Skip to content
MiixNederlands
Menu

Data processing agreement Laposta for Shopify

This is a translation of the Dutch data processing agreement. In case of differences, the Dutch text prevails. Version 1.0, 12 November 2026.

1. Parties and scope

This Data Processing Agreement ("DPA") applies between the merchant who installs the Laposta Integration app ("the App") on a Shopify store ("you", the controller) and Miix, the developer of the App ("we", the processor). It applies to all personal data we process on your behalf while the App is installed, in accordance with Article 28 of the General Data Protection Regulation (GDPR).

By installing or continuing to use the App you accept this DPA. It complements our privacy policy for the App and our terms and conditions (article 20). If you need a countersigned copy, contact us (see section 15).

2. Subject, nature and purpose of the processing

We process personal data only to provide the App's functionality: synchronising customer data and email marketing consent between your Shopify store and your own Laposta account, in the direction(s) you configure. We do not use the data for any other purpose, do not sell it and do not combine it with data from other merchants.

3. Categories of data subjects and personal data

Data subjects: customers and prospective customers of your Shopify store.

Personal data, insofar as you map these fields in the App:

  • Name, email address, phone number
  • Address details and company name
  • Email marketing consent status
  • Other customer fields you choose to map (such as tags, notes, locale, order count and total spent)

We also store data about you as a merchant: your shop domain, Shopify access credentials, your Laposta API key and your list and field mapping settings.

4. Duration of the processing

Customer personal data is processed in transit only: it is read from one system and written to the other, and is not stored in the App's database. Operational server logs may contain customer email addresses for troubleshooting purposes; these logs are kept for at most 30 days. This DPA applies for as long as the App is installed on your store.

5. Instructions

We process personal data only on your documented instructions. Your configuration of the App (connected lists, field mappings, two-way sync on or off) constitutes your instructions. If we believe an instruction infringes the GDPR, we will inform you. We may process data without your instruction only where required by EU or Member State law, in which case we will inform you unless that law prohibits it.

6. Confidentiality

Only persons authorised by Miix who need access to operate and support the App have access to the personal data, and they are bound by confidentiality.

7. Security measures

We take appropriate technical and organisational measures in accordance with Article 32 GDPR, including:

  • Encryption in transit (HTTPS/TLS) for all communication with Shopify, Laposta and our database
  • Encryption at rest (AES-256) of our database and backups
  • Verification of all incoming webhooks (HMAC signatures for Shopify; per-shop tokens and signatures for Laposta)
  • Strict separation of data per shop, and separate test and production environments
  • Access to production systems restricted to authorised persons, protected by strong passwords and two-factor authentication
  • Daily, weekly and monthly encrypted backups of configuration data
  • A documented security incident procedure

8. Sub-processors

You give us general authorisation to engage sub-processors. We currently use:

  • Railway Corporation: hosting of the application (data centre in the Netherlands) and the database (data centre in the United States).

Shopify and Laposta are not our sub-processors: you have your own agreements with them, and the App acts on your behalf between those services.

We impose data protection obligations on our sub-processors that offer at least the same level of protection as this DPA. Where personal data is transferred outside the European Economic Area, we ensure appropriate safeguards such as the European Commission's Standard Contractual Clauses. We will inform you of intended changes to our sub-processors at least 30 days in advance; if you object, you may uninstall the App.

9. Data subject rights

Taking into account the nature of the processing, we assist you in responding to requests from data subjects (such as access, rectification or erasure). Since customer data is stored in your Shopify store and your Laposta account, most requests can be handled there directly. We support Shopify's mandatory privacy webhooks for customer data requests and erasure.

10. Personal data breaches

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data. The notification will include, as far as known, the nature of the breach, the data and data subjects concerned, the likely consequences and the measures taken or proposed. We will assist you in meeting your obligations to notify the supervisory authority and data subjects.

11. Assistance

We assist you, where reasonably required, with data protection impact assessments and prior consultations with the supervisory authority, insofar as these relate to the App.

12. Deletion and return of data

When you uninstall the App, your session data is deleted immediately and your configuration data (including your Laposta API key and list mappings) is deleted within 48 hours, following Shopify's data deletion request. We do not retain copies of customer personal data. Data already synchronised to your Laposta account or Shopify store remains under your control there.

13. Audits

We make available all information reasonably necessary to demonstrate compliance with this DPA. You may audit our compliance, or have it audited by an independent auditor bound by confidentiality, once per year with at least 30 days' notice, at your own cost.

14. Liability and governing law

The Miix terms and conditions apply to this DPA; in case of conflict, this DPA prevails. Miix's liability is limited in accordance with article 12 of those terms: to the amount paid out by our insurance or, failing that, to the fees you paid for the App in the twelve months before the event giving rise to the claim, except in case of intent or deliberate recklessness or where the law does not allow such a limitation. This DPA is governed by Dutch law. Disputes are submitted to the competent court in Arnhem, the Netherlands.

15. Contact

Miix / Fred Klopper
Groningensingel 51-45
6835 EB Arnhem, the Netherlands
Chamber of Commerce (KvK) 09114618
Email: hallo@miix.dev