DOCUMENTS
Documents for your review
Data processing agreement, technical and organisational measures, sub-processors and deletion policy — no request, no form.
01 / WHY HERE
Because the question comes anyway.
Every data protection officer asks for these four documents before anything is installed. Hiding them behind a sales conversation costs both sides two weeks and answers the same question in the end.
02 / THE DOCUMENTS
Four documents.
Data processing agreement (Art. 28 GDPR)
Subject matter, duration, nature and purpose of processing, categories of data subjects, right to issue instructions, sub-processing, return and deletion. It is concluded electronically and without paper, separately for each account: in the customer portal under “Privacy” or when setting up through the Shopify app. Its three annexes are the documents below in the same version. The record with the agreed text is kept in the portal.
Technical and organisational measures (Art. 32 GDPR)
Physical access, system access, data access, transfer, input, processor and availability control and separation — with what is actually built into this software for each.
Annex to the DPA: further processors
Who processes on our behalf under Art. 28 GDPR, for what, where, and on which basis for any transfer outside the EU. Recipients acting as their own controller are listed separately there.
Deletion policy
Which data stays for how long, what happens when a person is erased, and why a suppression list arises in the process.
03 / SERVICE PROVIDERS AND RECIPIENTS
Who receives data — and in which role.
This overview names every recipient, whatever their role. It is not a contractual annex: the annex to the data processing agreement lists only those who process on our behalf under Art. 28 GDPR and sets the others out separately. Read this table to see who receives your data; read the annex to see what we are liable for as a processor.
| Company | Purpose | Role | Place of processing | Basis for third-country transfer |
|---|---|---|---|---|
| Google Cloud EMEA Limited | Operation of the application, database, secret management, scheduling, load balancing and TLS | Processor | EU – europe-west3 (Frankfurt); separately, administration and system logs of the cloud platform in global logging buckets of the provider that cannot be moved to a region (up to 400 days; a further global bucket with seven days, to which the application logs are not written) | EU–US adequacy decision (EU-US Data Privacy Framework) to the extent of the recipient’s certification; in addition, and for companies that are not certified, EU standard contractual clauses. A copy of the safeguards is available via privacy@metrunio.com |
| Google Cloud – BigQuery | Analytics mirror of the measurement data of all tenants in the same environment, separated per tenant; a tenant’s reports are calculated from it once data volumes are larger or retention exceeds 180 days | Processor | EU – europe-west3 (Frankfurt) | EU–US adequacy decision (EU-US Data Privacy Framework) to the extent of the recipient’s certification; in addition, and for companies that are not certified, EU standard contractual clauses. A copy of the safeguards is available via privacy@metrunio.com |
| Google Cloud – Vertex AI | Language model behind the data assistant in the portal; receives the question, metrics and, where the question calls for it, individual conversions and journeys | Processor | EU – europe-west3 (Frankfurt) | EU–US adequacy decision (EU-US Data Privacy Framework) to the extent of the recipient’s certification; in addition, and for companies that are not certified, EU standard contractual clauses. A copy of the safeguards is available via privacy@metrunio.com |
| Google Workspace | Mailbox for support, contract and data-subject requests; sending of system mails, including reports and alerts containing client data in the body and as attachments, with a copy under “Sent”; measurement data only where it appears in that correspondence or in those mails | Processor | Data region Europe, set by policy on 18 September 2026; exceptions for logs and cache and the migration status remain to be evidenced | EU–US adequacy decision (EU-US Data Privacy Framework) to the extent of the recipient’s certification; in addition, and for companies that are not certified, EU standard contractual clauses. A copy of the safeguards is available via privacy@metrunio.com |
| Brevo (Brevo GmbH / Sendinblue SAS) | Sending our newsletter; for a transition period, receiving inbound support mail. System and support e-mails have been sent via Google Workspace since 1 October 2026 | Processor | EU – France and Germany (OVH), Belgium (Google Cloud) | EU standard contractual clauses with supplementary measures; for the US additionally the EU–US adequacy decision (Data Privacy Framework); for Canada the adequacy decision |
| Stripe Payments Europe, Ltd. | Payment processing: billing address, payment method, invoice and subscription status. No measurement data | Dual role | EU – Ireland | EU–US adequacy decision (EU-US Data Privacy Framework) to the extent of the recipient’s certification; in addition, and for companies that are not certified, EU standard contractual clauses. A copy of the safeguards is available via privacy@metrunio.com |
04 / CHANGES
What happens when something changes.
NOTICE PERIOD
We announce a new direct processor here at least 30 days before its engagement and notify it by email to the address on the account. If one of them engages a new further processor, we forward its notice at the latest five working days after receipt. You may object; section 7 of the data processing agreement governs what follows.