Privacy policy for Fruity Pickup: Date & Slots

Who is responsible

von Heugel Marketing GmbH, Am Tannenkamp 57, 26316 Varel, Germany. Managing director: Manuel von Heugel. Commercial register: HRB 223381, Amtsgericht Oldenburg.

Contact for all privacy questions: apps@fruity-software.de

What the app does

Fruity Pickup lets the customers of a Shopify store choose a pickup day and time slot on the cart page. Checkout requires a valid pickup time, either for every order or only for orders the customer picks up. The merchant chooses which and sets pickup days, hours and closed days on a settings page in the Shopify admin.

Data about the merchant and the store

When a store installs the app, our server stores a session for that store. It contains:

• the store's myshopify.com domain
• an access token issued by Shopify and the permissions the store granted
• technical fields of the session, such as its expiry time

We need this to call the Shopify Admin API for the store, for example to save the settings and to check the setup. The legal basis is the performance of the contract with the merchant (Art. 6 (1) (b) GDPR). The session does not contain names or email addresses of staff members.

The settings of the app (pickup days, hours, closed days, texts) are stored in the merchant's own Shopify store as metafields that belong to the app. They are not stored on our server.

To find out whether a store has an active subscription, our server asks Shopify's Partner API. Shopify handles billing. We receive no payment details.

Data about the store's customers

The pickup time a customer chooses is saved by Shopify as an attribute of the cart and later of the order. It stays in the merchant's Shopify store. Our server does not receive it and does not store it.

The check in checkout runs inside Shopify as a Shopify Function. It reads the chosen pickup time, the delivery method chosen in checkout (pickup or shipping, for example), the checkout step, the language, the store's local date and time and the app's settings. It does not read names, addresses, email addresses or phone numbers.

The app does not request access to customer or order data in the Shopify Admin API. The picker on the cart page sets no cookies, uses no browser storage and contains no tracking.

Server and log files

The settings page and the webhooks run on a server of Hetzner Online GmbH in Nuremberg, Germany. Hetzner acts on our behalf.

When a merchant opens the settings page, their browser connects to this server. The server needs the IP address to answer the request. It does not write it to an access log.

The application log records technical events: the topic of a webhook and the store domain it belongs to, and errors. Our own pages load the Inter typeface from Shopify's content delivery network, which is the same network the Shopify admin uses.

Who receives data

We do not sell data and do not pass it on for advertising. Data is processed by:

• Hetzner Online GmbH, Germany, as hosting provider
• Shopify, as the platform the app is part of. Shopify processes store and customer data under its own terms and privacy policy.

How long data is kept

The session of a store is deleted when the app is uninstalled. Shopify also sends a request to erase a store's data 48 hours after uninstallation. On that request we delete any session that is left.

The settings are stored in the merchant's store and not with us. Once the app is uninstalled, we can no longer access them.

Shopify's privacy requests

Shopify forwards requests to view or erase a customer's data to every installed app. Because the app stores no customer data on our server, there is nothing to hand over or to delete for a customer. We confirm the request to Shopify.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing. To use these rights, write to apps@fruity-software.de.

You can lodge a complaint with a supervisory authority. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

Customers of a store should contact the merchant first. The merchant is responsible for the data in their store.

Changes

If the app starts to process other data, we update this policy before the change goes live.