Privacy policy | Cofinal

Who is the controller?

Cofinal is controller of the personal data processed when you visit cofinal.io, create an account or use our service.

Cofinal, CVR 41289864, Rødovre Port 56, 1. 4, 2610 Rødovre. If you have questions, write to kontakt@cofinal.io.

Cofinal has two roles

When it concerns you and your account, Cofinal is controller. That covers your contact details, your invoices and the correspondence you send us.

When it concerns your customers’ order data, the roles are reversed: you are controller towards your customers, and Cofinal is your processor. We may only use their data to fulfil your orders and returns, and we do so on your instructions. The data processing agreement between us forms part of the terms of business.

Which data do we process?

Your account

Name, email address and login credentials. Company details if you fill them in, e.g. CVR and phone number. If you join the waitlist, we process your full name and email address until the account is created.

Your store’s data

When you connect your Shopify store, we fetch products, variants, barcodes, product images, inventory levels and locations, orders with fulfilments, returns and refunds, and your delivery profiles, rates, markets and shipping configuration. We continuously update the stock figures and mark orders as dispatched in Shopify.

Your customers’ order data

To dispatch a parcel we must know the recipient. From your orders we therefore process your customers’ name, delivery address, phone number and email address plus the order contents. The data comes from your Shopify store.

Payment

Card data is processed exclusively by Stripe. With us there is only a reference no. to your card, your invoices and their payment status.

Login with Google

If you log in with Google, we receive your Google ID, name, email address and profile picture from Google. The data is used only to log you in and identify your account, and is never shared. The profile picture is stored while your account is active and deleted when you disconnect Google in Settings or when the account is deleted.

Correspondence

Messages you send us via the contact form or support are stored with your email address.

Technical log data

When you use the website and the portal, IP address and timestamp are recorded in server log files. The log files are used only for operation and security and are deleted no later than 30 days after they are created.

Usage statistics

We keep statistics on how cofinal.io, the portal and the Shopify app are used: which pages are viewed, where visitors come from, country, device type and how long a page is active. The statistics set no cookies, store nothing on your device and do not contain your IP address. Visitors are counted with a code that changes every day, so visits cannot be linked across days. When you are logged in, page views are linked to your account.

Why do we process the data?

To deliver the service: receive your goods, store them, pack and dispatch orders. Legal basis: contract (GDPR Article 6(1)(b)).
To update your Shopify store with stock figures and dispatches. Legal basis: contract.
To invoice your usage and keep accounts. Legal basis: contract and legal obligation (the Bookkeeping Act).
To send you operational messages, e.g. receipts, warnings and notifications requiring your action. Legal basis: contract.
To let you log in with Google and to answer your enquiries via the contact form or support. Legal basis: contract (GDPR Article 6(1)(b)).
To secure operation and prevent abuse. Legal basis: legitimate interest (GDPR Article 6(1)(f)).
To keep usage statistics, so we can improve the website and the service. Legal basis: legitimate interest (GDPR Article 6(1)(f)).

Who do we share the data with?

We share data only with the providers the service consists of:

Shopify — your store’s platform. Source of order and product data; receives stock figures and dispatch updates.
Stripe — payments. Card data is processed only by Stripe. Stripe analyses transaction data to operate and improve its services, including for fraud detection — see Stripe’s privacy policy.
Shipmondo — booking of freight labels. Receives the recipient’s name, address and phone number.
GLS — carrier. Receives label data to deliver the parcel to your customer.
Resend — sending our emails to you, e.g. login codes and operational notifications.
Google — identity at login with Google.
netcup GmbH — hosting of the server in Austria. Processes data only to run and support operations. Data processing agreement per Article 28; processing takes place exclusively in the EU/EEA.
Hetzner Online GmbH — storage of encrypted backups in Germany. Processing takes place exclusively in the EU/EEA.

netcup and Hetzner process exclusively in the EU/EEA. Order and product data is processed by Shopify in the EU, the US and Canada under Shopify’s data processing terms. For payments our counterparty is Stripe’s European company, Stripe Payments Europe Ltd in Ireland, but parts of the processing take place at Stripe’s US company. Login with Google is processed by Google in the US. Resend processes data at their US company and is certified under the EU-US Data Privacy Framework. Transfers to the US take place under the EU Commission’s standard contractual clauses, which form part of Shopify’s, Stripe’s, Google’s and Resend’s data processing agreements.

The providers process the data only on our instructions, except where they act as independent controllers for their own service — Stripe for payments and fraud prevention, GLS for carriage, and Google for login — see their privacy policies.

How long do we keep the data?

Account data: while the account is active. An account can be deleted under Settings when there is no inventory in the warehouse, no open orders or returns, and no amount outstanding — including no dispatches under 60 days old which may still come back from the carrier. If the account is deleted, your personal data and your customers’ personal data are removed; order history and invoices are kept without personal data. Uninstalling the app in Shopify does not itself delete the account.
Customer orders: your customers’ personal data is kept only while the order is being processed with us. When the order is completed, personal data is removed and only anonymised statistics remain.
Invoice and transaction data: 5 years from the end of the financial year under the Bookkeeping Act, also after an account is deleted.
Usage statistics: 25 months. If the account is deleted, the link to it is removed.
Backups: daily backups are kept for up to about a month. Deleted data disappears at the latest with the oldest backups.

Cookies

We use no analytics or tracking cookies. We set only strictly necessary cookies: a signed session cookie keeping you logged in for up to 30 days, a small technical cookie remembering whether you are logged in, and — only when you actively choose a language — a language-preference cookie remembering your choice.

Security

The service is hosted in the EU with ISO 27001-certified providers. All traffic runs encrypted (TLS), login credentials are stored securely, the database is reachable only from the application server, and both local and offsite backups are encrypted. Only a limited number of persons have access to the data. Access to personal data is logged with timestamp, actor, action and object id — without personal data in the log itself — and kept for 12 months. If we discover a personal data breach, we follow a fixed procedure: containment, notification of affected merchants without undue delay and report to the Danish Data Protection Agency within 72 hours where we are controllers.

Your rights

Under the General Data Protection Regulation you have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can always see which data we hold on you and have it handed over.

If you are dissatisfied with our processing, complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, dt@datatilsynet.dk.

Changes

This policy is updated as the service changes. You are notified of material changes by email.