Data processing agreement between the merchant and KOHEX

Version of 31 October 2026

This agreement is the processing contract provided for in article 28 of Regulation (EU) 2016/679 (the "GDPR").

1. Parties and purpose

This agreement binds the merchant who installs the "Todis Age Verification" app on its Shopify store (the "merchant") and KOHEX, which publishes it. It governs the data the app processes on the merchant's behalf, and supplements the terms of use and the privacy policy.

KOHEX, a société à responsabilité limitée (SARL, French limited liability company) with share capital of €1,000, registered with the Besançon Trade and Companies Register (RCS) under number 918 862 830, whose registered office is located at 20 allée des Sorentines, 25870 Châtillon-le-Duc, France. Intra-community VAT number: FR16918862830. Represented by Raphaël Citeau, gérant (manager).

Contact: contact@todis.eu

Publication: this agreement is published at https://shop-verify.todis.eu/legal/en/accord-traitement.html, and the French original at https://shop-verify.todis.eu/legal/fr/accord-traitement.html.

Signatory: for KOHEX, Raphaël Citeau, gérant (manager).

Acceptance: the merchant accepts this agreement, together with the terms of use, by installing or using the app. This electronic acceptance constitutes writing within the meaning of article 28(9) of the GDPR.

2. Roles

For the data of the buyers of its store, the merchant is the controller; KOHEX is the processor for the app (shop-verify), including for the verification performed by Todis, a KOHEX service.

For identity document verification (terms, article 2a), the processing of the images of the face and of the document takes place on the buyer's device only, on behalf of the merchant, who is its controller. KOHEX provides the program that runs it, receives none of this data and processes, as processor, only the answer about age.

For the merchant's own data (store domain, billing, Early Bird right, support), KOHEX is the controller; this data is outside the scope of this agreement and is described in the privacy policy, article 3a.

3. Nature, purposes and duration of the processing

Purposes, and these only:

• verify the age of buyers before payment for a cart that contains an age-restricted product, through Todis or, if the merchant has turned it on, through identity document verification in the buyer's browser;
• check, when the order is created, the verification it carries; put the shipping on hold if this check fails, and add the "age verified" tag if it succeeds;
• release the hold after a new successful verification;
• release the payment block for a buyer accepted by the merchant after review;
• answer the access and erasure requests forwarded by Shopify;
• bill the merchant, with no buyer data;
• monitor the service, with no buyer data.

Nature: automated collection, recording, consultation, comparison, limited storage and erasure. Identity document verification also involves an image comparison performed on the buyer's device, none of which is sent to KOHEX (article 4).

Duration: that of the app's installation, then the time needed for erasure (article 11).

4. Data subjects and categories of data

Data subjects: the store's buyers who go through age verification, or whose order contains an age-restricted product. No data of the merchant's staff: the app uses no online session.

Categories of data:

• the buyer's wallet presentation and verified attributes, processed by Todis in memory only, 15 minutes at most, never sent to the app;
• images of the buyer's face and identity document and text read from the document, including the dates of birth and expiry, processed in the buyer's browser only, for the duration of the verification, never sent to KOHEX or kept; only the answer about age results from them (privacy policy, article 4a);
• cart identifier (without its access key);
• order identifier, date, reason for a failure, fulfillment orders and holds placed by the app, "age verified" or "age accepted by merchant" tag added to the order;
• merchant authorisation links (identifier, dates, cart identifier when used);
• outcome of the verification, returned by Todis or by the buyer's browser (18 or over, under 18, or failure), with the method used, linked to a technical verification identifier;
• identifier of an accepted verification;
• identifiers of access requests and of the orders they cite.

Excluded data: the app neither receives nor keeps any identity data of the buyer, no name, no email, no phone number, no address, no customer identifier. No level 2 protected customer field is read. KOHEX neither receives nor keeps any special category of data within the meaning of article 9 of the GDPR: age is known only as "18 or over", or not. The images of the face processed on the buyer's device for identity document verification are biometric data within the meaning of that article; they do not leave that device, and their processing is based on the buyer's explicit consent (privacy policy, article 4a).

The details of the data, their uses and their retention periods are in the privacy policy, articles 3, 4, 4a, 5 and 8.

5. Merchant's instructions

KOHEX processes the data only on the merchant's documented instructions. These instructions are this agreement, the terms of use and the merchant's settings in the app (tagged products, app embed, checkout rule, activation of identity document verification, sending of the verification link), including with regard to transfers outside the European Union (article 13).

If KOHEX considers an instruction to infringe the GDPR or another data protection rule, it informs the merchant and does not carry it out. If Union or Member State law requires KOHEX to process data, it informs the merchant before processing, unless that law prohibits it.

6. Sub-processors

General authorisation: the merchant authorises KOHEX to use the following sub-processors.

Backup copies also go to a KOHEX server in France, encrypted; monitoring runs on the same server, with no buyer data.

Todis is a KOHEX service, not a sub-processor.

Shopify is not a sub-processor of KOHEX: it is the merchant's provider. What the app reads and writes at Shopify is described in the privacy policy, article 3.

Obligations imposed: KOHEX imposes on each sub-processor, by contract, data protection obligations equivalent to those of this agreement, in particular sufficient security guarantees. KOHEX remains fully liable to the merchant for the performance of their obligations.

New sub-processor: KOHEX announces it to the merchant 30 days before it processes data, by email and in the app. A merchant who objects on reasonable data protection grounds may terminate the agreement and the terms by uninstalling the app, at no cost.

7. Security and confidentiality

Measures in place:

• encrypted exchanges: HTTPS for what Shopify, the store and the buyer call; TLS with Todis, over a dedicated private network, with authentication and signed messages;
• separate test and production environments;
• machines filtered from the internet, administration by key only;
• secrets in a vault, never in the code;
• app database encrypted at rest; encrypted backup copies, whose restoration is tested regularly;
• no buyer data in logs or metrics;
• minimisation: only the data needed is received from Shopify;
• identity document verification run on the buyer's device, with no transmission of images or document data; no third-party service called by that page.

KOHEX may change these measures, provided it does not reduce the level of security.

Who accesses the data. Only persons authorised by KOHEX, to the extent their duties require, starting with Raphaël Citeau, gérant (manager). These persons are bound by confidentiality through a written undertaking or a legal obligation.

8. Assistance to the merchant

• Access requests: the app's "Data access requests" page shows the merchant the data held on each order cited by a request that Shopify forwards, with the 30-day deadline and a text to pass on to the buyer.
• Erasure requests: the app immediately erases the data of the orders Shopify forwards to it (customers/redact).
• Other rights: if a buyer contacts KOHEX directly, KOHEX forwards the request to the merchant without answering it itself.
• Buyer's recourse against an automated decision: human review is the merchant's (privacy policy, article 7).
• Impact assessment: KOHEX provides the merchant who turns on identity document verification with the description of the processing needed for its data protection impact assessment, where one is required of the merchant.
• Security, breaches, impact assessment and consultation of the authority: KOHEX helps the merchant comply with articles 32 to 36 of the GDPR, taking into account the nature of the processing and the information available to it, in particular through the documentation in article 12. This help is free of charge within reason; beyond that, it may be charged with the merchant's agreement.

9. Retention periods

Those of the table in the privacy policy, article 8.

The store's data and the Early Bird right follow article 11.

10. Data breach

• To the merchant: KOHEX notifies the merchant of any breach of the merchant's data, actual or suspected, by email to the store's address registered with Shopify, within 24 hours of becoming aware of it. The notification contains, with what is known at that time: the nature of the breach, the categories and approximate number of data subjects and records concerned, the point of contact for follow-up, probable consequences, and measures taken or proposed. These elements are provided as they become known, if they are not all known immediately. Notifying a breach to the supervisory authority and to buyers remains the decision and responsibility of the merchant, as controller.
• To Shopify: KOHEX notifies Shopify of any breach, actual or suspected, of merchant data, immediately upon becoming aware of it and no later than 24 hours after, as Shopify's terms require.

Notification of a breach by KOHEX does not constitute an admission of liability.

11. End of processing, erasure and return

• Return: a merchant who wants a copy of the data processed on its behalf requests it at contact@todis.eu before uninstalling; KOHEX provides it in a readable format. Failing such a request, the merchant chooses erasure.
• Uninstallation: the app session, the billing status and any Early Bird reservation are erased immediately; the store's licence at Todis is suspended.
• Store erasure request (shop/redact, which Shopify sends 48 hours after uninstallation): all of the store's data is erased within the request, well before the 30-day deadline, except what "What remains" lists; the app asks Todis to anonymise the store's licence (domain and return addresses erased), and repeats the request until it is confirmed.
• What remains: the Early Bird right of a store that bought it, merchant data processed by KOHEX as controller (article 2); and technical identifiers, without domain or buyer data, for the time needed to complete the erasure, 32 days at most in normal operation.
• Backup copies: erased data leaves them 30 days at most after the erasure, in normal operation.

12. Documentation and audits

KOHEX makes available to the merchant, on request, the documentation needed to demonstrate compliance with this agreement. The merchant may have one audit per year carried out, by itself or by an independent auditor bound by confidentiality and not a competitor of KOHEX, on 30 days' notice, during business hours, without disrupting the service or accessing other merchants' data, and at its own expense. An additional audit is possible after a data breach that concerns the merchant or at the request of a supervisory authority.

13. Transfers outside the European Union

The virtual machines of the app and of Todis (Scaleway, Paris) and the encrypted backup copies (OVH, Gravelines, and the KOHEX server) are in France. No buyer data leaves the European Union.

Only monitoring alerts, which carry only the store's licence identifier, may be processed in the United States by Slack Technologies, LLC. This transfer is covered by the EU-US Data Privacy Framework, in which Slack participates, and otherwise by the European Commission's standard contractual clauses.

Any other transfer outside the European Union follows the procedure in article 6 for a new sub-processor, and relies on a safeguard provided for in chapter V of the GDPR.

14. Liability, term and governing law

Liability: between the parties, liability under this agreement follows article 8 of the terms of use. This clause does not affect the rights of data subjects under article 82 of the GDPR.

Term: this agreement runs from the installation of the app until the data is erased (article 11).

Governing law: this agreement is governed by French law. Failing an amicable resolution, any dispute falls within the jurisdiction of the courts for the place of KOHEX's registered office (Besançon), including in the event of multiple defendants or third-party claims.

Language: the French text prevails; the English text is a faithful translation of it.