Privacy Policy

for the Shopify app “FakturaKlar” · Last updated: October 2026 · Deutsche Fassung

1. Controller

SyncVentura, owner Igor Savostjanow, Bettina-von-Arnim-Str. 68, 28857 Syke, Germany
Email: info@syncventura.de

2. What this is about

The app is installed through Shopify and runs in the merchant’s Shopify admin. It creates invoices and credit notes for the store’s orders, stores them and makes them available to the merchant, their customers and – at the merchant’s request – their tax adviser.

The merchant is the controller for the data of the store’s customers; we process it only on their behalf (Art. 28 GDPR). The data processing agreement is available at Data processing agreement. We are the controller within the meaning of this policy for the merchant’s own data (access, settings, subscription).

3. Data processed

Store access. On installation, Shopify transmits the store address (myshopify domain) and an access token. Where Shopify provides it at sign-in, the app also stores the ID, first and last name, email address and locale of the signed-in staff member.

Merchant data. Company details for the invoice header (name, address, contact, tax number, VAT ID, bank details, registration details), logo, texts, settings, DATEV settings and – if entered – the tax adviser’s name and email address.

Order and customer data (on behalf of the merchant). For each invoice the app reads the order from Shopify: order number, line items, prices, taxes, shipping, payment method, billing and shipping address (name, company, street, postcode, city, country), email address, customer number and, where present, VAT ID and buyer reference. These details appear on the invoice and are stored with it (database and PDF/XML in the archive), encrypted (AES-256). The invoice is also noted as a link on the order in Shopify.

Download links. Every invoice has a random link that cannot be guessed. Anyone who knows the link can retrieve the invoice; the app only gives it to the merchant, to the customer (customer account, the merchant’s order emails) and – through the adviser access – to the tax adviser.

Subscription. Whether a store has already used the free trial is stored as a non-reversible hash value (HMAC) of the store address together with the date.

Server logs. When the app is accessed, the server processes the IP address, time, requested address and browser identifier.

4. Purposes and legal bases

Providing the app to the merchant: Art. 6(1)(b) GDPR (contract). Invoices with customer data: on behalf of the merchant (Art. 28 GDPR); the merchant relies on Art. 6(1)(b) and (c) GDPR (contract with the customer, obligation to invoice under § 14 UStG and to retain records under § 147 AO, § 14b UStG). Trial record and server logs: Art. 6(1)(f) GDPR (preventing abuse, secure operation). Emails to us: Art. 6(1)(b) or (f) GDPR.

5. Recipients

• Shopify (Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, Ireland): the platform through which the app is installed, billed and used and from which the order data comes. Shopify is responsible for its own platform.
• netcup GmbH (Daimlerstraße 25, 76185 Karlsruhe, Germany): server hosting in Germany, as a sub-processor.
• STRATO GmbH (Otto-Ostrowski-Straße 7, 10249 Berlin, Germany): storage for backups in Germany. Backups are encrypted before transfer; STRATO cannot read them.
• IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany): sending emails to the tax adviser (only if the merchant enables the monthly email) and forwarding emails sent to info@syncventura.de to our mailbox at Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).
• The merchant’s tax adviser: only if the merchant enters them or gives them the link.

The app and its data stay in the EU. Only emails to us may also be processed in the USA via Google; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR).

6. Retention

• Invoices and credit notes are kept as long as the app is installed. The merchant must retain invoices for 8 years (§ 147 AO, § 14b UStG); if a customer requests erasure, they are therefore kept (Art. 17(3)(b) GDPR).
• On uninstall the app immediately deletes the access tokens.
• 48 hours after uninstall, Shopify requests the deletion of all store data; the app then deletes everything for that store, including all invoices and files – except the trial record. Merchants should therefore export their invoices (document archive) before uninstalling.
• Trial record: 180 days, also after uninstall.
• Server logs: 7 days.
• Backups: deleted data disappears when the backup expires, after 12 months at the latest.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). An email to info@syncventura.de is sufficient. You may also lodge a complaint with a supervisory authority (Art. 77 GDPR); the competent authority is the Data Protection Commissioner of Lower Saxony, Prinzenstraße 5, 30159 Hannover, Germany.