Translation for information only. Only the German version is legally binding. Mandatory statutory rights remain unaffected.
Provider: schukai, postal address: Eichenstraße 26, 82290 Landsberied, Germany. Full provider details are available in the legal notice.
Public information on processing on behalf of customers
Where schukai processes personal data on behalf of a customer, a data processing agreement under Article 28 GDPR is required. This applies to hosted customer projects, portals, shops, workspaces, interfaces and apps insofar as schukai operates these systems for the customer.
The underlying contractual terms are based on legally reviewed contractual documents. Technical and organisational measures, subprocessors and project-specific information are maintained to suit the respective operating model.
Date of this public information version: 5 September 2026.
Scope
The data processing agreement applies to hosted customer projects and SaaS-related services insofar as schukai processes personal data on behalf of the customer. The public operating domain for these projects is getshop.cloud.
This may include, in particular, Shopcloud, schukai cloud, customer portals, B2B portals, workspaces, interfaces, hosted business apps, the Workspace App in conjunction with a hosted Workspace instance, and support and operating services for these systems.
The agreement does not automatically apply to on-premises installations or entirely self-hosted systems not operated by schukai. In those cases, processing on behalf of the customer depends on whether schukai processes personal data on the customer's behalf in the specific project.
Concluding the agreement
The public page is intended for advance review and does not replace a contract. Before processing on behalf of the customer begins, the parties agree on a clearly identified version of the data processing agreement. It may be concluded together with the order, electronically or in a separately signed version.
- The service terms and data processing agreement are identified as separate documents.
- The agreed version is clearly assigned to the order or contract record.
- The data processing agreement, technical and organisational measures and, where applicable, subprocessor list have traceable versions.
- A separately signed version may be agreed if required.
Data categories and data subjects
Depending on the project and module used, the following types of data may be processed in particular:
- Master data such as name, company, customer number, contact person and role
- Contact details such as email address, telephone number and address
- Access data such as user account, roles, permissions, login status and technical authentication data
- Communication data from contact forms, support enquiries, messages and comments
- Contract, order, commission, document and status data
- Portal, shop and workspace data such as shopping baskets, order history, product ranges, prices, documents and downloads
- Process data such as tasks, approvals, appointments, workflows, records and evaluations
- App data such as mobile data collection, service or installation reports, feedback, photos and attachments, where used in the project
- Technical data such as IP addresses, log files, device and browser data and timestamps
- Payment and transaction data only insofar as schukai processes them in the specific project
Data subjects may include, in particular, the customer's customers, prospective customers, contacts at business partners, the customer's employees, users of portals, shops, workspaces and apps, website visitors and support contacts.
Special categories of personal data
The agreed data scope, including any permitted special categories, is specifically described in the annex to the data processing agreement. Functions and notices are aligned with that scope. General free-text fields do not automatically extend the agreed scope.
schukai does not proactively review content. If either party identifies processing outside the agreed scope, the parties clarify it without undue delay and restrict it until a lawful solution is in place.
Technical and organisational measures
The technical and organisational measures are maintained as an annex to the data processing agreement. The public description is deliberately specific but does not contain internal tool names, hostnames or security-critical details.
Physical security
- Lockable rooms, door locks and key management for our own operating areas
- Alarm system, motion detectors and video surveillance of relevant entrances
- Visitor rules and accompanied access
- No publicly accessible server rooms
- Fire protection, smoke detectors, uninterruptible power supply, temperature monitoring and carefully selected service providers
Access and permissions
- Individual user accounts instead of shared administrator accounts in normal operation
- Secure passwords and two-factor authentication for administrator or critical access
- Roles and permissions with access on a need-to-know basis
- Event-driven permissions reviews, particularly when roles change or a person leaves
- Key-based SSH access without password-based SSH
- Zero-trust approach: systems and work devices are secured individually; access is not trusted solely because of network membership.
Encryption and secrets
- HTTPS/TLS for web access and API communication
- Encrypted email transport where the receiving system supports it
- Encrypted backups, storage media and work devices
- Protected management of secrets, credentials and keys
- No storage of user passwords in plain text
- Server-side encryption for S3/object storage where supported by the provider and project
Logging and monitoring
- Server and application logs
- Logging of administrative actions, logins and access events
- Monitoring of errors and security events using our own operating tools
- Access-restricted storage of log data
- Retention only for operation, security, evidence or statutory duties
- No permanent comprehensive logging of all user content and no proactive monitoring of customer data content
Backup and recovery
- Regular backups stored separately
- Encrypted backups and monitoring of backup runs
- Recovery tests and a restart plan
- Protection against accidental deletion or data loss
- Customers are notified of maintenance windows or planned maintenance
- No blanket promise of redundant infrastructure unless agreed in the specific contract or SLA
Tenant separation and operating models
Dedicated servers, databases and storage areas may be used for independent customer projects, larger projects or more extensively customised setups.
Smaller hosted sites or Workspace/portal instances may be operated with tenant separation within shared systems. In shared systems, separation is logical, using strict tenant, role and permissions models.
Storage and backups follow the respective operating model. Shared databases may technically require backups covering the whole system; access, recovery and export remain restricted by tenant or purpose.
Production, test and development environments are separate. Production data are not copied into test or development environments without a reason. Where production data are needed for support, error analysis or migration, their use is purpose-limited and access-restricted.
Subprocessors and operating service providers
Depending on the project, the following providers or internal operating areas may be involved in the standard operation of hosted customer projects:
- Our own data centre in Landsberied for hosting, email and operation
- DigitalOcean for hosting, individual systems, self-operated Jitsi and, where applicable, object storage
- AWS in Frankfurt or EU regions for hosting or S3/object storage, depending on the project
- Cloudflare for DNS, CDN and security where project traffic or customer domains pass through it
- schukai's own operating, support, monitoring and administration tools
New subprocessors are engaged only on the basis of prior specific or general written authorisation. Where general authorisation has been given, schukai provides timely advance information about the intended change, including the provider, service and data protection implications, so that the customer can object.
Urgent replacement measures are enabled through previously authorised fallback providers or specific authorisation obtained in good time. Notification solely after the event does not replace the required prior authorisation.
Payment services
Payment services such as PayPal, Mollie, Stripe, Amazon Pay, Google Wallet or comparable providers are usually integrated only technically. Customers generally conclude the contracts with these payment services themselves.
These providers are therefore not automatically schukai's subprocessors. If schukai itself engages payment services for a customer project or processes payment data on the customer's behalf in an individual case, this is regulated specifically for the project. The data protection role depends on the provider, contractual model and payment flow.
Transfers to third countries
Processing generally takes place in Germany, within the European Union or within the European Economic Area. Standard locations include, in particular, our own data centre in Landsberied and EU regions of AWS and DigitalOcean, depending on the project.
Depending on configuration and service, Cloudflare may technically involve worldwide traffic protection, CDN or DNS processing. The applicable legal bases and safeguards, such as the EU-US Data Privacy Framework and standard contractual clauses, are documented in the subprocessor and third-country transfer list.
Deletion and return
After processing on behalf of the customer ends, schukai returns or deletes personal customer data, including existing copies, at the customer's choice, unless a statutory storage obligation prevents this. Agreed export and retrieval periods are taken into account.
Separate purposes, legal bases and retention periods apply to our own business and billing records required by law. They do not provide blanket authorisation to continue storing customer content processed on behalf of the customer.
In shared or pooled operating models, data may technically remain in blocked backups until the agreed backup rotation expires. Backup data are not actively processed further and are overwritten or deleted during rotation. After a recovery, deletions already initiated are carried out again.
Instructions, support and our own operational systems
Instructions are given in text form, for example by email, customer portal, support ticket or documented project communication. Oral instructions are envisaged only in urgent exceptional cases and are subsequently confirmed in text form.
schukai may access customer systems for error analysis, maintenance, migration, support and operation insofar as necessary for the respective purpose. Access is by authorised persons on a need-to-know basis and is appropriately logged.
schukai uses its own operating, support, monitoring and administration tools to provide services. These may process project-related metadata, technical log data, support communications, error descriptions, contact details and status information.
Inspection rights and audits
schukai provides the information necessary to demonstrate compliance with the obligations under the data processing agreement and enables the checks required by law, including necessary inspections. Suitable, current independent evidence may be used initially.
Further checks are organised according to risk, while respecting legitimate confidentiality interests and protecting other customers. This does not constitute a blanket exclusion of checks required by law.
For shared or pooled offerings, customer-specific checks do not include unauthorised access to other customers' data or security-critical infrastructure details. Checks must be proportionate and must not jeopardise security, operation, confidentiality or other customers' rights.
Personal data breaches
schukai informs the controller without undue delay after becoming aware of a personal data breach insofar as the controller's personal data are affected.
An initial notification provides the information available at that time; necessary additions follow. Notification is not postponed until all investigations have been completed. Further deadlines apply where required by law or agreed in the individual contract.
Versioning and evidence
To evidence the agreement, the relevant documents are versioned and assigned to the respective contract. Depending on how the agreement is concluded, records may include, in particular, the organisation, authorised representative or agent, time, document type, document version and document hash.
- Data processing agreement version
- Technical and organisational measures version
- Subprocessor version
- Time and evidence of agreement
- Document hash of the agreed version
This makes it possible to trace which specific document version was agreed for which contract.
Contact for data protection questions
Please send questions about processing on behalf of customers, data protection documents or concluding the agreement to hey@schukai.com.
This page provides the current public information version. The specific data processing agreement is agreed with a clearly identified version for the respective contract.