Data Processing Agreement for DiscountHero

Last updated: 14 October 2026

1. Parties, scope and roles

1.1 This Data Processing Agreement ("DPA") is entered into between HeroSoftware GmbH, Walramstraße 23, 65510 Idstein, Germany ("HeroSoftware", "Processor") and the merchant using the Shopify app DiscountHero ("Merchant", "Controller").

1.2 This DPA forms part of the Terms of Service for DiscountHero ("Terms"). It is concluded electronically when the Merchant installs the app and accepts the Terms. HeroSoftware keeps a record of the installation as evidence of the conclusion.

1.3 This DPA applies to all personal data that HeroSoftware processes on behalf of the Merchant when providing the app ("Merchant Personal Data"). It does not apply to data that HeroSoftware processes as an independent controller, in particular account, contract, billing and support data relating to the Merchant and its staff. That processing is described in the Privacy Policy.

1.4 In case of conflict between this DPA and the Terms regarding the processing of personal data, this DPA prevails. Annexes 4 to 7 prevail over this DPA for the respective jurisdiction.

2. Subject matter, nature, purpose and duration

2.1 The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

2.2 The duration of the processing corresponds to the term of the Terms. Section 9 applies after termination.

3. Instructions

3.1 HeroSoftware processes Merchant Personal Data only on documented instructions of the Merchant, including with regard to transfers to a third country, unless required to do so by Union or Member State law to which HeroSoftware is subject. In that case HeroSoftware informs the Merchant of the legal requirement before processing, unless the law prohibits this.

3.2 The Terms, this DPA and the Merchant's configuration of the app constitute the Merchant's complete documented instructions at the time of conclusion. Further instructions must be given in text form (e.g. e-mail to post@hero.software) and must be consistent with the Terms.

3.3 When the Merchant connects its own third-party accounts to the app (for example its own e-mail, advertising or analytics accounts), the Merchant instructs HeroSoftware to transmit Merchant Personal Data to those accounts to the extent required for the integration. These providers are engaged by the Merchant, not by HeroSoftware, and are not sub-processors of HeroSoftware.

3.4 HeroSoftware informs the Merchant without undue delay if, in its opinion, an instruction infringes applicable data protection law. HeroSoftware may suspend the execution of such an instruction until the Merchant confirms or changes it, and may refuse instructions that are obviously unlawful.

3.5 The Merchant does not use the app to process special categories of personal data (Art. 9 GDPR) and ensures that its buyers' data transmitted to the app is limited to what the app requires.

3.6 If authorities, courts or other third parties request access to Merchant Personal Data, or if Merchant Personal Data is endangered by seizure, attachment or insolvency proceedings, HeroSoftware informs the Merchant without undue delay, unless prohibited by law. HeroSoftware discloses Merchant Personal Data only to the extent legally required, informs the requesting party that the data is under the Merchant's control and challenges requests it considers unlawful. HeroSoftware also informs the Merchant of inspections by a supervisory authority that concern the processing under this DPA.

4. Obligations of HeroSoftware

HeroSoftware shall:

a) ensure that all persons authorised to process Merchant Personal Data are bound by confidentiality, also after the end of their engagement;

b) implement and maintain the technical and organisational measures described in Annex 2. HeroSoftware may adapt these measures to technical progress, provided the overall level of protection is not reduced;

c) engage sub-processors only in accordance with Section 6;

d) assist the Merchant, taking into account the nature of the processing, in responding to requests from data subjects (Section 8);

e) assist the Merchant in complying with its obligations regarding security of processing, notification of personal data breaches, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to HeroSoftware;

f) delete or return Merchant Personal Data in accordance with Section 9;

g) make available to the Merchant the information necessary to demonstrate compliance with this DPA and allow for audits in accordance with Section 10.

5. Security

HeroSoftware protects Merchant Personal Data by the technical and organisational measures described in Annex 2. The Merchant has reviewed these measures and considers them appropriate for the risks of the processing.

6. Sub-processors

6.1 The Merchant grants HeroSoftware a general authorisation to engage sub-processors. The sub-processors engaged at the time of conclusion are listed in Annex 3 and are deemed approved. Annex 3 is always kept up to date in the version of this DPA published on the app website.

6.2 HeroSoftware informs the Merchant by e-mail to the Merchant's store e-mail address at least 30 days before adding or replacing a sub-processor. The Merchant may object in text form within this period on reasonable data protection grounds. If HeroSoftware cannot offer a reasonable alternative, the Merchant may terminate the Terms with effect from the date on which the new sub-processor would start processing.

6.3 In urgent cases, in particular to maintain security or availability, HeroSoftware may engage a new sub-processor with shorter notice. The Merchant's right to object and terminate under Section 6.2 remains unaffected.

6.4 Services that HeroSoftware uses as ancillary services without access to Merchant Personal Data (e.g. telecommunications, postal services, office services) are not sub-processors. Maintenance and support services with possible access to Merchant Personal Data are sub-processors.

6.5 HeroSoftware imposes data protection obligations on each sub-processor that provide at least the same level of protection as this DPA. HeroSoftware remains liable to the Merchant for the performance of its sub-processors' obligations.

7. Personal data breaches

7.1 HeroSoftware notifies the Merchant without undue delay, and in any case within 24 hours, after becoming aware of a personal data breach affecting Merchant Personal Data. This also applies to breaches at sub-processors.

7.2 The notification is sent to the Merchant's store e-mail address and contains, as far as known at that time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact person. Information not yet available is provided without undue delay as soon as it becomes available.

7.3 Notifying the competent supervisory authority and data subjects is the responsibility of the Merchant. HeroSoftware supports the Merchant in doing so.

8. Data subject requests

8.1 If a data subject contacts HeroSoftware directly regarding Merchant Personal Data, HeroSoftware forwards the request to the Merchant without undue delay and does not respond itself unless instructed by the Merchant or required by law.

8.2 HeroSoftware processes the mandatory Shopify privacy webhooks (customers/data_request, customers/redact, shop/redact) within the periods specified by Shopify.

9. Deletion and return

9.1 When the Merchant uninstalls the app or the Terms end, HeroSoftware blocks Merchant Personal Data and keeps it for 30 days solely so that the Merchant can request an export. HeroSoftware then deletes the data from its active systems, at the latest 30 days after uninstallation or termination, and within the periods required by Shopify for its privacy webhooks. If the Merchant has requested an export within the 30 days, HeroSoftware provides it even if delivery takes place after the end of this period and deletes the data once the export has been provided. Residual copies in backups expire no later than 7 days after deletion. If data is restored from a backup, deletions are re-applied before the data is used.

9.2 During the term and within 30 days after uninstallation or termination (Section 9.1), the Merchant may request the return (export) or deletion of its Merchant Personal Data by e-mail to post@hero.software. If no export is requested within this period, the data is deleted in accordance with Section 9.1.

9.3 Section 9.1 does not apply where Union or Member State law requires HeroSoftware to retain data. In that case HeroSoftware restricts processing to the purpose of the retention obligation.

9.4 Upon request, HeroSoftware confirms the deletion in text form.

9.5 HeroSoftware has no right of retention with regard to Merchant Personal Data.

10. Audits

10.1 HeroSoftware demonstrates compliance with this DPA primarily by providing up-to-date documentation, in particular a description of its technical and organisational measures, and by answering reasonable written questions.

10.2 If this is not sufficient, the Merchant or an independent auditor bound by confidentiality who is not a competitor of HeroSoftware may carry out an on-site audit once per calendar year, with at least 30 days' notice, during normal business hours and without disproportionate disruption of HeroSoftware's operations. In case of a personal data breach or concrete indications of non-compliance, shorter notice is possible. Each party bears its own costs.

11. Anonymised and aggregated data

11.1 HeroSoftware may create anonymised and aggregated statistics from the processing (for example usage, error or success rates across all merchants) and use them to operate, secure and improve its services. Anonymised data no longer relates to an identifiable person and is not subject to this DPA.

12. Place of processing and international transfers

12.1 The app is hosted in Frankfurt am Main, Germany. Some sub-processors listed in Annex 3 are located outside the European Economic Area or may access data from there.

12.2 EU/EEA: Transfers of Merchant Personal Data to a sub-processor in a third country take place only if the requirements of Chapter V GDPR are met, in particular on the basis of an adequacy decision (including the EU-U.S. Data Privacy Framework) or the Standard Contractual Clauses of the European Commission.

12.3 If the Merchant is established in a third country that is not covered by an adequacy decision of the European Commission, the Standard Contractual Clauses in Annex 4 apply to the transfer of Merchant Personal Data from HeroSoftware to the Merchant.

12.4 UK and Switzerland: Annexes 5 and 6 apply in addition.

12.5 USA: If the Merchant is subject to US state privacy laws, Annex 7 applies in addition.

13. Liability

The liability of the parties under this DPA is governed by the limitation of liability in the Terms. Mandatory liability towards data subjects under applicable data protection law, in particular Art. 82 GDPR, remains unaffected.

14. Term, changes and final provisions

14.1 This DPA applies for as long as HeroSoftware processes Merchant Personal Data.

14.2 Changes to this DPA follow the amendment procedure of the Terms. Changes to the list of sub-processors follow Section 6.

14.3 This DPA is governed by the laws of the Federal Republic of Germany. The place of jurisdiction is Wiesbaden, Germany, provided the Merchant is a merchant (Kaufmann), a legal entity under public law or has no general place of jurisdiction in Germany. Annexes 4 to 7 may provide otherwise for their scope.

14.4 Should any provision of this DPA be invalid, the remaining provisions remain unaffected. The invalid provision is replaced by the corresponding requirement of Art. 28 GDPR.

Annex 1: Processing details

Nature and purpose. Detecting and preventing the misuse of discount codes in the Merchant's checkout according to the Merchant's rules; blocking discounts that violate these rules; statistics and reporting for the Merchant.

Processing steps. When a buyer enters a discount code, the App's Shopify checkout extension sends the discount code and the buyer's data relevant for the rules to HeroSoftware's servers. After an order has been placed, the App reads the order reference and the discount used via the Shopify API in order to record the discount use; buyer contact and address data obtained in this way is likewise stored only as keyed hash values. HeroSoftware compares the data with earlier uses of discount codes in the same shop and returns whether the discount may be applied. Data is compared only within the Merchant's shop, not across shops. In addition, the App's Shopify web pixel records discount-related checkout events; it only runs if the buyer has given the consent required in the Merchant's store (Shopify Customer Privacy API). The decision to block a discount is made automatically according to the rules set by the Merchant.

Types of personal data.

• E-mail address, telephone number, name, address and IP address of the buyer: processed in plain text only at the moment of the check, stored only as keyed hash values (HMAC with a secret key per shop, stored separately from the database)
• Shopify customer or client ID
• Discount code used, order reference, time, result of the check
• Discount-related checkout events from the web pixel (with consent)

Categories of data subjects. Buyers of the Merchant's store who enter a discount code.

Special categories of data. None (Section 3.5).

Retention during use. All buyer data (hash values, customer or client IDs, check results and web pixel events) is deleted 12 months after the respective discount use; application logs after 30 days at the latest. Backup copies expire no later than 7 days after deletion. After uninstallation, Section 9 applies.

Annex 2: Technical and organisational measures (TOMs)

This annex describes the measures HeroSoftware has implemented. A more detailed description is available to merchants on request.

Confidentiality and access control

• Access to systems and data is limited to HeroSoftware's own employees in Germany. No freelancers have access.
• All employees are bound in writing to confidentiality and data protection.
• Personal accounts for all systems. Multi-factor authentication is mandatory for all employees in all applications used.
• Permissions are granted on a need-to-know basis, reviewed quarterly and revoked immediately when an employee leaves.
• Only company-owned computers with full-disk encryption and automatic screen lock are used.
• Merchants access the app only via Shopify Admin (OAuth 2.0 and session tokens). Shopify webhooks are verified by HMAC.

Separation

• Every data record is assigned to a shop. Access to app data is determined by the authenticated shop session.
• Production, test and development environments are separated, with separate apps, databases and credentials.

Encryption

• Data in transit is encrypted with TLS.
• Stored app data, logs and backups are encrypted.

Integrity and secure development

• Changes to production code require a pull request, review by a second person and passing automated tests.
• Dependencies, code and secrets are scanned regularly. Vulnerabilities are fixed within defined deadlines according to their severity.
• Production secrets are stored separately from the source code. AI-based development tools have no access to production secrets or production data.
• Sensitive fields (passwords, tokens, keys) are redacted before they are written to application logs.
• Buyer data must not be entered into internal communication, ticketing or documentation tools. Cases are referred to by order number and shop domain only.

Availability and resilience

• Hosting with DigitalOcean in Frankfurt, Germany, with multiple app instances.
• Daily database backups, stored in Frankfurt and retained for 7 days.
• Monitoring with automatic alerts. Recovery procedures are documented and tested.

Incident response

• A documented incident procedure covers reporting, containment, evidence preservation, assessment, notification of merchants, recovery and follow-up.
• Merchants are notified of personal data breaches within 24 hours (Section 7).

Organisation and review

• Employees complete security awareness training when joining and regularly thereafter (last company-wide training: October 2026).
• Contact for data protection: post@hero.software. A data protection officer is not required to be appointed.
• These measures are reviewed quarterly and after material changes.

Annex 3: Sub-processors

Sub-processors with access to Merchant Personal Data

Other service providers without access to Merchant Personal Data

HeroSoftware also uses service providers for internal communication, software development, testing, translation and project management (for example Google Workspace, Slack, Notion, Linear, GitHub, Cursor, DeepL). Under HeroSoftware's internal rules, Merchant Personal Data must not be entered into these tools (Annex 2). They are therefore not sub-processors.

Annex 4: Standard Contractual Clauses for merchants outside the EEA

4.1 If the Merchant is established in a country outside the European Economic Area that is not covered by an adequacy decision of the European Commission, or in the USA without certification under the EU-U.S. Data Privacy Framework, the Standard Contractual Clauses of the European Commission (Implementing Decision (EU) 2021/914), Module Four (transfer processor to controller), are incorporated into this DPA by reference.

4.2 HeroSoftware is the data exporter, the Merchant is the data importer. The details required in Annex I of the Clauses follow from Annex 1 of this DPA.

4.3 Clause 7 (docking clause) does not apply. For Clause 17, the parties choose the law of Germany. For Clause 18, the parties choose the courts of Wiesbaden, Germany.

Annex 5: United Kingdom

5.1 Where the UK GDPR applies to the processing, references in this DPA to the GDPR are to be read as references to the UK GDPR and the UK Data Protection Act 2018, and references to the supervisory authority as references to the Information Commissioner's Office (ICO).

5.2 Transfers of personal data from the United Kingdom to HeroSoftware in Germany are covered by the UK adequacy regulations for the European Economic Area. For onward transfers to sub-processors outside the UK and the EEA, HeroSoftware relies on the UK Extension to the EU-U.S. Data Privacy Framework or on the Standard Contractual Clauses together with the UK International Data Transfer Addendum.

Annex 6: Switzerland

6.1 Where the Swiss Federal Act on Data Protection (FADP) applies to the processing, references in this DPA to the GDPR are to be read as references to the FADP, and references to the supervisory authority as references to the Federal Data Protection and Information Commissioner (FDPIC).

6.2 Transfers of personal data from Switzerland to HeroSoftware in Germany are covered by the Swiss Federal Council's recognition of Germany as providing adequate protection. For onward transfers, HeroSoftware relies on the Swiss-U.S. Data Privacy Framework or on the Standard Contractual Clauses as adapted for Swiss law.

Annex 7: US state privacy laws

7.1 Where the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA) or a comparable US state privacy law applies, HeroSoftware acts as a "service provider" or "processor" of the Merchant with respect to Merchant Personal Data.

7.2 HeroSoftware shall not:

a) sell or share Merchant Personal Data;

b) retain, use or disclose Merchant Personal Data for any purpose other than providing the app as set out in the Terms and this DPA, or as otherwise permitted for service providers under the CCPA;

c) retain, use or disclose Merchant Personal Data outside the direct business relationship with the Merchant; this does not apply to transmissions to independent controllers or Merchant integrations listed in Annex 3, which take place on the Merchant's instruction;

d) combine Merchant Personal Data with personal data received from other sources, except as permitted for service providers under the CCPA.

7.3 HeroSoftware complies with the obligations applicable to it under the CCPA and provides the same level of privacy protection as required by the CCPA. HeroSoftware notifies the Merchant if it determines that it can no longer meet these obligations. The Merchant may then take reasonable and appropriate steps to stop and remediate unauthorised use of Merchant Personal Data.

7.4 HeroSoftware certifies that it understands and will comply with the restrictions in this Annex.

Annex 8: Privacy policy text for merchants

The Merchant is responsible for informing its buyers about the processing. The following text may be added to the Merchant's privacy policy.

Base text

Protection against misuse of discount codes with DiscountHero. When you enter a discount code in our checkout, we check whether it may be used, using the DiscountHero app provided by HeroSoftware GmbH, Walramstraße 23, 65510 Idstein, Germany. For this purpose, the app compares your e-mail address, telephone number, name, address and IP address (stored only as hash values, i.e. in pseudonymised form) and your customer ID with earlier uses of discount codes in our store. If our discount conditions are not met, the discount is not applied automatically. If you believe this is wrong, please contact us. HeroSoftware processes this data on our behalf and deletes it after 12 months.

Addition for the EU/EEA and the UK

The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in preventing the misuse of discounts) and, for recording discount-related events in the checkout, your consent (Art. 6(1)(a) GDPR; in Germany § 25(1) TDDDG; in the UK regulation 6 PECR). You can withdraw your consent at any time with effect for the future via the cookie or privacy settings in our store.

Addition for the USA

DiscountHero acts as our service provider. We do not sell or share your personal information through this service.