Privacy Policy (Datenschutzerklärung)

This Privacy Policy describes how Martin Gardemann - Synplex ("we", "us", or "our") collects, uses, and shares personal information when you install and use our Shopify applications ("Synplex Apps") and/or interact with our related services and website.

I. Responsible Person (Controller)

Supervisory Authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Ansbach.

II. Processing of Merchant Data (B2B Customers)

We process personal data of merchants (Legal Basis: Art. 6(1)(b) GDPR):

• Shopify Account Data: Store name, ID, email, and subscription details.
  Retention: Duration of contract plus statutory tax periods (6–10 years).
• Communication Data: Emails and support tickets.
  Retention: Until inquiry resolution or expiry of statutory retention periods.

III. Processing of End-Customer Data (Data Processor)

We act as a Data Processor (Art. 28 GDPR) for order items, quantities, and fulfillment locations via the Shopify API.

• Data Minimization: We do not store names, addresses, or phone numbers of end-customers.
• Aggregation: Only pseudonymized sales data is stored for forecasting.

IV. Shopify Mandatory Webhooks

To comply with Shopify's requirements, we process:

• Customers/Redact: Request for customer data deletion.
• Shop/Redact: Deletion of shop data 48h after uninstallation.
• Customers/Data_Request: Access requests for customer data.

V. Website Data Processing & Analytics

1. Website Hosting (Vercel)

Our marketing website is hosted by Vercel Inc. (USA). Vercel processes technical data (IP address, device info) of website visitors to ensure stability and security. Logs are retained for up to 3 days (Legal Basis: Art. 6(1)(f) GDPR).

2. Vercel Web Analytics

On our website, we use anonymous analytics. No cookies are used, and no personal identifiers are stored.

VI. Sub-Processors & International Transfers

Our infrastructure for the Synplex App and website relies on the following providers. All transfers to the USA are safeguarded by the EU-U.S. Data Privacy Framework (DPF) or SCCs:

VII. Your Rights

You have the right to access, rectification, and erasure. To exercise these, contact privacy@synplex.io. You may also lodge a complaint with the BayLDA Complaint Portal.

VIII. Data Processing Addendum (DPA)

Our DPA for merchants is available here: Download DPA.