Data Processing Agreement

KID og EHF · Last updated 14 October 2026

This Data Processing Agreement (“DPA”) forms part of the agreement between the merchant that installs and uses the Shopify app KID og EHF (“Controller”) and the service provider below (“Processor”). It applies automatically when the Controller installs or uses the app, and fulfils the requirements of article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

Processor

1. Subject matter and duration

The Processor processes personal data on behalf of the Controller to provide the app’s features: generating KID payment references, creating and storing invoices (PDF and EHF/Peppol), and, when enabled by the Controller, delivering invoices through a Peppol access point. The DPA lasts as long as the Processor processes personal data for the Controller.

2. Instructions

The Processor processes personal data only on the Controller’s documented instructions. The Controller’s use and configuration of the app constitute those instructions. The Processor informs the Controller if it considers an instruction to infringe data protection law. The Processor does not use the personal data for its own purposes.

3. Confidentiality

Everyone authorised by the Processor to process the personal data is bound by confidentiality. At present, only the Processor personally has access to production data.

4. Security (GDPR art. 32)

The Processor implements the technical and organisational measures in Annex 2.

5. Sub-processors

The Controller gives general authorisation to use the sub-processors in Annex 3. The Processor imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible for them. The Processor notifies the Controller at least 14 days before adding or replacing a sub-processor; the Controller may object on reasonable data protection grounds and, if no solution is found, terminate use of the app.

6. International transfers

Personal data is stored in the EU/EEA. Any transfer outside the EU/EEA is made under the EU Standard Contractual Clauses or another transfer mechanism under chapter V of the GDPR.

7. Assistance

Taking into account the nature of the processing, the Processor assists the Controller in responding to data subject requests (access, rectification, erasure, restriction, portability, objection), and with security, breach notification, data protection impact assessments and prior consultations. Requests Shopify forwards through its mandatory privacy webhooks are handled automatically as described in the Privacy Policy.

8. Personal data breaches

The Processor notifies the Controller without undue delay, and no later than 48 hours after becoming aware of a personal data breach, with the information the Controller needs to meet its own obligations, following the Processor’s Security Incident Policy.

9. Deletion and return

When the Controller uninstalls the app, all personal data for the shop is deleted after Shopify’s shop erasure request (48 hours after uninstallation). Before uninstalling, the Controller can download its invoices as PDF and EHF from the app. During use, invoices are deleted at the end of the fifth year after the year of issue.

10. Audits

The Processor makes available all information necessary to demonstrate compliance with article 28 and allows for and contributes to audits, including inspections, by the Controller or an auditor mandated by it, on reasonable notice and at the Controller’s cost.

Annex 1 – Details of processing

Annex 2 – Technical and organisational measures

• Encryption in transit: HTTPS for all app traffic; TLS required for the database connection.
• Encryption at rest: provided by the hosting provider at the storage level.
• Access control: production access limited to the Processor; credentials stored as encrypted service variables; Shopify OAuth with the minimum required access scopes.
• Data minimisation: only data needed for KID and invoicing is stored; no payment card data.
• Erasure: automated handling of Shopify’s customer and shop erasure requests; automatic deletion after the retention period.
• Accountability: privacy requests are logged without names or email addresses.
• Access logging: every view, creation, download and transmission of invoices is logged with Shopify staff ID, action, invoice number and time; the Controller can review the log in the app; entries are kept for 365 days.
• Incident handling: a documented Security Incident Policy with an incident register.

Annex 3 – Sub-processors

When the Controller uses one-click «Koble til Peppol», the Processor creates a send-only company account for the Controller with e-invoice.be under the Processor’s reseller agreement, and e-invoice.be acts as a sub-processor. Alternatively, EHF delivery can use the Controller’s own Peppol access point account (currently e-invoice.be, Belgium). The Controller contracts with that provider directly, so it is the Controller’s processor and not a sub-processor of the Processor. The Processor only transmits each invoice the Controller chooses to send, using the API key the Controller provides, which is stored encrypted.