Privacy Policy for the App Codixio Lowest Price 30 Days
1. Controller
Matthias Jakisch, Hauptstr. 34, OT Etingen, 39359 Oebisfelde-Weferlingen, Germany. Phone +49 39059 974988. E-mail general support@codixio.com, e-mail data protection/legal legal@codixio.com. Legal form: sole proprietorship (no commercial register entry), operating under the trade name Codixio. VAT identification number pursuant to Sec. 27a UStG: DE296346917. Tax status: small business under Sec. 19 UStG.
2. Subject
This policy describes the processing of personal data by the Shopware app Codixio Lowest Price 30 Days (technical name CodixioLowestPriceApp) and its backend at sw-codixiolowestpriceapp.api.codixio.com. The app determines, for Shopware 6 shops, the lowest total price of the last 30 days pursuant to Sec. 11 of the German Price Indication Ordinance (PAngV) and displays it in the merchant's storefront. It is intended for operators of Shopware shops (merchants). The merchant is the controller for data processing within the shop; Codixio processes the data listed in section 4 on behalf of the merchant under the data processing agreement at https://legal.codixio.com/apps/lowest-price-30-days-shopware/dpa.en.
3. Data the app does not process
The app does not read customer, order, address or payment data of the shop. It does not request permissions on customer or order entities. The storefront display loads no JavaScript from Codixio, sets no cookies, does not access device storage and sends no data of shop visitors to Codixio. No artificial intelligence is used, no data is transmitted to AI providers and no automated decisions within the meaning of Art. 22 GDPR are made. The app sends no e-mails.
4. Processing in the Codixio backend
4.1 App registration
Upon installation the shop transmits to the backend the shop identifier, the shop URL and the credentials for the shop's Admin API generated by Shopware. These data are necessary to provide the service (Art. 6(1)(b) GDPR). They are stored for as long as the app is installed and deleted upon uninstallation. A personal reference exists only indirectly where the shop URL or registration data allow identification of a natural person, for example a sole trader.
4.2 Plan data
The backend stores per shop the active plan (Standard, Pro, Max, Enterprise), derived from the in-app purchase signal of the Shopware Store. Payment and invoicing data are processed exclusively by the Shopware Store of shopware AG; Codixio does not receive them. Legal basis is Art. 6(1)(b) GDPR.
4.3 Product price data
To determine the lowest price of the last 30 days the backend reads via the Admin API product and variant identifiers, prices, strike-through prices and the identifiers of currencies, sales channels, price rules and customer groups, and stores price intervals with timestamps derived from them. Triggers are shop events on product and price changes (webhooks) and a daily full reconciliation. In the Enterprise plan campaign and alert entries and information on automatic promotions are stored in addition. These data are business data of the merchant without personal reference. Price intervals are deleted 90 days after they end, in the Enterprise plan after 24 months; reference states and campaigns remain stored until uninstallation. Results are written back to the product in the shop as custom fields and remain there under the merchant's responsibility.
4.4 Administration module
When a shop administrator opens the app's module, Shopware transmits signed parameters (shop identifier, language, timestamp) to the backend so the page can be assigned to the shop. No identifier of the logged-in user is transmitted or stored. The evidence export (Max plan) is generated on request from the stored price data and is not stored. Legal basis is Art. 6(1)(b) GDPR.
4.5 Technical logs
Incoming requests from the shop server are processed transiently in the operating log of the application container to detect malfunctions. IP addresses are not stored in the database; operating logs are not retained permanently. Legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and reliable operation).
5. Recipients and processors
The backend is operated on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (hosting provider for application servers and Postgres database, data centres Falkenstein and Nuremberg). Coolify is used as self-operated open-source container orchestration on this infrastructure and is not an external service provider. There are no further recipients. No transfer to third countries takes place.
6. Retention
Registration and plan data: until uninstallation of the app. Price intervals: 90 days after the end of the interval, in the Enterprise plan 24 months. Reference states, campaigns, alerts: until uninstallation. Upon uninstallation (event app.deleted) the backend deletes all data of the shop.
7. Rights of data subjects
Data subjects have, pursuant to Art. 15 to 21 GDPR, the rights of access, rectification, erasure, restriction of processing, data portability and objection to processing based on Art. 6(1)(f) GDPR. Requests may be sent to legal@codixio.com. There is a right to lodge a complaint with a supervisory authority, in particular the State Commissioner for Data Protection of Saxony-Anhalt (Landesbeauftragter für den Datenschutz Sachsen-Anhalt), Leiterstraße 9, 39104 Magdeburg, Germany, phone +49 391 81803-0, e-mail poststelle@lfd.sachsen-anhalt.de, website datenschutz.sachsen-anhalt.de.
8. Security
Communication between shop and backend is encrypted (TLS) and signed. Data are stored separately per shop. Access to the backend is restricted to the controller.
9. Changes
This policy is updated when the app's data processing changes. The version published at https://legal.codixio.com/apps/lowest-price-30-days-shopware/privacy.en is authoritative. Version date: 18 September 2026.