Privacy Policy — Kodra Sidrix: Sidrena cijena

1. Who we are

The “Kodra Sidrix: Sidrena cijena” app for Shopify stores (the “App”) is provided by Enigma 101 global j.d.o.o., Gajeva ulica 42, 10000 Zagreb, Croatia, OIB 03945849423, VAT ID HR03945849423, company registration number (MBS) 081673164, statistical number (MB) 6171923, registered with the Commercial Court in Zagreb (“we” or the “Provider”).

For any privacy question contact us at info@enigma101.com or by post at the address above.

This Policy explains what data we process when a merchant installs and uses the App, for what purposes, on which legal basis, with whom we share it, how long we keep it and what rights data subjects have. The General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Croatian Act on the Implementation of the GDPR (OG 42/18) apply.

2. Who this applies to

• Merchants (legal entities and sole traders) who have installed the App in their Shopify store.
• Staff and contractors of the merchant who use the App in the Shopify admin (e.g. the person confirming anchor prices or receiving e-mail alerts).
• The App does NOT process personal data of the store's customers (names, addresses, e-mails, phone numbers, payment data). See section 3.6.

3. Data we process

3.1. Store and access data: the store's Shopify domain (e.g. store.myshopify.com), access tokens issued to the App by Shopify (OAuth), granted scopes, installation time. If Shopify provides admin user details in the session (first name, last name, e-mail, locale), they are used only to sign in to the App.

3.2. Store location settings: type of outlet, outlet address, outlet code, reference date, alert e-mail address. These are entered by the merchant.

3.3. Anchor price audit trail: for each confirmed anchor price we record the product variant, amount, date, source (import, order, manual entry, new product), evidence (e.g. imported file name or order number), the first and last name of the person who confirmed it and the time of confirmation. The audit trail exists so the merchant can prove the origin of anchor prices to the inspectorate.

3.4. Product data: titles, SKUs, barcodes, vendors, prices, compare-at prices, availability and variant option values. The anchor price, its date and source are stored as metafields in the merchant's Shopify store. This is generally not personal data.

3.5. Published price lists: CSV price list files and their index (sequence number, publication date and time, row count). Price lists are public on the merchant's domain because the Decision on Publishing Price Lists (OG 101/2026) requires it. They contain no personal data unless the merchant enters personal data into product titles or the outlet address.

3.6. Orders: the App's permission to read orders is used solely for the “Suggest from orders” feature (reconstructing the price on the reference date). We read only the order number, product variant and original unit price of the line item. We do not read or store customer names, addresses, e-mails, phone numbers or payment data. If the merchant confirms a suggested price, the order number (e.g. #1001) is recorded in the audit trail as evidence.

3.7. Technical logs: the server records request logs (time, path, status code, IP address of the client or Shopify, error messages) for security and troubleshooting.

3.8. E-mail alerts: recipient address, subject and content of the alert and delivery status.

3.9. Cookies: inside the Shopify admin the App uses session tokens issued by Shopify. We do not use cookies for analytics, tracking or advertising. The public price list page sets no cookies.

4. Purposes and legal bases

• Providing the service (anchor price display, generating and publishing price lists, import, alerts) — performance of the contract with the merchant (Art. 6(1)(b) GDPR).
• Audit trail and proof of anchor price origin — performance of the contract and the merchant's legitimate interest in meeting and demonstrating a legal obligation (Art. 6(1)(b) and (f)).
• Security, abuse prevention and troubleshooting (technical logs) — the Provider's legitimate interest (Art. 6(1)(f)).
• Subscription billing — performance of the contract; billing and collection are carried out by Shopify.
• Compliance with the Provider's legal obligations (accounting, tax, requests from authorities) — legal obligation (Art. 6(1)(c)).

We do not sell personal data, do not use it for advertising and do not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR.

5. Roles: controller and processor

For data about the merchant as our customer (sections 3.1, 3.2, 3.7 and 3.8 insofar as they concern our relationship with the merchant) the Provider is the controller.

For personal data the merchant enters about its staff (e.g. the name of the person confirming anchor prices) and for store data the App processes on the merchant's behalf, the merchant is the controller and the Provider is the processor. The terms of that processing are set out in the “Processing of personal data” clause of the Terms of Use, which constitutes a data processing agreement under Art. 28 GDPR.

6. Recipients and sub-processors

We share data only with providers necessary to run the App:

• Shopify (Shopify International Limited, Ireland, and affiliates) — the platform the App runs on; store and product data reside on Shopify.
• Fly.io, Inc. (USA) — application server hosting; data centre in Frankfurt (Germany).
• Neon, Inc. (USA) — database (settings, audit trail, price lists); data centre in Frankfurt (Germany, Amazon Web Services eu-central-1).
• Resend, Inc. (USA) — sending e-mail alerts.

We may disclose data to competent authorities where required by law or a final decision of a court or authority.

7. Transfers outside the EEA

Data is primarily stored in the European Union (Frankfurt). As some sub-processors are established in the USA, access to or transfer of data outside the European Economic Area may occur (e.g. for support or e-mail delivery). Such transfers rely on the adequacy decision for the EU–US Data Privacy Framework (for certified providers) or on the European Commission's Standard Contractual Clauses, with supplementary measures where needed.

8. Retention

• Settings, the audit trail and published price lists are kept while the App is installed.
• After uninstallation Shopify sends us a shop data erasure request (shop/redact), usually 48 hours after uninstallation. On receipt we delete the store's settings, audit trail, price lists and sessions, at the latest within 30 days.
• Database backups are deleted in their regular cycle, at the latest 30 days after the source data is deleted.
• Technical logs are kept briefly, generally for no more than 30 days.
• Records of sent e-mails are kept according to Resend's retention rules, generally for no more than 30 days.
• Data we must keep under specific regulations (e.g. accounting) is kept for the prescribed periods.

Important for merchants: the regulation requires previous price lists to remain publicly available for at least 30 days. Uninstalling the App stops the public price list page. Download the price list archive and audit trail before uninstalling if you need them.

9. Security

We apply appropriate technical and organisational measures: encrypted communication (HTTPS/TLS), signature verification of all requests sent by Shopify, access limited to necessary scopes (least privilege), encryption at rest by our hosting and database providers, protection of access keys and restricted staff access. No measure is absolute; we will notify affected merchants of a personal data breach and, where required, the supervisory authority.

10. Shopify privacy webhooks

• customers/data_request — the App stores no customer personal data, so we confirm that we hold none.
• customers/redact — for the same reason there is no customer data to erase.
• shop/redact — we delete all store data as described in section 8.

11. Your rights

Data subjects have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on legitimate interest. Send requests to info@enigma101.com. We will respond without undue delay and at the latest within 30 days (extendable under Art. 12 GDPR).

If you are a merchant's employee and the data was entered by the merchant, please address your request primarily to the merchant as controller; we will assist the merchant in handling it.

You may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, www.azop.hr, or with the supervisory authority of the Member State of your habitual residence or place of work.

12. Children

The App is intended for business users only and not for persons under 16.

13. Changes

We may amend this Policy due to changes in the App, sub-processors or regulations. Material changes will be published on this page and communicated to merchants in the App or by e-mail at least 15 days before they take effect. The effective date is stated at the top of this page.