Privacy policy

When you create an account or use the https://shopyx.org platform, SHOPYX processes data relating to merchants and their staff, including: • identity and contact details (name, email, phone number); • account and authentication data (credentials, password hash, login logs); • professional information linked to the workspace (trade name, stores, roles and permissions); • billing and wallet data when billing applies (commission history, balances, necessary payment details); • technical data (IP address, device type, usage logs) needed for operation, security and support. This data is collected directly from you or your organisation. For this data, SHOPYX acts as data controller for performing the service contract and meeting its legal obligations.

Stores created on ShopyX collect data about end buyers (for example name, phone, delivery address, order contents, confirmation notes). For this data: • the merchant (or the entity operating the store) is the data controller: they decide the purposes (sale, COD delivery, after-sales) and must inform their customers as required by law; • SHOPYX acts as a processor / technical provider: it hosts and processes this data only to deliver the platform, according to the merchant’s instructions and workspace settings. Examples: a COD order placed on the storefront is stored so the merchant can confirm, ship and track the parcel; contact details may be sent to carriers or tools the merchant connects themselves. If you are a buyer on a third-party store hosted on ShopyX, send access, rectification or objection requests first to that merchant. SHOPYX may assist the merchant technically without replacing their responsibility.

Personal data processing through ShopyX is carried out under Tunisian organic law n° 2004-63 of 27 July 2004 on the protection of personal data, and applicable implementing rules. Main purposes: • provide, secure and improve the platform (accounts, stores, orders, inventory, analytics); • perform the contract with the merchant (support, billing, operational notifications); • enable order and delivery processing according to the merchant’s choices; • prevent fraud, abuse and security incidents; • comply with legal, tax or regulatory obligations binding SHOPYX. Typical legal bases: performance of a contract or pre-contractual steps; legal obligation; SHOPYX’s legitimate interest in securing and evolving the service without overriding individuals’ rights; and, where the law requires it, consent (for example certain non-essential cookies — see the Cookies page). SHOPYX does not sell merchants’ personal data or end-customer data.

Data is kept for as long as needed for the purposes above: • merchant account data: for the life of the active workspace, then for a reasonable period after closure for support, contractual evidence and legal duties; • order and end-customer data: according to the merchant’s settings and activity, and as long as law, tax, fraud prevention or a dispute require; • technical and security logs: a limited period proportionate to diagnosis and protection needs; • billing data: in line with accounting and tax retention periods applicable in Tunisia. When those periods end, data is deleted or anonymised, unless a contrary retention duty applies.

To operate the platform, SHOPYX may use technical subprocessors, including: • hosting and infrastructure: Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany — https://www.hetzner.com); • transactional messaging (account emails, service-related notifications); • object / file storage needed for storefronts and the dashboard; • payment or communication providers when you enable the related features. These providers act only on SHOPYX’s instructions (or, for end-customer data, as part of the service to the merchant) and are bound by appropriate confidentiality and security duties. When a merchant connects their own tools (carriers, ad pixels, spreadsheets, etc.), transfers to those tools are the merchant’s responsibility under their own terms.

Under law n° 2004-63, you have in particular the following rights, subject to the conditions set by law: • right of access to data about you; • right to rectify inaccurate or incomplete data; • right to object to certain processing on legitimate grounds; • right to request erasure or restriction where the legal conditions are met. Merchants and staff: send your request to hello@shopyx.org, stating your identity and the purpose of the request. We will reply within a reasonable time. Buyers of a store: contact the merchant first (data controller). You may also write to hello@shopyx.org; we will route the request to the right workspace when possible. Proof of identity or elements confirming your standing may be requested to avoid disclosure to a third party.

If, after contacting us, you believe your rights regarding personal data have not been respected, you may refer the matter to the National Authority for the Protection of Personal Data (INPDP): Instance Nationale de Protection des Données à Caractère Personnel (INPDP) Rue de la Ferme, Centre Urbain Nord, 1082 Tunis, Tunisia Website: https://www.inpdp.tn SHOPYX contact for platform privacy questions: Email: hello@shopyx.org Website: https://shopyx.org Address: Tunis, Tunisia