Privacy policy

Who we are

The app is developed and operated by Day Six Digitale Communicatie B.V., Energieweg 4, 3641 RT Mijdrecht, the Netherlands (Chamber of Commerce 88224953). Privacy questions can be sent to support@daysix.nl.

For the personal data of a store's customers, the store itself is the data controller. Day Six processes that data only on behalf of the store, to enable fulfilment by HCM.

What data does the app process?

• Store data: store domain, store name, contact email address and time zone.
• Data of paid orders: order number, products and quantities, shipping method, and the recipient's name, address, email address and phone number.
• Product data: SKU, EAN, stock levels and the link to items at HCM.
• The store's HCM login details. The password is stored encrypted.
• A technical log of the messages between the app and HCM, used to resolve issues.

What for?

Only to send orders to HCM, write shipping information and tracking back to Shopify, update stock, and alert the store when something goes wrong. The app does not use data for marketing, profiling or advertising, and does not sell any data.

Who is data shared with?

• Handling Company Mijdrecht (the Netherlands): receives order data to ship the order. HCM is the fulfilment partner the store has chosen.
• Hostinger (servers in Germany, EU): hosting of the app and its database.
• Brevo (France, EU): sending alert emails to the store, with a copy to Day Six support. These emails contain order numbers only, no customer data.
• Shopify: the app reads and writes data through the Shopify Admin API.

All data stays within the European Economic Area.

How long do we keep data?

• Recipient name and email address of an order: up to 1 year after shipping. After that it is erased automatically.
• Address and phone number: not stored with the order. They only appear in the technical log of the message sent to HCM.
• The technical log (including the order messages sent): 30 days.
• After the app is uninstalled, all store data is erased within 48 hours of Shopify's request (shop/redact).

Security

All connections use HTTPS. Passwords, customer names, email addresses and log messages are stored encrypted (AES-256). The server can only be reached with an SSH key. Daily backups are encrypted and kept for 30 days. Only Day Six staff who operate the app have access. In the event of a data breach, we inform the affected stores within 72 hours.

Your rights

Are you a customer of a store that uses this app? Please contact that store first. Access and erasure requests sent through Shopify (customers/data_request and customers/redact) are handled automatically. You can also email support@daysix.nl directly, and you have the right to lodge a complaint with your data protection authority.