Legal

Sortimentor – Data Processing Agreement (Art. 28 GDPR)

Draft – version of 26 October 2026. The English version is binding; the German version is a translation.

Between the operator of the Shopware shop that installs the app (the Controller) and PAWSY STAYS, dejavnost spletnih iskalnikov, d.o.o., Prečna ulica 20, 1230 Domžale, Slovenia (the Processor).

1. Subject, duration, nature and purpose

1.1 The Processor provides the Shopware app "Sortimentor", which imports supplier files into the Controller's shop (Terms of Use, section 2). In doing so, it processes personal data on the Controller's behalf.

1.2 This agreement applies for as long as the app is installed and afterwards until the data has been deleted (section 9).

1.3 Data subjects and data: personal data that happens to be contained in supplier files the Controller uploads (e.g. names, email addresses or phone numbers of supplier contact persons) and in the product data of the shop the app reads and writes. The app has no access to the shop's customer or order data. The Processor does not process special categories of data (Art. 9 GDPR); the Controller does not upload them.

2. Instructions

2.1 The Processor processes the data only on the Controller's documented instructions. Using the app (uploading, mapping, applying, rolling back, deleting) is such an instruction. Further instructions may be given by email.

2.2 If the Processor believes an instruction infringes data protection law, it will tell the Controller.

3. Confidentiality

Persons authorised to process the data are bound to confidentiality.

4. Security

The Processor takes the technical and organisational measures in Annex 1. It may adapt them to technical progress, as long as the level of protection does not fall.

5. Subprocessors

5.1 The Controller agrees to the subprocessors listed in Annex 2.

5.2 The Processor informs the Controller of an intended new or replaced subprocessor at least 30 days in advance (email or a notice in the app and on the website). The Controller may object for important data protection reasons within that period; if no solution is found, the Controller may terminate the use of the app.

5.3 The Processor imposes the same data protection obligations on subprocessors by contract. It only uses subprocessors that process data in the EU/EEA.

6. Support for the Controller

The Processor supports the Controller, as far as possible and taking into account the nature of the processing, with requests from data subjects (Art. 12–22 GDPR) and with Art. 32–36 GDPR (security, breach notification, impact assessment, consultation).

7. Personal data breaches

The Processor notifies the Controller without undue delay, at the latest within 48 hours of becoming aware of a breach affecting the Controller's data, with the information available under Art. 33(3) GDPR.

8. Audits

The Processor provides the information needed to demonstrate compliance. The Controller may audit, primarily by requesting written information and documentation; on-site audits require 30 days' notice, take place during business hours, and are at the Controller's expense unless they reveal a material breach.

9. Deletion and return

9.1 Uploaded files, the import history and rollback data are deleted automatically 30 days after the import.

9.2 When the app is uninstalled with "delete data", all of the Controller's data is deleted immediately. When it is uninstalled with "keep data", supplier profiles and plan data are kept for a reinstall; the Controller can have them deleted at any time by email. Backups are overwritten within 14 days. Not covered: the apply log, which the Processor keeps as its own record for three years to establish or defend legal claims (no file contents; see the privacy policy).

9.3 On request before deletion, the Processor provides the Controller's supplier profiles as a JSON file.

10. Final provisions

The Terms of Use apply in addition (including liability and governing law). If this agreement conflicts with the Terms of Use, this agreement prevails for data protection matters.

Annex 1 – Technical and organisational measures

Confidentiality

• Server in an EU data centre operated by the hosting provider (physical access control by the provider).
• Server access only via SSH with keys; no password login; firewall allows only SSH, HTTP and HTTPS.
• The database is not reachable from the internet.
• Every request from Shopware is signed with a secret per shop and checked; the app page uses signed links that expire after 1 hour and sessions that expire after 12 hours.
• Each shop's data is stored with its shop ID and only ever read with it (tenant separation), covered by automated tests.
• The app requests only the Shopware permissions it needs (no customer or order data).

Integrity

• All connections use TLS (HTTPS).
• Changes are written to the shop only after the Controller confirms the preview; every import keeps a snapshot for rollback.
• Input validation for all data sent to the server.

Availability and resilience

• Daily database backups, kept for 14 days, with a copy in a second location.
• Automatic restart of services; external uptime monitoring.
• Interrupted imports are detected on restart and can be rolled back.

Data minimisation and deletion

• The AI provider receives only column names and up to 30 sample rows, never the whole file.
• Automatic deletion of files and import history after 30 days.
• No access logs with IP addresses.

Procedures

• Security updates are installed regularly; dependencies are pinned to exact versions.
• These measures are reviewed at least once a year.

Annex 2 – Subprocessors