Data and privacy
Who is responsible
- Your shoppers’ data: you’re the controller. EU Shop Kit processes it on your behalf, as your processor. Our Data processing agreement is part of our Terms of service and applies automatically.
- Your own data as our customer: we’re the controller. See our Privacy policy.
Your own privacy policy should cover how you handle withdrawal requests. Our list of sub-processors shows who processes data for us.
What EU Shop Kit stores
| What | Details | Why |
|---|---|---|
| Your shop | From Wix: site ID, site name and address, owner email, time zone and plan. From you: your business details and settings. | To run the app and show your details in withdrawal statements and emails |
| Your catalogue | Product names, links to product pictures, whether products are on sale, and the price history of each variant since installation | For product safety information and prior prices |
| Product safety data | The manufacturer profiles, identifiers, warnings and document links you enter | To show them on product pages |
| Withdrawal requests | Shopper name, email address, order number and items, withdrawal statement, optional message, order details the shopper typed in, time of receipt and language | As proof of each withdrawal |
| Email records | Recipient, subject, delivery status and a fingerprint (hash) of each email sent, not a copy of it | To prove what was sent and to spot failed deliveries |
| Activity log | Actions in the dashboard, such as settings changes, status changes and exports, with your Wix user ID | For security and to trace changes |
Shoppers’ names, email addresses, statements, messages and the order details they typed in are additionally encrypted, field by field, and bound to your shop.
On your storefront
- The storefront elements set no cookies and use no tracking or analytics.
- They load only data that isn’t personal, such as your settings, texts and product information. Personal data is sent only when a shopper uses the withdrawal function.
- When a shopper sends a withdrawal, their IP address is stored only as a keyed hash: a one-way fingerprint used to protect against abuse.
- Our servers keep technical logs of requests (time, page and response) for security and operations. These logs contain no IP addresses, names, email addresses or access tokens.
Where your data is hosted
- Hosting and database: Amazon Web Services in Frankfurt, Germany (EU).
- Emails: Amazon SES in the EU.
- Encryption: in transit (TLS) and at rest. Shoppers’ personal data is also encrypted field by field, as described above.
- Separation: the database keeps each shop’s data apart from every other shop’s.
The full list of security measures is in Annex 1 of the Data processing agreement.
Who can see your withdrawals
Only the site owner can open EU Shop Kit in the Wix dashboard, because withdrawal requests contain your shoppers’ names and email addresses. Other people with access to your dashboard see a message asking them to contact the owner.
How long data is kept
| Data | Kept for |
|---|---|
| Withdrawal records | The period you choose, from 1 to 10 years (3 by default), counted from receipt. Then deleted automatically. |
| Everything else | As long as the app is installed |
| All your shop’s data after uninstalling | 30 days, then deleted. Reinstalling within 30 days restores it. |
| Backups | Encrypted daily backups are kept for 7 days |
Change the retention period in Settings → Withdrawal button → Keep withdrawal records for (years). For uninstalling, see Uninstalling EU Shop Kit.
When a shopper asks about their data
As the controller, you decide how to answer. To help you:
- the search in the withdrawal inbox finds all requests with the shopper’s email address, on every plan and however old they are;
- each request’s detail view shows everything stored about that withdrawal;
- on Pro and Business, you can export your requests as a CSV file.
Withdrawal records can’t be edited, because they’re your proof. Add corrections as an internal note. If you need help with a request, for example to delete a record before its retention period ends, email support@eushopkit.com.
Updated: ·Still stuck? Email us at support@eushopkit.com