Privacy Policy
1. Who we are
BrandUp Factory GmbH, Duvenstedter Berg 55, 22397 Hamburg, Germany (“BrandUp”, “we”) provides the Shopify app “Digital Product Passport”. Contact: info@brandupfactory.com.
2. Roles
For the data merchants enter about their products and their company, the merchant is the controller and BrandUp acts as processor and Digital Product Passport service provider. For the merchant account data we need to run and bill the app, BrandUp is the controller.
3. Data we process
- Store data from Shopify: shop domain, shop name, contact email, primary domain, and product data (title, handle, image, SKU, barcode, vendor, product type) for products the merchant creates passports for.
- Data entered by the merchant: economic operator details (legal name, address, contact details, VAT ID, EORI, operator ID, EPR numbers, EU responsible person) and product passport data (materials, origin, care, repair, end of life, documents).
- Supplier data requests: when the merchant asks a supplier for passport data, the supplier name, the optional supplier email address and the message the merchant enters, and the data and notes the supplier submits through the request link. Only a hash of the link token is stored. A request made for a passport is deleted together with that passport, a request made for a template together with that template, and every request when the shop data is deleted (see section 6). To limit abuse, the IP address of requests to the supplier form is kept in memory for up to 10 minutes and is not stored.
- AI suggestions (Pro, optional): only when the merchant clicks “Fill with AI”, the product title and description, the notes the merchant enters and any PDF the merchant uploads are sent to Anthropic to generate suggestions. The app stores none of this, only a monthly count of AI requests per shop. Merchants should not upload documents that contain personal data.
- Weekly digest (optional): when the merchant turns on the weekly digest, the email address entered as its recipient (if one is entered; otherwise the shop email is used) and the time the last digest was sent.
- Session and billing data: Shopify session tokens and the subscription status from Shopify App Pricing (read via the Shopify Partner API).
- Support: name, email and message content when the merchant contacts us.
- Passport page visits: an aggregated view counter per passport. We do not set cookies on passport pages and do not store IP addresses or other data about shoppers. If the merchant adds a logo image, the passport page loads it from the host the merchant chose, so that host receives the visitor’s request like any other web server.
The app does not access or store Shopify customer data (shoppers’ names, orders or addresses).
4. Purposes and legal bases
- Providing the app and publishing the merchant’s product passports (Art. 6(1)(b) GDPR, contract; Art. 28 GDPR processing).
- Billing through Shopify (Art. 6(1)(b) GDPR).
- Transactional emails about installation, uninstallation and support (Art. 6(1)(b) and (f) GDPR).
- Supplier data requests and AI suggestions on the merchant’s instruction (Art. 6(1)(b) GDPR; Art. 28 GDPR processing for the merchant).
- Keeping published passports available and verifiable while the app is installed, including version history with checksums, as required for Digital Product Passports under Regulation (EU) 2024/1781 (Art. 6(1)(c) GDPR). Each version contains the product data and the economic operator’s name and address (with its public registration numbers and EU responsible person), but no email address, phone number or website. After uninstallation, published passports and their versions are deleted together with the other shop data (see section 6).
5. Recipients and sub-processors
- Shopify (platform, authentication, billing)
- Heroku (Salesforce), EU region (AWS Ireland) – application and database hosting
- Resend (transactional email, supplier request links and the optional weekly digest)
- Anthropic PBC, USA (Claude API) – only when the merchant requests AI suggestions; processes the product title and description, the merchant’s notes and uploaded PDFs as our processor to generate the suggestions. This transfer to the USA takes place on the basis of the EU-U.S. Data Privacy Framework where Anthropic is certified under it, and otherwise on the basis of the EU Standard Contractual Clauses.
- Sentry (error monitoring, if enabled)
- Ecobalyse (French government service) – only when the merchant calculates the French environmental score; we send product composition, weight and countries, no personal data.
Where data is transferred outside the EU/EEA, this is based on the EU Standard Contractual Clauses or an adequacy decision.
6. Retention
When the app is uninstalled, sessions are deleted immediately and all shop data, including published passports and their version history, is deleted no later than 48 hours afterwards when Shopify sends the shop/redact request, unless the merchant reinstalls the app in the meantime. Supplier data requests are deleted with the passport or template they were made for, and otherwise with the shop data. Merchants can export all passport data as CSV at any time before uninstalling.
7. Your rights
You have the right to access, rectification, erasure, restriction, data portability and objection, and to lodge a complaint with a supervisory authority (in Hamburg: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit). Contact us at info@brandupfactory.com.
8. Security
All connections are encrypted (TLS). Passport pages are served through Shopify’s signed App Proxy, and every published passport version is stored with a SHA-256 checksum to detect changes.