Terms of Service

The date above identifies the last revision of this document, not its publication or contractual effective date. This revised version has not yet been published. Publication following completion of review is planned for 2 October 2026; this is not an actual publication date and does not trigger automatic publication. If publication occurs later, the actual date applies; there is no backdating. Effective incorporation and changes to existing contracts are governed by Section 12.

1. Provider and Scope

These Terms of Service (“Terms”) govern the use of the Shopify application Post-Purchase Upsell Hero (the “App”), provided by:

HeroSoftware GmbH
Walramstraße 23, 65510 Idstein, Germany
Represented by the managing director: Calvin Blick
Commercial register: Amtsgericht Wiesbaden, HRB 34094
VAT ID: DE360788620
E-mail: post@hero.software

As a new customer (“Merchant”, “you”), you agree to these Terms on installing or using the App only where this version is effectively incorporated into your contract following its actual publication. If you do not agree, do not install or use the App. For existing customers, the transition rule in Section 12 applies; installation or mere use does not replace either the express consent required there or the separate conclusion of an SLA.

The App is intended exclusively for business customers (B2B). By installing the App, you confirm that you are acting in the course of your commercial or independent professional activity within the meaning of § 14 BGB (German Civil Code).

2. Description of the Service

Post-Purchase Upsell Hero enables merchants to display one-click upsell and downsell offers to customers after checkout on Shopify stores. Features include unlimited funnels and offers, AI-based product recommendations, analytics and A/B testing, translations for markets, and mobile-optimized offer pages.

We continuously develop the App. Individual features may be added, modified, or removed, provided this does not materially reduce the core functionality of the App for the Merchant.

3. Pricing and Payment

The App is offered under the following plan:

“Upsell revenue” means the gross revenue of orders or order items generated through offers displayed by the App, as measured by the App.

All fees are billed through the Shopify billing system in accordance with Shopify's billing cycles and terms. Prices are stated in USD and, where applicable, exclusive of VAT. We reserve the right to change prices with at least 30 days' prior notice; changes take effect at the start of the next billing cycle. If you do not agree to a price change, you may cancel before it takes effect.

4. Term and Cancellation

The contract runs for an indefinite period. You may cancel at any time by uninstalling the App from your Shopify store or by cancelling your plan through Shopify. Cancellation takes effect in accordance with Shopify's billing terms; fees already incurred (including usage fees on upsell revenue already generated) remain payable. There are no refunds for partial billing periods unless required by law.

We may terminate the contract with 30 days' notice, or without notice for good cause, in particular in the event of a material breach of these Terms, abusive use of the App, or non-payment.

5. Merchant Obligations

You are responsible for:

• the lawful operation of your Shopify store, including compliance with consumer protection, e-commerce, and advertising laws applicable to your store and the offers displayed through the App;
• the accuracy of product data, prices, and offer content configured in the App;
• maintaining the confidentiality of your Shopify account credentials;
• not using the App to display unlawful, misleading, or infringing content.

You may not reverse engineer, decompile, resell, sublicense, or misuse the App, or use it in a way that impairs its operation or security. You may not use the App to send unsolicited communications (spam) or in connection with products or services that are unlawful or violate Shopify's Acceptable Use Policy.

Use of the App is prohibited for Merchants located in, or conducting activities in, countries subject to EU, US, or UN embargoes or sanctions.

No legal advice. Templates, default settings, recommendations, AI-generated product suggestions, example funnels, documentation, and support provided in connection with the App are for informational purposes only and do not constitute legal, tax, or compliance advice. You are solely responsible for ensuring that your use and configuration of the App — including offer design, pricing display, and post-purchase flows — complies with the laws applicable to your store (in particular consumer protection, withdrawal rights, price indication, and tax rules). We do not monitor your store, jurisdictions, or configurations for legal compliance and have no obligation to notify you of changes in laws or platform rules affecting your business.

6. Data Protection and Security

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable German data protection law.

• Hosting: The production application, database and application-log infrastructure are hosted with DigitalOcean in Frankfurt, Germany. Other services used in connection with the App may process data outside Germany or the European Economic Area. Where personal data is transferred internationally, the requirements and safeguards described in Annex 1 apply.
• Encryption: According to management, application data is encrypted in transit and at rest, including the database, application logs and backups. Full-disk encryption of all company computers used by all employees is a separate measure planned for completion by 5 October 2026, inclusive; completion is not confirmed as of 1 October 2026.
• Processing on behalf: Where we process personal data of your store's customers on your behalf, we act as a data processor. This is governed by our Data Processing Agreement (DPA) pursuant to Art. 28 GDPR, which forms part of these Terms (Annex 1; technical and organisational measures in Annex 2).
• Our own processing: For account, billing, usage, and support data relating to you as our customer, we act as an independent data controller. Details are set out in our Privacy Policy.

Details on the categories of data processed, purposes, retention periods, and data subject rights are set out in our Privacy Policy.

General service, data-protection and security obligations, including the obligations under the DPA and the technical and organisational measures, apply independently of whether a separate SLA has been agreed. An SLA is not a prerequisite for those obligations and does not suspend them.

7. Availability

We aim for high availability of the App. Subject to expressly agreed specific availability commitments, we do not guarantee uninterrupted operation. Maintenance windows, updates, and disruptions caused by Shopify, hosting providers, or other third parties may temporarily limit availability. Where reasonably possible, planned maintenance will be announced in advance.

Specific availability commitments and service levels apply only where HeroSoftware and the respective customer expressly agree them in a separate service level agreement (“SLA”). The commitment to at least 99.9% monthly availability applies exclusively to customers with such a separate agreement and only to the services agreed in it. The agreement must identify the customer, the affected shops or services, the version and the commencement. Website publication, installation and mere use of the App do not conclude an SLA.

Separately agreed stricter SLA commitments take precedence over conflicting, less stringent general terms for the affected services. Any expressly agreed SLA remains unaffected by the general availability provisions of these Terms; in particular, the statement that uninterrupted operation is not guaranteed must not undermine the SLA. Mandatory law, the precedence of individual contractual agreements and the DPA's existing precedence for processing personal data remain unaffected.

For new separate SLA agreements, the earliest commencement is 15 October 2026 at 00:00 (Europe/Berlin). Where both parties expressly conclude the agreement later, the SLA applies from conclusion unless a later commencement is expressly agreed. There is no automatic retroactive effect. Existing earlier or stricter binding commitments are neither postponed nor reduced.

8. Intellectual Property

The App, including its software, design, texts, and trademarks, is the exclusive property of HeroSoftware GmbH or its licensors and is protected under German and international copyright and trademark law. You receive a non-exclusive, non-transferable, revocable right to use the App for the duration of the contract and solely for operating your own Shopify store(s). All other rights remain reserved.

9. Limitation of Liability

We are liable without limitation for intent (Vorsatz) and gross negligence (grobe Fahrlässigkeit), for injury to life, body, or health, and under the German Product Liability Act (Produkthaftungsgesetz).

In cases of slight negligence (einfache Fahrlässigkeit), we are liable only for breaches of material contractual obligations (Kardinalpflichten), i.e. obligations whose fulfilment is essential for the proper performance of the contract and on whose fulfilment you may regularly rely. In such cases, liability is limited to the foreseeable damage typical for this type of contract.

We are not liable for lost profits, lost revenue (including lost upsell revenue), or indirect or consequential damages, except in cases of intent or gross negligence.

We are not liable for disruptions caused by Shopify, third-party apps, themes, or the Merchant's own configuration.

10. Indemnification

You shall indemnify us against all third-party claims arising from your unlawful use of the App or from content you configure or display through the App, including reasonable costs of legal defence, unless you are not responsible for the breach.

11. Confidentiality

Each party shall protect the other party's confidential information (in particular non-public business, technical, and financial information disclosed in connection with the App) from unauthorized use, access, or disclosure with at least the same degree of care it applies to its own confidential information, and no less than reasonable care. This obligation survives termination for a period of three (3) years. It does not apply to information that is publicly available, independently developed, or required to be disclosed by law.

12. Changes to These Terms

We may propose amendments to these Terms with effect for the future. Publication and contractual amendment are separate: for new customers, this version applies only where effectively incorporated from its actual publication. The revision date and planned publication date are not contractual effective dates.

For the transition of existing customers to this revised version, we will notify the contractual contact individually by e-mail and additionally in the App at least 30 full calendar days before the intended individual effective time. Longer notice periods under existing agreements remain applicable. The notice provides the old and new versions, a clear list of changes, the intended individual effective time, the required express consent, the deadline and the contact post@hero.software. Existing binding special terms must be taken into account before each transition.

Documented express consent is required for this transition. Silence or mere continued use of the App does not constitute consent. Without consent, the previous terms continue to apply; lack of consent does not automatically result in suspension or termination. There is no single effective date for all existing customers. The individual effective time requires compliance with the applicable advance-notice period and express consent.

A separately and expressly concluded SLA may apply at its individually agreed commencement under Section 7 without waiting for the general transition of these Terms. Existing earlier or stricter commitments remain unchanged and must not be silently weakened. The version applicable to your contract depends on actual incorporation and effectively agreed changes, not solely on what is displayed on the website.

13. Dispute Resolution

We are neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board.

14. Final Provisions

These Terms are governed by the laws of the Federal Republic of Germany, excluding the UN Convention on Contracts for the International Sale of Goods (CISG).

Exclusive place of jurisdiction for all disputes arising from or in connection with these Terms is Wiesbaden, Germany, provided you are a merchant (Kaufmann), a legal entity under public law, or a special fund under public law.

Should individual provisions of these Terms be or become invalid, the validity of the remaining provisions shall remain unaffected.

Contact: HeroSoftware GmbH, Walramstraße 23, 65510 Idstein, Germany — post@hero.software

Annex 1: Data Processing Agreement (DPA)

Data Processing Agreement pursuant to Art. 28 GDPR

This Data Processing Agreement (“DPA”) forms an integral part of the Terms of Service for Post-Purchase Upsell Hero and applies whenever HeroSoftware GmbH (“Processor”) processes personal data on behalf of the Merchant (“Controller”) in connection with the App.

1. Subject Matter and Duration

The Processor processes personal data on behalf of the Controller for the purpose of providing the App as described in the Terms of Service. The duration of this DPA corresponds to the term of the Terms of Service. It ends automatically when the App is uninstalled and all personal data has been deleted or returned in accordance with Section 10.

2. Nature and Purpose of Processing

Processing includes the collection, storage, analysis, and display of order and customer data from the Controller's Shopify store in order to:

• display post-purchase upsell and downsell offers to the Controller's customers;
• generate AI-based product recommendations;
• provide analytics, A/B testing, and reporting;
• calculate usage-based fees (upsell revenue).

3. Types of Personal Data

These categories also cover data processed temporarily via APIs, webhooks or application logs; listing a category does not mean every field is stored permanently. This overview is not an exhaustive inventory of every field.

• Order, shop, product, checkout and funnel data (including order ID, order value, purchased products and timestamps)
• Numeric customer IDs, checkout tokens and broad shipping regions
• Read customer segments, order count and language
• Customer data that may be contained in Shopify payloads (name, e-mail address, shipping and billing address, where transmitted by Shopify)
• Technical data that may be processed depending on the API and webhook payloads received and the application logs (IP address, device and browser information, session identifiers)
• Interaction and analytics data relating to upsell offers (impressions, views, clicks, purchases, declines), settings, cart snapshots and UTM data

According to the developer, names, e-mail addresses, segments and order counts are read from Shopify; first names are used for personalisation only at runtime. According to the developer, UTM data is stored for 24 hours, and payment data and special categories of personal data are not stored. Removing a customer ID alone does not fully anonymise data; data without directly identifying buyer details can still be personal data.

4. Categories of Data Subjects

• Customers of the Controller's Shopify store
• Staff members of the Controller using the App

5. Obligations of the Processor

The Processor shall:

• a) process personal data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless prohibited by law;
• b) ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• c) implement all technical and organisational measures required pursuant to Art. 32 GDPR (see Annex 2);
• d) respect the conditions referred to in Section 6 for engaging sub-processors;
• e) taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Controller's obligation to respond to requests for exercising data subject rights (Art. 12–23 GDPR);
• f) assist the Controller in ensuring compliance with the obligations pursuant to Art. 32–36 GDPR (security, breach notification, data protection impact assessments), taking into account the nature of processing and the information available to the Processor;
• g) The Processor shall notify the Controller without undue delay and in any event no later than 24 hours after becoming aware of a personal data breach affecting personal data processed on behalf of the Controller. Information that is not yet available shall be provided in subsequent updates without undue delay.
• h) at the choice of the Controller, delete or return all personal data after the end of the provision of services (Section 10);
• i) make available to the Controller all information necessary to demonstrate compliance with Art. 28 GDPR and allow for and contribute to audits (Section 9);
• j) immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.

Personal data breach notification (Section 5(g))

The notification duty and the 24-hour maximum apply continuously, including at night, on weekends and on public holidays, and to relevant incidents involving engaged sub-processors. The maximum is not a waiting period. The initial notification to the agreed customer contact shall not be postponed until the investigation is complete.

The initial notification shall include the information available at that time about the nature and scope of the breach, the affected data and individuals, possible consequences, measures taken or proposed, and a contact person. Information not yet known shall be supplied in subsequent updates without undue delay. The Processor's own statutory obligations and its assistance to the Controller in meeting the Controller's obligations remain unaffected.

6. Sub-Processors

The Controller grants the Processor a general authorisation to engage sub-processors for the provision of the App. The overview of services used is set out below; questions may be sent to post@hero.software.

Overview of services used and their respective roles: Development services qualify as sub-processors for merchant customer data only if they actually receive such personal data on behalf of the Merchant. Code access is not equivalent to access to production data or secrets. Listing a service does not, by itself, confirm any transfer of merchant customer data.

• DigitalOcean: hosting of the production App, Managed MongoDB, OpenSearch and application logs in Frankfurt, as well as operations and deployment through its GitHub integration.
• GitHub: source-code repository, reviews and CI through GitHub Actions.
• Cursor / Anysphere, including Bugbot: development and review of code changes on the regular Business/Team plan (not Enterprise), with Privacy Mode enabled to the maximum extent. Bugbot supplements human review. Privacy Mode is not a guarantee of no data transfer, no storage or EU-only processing.
• Momentic: GitHub integration and E2E tests in the test store, processing test-browser content as well as screenshots and videos.
• Productlane: merchant feedback and GitHub integration.
• Featurebase: merchant feedback; code access is not confirmed.
• DeepL API: translation of offer texts; according to the developer, no directly identifying buyer details. This does not automatically mean the transmitted content contains no personal data.
• OpenAI API: optional product ranking, currently disabled; according to the developer, no data is currently sent to this API.
• Mantle: no longer used since October 2026. This does not establish that all data from prior use has already been deleted.
• Replit: hosting of this website; this does not establish access to the production Shopify App code or its customer data.

Shopify is the platform with a direct relationship with the Merchant and is not categorically classified here as HeroSoftware's sub-processor.

The Processor shall inform the Controller of any intended addition or replacement of sub-processors at least 30 days in advance, giving the Controller the opportunity to object on reasonable data protection grounds. If the Controller objects and no mutually acceptable solution is found, the Controller may terminate the Terms of Service.

Updating this overview does not replace any customer notification required under this DPA.

The Processor shall impose on each sub-processor the same data protection obligations as set out in this DPA by way of contract. The Processor remains fully liable to the Controller for the performance of the sub-processor's obligations.

7. Place of Processing and International Transfers

The production application, database and application-log infrastructure are hosted in Frankfurt, Germany. Processing by other service providers may take place in other countries. Transfers of personal data outside the European Economic Area are subject to Chapter V GDPR and the applicable sub-processor information and authorisation requirements under Section 6.

8. Data Subject Rights

If a data subject contacts the Processor directly with a request under Art. 12–23 GDPR, the Processor shall forward the request to the Controller without undue delay. The Processor shall not respond to such requests itself unless instructed to do so by the Controller or required by law.

9. Audits

The Controller has the right to verify the Processor's compliance with this DPA. The Processor shall primarily demonstrate compliance by providing suitable documentation (e.g. descriptions of technical and organisational measures, certifications, audit reports). On-site audits may be conducted no more than once per calendar year, during normal business hours, with at least 30 days' prior written notice, and without disrupting business operations, unless a personal data breach or evidence of non-compliance justifies a shorter notice period.

10. Deletion and Return of Data

Upon termination of the Terms of Service (in particular upon uninstallation of the App), the Processor shall, at the Controller's choice, delete or return all personal data processed on behalf of the Controller within 30 days, and delete existing copies, unless Union or Member State law requires further storage. Deletion in accordance with Shopify's mandatory GDPR webhooks (shop/redact, customers/redact, customers/data_request) remains unaffected and is performed within the deadlines set by Shopify.

Access and deletion requests may also arise during use of the App. Uninstallation triggers deletion duties; it does not mean all data is immediately and completely deleted. The obligation to delete or return data within 30 days remains in force.

This duty does not require an additional deletion request and concerns personal data processed on behalf of the Controller. Contract, billing and contact-person data processed by HeroSoftware as an independent controller are separate; their retention is governed by the respective processing purposes and statutory retention duties, as explained in the Privacy Policy.

According to the developer, UTM data is stored for 24 hours; existing MongoDB backups are retained for seven days. This does not establish a single retention period for application logs, feedback or test screenshots and videos. Required deletions must be reapplied after a restore. This is a requirement for the recovery process, not confirmation that deletion has been fully implemented technically or automated.

11. Liability

Liability under this DPA is governed by Art. 82 GDPR and the limitation of liability set out in Section 9 of the Terms of Service, to the extent permitted by law.

12. Precedence

In the event of a conflict between this DPA and the Terms of Service regarding the processing of personal data, this DPA shall prevail.

Annex 2: Technical and Organisational Measures (Art. 32 GDPR)

The following distinguishes existing measures and confirmed capabilities as of 1 October 2026 from established policies and planned improvements. Where indicated, descriptions of technical implementation are based on management or developer reports. A target date or policy is not evidence of completed implementation; planned measures are not automatically marked complete when a date passes.

A. Personnel and access control

• Internal access is limited to the company's own employees in Germany; no freelancers. Only company-owned workstations and personal user accounts are used.
• All employees have written data-protection and confidentiality commitments. Screens lock automatically.
• Access rights are granted according to task requirements and reviewed quarterly and upon relevant changes. Access is blocked or removed immediately on departure.
• Authenticator-app MFA is mandatory for all employees. Google serves as the identity provider; Cursor is accessed through Google sign-in. For federated sign-in, MFA takes place at the identity provider; direct sign-ins must also be protected by MFA. Two-factor sign-in is used for DigitalOcean and GitHub.
• Each authorised employee uses a personal Shopify Partner account with MFA. Passkeys are recommended for services that support them, and their use is monitored. There is no general passkey requirement or requirement to enter both a passkey and an authenticator code at every login.
• Technical service accounts, API tokens and deployment keys are distinct from personal employee sign-ins; their credentials are subject to the secret-protection measures described under C.

B. Infrastructure and encryption

• The production App, Managed MongoDB and OpenSearch are hosted with DigitalOcean in Frankfurt. The hosting provider provides physical protection of the data centres. Frankfurt is not the processing location of all service providers; international transfers are governed by Annex 1, Section 7.
• According to management, application data is encrypted in transit and at rest, including the database, application logs and backups. Workstation encryption is planned separately (F).

C. Integrity and logging

• According to the developer, application logging uses Winston/OpenSearch; this does not constitute a commitment to log every access to or change to personal data. Sensitive secret fields are redacted before transmission to application logs.
• Production and test/development environments are separated.

Code access and release approvals

• Code-access paths include GitHub (repository, reviews and Actions), DigitalOcean (GitHub deployment integration and operations), Cursor including Bugbot (development and review of changes), Momentic (GitHub integration and E2E tests), and Productlane (GitHub integration). Featurebase is used for merchant feedback; code access is not confirmed. Hosting this website on Replit does not establish access to the production Shopify App code or its customer data.
• Changes to the production branch require a pull request and approval by a second person. Unit tests, lint and typecheck must pass. There is no bypass for administrators, bots or integrations, and no unreviewed direct changes or manual production deployments.
• Changes to protection rules and release workflows require a documented four-eyes review. Bugbot supplements, but does not replace, human review.
• Code access is not equivalent to access to production data or secrets. Cursor uses the regular Business/Team plan, not Enterprise, with Privacy Mode enabled to the maximum extent. This mode does not guarantee no transfers, no storage or exclusively European processing.

Secrets and technical credentials

• Team Lead Martin Herd is responsible for secrets. Production secrets are held in the DigitalOcean environment; CI secrets are held in GitHub Secrets. Development, testing and production use separate credentials, and local development secrets are not version-controlled.
• Technical shielding of secrets from AI tools is confirmed as implemented and documented in the development process. It also covers terminal and MCP access; .gitignore or .cursorignore alone are not complete safeguards.
• On suspected compromise, employee departure or removal of access, affected access is blocked and secrets are revoked or rotated.
• A review of the entire repository, including Git history, is confirmed. This does not establish a result of “no findings”.

D. Availability and recovery

• Multiple App instances run with autoscaling. This is not a blanket commitment to complete database or site redundancy.
• According to the developer, MongoDB backups are taken daily and retained for seven days. Health checks and technical alerts are in place.
• Management confirms adherence to a maximum recovery time (RTO) of 8 consecutive hours. It starts at the actual onset of the outage and ends at validated recovery of the affected App core functions, including the required database and configuration.
• Management confirms adherence to a maximum tolerable data loss (RPO) of 24 hours for production App data stored by HeroSoftware. Confirmation of these recovery values is neither an independent audit report nor evidence of a completed restore test.
• Additional consistent recovery points at least every 12 hours, including backup monitoring, are planned for completion by 20 October 2026, inclusive. A full restore test is planned by 20 October 2026, inclusive; the internal procedure exercise is planned on 9 October 2026. Thereafter, recovery tests are planned at least quarterly and after material changes. Completion of these planned measures is not confirmed as of 1 October 2026.
• Required deletions must be reapplied after a restore (Annex 1, Section 10); this is a requirement, not confirmation of fully implemented technical deletion.

E. Incident handling and review

• Team Lead Martin Herd is responsible for technical security incidents. He and the internal development team oversee technical monitoring; on-call coverage and backup coverage for customer updates are in place.
• A written incident procedure has been prepared, covering reporting, containment, evidence preservation, assessment, customer notification, recovery and follow-up. Rollout and staff instruction have not yet been completed.
• A quarterly review of technical and organisational measures is planned. Personal data breaches must be notified without undue delay and no later than 24 hours after awareness under Annex 1, Section 5(g), including its provisions on the continuous deadline, sub-processor incidents, initial notification and subsequent updates.

Vulnerability assessments and penetration testing

Since 1 October 2026, an internal policy has been established for the following checks and treatment of findings:

• code analysis (SAST) and dependency checks (SCA);
• secret scans, including Git history;
• configuration checks and, where applicable, container checks;
• authenticated tests of the test environment;
• targeted checks of shop separation, permissions, tokens, webhooks and business logic;
• risk assessment, remediation deadlines and retesting.

The policy is established; full setup of the new automated scans and their initial runs are not yet confirmed as complete. Until automation is in place, equivalent controlled checks are required before release. Automated scans and Bugbot are not penetration tests.

An independent external penetration test, including a written findings report, is planned by 1 November 2026, inclusive. It is not represented as already performed or passed, and no claim is made that all findings have been resolved. Findings are addressed according to risk and retested.

F. Planned improvements (completion not yet confirmed)

As of 1 October 2026, the following measures are planned:

• full-disk encryption of all company computers used by all employees by 5 October 2026, inclusive, with no departmental exceptions;
• cybersecurity-awareness e-learning from TÜV SÜD Akademie and an internal awareness briefing on 9 October 2026 for all employees, with no departmental exceptions;
• additional consistent recovery points at least every 12 hours and backup monitoring, and a full restore test by 20 October 2026, inclusive; an internal procedure exercise on 9 October 2026, followed by recovery tests at least quarterly and after material changes (D);
• full setup and initial runs of the new automated security checks (E);
• an independent external penetration test with a written findings report by 1 November 2026, inclusive (E).

Completion of these measures is not confirmed. Participation in the TÜV course is not TÜV certification of the company or the App. The target dates do not suspend applicable data-protection or security obligations.

The Processor may update these measures, provided that the level of protection is not reduced.