Privacy policy

This English version is provided for convenience. The German version is legally binding.

Principle

EU Commerce Apps is a curated directory. I only process the data needed to run the site and to submit, check and present Shopify apps. There is no advertising, no tracking of individual visitors across pages or devices, and no embedded third-party services such as font servers, maps or social media plugins.

Controller

Patrick Ludewig, Lenneisgasse 5/1, 1140 Vienna, Austria. For access, corrections, deletion requests or privacy questions, write to info@eucommerceapps.com.

Hosting and server log files

The site runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. When you open the site, the server processes technically necessary connection data, typically IP address, date and time, requested address, status code, amount of data transferred, and browser and operating system details.

The purpose is the secure and stable operation of the site, error analysis and the prevention of abuse. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation). The data is only stored for as long as necessary for this.

Cloudflare

Requests go through Cloudflare to resolve the domain, speed up static files and protect against attacks. Cloudflare processes in particular the IP address and technical request data. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. The legal basis is Art. 6(1)(f) GDPR (security and efficient delivery).

For the transfer to the USA, Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework. Cloudflare also relies on the EU standard contractual clauses.

Click counting

When you click a link to another website on an app card or app page, for example to the Shopify App Store, this site counts the click. Only the day, the app and the type of link (for example “App Store” or “provider website”) are stored, as a total per day. No IP address, browser details, cookies or identifiers are stored for this, and no conclusions about you are possible. The purpose is to understand which listings are used. If audience measurement (see below) is active, the same click is sent to Umami as an event with the same details. The legal basis is Art. 6(1)(f) GDPR.

Audience measurement with Umami

To understand which pages are read and where visitors come from, I use the open-source software Umami. Umami runs on my own server at Hetzner Online GmbH in the Helsinki data centre, Finland. The data does not leave the EU and is not passed to any third party.

Umami sets no cookies and stores nothing in your browser. It records the requested address without search parameters, the referring page, browser, operating system, device type, screen size, language, and country and region. In addition, single actions without their content: a click to an external site (app and link type), a sent submission, and starting and completing the checklist. Country and region are derived from the IP address. The IP address itself is not stored. To group visits, Umami creates a non-reversible hash from the IP address, browser details and a regularly changing secret. This means visitors can neither be identified nor recognised over a longer period. I only evaluate aggregated statistics.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a data-minimising analysis of use in order to improve the directory). If your browser sends the “Do Not Track” signal, no measurement takes place. You can also object to the measurement for this browser here. This stores the entry umami.disabled in your browser's local storage.

Cookies and local storage

I set no cookies when you visit the public pages, with one exception: if you switch the language in the footer, your browser stores your choice in the cookie site-lang (value de or en, valid for one year). It contains no identifier and only stops the automatic language detection from redirecting you again. There is also a technically necessary session cookie in the administration area, which is not public.

When you first open an English page, the server reads your browser's language setting (Accept-Language) and sends you to the German version if you prefer German. The setting is only read for this, not stored. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in showing the site in your language).

The Shopify app checklist remembers, if you want, which items you have ticked. Your browser stores this in local storage (localStorage, key eu-commerce-apps:checkliste). The data stays in your browser and is not sent to the server. You can delete it via “Check a new app” in the checklist or in your browser settings.

Newsletter and app updates

When you sign up for emails, I process your email address, the language of the page and, where applicable, the apps you want updates on. I use double opt-in: you first get an email with a confirmation link and only receive further emails after clicking it. The legal basis is your consent under Art. 6(1)(a) GDPR and § 174 TKG 2021 (Austrian Telecommunications Act).

The contacts are held by Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France), which keeps the list and sends the emails for me as a processor. As proof of consent, Brevo also stores when you signed up and confirmed. Brevo keeps a separate list for each app you want updates on. I do not measure opens or clicks in the emails. If audience measurement is active, Umami counts a signup on this site as an event, without the email address.

You can withdraw your consent at any time, using the unsubscribe link in every email or by emailing me. After you unsubscribe, Brevo keeps the address and the time only as proof that I may no longer email you.

Submissions

When you submit an app, I process the details from the form, including app name, provider, URLs, contact address and notes. I use this data for the manual check, for follow-up questions and for editorial approval. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in maintaining the directory) and, where you want follow-up questions answered, point (b).

I keep submissions for as long as they are needed for the check and for maintaining the listing. I delete them earlier on request. The details are not shown publicly unless I explicitly approve them, and they are not passed on to third parties.

Sources

Provider and app information may be taken from publicly available sources such as the Shopify App Store, provider websites, and legal notice or legal pages.

External links

The site links to external services, such as the Shopify App Store and provider websites. Only when you click a link do you leave this site, and the respective provider processes data under its own privacy policy.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. Write to info@eucommerceapps.com.

You can also lodge a complaint with the supervisory authority: Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.