Data processing agreement under Art. 28 GDPR
When you use My Store Locator, we process personal data on your behalf. Here's what the data processing agreement (DPA) covers and how to conclude it.
Note: This page summarises the key points. The DPA you download in the app is what counts. This English version is for convenience; the German version (AV-Vertrag) is authoritative.
Last updated: 13 October 2026
What it's about
Under Art. 28 GDPR you need a data processing agreement if a service provider processes personal data on your behalf and on your instructions. That is the case with My Store Locator: you decide which data you store in the application and show on your website. We provide the technology and process the data only to deliver the service to you.
You remain the controller under the GDPR. The processor is Internet am Dornbusch, owner Sajjad Hanifa, Eschersheimer Landstraße 297, 60320 Frankfurt am Main, Germany – the provider of My Store Locator.
What the DPA covers
The DPA contains the points required by Art. 28(3) GDPR, in particular:
- subject matter, duration, nature and purpose of the processing
- types of personal data and categories of data subjects
- processing only on your documented instructions
- confidentiality obligations for people with access to the data
- technical and organisational measures (TOMs) under Art. 32 GDPR
- conditions for engaging sub-processors
- assistance with data subject requests and with your obligations under Art. 32 to 36 GDPR
- deletion or return of data when the contract ends
- audit and information rights
How to conclude the DPA
- Log in to the app.
- Open "Plan & billing".
- Click "Download DPA (GDPR)".
- File the document with your data protection records and add the processing to your record of processing activities.
You can also find the DPA and an overview of the technical measures in the settings under "Privacy".
The DPA is part of the usage contract (Section 9 of the terms). It is concluded when you register or book a plan; no signature is needed, the electronic format is sufficient (Art. 28(9) GDPR). The document in the app is for your records.
Data and data subjects
| Category of data subjects | Data |
|---|---|
| Your locations or their contact persons | Location data you maintain: name, address, coordinates, phone, e-mail, opening hours, custom fields – insofar as these relate to individuals (e.g. contact persons, owners of small locations) |
| Visitors to your website | Enquiries sent via the map's contact form (the details visitors enter); technical connection data when the map loads |
| Your team | User accounts: name, e-mail address, role, login and log data (audit log) |
Map usage statistics only store aggregated daily totals, without cookies and without IP addresses.
Technical and organisational measures (summary)
- Hosting in Germany: the application and database run on servers operated by us in data centres of STRATO GmbH in Germany.
- Tenant isolation: each company's data is separated at database level (row level security).
- Password protection: passwords are stored hashed with Argon2.
- Access control: roles for Owner, Administrator, Editor, Store manager (own locations only) and Viewer.
- Logging: changes are recorded in an audit log.
- Abuse protection: request rate limits.
- API keys: stored only in hashed form and shown once.
- Data export: you can export your data at any time as a ZIP file (CSV/JSON).
- Data minimisation: statistics without cookies and without storing IP addresses.
The full TOM description is part of the DPA. Two-factor sign-in is coming soon.
Sub-processors
| Sub-processor | Service | Place of processing |
|---|---|---|
| STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin | Data centre and server infrastructure for the application and database (the servers are operated by us) | Germany |
| IONOS SE, Elgendorfer Str. 57, 56410 Montabaur | E-mail sending and mailboxes (for example invitations and notifications) | Germany |
Payment processing via Stripe only concerns your own contract and payment data as a customer, not the data you process in My Store Locator; Stripe is therefore not a sub-processor. Your website visitors' browsers load OpenStreetMap tiles directly once the map is loaded; see the GDPR & security page.
We will inform you in advance about new or changed sub-processors so that you can object. Details are set out in the DPA.
Questions
For questions about the DPA or data protection, contact us at info@my-store-locator.com, by phone at +49 69 34 87 77 44 or via the contact form. More information on the GDPR & security page.