Preview: Kurswacht Invoice is coming soon to the Shopify App Store; prices are provisional. Get notified at launch
Install for freeInstall

Data processing agreement

Last updated: 14 October 2026

This is a translation of the German data processing agreement. If the two versions differ, the German version prevails.

Parties

  • Controller: the Shopify merchant who installs the app “Kurswacht Invoice” (the “Controller”).
  • Processor: Robin Schmitt, Schmitt IT (sole proprietorship), Deutschhausplatz 1a, 55116 Mainz, Germany, email hello@kurswacht.com (the “Processor”).

The agreement is concluded when the App is installed and is part of the terms of use (https://kurswacht.com/en/terms/, § 8). The Controller can view and save it at any time at https://kurswacht.com/en/dpa/.

§ 1 Subject matter and duration

  1. Using the App, the Processor creates invoices and credit notes from the Controller’s Shopify orders, stores them and makes them available to customers for download and to the Controller for export.
  2. The agreement applies as long as the App is installed in the shop and ends with the deletion under § 9.

§ 2 Nature and purpose, types of data, data subjects

  1. Purpose: creating, storing and providing invoices and credit notes; customer downloads; exports; rule-based automation; the features the Controller switches on (VIES check, email sending through the Controller’s own mailbox and the Shopify Flow trigger); handling Shopify privacy requests.
  2. Types of data: name, company, billing and shipping address including country; the buyer’s VAT ID, if provided, and, with the VIES check switched on, its confirmation (date, request identifier); the Leitweg-ID with XRechnung switched on; the document language with “language of the order”; order data (number, dates, line items, prices, taxes, discounts, shipping, fees); payment status, name of the payment method, payment or transaction reference; refunds, cancellations and order edits; generated documents (PDF, XML, validation report). Read but not stored: the order note and order attributes (except a VAT ID or Leitweg-ID detected in them). Read only with email sending switched on and passed to the Controller’s mailbox, but not stored: the order’s email address; only the sending status, the number and time of attempts and a history entry without the address are stored. Of order tags, payment method, country and sales channel, the automation history stores only the filter values entered by the Controller that an order matched. Not processed: customers’ phone numbers.
  3. Data subjects: the Controller’s customers and billing and shipping recipients.
  4. Transfers on instruction: with the VIES check switched on, the Processor transfers the buyer’s VAT ID and the Controller’s VAT ID to the European Commission’s VIES service. For email sending it passes the email address and the document to the SMTP server the Controller enters and, if entered, a copy with attachments to the BCC address chosen by the Controller; where available, the message also contains the document’s signed download link. The Controller chooses the provider and the copy recipient; they are not sub-processors of the Processor. With the Flow trigger switched on, the Processor reports every finished document with order reference, document number, document type, signed download link, date, gross amount and currency to Shopify Flow in the Controller’s shop.

§ 3 Instructions

  1. The Processor processes data only on documented instructions from the Controller. The settings in the App and this agreement are the instructions.
  2. If the Processor considers an instruction unlawful, it informs the Controller without undue delay.

§ 4 Obligations of the Processor

  1. It commits all persons with access to the data to confidentiality.
  2. It takes the technical and organisational measures in Annex 1 and adapts them to the state of the art without lowering the level of protection.
  3. It supports the Controller with data subject rights (Art. 12–22 GDPR) and with the obligations under Art. 32–36 GDPR. The App shows the Controller the Shopify requests customers/data_request and customers/redact; on customers/redact it revokes the download links of the affected documents.
  4. It reports personal data breaches without undue delay, at the latest within 48 hours of becoming aware of them, with the information under Art. 33(3) GDPR.
  5. Privacy contact: Robin Schmitt, hello@kurswacht.com

§ 5 Sub-processors

  1. The Controller approves the sub-processors listed in Annex 2.
  2. The Processor announces new or replaced sub-processors at least 30 days in advance. The Controller may object for an important data protection reason; it may then end the agreement by uninstalling the App.
  3. The Processor contractually binds sub-processors to the same data protection obligations.
  4. Shopify is not a sub-processor of the Processor but the Controller’s platform under the Controller’s own contract.

§ 6 Place of processing

Data is stored in the EU. Transfers to third countries take place only under the conditions of Art. 44 et seq. GDPR. The sub-processors Railway and Cloudflare are based in the United States. Both are certified under the EU-US Data Privacy Framework; the European Commission’s Standard Contractual Clauses from their data processing agreements apply in addition.

§ 7 Audit rights

On request, the Processor demonstrates compliance with its obligations, primarily through current documentation and information. On-site audits are possible after notice with a reasonable period and at the Controller’s expense, at most once per calendar year, with at least 30 days’ notice, during normal business hours and without disrupting operations. After a personal data breach (§ 4 no. 4) or where there are concrete indications of a breach of this agreement, additional audits are possible at shorter notice. Audits of sub-processors are governed by their contracts and audit reports.

§ 8 Retention by the Controller

The statutory retention of invoices and credit notes is the Controller’s responsibility. It exports its documents (monthly or yearly export) before uninstalling the App. The App is not an archive for statutory retention after uninstallation.

§ 9 Deletion and return

  1. Return: during the term the Controller can export all documents at any time as CSV and as a PDF/XML package.
  2. Deletion: on uninstallation the Shopify sessions are deleted immediately. Shopify sends the shop/redact request 48 hours after uninstallation; the App then deletes all data of the shop, including documents, exports, settings, number ranges and event histories.
  3. Backups and logs: the hosting provider backs up the database daily and deletes each backup after 6 days. Document files are not backed up separately. It deletes its request logs (time, path, status, IP address) after 90 days.
  4. Customer erasure: on customers/redact, documents the Controller must retain by law stay stored until the deletion under no. 2; the customer download links are revoked.

§ 10 Liability and final provisions

  1. Liability is governed by Art. 82 GDPR. Between the parties, § 9 of the terms of use applies in addition, insofar as Art. 82 GDPR does not preclude it.
  2. In data protection matters this agreement takes precedence over the terms of use in case of conflict.
  3. German law applies. Place of jurisdiction is Mainz, Germany, insofar as legally permissible.

Annex 1 – Technical and organisational measures (Art. 32 GDPR)

Technical statements are based on the App’s code, organisational ones on the Processor’s internal security policy.

Confidentiality

  • Physical access control: data centres of the sub-processors Railway (SOC 2 Type II) and Cloudflare (including ISO 27001 and SOC 2 Type II). The Processor operates no servers of its own.
  • System access control:
    • Merchants reach the App only through the Shopify admin (Shopify OAuth, App Bridge session tokens).
    • Shopify webhooks are verified by HMAC signature.
    • Only the Processor itself has access to the production environment, through personal accounts with two-factor sign-in and passwords of at least 16 characters from a password manager.
  • Data access control:
    • Every record belongs to one shop; queries are limited to the signed-in shop; document files are separated per shop, and paths are checked against leaving the storage directory.
    • Customer download links are signed with HMAC-SHA256, bound to shop, document and format, cannot be derived from order or invoice numbers, are stored only as hashes and can be revoked.
    • Admin print and file links are bound to shop, order and document and are valid for 30 minutes.
    • The customer account extension shows only final documents of the respective order; previews, XML and validation reports cannot be reached there.
  • Separation control: the App Store edition runs as a separate Shopify app with its own deployment, database, storage and keys, separate from the Processor’s other installations (own Railway project, own database, own R2 bucket, own keys; set up on 12 October 2026).
  • Encryption and pseudonymisation:
    • Document files (PDF, XML, validation report, HTML source), export files and the invoice snapshot with buyer data are encrypted by the App with AES-256-GCM before they are stored; in production the App rejects unencrypted files and snapshots.
    • Identifiers from Shopify privacy requests are stored only as HMAC hashes.
    • Railway encrypts database, disks and backups with AES-256, Cloudflare R2 the stored files.

Integrity

  • Transfer control:
    • From outside, the App is reachable only over HTTPS (TLS); it reaches the database over a private, encrypted network of the hosting provider.
    • Links and exports contain no internal storage paths.
    • Customer downloads are served with no-store and nosniff, error and waiting pages additionally with a restrictive CSP.
  • Input control:
    • For every document the App keeps an event history (creation, link issuance, revocation).
    • Automation decisions and privacy requests are logged.
  • Immutability:
    • Final documents are never changed afterwards; corrections are made with credit notes.
    • Document numbers are unique per shop through database constraints and are never reused.

Availability and resilience

  • Shopify webhooks are processed in a queue with retries.
  • A daily reconciliation finds paid orders of the last days without an invoice.
  • Document files are kept in Cloudflare R2, which stores them redundantly. The database is backed up daily (6 days retention, AES-256 encrypted). Restoring is tested before launch and every six months after that.
  • At start-up the App checks that all required keys are set and are not placeholders. On every deployment Railway uses a health check to confirm that the new version responds, and it restarts the process under its restart policy when the process exits with an error. There is no continuous monitoring with automatic alerting yet.

Data minimisation

  • Customers’ phone numbers are not requested. The order’s email address is read only with email sending switched on and is not stored.
  • From order attributes only a detected VAT ID and, with XRechnung switched on, the Leitweg-ID are stored.
  • The SMTP password is stored encrypted and never returned to the browser.
  • Personal data of shop staff from Shopify sessions is not stored.
  • The App does not write addresses or document content to its logs. Before logging and storing errors it removes the values of known link parameters such as tokens and signatures.
  • The hosting provider logs every request with time, path, status and IP address and deletes these logs after 90 days.
  • The process that renders PDF and XML receives no credentials. Its temporary files are deleted after every run.

Regular review

  • Automated tests and code review before every release.
  • No external penetration test has taken place so far.
  • The Processor handles security incidents according to a written policy: contain, assess within 24 hours, inform Shopify within 24 hours and the Controller under § 4 no. 4, document.
  • The technical and organisational measures are reviewed every six months and on major changes.

Annex 2 – Sub-processors

Sub-processor Service Seat / place of processing Safeguard
Railway Corporation Hosting of the App, the database and its daily backups San Francisco, USA / European Union (europe-west4 region, Netherlands) EU-US Data Privacy Framework; Standard Contractual Clauses from the Railway DPA
Cloudflare, Inc. Storage of document files (Cloudflare R2); the App encrypts the files before upload San Francisco, USA / European Union (R2 bucket with EU data location) EU-US Data Privacy Framework; Standard Contractual Clauses from the Cloudflare DPA

The App uses no analytics, advertising or tracking services and no email service of its own; it sends email only through the Controller’s mailbox (see § 2 no. 4).