Data Processing Agreement Codixio EmpCo Product Info

1. Parties

Controller: the merchant who installs the app Codixio EmpCo Product Info in its Shopware shop. Processor: Matthias Jakisch, Hauptstr. 34, OT Etingen, 39359 Oebisfelde-Weferlingen, Germany, phone +49 39059 974988, e-mail general support@codixio.com, e-mail data protection and legal legal@codixio.com, sole proprietorship (no commercial register entry), operating under the trade name Codixio, VAT ID DE296346917, small business under Sec. 19 UStG. This agreement is concluded upon installation of the app and supplements the terms and conditions at https://legal.codixio.com/apps/empco-product-info-shopware/terms.en.

2. Subject matter and duration

The subject matter is the processing of personal data by the processor in the course of operating the app pursuant to Art. 28 GDPR. The duration corresponds to the use of the app; the agreement ends with uninstallation and the subsequent deletion under clause 10.

3. Nature and purpose of processing

Provision of the app: registration of the shop, determination of the booked plan, answering retrievals of supplementary product information from the controller's storefront, execution of the administrative functions (report, export, import, compliance export, bulk assignment) on the controller's instruction, and retention of compliance copies in the Enterprise plan.

4. Categories of data and data subjects

Data categories: shop identifier, shop address, technical access credentials, plan data; on storefront retrieval the shop, product and language identifiers and an IP address held in truncated, hashed form for no more than 60 seconds; for administrative functions and compliance copies the product and manufacturer information the controller maintains in the custom fields. Data subjects: the controller and its staff, visitors of the controller's storefront (transient only), and natural persons the controller names in manufacturer or responsible-person fields.

5. Instructions

The processor processes data only on documented instructions from the controller. The controller issues instructions through installation, configuration and use of the app and in text form to legal@codixio.com. If the processor considers an instruction unlawful, it informs the controller without delay.

6. Confidentiality

The processor processes the data personally; it has no employees. Should it engage persons in future, it will bind them to confidentiality.

7. Technical and organisational measures

Operation exclusively in data centres in Germany; transport encryption of all connections; signed requests between shop and backend; server-side plan verification; rate limiting without storing IP addresses; separate database per app; access to server and database only for the processor using key-based authentication; no logging of field content or IP addresses in application logs; automated deletion runs; deletion of all shop data on uninstallation. The processor develops the measures in line with the state of the art.

8. Sub-processors

The controller approves Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, as hosting provider for application servers and the Postgres database (data centres Falkenstein and Nuremberg). Coolify is used as self-operated container orchestration without an external service provider. No further sub-processors, in particular no mailing or AI services, are used. The processor announces intended changes at least four weeks in advance; the controller may object and uninstall the app.

9. Assistance and notifications

The processor assists the controller in responding to data subject requests, in data protection impact assessments and in consultations with the supervisory authority, insofar as processing under this agreement is concerned. The processor notifies the controller of personal data breaches without undue delay and no later than 48 hours after becoming aware, with the information required under Art. 33 para. 3 GDPR.

10. Deletion and return

On uninstallation, the processor automatically deletes all data stored for the shop. Compliance copies are deleted 24 months after creation regardless. Before uninstallation, the controller may secure compliance copies via the export in the app.

11. Evidence and audits

On request, the processor provides the controller with the information necessary to demonstrate compliance with this agreement and allows audits to a reasonable extent after prior coordination.

12. Delimitation

The custom fields maintained in the shop and their display in the storefront (Standard plan in full, in higher plans the display) are processed exclusively by the controller's shop system; they are not subject to this agreement. The processor carries out no processing under its own responsibility.

13. Final provisions

German law applies. Amendments require text form. The version published at https://legal.codixio.com/apps/empco-product-info-shopware/dpa.en applies.