Privacy Policy Codixio Digital Product Passport
This privacy policy applies to the Shopware app Codixio Digital Product Passport (hereinafter the app) and to the publicly accessible product passport pages generated through the app.
1. Controller
Matthias Jakisch, Hauptstr. 34, OT Etingen, 39359 Oebisfelde-Weferlingen, Germany. Phone +49 39059 974988. E-mail general support@codixio.com, e-mail data protection and legal legal@codixio.com. Legal form: sole proprietorship (no commercial register entry), operating under the trade name Codixio. VAT identification number pursuant to Sec. 27a UStG: DE296346917. Tax status: small business under Sec. 19 UStG.
2. Scope and allocation of roles
The app is operated in two separate roles, and this distinction determines who is accountable under data protection law for which activity.
For all data originating from the merchant's shop or processed on the merchant's behalf in the course of operating the app, the merchant is the controller and Codixio is the processor. The basis for this is the data processing agreement provided for this app.
For the publicly accessible product passport pages, Codixio is an independent controller. These pages are served from Codixio's infrastructure and are accessed by any person, typically after scanning a QR code on a product or its packaging. The merchant's shop is not technically involved in this access. The data processing agreement therefore expressly does not cover this activity.
3. Processing within the merchant's Shopware context
The app creates its own data structure for product passports within the merchant's shop. Only product-related information is maintained there: title, summary, materials, origin, repair information, spare parts information, disposal information, certifications, GTIN, product category and the assignment to a product. This information leaves the shop only to the extent required to display the public product passport page (see section 5).
The app holds exclusively product-related access rights to the Shopware administration interface: reading products, dynamic product groups, languages, manufacturers, property groups and property options, and writing its own configuration key for the booked plan. It holds no rights to orders, customers, customer accounts, payment or shipping data. Access by the app to personal data of the merchant's end customers is technically impossible.
4. Processing in the Codixio backend
To operate the app, Codixio maintains a dedicated application backend at sw-codixioproductpassportapp.api.codixio.com. The following data is processed there:
Shop registration data. On installation, Shopware transmits the shop identifier, the shop address and a technical key for access to the administration interface. This information is stored for as long as the app is installed in the shop. It relates to the operation of the shop and is not used for any other purpose.
Tariff data. The booked tariff tier is stored for each shop in order to enable the corresponding scope of functions on the server side. Only the tariff tier is stored, no payment data. Billing is handled through the Shopware Store by Shopware AG; Codixio does not receive any payment data of the merchant.
Operational data of the product passports. For each product passport, a non-guessable public identifier, the selected page layout, the history of QR target changes and shop- and passport-related configuration values are stored. This data relates to products and configuration and has no personal reference.
Cached passport content. The contents of a product passport are cached briefly after retrieval from the shop so that the public page can still be served if the shop is temporarily unavailable. The cache contains the same product-related information as described in section 3.
5. Public product passport pages
When a public product passport page is accessed, Codixio processes the technically generated access data as controller: the IP address truncated by its final address block, the time of access, the requested address, the status code returned, information on the browser used and the language preference transmitted by the browser. The IP address is truncated before storage, so no complete IP address is stored.
The purpose of this processing is the technically correct delivery of the page, the assurance of stable operation and the prevention of abusive access. The legal basis is Article 6(1)(f) GDPR. The legitimate interest lies in the secure and functional operation of the service.
Access data is deleted after seven days. It is not combined with any other data set. No analysis of usage behaviour, no reach measurement, no counting or tracking of individual scans and no profiling take place.
Because access data is stored in truncated form, Codixio is generally unable to attribute an access to a specific person. Attention is drawn to Article 11 GDPR: where Codixio is unable to identify a data subject, Codixio is not obliged to obtain additional information solely in order to comply with data subject rights.
6. Free-text content entered by the merchant
Certain fields of a product passport are free-text fields, in particular repair information, spare parts information and certification details. Their content is published on the public product passport page.
The merchant is contractually obliged not to enter personal data into these fields, in particular no names, telephone numbers or e-mail addresses of individual contact persons. If a merchant nevertheless enters personal data contrary to this obligation, the merchant is the controller for that publication. In such a case Codixio processes the content on instruction within the scope of the data processing agreement and removes it upon instruction of the merchant or upon a justified complaint by a data subject.
7. Cookies and terminal equipment information
The public product passport pages do not set cookies and do not store any information on visitors' terminal equipment. No access to information already stored on the terminal equipment takes place beyond what is technically necessary to deliver the page. Consent under Sec. 25 TDDDG is therefore not required. Language selection is based on the language preference transmitted by the browser and on the address requested, not on storage on the terminal equipment.
8. No artificial intelligence, no automated decision-making
The app does not use artificial intelligence systems. No data is transmitted to providers of such systems. Automated decision-making including profiling within the meaning of Article 22 GDPR does not take place.
9. Recipients and processors
The following provider is used for hosting the application server and the database: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Processing takes place in the data centres in Falkenstein and Nuremberg, Germany. In addition, Coolify is used as self-operated open source container management on the same infrastructure; this does not involve an external service provider.
There are no further recipients. In particular, no external mail delivery providers, no analytics services, no advertising networks and no providers of artificial intelligence are used.
10. Transfers to third countries
No personal data is transferred to a third country outside the European Union. All processing takes place on servers in Germany.
11. Storage period and erasure
Registration, tariff and operational data is stored for the duration of the app's installation in the shop. If the app is uninstalled, all data stored for that shop in the Codixio backend is erased. The cache of passport content is refreshed regularly and discarded upon uninstallation. Access data of the public product passport pages is deleted after seven days.
12. Rights of data subjects
Data subjects have the right of access under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR and the right to data portability under Article 20 GDPR.
Where processing is based on Article 6(1)(f) GDPR, data subjects have the right under Article 21 GDPR to object at any time on grounds relating to their particular situation.
Requests should be addressed to legal@codixio.com. Where the data concerns a merchant's shop, Codixio forwards the request to the merchant as controller without undue delay or refers the requesting person to the merchant.
13. Right to lodge a complaint
Irrespective of the above, data subjects have the right to lodge a complaint with a supervisory authority under Article 77 GDPR. The authority responsible for Codixio is: Landesbeauftragter für den Datenschutz Sachsen-Anhalt, Leiterstraße 9, 39104 Magdeburg, Germany. Phone +49 391 81803-0. E-mail poststelle@lfd.sachsen-anhalt.de. Website datenschutz.sachsen-anhalt.de.
14. Amendments to this policy
This privacy policy will be amended if the processing carried out by the app changes, in particular in the case of new functions or new recipients. The version published at https://legal.codixio.com/apps/digital-product-passport-shopware/privacy.en applies.