Data Processing Agreement

Art. 28 GDPR · Selfix · As of 2026

This Data Processing Agreement ("DPA") applies between the merchant installing Selfix (the "Controller") and Gianluca Iacona, trading as infinitecodes (formerly infinitecodes solutions, infinitecodes-solutions.de), Rolshover Straße 70, 51105 Cologne, Germany (the "Processor"). It is concluded when the merchant installs the app and forms part of the terms of use.

1. Subject Matter and Duration

The Processor processes personal data on behalf of the Controller solely to provide the Selfix app. The DPA remains in force for as long as the app is installed and ends when it is uninstalled.

2. Nature and Purpose of Processing

Selfix allows the Controller's customers to correct their own order shortly after checkout: changing the shipping address and, on the Premium plan, swapping a product variant of equal price. Processing is limited to reading the order, verifying eligibility, and writing the change back to Shopify.

3. Types of Personal Data

Shipping address: first name, last name, street, postal code, city, country, phone
Order ID, order number, order creation date, fulfillment status
Customer ID (to verify that a customer edits only their own order)
Line item, variant and quantity data of the edited order
Merchant notification email address (Premium, optional)

The Processor does not access customer email addresses.

4. Categories of Data Subjects

End customers of the Controller's shop
The Controller (as the app user)

5. Instructions

The Processor processes personal data only on documented instructions from the Controller. The instructions are defined by this DPA and by the Controller's configuration in the app (time window, permitted edit types, notifications). The Processor informs the Controller if, in its opinion, an instruction infringes data protection law.

6. Confidentiality

Access to protected customer data is limited to a single administrator, who is bound to confidentiality. There are no other employees or contractors with access.

7. Security Measures (Art. 32 GDPR)

Shipping addresses are encrypted with AES-256-GCM before being stored; the key is held outside the database and differs per environment
All transport is TLS-encrypted (HTTPS)
Every access to protected customer data is logged (who, when, what, why)
Personal data in the change log is automatically anonymized after 90 days
Backups are encrypted with GPG (RSA-4096) before leaving the server, using a key the storage provider does not hold; they are deleted after 14 days
Test and production environments use separate databases and separate keys
Requests are authenticated with Shopify session tokens; order ownership, edit window and fulfillment status are verified server-side

8. Sub-processors

The Controller consents to the following sub-processors:

Shopify Ireland Ltd., Dublin, Ireland - shop and order data
STRATO GmbH, Berlin, Germany - hosting of the application; STRATO engages IONOS SE, Montabaur, Germany, for platform operation
Hetzner Online GmbH, Gunzenhausen, Germany - storage of encrypted backups (Falkenstein, Germany)

A data processing agreement under Art. 28 GDPR is in place with each sub-processor. The Processor informs the Controller before adding or replacing a sub-processor; the Controller may object within 14 days on reasonable data protection grounds.

9. Third Country Transfers

Processing takes place exclusively within the European Union. No transfer to a third country occurs.

10. Data Subject Rights and Breach Notification

The Processor assists the Controller in responding to data subject requests and forwards any request received directly to the Controller without undue delay. In the event of a personal data breach, the Processor notifies the Controller without undue delay, providing the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences and the measures taken.

11. Deletion and Return

Session data is deleted when the app is uninstalled. Change log entries are anonymized after 90 days at the latest, and earlier upon request. On request the Processor deletes or returns all personal data. Shopify's customers/redact and shop/redact webhooks are implemented and honoured.

12. Audits, Term and Governing Law

The Processor provides the Controller with the information necessary to demonstrate compliance with Art. 28 GDPR and allows audits at reasonable notice. This DPA takes precedence over conflicting provisions of the terms of use. German law applies. In case of discrepancies between language versions, the English version prevails.

13. Contact

Gianluca Iacona (infinitecodes)
Rolshover Straße 70, 51105 Cologne, Germany
Email: info@infinitecodes.de