer obligations
4.1 The Customer warrants that its instructions are lawful and that it (or the relevant Merchant) has established a valid legal basis for the processing of Merchant Personal Data through the service.
4.2 The Customer is responsible for what its own backend does with the credentials and forwarded requests DeploTeka delivers to it: using a Merchant's access token only within the permissions the Merchant granted and only for the purposes agreed with the Merchant, and acting on each forwarded privacy request within the time Data Protection Law allows. DeploTeka's forwarding of a request does not discharge the Customer's or the Merchant's obligation to answer it.
4.3 The Customer will not instruct DeploTeka to process special categories of personal data (Art. 9 GDPR) or data relating to criminal convictions (Art. 10) through the service. The service has no field for them; none is expected in the data described in Annex I.
4.4 The Customer will ensure its own arrangements with each Merchant permit DeploTeka's engagement as (sub-)processor on the terms of this DPA, and will flow down obligations no less protective than those here.
4.5 The Merchant relationship is the Customer's. As between the parties, the Customer — not DeploTeka — owns and operates the relationship with each Merchant and is solely responsible for that relationship and its compliance, including the Customer's and, as between the parties, each Merchant's compliance with their respective agreements with Shopify. DeploTeka has no contractual relationship with any Merchant and, except for obligations mandatorily imposed on processors by Data Protection Law, owes no duty to any Merchant. Nothing in this DPA transfers to DeploTeka any risk arising from Shopify's terms, policies, or enforcement, or qualifies §§5.3, 5.4, 14, or 15 of the Agreement.
5. DeploTeka's obligations
DeploTeka will:
- (a) Instructions — process Merchant Personal Data only as per §2.3;
- (b) Confidentiality — ensure that persons authorized to process Merchant Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
- (c) Security — implement and maintain the technical and organizational measures described in Annex II, taking into account the state of the art, costs, and the nature, scope, context, and purposes of processing, as required by Art. 32 GDPR;
- (d) Sub-processors — engage Sub-processors only per §6;
- (e) Data-subject requests — taking into account the nature of the processing, assist the Customer by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the Customer's (or the Merchant's) obligation to respond to data-subject requests. DeploTeka does not retain shopper-event analytics; limited app or extension verification may inspect configured storefront pages and assets. Its assistance consists of forwarding Shopify's privacy requests to the Customer (Annex I) and producing, on request, the record of what it held about a Merchant and when it was destroyed. If a data subject contacts DeploTeka directly, DeploTeka will not respond substantively except to direct them to the responsible controller, and will promptly notify the Customer;
- (f) Assistance — taking into account the nature of processing and the information available to it, assist the Customer in ensuring compliance with Arts. 32–36 GDPR (security, breach notification, DPIAs, prior consultation);
- (g) Return and deletion — comply with §9;
- (h) Information and audit — comply with §8.
6. Sub-processors
6.1 Authorization. The Customer gives general written authorization for DeploTeka to engage the Sub-processors listed in Annex III.
6.2 Changes. DeploTeka will give the Customer at least 30 days' written notice (email to the account address) before adding or replacing a Sub-processor. The Customer may object in writing on reasonable data-protection grounds within 14 days of notice. The parties will then discuss in good faith; if no resolution is found, the Customer may terminate the affected part of the service (and, if that part is not severable, the Agreement) with pro-rata refund of prepaid fees. Continued use after the notice period without objection constitutes acceptance.
6.3 Flow-down. DeploTeka will impose on each Sub-processor, by contract, data-protection obligations no less protective than those in this DPA, and remains fully liable to the Customer for the Sub-processor's performance.
7. International transfers
7.1 Merchant Personal Data is stored and processed on DeploTeka's server in the European Union (Annex III). DeploTeka will not transfer Merchant Personal Data outside the EEA/UK/Switzerland (where the data originates there) except in compliance with Chapter V GDPR (or the UK/Swiss equivalents). DeploTeka itself is established in the United Kingdom, which benefits from an EU adequacy decision.
7.2 Where a transfer is made to a country without an adequacy decision, the parties agree that the Standard Contractual Clauses, Module Three (processor → sub-processor) or Module Two as the chain requires, are incorporated by reference, with: Clause 7 (docking) included; Clause 9(a) Option 2 (general authorization, 30 days); Clause 11 optional redress not selected; Clause 17/18 law and forum = an EU member state; Annexes populated from Annexes I–III of this DPA. The UK International Data Transfer Addendum and the Swiss FADP adaptations apply where UK/Swiss data is in scope.
8. Audit
8.1 DeploTeka will make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer (or, where required, by a Merchant exercising audit rights through the Customer).
8.2 Audit mechanics: first by written questionnaire and documentation review; an inspection on 30 days' notice, at most once per 12 months, during business hours, without disrupting production, under confidentiality, and at the Customer's cost — except that these limits do not apply where an audit is required by a supervisory authority or follows a personal data breach affecting the Customer's Merchant Personal Data.
9. Return and deletion
9.1 Automatic destruction. When a Merchant uninstalls, a newer token replaces it, or the Customer deletes the store in the cabinet, its token is retired from active use. The service records destruction work transactionally with the owning record change and retries physical removal of the sealed copy after storage failures. Store deletion also removes its app/setup records and schedules destruction of their sealed secrets. Pending destruction is not treated as permission to use a retired credential. A forwarded privacy request is not retained beyond the record that it was forwarded.
9.2 On request or termination. Upon termination of the Agreement, or upon the Customer's written request for a given Merchant (e.g. when a Merchant offboards), DeploTeka will, at the Customer's choice, delete or return the relevant Merchant Personal Data within 30 days, and delete existing copies, unless and to the extent storage is required by law — in which case DeploTeka will protect the retained data per this DPA and process it for no other purpose. Retired sealed copies remain until physical cleanup and expiration of backups containing them; storage or backup delays can extend retention (Annex II).
9.3 On request, DeploTeka will confirm deletion in writing.
10. Personal data breach
DeploTeka will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Merchant Personal Data. The notification will describe, to the extent then known: the nature of the breach, the categories and approximate volumes of data subjects and records concerned, likely consequences, measures taken or proposed, and a contact point — and will be supplemented as information becomes available. DeploTeka's notification is not an admission of fault. The Customer is responsible for onward notification to Merchants, supervisory authorities, and data subjects as Data Protection Law requires.
11. Liability and precedence
11.1 Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability in the Agreement — including the Customer's indemnity in §14 of the Agreement and the exclusions in §15 — and liability under the Agreement and this DPA is a single aggregate cap, not separate caps.
11.2 In the event of conflict between this DPA and the Agreement with respect to the processing of Merchant Personal Data, this DPA prevails. Where the SCCs apply, the SCCs prevail over both to the extent of any conflict. For all other matters — in particular the allocation of Shopify platform risk — the Agreement (including §§5.3, 5.4, 14, and 15) prevails, and nothing in this DPA is a conflict with it.
11.3 Platform risk unaffected. Nothing in this DPA — including the assistance, audit, and breach-notification obligations in §§5, 8, and 10 — makes DeploTeka responsible for any act or omission of Shopify, creates any DeploTeka obligation or liability in respect of the Customer's or any Merchant's Shopify accounts, apps, or Partner status, or limits or overrides the platform-risk allocation, Customer indemnity, and liability exclusions in §§5.4, 14, and 15 of the Agreement, which apply with full force to this DPA and to the processing under it. For clarity: a Shopify Action (as defined in the Agreement) — including suspension or termination of a dedicated app or of the Customer's accounts, and any resulting revocation of a Merchant's access token — is not a personal data breach by DeploTeka, is not a breach of this DPA, and gives rise to no DeploTeka liability.
12. Term
This DPA runs for as long as DeploTeka processes Merchant Personal Data under the Agreement, and §§8–11 survive until deletion is complete.
Annex I — Details of processing
DeploTeka processes Merchant Personal Data in two activities, both of which exist only for apps the Customer has set to token delivery. A Customer whose apps do not use token delivery sends DeploTeka no Merchant Personal Data at all: DeploTeka then creates and releases the Customer's dedicated apps and delivers each app's own client id and secret to the Customer, and never touches a Merchant's token.
Activity 1 — token delivery and installation verification
Subject matter: receipt of the OAuth authorization code Shopify returns when a Merchant installs one of the Customer's dedicated apps, exchange of that code for an offline Admin API access token, and transmission of that token to the Customer's own backend.
Duration: from the Merchant's approval until the token is superseded by a newer one, the Merchant uninstalls, or the Customer deletes the store — at which point the credential is retired and durable destruction work is recorded; physical removal is retried after storage failures. A token DeploTeka could not hand over — because the Customer's endpoint did not accept it — is retained until the Customer retries the delivery or the Merchant uninstalls, so that an outage on the Customer's side does not require every Merchant to re-install.
Nature and purpose: delivering the credential to the Customer and verifying its permitted app installation. Limited authenticated Admin API requests check credential validity, app identity and required extension state. The basic credential check requests the shop endpoint and retains the response status without parsing or storing its response body. Verification results and proof identifiers are retained; the token is not returned to the cabinet or written to logs. The token is sealed in the encrypted vault (Annex II) for the whole time it is held.
Categories of data subjects: the Merchant, and the individual who approves the install on the Merchant's behalf.
Categories of personal data: the store domain, the access token, the permissions the Merchant granted, and the timestamps of install, delivery, and uninstall. Verification outcomes and proof identifiers are retained. Optional extension verification may transiently fetch configured storefront pages and assets; no shopper-event analytics is retained.
Frequency: at install, re-consent and uninstall, and when the Customer requests supported installation or extension verification.
Activity 2 — forwarding Shopify's privacy requests
Subject matter: receipt of the privacy webhooks Shopify sends to a dedicated app about a Merchant — customers/data_request, customers/redact and shop/redact — verification of their signature, and forwarding of each to the Customer's backend.
Duration: each request is forwarded on receipt; if the Customer's endpoint does not accept it, DeploTeka declines the webhook so that Shopify retries it rather than letting it be lost. DeploTeka keeps the record that a request was forwarded (or could not be) in the audit log; it does not keep the request content.
Nature and purpose: relaying a request to the party that holds the data it concerns. DeploTeka holds no customer data to act on itself. Requests for a store whose app has already been uninstalled are still forwarded.
Categories of data subjects: the Merchant, and the Merchant's customers named in a request.
Categories of personal data: whatever Shopify places in the request — typically the store domain, the customer's identifier, email address and phone number, and the orders concerned — in transit only.
Frequency: as Shopify sends them.
Special categories (both activities): none intended or permitted; see §4.3.
Annex II — Technical and organizational measures (Art. 32)
- Encryption in transit: TLS for all traffic between the Customer, DeploTeka, Shopify and the Customer's backend.
- Encryption at rest of credentials: every Merchant access token, Shopify dashboard session, operational key and install link is sealed with AES-256-GCM envelope encryption — a fresh data key per secret, wrapped by a master key that is not stored in the database, with the tenant bound as authenticated data so a secret cannot be unsealed for a different tenant. Secrets are unsealed server-side only, never rendered to a client and never written to logs; what appears in records is a reference or fingerprint, not the value. This is an implementation fact, not a certification.
- Destruction: uninstall, token replacement, store deletion and Shopify-session disconnection retire the affected credentials from active use and record durable destruction work. Failed physical deletion is retried without restoring access. Destruction outcomes and failures are recorded without secret values.
- Tenant isolation: every read and write is scoped to the owning tenant at the data-access layer; a webhook for a shop that cannot be mapped to exactly one tenant is refused rather than guessed.
- Ingress integrity: every webhook from Shopify (install, uninstall, privacy requests) is HMAC-verified against the dedicated app's secret before it is acted on; unauthenticated or malformed input is rejected; public endpoints are rate-limited with input validation and size caps.
- Logging discipline: request bodies are not logged; log lines are drawn from an allowlist of fields that excludes secrets, cookies, tokens and install URLs.
- Audit log: every connect, disconnect, setup, release, credential delivery, forwarded privacy request and deletion is recorded with actor, target, time and outcome — references and outcomes only, never secret values.
- Access control: destructive actions (disconnecting, deleting a store) are limited to workspace owners and admins and require a confirmation that states what will be destroyed; every state-changing request is CSRF-protected.
- Backups: the database is scheduled for backup every six hours, with the newest 28 copies retained. Sealed secrets stay sealed inside backups, whose master key is held separately. A retired copy remains until physical cleanup and expiration of backups containing it; storage failures or delayed backup rotation can extend retention. Recovery must preserve deletion decisions and complete pending destruction before returning restored data to use.
- Change safety: releases apply the scopes the Customer approved and are recorded per store; a store's install link is unsealed only on demand through an audited server round-trip, never embedded in a page or a log.
Annex III — Authorized Sub-processors
| Sub-processor | Purpose | Merchant Personal Data processed | Location / region | Transfer mechanism |
|---|---|---|---|---|
| Scaleway SAS | Hosting of the application, its database and backups (also hosts DeploTeka's own mail server and booking page) | All Merchant Personal Data, at rest in the database and backups and in transit on the server | Amsterdam, the Netherlands (European Union) | N/A — in-region |
The following providers run parts of DeploTeka's business but do not process Merchant Personal Data; they are listed here so the Customer sees the whole picture, and are described further in the Privacy Policy §5:
| Provider | Purpose | Merchant Personal Data processed | Location / region |
|---|---|---|---|
| Stripe | Subscription payments and invoicing for the Customer's own subscription | None — only the Customer's billing data | EU/UK entities; Stripe, Inc. in the United States under Stripe's own standard contractual clauses |
| Cloudflare, Inc. | DNS for deploteka.com only | None — no traffic passes through Cloudflare | United States (DNS network worldwide) |
Shopify is not a Sub-processor of DeploTeka: it is the Customer's own platform and the source of the data. GitHub, where the Customer connects a repository, is likewise the Customer's own platform and carries no Merchant Personal Data.
Acceptance: this DPA is accepted electronically together with the Terms of Service.