1. Who we are
[Denumirea legală a companiei] · CUI [●] · Reg. Com. [●] · [adresa] ("Coletly", "we") develops and operates the Coletly app for Shopify and this website. Data protection contact: suport@coletly.ro.
2. Our roles
For the data of your store's customers (parcel recipients), the merchant is the controller and Coletly is a processor: we process the data only to carry out the app's instructions (label, invoice, tracking, return). For your merchant account data and for visitors of this website, Coletly is the controller.
3. What data we process and why
- Order data received from Shopify: name, phone, e-mail, shipping address, products, weight, cash-on-delivery amount. Purpose: creating the label at the chosen courier, the invoice in the chosen invoicing tool, the tracking page and the return. Basis: performance of the contract with the merchant (Art. 6(1)(b) GDPR) and the merchant's instructions.
- Credentials for couriers and invoicing tools, entered by the merchant. Stored encrypted with a key unique to the store.
- Return data: reason, state and, for bank refunds, the buyer's IBAN. The IBAN is encrypted and deleted 30 days after the return closes, at the latest 90 days after the request.
- Merchant account and billing data: store domain, chosen plan, date of the first trial. Subscription billing is done by Shopify.
- Technical logs without personal data: no phones, e-mails, addresses or link parameters.
- This website: no tracking cookies. If you accept, anonymous statistics run; your choice is remembered in your browser.
4. Recipients
Data reaches: the courier the merchant chooses for each parcel (Sameday, FAN Courier, Cargus, GLS or DPD), the chosen invoicing tool (SmartBill, Oblio or FGO), Shopify (the store platform) and our hosting provider (Amazon Web Services, Frankfurt region, European Union). We do not sell data and do not use it for advertising.
5. Retention
Order data, labels and invoices are kept while the app is installed. On uninstall, the store's encryption key is destroyed immediately and the data is deleted after 48 hours, as Shopify requires. Customer deletion requests received through Shopify are carried out automatically. The date of the first trial is kept after uninstall to apply the one-trial-per-store rule.
6. Your rights
Access, rectification, erasure, restriction, portability and objection, under the GDPR. Store customers contact the merchant; merchants write to the address above. You may lodge a complaint with the Romanian supervisory authority (ANSPDCP).
7. Security
Envelope encryption (AES-256-GCM) for sensitive data, expiring Shopify tokens, signed links for public pages, encrypted databases with daily backups, logs without personal data.
8. Changes
We publish any change here, with its date. Important changes are also announced in the app.