IoneShop · EU / EEA
IoneShop Platform Privacy Policy — Shop track
- Version: 1.2-shop
- Effective date: 2026-08-02
- Audience: users of the Start / Growth / Pro offer (“For shops”).
Does not replace the Enterprise policy (/enterprise/privacy). Applies in the European Economic Area (EEA) and for services directed at users in the EU/EEA/UK (to the extent permitted by law).
Binding language: Polish (this English text is an informative translation; the Polish version governs for the Shop track unless otherwise agreed).
1. Data controller and contact
The controller of personal data in the scope indicated in § 3 is:
ABSGROUP INC. (Named Alberta Corporation, Canada) Registered office: 347 Hudson Bend, Edmonton, Alberta T6V 1R5, Canada Alberta Corporate Access Number: 2025055126 · Canada Business Number: 724018148 Alberta registration date: 2023-03-30 Data protection e-mail (GDPR): [email protected] General / complaints e-mail: [email protected]
EU representative (GDPR Art. 27) — mandate formalisation in progress: QData, Spektrum Tower, Twarda 18, 00-105 Warsaw, Poland Website: https://qdata.pl Until the mandate is fully formalised, the Controller/Provider remains the contact point for supervisory authorities and data subjects: [email protected]. Once the mandate is concluded, QData will act as representative under Art. 27 — alongside the Controller.
Digital product: IoneShop (domains including ioneshop.eu, ioneshop.pl, ioneshop.cloud and related application hosts).
A Data Protection Officer (DPO) is not currently designated (Art. 37 — DPO obligation depends on processing nature; Art. 27 representative ≠ DPO).
2. Scope of this Policy and definitions
2.1. Scope
This Policy describes processing of personal data in connection with:
- The platform marketing / sales website (including
www.ioneshop.eu); - SaaS user accounts (merchants / merchant employees, platform operators);
- B2B contract handling, subscription payments, technical support;
- Processor role regarding end-customer data of stores operated by merchants.
2.2. Definitions
| Term | Meaning |
|---|---|
| Platform | IoneShop SaaS service (storefront, merchant panel, account and store management system, API, infrastructure) |
| Merchant / Client | Entrepreneur using the Platform under the Terms of Service |
| Store user / Shopper | Natural person buying or browsing a merchant’s store |
| GDPR | Regulation (EU) 2016/679 |
| ePrivacy | Directive 2002/58/EC (as amended) and national rules on electronic communications / cookies |
| DPA | Data processing agreement (GDPR Art. 28) — annex to the Terms |
3. Roles under GDPR (key for multi-tenant SaaS)
| Context | IoneShop operator role | Merchant role |
|---|---|---|
| SaaS account data, billing, platform logs, B2B marketing | Controller | — |
| Store customer data (orders, cart, addresses, store marketing contacts) | Processor (under DPA) | Controller |
| Merchant employees in admin panel | Joint controllership or controller/processor depending on purpose; default: merchant = store account controller, operator = platform contractual data controller | Store account controller |
The operator is not the seller of goods offered in merchant stores and is not controller of store marketing purposes (store newsletter, store remarketing), unless a separate agreement provides otherwise.
The Merchant must maintain its own privacy policy and consumer texts in the store. The Platform may provide templates, but final content and purpose decisions belong to the merchant.
4. Categories of persons and data
4.1. Visitors to the marketing website
- Technical data: IP address, user-agent, timestamps, referrer URL, session identifiers;
- Form data (order / contact): name, surname / company, e-mail, phone, message content, tax ID (optional), plan preferences;
- Cookie consent / privacy preference data;
- Analytics / marketing data — only after consent (if enabled).
4.2. Merchant representatives (SaaS users)
- Identification and contact data: name, surname, job title, e-mail, phone;
- Company data: name, address, tax/VAT ID, invoicing details;
- Account data: login, OIDC/SSO identifiers, roles, access logs;
- Billing data: subscription history, payment status (no full card data — PSP tokens);
- Support tickets and correspondence;
- Security metadata (login IP, MFA, audit events).
4.3. Shoppers (data in processor role)
We process solely on behalf of the merchant, to the extent necessary to operate the store, including:
- Order data (name, delivery/invoice address, e-mail, phone, line items, status);
- Store customer account data (if enabled by merchant);
- Marketing preferences / consents set by the merchant;
- Technical session, cart and transaction-necessary cookie data;
- Return / consumer complaint data handled in the panel.
We do not store payment card PAN/CVV numbers. Card payments are handled by an external payment provider (PSP); Platform systems may contain only tokens / transaction identifiers.
5. Purposes and legal bases (GDPR Art. 6)
5.1. When we are controller
| Purpose | Legal basis |
|---|---|
| SaaS provision, account maintenance, tenant isolation, security | Art. 6(1)(b) (contract) and (f) (legitimate interest — security, service integrity) |
| Billing, invoices, VAT, debt collection | Art. 6(1)(b) and (c) (legal obligation) |
| Enquiries and support | Art. 6(1)(b) or (f) |
| “Order / contact” form before contract | Art. 6(1)(b) (pre-contractual steps) or (f) |
| B2B direct marketing e-mail / phone | Art. 6(1)(f) and national ePrivacy / electronic services / telecommunications rules — in PL usually consent for electronic marketing unless law provides an exception |
| Non-essential cookies / trackers | Consent (Art. 6(1)(a)) + ePrivacy rules |
| Product improvement analysis (aggregated / minimal) | Art. 6(1)(f) — respecting ePrivacy |
| Establishment, exercise, defence of claims | Art. 6(1)(f) |
| NIS2 / cybersecurity obligations (where applicable) | Art. 6(1)(c) and/or (f) |
5.2. When we are processor
The operator’s basis is the contract with the merchant + DPA (Art. 28). Bases vis-à-vis the shopper are determined by the merchant (usually Art. 6(1)(b) — sale; (c) — accounting/consumer duties; (a) — marketing).
6. Mandatory information (Directive 2000/31/EC, national electronic services rules)
On the Platform website we provide: company name, address, contact details, registration numbers, licensing authority if applicable. Complaints: [email protected].
7. Recipients and sub-processors
Data may be disclosed to:
- EEA infrastructure providers (hosting, DNS, CDN, object storage) — preference: EEA location;
- Mail / ESP, monitoring, IdP (OIDC) providers;
- PSP (subscription payments and — in stores — shopper payments per merchant choice);
- Advisers (legal, accounting, audit) — under confidentiality;
- Public authorities — where legally required;
- Business purchaser — on succession (with notice where law requires).
The current list of key processing sub-processors (Art. 28) is provided to the Merchant with the DPA / order form (contract annex). Sub-processor change: merchant notification per DPA (at least 14–30 days, with objection rights as required by contract).
No false claims: this Policy does not certify SOC 2, ISO 27001, PCI DSS or a “GDPR certificate”.
8. Transfers outside the EEA
We aim by default to process in the EEA. Where transfer outside the EEA is necessary:
- we apply GDPR Arts. 44–49 mechanisms (adequacy decision, European Commission SCCs, TIA where required);
- we indicate country and mechanism in the sub-processor list.
9. Retention periods
| Dataset | Period (indicative) |
|---|---|
| Active SaaS account data | Duration of contract + claims/debt collection period |
| Accounting documents / invoices | Per tax law (in PL usually up to 5 tax years; verify with tax adviser) |
| Security / audit logs | Usually 12–24 months, longer during incident / legal hold |
| Lead / contact forms without contract | Up to 24 months or until consent withdrawal / objection — depending on purpose |
| Store data (processor role) | Per merchant instructions + contractual retention; after offboarding: export, then deletion/anonymisation within DPA term (e.g. 30–90 days), except legal holds |
| Cookie consents | Until preference change / consent mechanism expiry |
After the period, data are deleted or anonymised unless law requires longer retention.
10. Data subject rights
Under GDPR Arts. 12–22, rights include:
- access, rectification, erasure (“right to be forgotten” — with limitations);
- restriction of processing, data portability;
- objection (including to direct marketing);
- withdrawal of consent (without affecting lawfulness before withdrawal);
- complaint to a supervisory authority.
Requests regarding Platform account data: [email protected] (and EU representative — QData, as in § 1).
Shopper requests regarding a merchant’s store: direct to the merchant (controller). The operator forwards to the merchant or supports DSR fulfilment via Platform tools (export/delete) per the DPA — does not replace the merchant in the shopper relationship.
10.1. Supervisory authorities (EU) — examples
A person may lodge a complaint with an authority in their habitual residence, workplace or place of alleged infringement, including:
| Country | Authority (abbrev.) |
|---|---|
| Poland | UODO |
| Germany | competent LfDI / BfDI (depending on entity) |
| France | CNIL |
| Spain | AEPD |
| Italy | Garante Privacy |
| Netherlands | AP |
| Czechia | ÚOOÚ |
| Sweden | IMY |
| Ireland | DPC |
EDPB list: https://edpb.europa.eu/
11. Cookies and similar technologies
Details: [Cookie Policy](/cookies).
- Essential cookies (session, security, consent memory, load balancing) — no marketing consent required;
- Analytics / marketing cookies — only after consent;
- We prefer minimisation / cookieless analytics where possible.
In some Member States (e.g. CNIL practice in FR, DE/IT authority guidance) consent UX requirements (reject as easy as accept) are enforced more strictly — the Platform designs its banner to that standard.
12. Security
We apply technical and organisational measures adequate to risk, including:
- store data isolation (separate data environments per store);
- TLS for non-local traffic;
- encryption of merchant secrets at rest;
- access control and audit of administrative actions;
- limited operator access to shopper data (no routine decryption; emergency access audited — as implemented);
- no PAN/CVV storage.
These measures do not guarantee absolute security and do not constitute a statement of specific certifications without evidence.
13. Personal data breaches
In case of a breach likely to risk rights and freedoms:
- we notify the competent supervisory authority without undue delay, where feasible within 72 hours (Art. 33) when we are controller;
- we notify data subjects where Art. 34 requires;
- as processor — we notify the merchant without undue delay per the DPA (Art. 33(2)).
14. Profiling and automated decisions
We do not take decisions producing legal effects concerning merchants solely by automated means within Art. 22, except necessary fraud/abuse controls (e.g. suspension on suspected abuse) — with support contact available.
AI features (if enabled, e.g. import column mapping) are assistive tools; the merchant retains control over accepting results. AI Act classification — according to actually deployed features (Policy update on AI launch).
15. Minors
The SaaS Service is directed at entrepreneurs. We do not target the Platform offer at children. Merchant stores may have their own age policies — merchant responsibility.
16. Annex — selected EU country aspects
EU law (GDPR) applies directly; Member States specify among other things child consent age, ePrivacy, local penalties, authority jurisdiction.
| Area | Operational notes |
|---|---|
| Poland | Personal data protection act; electronic communications / electronic services law — electronic marketing; UODO; Civil Code / consumer rights act — applies to merchant B2C stores |
| Germany | TTDSG / TDDDG (cookies/telemedia); strict Land authority practice; B2B marketing also restricted |
| France | CNIL cookie guidelines (reject = as easy as accept); strict proof of consent |
| Italy / Spain | Local codes / Garante / AEPD guidelines; cookie walls assessed critically |
| Nordics / Benelux | Strong emphasis on minimisation and transparency; local bodies (IMY, Datatilsynet, AP, etc.) |
| DSA (EU) | When hosting merchant storefronts — abuse reporting channel [email protected]; obligations grow with role/scale |
Merchants selling B2C in multiple EU countries must address local consumer requirements in their own store documents (language, withdrawal, warranties, mediation). The Platform provides infrastructure; it does not assume the seller role.
17. Policy changes
We inform of material changes by publishing a new version on the website and — where contract or law requires — e-mail to merchants. The effective date is in the header.
18. Contact
Privacy questions: [email protected] General contact: [email protected] EU representative: QData, Spektrum Tower, Twarda 18, 00-105 Warsaw, Poland
Related: Terms of Service · Cookie Policy · Enterprise: /enterprise/privacy
*IoneShop — Shop privacy policy. Not legal advice.*
Related documents