DataX — Privacy Policy
DataX GmbH, Waldstr. 4, 04105 Leipzig, Germany (Managing Director: Jakob Gerzen) — "DataX" — provides analytics services to Shopify merchants. This policy explains how DataX handles personal data when a merchant uses the DataX app.
Our role
DataX acts as a data processor on behalf of the merchant (the controller). DataX processes data only to provide analytics for that merchant — never for its own purposes, and never selling data. A Data Processing Agreement (DPA) under Art. 28 GDPR is concluded with each merchant.
Data we process
On behalf of the merchant, DataX processes data about the merchant's own customers:
- order data (order ID, date, amounts, items/quantities, discount codes, status);
- customer email and phone number — stored hashed/pseudonymised for matching;
- product and discount data.
We process only the merchant's own customers' data — no scraping of third-party profiles. Fields we do not need are not stored (data minimisation).
Purpose
Solely to provide the analytics commissioned by the merchant (e.g. revenue/order KPIs, new-vs-returning and cohort analysis, influencer/campaign attribution, discount-code performance).
Storage & security
- Stored encrypted in a database in the EU (Oracle Autonomous Database, Frankfurt).
- Encryption at rest (TDE) and in transit (TLS/HTTPS).
- Phone numbers and email local parts are stored pseudonymised (hashed).
- Strict tenant isolation: each merchant/user only sees their own shop's data.
- Role-based, least-privilege access; access is logged.
Retention & deletion
Personal data is kept only as long as necessary for the analysis. It is deleted or anonymised on the merchant's request and automatically upon uninstalling the app (via Shopify's shop/redact and customers/redact compliance webhooks).
No sharing / no sale
No sharing with third parties for their advertising purposes, and no sale of personal data. Sub-processors (e.g. hosting) are contractually bound and listed in the DPA.
Data subject rights
Data subjects exercise their rights (access, erasure, restriction) with the merchant (the controller); DataX supports these requests as a processor, technically via the Shopify compliance webhooks.
Contact
DataX GmbH, Waldstr. 4, 04105 Leipzig, Germany — jakob@more-conversions.com
Security incidents: report suspected breaches to robert@datax-ecom.com. Affected merchants are notified without undue delay (Art. 33 GDPR).