Data Processing Agreement (Art. 28 GDPR)

1. Subject matter and duration

The processor processes personal data on behalf of the controller to provide the app: product designer in the online store, storage of designs, creation of print files and matching them to orders. The agreement applies while the controller uses the app and ends with the deletion of the data under section 9.

2. Types of data and data subjects

• Data subjects: customers and visitors of the controller's online store.
• Data: text entered and images uploaded by customers (may show people), design data, preview images, print files, order name, order and line item IDs, ordered variant.
• No customer names, email addresses, postal addresses or payment details; no special categories under Art. 9 GDPR, unless a customer uploads such content in an image.

3. Instructions

The processor processes the data only on documented instructions of the controller. The settings and actions in the app and this agreement are such instructions. If the processor considers an instruction unlawful, it informs the controller without delay.

4. Confidentiality

Persons with access to the data are bound to confidentiality. Only those who need access for operation and support have it.

5. Technical and organisational measures

• Hosting in the EU: Amazon Web Services, Frankfurt region (eu-central-1).
• Encryption in transit: all connections via TLS (HTTPS).
• Files (uploads, previews, print files) and backups stored encrypted (AES-256) in private storage, retrievable only through random, unguessable addresses.
• Database on a dedicated server, stored on an encrypted volume (keys managed by AWS); accessible only with keys, no password login.
• Tenant separation: each store's data is stored and queried separately per store.
• Access control: server and cloud access only for authorised persons, least-privilege permissions.
• Logs without IP addresses or personal content.
• Backups: daily database backup, deleted automatically after 30 days.
• Automatic deletion of designs that were not ordered and unused uploads after 90 days.

The processor keeps the measures up to date with the state of the art without lowering the level of protection.

6. Sub-processors

• Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg – servers, file storage, backups (Frankfurt region).

The controller approves this sub-processor. The processor announces new sub-processors at least 30 days in advance by email; the controller may object for good cause and terminate. Shopify is the platform used by the controller and not a sub-processor of the processor.

7. Assistance

The processor assists the controller with data subject requests (access, erasure etc.), security of processing, notification of data breaches and data protection impact assessments. Deletion requests through Shopify (customers/redact, shop/redact) are carried out automatically.

8. Personal data breaches

The processor notifies the controller of a personal data breach without undue delay, at the latest within 48 hours of becoming aware of it, with the information under Art. 33(3) GDPR as far as known.

9. Deletion and return

After the end of use (uninstalling), the processor deletes all of the controller's data as soon as Shopify instructs it (shop/redact, 48 hours after uninstalling). The controller can download print files in the app beforehand. Backups are overwritten after 30 days at the latest.

10. Evidence and audits

On request, the processor provides the information needed to demonstrate compliance and allows audits after reasonable notice. Contact: dev@metacom.at.

11. Place of processing

Data is stored in the EU. Where a sub-processor transfers data to a third country, this is based on the EU-US Data Privacy Framework or standard contractual clauses.

12. Final provisions

Austrian law applies. In case of conflict, this agreement prevails over the terms of service as far as the protection of personal data is concerned.