This Privacy Policy explains how Juan Angel Garcia Rodenas (self-employed, NIF 44380284J) ("Provider", "we") collects, uses, and protects personal information in connection with the Shopify App Nextronics Inventory Manager (the "App").

Privacy contact: contacto@nextronics-es.com

Location: Arganda del Rey, Madrid, Spain

1. Data protection roles (very important)

When we process data to operate the App (account, support, billing, security), we act as a data controller.

When we process Merchant data contained in import/export files (for example, customer data from the Store), we act as a data processor on behalf of the Merchant. In that case, our DPA (Version 1.1) applies: Public DPA URL.

2. What data we collect

2.1 Merchant data (Controller)

We may collect:

• Store data: *.myshopify.com domain, shop_id, store name;
• contact and support data: email, name (if provided), support messages;
• technical data: error logs, usage events, timestamps, IP address (when needed for security/fraud prevention).

2.2 Data processed on behalf of the Merchant (Processor)

The App allows uploading/generating import/export files that may include personal data (name, email, phone, addresses, order/customer identifiers, etc.) depending on the content uploaded by the Merchant.

3. How we use data

We use data to:

• provide and maintain the App;
• run imports/exports requested by the Merchant;
• prevent fraud and abuse and improve security;
• provide support and respond to inquiries;
• comply with legal obligations.

4. Legal basis (GDPR)

• Performance of a contract (providing the App and support).
• Legitimate interests (security, fraud prevention, technical improvements).
• Legal obligations (where applicable).

The Merchant is responsible for the legal basis for the data of its customers that it uploads/processes.

5. Data retention

• Import/export files: stored temporarily for up to 7 days and automatically deleted, unless prior deletion is requested or legal requirements apply.
• Technical logs: up to 90 days (minimized; avoiding personal data when possible).
• Support data: as long as needed to handle the case and for reasonable traceability purposes.

6. Where data is stored

• Main infrastructure: OVHcloud VPS in France (EU/EEA).
• Database: PostgreSQL, where files may be stored in compressed format (ZIP) and, when enabled, encrypted at the application level before being persisted.

7. Security

We apply reasonable technical and organizational measures, including:

• HTTPS/TLS in transit;
• access control and least privilege;
• logical separation by store (tenant isolation);
• server hardening;
• automatic deletion of files after 7 days;
• downloads through authenticated endpoints and/or signed links with expiration.

(More details in the DPA, Annex 2.)

8. Subprocessors

Our main subprocessor is:

• OVHcloud (VPS/Hosting) — France (EU/EEA).

If we add new subprocessors, we will update this policy and/or the DPA.

9. International transfers

We do not perform international transfers outside the EEA for primary storage. If this changes in the future, we will apply appropriate legal mechanisms (e.g., SCCs) and inform you.

10. Individual rights

If you are a customer of the Merchant and your data was processed through the Store, you should contact the Merchant, who is the controller.

If you are the Merchant (or a Store user), you may exercise your rights by emailing contacto@nextronics-es.com.

11. Cookies and tracking

The App runs inside the Shopify admin. We do not intend to use marketing cookies or sell data. If analytics/cookies are added in the future, we will provide notice and configure them in accordance with applicable laws.

12. Changes to this Policy

We may update this Policy. We will publish the new version with a "Last updated" date.