Terms of service

Terms applying when Shopify merchants use DPG Pfand Germany.

Operator: Genius Nutrition S.R.L.
Effective date: 2026-08-09

1. Service

DPG Pfand Germany supports manual selection of variants already registered and marked for DPG, a technical deposit line in Shopify cart, and internal merchant audits. The app is not affiliated with, endorsed by or operated by DPG Deutsche Pfandsystem GmbH and does not provide legal or tax advice.

2. Merchant responsibility

The merchant confirms product scope, GTIN, package count, DPG registration and marking, and its retailer/end-distributor role. First distributors, importers and private-label responsible parties must not rely on this V1 for their broader obligations.

3. Deposit and offer display

For selected variants, the app configures EUR 0.25 per physical DPG package as a separate Shopify line. The merchant verifies EINWEG and the separate deposit disclosure on every offer surface used by its theme, including product cards, search and quick buy.

4. Internal reports

XLSX and CSV files are internal merchant records only. They are not DPG, LUCID, regulatory or clearing submissions.

5. Billing

Paid plans, approvals, renewals and cancellations are processed by Shopify. Prices and cycles shown by Shopify prevail.

6. Availability and limitations

We may secure, fix, update or discontinue functionality. To the extent permitted by law, the operator is not responsible for incorrect product selection, omitted merchant reviews, legal changes or third-party outages. Mandatory rights remain unaffected.

7. Data processing schedule (Article 28)

This schedule applies where, under applicable data-protection law, the Shopify merchant acts as controller and the operator processes personal data on the merchant's behalf. It forms part of these terms and remains subject to the mandatory requirements of applicable law.

Document version: 2026-08-08-dpa-v1

7.1 Roles, subject matter and duration

The processing supports authentication, deposit configuration and control, order and refund synchronization, merchant reporting, privacy requests and support for the duration of the merchant's use of the app and the documented retention and deletion periods that follow termination.

7.2 Nature, purpose and documented instructions

The operator collects, organizes, stores, retrieves, compares, exports and deletes the limited store data needed to provide the app. The operator acts only on documented instructions in these terms, the merchant's app configuration and lawful Shopify actions. If an instruction appears to violate applicable data-protection law, the operator will notify the merchant before proceeding unless prohibited by law.

7.3 People and data concerned

Data subjects can include authenticated merchant staff and individuals represented in order, refund or fulfillment records. Data is limited to merchant-staff session attributes; Shopify shop and configuration identifiers; order, line, product, variant, SKU, GTIN, quantity, price, discount and tax data; timestamps and status values; refund and minimal transaction metadata; and technical security, webhook and audit records. The app does not request or store buyer names, postal addresses, phone numbers, email addresses or payment-instrument data.

7.4 Confidentiality

The operator limits personal-data access to authorized people who need it to operate, secure or support the service and who are bound by confidentiality obligations or an equivalent statutory duty.

7.5 Security and incidents

The operator maintains measures appropriate to the risk, including HTTPS transport, Shopify authentication, webhook HMAC verification, tenant-scoped authorization and storage, data minimization, controlled credential access, bounded retention and tested deletion paths. The operator will notify the merchant without undue delay after becoming aware of a personal-data breach affecting merchant data and will provide information reasonably available for the merchant's response.

7.6 Providers, subprocessors and transfers

Shopify provides the merchant platform, authentication, billing and store data. Railway provides app-hosting and database infrastructure. To the extent a provider acts as a subprocessor for merchant data, the operator requires data-protection obligations appropriate to the service and remains responsible as required by applicable law. Material provider changes and applicable objection rights will be communicated through the service or privacy notice. Processing outside the EEA follows the provider's applicable contractual and transfer mechanisms.

7.7 Assistance

Taking account of the nature of the processing and information available, the operator will reasonably assist the merchant with data-subject requests, security obligations, breach notifications, data-protection impact assessments and consultations with supervisory authorities.

7.8 Return, export and deletion

The app provides the documented privacy-request and merchant-export paths. At the end of the service, the operator deletes or returns merchant personal data as directed and deletes remaining copies through the documented retention jobs and Shopify shop/redact flow, unless applicable law requires continued storage.

7.9 Information and audit

The operator will make information reasonably necessary to demonstrate compliance with this schedule available to the merchant and will allow proportionate audits or inspections on reasonable notice, subject to confidentiality, security, legal and third-party restrictions. Existing independent reports and provider evidence may be used where appropriate.

7.10 Priority and termination

If this schedule conflicts with another provision about processing merchant personal data, this schedule prevails to the extent of the conflict. A material breach of this schedule that is not remedied within a reasonable period permits the affected party to terminate the service, without limiting mandatory rights.

8. Law and forum

These terms are governed by Romanian law, subject to mandatory applicable law. Subject to mandatory rules, disputes are submitted to the competent courts at the operator's registered office in Romania, subject to mandatory jurisdiction rules.

9. Contact

support@obsedia.ai