Data Processing Agreement (DPA)

1. Subject matter and duration

The subject of the processing is the operation of the NorthProfit platform for eCommerce profit analytics, accounting export, invoicing/dunning, marketing tracking and tax advisor collaboration. Processing takes place for the duration of the main contract between controller and NorthProfit.

2. Nature and purpose

NorthProfit processes the following data categories on behalf of the controller:

• Orders, refunds and customer master data from the respectively available and connected shops and marketplaces
• Advertising performance data from connected platforms (Meta, Google, TikTok)
• Tracking events when the web pixel is active (IP address stored only truncated for new entries, raw events until a deletion order; passed on to Meta and TikTok only for end customers who have consented)
• Attribution record per order where the web pixel is active (for every paid order: order number, time of purchase, purchase value, origin of the attribution and click IDs from the landing or referring address of the order; only where the end customer has consented in the pixel, in addition a contact path of up to 20 contacts: time, channel, source and medium, campaign, ad set and ad ID, type and value of the click ID; without IP address, user agent, visitor or session identifier and device characteristics; stored as long as the order data)
• Accounting and invoicing data (invoices, receipts, OSS reports, DATEV exports)
• Access/client data from tax advisor collaboration (where the tax advisor portal is used)

3. Categories of data subjects

• End customers and buyers of the controller
• Website and advertising contacts (where the web pixel is active)
• Employees and users of the controller
• Tax advisors of the controller (where the tax advisor portal is used)
• Suppliers of the controller, where applicable

4. Obligations of NorthProfit as processor

• Processing only on documented instructions of the controller; NorthProfit informs the controller without delay if it considers an instruction to infringe the GDPR or other data protection rules (Art. 28(3) subpara. 2)
• Confidentiality of all personnel involved in processing (Art. 28(3)(b) GDPR)
• Appropriate technical and organisational measures under Art. 32 GDPR (see section 5)
• Support for the controller in responding to data subject rights (Art. 12–22) and in complying with Art. 32–36 GDPR, in particular data protection impact assessment (Art. 35) and prior consultation (Art. 36), taking into account the nature of processing and available information
• Notification of personal data breaches to the controller without undue delay (Art. 33(2) GDPR)
• At the controller's choice, deletion or return of all personal data after the end of processing, including deletion of existing copies. For other data outside the following Shopify rule, a period of 90 days after contract end applies, subject to the narrowly limited statutory exception below.
• Overriding Shopify rule: All Shopify merchant data, including originals, copies and reproductions, is deleted no later than within 30 days when (a) the merchant uninstalls the app, (b) the data is no longer required to provide the app services to the relevant merchant, (c) it is no longer required to provide Platform Services to Shopify, where applicable, or (d) NorthProfit receives an enforceable deletion request from the merchant, a customer or Shopify. The period begins with the respective trigger; contract end or subsequent events do not restart it. Returning the data does not extend this deletion deadline.
• A departure from the deletion obligation or its deadline is permitted only to the extent that mandatory applicable law requires it for specifically affected data. It applies only to that data and only for the legally necessary duration; all other data and copies must be deleted within the deadline.
• Legal archive for finalised accounting data: Invoices that the controller created and finalised through NorthProfit, including the customer data they contain, related payments, reminders, document versions and change logs, as well as accounting records archived by the controller (e.g. DATEV exports, received receipts and incoming invoices), are kept by NorthProfit on behalf and on the instructions of the controller, even after an uninstall or a deletion request, in a separate, access-restricted legal archive for as long as the controller's statutory retention period runs. It is generally 8 years for invoices and other accounting vouchers (including voucher bundles and received invoices) (Sec. 147(3) and (4) AO, Sec. 257(4) and (5) HGB, for invoices also Sec. 14b UStG) and 10 years for DATEV posting batches and exports insofar as they are books or records (Sec. 147(3) and (4) AO, Sec. 257(4) and (5) HGB), in each case from the end of the calendar year in which the voucher arose or the posting period ends (in case of later entries: the last entry is made). Related payment, reminder, document, goods receipt and stock data and change logs remain for as long as the voucher they belong to; orders to which a finalised invoice refers remain only as a reference without customer data, addresses and raw data. The data is stored there exclusively for this purpose and deleted after the period ends unless a statutory extension applies (e.g. a tax assessment period that is still open or an audit in progress). The controller can secure it before uninstalling via the service's export functions. All other data is deleted after the 30-day period set out above.

5. Technical and organisational measures (Art. 32 GDPR)

• Encryption: TLS in transit, AES-256 at rest for secrets/tokens
• Access control: role-based, least-privilege, strict tenant/org separation
• Pseudonymisation where possible for the processing purpose
• Backup and recovery concept; deletion concept based on retention periods
• Logging, server hardening (firewall, fail2ban, malware scanning) and regular updates

6. Sub-processors

The controller grants general written authorisation to use the sub-processors listed below. NorthProfit informs the controller at least 14 days before activating a new or changed sub-processor (e.g. by email or status page); the controller may object for an important data protection reason and, in that case, terminate the contract. NorthProfit binds sub-processors to an equivalent level of data protection.

This authorisation covers only the processing activities explicitly described below on the merchant's behalf. NorthProfit's own subscription billing and merely connected merchant, payment, advertising and email platforms do not automatically become sub-processing activities. Their role depends on the processing activity and the applicable contracts. The broader recipient list in the privacy policy (section 13) also provides information about these services. Processing for own purposes and processing on the merchant's behalf must be considered separately even when performed by the same provider.

• STRATO AG — Application and database hosting for processing on the merchant's behalf, Germany (EU)
• Hetzner Online GmbH — Storage of backups encrypted before upload for data processed on the merchant's behalf, Germany (EU)
• Plus Five Five, Inc. (Resend) — Delivery of emails initiated by the merchant (invoices, dunning notices, confirmations, data export), to the extent personal data is processed on the merchant's behalf, USA (SCC; DPF in addition)
• OpenAI Ireland Ltd. — Refinement of North AI answers and requested AI visibility checks, to the extent personal data is processed on the merchant's behalf, EU (Ireland) + USA (SCC)
• DataForSEO (provider of the measurement data for visibility measurement) — Performing explicitly started visibility measurements (search terms, location, language), to the extent personal data is processed on the merchant's behalf, Registered office: DataForSEO OÜ, Tallinn, Estonia (EU); basis: Processing on our behalf under Art. 28 GDPR based on DataForSEO's data processing agreement (part of its terms of service, version of 12 June 2026). The provider is established in the EU. For sub-processors outside the EU, for example in the USA, DataForSEO states that it relies on standard contractual clauses (Implementing Decision (EU) 2021/914) or adequacy decisions.

7. Transfers to third countries

Where sub-processors process personal data in a third country (in particular the USA), this only takes place on the basis of appropriate safeguards under Art. 44 et seq. GDPR — EU Standard Contractual Clauses (SCC 2021/914) and, where certified, the EU-US Data Privacy Framework. The controller's instructions also apply to third-country transfers; exceptions only exist under mandatory law and, where legally permitted, after prior notice. The transfer mechanism for each recipient follows from the location column in section 6.

8. Controller's audit rights

The controller may verify compliance with the obligations under this DPA. On request, NorthProfit provides the necessary information and a standard audit report. On-site audits are possible after reasonable prior notice and without disrupting operations.

9. Liability and final provisions

Liability follows Art. 82 GDPR. There are no oral side agreements. If individual clauses are invalid, the rest of the agreement remains effective; the statutory provisions take their place.

Jurisdiction: NorthProfit's registered office (Düsseldorf), where legally permitted. Applicable law: Germany.