Privacy Policy: Pre-Order Function for New Products

This privacy policy explains how personal data is processed by the Shopware app "Pre-Order Function for New Products" (the "App").

1. Controller

Matthias Jakisch, Hauptstr. 34, OT Etingen, 39359 Oebisfelde-Weferlingen, Germany. Phone +49 39059 974988. E-mail general support@codixio.com, e-mail data protection/legal legal@codixio.com. Legal form: sole proprietorship (no commercial register entry), operating under the trade name Codixio. VAT identification number pursuant to Sec. 27a UStG: DE296346917. Tax status: small business under Sec. 19 UStG.

2. Roles

For merchant data processed to provide the App (app registration, plan data), the provider named above acts as controller within the meaning of the GDPR. For personal data of the merchant's shop customers (waiting-list e-mail addresses, pre-order order data), the provider acts as a processor pursuant to Art. 28 GDPR on behalf of the merchant; the respective merchant is the controller for such data. A data processing agreement is concluded for this purpose (see the DPA of this App).

3. Processing activities in detail

3.1 App registration and operation

Upon installation, the shop identifier (shopId), the shop URL and a technical secret (shopSecret) securing the communication are stored. The purpose is the technical operation of the connection between the merchant's shop and the App backend. Legal basis: Art. 6(1)(b) GDPR (provision of the App to the merchant). Retention: until the App is uninstalled; upon uninstallation these data are deleted automatically.

3.2 Plan determination (in-app purchases)

To determine the active plan, the plan name, the time of the last verification and the in-app purchase identifier are stored. The plan information is retrieved via the Shopware platform. Legal basis: Art. 6(1)(b) GDPR. Retention: until the App is uninstalled.

3.3 Pre-order positions

When a pre-order is placed in a shop with the pre-order function enabled, the backend stores, on behalf of the merchant, the order identifier, the order number, the product identifier, the quantity, the release date and status timestamps (created, fulfilled, notified). These data contain no names and no contact details but are indirectly attributable to a person via the order number. Purposes are the management of pre-orders, the notification at release, the stock reservation for pre-order customers and reporting for the merchant. Retention: open pre-orders until fulfilment; fulfilled pre-orders are deleted automatically 24 months after fulfilment, at the latest upon uninstallation of the App.

3.4 Waiting list

When a shop customer signs up to a product's waiting list, the backend stores, on behalf of the merchant, the e-mail address, the product identifier and the timestamps of sign-up and notification. The sole purpose is the one-time notification about the product's availability. The App does not send any further advertising. Retention: after the availability notification has been sent, the entry is deleted automatically; entries for which no notification was sent are deleted automatically after 12 months, at the latest upon uninstallation of the App. Obtaining any consent required from shop customers is the responsibility of the merchant as controller.

3.5 Abuse prevention (IP addresses)

To protect the waiting-list form against automated abuse, the sender's IP address is processed briefly in a server-side cache (rate limiting). The IP address is not stored in the database and not logged; the cache expires automatically after a few minutes. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abusive use).

3.6 E-mail dispatch

All e-mails of the App (notification of pre-order customers, waiting-list availability notification) are sent exclusively via the mail infrastructure of the merchant's Shopware shop. The App backend does not operate its own mail dispatch and does not use any external mail service provider.

3.7 ERP forwarding (Enterprise plan only, optional)

If the merchant activates ERP forwarding in the Enterprise plan, the backend transmits a signed data record (event type, order identifier, order number, product identifiers, quantities, release date) for pre-order events to a target address configured by the merchant. Names and contact details are not included. The merchant is responsible for the choice of the target and the lawfulness of processing there. Without activation, no transmission takes place.

4. Recipients and processors

Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Activity: hosting provider for application servers and Postgres database. Processing locations: data centres Falkenstein (DE) and Nuremberg (DE). In addition, Coolify is used as self-operated open-source container orchestration on Hetzner; it is not an external service provider. No further external services are used: no external mail service provider, no AI services.

5. Third-country transfers

No transfer to third countries takes place. All processing occurs in data centres in Germany.

6. Cookies and terminal equipment access

The App does not set cookies and does not access information on users' terminal equipment (no localStorage, no sessionStorage). Accordingly, no consent requirement under Sec. 25 TDDDG applies to the App.

7. No automated decision-making, no AI

The App does not make automated decisions with legal effect within the meaning of Art. 22 GDPR. The App does not use artificial intelligence and does not transmit data to AI providers.

8. Rights of data subjects

Data subjects have, in accordance with the GDPR, the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on Art. 6(1)(f) (Art. 21). Please address requests to legal@codixio.com. Shop customers of a merchant should primarily contact the respective merchant as controller; the provider supports the merchant in responding within the scope of the data processing agreement.

9. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. Competent for the provider: Landesbeauftragter für den Datenschutz Sachsen-Anhalt, Leiterstrasse 9, 39104 Magdeburg, Germany. Phone +49 391 81803-0. E-mail poststelle@lfd.sachsen-anhalt.de. Website datenschutz.sachsen-anhalt.de.

10. Amendments to this policy

This privacy policy will be amended if the processing carried out by the App changes. The version published at https://legal.codixio.com/apps/pre-order-shopware/privacy.en applies.