Data Processing Agreement

Art. 28 GDPR · DiscountComposer · As of 2026

This Data Processing Agreement ("DPA") applies between the merchant installing DiscountComposer (the "Controller") and Gianluca Iacona, trading as infinitecodes (formerly infinitecodes solutions, infinitecodes-solutions.de), Rolshover Straße 70, 51105 Cologne, Germany (the "Processor"). It is concluded when the merchant installs the app and forms part of the terms of use.

1. Subject Matter and Duration

The Processor processes personal data on behalf of the Controller solely to provide the DiscountComposer app. The DPA remains in force for as long as the app is installed and ends when it is uninstalled.

2. Nature and Purpose of Processing

DiscountComposer lets the Controller create automatic discounts and display a cart progress bar in their storefront. Discount rules are evaluated inside a Shopify Function at checkout. Personal data is touched in only one place: if the Controller restricts a discount to customer tags, the app reads the IDs of the customers carrying those tags so the rule can be limited to them.

3. Types of Personal Data

Shop domain, Shopify access token and session metadata
Name and email address of the person installing the app (provided by Shopify)
Customer IDs - only when the Controller uses tag-based customer targeting

The Processor does not access names, addresses, phone numbers or email addresses of the Controller's customers. The app holds no scope that would permit it.

4. Categories of Data Subjects

The Controller and their staff (as app users)
Customers of the Controller's shop, limited to their customer ID

5. Where the Data Is Stored

This is the central point of this agreement: discount configurations, including any customer IDs, are stored as metafields inside the Controller's own Shopify shop - not on the Processor's servers. The Processor's own database contains nothing but session data required to authenticate against the Shopify Admin API.

6. Instructions and Confidentiality

The Processor processes personal data only on documented instructions from the Controller, as defined by this DPA and the Controller's configuration in the app. Access is limited to a single administrator, bound to confidentiality. There are no other staff or contractors with access.

7. Security Measures (Art. 32 GDPR)

All transport is TLS-encrypted (HTTPS)
Requests are authenticated with Shopify session tokens
Backups contain session data only; they are encrypted with GPG (RSA-4096) before leaving the server, using a key the storage provider does not hold, and are deleted after 14 days
Because configurations live in Shopify metafields, no customer data resides in the Processor's database - the most effective protection is not holding the data at all

8. Sub-processors

The Controller consents to the following sub-processors:

Shopify Ireland Ltd., Dublin, Ireland - shop, discount and customer data
STRATO GmbH, Berlin, Germany - hosting of the application; STRATO engages IONOS SE, Montabaur, Germany, for platform operation
Hetzner Online GmbH, Gunzenhausen, Germany - storage of encrypted backups (Falkenstein, Germany)

A data processing agreement under Art. 28 GDPR is in place with each sub-processor. The Processor informs the Controller before adding or replacing a sub-processor; the Controller may object within 14 days on reasonable data protection grounds.

9. Third Country Transfers

Processing takes place exclusively within the European Union. No transfer to a third country occurs.

10. Data Subject Rights, Breaches, Deletion

The Processor assists the Controller in responding to data subject requests and forwards any request received directly to the Controller without undue delay. In the event of a personal data breach, the Processor notifies the Controller without undue delay, stating the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences and the measures taken. Session data is deleted when the app is uninstalled. Discount configurations remain in the Controller's own Shopify shop and are under their control. Shopify's customers/redact and shop/redact webhooks are implemented and honoured.

11. Audits, Term and Governing Law

The Processor provides the Controller with the information necessary to demonstrate compliance with Art. 28 GDPR and allows audits at reasonable notice. This DPA takes precedence over conflicting provisions of the terms of use. German law applies. In case of discrepancies between language versions, the English version prevails.

12. Contact

Gianluca Iacona (infinitecodes)
Rolshover Straße 70, 51105 Cologne, Germany
Email: info@infinitecodes.de