# Data Processing Agreement

> How the ShopAssist DPA is accepted, what it covers and how you are told about changes and new sub-processors.

Source: https://shopassist.coec.dk/docs/compliance/dpa · Updated 2026-10-01

The [Data Processing Agreement](/legal/dpa) (Art. 28 GDPR) is part of the ShopAssist terms. It is accepted by an owner when the organization is created (signup checkbox or Shopify onboarding), and recorded with the version, time and user.

**Until the DPA is accepted, the live widget is disabled** and the store shows the health warning `legal_acceptance_required`. Preview and the playground keep working, and catalog sync runs.

## What it covers [#contents]

* The subject matter, duration, nature and purpose of the processing, and the categories of data and data subjects.
* COEC's obligations: processing only on documented instructions, confidentiality, security measures (Annex II), assistance with data subject requests and breaches, deletion at the end of the service.
* Sub-processors (Annex III) and the procedure for changes.
* International transfers and the safeguards used.
* Audits and information rights.

## Changes and new sub-processors [#changes]

* New versions that require acceptance are announced to owners and admins at least 30 days before they take effect. Owners accept them under **Organization → Legal**.
* Sub-processor changes are announced in advance. Subscribe to the [sub-processor feed](/subprocessors) (RSS or JSON) to get notified.

## Enterprise [#enterprise]

Enterprise customers can negotiate a DPA. [Contact sales](/contact).

## Download [#download]

Read the current version and earlier versions on the [DPA page](/legal/dpa).