Privacy Policy

for the Shopify app “ZutatenKlar” · Last updated: October 2026 · Deutsche Fassung

1. Controller

SyncVentura, owner Igor Savostjanow, Bettina-von-Arnim-Str. 68, 28857 Syke, Germany
Email: info@syncventura.de

2. What this is about

The app helps Shopify merchants maintain the mandatory food information under Regulation (EU) No 1169/2011 and show it on the product page. It is installed through Shopify, runs in the merchant’s Shopify admin and works with the store’s products, not with customers, orders or payments.

3. Data processed

Store access. On installation, Shopify transmits the store address (myshopify domain) and an access token that lets the app access the merchant’s products on their behalf. Where Shopify provides it at sign-in, the app also stores the ID, first and last name, email address and locale of the signed-in staff member.

Product data. The app reads products through Shopify’s API. Only for stores with more than 1,000 products does it keep a copy of the product data (ID, title, handle, vendor, product type, category, tags, status, image URL and, per variant, title, SKU, barcode and unit price quantity, plus the app’s metafield) in its database, so that its pages load quickly.

Food business operators. The merchant enters the name or business name and address of the food business operators that must appear on the product page (Art. 9(1)(h) Regulation (EU) No 1169/2011) and, if wanted, rules that link suppliers to them. If a food business operator is an individual, this is personal data.

Suggestions from Open Food Facts. The app keeps a copy of the free Open Food Facts database (products from Germany, Austria and Switzerland) on its server and searches it by barcode and product name. No store data leaves the server for this. Suggestions found are stored with the product ID until the merchant reviews them.

What the app writes to the store. When the merchant approves the information, the app stores it per product in a metafield (zutatenklar.angaben) and the food business operators in a store metafield (zutatenklar.unternehmer); the app’s block shows both on the product page.

Subscription. Whether a store has already used the free trial is stored as a non-reversible key (HMAC) of the store address with the date.

Server logs. When pages are requested, the server processes the IP address, time, requested URL and user agent.

4. Purposes and legal bases

Providing the app to the merchant: Art. 6(1)(b) GDPR (contract). Trial note and server logs: Art. 6(1)(f) GDPR (preventing abuse, secure operation). Emails to us: Art. 6(1)(b) or (f) GDPR.

5. Recipients

• Shopify (Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, Ireland): the platform through which the app is installed, billed and used.
• netcup GmbH (Daimlerstraße 25, 76185 Karlsruhe, Germany): server hosting in Germany, as a processor.
• STRATO GmbH (Otto-Ostrowski-Straße 7, 10249 Berlin, Germany): storage for encrypted backups in Germany.
• Emails to us: IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany) forwards emails sent to info@syncventura.de to our mailbox at Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

The app and its data stay in the EU. Only emails to us may also be processed by Google in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework (EU Commission adequacy decision, Art. 45 GDPR).

6. Retention

• On uninstall, the app immediately deletes the access tokens and the copy of the product data.
• Food business operators, rules and suggestions: while the app is installed, at most until deletion after uninstall.
• The metafields remain in the store after uninstall and can be changed or deleted there.
• 48 hours after uninstall, Shopify requests deletion of all store data; the app then deletes everything for that store except the trial note.
• Trial note: 180 days, also after uninstall.
• Server logs: 7 days.
• Backups: deleted data disappears when the backup expires, at the latest after 12 months.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). An email to info@syncventura.de is sufficient. You may also lodge a complaint with a supervisory authority (Art. 77 GDPR); the competent authority is the Data Protection Commissioner of Lower Saxony, Prinzenstraße 5, 30159 Hannover, Germany.