Data processing agreement

The controller is the operator of the Shopify shop ("merchant") that installs Inkmate.

The processor is:

Valerian Huber, sole proprietorship
Address as stated in the imprint (in German)
support@inkmate.shop · valerian@luvex.tech

Not covered by this agreement are the data that Inkmate processes as a controller in its own right: the contract and billing data of the merchant itself and the operating logs for the security of the service.

Conclusion: upon installation of the app in the Shopify shop; there is no individual negotiation. This agreement takes precedence over the terms of use (in German) insofar as it concerns personal data.

Language: The German version is authoritative; an English version is provided for information only.

Provision of a tool for print templates (flyers, inserts, QR codes, landing pages) in the merchant's shop, including the evaluation of QR scans and the creation of invoices for orders, insofar as the merchant uses these functions. Any use for the processor's own purposes is excluded, in particular profiling, advertising and the training of AI models. Inkmate itself does not use any AI services (for services connected by the merchant, see Section 6).

Duration: for the term of the installation; the consequences of its end are governed by Section 9.

Images uploaded by the merchant (e.g. logos) may show persons. The processor treats them as personal data. Uploaded images are publicly accessible via their address because they appear in printed and digital templates (Annex 2).

Payment data of end customers is not processed.

The processor processes personal data only on documented instructions from the controller, unless required to do so by Union or Member State law to which the processor is subject. In such a case, the processor informs the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. This agreement and the controller's operation of the app constitute instructions.

Individual instructions must be sent in text form to the address stated in the preamble.

If the processor considers an instruction to be unlawful, the processor informs the controller without undue delay.

The processor is a sole proprietorship. Only the owner of the sole proprietorship has access to production data.

The processor ensures that all persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR).

The processor implements the measures described in Annex 2, including the gaps openly identified there.

The processor engages further processors only with the prior authorisation of the controller in text form. The controller grants general authorisation for the services listed in Annex 1. The processor informs the controller in text form of any intended change (addition or replacement) 30 days in advance. The controller may object for good cause; if the change is maintained, the controller has the right to terminate.

The processor imposes on each sub-processor, by contract, the same data protection obligations as set out in this agreement, in particular sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing meets the requirements of the GDPR (Art. 28(4) GDPR). Where a sub-processor fails to fulfil its data protection obligations, the processor remains liable to the controller for the performance of those obligations.

The merchant's own AI services. If the merchant uses their API key to connect their own AI service via the interface or the MCP access, including the hosted one at api.inkmate.shop/mcp, Inkmate transmits the requested data to this service on the merchant's instructions. This may include data of end customers and contacts, such as email addresses, customer names on invoices and recipient names from mail merges. The choice of service, the legal basis, any contract required with the service and the basis for any transfer to third countries are the responsibility of the merchant. The service is not a sub-processor of Inkmate.

The processor assists with requests under Arts. 15–22 GDPR. Erasure requests from end customers received via Shopify (customers/redact) are implemented automatically: contacts, events and stamps are deleted, mail merge templates and metrics are anonymised, rendered files are removed. Invoices are retained because the merchant is required to keep them (Section 9).

Access requests (customers/data_request) are recorded and answered via support; there is no self-service export yet.

The processor notifies the merchant of any personal data breach without undue delay, and no later than 24 hours after becoming aware of it. The notification contains, as far as known: the nature of the incident, the categories of data concerned and the approximate number of data subjects concerned, the time of occurrence and discovery, the likely consequences and the measures taken and planned.

The processor does not itself notify the supervisory authority. The processor assists with data protection impact assessments (Art. 35 GDPR) and prior consultations (Art. 36 GDPR).

Where a statutory retention obligation prevents deletion during ongoing use, the data is restricted instead of deleted (Art. 17(3)(b) GDPR; Art. 5(1)(b) and (c) GDPR).

Evidence: by this agreement including its annexes; an on-site inspection is possible with prior notice. The processor holds no certification.

Third countries: Processing takes place in the EU unless Annex 1 states otherwise. The transfer basis for each provider is stated there.

Liability: in accordance with Art. 82 GDPR. German law applies. Amendments must be made in text form.

Art. 28(4) GDPR

1. Sub-processors

2. Engaged by the merchant directly

3. Not listed as sub-processors

Not in use: Anthropic and OpenAI.

Art. 32 GDPR

1. Confidentiality

• Physical: application, database and local backup copies (14 days) at Hostinger in Frankfurt; file storage and encrypted off-site backup copies (35 days) at Hetzner, data centre Falkenstein (Germany).
• Sign-in: exclusively via Shopify; session token with verified signature, expiry and audience.
• Server access: only with an SSH key, password login disabled. Only the owner has access to production data.
• Encryption of individual fields (AES-256-GCM): name, address and VAT ID on invoices, contact emails, stored order events, Shopify access tokens, interface keys for third-party services, invoice PDF and e-invoice XML in file storage.
• Rendered packing slips are stored unencrypted in file storage and can only be retrieved with a session of the shop they belong to (No. 6).
• The merchants' interface keys are revoked upon uninstallation.
• Tenant separation via shop_id in the application (No. 6).
• Database bound locally only, not reachable from outside.
• Data minimisation: IP addresses only as an HMAC hash; Inkmate itself does not use any AI services; no payment data.

2. Integrity

• Transport only encrypted (TLS, Let's Encrypt; HTTP redirects to HTTPS).
• Webhooks with constant-time HMAC verification.
• Invoices with sequential numbering per shop.
• Access log: viewing, downloading and exporting invoices, contacts, the order list and API exports are logged per shop, retention 12 months.

3. Availability

4. Review

Continuous monitoring by the hub (availability, certificates, backup reports, dependencies, containers); annual review of this annex.

5. Control of processing

Sub-processors only in accordance with Annex 1; master register in the hub (external_services).

6. Openly identified gaps (as of 10 November 2026)

26 September 2026: first version.

9 November 2026: Section 1 and Section 6: the merchant's own connected AI services.

10 November 2026: Annex 2: measures brought up to the state of the measurement of 10 November 2026; Section 9: backup copies 35 days.

14 November 2026: Preamble: German version authoritative; Sections 3, 4 and 6: mandatory content under Art. 28 GDPR added; Sections 1, 2, 6 and Annex 1: capture of contacts via landing pages and Klaviyo removed; Section 2: no city/region for scans; Annexes 1 and 2: locations of backup copies aligned.