Auftragsverarbeitungsvertrag

1. Parties and Scope

The Controller is the legal entity that registered the Composerie organization, as recorded in the account settings. This DPA applies to all Merchant Personal Data (defined below) that Composerie processes while providing the Service, in every environment and through every connected platform.

This DPA does not apply to data for which Composerie is itself the controller (such as the Merchant's own account, billing and support data). That processing is described in our Privacy Policy.

2. Definitions

• Merchant Personal Data — personal data of the Merchant's shoppers, order recipients, staff and other data subjects that Composerie processes on the Merchant's instructions, as described in Section 4.
• Sub-processor — a third party engaged by Composerie to process Merchant Personal Data on Composerie's behalf.
• Data Protection Law — the GDPR, the UK GDPR, the Dutch GDPR Implementation Act (UAVG) and any other data protection law that applies to the processing.
• Service, Terms and Content have the meaning given in the Terms of Service. Other capitalized terms have the meaning given in the GDPR.

3. Roles of the Parties

The Merchant is the controller of Merchant Personal Data and Composerie is its processor. The Merchant warrants that it has a lawful basis for the processing, that it has provided the notices required by Data Protection Law to its shoppers, and that its instructions comply with Data Protection Law. Composerie processes Merchant Personal Data only on the Merchant's documented instructions; these Terms, this DPA and the Merchant's use of the Service's features (including the integrations the Merchant connects) constitute the complete set of instructions.

4. Details of the Processing

5. Composerie's Obligations

Composerie shall:

• process Merchant Personal Data only on the Merchant's documented instructions, unless required to do otherwise by law, in which case Composerie informs the Merchant before processing unless the law prohibits it;
• immediately inform the Merchant if, in Composerie's opinion, an instruction infringes Data Protection Law;
• ensure that persons authorized to process Merchant Personal Data have committed themselves to confidentiality;
• implement the technical and organizational measures in Annex 2 and keep them appropriate to the risk;
• engage sub-processors only in accordance with Section 8;
• assist the Merchant with data-subject requests, data protection impact assessments and prior consultations as set out in Section 10;
• delete or return Merchant Personal Data at the end of the Service as set out in Section 13;
• make available the information necessary to demonstrate compliance and allow audits as set out in Section 12.

6. Security of Processing

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, Composerie implements the technical and organizational measures described in Annex 2. Composerie may update those measures from time to time, provided the updates do not materially lower the overall level of protection.

7. Confidentiality and Personnel

Access to Merchant Personal Data is limited to personnel who need it to operate, support or secure the Service. Such personnel are bound by written confidentiality obligations and receive data-protection instructions. Support staff access a Merchant's data only for the purpose of resolving that Merchant's request, and such access is logged.

8. Sub-processors

Anthropic is the sub-processor for central text assistance, distinct from image providers engaged by the Merchant. Activating this new processing for existing merchants requires the advance notice below; publishing this revision alone does not satisfy that notice or authorize immediate activation.

PostHog is listed in Annex 1 as an intended sub-processor for product analytics. It is not active: Composerie sends it no Merchant Personal Data until its retention and erasure controls have been verified and the advance notice below has been given.

The Merchant grants Composerie general authorization to engage the sub-processors listed in Annex 1. Composerie imposes data-protection obligations on each sub-processor that are no less protective than those in this DPA and remains fully liable to the Merchant for the sub-processor's performance.

Composerie announces any intended addition or replacement of a sub-processor at least 30 days in advance by updating Annex 1 (published at composerie.com/dpa) and, for material changes, by email to the organization owners. The Merchant may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection in good faith, the Merchant may terminate the affected part of the Service with immediate effect and receive a pro-rata refund of prepaid fees for the remaining period.

Parties that receive Merchant Personal Data because the Merchant connected them (its e-commerce platform, its fulfillment partners and the AI provider accounts it connects) act on the Merchant's own instructions and agreements; they are listed in Annex 1 for transparency but are not Composerie's sub-processors.

The customizer also has the shopper's browser load fonts and map tiles directly from the public content services in the third table of Annex 1. Composerie does not pass them personalization content, order data or account data. They receive what the browser's request itself contains (its IP address and user agent, the font requested or, for map tiles, the map area being viewed, and the referring website unless the browser or page suppresses it) and handle it under their own terms. They are listed so the Merchant can name them in its own privacy notice.

9. International Transfers

Composerie stores Merchant Personal Data primarily in the European Economic Area: the Service's applications and databases run on servers in Germany. Some sub-processors in Annex 1 process data outside the EEA, for example to deliver email or content. Where a sub-processor processes data outside the EEA, Composerie relies on a European Commission adequacy decision (including the EU-US Data Privacy Framework for certified providers) or on the Standard Contractual Clauses (Commission Decision 2021/914) together with the supplementary measures required under Data Protection Law, and the UK Addendum where the UK GDPR applies. Annex 1 records the safeguard used per sub-processor. Font requests that the shopper's browser sends to Google Fonts (Section 8) go to Google LLC in the United States, which is certified under the EU-US Data Privacy Framework. Transfers to recipients the Merchant connects (Section 8), such as its AI provider or fulfillment partner, are governed by the Merchant's own agreement with that recipient.

10. Assistance with Data-Subject Requests and Assessments

• Data-subject requests. If a data subject contacts Composerie directly about Merchant Personal Data, Composerie refers the request to the Merchant without undue delay and does not respond substantively unless instructed. Composerie provides the tools and assistance the Merchant reasonably needs to answer access, rectification, erasure, restriction, portability and objection requests, including erasure of a shopper's personalization content and order identifiers on request.
• Shopify privacy webhooks. For Shopify stores, Composerie answers Shopify's customers/data_request, customers/redact and shop/redact webhooks automatically: it exports the stored data for the customer, erases or anonymizes the customer's order data, personalization content and email logs, and purges all data of an uninstalled store after Shopify's mandatory waiting period.
• Impact assessments. Composerie provides the information about its processing reasonably needed for the Merchant's data protection impact assessments and prior consultations with a supervisory authority.

11. Personal Data Breach

Composerie notifies the Merchant without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Merchant Personal Data. The notification describes, as far as known at that time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Composerie provides further information in phases as it becomes available and cooperates with the Merchant's own notification duties. Notification of, or response to, a breach is not an acknowledgement of fault.

12. Information and Audits

Composerie makes available to the Merchant the information reasonably necessary to demonstrate compliance with this DPA, including this DPA, Annex 2, the current sub-processor list and, on request, summaries of security reviews. Where that information is insufficient, the Merchant (or an independent auditor bound by confidentiality) may audit Composerie's processing once per twelve months, with at least 30 days' written notice, during business hours, without unreasonably disrupting operations, and at the Merchant's cost. Additional audits are permitted where required by a supervisory authority or after a personal data breach affecting the Merchant.

13. Deletion and Return

The Merchant can export its designs, product configurations and order data from the Service at any time and may request a complete machine-readable export before closing the account. When the Merchant closes its organization, Composerie keeps the data for a 30-day recovery period and then deletes it, including files in object storage, unless Composerie must retain specific records by law (for example invoices and order records for tax purposes, which are retained for 7 years with personal identifiers removed as described in the Privacy Policy). Encrypted backups expire within a further 30 days, except that the four most recent backups are always kept as a recovery point and are deleted as soon as newer backups replace them. For Shopify stores, an uninstall triggers the shop/redact process described in Section 10.

14. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except where Data Protection Law does not allow such limitation. Each party is liable for administrative fines imposed on it by a supervisory authority to the extent the fine results from its own breach.

15. Term, Precedence and Governing Law

• Term — this DPA takes effect when the Merchant accepts the Terms and remains in force for as long as Composerie processes Merchant Personal Data.
• Precedence — in case of conflict between this DPA and the Terms regarding the processing of personal data, this DPA prevails. Where the Standard Contractual Clauses apply, they prevail over both.
• Changes — Composerie may update this DPA to reflect changes in Data Protection Law or the Service; material changes are announced at least 30 days in advance as described in the Terms.
• Governing law — this DPA is governed by the laws of the Netherlands, and disputes are subject to the jurisdiction clause in the Terms of Service, without prejudice to data subjects' rights under Data Protection Law.

Annex 1 — Sub-processors and Other Recipients

Current as of October 9, 2026. Sub-processors engaged by Composerie:

Recipients engaged by the Merchant (not sub-processors of Composerie):

Public content services the shopper's browser contacts directly (Section 8):

Annex 2 — Technical and Organizational Measures

• Encryption — TLS 1.2 or higher for all data in transit, including between Composerie services; encryption at rest for databases, object storage and backups; connected-platform access tokens and provider credentials encrypted with keys managed outside the database.
• Access control — role-based access with least privilege for merchants, their team members and Composerie staff; multi-factor authentication available for all accounts and required for administrative access; short-lived signed tokens for the storefront customizer, embedded surfaces and webhooks; every tenant query scoped to the organization.
• Data minimization — Shopify order payloads are reduced to an allowlist of shipping fields before storage; billing addresses are stripped at ingress and rejected by a database constraint; the Web Pixel sends no personally identifiable information; no customer-profile scope is requested.
• Secret management — all credentials are stored in a dedicated secrets manager and injected at runtime; no secrets are stored in source code or container images; secrets are rotated when personnel or providers change.
• Logging and monitoring — application and security logging with request identifiers, centralized error monitoring with EU data residency, audit logging of administrative and support actions (retained 24 months), uptime monitoring with a public status page and incident timeline.
• Resilience — daily encrypted database backups retained for 30 days, of which the four most recent are always kept so that a period of failed backups cannot leave us without a recovery point, with periodic restore tests; redundant job processing with automatic retries; rate limiting and abuse detection on public endpoints.
• Secure development — peer review and automated review of every change before release, automated tests and security audits in continuous integration, dependency vulnerability scanning, staged releases through a staging environment with verification gates before production, and a documented rollback path.
• Sub-processor management — written data-processing terms with every sub-processor, transfer safeguards recorded in Annex 1, and a 30-day announcement period for changes.
• Incident response — a documented incident-response procedure with severity classification, a 48-hour notification commitment to affected merchants, root-cause analysis and corrective actions.
• Deletion — automated retention jobs enforce the periods in the Privacy Policy; Shopify redaction webhooks are processed automatically with durable retries; organization deletion purges databases and object storage after the 30-day recovery period.