Privacy policy

Last updated: [PLACEHOLDER: date]. If the two versions differ, theGerman version applies.

This policy explains how Edenwork processes personal data on the website edenwork.io, when you join the waitlist, and in the Shopify app Packsum.

1. Controller

More details are in the imprint.[PLACEHOLDER: if applicable: data protection officer; if established outside the EU: representative under Art. 27 GDPR]

2. In short

• The website sets no cookies and uses no analytics or tracking tools.
• Fonts are served from our own server, not from Google or other third parties.
• We use waitlist data only to invite you to early access and tell you about the launch.
• The app only reads orders and products, and does not store your customers’ names, email addresses or street addresses.

3. Hosting and server logs

The website is served by Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). When you visit, Cloudflare processes technically necessary data such as your IP address, time, page requested and browser identifier to deliver the page and protect it from attacks. The legal basis is our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR). We have a data processing agreement with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework, and standard contractual clauses also apply.

4. Waitlist

When you join the waitlist, we store your email address and, if you provide them, your shop URL and the countries you sell to, together with the language and time of sign-up. We use this data to invite you to early access, tell you about the launch of Packsum, and decide which countries to support next.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by emailinghello@edenwork.io, and we will delete your entry. The data is stored in a database at Cloudflare (Cloudflare D1) located in the EU. For spam protection we use a hidden form field, not a third-party service. We delete entries once the waitlist has served its purpose, at the latest [PLACEHOLDER: e.g. 12 months after the app launches].

5. Contact by email

When you write to us, we process your details to answer your request (Art. 6(1)(b) GDPR for requests about a contract, otherwise Art. 6(1)(f)). We delete the message once it is dealt with and no retention duty applies.

6. Shopify app Packsum

When you install Packsum in your Shopify store, we process data that Shopify makes available to us through its API. The app has read-only access to orders and products.

What data

• Your shop domain and the access token issued by Shopify
• Name and email address of the person using the app in the Shopify admin, where Shopify provides them
• Product data such as titles, variants and SKUs
• Order data needed for the calculation: line items and quantities, ship date and destination country
• What you enter in the app: packaging profiles, mappings and registry details such as your LUCID number or Citeo IDU
• Saved reports with totals per country and material

Orders are read when you run a report and are stored only as totals. We do not store your customers’ names, email addresses or street addresses.

Roles and legal basis

For your shop account data we are the controller; the legal basis is the contract for using the app (Art. 6(1)(b) GDPR). Where order data about your customers is involved, we process it on your behalf as a processor under Art. 28 GDPR.

App hosting

[PLACEHOLDER: provider and location of the app server and database]

Deletion

When you uninstall the app, Shopify notifies us and we delete your shop’s data[PLACEHOLDER: time limit, e.g. within 30 days]. We also handle data requests from your customers that Shopify forwards to us.

7. Your rights

Under the GDPR you have the right to

• access the data we hold about you (Art. 15),
• rectification (Art. 16) and erasure (Art. 17),
• restriction of processing (Art. 18) and data portability (Art. 20),
• object to processing based on legitimate interests (Art. 21),
• withdraw consent with effect for the future (Art. 7(3)).

To use these rights, email hello@edenwork.io. You can also complain to a data protection authority, for example the one responsible for our location:[PLACEHOLDER: competent supervisory authority].

8. No automated decisions

We make no automated decisions and do no profiling within the meaning of Art. 22 GDPR.

9. Changes

We update this policy when our processing or the law changes. The version published here applies.