shopproof Launching soon

Data processing terms

Last updated 30 October 2026

These terms are the data processing agreement under Art. 28 GDPR between Apex Point Consulting GmbH, Austria ("we", the processor) and each shop that uses the Shopproof Shopify app ("you", the controller). They are part of our terms of use and apply automatically, free of charge, while your shop uses the app. Our full company details are in the Impressum.

1. What we process for you

Subject and purpose
Receiving the withdrawals your customers send through the Shopproof withdrawal form, storing them, emailing your customer an acknowledgement and you a copy, showing them to you in the app, and answering Shopify's privacy requests for them.
Personal data
Name, email address, order number, order date, items being returned, country, language, time of the withdrawal, reference number, and the Shopify customer ID if the customer is logged in.
People concerned
Your customers who use the withdrawal form.
Duration
While your shop uses the app, and until the data is deleted as described in section 7.

We do not process special categories of personal data for you, and we do not use your customers' data for our own purposes.

2. Your instructions

We process the data only on your documented instructions. These terms, the way the app works and the settings you choose in it, and the privacy requests you send through Shopify are your instructions. If we think an instruction breaks data protection law, we will tell you. If the law requires us to process the data in another way, we will tell you first, unless the law forbids that.

3. Confidentiality and security

Everyone at our company who can access the data is bound to confidentiality. We take the technical and organisational measures listed in the annex to protect the data (Art. 32 GDPR) and may improve them, as long as the protection does not fall below that level.

4. Sub-processors

You allow us to use these sub-processors:

  • Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg: hosting, database, email sending and logs, in the Frankfurt region (eu-central-1). Requests to the app pass through the Amazon CloudFront network, which may route them through locations outside the EU.

We bind each sub-processor to data protection obligations that are at least as protective as these terms. We will tell you at least 30 days before we add or replace a sub-processor, by email to your shop's contact address or in the app. If you object, you can remove the app; we will then delete your data as described in section 7.

5. Transfers outside the EU

We store the data in the EU. Where a sub-processor or one of its affiliates outside the EU may access it, the transfer is covered by the EU Standard Contractual Clauses and, for Amazon, its certification under the EU-US Data Privacy Framework.

6. Helping you

The app answers Shopify's customer data requests by emailing you the stored withdrawals for that customer, and deletes a customer's withdrawals when Shopify asks us to. We will also help you, as far as we reasonably can, to answer other requests from your customers and to meet your duties on security, data breaches, impact assessments and consultation with authorities (Art. 32 to 36 GDPR). If we become aware of a breach of the security of your data, we will tell you without undue delay, with the information we have.

7. Deletion

When you remove the app, Shopify asks us to erase your shop's data 48 hours later, and we then delete all withdrawals stored for your shop. Copies in our backups are overwritten within 35 days. Before you remove the app, keep the copies of each withdrawal that we emailed you; the app also lists your most recent ones. We keep nothing for longer, unless the law requires it.

8. Checks

We give you the information you need to show that these terms are kept. You or an auditor you appoint, who is bound to confidentiality, may check this after giving us reasonable notice, normally once a year and in a way that does not disrupt our work or expose other shops' data. We may first answer with documents, such as our sub-processors' certifications.

9. Other terms

Liability follows our terms of use. If these terms and the terms of use differ, these terms apply to data protection. Austrian law applies. We will publish changes on this page and tell you about important changes in advance.

Annex: technical and organisational measures

  • Location: all data stored in the AWS Frankfurt region.
  • Encryption: TLS for all connections; data at rest encrypted by AWS.
  • Access: only our administrators can access our AWS account, and signing in to it needs multi-factor authentication; the app itself can use only the tables and services it needs.
  • Separation: each shop's records are stored under that shop's address, and the app shows a shop only its own records.
  • Input checks: Shopify signs every request from the shop to the app, and we refuse requests with a missing or wrong signature; form input is checked and cleaned; at most 5 withdrawals per customer email per shop per hour; spam trap field.
  • Availability: point-in-time backups for 35 days; the withdrawals table is protected against deletion.
  • Logs: error and request logs kept for 14 days.
  • Changes: code is reviewed and tested automatically before release; infrastructure is defined in code.