Data Processing Agreement pursuant to Art. 28 GDPR for the App Codixio Lowest Price 30 Days
1. Parties
The controller is the operator of the Shopware shop installing the app Codixio Lowest Price 30 Days (merchant). The processor is Matthias Jakisch, Hauptstr. 34, OT Etingen, 39359 Oebisfelde-Weferlingen, Germany, phone +49 39059 974988, e-mail support@codixio.com, e-mail data protection/legal legal@codixio.com, sole proprietorship (no commercial register entry), operating under the trade name Codixio, VAT ID DE296346917, small business under Sec. 19 UStG (contractor). This agreement is concluded upon installation of the app and supplements the terms and conditions at https://legal.codixio.com/apps/lowest-price-30-days-shopware/terms.en.
2. Subject and duration
The subject is the operation of the app's backend at sw-codixiolowestpriceapp.api.codixio.com, which records product price data for the merchant, calculates the lowest price of the last 30 days and writes the results back to the shop. The duration corresponds to the installation period of the app. The agreement ends upon uninstallation; the contractor deletes the data in accordance with section 9.
3. Nature, purpose, data categories and data subjects
Nature and purpose: storage of shop registration and plan data, recording and storage of product price data with timestamps, calculation of reference prices, writing back results as custom fields, provision of an administration module including evidence export. Data categories: shop identifier, shop URL, shop API credentials, plan identifier, product and variant identifiers, prices, strike-through prices, identifiers of currencies, sales channels, price rules and customer groups, timestamps, campaign and alert entries. Data subjects: the merchant and its employees insofar as registration data contain a personal reference. The merchant's end customers are not affected; the app processes no customer, order or payment data.
4. Instructions
The contractor processes the data exclusively within the scope of this agreement and the merchant's documented instructions. Instructions arise from installation, configuration of the app in the Shopware administration, the selected plan and uninstallation. If the contractor considers an instruction unlawful, it informs the merchant without delay. The contractor is not subject to any deviating statutory processing obligation; should one arise, it will inform the merchant before processing, insofar as the law permits.
5. Confidentiality
The contractor undertakes to maintain confidentiality. Persons with access to the data are bound to confidentiality. Access is restricted to the contractor.
6. Technical and organisational measures
Operation exclusively in data centres in Germany (Hetzner, Falkenstein and Nuremberg). Encrypted transmission (TLS) and signature verification of all requests between shop and backend. Separation of data per shop by shop identifier in all records. Access to servers and database only via authenticated, encrypted connections. Regular database backups on the same infrastructure. No storage of IP addresses in the database. Automatic deletion after expiry of retention periods and upon uninstallation. The contractor adapts the measures to the state of the art without lowering the level of protection.
7. Sub-processors
The merchant approves the use of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, as hosting provider for application servers and Postgres database (processing location Falkenstein and Nuremberg, no third-country transfer). Coolify is used as self-operated open-source container orchestration on this infrastructure and is not a sub-processor. No further sub-processors, in particular no mailing or AI services, are used. If the contractor intends to replace or add a sub-processor, it informs the merchant at least four weeks in advance in text form; the merchant may object within this period for good cause.
8. Support of the merchant
The contractor supports the merchant with reasonable means in responding to requests of data subjects, in the security of processing, in notifying personal data breaches and in data protection impact assessments, insofar as processing under this agreement is concerned. The contractor notifies the merchant of personal data breaches in the backend without delay to the contact address stored in the Shopware account.
9. Deletion and return
Upon uninstallation of the app the contractor deletes all data of the shop in the backend. A return is not required because the results remain as custom fields in the merchant's shop and the evidence export in the Max plan can be retrieved at any time before uninstallation. Backup copies are overwritten within the backup cycle.
10. Evidence and audits
On request the contractor provides the merchant with the information necessary to demonstrate compliance with this agreement and allows audits announced with reasonable notice that do not unreasonably impair operations. Audits are conducted primarily by written information.
11. Third countries
No processing takes place outside the European Union or the European Economic Area.
12. Final provisions
German law applies. In all other respects the terms and conditions at https://legal.codixio.com/apps/lowest-price-30-days-shopware/terms.en and the privacy policy at https://legal.codixio.com/apps/lowest-price-30-days-shopware/privacy.en apply. Version date: 18 September 2026.