Privacy policy
Last updated: October 2, 2026
This privacy policy explains how we process personal data when you visit eushopkit.com, when you use EU Shop Kit as a merchant, and when you use the withdrawal function in an online shop that uses EU Shop Kit. We provide this information under Articles 13 and 14 of the General Data Protection Regulation (GDPR).
1. Who we are
EU Shop Kit is operated by Synexco Digital, B-13-06 Sunway Geo Residence, Bandar Sunway, 47500 Subang Jaya, Selangor, Malaysia, a business registered with the Companies Commission of Malaysia (SSM) under no. 202603052366 (SA0649630-T) (“we”, “us”, “our”).
- Privacy questions: privacy@eushopkit.com
- General support: support@eushopkit.com
2. Overview
| Who you are | Our role | Section |
|---|---|---|
| Visitor of our website | Controller | 3 |
| Merchant using EU Shop Kit (a Wix site owner or their staff) | Controller | 4 |
| Shopper using the withdrawal function in a merchant’s shop | Processor for the merchant | 5 |
Sections 6 to 13 apply to everyone.
3. Visitors of our website
Our website uses no cookies, no analytics and no tracking, and it doesn’t load content from third parties.
Server logs. When you open a page, our servers process the technical data needed to deliver it, including your IP address. Your IP address is used only briefly, in memory, to deliver the page and to limit abusive request rates; it is not written to our logs. The logs record the date and time of the request, the page requested and technical information about the response.
- Purpose: delivering the website, keeping it secure and detecting abuse.
- Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
- Retention: 3 days, then deleted automatically.
Free compliance check. If you use the free check on our website, we load the public web page whose address you enter and show you what we found. We don’t store the address or the results: they’re kept in memory for up to an hour, so repeated checks don’t load the same site again. To prevent abuse, your IP address is used in memory to limit how many checks you can run.
- Purpose: providing the check and protecting it from abuse.
- Legal basis: our legitimate interest in offering the check and keeping it secure (Art. 6(1)(f) GDPR).
Protection against attacks. Our website and app are delivered through the network of Cloudflare, Inc., which filters attacks and abusive traffic before it reaches our servers. For this, Cloudflare processes your IP address and the technical data of each request on our behalf.
Emails to us. If you email us, we process your email address, your message and any other data you include, in order to answer you.
- Legal basis: steps taken at your request before entering into a contract, or the performance of a contract (Art. 6(1)(b) GDPR); otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
- Retention: as long as needed to deal with your request, and longer only where the law requires us to keep it.
4. Merchants using EU Shop Kit
Data we process
Data we receive from Wix when you install and use the app:
- your Wix site ID, site name and site address (URL);
- the email address of the site owner;
- your site’s time zone and language;
- the business information in your Wix site settings (business name, address, email address and phone number), which we use to prefill your business details;
- your plan and billing status from Wix (we never receive your payment details);
- your Wix user ID when you open the EU Shop Kit dashboard;
- your store’s catalogue: product names, pictures and prices.
Data you enter in the app: your business details (legal name, address, contact email address and phone number), the email addresses that receive withdrawal notifications, your settings, and manufacturer and responsible-person profiles. Profiles can include the names and contact details of people.
Usage data: a log of actions taken in the dashboard, such as changes to settings, status changes and exports, with your Wix user ID and the time. Dashboard sessions use short-lived tokens and no cookies. Our servers also keep technical logs, as described in section 3.
Communications: the emails we send you, such as withdrawal notifications and service notices, with their delivery status, and your messages to our support.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing EU Shop Kit under our Terms of service: set-up, settings, storefront elements, notifications and plan features | Performance of a contract (Art. 6(1)(b) GDPR) |
| Keeping the service secure, preventing abuse, tracing changes and fixing errors | Our legitimate interest in a secure and reliable service (Art. 6(1)(f) GDPR) |
| Telling you about changes to the service, to these documents or to our sub-processors | Performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in informing our customers (Art. 6(1)(f) GDPR) |
| Meeting legal obligations, for example record-keeping duties | Legal obligation (Art. 6(1)(c) GDPR) |
Retention
We keep merchant data while EU Shop Kit is installed on your site. When you uninstall the app, we delete your shop’s data 30 days later. If you reinstall within those 30 days, your data is restored. Deleted data remains in encrypted backups for up to 7 days. We keep a record that a shop’s data was deleted, without personal data. Support emails are kept as long as needed to deal with your request.
5. Shoppers using the withdrawal function
Online shops built with Wix can use EU Shop Kit to provide the online withdrawal function required by EU law. When you use it, the shop is responsible for your data as the controller. We process your data only on the shop’s behalf and according to its instructions, under a data processing agreement (Art. 28 GDPR).
When you withdraw through the function, we process the following for the shop:
- your name, email address and order number;
- the products you withdraw from, and any order details you enter;
- your withdrawal statement, your optional message, the date and time of receipt and your language;
- data about your order from the shop’s Wix store, to check that the order number and email address match;
- your IP address, which we store only as a keyed hash, to protect against abuse;
- the delivery status of your confirmation email;
- technical data in our server logs, as described in section 3.
We use this data only to receive and document your withdrawal, to send you the acknowledgement of receipt and to notify the shop. We don’t use it for our own purposes. The EU Shop Kit elements on the shop use no cookies, no tracking and no advertising.
The shop decides how long your withdrawal is kept as proof, between 1 and 10 years.
For more information and to exercise your rights, please see the shop’s privacy policy and contact the shop. If you contact us, we’ll forward your request to the shop.
6. Recipients
- Amazon Web Services EMEA SARL (Luxembourg) hosts our servers and database and delivers our emails (Amazon SES), in Frankfurt, Germany. See our list of sub-processors.
- Cloudflare, Inc. (USA) delivers our website and app through its network, protects them against attacks and forwards the emails sent to our @eushopkit.com addresses. See our list of sub-processors.
- Wix.com Ltd. is the platform the merchant uses. Data reaches us from Wix at the merchant’s instruction. Wix processes data under its own terms and privacy policy.
- The shop, when a shopper uses the withdrawal function: the shop receives the withdrawal and the shopper’s details.
- Authorities, where the law requires us to disclose data.
We don’t sell personal data.
7. Where data is processed
We host all data in the European Union, with Amazon Web Services in Frankfurt, Germany.
We are established in Malaysia, for which the European Commission has not adopted an adequacy decision, and we may access personal data from there for support and operations. Where we access personal data on a merchant’s behalf, the transfer is covered by the European Commission’s Standard Contractual Clauses (Module Two, controller to processor), which are part of our Data processing agreement.
Cloudflare may process data outside the European Economic Area. It is certified under the EU–US Data Privacy Framework, and its data processing addendum includes the Standard Contractual Clauses.
You can ask for a copy of these safeguards at privacy@eushopkit.com.
8. Security
We protect personal data with technical and organisational measures, including:
- encryption in transit (TLS) and at rest, plus field-level encryption of shoppers’ personal data, bound to each shop;
- keyed hashes instead of plain email addresses and IP addresses for lookups;
- separation of each shop’s data, enforced by the database;
- withdrawal records whose content the application can’t change or delete;
- access to production systems limited to the operator, with multi-factor authentication;
- encrypted daily backups.
The full list is in Annex 1 of our Data processing agreement.
9. Retention overview
| Data | Retention |
|---|---|
| Website server logs | 3 days |
| Merchant data | While the app is installed; deleted 30 days after uninstalling |
| Withdrawal records | The period the merchant sets (1 to 10 years, 3 by default), or until 30 days after the merchant uninstalls, whichever comes first |
| Backups | Up to 7 days |
| Support emails | As long as needed to deal with the request |
10. Your rights
Under the GDPR you have the right to:
- access your personal data (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict processing (Art. 18);
- receive your data in a portable format (data portability, Art. 20);
- object to processing based on our legitimate interests (Art. 21);
- lodge a complaint with a supervisory authority, in particular in the EU country where you live, work or where an alleged infringement took place (Art. 77).
To exercise your rights, email privacy@eushopkit.com. We may need to confirm your identity. We answer within one month, which can be extended by two further months for complex requests (Art. 12(3) GDPR).
If you’re a shopper and your request concerns a withdrawal, please contact the shop, which is the controller (see section 5).
11. Automated decisions
We don’t make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). EU Shop Kit never blocks a withdrawal: the shop decides how to handle each request.
12. Do you have to provide your data?
- Merchants: we need the data described in section 4 to provide EU Shop Kit. Without it, the app can’t work.
- Shoppers: to use the withdrawal function, you need to give your name, your email address and details of your order. You can also withdraw in other ways, for example by contacting the shop directly.
13. Changes to this policy
We update this policy when our processing changes. The date at the top shows the latest version. We inform merchants of significant changes by email.
Contact
Synexco Digital
B-13-06 Sunway Geo Residence, Bandar Sunway
47500 Subang Jaya, Selangor, Malaysia
privacy@eushopkit.com