Privacy policy

Who operates Poland DSR

Poland DSR is operated by Genius Nutrition S.R.L.. For merchant account, support, security, and billing-administration data, we act as a data controller. For Shopify order, fulfillment, and return data processed to produce a merchant's reconciliation report, the merchant remains the controller and we act as its processor or service provider.

Data we process

• Shopify shop identity, installation and encrypted session-token data required to authenticate the merchant and isolate its tenant.
• Product, variant, SKU, barcode, packaging-classification, deposit, technical-line, selected-operator, and configuration-revision data.
• The minimum order, fulfillment, and return data needed for monthly reconciliation: Shopify order references, timestamps, currency, relevant line and variant identifiers, SKU/barcode snapshots, successful fulfillment quantities, deposit components, and completed-return quantities and timestamps.
• Report metadata, bounded classification/operator snapshots, and finalized XLSX bytes; webhook delivery identifiers and revision timestamps; pseudonymized operational security events.
• Customer and order identifiers supplied by Shopify in mandatory privacy webhooks, used only to locate, provide, or redact data already stored by Poland DSR.
• Support communications and contact details that a merchant chooses to send to us.

Poland DSR does not request customer names, email addresses, phone numbers, postal addresses, notes, payment-card data, or optional customer-identifying fields for reporting.

Why we process data

• Authenticate shops and enforce tenant isolation.
• Provision app-owned Shopify resources and maintain explicit variant packaging classifications.
• Itemize and validate mandatory refundable deposits in supported carts and checkouts.
• Generate, invalidate, finalize, and deliver bounded monthly reconciliation reports requested by the merchant.
• Verify the app subscription, prevent abuse, diagnose failures, comply with privacy requests, and provide support.

We limit use to these purposes. We do not sell personal data, use it for targeted advertising, or make automated decisions about people that produce legal or similarly significant effects.

Legal basis and merchant instructions

We process controller data where necessary to provide the contracted service, meet legal obligations, and protect the security and integrity of the app. We process Shopify order, fulfillment, and return data only on the installing merchant's documented instructions and only for the visible reconciliation functionality described in the app.

Service providers and disclosures

Data is disclosed only when necessary to Shopify, our hosting and database provider Railway, professional advisers bound by confidentiality, or competent authorities when legally required. These providers may process data in jurisdictions outside the European Economic Area under applicable transfer safeguards, including contractual protections where required.

Cookies and similar technologies

The public product and policy pages do not use advertising cookies or marketing analytics. The embedded app uses only the Shopify and application security mechanisms needed to authenticate the merchant, maintain the authorized session, and prevent abuse.

Retention and deletion

• Finalized and provisional report artifacts: up to 365 days.
• Processed webhook receipt evidence: up to 30 days.
• Technical automatic-fulfillment job evidence: up to 30 days after completion.
• Completed customer data-request exports and their minimal request metadata: up to 30 days after completion.
• Shop configuration, classifications, operator history, and encrypted sessions: while the app remains installed and as needed to provide the service.
• Support correspondence: only as long as needed to resolve the request and meet applicable recordkeeping duties.

Valid Shopify uninstall and erasure events delete the affected tenant's app data and report artifacts. A merchant may retain a report it has already downloaded outside Poland DSR.

Security

We use authenticated Shopify sessions, required shop identifiers, tenant-bound database access, application-level encryption for Shopify access and refresh tokens, TLS for public traffic, encryption at rest supplied by our production hosting platform, restricted runtime database credentials, bounded processing, and fail-closed authorization checks. No online service can guarantee absolute security; suspected incidents should be reported promptly to the privacy contact below.

Rights and privacy requests

A customer should normally contact the merchant that collected the order data. Shopify forwards applicable access or erasure requests to installed apps, and Poland DSR processes those requests without retaining unnecessary customer payloads. Merchants and other data subjects may also contact us to request access, correction, deletion, restriction, objection, or portability where applicable, or complain to the Romanian data-protection authority or their local supervisory authority.

Changes to this policy

We may update this policy when the app, providers, or legal requirements change. The effective date above identifies the current version. Material changes will be communicated through the app or another appropriate merchant channel.