Data privacy statement

1. Contact information and responsible party

Responsible for the processing of your personal data is:

Tom IT B.V.
Hem 26a
4301HR Zierikzee

If you have any questions or suggestions regarding data protection, please feel free to email us at support@tom-it.nl

You can contact our privacy protection officer at info@tom-it.nl

2. Subject matter of data protection

The subject of data protection is personal data, i.e. all information relating to an identified or identifiable natural person.

3. Automated data collection

When accessing our website, your device automatically transmits data for technical reasons. The following data is stored separately from other data that you may transmit to us:

• URL of the page accessed
• The latency of the network connection
• Date and time

We save this data for the following purposes:

• Load balancing, i.e. to distribute the access to our website across several devices and to be able to offer you the fastest possible loading times.
• Ensuring the security of our IT systems, for example, to prevent specific attacks on our systems and to identify attack patterns.
• Ensuring the proper operation of our IT systems, for example if errors occur that we can only remedy by storing the IP address.
• To enable criminal prosecution, security or legal prosecution if there are specific indications of criminal offenses.

Your IP address is only saved for a period of 14 days.

In this case, the processing takes place on the basis of our predominant legitimate interests mentioned above (Art. 6 Para. 1 lit.f GDPR).

4. Registration data

To be able to use all functions of the app, you have to register. For this you have to provide the following mandatory information:

• Shopify Store URL

Once you have installed our ap, we receive the following personal datau:

• Name
• Email address
• An authentication token

Your registration data is required to set up and manage a user account for you and so that you can use all the features of our application. In this case, you conclude a usage contract with us on the basis of which we collect this data (Art. 6 Para. 1 b GDPR).

In order to conclude the contract, you have to provide us with this data. However, you are neither contractually nor legally obliged to conclude the contract and thus to provide the data.

When you log in to our App, we also save your IP address for a short period of time in order to be able to detect and prevent possible attacks and mass misuse of logins to the app (so-called brute force attacks) by blocking these IP addresses temporarily if necessary. The processing takes place in order to ensure the security of the processing according to Art. 32 GDPR and based on our legitimate interest in protecting us from misuse of our service (Art. 6 Para. 1 lit.f GDPR). Data is only stored for as long as it is necessary for these purposes.

6. Inquiries

If you send us inquiries by email or other means, your details will be saved and used to process the request.

We store inquiries about contracts or of potentially legal relevance during the general limitation period, i.e. three years from the end of the year in which we received your inquiries. We save all other inquiries for a period of 24 months. After that, your inquiries will be deleted unless we are legally obliged to keep them longer.

The storage takes place on the basis of our legitimate interest, the proper documentation of our business operations and the securing of our legal positions (Art. 6 Para. 1 lit.f GDPR).

7. Deletion of your data

Unless otherwise stated, we will delete or anonymize your personal data as soon as it is no longer required for the purposes for which we collected or used it in accordance with the preceding paragraphs. As a rule, we store your personal data for the duration of the usage or contractual relationship via the website plus a period of 30 days in which we keep backup copies after the deletion. We will also keep your data if we are obliged to do so for legal reasons or if the data is needed for criminal prosecution or to secure, assert or enforce legal claims.

If you delete your user account, your profile will be completely and permanently deleted. However, we will keep backup copies of your data for a period of 30 days before they are finally deleted, provided that this data is no longer required for legal reasons or for criminal prosecution or to secure, assert or enforce legal claims.

As far as data has to be kept for legal reasons, processing is restricted. The data will then no longer be available for further use.

Storage beyond the contractual relationship takes place on the basis of our aforementioned legitimate interests in accordance with Art. 6 Para. 1 lit. f GDPR.

8.1. Right to information

You have the right to receive information from us at any time on request about the personal data processed by us in the scope and under the conditions of Art. 15 GDPR and § 34 BDSG. To do this, you can submit an application by post or email to the above address.

8.2. Right to correct incorrect data

You have the right to request that we immediately correct your personal data if it is incorrect. For this, please contact the contact addresses given above.

8.3. Right to cancellation

You have the right, under the conditions described in Art. 17 GDPR and § 35 BDSG, to request that we delete your personal data. These requirements provide in particular a right to erasure if the personal data is no longer necessary for the purposes for which they were collected or otherwise processed, as well as in cases of unlawful processing, the existence of an objection or the obligation to erase them under EU law or the law of the Member State to which we are subject. For the period of data storage, see also section 15 of this data protection declaration. In order to assert your above right, please contact the above address.

8.4. Right to restriction of processing

You have the right to request that we restrict processing in accordance with Art. 18 GDPR. This right exists in particular if the correctness of the personal data between the user and us is controversial, for the duration that requires the correctness to be checked and in the event that the user requests a restricted processing instead of the deletion in the case of an existing right to deletion; furthermore in the event that the data is no longer required for the purposes pursued by us, but the user needs it to assert, exercise or defend legal claims and if the successful exercise of an objection between us and the user is still controversial. In order to assert your above right, please contact the above address.

8.5. Right to data portability

You have the right to receive the personal data concerning you that you have provided to us in a structured, common, machine-readable format in accordance with Art. 20 GDPR. In order to assert your above right, please contact the above address.

8.6. Right to object

You have the right to object to the processing of your personal data at any time for reasons that arise from your particular situation on the basis of Art. 6 Para. 1 (GDPR). Your right to objection exists for reasons arising out of your particular situation, unless we can establish compelling legitimate grounds for processing that outweigh your interests, rights and freedoms or if the processing is necessary for the assertion and exercise of or defence against legal claims (Art. 21 (1) GDPR).

8.7. Right to complain

You have the right to contact a supervisory authority of your choice in the event of complaints.

8.8. Data processing when exercising your rights

Finally, we would like to point out that we exercise the rights according to Process Art. 15 to 22 GDPR to use personal data transmitted by you for the purpose of implementing these rights and in order to be able to provide proof of this. This processing is based on the legal basis of Art. 6 Para. 1 lit. c GDPR in conjunction with Art. 15 to 22 GDPR and Section 34 ( 2) BDSG.