This Privacy Policy explains how ZAHA Global GmbH (“we”, “us”, “MyShopie”) processes personal data when you visit www.myshopie.com, contact us, request a demo, subscribe to our newsletter, or create a MyShopie account. We process personal data in accordance with the EU General Data Protection Regulation (GDPR / DSGVO) and the German Federal Data Protection Act (BDSG).

1. Controller

The controller responsible for data processing on this website is:

Company: ZAHA Global GmbH
Managing Director: Saira Tayyab
Address: Adolfstraße 32, 52134 Herzogenrath, Germany
Email: hello@myshopie.com

For any question about this policy or to exercise your rights, contact us at hello@myshopie.com.

2. Scope: website vs. platform

This policy covers personal data we process as controller in connection with our marketing website and pre-sale relationship with you. When a merchant uses the MyShopie platform to run their own store, that merchant is the controller for their customers’ data and MyShopie acts as a processor on their behalf under a separate Data Processing Agreement (DPA) pursuant to Art. 28 GDPR. That processing is governed by the merchant’s own privacy notice.

3. Data we process when you visit the site

When you access our website, your browser automatically transmits technical data that our hosting infrastructure records in server log files:

anonymised / truncated IP address
date and time of the request
the page or file requested and the amount of data transferred
referring URL, browser type and version, and operating system

This data is necessary to deliver the website securely and reliably, to prevent abuse, and to guarantee stability. Legal basis: Art. 6 (1) (f) GDPR (our legitimate interest in a secure, functioning website). Log data is stored only as long as needed for these purposes and is then deleted or anonymised.

4. Fonts and assets

We self-host our web fonts, stylesheets, and images. We do not load fonts or stylesheets from third-party content-delivery networks such as Google Fonts, so viewing a page transmits no personal data to those providers.

The one exception is the measurement and advertising technology described in section 5, which is loaded from Google, Meta, and TikTok servers only after you consent. If you decline, or before you have chosen, none of those scripts is requested and no data reaches those providers.

5. Cookies and consent

Strictly necessary cookies and equivalent local storage are used to provide functionality you have requested — remembering your chosen language (`myshopie_locale`), your chosen region and the currency that follows from it (`myshopie:market`, `myshopie:currency`), remembering that you dismissed our suggestion of a regional page (`myshopie:market:hint`), and protecting our forms against automated abuse. These hold no identifier, are never read for analytics or advertising, and do not require consent (§ 25 (2) TDDG).

Everything else is off until you switch it on. When you first visit, our cookie banner asks you to choose; until you do, no analytics or advertising technology is loaded (§ 25 (1) TDDG, Art. 6 (1) (a) GDPR). We use Google Consent Mode, so these tools cannot write to storage or receive identifiers while your choice is set to denied. The two optional categories are:

Analytics: Google Analytics 4, loaded through Google Tag Manager (Google Ireland Limited). We use it to understand which pages are useful and where visitors get stuck. IP addresses are truncated and we do not use it to identify you personally.
Advertising: The Meta pixel (Meta Platforms Ireland Limited) and the TikTok pixel (TikTok Information Technologies UK Limited). We use these to measure which of our advertising campaigns bring visitors to this site, to record when an enquiry results from an advertisement, and to limit how often the same advertisement is shown to you.

6. Contact and demo requests

If you contact us or submit a demo request, we process the data you provide (such as your name, shop name, number of locations, region, email address, and your message) to respond to your enquiry and, where relevant, to take steps at your request prior to entering into a contract. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures) and Art. 6 (1) (f) GDPR (our legitimate interest in handling enquiries). We keep this data for as long as needed to process your request and in line with statutory retention periods.

Where you reached our website through an advertisement and have consented to the advertising category under section 5, we also store the campaign parameters contained in the link you followed (such as the campaign name and the advertising platform’s click identifier) alongside your enquiry. We use them to tell which campaign produced the enquiry and to report the conversion back to that platform, as described in section 12. They are not used to build a profile of you, and they are not stored if you have declined that category.

7. “Email me this breakdown” (pricing calculator)

If you ask us to email you a cost breakdown from our pricing calculator, we use the email address you provide to send that breakdown. Legal basis: Art. 6 (1) (a) GDPR (consent). You can object to further contact at any time.

If you subscribe to our newsletter, we use your email address to send you product news and retail-commerce content. We use a double opt-in procedure: after signing up, you receive a confirmation email and are only added once you confirm. Legal basis: Art. 6 (1) (a) GDPR (consent). Every newsletter contains an unsubscribe link; withdrawing consent does not affect the lawfulness of processing before withdrawal.

9. Trial and account data

When you start a free trial or create a MyShopie account, we process your registration and account data (such as name, email, shop details, and billing information) to provide the service and manage the contractual relationship. Legal basis: Art. 6 (1) (b) GDPR (performance of a contract) and, for statutory bookkeeping, Art. 6 (1) (c) GDPR.

10. Payment processing (Stripe)

Subscription billing and, in the product, merchant card processing are handled through Stripe. Merchants connect their own Stripe account, and card payments are made directly to the merchant — MyShopie does not receive or store full card numbers. Where we bill you for a MyShopie subscription, Stripe processes the payment data required to complete the transaction as an independent controller / our processor under its own terms. Legal basis: Art. 6 (1) (b) GDPR. See Stripe’s privacy policy at stripe.com/privacy.

11. Hosting

Our website and application are hosted on cloud infrastructure located within the European Union. Our hosting providers process data strictly on our behalf as processors under Art. 28 GDPR. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in reliable, secure hosting).

12. Recipients and processors

We only share personal data where necessary and lawful — for example with IT, hosting, email, and payment service providers that act as processors on our behalf, or where we are legally required to do so. Each processor is bound by a data processing agreement under Art. 28 GDPR. We do not sell your personal data.

Where you have consented under section 5, the following additional recipients receive website usage data:

Google: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — Google Analytics 4 and Google Tag Manager. Privacy policy.
Meta: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland — Meta pixel and Conversions API. Privacy policy.
TikTok: TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London EC1A 9HP, United Kingdom — TikTok pixel and Events API. Privacy policy.

Where you have consented to the advertising category and then submit an enquiry, we also report that enquiry to Meta and TikTok from our own servers rather than only from your browser, so that the campaign can be measured even if the pixel in your browser is blocked. That report contains the click identifier from the advertisement you followed and your email address and telephone number in irreversibly hashed form only, which those platforms use to match the enquiry to the advertisement. We never transmit your enquiry message, and declining the advertising category prevents this report entirely.

13. International data transfers

We prefer providers that process data within the EU/EEA. Where a transfer to a third country is unavoidable, we ensure an adequate level of protection through an EU adequacy decision or appropriate safeguards such as the EU Standard Contractual Clauses (Art. 46 GDPR).

The measurement and advertising providers named in section 12 contract with us through their EU/EEA entities, but may transmit data to their parent companies in the United States. For those transfers we rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and on the EU Standard Contractual Clauses together with supplementary measures otherwise (Art. 45 and Art. 46 GDPR). You should be aware that US authorities may in principle be able to access data transferred in this way, and that your consent under Art. 49 (1) (a) GDPR also covers this transfer. You can prevent these transfers entirely by declining the analytics and advertising categories — see section 5.

14. Retention

We store personal data only for as long as necessary for the purposes described above or as required by statutory retention obligations (for example commercial and tax law, typically 6 to 10 years for accounting records). Once the purpose no longer applies and no retention obligation remains, the data is deleted.

15. Your rights

Subject to the conditions of the GDPR, you have the right to:

access your personal data (Art. 15)
rectification of inaccurate data (Art. 16)
erasure (Art. 17)
restriction of processing (Art. 18)
data portability (Art. 20)
object to processing based on legitimate interests (Art. 21)
withdraw consent at any time with effect for the future (Art. 7 (3))

To exercise any of these rights, contact us at hello@myshopie.com.

16. Your rights in your country

We are established in Germany and apply the GDPR standard set out in section 15 to every visitor, wherever you are. That is our baseline, not the limit of your rights: if the law of your own country gives you more, you keep it, and where the two differ we apply whichever is more protective of you. The laws below are the ones that apply to the markets we sell into.

EU / EEA, United Kingdom and Switzerland: The rights listed in section 15 apply directly under the GDPR (and, for UK visitors, the UK GDPR and Data Protection Act 2018). You may complain to your own national supervisory authority as well as to ours — see section 17.
Australia: The Privacy Act 1988 (Cth) and the Australian Privacy Principles apply to our handling of your personal information. You may ask us for access to it (APP 12) and ask us to correct it (APP 13). We will notify you and the Office of the Australian Information Commissioner of an eligible data breach as required by the Notifiable Data Breaches scheme. You may complain to us first, and then to the Office of the Australian Information Commissioner (OAIC).
United Arab Emirates: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data gives you the rights to be informed, to access and receive a copy of your data, to have it corrected or erased, to restrict or object to its processing, and to withdraw consent. You may complain to the UAE Data Office. If you deal with us through an entity established in a financial free zone, that zone’s own regime may apply instead (the DIFC Data Protection Law 2020 or the ADGM Data Protection Regulations 2021).
Saudi Arabia: The Personal Data Protection Law (Royal Decree M/19 of 1443H, as amended) gives you the rights to be informed of the legal basis for collecting your data, to access it, to request a copy in a readable format, to have it corrected or completed, and to request its destruction where it is no longer needed. The competent authority is the Saudi Data and Artificial Intelligence Authority (SDAIA).
Pakistan: Pakistan has no comprehensive general data-protection statute in force at the date of this policy; a Personal Data Protection Bill has been under consideration for several years. We therefore apply the GDPR standard in section 15 to visitors in Pakistan as a matter of our own commitment, and we will update this section if and when that legislation commences.
Everywhere else: If your country gives you statutory data-protection rights we have not listed, write to us at hello@myshopie.com and we will honour them.

Whichever country you are in, the single address for every request is hello@myshopie.com. We do not require you to cite a legal provision, and we will not charge you for a first request.

17. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work, or the place of the alleged infringement. The authority responsible for us is the North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen).

18. Changes to this policy

We may update this Privacy Policy to reflect changes to our services or legal requirements. The current version published on this page applies. Please review it periodically.

Privacy Policy