Who we are
Everlist is a Shopify app published by Alessio Bussolari (Negozione), Via del Prete 121, 47841 Cattolica (RN), Italy, VAT no. 02037590383. We process personal data in two different roles, explained below: as controller for our own relationship with the merchants who install the app, and as processor on behalf of each merchant for the data of that merchant's customers.
For any question about this policy you can write to [email protected].
What Everlist does
Everlist lets a Shopify merchant create gift registries — baby showers, weddings, birthdays and similar occasions. The registry owner picks products from the store catalogue, and guests open a public link and buy those gifts through the store's Shopify checkout.
Store data we access
When a merchant installs Everlist, Shopify grants us access to the following, strictly to make the app work:
- Store details: name, domain, contact email, plan, currency and language.
- Products and inventory: to let registry owners choose gifts and to keep prices and availability up to date.
- Orders: to know when a gift has been purchased and mark it as received.
- Customers: name and email only, to create or update the Shopify customer account of the person who owns a registry.
Personal data we process
Besides the store data above, Everlist stores:
- Registry owner: name and email address.
- Guests who give a gift: name, email address and the message they choose to leave.
- Technical data: application logs and error reports, needed to keep the service running and secure.
Why we process it
As controller. We use the store details and the merchant's contact details to provide the app and its support: the legal basis is the performance of our contract with the merchant (Art. 6(1)(b) GDPR). These details are needed to install and use Everlist: without them the app cannot work. When we deal with a member of the merchant's staff, we use their contact details on the basis of our legitimate interest in managing the relationship with the merchant (Art. 6(1)(f) GDPR). We use application logs and error reports, including the technical details they may contain about the people using the app, to keep Everlist secure and working: the legal basis is our legitimate interest (Art. 6(1)(f) GDPR).
As processor (Art. 28 GDPR). The data of the merchant's customers, meaning registry owners and the guests who give a gift, is controlled by the merchant, who decides why it is used and on which legal basis, usually the performance of its contract with its own customer. We process it only on the merchant's instructions, given through the app's settings, to create and display registries, let guests buy gifts, notify the people involved and provide support. We do not use it for any purpose of our own. Hetzner and Amazon Web Services, listed below, act as our sub-processors for this data.
We never sell personal data, and we never use it for advertising or profiling.
Where the data is stored
Our primary storage is in Germany, inside the European Union: the application and its database run on Hetzner servers in Germany, and uploaded images (registry and store logos) are kept there or in Amazon Web Services storage in the Frankfurt region, Germany. All traffic between your browser, Shopify and our servers is encrypted with TLS.
Shopify keeps store and customer data on its own platform, under the merchant's agreement with Shopify and Shopify's own privacy policy.
How long we keep it
We keep the data for as long as the app stays installed on the store.
When a merchant uninstalls Everlist, Shopify sends us a shop deletion request 48 hours later, and we delete all data belonging to that store.
If a customer asks the merchant to delete their data, Shopify forwards the request to us and we anonymise that person's details so they can no longer be traced back to them. If a customer asks for a copy of their data, we provide it to the merchant, who passes it on.
Who we share it with
We only share data with the providers we need to run the service:
- Shopify — the platform hosting the store and processing payments. For stores in Europe the contracting company is Shopify International Limited, Ireland. When Shopify transfers data outside the EU to its group companies, including its parent Shopify Inc. in Canada (a country covered by an adequacy decision of the European Commission), it relies on its Binding Corporate Rules; transfers to other recipients rely on the Standard Contractual Clauses of the European Commission, as set out in the Shopify Data Processing Addendum.
- Hetzner Online GmbH — our hosting provider in Germany.
- Amazon Web Services — storage of uploaded images in the Frankfurt region, Germany. The data stays in the EU; if Amazon Web Services, Inc. accesses it from the United States, that transfer relies on the EU-US Data Privacy Framework, under which the company is certified, and on the Standard Contractual Clauses of the European Commission included in its data processing terms. You can request a copy of these safeguards at [email protected].
- CloseYourIt (formerly called BugToMe) — our own error monitoring service, run by us on Hetzner servers in Germany. Names, email addresses and other personal details are removed before an error report is sent, and the reports are not passed on to third parties.
Your rights
Under the GDPR you can ask to access, correct or delete your data, to restrict its processing, to object to it and to receive it in a portable format.
If you are a customer of a store (a registry owner or a guest), the store is the controller of your data: contact it first, and we will help it answer. You can also write to us at [email protected] and we will pass your request on to the store. For the data we process as controller, write to us directly at the same address.
You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of the EU country where you live or work.
Cookies
Everlist sets a single cookie of its own, in the Shopify admin and on public registry pages, and stores nothing in your browser's local storage. It is strictly necessary, so it does not need your consent. The Shopify admin that hosts the app sets its own cookies under Shopify's cookie policy. The cookies and browser storage of this website (negozi.one) are listed on its cookie page. We use no advertising or tracking cookies.
- _everlist_rails_session — the encrypted session cookie of the Everlist app. In the Shopify admin it only holds the security token that protects forms from forged requests: you are signed in through Shopify session tokens, not through cookies. On a public registry page it also remembers the guest's cart for that registry: the draft order with the selected gifts and a random identifier that tells your reservations apart from those of other guests. Duration: until you close the browser.
Changes to this policy
If we change this policy we will update the date at the top of this page and, when the change is significant, we will inform merchants by email.
Contact
Alessio Bussolari (Negozione) — [email protected]