Data Processing Agreement for PaymentHero

Last updated: 14 October 2026

1. Parties, scope and roles

1.1 This Data Processing Agreement ("DPA") is entered into between HeroSoftware GmbH, Walramstraße 23, 65510 Idstein, Germany ("HeroSoftware", "Processor") and the merchant using the Shopify app PaymentHero ("Merchant", "Controller").

1.2 This DPA forms part of the Terms of Service for PaymentHero ("Terms"). It is concluded electronically when the Merchant installs the app and accepts the Terms. HeroSoftware keeps a record of the installation as evidence of the conclusion.

1.3 This DPA applies to all personal data that HeroSoftware processes on behalf of the Merchant when providing the app ("Merchant Personal Data"). It does not apply to data that HeroSoftware processes as an independent controller, in particular account, contract, billing and support data relating to the Merchant and its staff. That processing is described in the Privacy Policy.

1.4 In case of conflict between this DPA and the Terms regarding the processing of personal data, this DPA prevails. Annexes 4 to 7 prevail over this DPA for the respective jurisdiction.

2. Subject matter, nature, purpose and duration

2.1 The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

2.2 The duration of the processing corresponds to the term of the Terms. Section 9 applies after termination.

3. Instructions

3.1 HeroSoftware processes Merchant Personal Data only on documented instructions of the Merchant, including with regard to transfers to a third country, unless required to do so by Union or Member State law to which HeroSoftware is subject. In that case HeroSoftware informs the Merchant of the legal requirement before processing, unless the law prohibits this.

3.2 The Terms, this DPA and the Merchant's configuration of the app constitute the Merchant's complete documented instructions at the time of conclusion. Further instructions must be given in text form (e.g. e-mail to post@hero.software) and must be consistent with the Terms.

3.3 When the Merchant connects its own third-party accounts to the app (for example its own e-mail, advertising or analytics accounts), the Merchant instructs HeroSoftware to transmit Merchant Personal Data to those accounts to the extent required for the integration. These providers are engaged by the Merchant, not by HeroSoftware, and are not sub-processors of HeroSoftware.

3.4 HeroSoftware informs the Merchant without undue delay if, in its opinion, an instruction infringes applicable data protection law. HeroSoftware may suspend the execution of such an instruction until the Merchant confirms or changes it, and may refuse instructions that are obviously unlawful.

3.5 The Merchant does not use the app to process special categories of personal data (Art. 9 GDPR) and ensures that its buyers' data transmitted to the app is limited to what the app requires.

3.6 If authorities, courts or other third parties request access to Merchant Personal Data, or if Merchant Personal Data is endangered by seizure, attachment or insolvency proceedings, HeroSoftware informs the Merchant without undue delay, unless prohibited by law. HeroSoftware discloses Merchant Personal Data only to the extent legally required, informs the requesting party that the data is under the Merchant's control and challenges requests it considers unlawful. HeroSoftware also informs the Merchant of inspections by a supervisory authority that concern the processing under this DPA.

4. Obligations of HeroSoftware

HeroSoftware shall:

a) ensure that all persons authorised to process Merchant Personal Data are bound by confidentiality, also after the end of their engagement;

b) implement and maintain the technical and organisational measures described in Annex 2. HeroSoftware may adapt these measures to technical progress, provided the overall level of protection is not reduced;

c) engage sub-processors only in accordance with Section 6;

d) assist the Merchant, taking into account the nature of the processing, in responding to requests from data subjects (Section 8);

e) assist the Merchant in complying with its obligations regarding security of processing, notification of personal data breaches, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to HeroSoftware;

f) delete or return Merchant Personal Data in accordance with Section 9;

g) make available to the Merchant the information necessary to demonstrate compliance with this DPA and allow for audits in accordance with Section 10.

5. Security

HeroSoftware protects Merchant Personal Data by the technical and organisational measures described in Annex 2. The Merchant has reviewed these measures and considers them appropriate for the risks of the processing.

6. Sub-processors

6.1 The Merchant grants HeroSoftware a general authorisation to engage sub-processors. The sub-processors engaged at the time of conclusion are listed in Annex 3 and are deemed approved. Annex 3 is always kept up to date in the version of this DPA published on the app website.

6.2 HeroSoftware informs the Merchant by e-mail to the Merchant's store e-mail address at least 30 days before adding or replacing a sub-processor. The Merchant may object in text form within this period on reasonable data protection grounds. If HeroSoftware cannot offer a reasonable alternative, the Merchant may terminate the Terms with effect from the date on which the new sub-processor would start processing.

6.3 In urgent cases, in particular to maintain security or availability, HeroSoftware may engage a new sub-processor with shorter notice. The Merchant's right to object and terminate under Section 6.2 remains unaffected.

6.4 Services that HeroSoftware uses as ancillary services without access to Merchant Personal Data (e.g. telecommunications, postal services, office services) are not sub-processors. Maintenance and support services with possible access to Merchant Personal Data are sub-processors.

6.5 HeroSoftware imposes data protection obligations on each sub-processor that provide at least the same level of protection as this DPA. HeroSoftware remains liable to the Merchant for the performance of its sub-processors' obligations.

7. Personal data breaches

7.1 HeroSoftware notifies the Merchant without undue delay, and in any case within 24 hours, after becoming aware of a personal data breach affecting Merchant Personal Data. This also applies to breaches at sub-processors.

7.2 The notification is sent to the Merchant's store e-mail address and contains, as far as known at that time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact person. Information not yet available is provided without undue delay as soon as it becomes available.

7.3 Notifying the competent supervisory authority and data subjects is the responsibility of the Merchant. HeroSoftware supports the Merchant in doing so.

8. Data subject requests

8.1 If a data subject contacts HeroSoftware directly regarding Merchant Personal Data, HeroSoftware forwards the request to the Merchant without undue delay and does not respond itself unless instructed by the Merchant or required by law.

8.2 HeroSoftware processes the mandatory Shopify privacy webhooks (customers/data_request, customers/redact, shop/redact) within the periods specified by Shopify.

9. Deletion and return

9.1 When the Merchant uninstalls the app or the Terms end, HeroSoftware blocks Merchant Personal Data and keeps it for 30 days solely so that the Merchant can request an export. HeroSoftware then deletes the data from its active systems, at the latest 30 days after uninstallation or termination, and within the periods required by Shopify for its privacy webhooks. If the Merchant has requested an export within the 30 days, HeroSoftware provides it even if delivery takes place after the end of this period and deletes the data once the export has been provided. Residual copies in backups expire no later than 7 days after deletion. If data is restored from a backup, deletions are re-applied before the data is used.

9.2 During the term and within 30 days after uninstallation or termination (Section 9.1), the Merchant may request the return (export) or deletion of its Merchant Personal Data by e-mail to post@hero.software. If no export is requested within this period, the data is deleted in accordance with Section 9.1.

9.3 Section 9.1 does not apply where Union or Member State law requires HeroSoftware to retain data. In that case HeroSoftware restricts processing to the purpose of the retention obligation.

9.4 Upon request, HeroSoftware confirms the deletion in text form.

9.5 HeroSoftware has no right of retention with regard to Merchant Personal Data.

10. Audits

10.1 HeroSoftware demonstrates compliance with this DPA primarily by providing up-to-date documentation, in particular a description of its technical and organisational measures, and by answering reasonable written questions.

10.2 If this is not sufficient, the Merchant or an independent auditor bound by confidentiality who is not a competitor of HeroSoftware may carry out an on-site audit once per calendar year, with at least 30 days' notice, during normal business hours and without disproportionate disruption of HeroSoftware's operations. In case of a personal data breach or concrete indications of non-compliance, shorter notice is possible. Each party bears its own costs.

11. Anonymised and aggregated data

11.1 HeroSoftware may create anonymised and aggregated statistics from the processing (for example usage, error or success rates across all merchants) and use them to operate, secure and improve its services. Anonymised data no longer relates to an identifiable person and is not subject to this DPA.

12. Place of processing and international transfers

12.1 The app is hosted in Frankfurt am Main, Germany. Some sub-processors listed in Annex 3 are located outside the European Economic Area or may access data from there.

12.2 EU/EEA: Transfers of Merchant Personal Data to a sub-processor in a third country take place only if the requirements of Chapter V GDPR are met, in particular on the basis of an adequacy decision (including the EU-U.S. Data Privacy Framework) or the Standard Contractual Clauses of the European Commission.

12.3 If the Merchant is established in a third country that is not covered by an adequacy decision of the European Commission, the Standard Contractual Clauses in Annex 4 apply to the transfer of Merchant Personal Data from HeroSoftware to the Merchant.

12.4 UK and Switzerland: Annexes 5 and 6 apply in addition.

12.5 USA: If the Merchant is subject to US state privacy laws, Annex 7 applies in addition.

13. Liability

The liability of the parties under this DPA is governed by the limitation of liability in the Terms. Mandatory liability towards data subjects under applicable data protection law, in particular Art. 82 GDPR, remains unaffected.

14. Term, changes and final provisions

14.1 This DPA applies for as long as HeroSoftware processes Merchant Personal Data.

14.2 Changes to this DPA follow the amendment procedure of the Terms. Changes to the list of sub-processors follow Section 6.

14.3 This DPA is governed by the laws of the Federal Republic of Germany. The place of jurisdiction is Wiesbaden, Germany, provided the Merchant is a merchant (Kaufmann), a legal entity under public law or has no general place of jurisdiction in Germany. Annexes 4 to 7 may provide otherwise for their scope.

14.4 Should any provision of this DPA be invalid, the remaining provisions remain unaffected. The invalid provision is replaced by the corresponding requirement of Art. 28 GDPR.

Annex 1: Processing details

Nature and purpose. Providing payment rules that hide, sort and rename payment methods in the Merchant's checkout.

Where buyer data is processed. The payment rules are executed by Shopify as Shopify Functions within Shopify's infrastructure. Buyer data used by the rules (e.g. cart contents, shipping country and address, customer tags or segment) is processed exclusively by Shopify and is not transmitted to HeroSoftware's servers. The app backend retrieves only the names of customer segments and tags for the rule editor. HeroSoftware stores store and account data (as described in its Privacy Policy), the Merchant's rules and settings, and usage and billing data; it does not store buyer data.

Processing on behalf of the Merchant. This DPA applies as a precaution to the extent that HeroSoftware processes personal data on behalf of the Merchant, in particular:

• Shopify Function run logs that the Merchant shares with HeroSoftware for troubleshooting via Shopify's log sharing function; these logs may contain buyer data such as cart contents and shipping address. HeroSoftware views them in the Shopify Partner Dashboard and uses them only to resolve the support case. If copies are made, they are deleted no later than 30 days after the case is closed.

Categories of data subjects. Buyers of the Merchant's store (only in shared logs).

Special categories of data. None (Section 3.5).

Retention during use. Rules and settings are stored for as long as the Merchant uses the app. After uninstallation, Section 9 applies.

Annex 2: Technical and organisational measures (TOMs)

This annex describes the measures HeroSoftware has implemented. A more detailed description is available to merchants on request.

Confidentiality and access control

• Access to systems and data is limited to HeroSoftware's own employees in Germany. No freelancers have access.
• All employees are bound in writing to confidentiality and data protection.
• Personal accounts for all systems. Multi-factor authentication is mandatory for all employees in all applications used.
• Permissions are granted on a need-to-know basis, reviewed quarterly and revoked immediately when an employee leaves.
• Only company-owned computers with full-disk encryption and automatic screen lock are used.
• Merchants access the app only via Shopify Admin (OAuth 2.0 and session tokens). Shopify webhooks are verified by HMAC.

Separation

• Every data record is assigned to a shop. Access to app data is determined by the authenticated shop session.
• Production, test and development environments are separated, with separate apps, databases and credentials.

Encryption

• Data in transit is encrypted with TLS.
• Stored app data, logs and backups are encrypted.

Integrity and secure development

• Changes to production code require a pull request, review by a second person and passing automated tests.
• Dependencies, code and secrets are scanned regularly. Vulnerabilities are fixed within defined deadlines according to their severity.
• Production secrets are stored separately from the source code. AI-based development tools have no access to production secrets or production data.
• Sensitive fields (passwords, tokens, keys) are redacted before they are written to application logs.
• Buyer data must not be entered into internal communication, ticketing or documentation tools. Cases are referred to by order number and shop domain only.

Availability and resilience

• Hosting with DigitalOcean in Frankfurt, Germany, with multiple app instances.
• Daily database backups, stored in Frankfurt and retained for 7 days.
• Monitoring with automatic alerts. Recovery procedures are documented and tested.

Incident response

• A documented incident procedure covers reporting, containment, evidence preservation, assessment, notification of merchants, recovery and follow-up.
• Merchants are notified of personal data breaches within 24 hours (Section 7).

Organisation and review

• Employees complete security awareness training when joining and regularly thereafter (last company-wide training: October 2026).
• Contact for data protection: post@hero.software. A data protection officer is not required to be appointed.
• These measures are reviewed quarterly and after material changes.

Annex 3: Sub-processors

Sub-processors with access to Merchant Personal Data

Other service providers without access to Merchant Personal Data

HeroSoftware also uses service providers for internal communication, software development, testing, translation and project management (for example Google Workspace, Slack, Notion, Linear, GitHub, Cursor, DeepL). Under HeroSoftware's internal rules, Merchant Personal Data must not be entered into these tools (Annex 2). They are therefore not sub-processors.

Annex 4: Standard Contractual Clauses for merchants outside the EEA

4.1 If the Merchant is established in a country outside the European Economic Area that is not covered by an adequacy decision of the European Commission, or in the USA without certification under the EU-U.S. Data Privacy Framework, the Standard Contractual Clauses of the European Commission (Implementing Decision (EU) 2021/914), Module Four (transfer processor to controller), are incorporated into this DPA by reference.

4.2 HeroSoftware is the data exporter, the Merchant is the data importer. The details required in Annex I of the Clauses follow from Annex 1 of this DPA.

4.3 Clause 7 (docking clause) does not apply. For Clause 17, the parties choose the law of Germany. For Clause 18, the parties choose the courts of Wiesbaden, Germany.

Annex 5: United Kingdom

5.1 Where the UK GDPR applies to the processing, references in this DPA to the GDPR are to be read as references to the UK GDPR and the UK Data Protection Act 2018, and references to the supervisory authority as references to the Information Commissioner's Office (ICO).

5.2 Transfers of personal data from the United Kingdom to HeroSoftware in Germany are covered by the UK adequacy regulations for the European Economic Area. For onward transfers to sub-processors outside the UK and the EEA, HeroSoftware relies on the UK Extension to the EU-U.S. Data Privacy Framework or on the Standard Contractual Clauses together with the UK International Data Transfer Addendum.

Annex 6: Switzerland

6.1 Where the Swiss Federal Act on Data Protection (FADP) applies to the processing, references in this DPA to the GDPR are to be read as references to the FADP, and references to the supervisory authority as references to the Federal Data Protection and Information Commissioner (FDPIC).

6.2 Transfers of personal data from Switzerland to HeroSoftware in Germany are covered by the Swiss Federal Council's recognition of Germany as providing adequate protection. For onward transfers, HeroSoftware relies on the Swiss-U.S. Data Privacy Framework or on the Standard Contractual Clauses as adapted for Swiss law.

Annex 7: US state privacy laws

7.1 Where the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA) or a comparable US state privacy law applies, HeroSoftware acts as a "service provider" or "processor" of the Merchant with respect to Merchant Personal Data.

7.2 HeroSoftware shall not:

a) sell or share Merchant Personal Data;

b) retain, use or disclose Merchant Personal Data for any purpose other than providing the app as set out in the Terms and this DPA, or as otherwise permitted for service providers under the CCPA;

c) retain, use or disclose Merchant Personal Data outside the direct business relationship with the Merchant; this does not apply to transmissions to independent controllers or Merchant integrations listed in Annex 3, which take place on the Merchant's instruction;

d) combine Merchant Personal Data with personal data received from other sources, except as permitted for service providers under the CCPA.

7.3 HeroSoftware complies with the obligations applicable to it under the CCPA and provides the same level of privacy protection as required by the CCPA. HeroSoftware notifies the Merchant if it determines that it can no longer meet these obligations. The Merchant may then take reasonable and appropriate steps to stop and remediate unauthorised use of Merchant Personal Data.

7.4 HeroSoftware certifies that it understands and will comply with the restrictions in this Annex.

Annex 8: Privacy policy text for merchants

The Merchant is responsible for informing its buyers about the processing. The following text may be added to the Merchant's privacy policy.

Base text

Payment methods with PaymentHero. We use the PaymentHero app provided by HeroSoftware GmbH, Walramstraße 23, 65510 Idstein, Germany, to determine which payment methods are shown to you in our checkout, for example depending on your shipping country, cart or customer group. These rules are executed within our shop system Shopify; HeroSoftware does not receive your data for this purpose. If we need technical support, we may share technical logs, which can contain order data, with HeroSoftware as our processor.

Addition for the EU/EEA and the UK

The legal basis is Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR (our legitimate interest in offering suitable payment methods).

Addition for the USA

PaymentHero acts as our service provider. We do not sell or share your personal information through this service.