Data Processing Agreement (DPA) under Art. 28 GDPR

1. Subject Matter, Nature and Purpose

1.1 The Processor processes personal data on behalf of the Controller solely to provide the App as described in the Main Agreement — in particular: managing Course access and enrollments; displaying Student data in the “Students” area; tracking and displaying Course progress; storing quiz answers and results; issuing certificates; and granting or revoking Student access on the Controller’s instructions.

1.2 Nature of processing: collection, organization, storage, retrieval, use, display, transmission, restriction, and erasure of personal data by automated means, including reading Shopify customer data via the Shopify API and displaying it within the App.

1.3 The processing does not include special categories of data (Art. 9 GDPR); the Controller must not instruct such processing without a separate written agreement.

2. Duration

2.1 This DPA runs for as long as the Processor processes personal data on behalf of the Controller under the Main Agreement, ending with the termination of the Main Agreement, subject to the deletion and return obligations in Section 11.

3. Categories of Data Subjects and Personal Data

3.1 Categories of data subjects: the Controller’s customers and Course Students, including Students added manually by the Controller and, where the Controller offers Courses free of charge with registration, registered visitors.

3.2 Categories of personal data: first and last name; email address; Shopify customer and order identifiers; Course enrollment and access status; Course progress; quiz answers and results; certificates issued; and, for Students added manually by the Controller, the name, email address, and access data entered by the Controller. The Processor does not itself store IP addresses of Students; its infrastructure providers may log IP addresses as part of ordinary server operation.

4. Rights and Obligations of the Controller

4.1 The Controller is responsible for the lawfulness of the processing and for a valid legal basis, for safeguarding data-subject rights, and for its own information duties and privacy policy toward data subjects. The Controller is the “controller” within the meaning of Art. 4(7) GDPR. This applies in particular to Students the Controller adds manually, for whom the Controller must ensure a valid legal basis.

4.2 The Controller may issue supplementary instructions in text form. The Controller confirms that the description in this DPA and the functions of the App constitute its initial documented instructions.

5. Obligations of the Processor

5.1 Documented instructions (Art. 28(3)(a)). The Processor processes personal data only on the Controller’s documented instructions, including as regards transfers to third countries, unless required to do otherwise by Union or Member State law (in which case it will inform the Controller before processing, unless the law prohibits this).

5.2 Duty to notify unlawful instructions (Art. 28(3), final sentence). The Processor will inform the Controller without undue delay if, in its opinion, an instruction infringes the GDPR or other data-protection provisions.

5.3 Confidentiality (Art. 28(3)(b)). The Processor ensures that persons authorized to process personal data have committed to confidentiality or are under an appropriate statutory confidentiality obligation.

5.4 Security (Art. 28(3)(c) / Art. 32). The Processor implements the technical and organizational measures set out in Annex 2.

5.5 Assistance (Art. 28(3)(e)/(f)). Taking into account the nature of processing, the Processor assists the Controller by appropriate technical and organizational measures, insofar as possible, in responding to data-subject requests, and assists the Controller in ensuring compliance with Art. 32–36 GDPR (security, breach notification, data protection impact assessments, prior consultation).

5.6 Breach notification. The Processor notifies the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller’s data, providing the information the Controller reasonably needs to meet its own obligations under Art. 33 and 34 GDPR.

5.7 Records and demonstrating compliance (Art. 28(3)(h)). The Processor maintains a record of processing categories under Art. 30(2) GDPR and makes available to the Controller the information necessary to demonstrate compliance with Art. 28.

5.8 Data-protection contact: support@mapmigo.io

6. Subprocessors (Art. 28(2) and (4))

6.1 The Controller grants the Processor general authorization to engage subprocessors. Those currently engaged are listed in Annex 3.

6.2 The Processor will inform the Controller of any intended addition or replacement of a subprocessor at least 30 days in advance (e.g., by email or in-app notice), giving the Controller the opportunity to object on reasonable data-protection grounds within 14 days. If the Controller objects and no amicable solution is reached, the Controller may terminate the affected service; the Processor may likewise terminate if it cannot reasonably provide the service without the subprocessor.

6.3 The Processor imposes on each subprocessor, by contract, data-protection obligations equivalent to those in this DPA and remains fully liable to the Controller for the subprocessor’s performance.

7. International Transfers

7.1 Processing takes place on servers located within the EU/EEA: application hosting in Frankfurt, Germany; database and file storage in Stockholm, Sweden; video storage in an EU region. Some subprocessors are established outside the EU/EEA or operate infrastructure outside the EU/EEA, in particular Fly.io, Inc. and Supabase, Inc. (both United States), whose personnel may access data for support and maintenance purposes, and BunnyWay d.o.o., whose global content-delivery network may serve or cache video content from points of presence outside the EEA. Development, maintenance, and support access may also be provided by service providers located in the United Kingdom.

7.2 Where personal data is transferred to a third country without an adequacy decision, the transfer is safeguarded by the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914) in the applicable module, together with any additional measures required, or by another valid transfer mechanism under Chapter V GDPR. Transfers to the United Kingdom are based on the applicable adequacy decision.

8. Data-Subject Rights

8.1 The Processor will, to the extent legally required, forward to the Controller without undue delay any request it receives from a data subject relating to the Controller’s data and will not respond to such requests itself except on the Controller’s instruction or where legally required.

9. Audit Rights (Art. 28(3)(h))

9.1 The Processor makes available all information necessary to demonstrate compliance with Art. 28 GDPR and, upon reasonable prior notice, allows for and contributes to audits, including inspections.

9.2 Audits are conducted primarily via documentation, self-assessments, and available certifications or reports. On-site inspections take place only where necessary, during normal business hours, without disproportionate disruption, subject to reasonable prior notice of at least 14 days and confidentiality, and no more than once per year unless there is specific cause (e.g., a data breach or a supervisory-authority request). Each party bears its own costs; the reasonable costs of extraordinary audits caused by the Controller may be allocated to the Controller.

10. Liability

10.1 Liability under this DPA is governed by the limitation-of-liability provisions of the Main Agreement (Section 12), without prejudice to Art. 82 GDPR and mandatory statutory liability. As between the parties, liability follows the allocation of responsibilities under the GDPR and this DPA.

11. Deletion and Return (Art. 28(3)(g))

11.1 Upon termination of the processing, the Processor will, at the Controller’s choice, delete or return all personal data processed on the Controller’s behalf and delete existing copies, unless Union or Member State law, or Shopify’s API Terms, require continued storage.

11.2 Upon uninstallation of the App, the Processor terminates the Controller’s active sessions. Upon receipt of Shopify’s shop/redact request, which Shopify sends approximately 48 hours after uninstallation, the Processor queues the Controller’s data, uploaded files, and videos for deletion and completes deletion within 30 days of the request, unless the Controller requests earlier deletion or return.

11.3 The Processor implements Shopify’s mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact) and completes the corresponding actions within the timelines required by Shopify.

12. Precedence

12.1 In the event of any conflict between this DPA and the Main Agreement regarding data protection, this DPA prevails. In all other respects the Main Agreement applies.

13. Final Provisions

13.1 Should individual provisions of this DPA be invalid, the validity of the remainder is unaffected; the parties will replace the invalid provision with a valid one that comes closest to its economic and data-protection purpose. German law applies; jurisdiction is as set out in the Main Agreement.

Annex 1 — Description of processing

• Subject matter: Provision of the Studyvio app (course creation, sale, delivery, and student-management functionality) within the Controller’s Shopify Store.
• Purpose: Managing Course access and enrollments; displaying Student data; tracking Course progress; storing quiz answers and results; issuing certificates; granting and revoking access on the Controller’s instructions.
• Nature: Automated collection, storage, retrieval, display, transmission, restriction, and erasure; reading Shopify customer data via the Shopify API.
• Duration: For the term of the Main Agreement, plus the deletion window in Section 11.
• Categories of data subjects: The Controller’s customers and Course Students, including manually added Students and registered visitors to free Courses.
• Categories of personal data: Name; email address; Shopify customer and order identifiers; Course enrollment and access status; Course progress; quiz answers and results; certificates issued; access data entered by the Controller for manually added Students.
• Special categories: None.

Annex 2 — Technical and organizational measures (Art. 32 GDPR)

1. Confidentiality

• Hosting: Application hosting with Fly.io in the Frankfurt (Germany) region; database and file storage with Supabase in the Stockholm (Sweden) region; video hosting and delivery with bunny.net. No production personal data is stored on local devices.
• Access control (system): Individual accounts for administrative access; access limited to the Processor and contracted development personnel bound to confidentiality.
• Access control (data): Server-side authorization checks on every request for Course content; separation of Merchants’ data through shop ownership records; role-based, least-privilege access to production systems.
• Protection of content: Uploaded PDFs and images are stored in a private storage bucket and served only via signed URLs that expire after approximately five minutes. Videos are served only via server-generated, token-authenticated links that expire after approximately five minutes. Before a link is issued, the App verifies the Merchant, the Student’s access entitlement to the specific Course, and the availability of the specific lesson. Video-platform API keys are held server-side only and are not present in the storefront or the Shopify theme extension.
• Encryption: Encryption in transit (HTTPS/TLS) for all application and database connections; encryption at rest for data stored in the database and file storage.

2. Integrity

• Secured API access to Shopify; controlled interfaces to subprocessors; access to Course content granted only after the verification steps described above.

3. Availability and Resilience

• Managed hosting, database, and storage services with provider-side redundancy and automated backups; DDoS protection and content-delivery network at the infrastructure level.

4. Data Minimization

• The Processor does not store Students’ IP addresses. Progress of non-registered visitors is stored only in the visitor’s browser (sessionStorage) and not on the Processor’s servers. Application and error logs are retained for seven (7) days.

5. Regular Review, Assessment, Evaluation (Art. 32(1)(d))

• Periodic review of measures; patch management; data protection by design and by default; subprocessor management; deletion routines in accordance with Section 11; incident-response process including breach notification.

Annex 3 — List of subprocessors

Subprocessor	Service	Location / data residency	Transfer safeguard
Fly.io, Inc., United States	Application hosting	Servers: Frankfurt, Germany	SCCs (and EU-U.S. Data Privacy Framework where certified)
Supabase, Inc., United States	Database; storage of uploaded images and PDFs	Servers: Stockholm, Sweden	SCCs (and EU-U.S. Data Privacy Framework where certified)
BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia	Video hosting, transcoding, and CDN delivery	EU storage region; global CDN edges may serve or cache content outside the EEA	SCCs (bunny.net DPA)
External development and support service provider, United Kingdom	Development, maintenance, and support access to production systems	United Kingdom	UK adequacy decision

The identity of the development and support service provider will be disclosed to the Controller on request.