Privacy Policy

1. Who we are

The app is operated by Bristol Marketing Kft. (Bristol Marketing Korlátolt Felelősségű Társaság), 1188 Budapest, Kisfaludy utca 9/A, Hungary. Company registration number: Cg. 01-09-408087, tax number: 32128332-2-43. Contact: info@eucompliancemail.com.

• For merchant data (store and account information) we act as the data controller.
• For customer data (the buyers of a merchant’s store) the merchant is the controller and we act as a data processor on the merchant’s behalf (Article 28 GDPR). The data processing terms in section 9 apply between us and the merchant.

2. What data we process

Merchant data

• Store domain, store name, the store’s languages, the selected plan and the number of emails sent this month.
• The store’s contact email address, used as the Reply-To address of order emails and for service notices such as the monthly email limit notice.
• The access token Shopify issues when the app is installed (used only to call the Shopify API for that store).
• App settings, including an optional custom sender domain and sender address.
• Documents (PDF files) and an optional logo uploaded by the merchant. For each uploaded PDF we store a SHA-256 checksum and the upload date so we can show which version was sent.

Customer data (received from Shopify when an order is created)

• The buyer’s email address, the order number and the language (locale) of the order.

Shopify’s order notification contains the full order, but the app reads only these three fields and discards the rest. It does not use the buyer’s name, addresses, payment details or the products ordered. Every order with a customer email is written to a sending queue (outbox) so the email can be sent and, if needed, retried — not only when the monthly email limit is reached (see section 6).

3. Why we process it

Emails sent by the app are transactional only. We never send marketing email to customers and never use their data for any other purpose, profiling or advertising.

4. Service providers (sub-processors)

Some of these providers are US companies. Where data may be accessed from outside the EEA, transfers are covered by the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

5. Custom sender domains

If a merchant on the Growth or Professional plan connects their own sender domain, we register that domain with Amazon SES and show the DNS records the merchant has to add. Once the domain is verified, emails are sent from the merchant’s address; until then they are sent from info@eucompliancemail.com with the merchant’s address as Reply-To. A sender domain can be connected to only one store. When the merchant removes or changes the domain, or uninstalls the app, we delete the domain identity the app created from Amazon SES. A domain that was already registered in our Amazon SES account before the merchant connected it is not deleted.

6. How long we keep data

• Merchant settings, uploaded documents and logos: until the app is uninstalled. They are deleted when the app is uninstalled and, at the latest, when Shopify sends the shop data erasure request (48 hours after uninstall).
• Previous versions of merchant documents: when a merchant uploads a new PDF, earlier versions that were attached to customer emails are kept together with the delivery proof (up to 5 years), so the merchant can show exactly which document a customer received. Earlier versions that were never sent are deleted 30 days after they were replaced. All versions are deleted when the app is uninstalled or Shopify sends the shop data erasure request. These files are the merchant’s own documents and contain no customer data.
• Customer data: every order with a customer email is stored in the sending queue (outbox) — not only when the monthly email limit is reached. The buyer’s email address, the order number and the language are kept until the email is sent. Sent, pending and permanently failed rows (including bounces and spam complaints) are deleted after 90 days. A customer erasure request deletes that customer’s queued rows; uninstalling the app or a shop erasure request deletes every queued row for the store. Application logs do not record customer email addresses in full: where an address appears, for example in a delivery error, it is masked (j***@gmail.com). Logs are kept for up to 30 days.
• Amazon SES may keep an address on its suppression list after a hard bounce or a spam complaint, so that no further email is sent to it.
• Delivery proofs: after a successful send we keep the shop, order number, send time, SES message id, language and the SHA-256 checksums and storage references of the attached PDFs. These records contain no customer email address. They are kept for 5 years to defend legal claims (GDPR Article 17(3)(e)) and remain after a customer erasure request (customers/redact). They are deleted when they reach five years of age, when the app is uninstalled, or when Shopify sends the shop data erasure request.
• Support emails: as long as needed to handle the request, and invoicing records as required by Hungarian accounting law.

We handle Shopify’s mandatory privacy requests (customer data request, customer data erasure, shop data erasure) automatically.

7. Security

All traffic is encrypted with TLS. Documents are stored in a private storage bucket that is not publicly accessible, separated per store. Access tokens and credentials are kept on the server only, and access to production systems is limited to the operator. We follow a written security and incident response policy and notify affected merchants without undue delay in case of a personal data breach.

8. Your rights

Under the GDPR you have the right to access, rectify and erase your personal data, to restrict or object to processing, and to data portability. Customers of a store should contact the store first, because the store is the controller of their data; we will help the store answer the request. Merchants can contact us directly at info@eucompliancemail.com.

You can also lodge a complaint with the Hungarian supervisory authority, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, naih.hu), or with the data protection authority of your own EU country.

9. Data processing terms for merchants

By installing the app the merchant instructs us to process customer data as described in this policy. We process it only on those instructions and only to send the order emails; keep it confidential; use only the sub-processors listed in section 4 (and inform merchants of changes by updating this page); apply the security measures in section 7; help the merchant respond to data subject requests; notify the merchant without undue delay of a personal data breach affecting their customers; and delete the data when the app is uninstalled.

10. Changes

We may update this policy when the app or the law changes. The current version is always available at eucompliancemail.com/privacy, with the date of the last update at the top. The Terms of use describe the service, merchant responsibilities and liability.