InvoNorm Data Processing Agreement (DPA)

Version 1.2 · Last updated: 31 July 2026 · A German translation is available on request ([email protected]); the English version is authoritative.

Status: this DPA forms part of the Privacy Policy framework and of the agreement concluded when a merchant installs the InvoNorm app via the Shopify App Store. It takes effect for each merchant upon installation of the app (the app has been live on the Shopify App Store since 22 July 2026).

This DPA forms part of the agreement between the Merchant ("Controller") and Fengjing (Shenzhen) Trading Co., Ltd. ("Processor") concluded when the Merchant installs the InvoNorm app via the Shopify App Store, and applies to all processing of personal data under Art. 28 GDPR.

1. Subject matter, duration, nature and purpose

Processing of order-related personal data for the generation, delivery, transmission and statutory archiving of electronic invoices via the InvoNorm application, for the duration of the app installation plus the agreed archive/export grace period.

2. Categories of data and data subjects

Data subjects: the Controller's customers and staff. Data: name, company, billing/shipping address, email, order line items, prices, tax data, payment status (no card data).

3. Obligations of the Processor

The Processor shall: (a) process personal data only on documented instructions of the Controller (the app's functions constitute such instructions), including with regard to transfers to third countries, unless required by EU or Member State law, in which case the Processor informs the Controller of that legal requirement before processing unless the law prohibits it; (b) ensure confidentiality commitments of all persons authorised to process; (c) implement the technical and organisational measures in Annex II; (d) engage subprocessors only per Section 5; (e) assist the Controller, by appropriate technical and organisational measures, with responses to data subject requests and with the Controller's Art. 32–36 obligations; (f) at the Controller's choice, delete or return all personal data after the end of the provision of services, and delete existing copies, unless EU or Member State law requires storage (principally the statutory retention of issued invoice archives); (g) make available information necessary to demonstrate compliance and allow and contribute to audits (remote audits and completed questionnaires accepted as first line, on-site audits with 30 days' notice at the Controller's cost); (h) immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other EU or Member State data protection law.

3a. Obligations of the Controller

The Controller warrants that it has a valid legal basis for the processing, that its documented instructions (including its use of the app's features) comply with applicable data protection law, and that it has provided any notices and obtained any consents required from its own customers. The Controller is responsible for the lawfulness of the personal data it makes available to the Processor.

3b. No use for AI or machine-learning training

The Processor shall not use personal data processed under this DPA — nor merchant data or customer data in any anonymised, aggregated or derived form — to create, develop, train, fine-tune or improve any machine-learning or artificial-intelligence system, model or technology, including large language models, and shall not enable any third party to do so. This obligation is independent of the Controller's instructions: the Controller cannot instruct such use, and the Processor will not seek consent for it. It mirrors, and is at least as protective as, section 9.15 of the Shopify Partner Program Agreement. The Processor confirms that the Service makes no outbound connection to any AI or machine-learning service; its only external connections are to Shopify and to the European Commission's VIES service for VAT identification number checks.

4. Personal data breach

The Processor notifies the Controller without undue delay and at the latest within 48 hours of becoming aware of a personal data breach, including the information required by Art. 33(3) GDPR.

5. Subprocessors

General authorisation is granted for the subprocessors listed in the Privacy Policy. The Processor informs the Controller of intended changes (addition or replacement of a subprocessor) at least 14 days in advance; the Controller may object on reasonable data protection grounds, in which case the Controller's sole remedy is termination.

Where the Processor engages a subprocessor, it does so under a written contract imposing the same data protection obligations as set out in this DPA (Art. 28(4) GDPR), in particular sufficient guarantees to implement appropriate technical and organisational measures. Where a subprocessor fails to fulfil its data protection obligations, the Processor remains fully liable to the Controller for the performance of that subprocessor's obligations.

6. International transfers

Primary processing and storage occur in the EU. Remote support access from China is safeguarded by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller→processor), which are hereby incorporated by reference with: Clause 7 (docking) included; Clause 9(a) Option 2 (general authorisation, 14 days' notice); Clause 11 optional independent-dispute-resolution language not used; Clause 17 Option 1 — governing law of Ireland; Clause 18(b) — courts of Ireland. The SCC Annexes are set out in Annex I (parties, description of the transfer, competent supervisory authority) and Annex II (technical and organisational measures) of this DPA.

Clause 14 transfer impact assessment. The parties have assessed the transfer and consider that the laws and practices of the destination country (China), as applied to this specific transfer, do not prevent the Processor from meeting its obligations under the SCCs, taking into account: (i) the narrow scope — no personal data is stored in China; production access is remote-only, limited to one authorised administrator using key-based SSH, and used only for security, maintenance or merchant-requested support; InvoNorm has no support dashboard that routinely exposes customer personal data; (ii) the nature of the data (commercial invoice data, no special-category data, no card data); and (iii) the supplementary technical, organisational and contractual measures below. The Processor maintains a documented assessment and will notify the Controller and, where required, suspend transfers if it can no longer comply (SCC Clause 14(f), 16). Supplementary measures: EU data residency, infrastructure access logging, strict purpose limitation, encryption at rest and in transit, and a commitment to challenge and to inform the Controller of any legally binding government access request unless legally prohibited (SCC Clause 15).

7. Liability and precedence

Liability follows the agreement between the parties and applicable law. In case of conflict regarding data protection, this DPA prevails; the SCCs prevail over both.

Annex I — Standard Contractual Clauses details

A. List of parties. Data exporter: the Merchant (Controller) identified by the Shopify store and account details provided in the app, together with its EU representative where one is designated; role — controller; activities — operating a Shopify store and issuing invoices to its customers. Data importer: Fengjing (Shenzhen) Trading Co., Ltd., Rm 902, Block B, Haijing Court, Haojing Garden, No. 2 Shazui Rd, Futian District, Shenzhen, China; contact [email protected]; role — processor; activities — generating, delivering, transmitting and archiving electronic invoices via the InvoNorm app.

B. Description of the transfer. Data subjects: the Controller's customers and staff. Categories of personal data: name, company, billing/shipping address, email, order line items, prices, tax data, payment status (no special-category data; no payment card data). Frequency: continuous, for the duration of the app installation. Nature and purpose: support-related remote access to enable invoice generation, delivery, transmission and statutory archiving. Retention: per Section 5 of the Privacy Policy (statutory retention of invoice archives; technical logs ≤ 90 days). Subprocessors: as listed in the Privacy Policy, engaged under Section 5 of this DPA.

C. Competent supervisory authority. The supervisory authority of the Member State in which the Controller (data exporter) is established; where the Controller is not established in the EU, the supervisory authority of the Member State in which the Controller's Art. 27 GDPR representative is located, or in which the affected data subjects are located.

Annex II — Technical and organisational measures (summary)