Data Processing Agreement (Codixio Back in Stock)

1. Parties and subject matter

This agreement governs the processing of personal data on behalf of the controller pursuant to Art. 28 GDPR in connection with the use of the Codixio Back in Stock extension.

The client is the merchant who uses the extension in their Shopware shop. The merchant is the controller within the meaning of Art. 4 no. 7 GDPR.

The contractor is: Matthias Jakisch, Hauptstr. 34, OT Etingen, 39359 Oebisfelde-Weferlingen, Germany. Phone +49 39059 974988. E-mail general support@codixio.com, e-mail data protection and legal legal@codixio.com. Legal form: sole proprietorship (no commercial register entry), operating under the trade name Codixio. VAT identification number pursuant to Sec. 27a UStG: DE296346917. Tax status: small business under Sec. 19 UStG.

This agreement comes into effect upon installation of the extension in the client's shop and applies for the duration of use.

2. Subject matter and duration of the processing

The subject matter is the receipt, storage and processing of sign-ups for notification about the renewed availability of products, together with the associated sending of e-mails through the client's mail infrastructure.

The processing continues for as long as the extension is installed in the client's shop. It ends upon uninstallation; the legal consequences are governed by section 10.

3. Nature and purpose of the processing

Nature of the processing: collection, storage, organisation, retrieval, use, transmission to the client's shop for the purpose of sending mail, and erasure.

Purpose: operation of the notification function, namely receipt of the sign-up, execution of the confirmed sign-up procedure, determination of renewed availability on the basis of the shop's stock messages, the one-off sending of the notification per sign-up, unsubscription and, depending on the plan booked, reminders, evaluations without personal reference, data export and the triggering of events for the client's Flow Builder.

4. Types of data and categories of data subjects

Types of data processed: e-mail address of the person signing up; product, sales channel and shop identifiers; desired quantity; language indicator; check value of the confirmation link; processing status and timestamps of the sign-up; dispatch record per sign-up and type of e-mail; the notification address stored by the client; transiently, the sender's IP address for limiting sign-ups.

Not processed: customer accounts, order, payment, invoice and address data of the shop, and any other customer master data.

Categories of data subjects: end customers and visitors of the client's shop who sign up for notification, and employees of the client whose address is stored as the notification address.

5. Right to issue instructions

The contractor processes the data exclusively within the scope of this agreement and in accordance with the documented instructions of the client. The configuration of the extension in the shop constitutes an instruction. Further instructions are issued in text form to legal@codixio.com.

If the contractor considers that an instruction infringes data protection law, the contractor shall inform the client without undue delay. The contractor is entitled to suspend execution until the instruction is confirmed or amended.

The contractor does not process the data for its own purposes, in particular not for advertising, analysis or training purposes, and does not disclose it to third parties unless otherwise provided in this agreement.

6. Delimitation

The extension serves pages for confirmation and unsubscription via the contractor's infrastructure which data subjects open directly from an e-mail. The submission of the sign-up form is likewise sent directly from the data subject's browser to the contractor's infrastructure. These operations form part of the processing on behalf of the controller under this agreement; the client remains the controller. The contractor pursues no purposes of its own in this context and collects no data beyond that listed in section 4.

7. Confidentiality

The contractor is bound to confidentiality. As the contractor is a sole proprietorship without employees, the processing is carried out exclusively by the contractor personally. Should employees be engaged in future, they will be bound to confidentiality and instructed in data protection before taking up their duties.

8. Technical and organisational measures pursuant to Art. 32 GDPR

The contractor implements the following measures:

Confidentiality: access to the infrastructure exclusively via authenticated connections; separate access credentials per system; data held in separate databases per application; strict separation of data per shop, with every query scoped to the respective shop.

Integrity: transmission exclusively over transport-encrypted connections; authentication of requests between shop and extension by means of a signature procedure; confirmation and unsubscribe links exclusively as random values which are not stored in plain text but as a check value; protection against repeated processing of incoming messages; protection against duplicate dispatch by means of recorded dispatch operations.

Availability and resilience: operation in data centres with redundant power supply and network connectivity; regular data backup; recoverability of the data stocks.

Data minimisation and storage limitation: collection exclusively of the data listed in section 4; no collection of order or customer master data; server-side resolution of product details instead of adoption from the browser; no storage of IP addresses beyond the limiting of sign-ups; no personal data in application logs; automatically recurring erasure in accordance with the periods set out in section 9.

Review: the program code is safeguarded by automated checks which continuously demonstrate, among other things, the separation per shop, the erasure periods, the complete erasure upon uninstallation and the absence of personal data from the logs.

9. Storage period

An upper limit of 24 months applies from creation of the sign-up, irrespective of its processing status. Within this limit: unconfirmed sign-ups are erased after fourteen days, unsubscribed sign-ups after thirty days, technical event data of incoming stock messages after thirty days. Dispatch records are erased together with the associated sign-up. Erasure is carried out by an automatically recurring run and is final.

10. Erasure and return upon termination

Upon uninstallation of the extension, the contractor erases all data of the shop concerned in full, namely the sign-ups including the e-mail addresses, the dispatch records, the settings including the notification address, the product-level switches, the technical event data as well as the registration and plan data of the shop. If the client expressly requests the retention of the data during uninstallation by means of the Shopware function, erasure does not take place; in that case the periods set out in section 9 continue to apply.

The client may obtain the return of the data prior to uninstallation by means of the export function contained in the extension, insofar as the plan booked includes it. Upon request, the contractor provides the data in a common format.

Backups are overwritten within the ordinary backup cycle.

11. Sub-processors

The client consents to the engagement of the following sub-processor: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Activity: hosting provider for application servers and Postgres database. Place of processing: data centres Falkenstein (Germany) and Nuremberg (Germany). Third country transfer: no. In addition, Coolify is used as self-operated open source container orchestration on this infrastructure; this is not an external service provider.

There are no further sub-processors. In particular, no external dispatch service provider is engaged; all e-mails are sent through the client's mail infrastructure. No service for analytics or reach measurement and no provider of artificial intelligence systems is engaged.

The contractor shall inform the client in text form in good time of the intended engagement of a further sub-processor. The client may object within fourteen days for good cause relating to data protection; in that case the client is entitled to terminate the agreement extraordinarily.

12. Third country transfers

No processing of personal data takes place outside the European Economic Area.

13. Duties to provide assistance

The contractor assists the client, to a reasonable extent, in fulfilling the rights of data subjects under Art. 12 to 23 GDPR, in notifying personal data breaches under Art. 33 and 34 GDPR, in data protection impact assessments under Art. 35 GDPR and in prior consultations under Art. 36 GDPR.

If a data subject approaches the contractor directly, the contractor shall forward the matter to the client without undue delay and shall respond only on the client's instructions, unless the matter concerns the exercise of the unsubscribe route which the extension itself provides.

14. Notification of breaches

The contractor shall notify the client of a personal data breach without undue delay after becoming aware of it, and at the latest within 24 hours, in text form to the address designated by the client. The notification shall contain, insofar as known, the nature of the breach, the categories of data affected, the approximate number of data subjects, the likely consequences and the measures taken.

15. Evidence and audits

The contractor shall demonstrate compliance with the obligations under this agreement in text form upon request. The client is entitled to satisfy itself of compliance. On-site inspections are permissible with reasonable prior notice, during ordinary business hours and without disrupting operations; they are limited to what is necessary.

16. Liability

Art. 82 GDPR applies. In all other respects, the liability provisions of the general terms and conditions apply, available at https://legal.codixio.com/apps/back-in-stock-shopware/terms.en.

17. Final provisions

Amendments and additions to this agreement require text form. Should any provision be invalid, the validity of the remaining provisions shall remain unaffected.

The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods.

Further documents: privacy policy at https://legal.codixio.com/apps/back-in-stock-shopware/privacy.en, general terms and conditions at https://legal.codixio.com/apps/back-in-stock-shopware/terms.en.