← Back to Levamio Accessibility Check

Data Processing Agreement (DPA) under Art. 28 GDPR – "Levamio Accessibility Check" (Shopify app)

between

the merchant that has installed the app "Levamio Accessibility Check" (in other languages under a translated name) in its Shopify shop (identified by the shop domain)
– controller, hereinafter the "Controller" –

and

NEXTLEVEL CORPORATE SERVICE PROVIDER - FZCO, Building A1, IFZA Business Park, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates, DIEZ License No. 67837, represented by Tassilo Peter Seitz, email: [email protected], data protection: [email protected]
– processor, hereinafter the "Processor" –

1. Subject matter and duration

1.1 The subject matter is the processing of personal data by the Processor in the course of providing the Shopify app "Levamio Accessibility Check" (the "app") under the Processor's terms of use (https://levamio.com/apps/shopify-barrierefrei/nutzungsbedingungen-en/, the "Main Agreement"). The app automatically checks product images and publicly accessible shop pages for common barriers (WCAG 2.2) and provides tools (alt-text suggestions, EAA self-assessment, draft accessibility statement).

1.2 This agreement applies only to personal data contained in the Controller's shop content or entered by the Controller in the app (the "Controller Data", section 2). For data that the Processor processes as a controller in its own right (in particular shop domain, access tokens, plan and subscription status, technical logs, support requests), the app's privacy policy applies (https://levamio.com/apps/shopify-barrierefrei/datenschutz-en/).

1.3 The term of this agreement corresponds to the term of the Main Agreement, i.e. the duration of the app's installation. Obligations under section 9 (deletion) continue after the end of the agreement.

2. Nature, purpose, types of data, data subjects

2.1 Nature of processing: retrieval via the Shopify API and from publicly accessible shop pages, storage, analysis (automated audit), display, transfer to sub-processors (Schedule 2), writing back to the shop on the Controller's instructions (only alt attributes of product images), deletion.

2.2 Purpose: provision of the app under the Main Agreement, in particular audit runs with score and notes, creation of alt-text suggestions at the Controller's request, creation of a draft accessibility statement from the Controller's details.

2.3 Types of data: The app does not request customer or order permissions (no read_customers, no read_orders, no access to "protected customer data"). Personal data can be contained only in the following content:

• Contact details of the Controller and its staff in shop content: e.g. name, address, email address or phone number on the publicly accessible shop pages checked (home page, one collection page, one product page, cart), to the extent they appear in stored short snippets of affected elements;
• Accessibility statement details: company name, address, contact email and phone, to the extent they relate to a natural person (e.g. a sole trader), as entered by the Controller;
• Personal details in product data: e.g. names in product titles (designers, artists) and identifiable people in product images;
• For alt-text suggestions (only when the Controller clicks): image URL (Shopify CDN), the product image retrieved via that URL and the product title; the generated text suggestion if it describes a person.

Data of the Controller's end customers (customers, orders, carts, payment data) is not subject to the processing. Special categories under Art. 9 GDPR and data under Art. 10 GDPR are not subject to the processing; the Controller does not request alt-text suggestions for images from which such data can be derived.

2.4 Data subjects: the Controller itself (where a natural person), its staff and contact persons; persons depicted in product images or named in product data.

3. Instructions

3.1 The Processor processes the Controller Data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to do so by Union or Member State law to which the Processor is subject (Art. 28(3)(a) GDPR); in that case, the Processor informs the Controller of that legal requirement beforehand, unless that law prohibits such information.

3.2 Instructions are the Main Agreement, this agreement and the Controller's settings and actions in the app (e.g. installation and permissions granted, starting an audit run, entering details for the accessibility statement, requesting, applying or rejecting an alt-text suggestion, uninstallation). The Controller gives further instructions in text form (e.g. email) to [email protected].

3.3 If the Processor considers that an instruction infringes data protection provisions, it informs the Controller without undue delay and may suspend execution until the instruction is confirmed or changed.

4. Obligations of the Controller

4.1 The Controller is responsible for the lawfulness of the processing of the Controller Data, in particular for being entitled to use the personal data entered in the shop and in the app (e.g. contact details in the accessibility statement, people in product images) and for the data subjects having been informed in accordance with Art. 13 and 14 GDPR.

4.2 The Controller informs the Processor without undue delay if it detects errors or irregularities in the processing.

5. Obligations of the Processor

5.1 Confidentiality: The Processor uses only persons who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR). The obligation continues after the end of their activity.

5.2 Security: The Processor takes the technical and organisational measures under Art. 32 GDPR set out in Schedule 1. It may further develop them, provided the level of protection is not reduced.

5.3 Assistance with data subject rights: The Processor assists the Controller with appropriate measures in responding to requests from data subjects (Art. 12–23 GDPR). The Controller can rectify or delete most Controller Data itself in Shopify or in the app. If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without undue delay and does not answer it itself.

5.4 Assistance with Art. 32–36 GDPR: Taking into account the nature of processing and the information available to it, the Processor assists the Controller with security, notification of breaches, data protection impact assessment and prior consultation.

5.5 Personal data breaches: The Processor notifies the Controller of a breach of the security of the Controller Data that has come to its knowledge without undue delay, where possible within 24 hours, to the shop's contact email address stored in the Shopify account and, where possible, by a notice in the app. The notification contains, where available, the information under Art. 33(3) GDPR; missing information is provided in phases. Independently of this, the Processor also reports breaches affecting merchant data to Shopify in accordance with Shopify's terms for app developers.

5.6 Evidence: The Processor makes available to the Controller all information necessary to demonstrate that the obligations under Art. 28 GDPR are met (section 8).

5.7 Records: The Processor maintains a record of processing activities under Art. 30(2) GDPR.

5.8 The Processor does not use the Controller Data for its own purposes, in particular not for training AI models, not for advertising and not for sale.

6. Sub-processors

6.1 The Controller authorises the use of the sub-processors listed in Schedule 2 (general written authorisation, Art. 28(2) GDPR).

6.2 The Processor informs the Controller at least 30 days before engaging or replacing a sub-processor by a notice in the app or by email to the shop's contact address. The Controller may object within 14 days for an important reason relating to data protection. If no agreement is reached, the Controller may uninstall the app with effect from the date of the change; periods already paid are credited pro rata in accordance with Shopify's rules (Main Agreement section 9.1).

6.3 The Processor contractually imposes on each sub-processor data protection obligations that substantially correspond to this agreement (Art. 28(4) GDPR). It is liable to the Controller for the sub-processor meeting those obligations.

6.4 Ancillary services such as telecommunications do not constitute sub-processing. Shopify is not a sub-processor of the Processor: Shopify is the Controller's contractual partner and processes shop data under its own terms and Shopify's Data Processing Addendum; the Processor accesses that data only with the permissions granted by the Controller.

7. Transfers to third countries

7.1 The Processor is established in the United Arab Emirates; there is no adequacy decision of the European Commission for the UAE. The Controller Data is stored with sub-processors, the database in the EU region Frankfurt (Schedule 2); administrative access by the Processor takes place from the UAE.

7.2 For transfers to the Processor to which Chapter V GDPR applies, the parties agree, upon conclusion of this agreement, on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), Module 2 (controller to processor), which are incorporated into this agreement by this reference; the Controller is the data exporter, the Processor the data importer. The following applies: Clause 7 (docking clause) does not apply; Clause 9 Option 2 (general authorisation, notice period under section 6.2); the option in Clause 11 does not apply; Clause 13: the competent supervisory authority is the one competent for the Controller; Clause 17 Option 1: law of the Federal Republic of Germany; Clause 18: courts of the Federal Republic of Germany. Annex I follows from the installation (parties) and section 2 (description of the transfer), Annex II from Schedule 1, Annex III from Schedule 2. The Controller receives a copy of the clauses on request. The clauses take precedence in accordance with section 11.2.

7.3 Transfers to sub-processors in third countries take place only if the requirements of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision (e.g. EU-US Data Privacy Framework for certified recipients) or the Standard Contractual Clauses (Module 3, processor to sub-processor).

8. Audit rights

8.1 The Processor demonstrates that it meets its obligations primarily through self-assessments, the current version of Schedule 1 and certificates and audit reports of its sub-processors (e.g. ISO 27001, SOC 2).

8.2 In addition, after timely notice (at least 30 days) and no more than once per calendar year, except where there is a specific reason, the Controller may request an audit by itself or by an auditor bound to confidentiality, which is carried out primarily as a document-based or remote audit. The Processor may request reasonable reimbursement of its costs for audits going beyond section 8.1; this does not apply if the audit reveals a material breach of this agreement by the Processor. Audits by supervisory authorities remain unaffected.

9. Deletion

9.1 If the Controller uninstalls the app, the Processor immediately deletes the access tokens and cancels running audit runs. It deletes all Controller Data including copies after receipt of the Shopify webhook shop/redact (usually 48 hours after uninstallation); if the webhook does not arrive, usually 7 days after uninstallation, but at the latest 30 days after uninstallation or after receipt of an enforceable deletion request from the Controller or from Shopify, unless Union or Member State law requires storage (Art. 28(3)(g) GDPR). Return of data is not required because the shop content remains with the Controller in Shopify.

9.2 During the term, a daily deletion job deletes Controller Data in accordance with the periods in the app's privacy policy (section 9), including audit runs after 24 months, alt-text suggestions 90 days after being applied or rejected, completed jobs with error messages after 30 days, expired online sessions 1 day after expiry. Database backups at the sub-processor are deleted as part of regular rotation.

9.3 Alt attributes that the app has written to the shop on the Controller's instructions are the Controller's data in Shopify; they remain there until the Controller or Shopify removes them.

9.4 The Processor confirms deletion in text form on request.

10. Liability

Liability towards data subjects is governed by Art. 82 GDPR. As between the parties, the liability provisions of the Main Agreement apply, unless Art. 82 GDPR mandatorily provides otherwise.

11. Final provisions

11.1 This agreement is concluded upon installation of the app; the Main Agreement refers to it. Amendments and additions require text form; section 10 of the Main Agreement applies accordingly to amendments.

11.2 In the event of conflicts, this agreement takes precedence over the Main Agreement insofar as the protection of personal data is concerned; the Standard Contractual Clauses (section 7.2) take precedence over this agreement and the Main Agreement.

11.3 If individual provisions are invalid, the remainder of the agreement remains valid.

11.4 By way of derogation from section 11.1 of the Main Agreement, this agreement is governed by the law of the Federal Republic of Germany (Art. 28(3) GDPR: contract under Member State law). The place of jurisdiction is determined by the Main Agreement, unless the Standard Contractual Clauses (section 7.2) or the GDPR mandatorily provide otherwise.

---

Schedule 1 – Technical and organisational measures (Art. 32 GDPR), summary

Confidentiality

• Physical access control: no own data centres; physical security at Cloudflare and Supabase (or their hosting provider AWS) in certified data centres (ISO 27001/SOC 2 according to the provider).
• System access control: admin access to Cloudflare, Supabase, Shopify Dev Dashboard and Anthropic only with a strong password and two-factor authentication; personal accounts, no shared logins.
• Data access control (application): access only from the Shopify admin via Shopify session tokens; HMAC signature verification of all Shopify webhooks including the privacy webhooks; scheduled runs as Worker cron triggers, manual calls only with a secret key; demo mode with test data disabled in production.
• Database: Supabase Postgres in the EU region Frankfurt (eu-central-1); app access only via Cloudflare Hyperdrive; row level security enabled on all tables so that Supabase's public data API returns no data (checked by an automated test for new tables).
• Separation control (multi-tenancy): all business records are assigned to the shop domain; queries filter by the shop from the verified Shopify session or the signed webhook, never by a value from the request. The server itself loads images for alt-text suggestions via the Shopify API and checks that they belong to the shop.
• Encryption: TLS for all connections; storefront password stored encrypted with AES-256-GCM (key only as a runtime secret); secrets never in source code.
• Minimisation: minimal Shopify permissions (read_products, optional write_files and write_products only when needed), no customer, order or theme scopes; fetched storefront content is not stored in full, only the audit result with short snippets; storefront fetches only to the shop domains (stylesheets additionally cdn.shopify.com) with SSRF protection; only image URL, product title and language sent to the AI provider, only on click.

Integrity

• Input control: audit runs with time and trigger; alt-text suggestions with status (pending, applied, rejected); applied in Shopify only after approval by the Controller.
• Transfer control: write access only – with the optional permissions and after approval – to the alt attribute of product images; the app does not change theme code, titles, prices or texts.

Availability and resilience

• Operation on Cloudflare Workers (distributed network, Smart Placement close to the database); database at Supabase with the provider's backups; additional dump before migrations.
• Rollback to an earlier Worker version possible without a rebuild; cron runs can be disabled individually.
• Audit runs in chunks with a lock against duplicate processing; Workers logs for error analysis.

Procedures for regular review

• Automated tests (Vitest) for audit logic, webhooks, deletion job and row level security on every change; type checking.
• Dependencies with pinned versions; regular updates.
• Review of this schedule at least annually.
• Deletion: immediate deletion of tokens on app/uninstalled; complete deletion of all shop data on shop/redact; daily deletion job (02:45 UTC) with the periods of the privacy policy and a safety net that completely deletes uninstalled shops after 7 days if shop/redact does not arrive.
• Incident response plan for data breaches with reporting channels to the Controller and Shopify (internal).

Schedule 2 – Sub-processors (as of 20 Oct 2026)

Not a sub-processor: Shopify (contractual partner of the Controller, section 6.4; billing of the app plans via Shopify).

As of: 21 October 2026