Privacy Policy Collection Sync App


Introduction

With the following data protection declaration, we would like to inform you about the types of your personal data (hereinafter also referred to as "data") that we process, for what purposes and to what extent in the context of providing our application.

The terms used are not gender-specific.

Status: 4 October 2022

Table of contents

  • Introduction
  • Responsible
  • Contact Data Protection Officer
  • Overview of processing operations
  • Relevant legal basis
  • Security measures
  • Data processing in third countries
  • Deletion of data
  • Provision of the online offer and web hosting
  • Contact and enquiry management
  • Newsletter and electronic notifications
  • Web analysis, monitoring and optimisation
  • Modification and updating of the privacy policy
  • Definition of terms

Responsible

Dave Crowder  / Eshop Guide GmbH

Husemannplatz 5a
44787 Bochum

Authorised representatives:

Dave Crowder

E-mail address:

apps@eshop-guide.de

Imprint: https://www.eshop-guide.de/pages/impressum

Regarding the use of app development technology from Shopify, please read Shopify's privacy policy: https://www.shopify.com/legal/privacy

Contact data protection officer

apps @eshop-guide.de

Overview of processing

The following overview summarises the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed by Shopify

  • collection data.

Categories of data subjects

  • Communication partners.
  • User.

Purposes of processing

  • Provision of contractual services and customer service.
  • Contact requests and communication.
  • Managing and responding to enquiries.
  • Feedback.
  • Information technology infrastructure.

Relevant legal basis

Below you will find an overview of the legal basis of the GDPR on the basis of which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Should more specific legal bases be relevant in individual cases, we will inform you of these in the data protection declaration.

  • Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO) - The data subject has given his/her consent to the processing of personal data relating to him/her for a specific purpose or purposes.
  • Performance of a contract and pre-contractual enquiries (Art. 6 para. 1 p. 1 lit. b. DSGVO) - Processing is necessary for the performance of a contract to which the data subject is party or for the performance of pre-contractual measures taken at the data subject's request.
  • Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO) - Processing is necessary for the purposes of the legitimate interests of the controller or a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.

In addition to the data protection regulations of the General Data Protection Regulation, national regulations on data protection apply in Germany. These include, in particular, the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act - BDSG). In particular, the BDSG contains special regulations on the right to information, the right to erasure, the right to object, the processing of special categories of personal data, the processing for other purposes and the transmission and automated decision-making in individual cases, including profiling. Furthermore, it regulates data processing for purposes of the employment relationship (Section 26 BDSG), in particular with regard to the establishment, implementation or termination of employment relationships as well as the consent of employees. Furthermore, data protection laws of the individual federal states may apply.

Security measures

We take appropriate technical and organisational measures in accordance with the legal requirements, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

The measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, as well as access to, entry into, disclosure of, assurance of availability of and segregation of the data. We also have procedures in place to ensure the exercise of data subjects' rights, the deletion of data and responses to data compromise. Furthermore, we already take the protection of personal data into account in the development or selection of hardware, software and procedures in accordance with the principle of data protection, through technology design and through data protection-friendly default settings.

SSL encryption (https): In order to protect your data transmitted via our online offer, we use SSL encryption. You can recognise such encrypted connections by the prefix https:// in the address line of your browser.

Data processing in third countries

If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or the processing takes place in the context of the use of third-party services or the disclosure or transfer of data to other persons, bodies or companies, this will only be done in accordance with the legal requirements.

Subject to express consent or contractually or legally required transfer, we only process or have data processed in third countries with a recognised level of data protection, contractual obligation through so-called standard protection clauses of the EU Commission, in the presence of certifications or binding internal data protection regulations (Art. 44 to 49 DSGVO, information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).

Deletion of data

The data processed by us will be deleted in accordance with the legal requirements as soon as their consents permitted for processing are revoked or other permissions cease to apply (e.g. if the purpose of processing this data has ceased to apply or it is not necessary for the purpose). If the data are not deleted because they are required for other and legally permissible purposes, their processing is limited to these purposes. I.e. the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for reasons of commercial or tax law or whose storage is necessary for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person.

Our privacy notices may also contain further information on the retention and deletion of data, which will take precedence for the respective processing operations.

Provision of the app offer and web hosting

In order to be able to provide our online offer securely and efficiently, we use the services of a web hosting provider from whose servers (or servers managed by them) the app offer can be accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services as well as security services and technical maintenance services.

The data processed as part of the provision of the hosting service may include all information relating to the users of our app service that is generated in the course of use and communication. This regularly includes the Shopify shop ID and URL, which are necessary to be able to provide the functionalities of the app offer, and all entries made within our online offer or from websites.

  • Types of data processed: collection assignment data, shop ID’s, collection data.
  • Data subjects: Users of our Shopify app.
  • Purposes of processing: Provision of app functionalities and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.).).
  • Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Further information on processing processes, procedures and services:

  • Collection of access data and log files: We ourselves (or our web hosting provider) collect data on every access to the server (so-called server log files). The server log files may include the address and name of the Shopify online shop data retrieved and files uploaded, the date and time of the retrieval, data volumes transferred, notification of successful retrieval, browser type and version, the user's operating system, referrer URL (the previously visited page) and, as a rule, Shopify shop IDs. The server log files may be used on the one hand for security purposes, e.g. to avoid overloading the servers (especially in the event of abusive attacks, so-called DDoS attacks) and on the other hand to ensure the utilisation of the servers and their stability; Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO); Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymised. Data whose further storage is required for evidentiary purposes is exempt from deletion until the respective incident has been finally clarified.

Contact and enquiry management

When contacting us (e.g. via contact form, email, telephone or via social media) as well as in the context of existing user and business relationships, the information of the inquiring persons is processed to the extent necessary to respond to the contact requests and any requested measures.

The response to the contact enquiries as well as the management of contact and enquiry data in the context of contractual or pre-contractual relationships is carried out in order to fulfil our contractual obligations or to respond to (pre)contractual enquiries and, moreover, on the basis of the legitimate interests in responding to the enquiries and maintaining user or business relationships.

  • Types of data processed: contact data (e.g. e-mail, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Communication partners.
  • Purposes of processing: provision of contractual services and customer service; contact requests and communication; managing and responding to requests; feedback (e.g. collecting feedback via online form); providing our online offer and user experience.
  • Legal basis: Contract performance and pre-contractual enquiries (Art. 6 para. 1 p. 1 lit. b. DSGVO); Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Further notes on processing processes, procedures and services:

  • Contact form: If users contact us via our contact form, e-mail or other communication channels, we process the data communicated to us in this context to process the communicated request. For this purpose, we process personal data in the context of pre-contractual and contractual business relationships, insofar as this is necessary for their fulfilment and otherwise on the basis of our legitimate interests as well as the interests of the communication partners in responding to the concerns and our statutory retention obligations; Legal bases: Contractual fulfilment and pre-contractual enquiries (Art. 6 para. 1 p. 1 lit. b. DSGVO), Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).
  • Help Scout: Management of contact requests and communication; Service provider: Help Scout Inc, 131 Tremont St, Boston, MA 02111-1338, USA; Legal basis: Contractual performance and pre-contractual enquiries (Art. 6 para. 1 p. 1 lit. b. DSGVO), Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO);
    Website: https://www.helpscout.net;
    Privacy policy: https://www.helpscout.net/company/legal/privacy/;
    Order processing contract: https://www.helpscout.com/company/legal/dpa/;
    Standard contractual clauses (ensuring level of data protection for processing in third countries): https://www.helpscout.com/company/legal/dpa/.

Newsletters and electronic notifications

We send newsletters, e-mails and other electronic notifications (hereinafter "newsletters") only with the consent of the recipients or a legal permission. If the contents of a newsletter are specifically described in the course of registration, they are decisive for the consent of the users. Apart from that, our newsletters contain information about our services and us.

To subscribe to our newsletters, it is generally sufficient to provide your e-mail address. However, we may ask you to provide a name, for the purpose of a personal address in the newsletter, or further details if these are required for the purposes of the newsletter.

Double opt-in procedure: The registration for our newsletter is always carried out in a so-called double opt-in procedure. This means that after registration you will receive an e-mail in which you are asked to confirm your registration. This confirmation is necessary so that no one can register with other people's e-mail addresses. The registrations for the newsletter are logged in order to be able to prove the registration process in accordance with the legal requirements. This includes the storage of the registration and confirmation time as well as the IP address. Changes to your data stored with the dispatch service provider are also logged.

Deletion and restriction of processing: We may store unsubscribed email addresses for up to three years based on our legitimate interests before deleting them in order to be able to prove consent previously given. The processing of this data will be limited to the purpose of a possible defence against claims. An individual request for deletion is possible at any time, provided that the former existence of consent is confirmed at the same time. In the case of obligations to permanently observe objections, we reserve the right to store the e-mail address in a block list (so-called "block list") for this purpose alone.

The logging of the registration process takes place on the basis of our legitimate interests for the purpose of proving its proper course. Insofar as we commission a service provider with the dispatch of e-mails, this is done on the basis of our legitimate interests in an efficient and secure dispatch system.

Contents:

Information about us, our services, promotions and offers.

  • Types of data processed: inventory data (e.g. names, shop addresses); contact data (e.g. e-mail, telephone numbers); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Communication partners.
  • Purposes of processing: direct marketing (e.g. by email).
  • Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO); Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).
  • Option to object (opt-out): You can cancel receipt of our newsletter at any time, i.e. revoke your consent or object to further receipt. You will find a link to cancel the newsletter either at the end of each newsletter or you can use one of the contact options given above, preferably e-mail, for this purpose.

Further information on processing, procedures and services:

  • Mailchimp: email sending and email marketing platform;
    Service provider: Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA;
    Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO);
    Website: https://mailchimp.com;
    Privacy policy: https://mailchimp.com/legal/;
    Order processing contract: https://mailchimp.com/legal/;
    Standard contractual clauses (ensuring level of data protection for processing in third countries): Inclusion in the order processing contract;
    Special security measures: https://mailchimp.com/help/Mailchimp-european-data-transfers/.

Web analytics, monitoring and optimisation

Web analytics (also referred to as "reach measurement") is used to evaluate the flow of visitors to our online offering and may include behaviour, interests or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of the reach analysis, we can, for example, recognise at what time our online offer or its functions or content are most frequently used or invite re-use. Likewise, we can understand which areas need optimisation.

In addition to web analysis, we may also use test procedures, e.g. to test and optimise different versions of our online offer or its components.

Unless otherwise stated below, profiles, i.e. data summarised for a usage process, can be created for these purposes and information can be stored in a browser or in a terminal device and read from it. The information collected includes, in particular, websites visited and elements used there as well as technical information such as the browser used, the computer system used and information on usage times. If users have agreed to the collection of their location data from us or from the providers of the services we use, location data may also be processed.

The IP addresses of the users are also stored. However, we use an IP masking procedure (i.e. pseudonymisation by shortening the IP address) to protect users. In general, no clear user data (such as e-mail addresses or names) is stored in the context of web analysis, A/B testing and optimisation, but pseudonyms. This means that we as well as the providers of the software used do not know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective procedures.

  • Types of data processed: Usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: reach measurement (e.g. access statistics, recognition of returning visitors); profiling with user-related information (creation of user profiles); tracking (e.g. interest/behaviour-based profiling, use of cookies); provision of our online offer and user experience.
  • Security measures: IP masking (pseudonymisation of the IP address).
  • Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO).

Further information on processing processes, procedures and services:

  • Google Analytics: web analysis, reach measurement and measurement of user flows; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland,
    Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA;
    Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO);
    Website: https://marketingplatform.google.com/intl/de/about/analytics/;
    Privacy policy: https://policies.google.com/privacy;
    Order processing agreement: https://business.safety.google/adsprocessorterms; Standard contractual clauses (guaranteeing the level of data protection for processing in third countries): https://business.safety.google/adsprocessorterms;
    Opt-Out-Plugin: https://tools.google.com/dlpage/gaoptout?hl=de,
    Settings for the display of advertisements: https://adssettings.google.com/authenticated; Further information: https://privacy.google.com/businesses/adsservices (Types of processing as well as data processed).

Modification and updating of the privacy policy

We ask you to regularly inform yourself about the content of our data protection declaration. We adapt the data protection declaration as soon as the changes in the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

Where we provide addresses and contact details of companies and organisations in this privacy statement, please note that the addresses may change over time and please check the details before contacting us.

Definitions of terms

This section provides you with an overview of the terms used in this privacy statement. Many of the terms are taken from the law and defined primarily in Art. 4 of the GDPR. The legal definitions are binding. The following explanations, on the other hand, are primarily intended to help you understand them. The terms are sorted alphabetically.

  • Personal data: "Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • Profiles with user-related information: The processing of "profiles with user-related information", or "profiles" for short, includes any kind of automated processing of personal data that consists in using such personal data to analyse, evaluate or to predict certain personal aspects relating to a natural person (depending on the type of profiling, this may include different information concerning demographics, behaviour and interests, such as interaction with websites and their content, etc.) (e.g. interests in certain content or products, click behaviour on a website or location). Cookies and web beacons are often used for profiling purposes.
  • Reach measurement: Reach measurement (also known as web analytics) is used to evaluate the flow of visitors to an online offering and can include visitors' behaviour or interests in certain information, such as website content. With the help of reach analysis, website owners can see, for example, at what time visitors visit their website and what content they are interested in. This enables them, for example, to better adapt the content of the website to the needs of their visitors. For reach analysis purposes, pseudonymous cookies and web beacons are often used to recognise returning visitors and thus obtain more precise analyses of the use of an online offer.
  • Tracking: We speak of "tracking" when the behaviour of users can be traced across several online offers. As a rule, behavioural and interest information is stored in cookies or on servers of the providers of the tracking technologies with regard to the online offers used (so-called profiling). This information can then be used, for example, to display advertisements to users that are likely to correspond to their interests.
  • Controller: "Controller" is the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data.
  • Processing: "Processing" means any operation or set of operations which is performed upon personal data, whether or not by automatic means. The term is broad and encompasses virtually any handling of data, be it collection, analysis, storage, transmission or erasure.

Did this answer your question? Thanks for the feedback There was a problem submitting your feedback. Please try again later.