Privacy Policy Codixio EmpCo Product Info

1. Controller

Matthias Jakisch, Hauptstr. 34, OT Etingen, 39359 Oebisfelde-Weferlingen, Germany. Phone +49 39059 974988. E-mail general support@codixio.com, e-mail data protection and legal legal@codixio.com. Legal form: sole proprietorship (no commercial register entry), operating under the trade name Codixio. VAT identification number pursuant to Sec. 27a UStG: DE296346917. Tax status: small business under Sec. 19 UStG.

2. Subject and allocation of roles

This policy concerns the Shopware app Codixio EmpCo Product Info (technical name CodixioEmpCoProductInfoApp). The app supports merchants with the pre-contractual information duties under Art. 246a Sec. 1 para. 1 nos. 11, 11a, 11c, 20 and 21 of the German Introductory Act to the Civil Code (EGBGB) as applicable from 27 September 2026, and with manufacturer information under Art. 19 of Regulation (EU) 2023/988.

For the operation of the app in the shop, the merchant is the controller within the meaning of Art. 4 no. 7 GDPR. Codixio processes the data described in section 4 on behalf of the merchant as a processor under Art. 28 GDPR. The basis is the data processing agreement at https://legal.codixio.com/apps/empco-product-info-shopware/dpa.en. Codixio is not an independent controller for third-party access: the retrieval described in section 4.4 is triggered exclusively from the merchant's storefront; the app does not serve any independently accessible public pages. The QR code contained in the guarantee label leads to the European Union's "Your Europe" portal and not to Codixio systems.

3. Data that does not leave the shop

The app creates two groups of custom fields on products and manufacturers in the merchant's shop (repairability score, spare parts, repair manuals, repair restrictions, software update period, guarantee duration and conditions, guarantor, model designation, as well as manufacturer details, responsible person, product identification, warnings and data sheet address under the General Product Safety Regulation) and stores settings per sales channel. The merchant maintains this information; it describes products, not persons. If a field contains information about a natural person (for example a sole trader as manufacturer or responsible person), the merchant is responsible for the lawfulness of that publication. The display of the information block, the harmonised notice on the legal guarantee under Annex I of Implementing Regulation (EU) 2025/1960 and the harmonised guarantee label under Annex II takes place entirely within the shop system without transmission to Codixio.

4. Processing in the Codixio backend

4.1 Registration and operation of the app

On installation, Shopware registers the app with Codixio. Processed are the shop identifier, the shop address, the Shopware version, technical access credentials for the shop's API and the times of installation, activation, deactivation and uninstallation. Purpose: provision and protection of the app. Legal basis: Art. 6 para. 1 lit. b GDPR, insofar as a merchant's details are personal data (for example for sole traders). Retention: until the app is uninstalled.

4.2 Plan data

The booked plan (Standard, Pro, Max, Enterprise) is determined from Shopware's in-app purchase system and stored together with the time of verification. Purpose: activation of the booked features. Legal basis: Art. 6 para. 1 lit. b GDPR. Retention: until uninstallation.

4.3 Administrative functions (Max and Enterprise)

The completeness report, CSV export and import (Max) as well as the compliance export and bulk assignment (Enterprise) read and write product and manufacturer information via the shop's API at the moment of use. This information is not stored permanently in the backend; uploaded import files are discarded after processing. Requests from the administration are signed and contain the shop identifier, no user identifier.

4.4 Retrieval of supplementary product information from the storefront (Pro and above)

From the Pro plan onwards, the merchant's storefront retrieves supplementary product information (manufacturer details under the General Product Safety Regulation, values inherited from the manufacturer) from the Codixio backend when a product page is opened. Transmitted are the shop identifier, the product identifier and the language code; for technical reasons the backend also receives the IP address and browser identifier of the device. The IP address is held exclusively in truncated, hashed form for no more than 60 seconds in a cache to limit the request rate and is stored neither in the database nor in logs; identification is therefore not possible (Art. 11 GDPR). The response contains product information only, without personal data, and is cached for five minutes. Processing takes place on behalf of the merchant; the merchant names Codixio as processor in its own privacy policy and regularly relies on Art. 6 para. 1 lit. c GDPR in conjunction with its statutory information duties. No retrieval takes place in the Standard plan.

4.5 Compliance copies (Enterprise)

On a compliance export per sales channel, the backend stores per product a copy of the field values maintained at that time together with a timestamp, the sales channel identifier and the product identifier. Purpose: documentation of which information was displayed when. Legal basis: Art. 6 para. 1 lit. b GDPR in relation to the merchant; section 3 applies to any personal field content. Retention: 24 months from creation, then automatic deletion by a daily cleanup run; immediately on uninstallation.

4.6 Deletion on uninstallation

On uninstallation, Codixio deletes all data stored for the shop: registration and access data, plan data and compliance copies. The custom fields maintained in the shop are subject to Shopware's deletion logic and the merchant.

5. No cookies, no AI, no further recipients

The app sets no cookies and does not read information from devices beyond what is technically necessary for the retrieval (Sec. 25 TDDDG). The app does not use artificial intelligence, does not transmit data to AI providers and makes no automated decisions under Art. 22 GDPR. No external mailing or analytics services are used.

6. Hosting and third-country transfer

The backend is operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (data centres Falkenstein and Nuremberg). Coolify is used as self-operated open-source container orchestration on this infrastructure, not an external service provider. No transfer to third countries takes place.

7. Rights of data subjects

Data subjects have the rights of access, rectification, erasure, restriction of processing, data portability and objection under Art. 15 to 21 GDPR. Please address requests concerning processing in the shop to the respective merchant, and requests concerning Codixio to legal@codixio.com. You have the right to lodge a complaint with a supervisory authority, in particular the State Commissioner for Data Protection of Saxony-Anhalt, Leiterstraße 9, 39104 Magdeburg, Germany, phone +49 391 81803-0, e-mail poststelle@lfd.sachsen-anhalt.de, website datenschutz.sachsen-anhalt.de.

8. Changes

The version published at https://legal.codixio.com/apps/empco-product-info-shopware/privacy.en applies.