Data Processing Agreement for Post Purchase Upsell Hero

Last updated: 14 October 2026

1. Parties, scope and roles

1.1 This Data Processing Agreement ("DPA") is entered into between HeroSoftware GmbH, Walramstraße 23, 65510 Idstein, Germany ("HeroSoftware", "Processor") and the merchant using the Shopify app Post Purchase Upsell Hero ("Merchant", "Controller").

1.2 This DPA forms part of the Terms of Service for Post Purchase Upsell Hero ("Terms"). It is concluded electronically when the Merchant installs the app and accepts the Terms. HeroSoftware keeps a record of the installation as evidence of the conclusion.

1.3 This DPA applies to all personal data that HeroSoftware processes on behalf of the Merchant when providing the app ("Merchant Personal Data"). It does not apply to data that HeroSoftware processes as an independent controller, in particular account, contract, billing and support data relating to the Merchant and its staff. That processing is described in the Privacy Policy.

1.4 In case of conflict between this DPA and the Terms regarding the processing of personal data, this DPA prevails. Annexes 4 to 7 prevail over this DPA for the respective jurisdiction.

2. Subject matter, nature, purpose and duration

2.1 The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

2.2 The duration of the processing corresponds to the term of the Terms. Section 9 applies after termination.

3. Instructions

3.1 HeroSoftware processes Merchant Personal Data only on documented instructions of the Merchant, including with regard to transfers to a third country, unless required to do so by Union or Member State law to which HeroSoftware is subject. In that case HeroSoftware informs the Merchant of the legal requirement before processing, unless the law prohibits this.

3.2 The Terms, this DPA and the Merchant's configuration of the app constitute the Merchant's complete documented instructions at the time of conclusion. Further instructions must be given in text form (e.g. e-mail to post@hero.software) and must be consistent with the Terms.

3.3 When the Merchant connects its own third-party accounts to the app (for example its own e-mail, advertising or analytics accounts), the Merchant instructs HeroSoftware to transmit Merchant Personal Data to those accounts to the extent required for the integration. These providers are engaged by the Merchant, not by HeroSoftware, and are not sub-processors of HeroSoftware.

3.4 HeroSoftware informs the Merchant without undue delay if, in its opinion, an instruction infringes applicable data protection law. HeroSoftware may suspend the execution of such an instruction until the Merchant confirms or changes it, and may refuse instructions that are obviously unlawful.

3.5 The Merchant does not use the app to process special categories of personal data (Art. 9 GDPR) and ensures that its buyers' data transmitted to the app is limited to what the app requires.

3.6 If authorities, courts or other third parties request access to Merchant Personal Data, or if Merchant Personal Data is endangered by seizure, attachment or insolvency proceedings, HeroSoftware informs the Merchant without undue delay, unless prohibited by law. HeroSoftware discloses Merchant Personal Data only to the extent legally required, informs the requesting party that the data is under the Merchant's control and challenges requests it considers unlawful. HeroSoftware also informs the Merchant of inspections by a supervisory authority that concern the processing under this DPA.

4. Obligations of HeroSoftware

HeroSoftware shall:

a) ensure that all persons authorised to process Merchant Personal Data are bound by confidentiality, also after the end of their engagement;

b) implement and maintain the technical and organisational measures described in Annex 2. HeroSoftware may adapt these measures to technical progress, provided the overall level of protection is not reduced;

c) engage sub-processors only in accordance with Section 6;

d) assist the Merchant, taking into account the nature of the processing, in responding to requests from data subjects (Section 8);

e) assist the Merchant in complying with its obligations regarding security of processing, notification of personal data breaches, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to HeroSoftware;

f) delete or return Merchant Personal Data in accordance with Section 9;

g) make available to the Merchant the information necessary to demonstrate compliance with this DPA and allow for audits in accordance with Section 10.

5. Security

HeroSoftware protects Merchant Personal Data by the technical and organisational measures described in Annex 2. The Merchant has reviewed these measures and considers them appropriate for the risks of the processing.

6. Sub-processors

6.1 The Merchant grants HeroSoftware a general authorisation to engage sub-processors. The sub-processors engaged at the time of conclusion are listed in Annex 3 and are deemed approved. Annex 3 is always kept up to date in the version of this DPA published on the app website.

6.2 HeroSoftware informs the Merchant by e-mail to the Merchant's store e-mail address at least 30 days before adding or replacing a sub-processor. The Merchant may object in text form within this period on reasonable data protection grounds. If HeroSoftware cannot offer a reasonable alternative, the Merchant may terminate the Terms with effect from the date on which the new sub-processor would start processing.

6.3 In urgent cases, in particular to maintain security or availability, HeroSoftware may engage a new sub-processor with shorter notice. The Merchant's right to object and terminate under Section 6.2 remains unaffected.

6.4 Services that HeroSoftware uses as ancillary services without access to Merchant Personal Data (e.g. telecommunications, postal services, office services) are not sub-processors. Maintenance and support services with possible access to Merchant Personal Data are sub-processors.

6.5 HeroSoftware imposes data protection obligations on each sub-processor that provide at least the same level of protection as this DPA. HeroSoftware remains liable to the Merchant for the performance of its sub-processors' obligations.

7. Personal data breaches

7.1 HeroSoftware notifies the Merchant without undue delay, and in any case within 24 hours, after becoming aware of a personal data breach affecting Merchant Personal Data. This also applies to breaches at sub-processors.

7.2 The notification is sent to the Merchant's store e-mail address and contains, as far as known at that time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact person. Information not yet available is provided without undue delay as soon as it becomes available.

7.3 Notifying the competent supervisory authority and data subjects is the responsibility of the Merchant. HeroSoftware supports the Merchant in doing so.

8. Data subject requests

8.1 If a data subject contacts HeroSoftware directly regarding Merchant Personal Data, HeroSoftware forwards the request to the Merchant without undue delay and does not respond itself unless instructed by the Merchant or required by law.

8.2 HeroSoftware processes the mandatory Shopify privacy webhooks (customers/data_request, customers/redact, shop/redact) within the periods specified by Shopify.

9. Deletion and return

9.1 When the Merchant uninstalls the app or the Terms end, HeroSoftware blocks Merchant Personal Data and keeps it for 30 days solely so that the Merchant can request an export. HeroSoftware then deletes the data from its active systems, at the latest 30 days after uninstallation or termination, and within the periods required by Shopify for its privacy webhooks. If the Merchant has requested an export within the 30 days, HeroSoftware provides it even if delivery takes place after the end of this period and deletes the data once the export has been provided. Residual copies in backups expire no later than 7 days after deletion. If data is restored from a backup, deletions are re-applied before the data is used.

9.2 During the term and within 30 days after uninstallation or termination (Section 9.1), the Merchant may request the return (export) or deletion of its Merchant Personal Data by e-mail to post@hero.software. If no export is requested within this period, the data is deleted in accordance with Section 9.1.

9.3 Section 9.1 does not apply where Union or Member State law requires HeroSoftware to retain data. In that case HeroSoftware restricts processing to the purpose of the retention obligation.

9.4 Upon request, HeroSoftware confirms the deletion in text form.

9.5 HeroSoftware has no right of retention with regard to Merchant Personal Data.

10. Audits

10.1 HeroSoftware demonstrates compliance with this DPA primarily by providing up-to-date documentation, in particular a description of its technical and organisational measures, and by answering reasonable written questions.

10.2 If this is not sufficient, the Merchant or an independent auditor bound by confidentiality who is not a competitor of HeroSoftware may carry out an on-site audit once per calendar year, with at least 30 days' notice, during normal business hours and without disproportionate disruption of HeroSoftware's operations. In case of a personal data breach or concrete indications of non-compliance, shorter notice is possible. Each party bears its own costs.

11. Anonymised and aggregated data

11.1 HeroSoftware may create anonymised and aggregated statistics from the processing (for example usage, error or success rates across all merchants) and use them to operate, secure and improve its services. Anonymised data no longer relates to an identifiable person and is not subject to this DPA.

12. Place of processing and international transfers

12.1 The app is hosted in Frankfurt am Main, Germany. Some sub-processors listed in Annex 3 are located outside the European Economic Area or may access data from there.

12.2 EU/EEA: Transfers of Merchant Personal Data to a sub-processor in a third country take place only if the requirements of Chapter V GDPR are met, in particular on the basis of an adequacy decision (including the EU-U.S. Data Privacy Framework) or the Standard Contractual Clauses of the European Commission.

12.3 If the Merchant is established in a third country that is not covered by an adequacy decision of the European Commission, the Standard Contractual Clauses in Annex 4 apply to the transfer of Merchant Personal Data from HeroSoftware to the Merchant.

12.4 UK and Switzerland: Annexes 5 and 6 apply in addition.

12.5 USA: If the Merchant is subject to US state privacy laws, Annex 7 applies in addition.

13. Liability

The liability of the parties under this DPA is governed by the limitation of liability in the Terms. Mandatory liability towards data subjects under applicable data protection law, in particular Art. 82 GDPR, remains unaffected.

14. Term, changes and final provisions

14.1 This DPA applies for as long as HeroSoftware processes Merchant Personal Data.

14.2 Changes to this DPA follow the amendment procedure of the Terms. Changes to the list of sub-processors follow Section 6.

14.3 This DPA is governed by the laws of the Federal Republic of Germany. The place of jurisdiction is Wiesbaden, Germany, provided the Merchant is a merchant (Kaufmann), a legal entity under public law or has no general place of jurisdiction in Germany. Annexes 4 to 7 may provide otherwise for their scope.

14.4 Should any provision of this DPA be invalid, the remaining provisions remain unaffected. The invalid provision is replaced by the corresponding requirement of Art. 28 GDPR.

Annex 1: Processing details

Nature and purpose. Displaying upsell and downsell offers to buyers after checkout on behalf of the Merchant; selecting offers based on the order, customer segment, cart value or region; personalising offers; processing accepted offers as additions to the order; analytics, A/B tests and reporting for the Merchant; determining upsell revenue for billing on the basis of order values and order references (no further buyer data is used for this purpose).

Processing steps. After checkout, the App's Shopify post-purchase extension receives the order data from Shopify and requests a suitable offer from HeroSoftware's servers using a Shopify session token. HeroSoftware selects the offer based on the Merchant's funnels and settings and returns it for display. If the buyer accepts, the offer is added to the order via Shopify. Shopify webhooks inform the App about orders. Interactions with offers are recorded for the Merchant's analytics. The App does not track buyers outside the post-purchase page. If the Merchant connects its own advertising or analytics accounts, the App transmits events about accepted offers to them via a Shopify web pixel, only if the buyer has given the consent required in the Merchant's store (Section 3.3, Annex 3).

Types of personal data.

• Order references and timestamps, numeric Shopify customer ID, checkout token
• Order contents and order value, purchased and offered products
• Shipping region (country, region, city, postal code; no street or house number)
• Customer segment, number of previous orders and language, read from Shopify at runtime, not stored
• Buyer first name, only at runtime for personalising the offer, not stored
• Interactions with offers on the post-purchase page (impressions, clicks, purchases, declines) with session identifier, device and browser information, and cart snapshots
• Campaign attribution data (UTM parameters) as provided by Shopify with the order, stored for 24 hours
• Technical connection data of the buyer's browser (IP address, browser information), stored in application logs for no longer than 30 days

Name and e-mail address of the buyer may be contained in data transmitted by Shopify; the App does not store them, and application logs and cart snapshots contain identifiers only. The App does not process payment data. Payments for accepted offers are processed by Shopify.

Categories of data subjects. Buyers of the Merchant's store.

Special categories of data. None (Section 3.5).

Retention during use. Funnels, settings and analytics data are stored for as long as the Merchant uses the app, so that the Merchant can access its reports. UTM data is deleted after 24 hours, application logs after 30 days at the latest. After uninstallation, Section 9 applies.

Annex 2: Technical and organisational measures (TOMs)

This annex describes the measures HeroSoftware has implemented. A more detailed description is available to merchants on request.

Confidentiality and access control

• Access to systems and data is limited to HeroSoftware's own employees in Germany. No freelancers have access.
• All employees are bound in writing to confidentiality and data protection.
• Personal accounts for all systems. Multi-factor authentication is mandatory for all employees in all applications used.
• Permissions are granted on a need-to-know basis, reviewed quarterly and revoked immediately when an employee leaves.
• Only company-owned computers with full-disk encryption and automatic screen lock are used.
• Merchants access the app only via Shopify Admin (OAuth 2.0 and session tokens). Shopify webhooks are verified by HMAC.

Separation

• Every data record is assigned to a shop. Access to app data is determined by the authenticated shop session.
• Production, test and development environments are separated, with separate apps, databases and credentials.

Encryption

• Data in transit is encrypted with TLS.
• Stored app data, logs and backups are encrypted.

Integrity and secure development

• Changes to production code require a pull request, review by a second person and passing automated tests.
• Dependencies, code and secrets are scanned regularly. Vulnerabilities are fixed within defined deadlines according to their severity.
• Production secrets are stored separately from the source code. AI-based development tools have no access to production secrets or production data.
• Sensitive fields (passwords, tokens, keys) are redacted before they are written to application logs.
• Buyer data must not be entered into internal communication, ticketing or documentation tools. Cases are referred to by order number and shop domain only.

Availability and resilience

• Hosting with DigitalOcean in Frankfurt, Germany, with multiple app instances.
• Daily database backups, stored in Frankfurt and retained for 7 days.
• Monitoring with automatic alerts. Recovery procedures are documented and tested.

Incident response

• A documented incident procedure covers reporting, containment, evidence preservation, assessment, notification of merchants, recovery and follow-up.
• Merchants are notified of personal data breaches within 24 hours (Section 7).

Organisation and review

• Employees complete security awareness training when joining and regularly thereafter (last company-wide training: October 2026).
• Contact for data protection: post@hero.software. A data protection officer is not required to be appointed.
• These measures are reviewed quarterly and after material changes.

Annex 3: Sub-processors

Sub-processors with access to Merchant Personal Data

Integrations enabled by the Merchant

The following services receive data only if the Merchant connects its own account. They act on behalf of the Merchant or as independent controllers and are not sub-processors of HeroSoftware (Section 3.3).

• Meta (Meta Pixel / Conversions API of the Merchant): events about accepted offers (event and order reference, order value, products, identifiers provided by Shopify's web pixel), only with the buyer's consent
• Google Ads / Google Analytics of the Merchant: as above, only with the buyer's consent
• TikTok Pixel of the Merchant: as above, only with the buyer's consent

Other service providers without access to Merchant Personal Data

HeroSoftware also uses service providers for internal communication, software development, testing, translation and project management (for example Google Workspace, Slack, Notion, Linear, GitHub, Cursor, DeepL). Under HeroSoftware's internal rules, Merchant Personal Data must not be entered into these tools (Annex 2). They are therefore not sub-processors.

Annex 4: Standard Contractual Clauses for merchants outside the EEA

4.1 If the Merchant is established in a country outside the European Economic Area that is not covered by an adequacy decision of the European Commission, or in the USA without certification under the EU-U.S. Data Privacy Framework, the Standard Contractual Clauses of the European Commission (Implementing Decision (EU) 2021/914), Module Four (transfer processor to controller), are incorporated into this DPA by reference.

4.2 HeroSoftware is the data exporter, the Merchant is the data importer. The details required in Annex I of the Clauses follow from Annex 1 of this DPA.

4.3 Clause 7 (docking clause) does not apply. For Clause 17, the parties choose the law of Germany. For Clause 18, the parties choose the courts of Wiesbaden, Germany.

Annex 5: United Kingdom

5.1 Where the UK GDPR applies to the processing, references in this DPA to the GDPR are to be read as references to the UK GDPR and the UK Data Protection Act 2018, and references to the supervisory authority as references to the Information Commissioner's Office (ICO).

5.2 Transfers of personal data from the United Kingdom to HeroSoftware in Germany are covered by the UK adequacy regulations for the European Economic Area. For onward transfers to sub-processors outside the UK and the EEA, HeroSoftware relies on the UK Extension to the EU-U.S. Data Privacy Framework or on the Standard Contractual Clauses together with the UK International Data Transfer Addendum.

Annex 6: Switzerland

6.1 Where the Swiss Federal Act on Data Protection (FADP) applies to the processing, references in this DPA to the GDPR are to be read as references to the FADP, and references to the supervisory authority as references to the Federal Data Protection and Information Commissioner (FDPIC).

6.2 Transfers of personal data from Switzerland to HeroSoftware in Germany are covered by the Swiss Federal Council's recognition of Germany as providing adequate protection. For onward transfers, HeroSoftware relies on the Swiss-U.S. Data Privacy Framework or on the Standard Contractual Clauses as adapted for Swiss law.

Annex 7: US state privacy laws

7.1 Where the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA) or a comparable US state privacy law applies, HeroSoftware acts as a "service provider" or "processor" of the Merchant with respect to Merchant Personal Data.

7.2 HeroSoftware shall not:

a) sell or share Merchant Personal Data;

b) retain, use or disclose Merchant Personal Data for any purpose other than providing the app as set out in the Terms and this DPA, or as otherwise permitted for service providers under the CCPA;

c) retain, use or disclose Merchant Personal Data outside the direct business relationship with the Merchant; this does not apply to transmissions to independent controllers or Merchant integrations listed in Annex 3, which take place on the Merchant's instruction;

d) combine Merchant Personal Data with personal data received from other sources, except as permitted for service providers under the CCPA.

7.3 HeroSoftware complies with the obligations applicable to it under the CCPA and provides the same level of privacy protection as required by the CCPA. HeroSoftware notifies the Merchant if it determines that it can no longer meet these obligations. The Merchant may then take reasonable and appropriate steps to stop and remediate unauthorised use of Merchant Personal Data.

7.4 HeroSoftware certifies that it understands and will comply with the restrictions in this Annex.

Annex 8: Privacy policy text for merchants

The Merchant is responsible for informing its buyers about the processing. The following text may be added to the Merchant's privacy policy.

Base text

Offers after your purchase with Post Purchase Upsell Hero. After you complete your order, we may show you additional offers that match your order, using the Post Purchase Upsell Hero app provided by HeroSoftware GmbH, Walramstraße 23, 65510 Idstein, Germany. To select and display a suitable offer, the app processes your order (products, order value, order reference), your shipping region (country, city, postal code), your customer segment and number of previous orders, and your first name to address you personally. It also records whether you view, accept or decline an offer. The app also processes technical data of your browser and device (session identifier, device and browser information, IP address in server logs for up to 30 days) and, if available, the campaign through which you reached our store (stored for 24 hours). If you have consented to marketing cookies in our store, information about accepted offers is also transmitted to our advertising partners [list only the partners you have connected, e.g. Meta, Google, TikTok] to measure the success of our advertising. If you accept an offer, it is added to your order and paid through our store's checkout. HeroSoftware processes this data on our behalf.

Addition for the EU/EEA and the UK

The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in offering you suitable additional products), for accepted offers Art. 6(1)(b) GDPR (performance of the contract) and, for the transmission to advertising partners, your consent (Art. 6(1)(a) GDPR; in Germany § 25(1) TDDDG), which you can withdraw at any time in our cookie settings.

Addition for the USA

Post Purchase Upsell Hero acts as our service provider. If you have consented, information about accepted offers is disclosed to our advertising partners, which may qualify as "sharing" under California law. You can opt out at any time via the cookie settings in our store.