Privacy policy

1. Who we are

kreativkonnekt GmbH, Fuhlsbüttler Str. 421, 22309 Hamburg, Germany. Managing directors: Michael Wanjek, Nikolas Schaffmann. Email: hi@getfondo.app. Our legal notice is at getfondo.app/impressum.

2. Our two roles

For a merchant's own account and visits to dash.getfondo.app, we are the controller under the GDPR. The data of a store's customers we process on the merchant's behalf (Art. 28 GDPR): the merchant decides what Fondo uses it for and is responsible for it. Merchants can request a data processing agreement at hi@getfondo.app.

3. Signing in and merchant accounts

Fondo opens from the store's Shopify admin, and Shopify signs the person in. Shopify tells us the staff member's name, email address, Shopify user ID and whether they own the store. We keep these, the stores they may open, and their sessions.

Purpose: providing the account and access to the store's Fondo (Art. 6(1)(b) GDPR). We keep this data while the account exists and delete it afterwards.

Cookies: only strictly necessary ones, to keep you signed in and for the moment Shopify signs you in. Your choice of light or dark display is kept in your browser. There are no analytics, advertising or tracking cookies.

4. Connecting a store

When a merchant installs Fondo, Shopify shares the store's name, domain, email address, currency, time zone and plan, and an access token, which we store encrypted. Billing runs through Shopify: we see the plan and its status, never payment details.

5. Store customers' data (on the merchant's behalf)

For customers who order, whose balance the merchant adjusts, or about whom Shopify notifies Fondo: Shopify customer ID, first and last name, email address, the amount they have spent and their number of orders; their orders with order number, amounts, credit used and refunds; their store credit and its transactions; and their membership tier.

Purpose: running the merchant's loyalty program: cashback as store credit, spending credit at checkout, and membership tiers. Fondo writes each customer's balance and tier to their Shopify customer record, so the store, the checkout and the customer's account can show it.

On the storefront and in checkout, Fondo's blocks read the store's settings and the signed-in customer's balance from Shopify. They set no cookies. When a customer switches on their credit, Shopify notes that choice on their cart.

Requests and deletion go through Shopify's privacy webhooks: Fondo answers the access requests Shopify forwards, deletes a customer's data when Shopify asks for it, and deletes all of a store's data when Shopify asks after the store uninstalls Fondo.

6. Service providers

netcup GmbH, Karlsruhe, Germany: servers and database. Our data stays in Germany.

Shopify, which runs the stores, sign-in and billing, processes data under its own terms with the merchant.

We have a data processing agreement with netcup. We don't sell data or share it with anyone else.

7. Security

All connections are encrypted (TLS). Shopify access tokens are additionally stored encrypted. Only people at kreativkonnekt who run Fondo can reach the servers.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and you can withdraw a consent at any time. Write to us at hi@getfondo.app. If you are a customer of a store, it is best to contact the store first; we support it in answering you.

You can lodge a complaint with a data protection authority, for example the one responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.

9. Changes

We update this policy when Fondo or the law changes. The version published here applies.