Effective from 5 November 2026This policy describes how the Fakturoid for Shopify app (the “App”) processes personal data under Regulation (EU) 2016/679 (GDPR) and the Czech Personal Data Processing Act No. 110/2019 Coll.1. OperatorThe App is operated by Lukáš Plesník, Company ID (IČO): 06506003, registered address Slatinice 441, 783 42 Slatinice, a sole trader registered in the Czech Republic (the “Operator”, “we”).For any privacy questions, contact us at support@hextreestudio.com.2. Our roleWe process data about merchants who install the App as a controller.We process data about the merchant's customers (from Shopify orders) as a processor under Article 28 GDPR, only on the merchant's instructions and only to issue invoices. The merchant is the controller of this data and is responsible for informing their customers about the processing.3. What data we processMerchant data: the Shopify store domain, access tokens for Shopify and Fakturoid (stored encrypted), the Fakturoid account name, App settings and the email address for error notifications, if you provide one.Data about the merchant's customers: name, email, billing address and order details (line items, prices, payment method, payment status). We read this data from Shopify only when needed and pass it to Fakturoid to issue the invoice. We do not store it in the App's database.Server logs may briefly contain order identifiers and error messages. They are used only to fix errors and keep the service secure.4. Purposes and legal basisProviding the App and issuing invoices: performance of the contract with the merchant (Article 6(1)(b) GDPR).Fixing errors, sending error notifications and securing the service: our legitimate interest in the App working properly and securely (Article 6(1)(f) GDPR).We process the merchant's customer data on the merchant's instructions. The legal basis for issuing the invoice is determined by the merchant as the controller; usually it is the performance of a contract with the customer and compliance with tax laws.We do not use the data for marketing or profiling, and we do not sell it.5. Who we share data withWe share data only with providers the App cannot work without: Shopify (the store platform and App billing), Fakturoid s.r.o. (issuing invoices in your Fakturoid account), Northflank Ltd (server hosting), MongoDB, Inc. (MongoDB Atlas database) and an email service provider for error notifications.Our servers and database run in the European Union. Some providers are based outside the EU (Northflank in the United Kingdom, MongoDB in the USA). Any transfer is covered by a European Commission adequacy decision (United Kingdom, EU–US Data Privacy Framework) or by standard contractual clauses.We may disclose data to public authorities where required by law.6. How long we keep dataWe keep merchant data while the App is installed. It is deleted automatically when the App is uninstalled, and in any case once Shopify sends a shop data erasure request (shop/redact).Invoices and contacts created in Fakturoid belong to your Fakturoid account and are governed by your agreement with Fakturoid. Uninstalling the App does not delete them.Server logs are kept only for the limited time needed to fix errors.7. SecurityAll communication is encrypted (HTTPS), access tokens are stored encrypted and only the Operator has access to the systems. Requests from Shopify and Fakturoid are verified by signature or token.8. CookiesThe App runs inside the Shopify admin and uses only what is technically necessary for signing in (Shopify session tokens). We do not use analytics or advertising cookies.9. Your rightsYou have the right to access, correct, erase, restrict and port your data, and to object to processing based on legitimate interest. Send requests to support@hextreestudio.com.The merchant's customers exercise their rights with the merchant. We handle requests forwarded by Shopify (customers/data_request, customers/redact) without undue delay; because we do not store customer data in the App's database, there is usually nothing to export or delete.You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (www.uoou.gov.cz) or with the supervisory authority in your country.10. ChangesWe may update this policy, for example when App features or laws change. The current version is always available in the App, and we will inform you in advance about material changes.