Data Processing Agreement

The Data Processing Agreement (Art. 28 GDPR) is part of the ShopAssist terms. It is accepted by an owner when the organization is created (signup checkbox or Shopify onboarding), and recorded with the version, time and user.

Until the DPA is accepted, the live widget is disabled and the store shows the health warning legal_acceptance_required. Preview and the playground keep working, and catalog sync runs.

What it coversCopy Anchor Link

• The subject matter, duration, nature and purpose of the processing, and the categories of data and data subjects.
• COEC's obligations: processing only on documented instructions, confidentiality, security measures (Annex II), assistance with data subject requests and breaches, deletion at the end of the service.
• Sub-processors (Annex III) and the procedure for changes.
• International transfers and the safeguards used.
• Audits and information rights.

Changes and new sub-processorsCopy Anchor Link

• New versions that require acceptance are announced to owners and admins at least 30 days before they take effect. Owners accept them under Organization → Legal.
• Sub-processor changes are announced in advance. Subscribe to the sub-processor feed (RSS or JSON) to get notified.

EnterpriseCopy Anchor Link

Enterprise customers can negotiate a DPA. Contact sales.

DownloadCopy Anchor Link

Read the current version and earlier versions on the DPA page.