Mora Technologies ApS · Legal
Data Processing Agreement
Last updated: 9 November 2026 · Version: 2026-10-26 · GDPR Art. 28 · Applies to all Shopify applications published by Mora Technologies ApS under the Aveus brand
This Data Processing Agreement ("DPA") is entered into between the business that installs an Aveus App on its Shopify store (the "Merchant", acting as controller) and Mora Technologies ApS, trading as Aveus ApS (registered secondary name), CVR 46 17 19 77, Rantzausgade 11, 2. 6., 2200 København N, Denmark (acting as processor). It forms part of our Terms of Service and applies whenever an App processes personal data on the Merchant's behalf. The Merchant accepts it together with the Terms and the Privacy Policy: in each App before it is used; in Aveus AI, on its first screen, and nothing is processed under this DPA before that (Terms A.13), except the answers to the mandatory privacy webhooks of Shopify and the IP address of the visitor that the storefront scripts and the public disclosure page use as a rate limit key (Annex II).
For the Merchant's own account data (store domain, access token, audit records and the other merchant data listed in Part B of the Privacy Policy) Mora Technologies ApS is an independent controller, not a processor; that data is governed by the Privacy Policy, not by this DPA.
1. Standard Contractual Clauses
The parties agree that the standard contractual clauses between controllers and processors set out in the Annex to Commission Implementing Decision (EU) 2021/915 of 4 June 2021 (the "Clauses", available at eur-lex.europa.eu/eli/dec_impl/2021/915/oj) apply between them and are incorporated into this DPA by reference, with the Merchant as controller and Mora Technologies ApS as processor. The Annexes of the Clauses are completed by Annexes I to IV below. In case of conflict between the Clauses and the Terms or any other agreement between the parties, the Clauses prevail (Clause 4).
The parties make the following choices that the Clauses leave open:
| Clause 5 (docking clause) | Not used. A new store installs the App and accepts this DPA directly, in the App, before using it. |
| Clause 7.7 (subprocessors) | Option 2: general written authorisation. The processor informs the controller of any intended addition or replacement of a subprocessor at least 14 days in advance, by email or in the App, and the controller may object; if the objection cannot be resolved, the controller may terminate by uninstalling the App. The current list is Annex IV. |
| Clause 7.8 (international transfers) | Only to the recipients and under the safeguards stated in Annex IV and in section A.4 of the Privacy Policy: the Standard Contractual Clauses of Commission Decision (EU) 2021/914 pursuant to GDPR Art. 46.2.c where data may be accessed outside the EEA, and, for Shopify Inc. in Canada, the European Commission’s adequacy decision for Canada. |
| Clause 9 (personal data breach) | The processor notifies the controller without undue delay after becoming aware of a breach and, where feasible, within 48 hours, with the information listed in Clause 9.2. |
| Instructions (Clause 7.1) | The controller instructs the processor through its use of the App: its settings, the actions it takes in the App, and the mandatory Shopify privacy webhooks (customers/data_request, customers/redact, shop/redact). |
| Deletion at the end of the service (Clause 10.d) | Before uninstalling, the controller may ask at contact@aveus.ai for a copy of the personal data processed on its behalf. That data is then deleted on uninstallation or on the verified erasure request Shopify sends 48 hours later, as stated per App in Part B of the Privacy Policy, and on request we confirm the deletion in writing. |
2. Limits of this DPA
This DPA governs data protection only. It does not extend the scope of the Apps described in the Terms, does not make Mora Technologies ApS responsible for the Merchant's own obligations as controller (including the notices it gives its customers and the lawfulness of the data it collects) or as deployer under the EU AI Act, and does not change the limitation of liability in the Terms except where the Clauses or mandatory law require otherwise. Assistance under Clauses 7.6 and 8 that goes beyond what the App provides automatically (for example audits on site) is offered at a reasonable cost agreed in advance.
Annex I. List of parties
| Role | Party | Contact |
|---|---|---|
| Controller | The business that owns the Shopify store on which the App is installed, identified by its store domain and represented by the Shopify staff account that accepted this DPA | The store owner email registered in Shopify |
| Processor | Mora Technologies ApS, trading as Aveus ApS (registered secondary name), CVR 46 17 19 77, Rantzausgade 11, 2. 6., 2200 København N, Denmark | contact@aveus.ai |
Each party accepts the Clauses and this DPA on the date the controller accepts them in the App, which the App records (Terms A.13).
Annex II. Description of the processing
| Categories of data subjects | The controller’s customers and the visitors of its online store and of its public disclosure page; persons who may appear in or be named in the metadata of its product images; persons the controller names in the records it keeps in the App (for example its incident register). |
| Categories of personal data | Shopify customer identifiers delivered by the mandatory privacy webhooks (for example the customer ID in a customers/data_request or customers/redact request); the IP address of visitors, used as a rate limit counter key by the storefront scripts and the public disclosure page and expiring automatically within two hours, the user agent of their requests, used with the IP address to block abusive traffic and requests from certain countries or networks and kept in the service logs described in section A.11 of the Privacy Policy (for blocked requests, with a pseudonymised hash of the IP address), and the country derived from the IP address, which is not stored, so that the Trust Badge is shown only in the EU and the EEA; the metadata of product images, read only to find provenance markers (only the detection result is stored); and, only if the controller turns on visual analysis in Aveus AI, a reduced copy of the product images it chooses to analyse, which may show a person (the image is not stored); visual analysis is not available at the moment; the content the controller writes in the App, such as the incidents it records (description, authority and its email address) and its review notes. The Apps do not read orders, customer profiles or payment data. |
| Sensitive data | None. The Apps are not designed to process special categories of data (GDPR Art. 9) or data on criminal convictions (Art. 10). |
| Nature of the processing | Automated: reception and storage of webhook requests, temporary counting for rate limiting, blocking of abusive requests, reading of image metadata, storage of the records the controller keeps in the App, and deletion; and, only on the controller’s instruction (visual analysis turned on in Aveus AI), sending a reduced copy of the product images it selects to the AI subprocessor so that it can suggest whether a label is needed. Visual analysis is not available at the moment (Aveus AI Terms B.1.5): while it is not available, no product image is sent. |
| Purposes | Providing the App to the controller; carrying out the controller’s privacy requests received through Shopify; protecting the storefront endpoints against abuse. |
| Duration | For as long as the App is installed, followed by deletion as stated in Part B of the Privacy Policy (rate limit keys: two hours at most; privacy request queue: 90 days after completion). |
Annex III. Technical and organisational measures
- Data residency in the EU: database in Frankfurt (AWS eu-central-1), application runtime in Frankfurt (Vercel fra1), AI processing on the Vertex AI EU multiregional endpoint.
- Isolation between stores: access to data is limited to the store concerned, through Row Level Security in the database for requests made for a store, and through a filter on the store in the server tasks that run without it.
- Encryption: TLS in transit; Shopify access tokens encrypted at rest with AES-256-GCM; database encrypted at rest by the provider.
- Authentication: every request from the Shopify admin is verified with Shopify’s signed session token; every webhook with its HMAC signature; no long lived cloud service account key exists in the runtime (Workload Identity Federation).
- Least privilege: the App requests only the Shopify permissions it needs; the database role used for store requests has only the column privileges it needs.
- Data minimisation: no end customer data is collected on our own initiative; no IP address is stored in the database; error reports are redacted and pseudonymised.
- Secure development: dependency and secret scanning in the build pipeline, automated tests on every change, and regular security reviews against the OWASP Top 10.
- Logging and retention: security and operational logs are kept for the periods stated in the Privacy Policy and deleted automatically afterwards.
- Incident handling: breaches are notified as set out in Clause 9 (section 1 of this DPA).
Annex IV. List of subprocessors
The controller authorises the following subprocessors (Clause 7.7, option 2).
| Subprocessor | App | Purpose | Location |
|---|---|---|---|
| Shopify International Limited (Ireland) / Shopify Inc. | All | The platform on which the Apps run: authentication, Admin API, mandatory privacy webhooks | EU and Canada, under the Shopify Data Processing Addendum |
| Supabase Inc. | All | Database hosting | EU: AWS eu-central-1 (Frankfurt) |
| Vercel Inc. | All | Application hosting and serverless runtime | EU: Frankfurt (fra1); edge routing at the location nearest the visitor |
| Upstash, Inc. | Aveus AI | Rate limiting, AI spend budget and webhook idempotency | EU region |
| Google Cloud EMEA Limited (Ireland), Vertex AI | Aveus AI | AI classification of extracts of the theme files and public vendor documentation (no end customer data is sent to the model); and, only on the controller’s instruction, reduced copies of the product images it selects for visual analysis (visual analysis is not available at the moment) | EU: Vertex AI "eu" multiregional |
| Google Ireland Limited (Google Workspace / Gmail) | Aveus AI | Operational error alerting to our engineering mailbox | EU and US, under the Google DPA and Standard Contractual Clauses |
Supabase, Vercel, Upstash and Google may rely on personnel or affiliates outside the EEA for limited support and engineering access; any such access is covered by the Standard Contractual Clauses pursuant to GDPR Art. 46.2.c, as described in the Privacy Policy. The contact details of each subprocessor are those it publishes; on request we provide them, together with a copy of the relevant data processing terms.