How do I conclude the data processing agreement?

No DPA, no measurement

Metrunio processes personal data of your visitors on your behalf. That requires a data processing agreement. As long as none is concluded for your account, Metrunio accepts nothing. That applies to every account, whether registered in the portal or created from the Shopify app, in every environment and during the trial as well. There is no switch for this.

• Page views and events, consent reports, orders and refunds, the order import, conversion webhooks, ad contacts, the offline import and the test event are rejected, with the code PROCESSING_AGREEMENT_MISSING and HTTP status 403.
• The impression pixel only returns its image; a click on a tracking link redirects without being measured.
• None of it is stored: no pseudonymous identifiers, no hashed email addresses, no consent states. Anything already on its way into processing is discarded and deleted.
• Ad costs can still be sent. They contain no personal data.
• You can set up your account, website, keys, installation, consent setting and connections beforehand: in the step “Conclude the DPA” with “Prepare website and installation”, or under “Setup” with “Add a website”. The installation can only be checked afterwards. The test event is rejected until then as well.

The portal then shows “Measurement paused: DPA missing.” on every page, with the link “Conclude the DPA”. The setup assistant has “Conclude the DPA” as its second step, right after “Confirm your company”; the step cannot be ticked off, only completed. Below it, “Prepare website and installation” leads through the steps that need no data; a red notice stays in place, and at the end the wizard says that only the DPA is missing. Instead of “no data”, the live test and the health centre report the reason: the finding PROCESSING_AGREEMENT_MISSING.

Concluding it in the portal

1. 01Open “Privacy” in the portal, or the step “Conclude the DPA” in the setup assistant. The top of the page shows whether the agreement is concluded.
2. 02Read the agreement and its annexes: the TOMs, the sub-processor list and the deletion policy belong to it.
3. 03Enter the legal name as it appears in the commercial register or your business registration, with the legal form if there is one, and the address. The DPA does not require a register entry: as a sole trader, your first and last name is enough, with a trading name if you like. The account name is prefilled; it is often a brand name rather than the legal name.
4. 04Enter the name and position of the person concluding it, and choose the language of the agreement (German or English).
5. 05Confirm that you have read the agreement and may act for the company, then conclude it.

The conclusion takes effect within a few seconds, ten at the most; you change nothing in your installation. Art. 28(9) GDPR allows the electronic form; no signature on paper is needed.

You then receive a confirmation by email at the address you are signed in with: your declarations and links to the data processing agreement and its annexes, each in the agreed version. If you registered the account yourself, the first conclusion also covers the terms and the privacy notice you accepted when signing up, with the day you accepted them and the version of that day. The email comes in German or English, depending on the language of your account; for Spanish and French in English. If you later conclude a new version, the email confirms only the DPA.

Additional instructions in the same step

Below the agreement there are optional additional instructions, each with its own checkbox and the full wording to expand. Nothing is preselected, and the agreement applies without them. You can give them later or revoke them under “Privacy → Additional instructions”.

• Transfer to AI tools: transfer this account’s data to tools and programs that you connect yourselves later, through the approval page or with a read key. You then confirm each connection individually; the instruction does not apply to other purposes or recipients.
• Revenue reconciliation after a refusal too: listed with its requirements, but without a checkbox, because it needs your customer-specific details. You give it with the completed template.
• Order matching via the checkout: not available as long as it has not been released. There is no instruction in advance for it.

For each checkbox we store the wording as it was shown, with version and language, along with the account, the person and the time. A new version only counts as given once someone gives it. A revocation ends the instruction; the record is kept for three years after it ends.

Concluding it in the Shopify app

When the Shopify app creates your account, you conclude the DPA in the same step: with a tick box of its own next to the one for the terms, after confirming the company, its address and the name and position of the person concluding it; the app suggests company and address from your store’s billing address. If your store was connected through the portal and the DPA is still missing, you conclude it in the app without switching to the portal. The app shows whether it is concluded, and you receive a confirmation by email with links to the agreed versions.

What is stored

A conclusion is never changed. When there is a new version, the portal says so and you conclude it again; the previous one stays in force until then. Earlier conclusions remain listed under “All conclusions”. You can view the record with the agreed text and save it as a PDF at any time.

Every version also stays on the website permanently under its date, for example /en/documents/avv/2026-09-24. The page keeps exactly this text, even after a later change. The confirmation email and the record in the portal link there.

After the contract ends

When your contract ends, we delete your account after 30 days, and the stored conclusion with it. Before that we keep a brief record: company, address, versions, times, who concluded it (name, email address, role or Shopify ID), the declaration of authority, origin and shop. The confirmation email is included, exactly as we sent it. Not included are the contract text (it stays on the website under its date anyway), the IP address checksum and account data. The record is kept for six years from the end of the calendar year in which you concluded the contract, but at least until the end of the third calendar year after the contract ends, and is then deleted automatically. If we need it for pending or specifically threatened litigation, it stays until that is over.

Who may conclude it

In the portal, anyone with administration rights in the account; in the Shopify app, the person signed in there who is using the app. Metrunio staff cannot, not even through support access: an agreement the processor concludes with itself on the controller’s behalf would not be one. Whoever concludes it for a company must be entitled to represent it. The software cannot check that, hence the confirmation.

If you use your own agreement

Some companies only conclude data processing agreements on their own paper. That works but takes longer: write to privacy@metrunio.com. Concluding it in the portal is the faster route, not the only one.