App Privacy Notices

1. Controller and Contact

The provider of the apps is Andre Prochiner, Eichenweg 34b, 9581 Ledenitzen, Austria, trading as AppHighway. Contact for privacy enquiries: support@apphighway.com. No data protection officer has been appointed, as the statutory requirements for this are not met.

2. Who is Responsible for which Data?

We process customer data of a store (buyers) solely on behalf of the merchant who installed the app. The controller within the meaning of the GDPR is the merchant; we act as processor under Art. 28 GDPR. The basis for this is the data processing agreement, which comes into effect upon installation. Buyers wishing to request access or deletion should contact the merchant from whom they ordered; we assist the merchant in responding.

For the merchant's own data and that of its employees (store session, settings, support requests, notices), we are the controller. Billing for the apps is handled by Shopify; we do not receive payment data.

3. What Data the Apps Process

All apps store a store session: store domain, access token for the Shopify API, name, e-mail address and language of the Shopify user who installs or opens the app. We need this data to display the app in the Shopify admin and to connect it to your store.

Support and notices: if you write to us, we process the information you provide (name, e-mail address, store domain, message) to handle your request. At the end of the contract, E-Rechnung & GoBD sends a notice with download links to your store's invoice e-mail address.

4. Purposes and Legal Bases

We process buyer data only to provide the app function for the merchant, on the basis of the data processing agreement (Art. 28 GDPR); the legal basis for the processing itself is determined by the merchant, typically performance of the contract with the buyer and the statutory obligation to issue and retain invoices (Art. 6(1)(b) and (c) GDPR).

We process merchant data to perform the usage contract (Art. 6(1)(b) GDPR), to comply with legal obligations, for example cooperating with data protection webhooks (Art. 6(1)(c) GDPR), and on the basis of legitimate interest in secure and traceable operation, for example for logs and preventing misuse (Art. 6(1)(f) GDPR).

5. Recipients and Place of Processing

The apps run in data centres operated by Hetzner Online GmbH in Germany. Invoice documents, archive and handover packages, and export files are held in object storage operated by Amazon Web Services EMEA SARL in the Frankfurt region. We send transactional e-mail (invoice delivery to buyers, where enabled; notices to the merchant) via Brevo (Sendinblue SAS, France). Data processing agreements are in place with these service providers; they are named as sub-processors in the data processing agreement.

Shopify International Ltd. (Ireland) is the platform through which you use the apps; you control the data exchange with Shopify through the app's access rights. There are no further recipients unless you designate them yourself, for example your tax firm, to whom you hand over exports, or buyers to whom the app delivers invoices.

No transfer to third countries outside the EU and the EEA takes place. Should a service provider process data in a third country in the future, we will ensure appropriate safeguards under Chapter V GDPR beforehand and inform merchants.

6. Retention Period

We delete store sessions as soon as Shopify notifies us of the uninstallation (app/uninstalled webhook). We delete all other store data of Address Guard and DATEV Abgleich on the shop/redact webhook, which Shopify sends 48 hours after uninstallation.

E-Rechnung & GoBD keeps invoices and the archive for as long as the app is installed. After uninstallation, the archive export and the handover package remain available until day 28; from day 29 we delete drafts, handover packages, sessions and settings, with this deletion completed at the latest on day 30. Issued invoices with their verification chain are not deleted by the app on its own: they remain stored for as long as we operate the service, until their statutory retention period expires, or until the merchant instructs their deletion. The statutory retention of invoices (Germany: eight years; Austria: seven years, in each case subject to any suspension of the time limit) is the merchant's responsibility, for which they download the archive export; retention by us is not promised.

We retain support correspondence for as long as necessary to handle the request and to meet statutory retention obligations. Operational logs (server logs) are overwritten after a maximum of 30 days.

7. Shopify's Data Protection Webhooks

All apps implement Shopify's mandatory webhooks. customers/data_request: if a buyer requests access, E-Rechnung & GoBD shows the merchant which invoices are affected; Address Guard and DATEV Abgleich hold no buyer data that would need to be disclosed. customers/redact: a buyer's data is deleted unless a statutory retention obligation prevents it; issued invoices are retained until the retention period expires (Art. 17(3)(b) GDPR). shop/redact: all remaining data of a store is deleted.

8. Security

Transmission is exclusively encrypted (TLS). Access tokens are stored server-side, databases are not publicly reachable, each app has its own database, and document download links are signed and time-limited. The full technical and organisational measures are set out in Annex 2 of the data processing agreement.

9. No Cookies, No Analytics in the Apps

The apps run embedded in the Shopify admin and use Shopify's session tokens (App Bridge) for sign-in. The apps do not use their own cookies, analytics or advertising trackers. Address Guard's checkout extension does not store any data in buyers' browsers.

10. Your Rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interest (Art. 21). Please contact support@apphighway.com. Buyers of a store should direct their request to the merchant; to the extent we act as processor for this data, we forward requests to the merchant.

You also have the right to lodge a complaint with a supervisory authority. For us, the competent authority is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb.gv.at; you may also contact the supervisory authority of your place of residence.

11. Changes to these Notices

We update these notices when the apps, our service providers, or the legal situation change. The current version, with its version number and date, can be found on this page; we inform merchants of material changes in the app's dashboard or by e-mail.