TagRelay — Data Processing Agreement

Last updated: 2026-09-26

1. Parties

This Data Processing Agreement ("DPA") is concluded between the merchant who installs and uses the TagRelay Shopify app (the "Controller") and Lukasz Szczesiak (Marketing Online - Lukasz Szczesiak), the operator of TagRelay (the "Processor"). Contact: lukasz9011@gmail.com.

2. Subject matter, nature and purpose

The Processor processes personal data on behalf of the Controller only to provide TagRelay: conversion measurement and advertising on behalf of the Controller. Storefront events and order events of the Controller's store are received by a Google Tag Manager server-side container dedicated to that store and forwarded to the advertising and analytics platforms the Controller has configured. Processing lasts for as long as the app is installed and ends as described in section 11.

3. Categories of data subjects

Visitors of the Controller's online store.
Customers who place orders in the Controller's online store.

4. Categories of personal data

Storefront events (web pixel): event name, page path, value and currency, IP address, user agent, analytics client ID and advertising click identifiers (gclid, fbc/fbp, ttclid). The web pixel does not send email addresses or phone numbers.
Order events (Shopify orders/create webhook, delivered directly to the store's container): order ID, value, currency, products, click identifiers attached to the order, and the customer's email address, phone number, first and last name and address. The contact and address fields are hashed with SHA-256 in the container, in memory, before being sent to Meta, Google and TikTok.
Raw web server logs, which may contain the body of the order webhook, including the customer's email address, phone number and address. Access is limited to the administrator (files owned by root/adm, permissions 0640); the logs are kept for at most 14 days and then deleted automatically.
Event and order metadata kept by the Processor in the operator panel database for delivery monitoring and the attribution report: time, path, IP address, user agent, event name, value, click identifiers and order ID. Personal fields (email, phone, first name, last name, address) are removed before data is written to the database.

The Processor does not intentionally process special categories of personal data.

5. Instructions of the Controller

The Processor processes personal data only on documented instructions of the Controller. The Controller gives these instructions by configuring the app in its setup wizard and settings: selecting the destination platforms, entering their identifiers and credentials and enabling or disabling tracking. The Processor will inform the Controller if, in its opinion, an instruction infringes the GDPR. Data is forwarded to a platform only after the Controller has configured it, and in line with the consent signals of the data subject (Shopify Customer Privacy API, Google Consent Mode v2).

6. Confidentiality

Personal data is accessed only by the Processor's single administrator, who is bound by confidentiality. The Processor does not sell personal data and does not use it for its own purposes.

7. Security of processing

The Processor implements the technical and organisational measures described on the Security & data protection page, including data minimisation, limited retention, TLS encryption in transit, key-only administrative access and per-store isolation.

8. Sub-processors

The Controller authorises the following sub-processors. Data reaches Google, Meta and TikTok only when the Controller has configured the respective platform and in line with the data subject's consent.

Shopify — e-commerce platform; source of storefront and order events.
Google — Google Tag Manager, Google Analytics 4, Google Ads.
Meta — Meta Conversions API.
TikTok — TikTok Events API.

The app and the tag server containers are hosted on infrastructure operated by the Processor in the European Union (Poland). The Processor will inform the Controller of any intended addition or replacement of sub-processors by updating this page, giving the Controller the opportunity to object by uninstalling the app.

9. Assistance with data subject rights

The Processor assists the Controller in responding to data subject requests. Shopify's customers/data_request and customers/redact requests are acknowledged automatically. The Processor keeps no customer database; personal fields may exist only in raw web server logs for at most 14 days. On customers/redact the metadata in the operator panel linked to the listed orders and customer is deleted. Other requests can be sent to lukasz9011@gmail.com.

10. Personal data breaches

The Processor will notify the Controller of a personal data breach without undue delay and no later than 72 hours after becoming aware of it, and will provide the information the Controller needs to meet its own obligations.

11. Deletion at the end of processing

When the app is uninstalled, the store's tag server container is stopped. When Shopify sends the shop/redact request (48 hours after uninstall), the store's data in the operator panel and the store's configuration in the app are deleted and the container stays stopped. Data is in any case deleted after its retention period: raw web server logs after at most 14 days, the operator panel database after up to 30 days.

12. Audits and information

On request, the Processor makes available to the Controller the information necessary to demonstrate compliance with this DPA and Article 28 GDPR.

13. Governing law

This DPA is governed by the law of the European Union, in particular Regulation (EU) 2016/679 (GDPR), and the law of Poland.

14. Acceptance

By installing and using TagRelay, the Controller accepts this DPA. It applies for as long as the Processor processes personal data on behalf of the Controller.