Shopently privacy policy

This policy covers the public shopently.com website, the central customer account, sign-in, purchase and operation of services, and communication with Shopently.

For data about shoppers and other persons entered into a customer's store, the customer generally remains the controller and Shopently processes the data on the customer's behalf as a processor, according to the agreement, documented instructions and service settings. The customer is responsible for their store privacy notice and lawful basis for that processing.

The data processed depends on how the service is used.

• Account and identity data, such as name, email address, account identifier and a secured password hash.
• Company and billing data, including company name, tax and register numbers, address, country, contact details, orders, plan, amounts, currency and payment status.
• Store configuration, domain and assigned-resource data, content added to the service and activity of authorised users.
• Technical and security data, such as IP address, session identifiers, browser type, event times, logs, errors and authentication attempts.
• Correspondence, support requests and complaints.
• When Google sign-in is used: Google account identifier, email address, basic profile data and information needed to confirm authentication. We do not receive the Google password.
• Payment metadata supplied by the payment provider, such as transaction identifier, amount, currency and status. We do not store full payment card details.

We receive data directly from the user, account owner or person granting access. Data may also come from Google when Google sign-in is selected, the payment provider, Poland's GUS public registers when company details are retrieved, and Shopently's technical systems.

• Account creation, authentication, order fulfilment, store provisioning, support and performance of the service — steps requested before a contract or performance of a contract.
• Billing, accounting records, tax obligations and responses to authorities — compliance with a legal obligation.
• Security, fraud prevention, diagnostics, establishing or defending claims and improving service reliability — Shopently's legitimate interests.
• Electronic marketing, analytics or other optional functions — consent where required; consent may be withdrawn without affecting earlier processing.

We disclose data only as necessary to infrastructure and hosting, email and communication, security, accounting, legal and service maintenance providers. Providers acting on our instructions are bound by appropriate data protection obligations.

Transaction data is received by the payment provider, in particular PayPro S.A., which provides Przelewy24. When Google sign-in is used, data is exchanged with Google for the selected authentication method. Data may be disclosed to authorised public bodies where required by law.

Where a provider processes data outside the European Economic Area, we use a mechanism permitted by the GDPR, such as an adequacy decision or standard contractual clauses with the required safeguards. The scope depends on the function used, particularly optional Google sign-in.

Account and contract data is retained while the service is used and afterwards for billing, claims and legal obligations. Accounting and tax records are retained for the period required by law.

After a subscription ends, a store may remain active for up to 38 hours and operational data may be deleted after 31 days. Deleted data may remain for a limited time in rotating backups until overwritten under the security schedule.

Security and diagnostic logs are kept for a period proportionate to their purpose, and correspondence until the matter and relevant claims period end. Data based solely on consent is deleted or anonymised after withdrawal unless another legal basis applies.

Depending on the legal basis, you may have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Requests may be sent to support@shopently.com. We may request additional identity confirmation where necessary to protect the account.

You may also lodge a complaint with the President of the Polish Personal Data Protection Office or your competent supervisory authority. We do not make decisions about users based solely on automated processing that produce legal or similarly significant effects.

We use necessary cookies or browser storage to maintain sessions, secure forms, remember language and currency, and protect the service. Without them, some services cannot operate correctly.

Optional analytics or marketing tools may be enabled only in accordance with applicable consent requirements. Settings can be managed through the available consent mechanism and browser controls.

We apply technical and organisational measures appropriate to risk, including encrypted connections, access controls, store data isolation, security logging, updates and backups. No method removes all risk, so users should use a unique password and protect their email account.

This policy may be updated when law, services or providers change. The effective date appears at the beginning, and active customers will be notified through an appropriate channel of material changes affecting them.

Questions and data requests should be sent to support@shopently.com.