Data processing agreement pursuant to Art. 28 GDPR

The subject matter is the provision of the measurement service “Metrunio”: collecting, storing, linking and evaluating events to measure advertising contacts and conversions on the client’s websites independently.

Revenue reconciliation. The subject matter also includes the revenue reconciliation of orders and refunds that the client’s shop reports server-side and for which it transmits no decision on consent to tracking because none was made. The sole purpose is matching revenue, recognising duplicate transactions and assigning refunds.

• Only the tenant and source, the order number as order key, the type of transaction (order or refund), amount and currency, the business day without time and the environment flag are processed. The contractor removes all other fields before storage, in particular browser, session, customer and advertising identifiers, IP attribute, page addresses, campaign details and items.
• Excluded are linking to visits, journeys or advertising contacts, attribution, forwarding to advertising platforms, profiling, passing individual orders of this kind to the data assistant and any use of the contractor’s own. The data assistant may use metrics that include them; with small case numbers the amount and day of an individual order may be derivable from them.
• The data is deleted with the tenant’s raw-data retention period.
• The client may cancel this revenue reconciliation in the portal at any time; the setting is an instruction that only persons with the administration role can change, and it is recorded in the tenant’s log. The contractor then rejects such orders; orders already stored are deleted with the raw-data retention period. The extension to orders after a refusal requires revenue reconciliation to be switched on.
• An objection by a data subject to revenue reconciliation is implemented by the client in the portal’s privacy area using the order number as identifier, or by the contractor on the client’s instruction: the data of the transaction including refunds is deleted and the order number is blocked for future reports and imports.
• Orders for which the shop transmits a refusal are processed this way only if the client has given a separate supplementary instruction for it and the contractor has activated it for the tenant; otherwise the contractor rejects them. A transmitted refusal is never treated as a missing decision. Orders reported with consent that is later withdrawn are not transferred into revenue reconciliation (section 8).
• The client is responsible for the legal basis towards buyers, for informing them about purpose, legal basis and how to object in its own privacy notice and for honouring an objection (section 4).

The agreement runs for as long as the main contract for use of the software; no separate termination is required.

It continues to apply beyond that for as long as the contractor still processes the client’s data, i.e. until return or deletion under section 9, including remaining backups and copies held by sub-processors. During that period in particular the duty to follow instructions, confidentiality, security of processing, notification of breaches and assistance with data subject rights remain in force.

Only data transmitted by the client, or caused to be transmitted by the client, through the provided interfaces is processed. The sole purpose is the provision of the measurement service.

• receiving and validating events (delivery, viewability, click, site visit, interaction, conversion)
• linking events into journeys through unambiguous identifiers
• calculating attribution shares according to the models chosen by the client
• providing reports, exports and interfaces
• on explicit instruction: forwarding conversions to the advertising platforms named by the client
• revenue reconciliation of server-side orders without consent to tracking, to the extent set out in section 1
• on a question from an authorised person of the client in the portal: answering through a data assistant. Metrics and individual conversions and journeys go to the language model of a further processor (annex) – at most 300 rows per question; the tenant’s order numbers and journey identifiers only as codes that apply to this one request; earlier answers containing individual records not again; orders reported without consent not individually. A number typed in that cannot be matched to a record of the tenant goes to the model as text

Data subjects are visitors to the client’s websites and — for server-side reported completions — the client’s customers.

• pseudonymous identifiers for session, device, click and impression
• tenant-specific pseudonymised customer identifiers; a plaintext or hashed value passed in, such as the SHA-256 of the e-mail address, is pseudonymised on receipt via HMAC with a tenant-specific key and stored only in that form
• order and case numbers, values and currencies
• technical attributes in truncated or hashed form; IP addresses are processed in transit and for rate limiting and stored in the event data only as a truncated hash formed with a secret and the client’s identifier – in the measurement mode without consent not at all
• the consent state for each event

The contractor processes the data only on documented instructions from the client, including with regard to transfers to third countries, unless it is required to do so by Union or Member State law; in that case it informs the client before processing unless that law prohibits it.

The settings in the product, in particular retention period, attribution windows, forwarding to platforms, consent mapping and the data assistant, constitute instructions; their changes are traceable in the tenant’s log. Instructions outside the product are given by the client in text form. Product settings do not extend the purpose under section 2.

Persons with the administration role in the tenant and further persons the client names in text form are entitled to issue instructions. Where there is doubt about authorisation, the contractor has the instruction confirmed by one of these persons.

If the contractor considers an instruction unlawful, it informs the client without undue delay and suspends the part concerned until it is clarified. It does not carry out an instruction recognised as unlawful even if it is repeated.

The client is responsible for the legal basis, informing data subjects, any necessary consents and the lawfulness of its instructions.

All persons involved in the processing are bound to confidentiality and instructed in data protection requirements. Support access to tenant data is possible only after explicit, time-limited authorisation by the client, is separately logged and is shown visibly in the product.

The processor implements the measures described in the separate annex “Technical and organisational measures” pursuant to Art. 32 GDPR. Changes may not fall below the level of protection.

The client consents to the use of the further processors listed in the annex “Further processors”.

Direct sub-processors. The contractor announces a new or replaced further processor that it engages itself at least 30 days before its engagement on the website under “Documents” and in text form to the address stored in the account. Within this period the client may object on objective grounds relating to data protection. As long as the objection is unresolved, the new processor receives no data of the client. If no solution is reached, the client has a special right to terminate as of the date of the change; until then the new processor receives no data of the client.

Further tiers: secured notice. For the client’s data the contractor uses only sub-processors that have undertaken to announce the engagement of a new further processor at least 30 days before it receives data; exceptions only under the paragraph “Sub-processors without secured notice”. The annex states this undertaking for each sub-processor. The contractor forwards such a notice without undue delay, at the latest five working days after receiving it, by the route described in the previous paragraph. The notice states the recipient, activity, place of processing, transfer basis, the day from which the new further processor receives data (start date) and whether, according to the provider, its activity can also cover backups or copies pending deletion.

Objection to a further tier. The client may object on grounds relating to data protection up to ten days before the start date, but in any case within 14 days of receiving the notice. If the contractor cannot ensure that the client’s data does not reach the new tier, the client may terminate this agreement and the main contract with immediate effect. The contractor then accepts no further data of the client from receipt of the termination, makes the data available for export on request and deletes the active data under section 9 before the start date, at the latest five working days after receiving the termination. Backups and copies held by the cloud provider are deleted under section 9 and may exist until then; if the new further processor’s activity also covers them, the notice says so, and the contractor does not undertake to delete those copies earlier. The contractor refunds fees paid in advance for the period after termination on a pro-rata basis.

Late notice. If the contractor receives a sub-processor’s notice late or forwards it later than agreed, the rights under the previous paragraph apply from receipt of its notice; the client may then object within 14 days of receipt even if the start date is earlier. The notice states the reason for the delay. At the client’s request the contractor suspends acceptance of new data until the objection is decided.

Sub-processors without secured notice. Where the annex names a sub-processor without this undertaking, it receives the client’s data only to the extent described there. If it announces a new further processor, from receipt of the notice the contractor no longer routes the client’s data through it but through another sub-processor named in the annex, and gives notice as above. Data of the client already held by it at that point is deleted there by the contractor to the extent the sub-processor’s interfaces allow; otherwise the notice states the type and retention period of that data.

With every further processor we conclude a contract in writing, including in electronic form, imposing the same data protection obligations: adherence to instructions, confidentiality, the measures under Art. 32 GDPR at a level that does not fall below this one, assistance with data-subject requests and notification duties, audit and evidence rights, and deletion or return at the end. We are liable for their compliance as for our own conduct.

The contractor assists the client in fulfilling data subject rights. Access, erasure and objection can be carried out in the product’s privacy area without involving the contractor. Rectification, restriction of processing and data portability are carried out by the contractor on instruction in a documented procedure; a restriction keeps the data in a protected store and is not replaced by erasure. Requests from data subjects received by the contractor are forwarded to the client without undue delay and not answered by the contractor itself.

An erasure continues to apply through a suppression list, so that the same identifier is not captured again immediately afterwards. Only a checksum of the identifier is stored, not the identifier itself. The checksum remains pseudonymous personal data: it recognises the identifier but cannot be turned back into it. It is used for no purpose other than enforcing the erasure or objection.

Standing instruction on withdrawal. When a withdrawal of consent reaches the consent interface, the contractor ends, without any further order, the processing based on that consent, including reports to advertising platforms not yet transmitted. It deletes the attributable data based on that consent without undue delay unless a separate legal basis or an exception under Art. 17(3) GDPR supports further storage. The withdrawal applies to the browser in which it is declared; the client implements a request by the person going further through the privacy area.

Retention despite a withdrawal is limited to the data, purposes and period concerned; the client notifies such cases specifically in advance. There is no change to another purpose solely because of the withdrawal, in particular no transfer into revenue reconciliation. Implementation covers operational data, mirrors, pending transmissions and existing exports within the contractor’s control. The contractor cannot recall data already transmitted to recipients; it names the recipients to the client so that the client can meet its notification duty under Art. 19 GDPR, and assists it in doing so.

The contractor also assists with data protection impact assessments and with notifications under Art. 33 and 34 GDPR. A personal data breach is notified to the client without undue delay and at the latest within 24 hours of becoming aware of it.

On termination the data is returned or deleted at the client’s choice. The client communicates its choice in text form and may change it until the period expires.

Active data. For return, the data remains available for 30 days in the export formats provided; the client retrieves it itself or requests it from the contractor. An export during the term is possible at any time at no additional charge. Thereafter the contractor deletes the data in the database, analytics mirror and exports; if the client makes no choice, deletion applies.

Backups. Database backups expire in their cycle under Annex 1 and are not specifically searched. Until then they serve solely for restoration. If a backup is restored, the contractor reapplies all erasures, restrictions, blocks and withdrawals made since then before processing resumes. If that state cannot be fully reapplied, the data concerned is not released for processing.

Copies held by sub-processors. The cloud provider removes deleted data from its systems under its contract as soon as reasonably practicable and at the latest after 180 days (Google Cloud Data Processing Addendum, section 6.1); if the contractor’s agreement with it ends, a recovery period of up to 30 days is added (section 6.2). Until then this agreement continues to apply to those copies.

Discontinuation. If the contractor discontinues the service, it announces this under the main contract; return and deletion follow the paragraphs above.

Deletion is evidenced on request, stating time and scope. Log data that serves the duty of proof and documents subject to a statutory retention period are not affected; they are blocked for any other use.

The processor demonstrates compliance on request and allows for audits, including inspections, by the client or an auditor mandated by it. An audit is announced with reasonable notice and must not unreasonably disrupt operations; after an incident or on reasonable suspicion it is possible without that notice.

The main resources are located in the europe-west3 region (Frankfurt). Individual stores – in particular global logging areas of the cloud provider – and maintenance and support access by group companies of the further processors may be located or take place outside the EU; the annex names recipients, countries and transfer basis per service. Any further transfer to a third country takes place only on documented instruction and under the conditions of Art. 44 et seq. GDPR.

This agreement is concluded electronically (Art. 28(9) GDPR): in the customer portal under “Privacy” or when setting up through the Shopify app, in each case by a person who declares that they are authorised to conclude it for the client. It is concluded separately from the main contract and for each tenant. Until it is concluded the software accepts no measurement data for that tenant.

The annexes, in the same version as this agreement, are: Annex 1 “Technical and organisational measures”, Annex 2 “Further processors”, Annex 3 “Deletion policy”. The portal keeps the agreed wording under “Privacy”; every version also remains available on the website under its date.

Changes require text form. The contractor offers a new version for conclusion in the portal; until then the version concluded continues to apply. Notices under section 7 are not a change to this agreement.

In the event of conflict this agreement takes precedence over the main contract as far as the processing of personal data is concerned. German law applies.