Privacy Policy

1. Who handles your data

[LEGAL OPERATOR NAME], [BUSINESS POSTAL ADDRESS], operates shodesk and is the controller for personal data used to run the website, administer shodesk accounts, provide direct support and protect the service. For privacy questions, contact [MONITORED PRIVACY EMAIL].

When a merchant connects a store, the merchant generally acts as controller for personal data about its shoppers and staff. Shodesk processes those data on the merchant’s documented instructions to provide the service, subject to applicable law and the merchant’s data processing agreement. If you are a shopper, contact the merchant for requests concerning your order or customer profile. Shopify and other providers may act as separate controllers for their own services.

2. Data we receive and why

• Website and security data. The hosting and network services may receive IP addresses, browser information, requested URLs, timestamps and request or error logs to serve pages, diagnose faults and prevent abuse. Our legitimate interests are reliable delivery and security.
• Account and support data. We receive your email address and the information you provide when creating an account or contacting support. The app stores password hashes and uses account-verification and session data. We use these details to provide your account, authenticate you and respond to support requests. We rely on contract necessity where the contract is with you and on legitimate interests in service delivery and security where you represent a merchant or the processing is needed to protect the service.
• Store connection and subscription data. We receive Shopify store identifiers, authorized connection credentials, and plan and subscription information to connect and maintain a store and check plan access. Where Shopify bills for a plan, Shopify handles the payment credentials. We use these data to perform the contract where applicable, administer the service and comply with legal obligations where required.
• Merchant-directed store data. Depending on permissions and features, Shopify supplies product and inventory data, customer names and contact information, shipping and billing addresses, order records, notes, discounts, payment and refund status, and fulfillment and tracking information. Merchants may also enter shipping, pricing, cost or operational information. The app processes and can store these data to sync and manage the catalog and orders, calculate prices and shipping rates, generate selected feeds, and back up or restore store data. The merchant determines its lawful basis for this processing.

Account authentication data are required to sign in. Store permissions and relevant store data are required for features that depend on them. Optional integrations and exports are enabled by the merchant. Do not submit special-category personal data, full payment-card numbers or passwords through notes, feeds or support messages.

3. Cookies and similar technologies

The static website files contain no analytics, advertising scripts or cookie-setting code. Hosting and security providers may set cookies when needed for security or network operation. The application uses session and authentication technologies to keep sign-ins secure and support access from Shopify. Blocking essential cookies may prevent login or connected features. [CONFIRM LIVE HOST AND APPLICATION COOKIE NAMES, PURPOSES, DURATIONS AND ANY ADDITIONAL CONSENT REQUIREMENTS.]

4. Who may receive personal data

Personal data are made available only as necessary for the purposes described here. Recipients may include authorized service personnel, infrastructure and email providers, Shopify, and authorities where disclosure is legally required. When an integration is enabled, a carrier such as DHL may receive data needed for a quote or shipment. When configured by the operator, Google Drive may store encrypted backup files. [CONFIRM LIVE PROVIDERS, ROLES AND SUBPROCESSOR LIST.]

Merchants control which fields they include in exports and which recipients receive them. Anyone with a valid feed link may be able to retrieve the selected data. Keep feed links private and exclude personal data from feeds intended for public use.

5. International transfers

[CONFIRM HOSTING, SUPPORT AND PROVIDER LOCATIONS, INCLUDING REMOTE ACCESS, AND IDENTIFY ANY TRANSFERS OUTSIDE THE EEA.] Where a transfer is subject to GDPR transfer restrictions, the applicable safeguard must be identified here, such as an adequacy decision or European Commission standard contractual clauses. Contact the privacy address above for information about the applicable safeguards and how to obtain a copy.

6. Retention, account deletion and uninstall

We retain personal data for the purposes described above. Relevant criteria include whether an account or store is active, the merchant’s instructions, the need to investigate security incidents or resolve disputes, and applicable legal retention requirements. [CONFIRM LIVE RETENTION OR DELETION CRITERIA FOR LOGS, SUPPORT, STORE DATA, AND BACKUPS, INCLUDING AFTER UNINSTALL.]

Eligible merchants may request shodesk account deletion from their account settings. Deleting a shodesk account does not delete the original Shopify store records. Encrypted backup copies may remain until the applicable retention period expires. The merchant is responsible for copies it has downloaded or forwarded.

7. Security and incidents

The application uses access controls, email verification for sign-in and encrypted backup files. We limit the use of personal data to the purposes of the service and handle suspected breaches under applicable law and merchant agreements. If a breach affects data we process for a merchant, we notify the merchant without undue delay as required by law. Contact the privacy address above to report a suspected disclosure involving personal data.

8. Your privacy rights

Depending on the law that applies, you may have rights to access, correct or erase personal data, restrict processing, receive a portable copy, object to processing based on legitimate interests, and withdraw consent where processing relies on consent. Withdrawal does not affect processing that was lawful before withdrawal. You may complain to your competent supervisory authority. In Greece, you can contact the Hellenic Data Protection Authority.

Contact the privacy address above to exercise rights for data shodesk controls. We may verify your identity and, where appropriate, your authority to act for another person. If your request concerns a Shopify order or customer profile, contact the store that collected the data. We assist the merchant with requests relating to data we process on its behalf.

9. Updates

We post the current notice and its effective date at this address. We provide additional notice of material changes where required by applicable law.