Effective Date: 4 June 2018
Amended: November 2021
WHO WE ARE
Representative for the EU according to Art. 27 GDPR is Neato Robotics Europe, GmbH, Friedrichstraße 55A, 10117, Berlin, Germany.
WHAT DATA ABOUT ME IS COLLECTED AND HOW IS IT USED?
Which Personal Data we Collect
On Which Legal Basis We Process Your Personal Data
We process your data pursuant to Art. 6 GDPR, especially when you give us your consent pursuant to Art. 6 (1) lit. a GDPR, for contractual purposes or for pre-contractual purposes pursuant to Art. 6 (I) lit. b GDPR or based on legitimate interest pursuant to Art. 6 (I) lit. f GDPR.
How We Process Your Personal Data
We inform you herein about how we collect your Personal Data and to what purposes we process your Personal Data.
The types of information that you provide actively and that we collect automatically depend on your level of engagement with our Services. The higher the level of your engagement, the more information we need in order to serve you.
- If You Use Our Website
We collect Information, some of which contains Personal Data that you provide directly to us through responses to special Services such as surveys, questionnaires, and the like. We use this data to personalize our Services and to optimize your customer experience when using our Website.
Moreover, we automatically collect information including Personal Data when you browse our Website, such as your IP address, browser type, operating system, error logs, and other similar information. Such aggregated information does not allow us to identify you and is used by us to analyze trends, to administer the Website, to monitor our Website’s use, and to gather general information about the use of our Website.
The legal basis for such processing of your Personal Data is our legitimate interests (Art. 6(1)(f) GDPR) in customizing the content of our Services in line with user preferences and in further improving our Services.
Please note that you are not legally required to provide us with your Personal Data. However, without your Personal Data, we will not be able to provide you with the full range of our Services.
- If You Become a My Neato Account Holder
In order to access certain Services on our Website, you must first complete certain steps to become either a regular My Neato Account holder or a My Neato account holder as a developer. During these steps, you will be required to provide us with Personal Data such as your name, postcode and email address. When you become a My Neato account holder, we will send you a welcome email to provide transactional information about your subscription or to verify your username and password.
Such processing of your Personal Data is necessary for the performance of our services. The legal basis for such processing of your Personal Data is therefore Art. 6(1)(b) GDPR.
- If You Use Your Neato Robot
If you use your Neato robot, we gather product logs and other data regarding product performance in order to correct problems and make product improvements. These product logs and other product-related data may contain Personal Data.
Such processing of your Personal Data is necessary for the performance of our Services. The legal basis for such processing of your Personal Data is pursuant to Art. 6(1)(b) GDPR.
- If We Send You Service Updates
We use your Personal Data to send you important announcements and updates regarding our Services or about your billing account status. Such announcements and updates contain important information relevant to your use of our Services.
The processing of your Personal Data for such purposes is necessary for the performance of our Services. The legal basis for such processing of your Personal Data is pursuant to Art. 6(1)(b) GDPR. Please note that you are contractually required to provide us with such Personal Data since, without such Personal Data, we will not be able to send you Service-related communication.
- If You Contact Our Customer Service
If you contact our customer service, we will communicate with you in response to your inquiries, to provide the Services you request, and to manage your subscription. We will communicate with you by email or telephone, in accordance with your preferences.
Such processing of your Personal Data is necessary for the performance of our Services; the legal basis for such processing of your Personal Data is pursuant to Art. 6(1)(b) GDPR. Additionally, there is a legitimate interest pursuant to Art. 6 (1) (f) GDPR in providing communication and the functionality of the communication process. Please note that you are contractually required to provide us with such Personal Data and, that without such Personal Data, we will not be able to send you customer service-related communications.
- If You Subscribe to Newsletters and Other Marketing Communications
When subscribing to our Services, you have the option to consent to receiving newsletters and other information on our products and services according to Art. 6 (1) lit. a GDPR.
For this purpose, we process your email-address as well as your first and last name and possibly other data you provide us at your discretion. For verification purposes, the registration takes place using the double-opt-in method, i.e., when registering, we send an email to the email-address you provided us with asking for confirmation of your registration. As part of the application and registration for the newsletter additionally date and time as well as IP address of the invoking computer. This collection takes place to avoid misuse of the services or of the used email address as well as to personalize the promotional information. If you “opt in,” we will send you promotional newsletters and inform you about offers, events and surveys via e-mail and through social media platforms.
We evaluate statistical user data in order to create newsletter content and the newsletter respectively user-friendly and to analyze and optimize our email-marketing-campaigns. By creating receiver profiles and segmenting address lists we can adapt the content to the respective groups of receivers. Therefore we process the following data:
- Clicked links
- Time of opening and frequency
- Frequency of newsletter reception
- Confirmation of receipt and reading of mails
- Operating system, browser, type of device
This individualized evaluation takes place using tracking-pixel the sent emails contain. Your email address is used as an identifier for aggregating the above data. Legal basis for the evaluation of the user behavior is Art. 6 para. 1 lit. a GDPR. As part of the registration process for our newsletter you will be informed about the processing of your personal data for analysis reasons and with registration you actively give your consent to the reception of newsletter.
You can withdraw your consent to the reception of the newsletter and the linked tracking at any time ticking on the unsubscribe link provided in the newsletter or by email to email@example.com . An isolated withdrawal of the consent to tracking is not possible. In this case you will cease to receive the newsletter as well.
- If you take part in sweepstakes
We process personal data that we obtain from you within the scope of the sweepstake.
We generally only collect personal data from you that are necessary for the execution of sweepstakes:
- In case of offline-competitions: Name, address, email-address and phone number
- In case of competitions by text messages or on the phone: Name, address, mobile phone and/or phone number (landline) respectively
- In case of online-competitions: Name, address, email-address
- In case of competitions using WhatsApp, Facebook Messenger and Insta: Name, address, email-address, phone number
- In case of competitions on Facebook: Name, address, email address, phone number, Facebook-name
- In case of competitions on Instagram: Name, address, email address, phone number
We process the collected personal data according to Art. 6 para 1 lit. b GDPR for the purpose of performing the contract, i.e. the sweepstake.
Depending on the sweepstake the collection of further data (e.g. birthday) may be necessary. These data are necessary for the performance of the sweepstake, e.g. for age verification.
Additionally, data processing based on your consent (Art. 6 para 1 lit. a GDPR)
If and when you have given us your consent for the processing of your personal data for determined purposes (e.g. transfer of data within company groups, use of your email-address also for partners and for marketing purposes beyond for own goods or services similar to the one purchased), the legal basis for this processing activities is your consent. You can withdraw a given consent at any time. This does also apply to the withdrawal of consents that have been provided before May 25th, 2018. Please, take into account, that any withdrawal will only be effective for the future. Processing procedures that have taken place before the withdrawal shall not be affected.
We generally process and store your personal data for as long as needed for the performance of the sweepstake and the fulfilment of legal obligations. Thereafter your personal data will be deleted on a regular basis.
Robot owners may register their NEATO robots in their My Neato account. We may ask for other information in surveys to assist us with new product development by asking questions about how you like your NEATO robot or how you use it. You do not have to participate in these surveys.
The legal basis for such processing of your data is your consent (Art. 6(1)(a) GDPR). Please note that you are not legally required to provide us with your Personal Data. However, without your Personal Data we will not be able to send you our newsletters and other information as described above. You have the option to opt out of these types of communication at any time by following the respective instructions in such communication.
HOW WE SHARE AND DISCLOSE PERSONAL DATA
We will not share, sell, transfer or otherwise disseminate your Personal Data to third parties, unless there is a legal basis pursuant to Art. 6 GDPR, especially if this is required by law according to Art. 6(1) 1(c) GDPR, or if this is required for the purpose of your contract according to Art. 6(1) 1 (b) GDPR, of if we are allowed to do so on the basis of a data processing agreement according to Art. 28 GDPR or you have given us express consent to do so according to Art. 6(1) 1(a) GDPR.
We share some of your Personal Data with other Neato companies to the extent necessary for such companies to provide services on our behalf. In particular, we are using other Neato companies to send marketing communication to you if you have given us your consent to do so.
We also use third-party service providers to offer or facilitate services on our behalf and share your Personal Data with such providers to the extent necessary for such providers to perform their services on our behalf. In particular, we use a payment service provider to bill you for goods and services and for credit card processing, a specialist provider for fraud screening, a shipping company to fulfill orders, a call center provider to facilitate customer service, a social media agency to manage our social media campaigns, a repair center for receiving and repairing defective units.
Some of the companies we share your Personal Data with as described above are located outside of the European Economic Area.
In order to grant sufficient protection of your Personal Data in this context, we use standard data protection clauses adopted by the European Commission according to Art. 46(2)(c) GDPR with such companies. You can request further details by contacting us at the contact details as mentioned below.
We may also be required to disclose your Personal Data to government or law enforcement officials in response to a lawful request by a public authority or if we have to do so to comply with a legal obligation, court order, subpoena, or to cooperate with a law enforcement investigation or to meet national security or law enforcement requirements according to Art. 6(1)(c) GDPR. We can also disclose your information in order to pursue our legitimate interest in applying or enforcing our terms and conditions or in responding to any claims, in protecting our rights or the rights of a third party, in protecting the safety of any person or in preventing any illegal activity (including for the purposes of fraud protection and credit risk reduction) according to Art. 6(1) 1 (f) GDPR.
IS MY PERSONAL DATA USED FOR ANY OTHER PURPOSES?
WHAT RIGHTS DO I HAVE?
You have the following rights:
- Right of access (Art. 15 GDPR): You have the right to request confirmation as to whether we process your Personal Data and where that is the case, to request access to the Personal Data we hold about you.
- Right to rectification (Art. 16 GDPR): You have the right to request the correction of inaccurate Personal Data.
- Right to erasure (Art. 17 GDPR): You have the right to request erasure of Personal Data without undue delay under certain circumstances, e.g., if your Personal Data is no longer necessary for the purposes for which it was collected or if you withdraw consent on which our processing is based according to Art. 6(1)(a) GDPR and where there is no other legal ground for processing.
- Right to restriction of processing (Art. 18 GDPR): You have the right to request us to restrict the processing of your Personal Data under certain circumstances, e.g., if you think that the Personal Data we process about you is incorrect or unlawful.
- Right to data portability (Art. 20 GDPR): Under certain circumstances, you have the right to receive your Personal Data you have provided us with, in a structured, commonly used and machine-readable format and you have the right to transmit that information to another controller without hindrance or ask us to do so.
- Right to object (Art. 21 GDPR): You have the right to object to the processing of your Personal Data under certain circumstances, in particular if we process your Personal Data on the legal basis of legitimate interests (Art. 6(1) 1 (f) GDPR) or if we use your Personal Data for marketing purposes. If you object to the processing of your Personal Data, we will not continue processing your Personal Data unless we can prove mandatory protectable reasons for the processing that supersedes your interests, rights and freedom or that the processing is for the enforcement, exercising or defense of legal claims.
You can assert your abovementioned rights by contacting us at the contact details mentioned below.
We store your Personal Data and other information for as long as necessary to enable you to use our Services, to provide our Services to you, to comply with applicable laws (including those regarding document retention), to resolve disputes with any parties and otherwise as necessary to allow us to conduct our business. If you have a question about a specific retention period for certain types of Personal Data we process about you, please contact us at the contact details mentioned below.
AUTOMATED INDIVIDUAL DECISION-MAKING
We do not use your Personal Data to make decisions with legal or similar effects for you based on the automated processing of your Personal Data only.
RIGHT TO LODGE A COMPLAINT BEFORE THE DATA PROTECTION AUTHORITY
You have the right to lodge a complaint with a supervisory authority, and in particular in the EU Member State or country of your habitual residence, place of work, or place of the alleged infringement if you consider that our processing of your Personal Data infringes the applicable data protection laws. Please contact us at the contact details mentioned below, and we will assist you to identify the respective competent supervisory authority. [Art. 7 GDPR ]
YOUR CALIFORNIA PRIVACY RIGHTS
California law permits users who are California residents to request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their Personal Data (if any) for their direct marketing purposes in the prior calendar year, as well as the type of personal information disclosed to those parties. If you are a California resident and would like to request this information, please submit your request in an email to firstname.lastname@example.org.
CALIFORNIA DO-NOT-TRACK DISCLOSURE REQUIREMENTS
We are committed to providing you with meaningful choices about the information collected about you, and that is also why we provide the opt-out links above. However, we do not recognize or respond to browser-initiated Do-Not-Track signals, because the Internet industry is still working on uniform Do-Not-Track standards.
We do not knowingly collect any Personal Data from anyone under the age of eighteen (18) without parental consent, unless permitted by law. If we learn that a person under the age of eighteen (18) has provided us with Personal Data, we will delete it in accordance with applicable law.
WHO DO I CONTACT IF I HAVE ANY QUESTIONS CONSIDERING MY PERSONAL DATA?
By Email: email@example.com
Or by mailing us at the address below:
Neato Robotics, Inc.
50 Rio Robles
San Jose, California 95134
For the EU:
Neato Robotics Europe, GmbH
10117, Berlin, Germany
A cookie is a small data file containing a string of characters that is sent to your computer when you visit a website. When you visit the website again, the cookie allows that site to recognize your browser. The length of time a cookie will stay on your computer or mobile device depends on whether it is a “persistent” or “session” cookie. Our Website uses both types of cookies. Session cookies will only stay on your device until you stop browsing. Persistent cookies stay on your computer or mobile device until they expire or are deleted.
We use tracking services for technically necessary purposes, preference, statistical and marketing purposes.
Further information about the cookies we use and about how to opt out can be accessed here: Cookies
We Use the Following Types of Cookies:
- First-Party Cookies. First-Party cookies are cookies set by us when you visit our Website. These are cookies by neatorobotics and shop.neatorobotics. Our cookies store information about your location and language. These cookies cannot be blocked. If you do not wish to receive them, do not use our Website. Legal basis is our legitimate interest in providing a working and user-friendly homepage in accordance with Art. 6 (1) lit. f GDPR.
- Third-Party Cookies Used to Target Ads to You When You are on Other Websites. We work with other companies who use their cookies to target Neato Robotics ads to you on other websites. For this purpose, a code is integrated into our Website (“retargeting tag”), by means of which the retargeting service provider can collect pseudonymous data for advertising purposes. When you visit one of our Websites that contains a “retargeting tag,” the retargeting service provider sets a cookie on the user’s device and assigns it to specific retargeting groups to serve personalized advertising on other websites. Specifically which data is collected in detail results from the privacy policies of the retargeting service provider. The retargeting service providers, their privacy policies, as well as other information including about how to opt-out can be accessed at the above link.
- Device Identifiers. When you use a mobile device such as a tablet or cell phone to use our Website, we may assign or access one or more tokens or “Device Identifiers.” Device Identifiers are small data files associated with your mobile device that uniquely identify your mobile device to us. A Device Identifier may deliver information to us or a third party partner about how you browse and use our Services and may help us or others provide reports or personalized ads. Some Website features may not function properly if use or availability of Device Identifiers is impaired or disabled.
Information regarding the tracking service provider:
2. Google Tag Manager
The Google Tag Manager is a service provided by Google LLC 1600 Amphitheatre Parkway Mountain View, CA 94043, USA, which serves to steer rule-based provision of functional, statistical, preference or marketing cookies. The Google Tag Manager itself therefore does not collect or process personal data. In order to monitor system stability and performance, Google Tag Manager may collect some aggregated data about tag firing. This data does not include user IP addresses or any user-specific identifiers that could be associated with a particular individual. Other than data in standard HTTP request logs, all of which is deleted within 14 days of being received, Google Tag Manager does not collect, retain, or share any information about visitors to customers’ properties, including page URLs visited.
For further information regarding this topic see Data privacy and security - Tag Manager Help (google.com)
We use the service provider for fraud prevention Signify provided by Signifyd Inc. (2540 North First Street, Ste. 300, San Jose, CA 95131, USA) for administration of payments and fraud prevention where payment takes place by credit card. Signifyd will analyze the orders and seek to recognize potential fraud intents.
Signifyd will use data transmitted by us sporadically and only in cases of suspected threat, in order to compare those with their databank and to then provide an assessment regarding the fraud risk.
For this purpose, we transmit the following data to Signifyd:
- Transaction data (delivery address, invoice address, name, phone number)
- Email address
- Country of delivery
- IP address
The legal basis for the use of data for fraud prevention is Art. 6 (1) 1 lit. f GDPR. This also justifies our legitimate interest. The implementation of Signifyd makes it possible for us as shop provider to get a refund of order value in case of detected manipulation.
When transferring data to Signifyd Inc., a transfer of personal data to the USA takes place. For this purpose, we have signed the Standard Contractual Clauses.
For further information please visit https://www.signifyd.com/privacy/.
On our Website, we offer a rating form for our products in order to improve customer satisfaction using the service BazaarVoice. Service Provider is the BazaarVoice Inc., Austin, Texas, USA.
We use the service in order to provide rating functions and in order to evaluate the ratings. Your ratings will be accessible for all visitors of our Website.
When using the tool, personal data that you transmit within the recording process (like (nick)name, email-address, place of residence, gender, age) and for quality purposes will be processed. The fields marked with an asterisk are mandatory fields. The usage of the rating form is optional and does not oblige you to disclose personal data. Especially disclosing your real name is not mandatory for the rating.
Alternatively, you can always contact us as usual.
- IP address of your computer
- Sites visited within the BazaarVoice-network
- Date and time of your visit
- Type and version of browser
- Other clickstream data (summarized as “analytics and tracking data”)
Legal basis for the use of this tool is our legitimate interest pursuant to Art. 6 (1) 1 lit f GDPR. Reason is the warrant of customer satisfaction and optimization of our products based on the ratings.
It is possible that our service provider BazaarVoice also processes your data in the USA. Therefore, we have signed EU Standard Contractual Clauses with the service provider.
In order to deal with customer requests, we use the Zendesk support tool, a customer service platform by Zendesk, Inc. (109 Market Street, San Francisco, CA 94103 USA). Our Website will collect necessary data to handle your customer request such as first name, last name, and email address. If you have contacted us by email or using a form, we will only process the data obtained from you for the processing of your concrete request.
Legal basis is your consent pursuant to Art. 6 (1) 1 lit. a GDPR in the case of requests regarding the contract with us Art. 6 (1) 1 lit. b GDPR as well as our legitimate interest pursuant to Art. 6 (1) 1 lit. f GDPR. The transfer takes place in order to answer to your request quickly and efficiently. This is also our legitimate interest for processing of aforementioned data by third party. When contacting us, you agree to the transfer of your data to Zendesk.
6. Use of Google Analytics
If you have given your consent, our Website uses Google Analytics, a web analysis service of Google LLC 1600 Amphitheatre Parkway Mountain View, CA 94043, USA (”Google“).
(1) Extent of Processing
Google Analytics uses ”Cookies“ to allow the website operator to analyze how users use the site. The information generated by the cookie about your use of this Website is usually transferred to a Google server in the USA and stored there.
We use the function “anonymizeIP” (referred to as IP-masking): Due to the activation of the IP masking on this Website your IP address will be shortened from Google within member states of the EU or in other member states of the Treaty of the European Economic Area. Only in exceptional cases will the entire IP address be transmitted to a server in the USA and shortened there. The IP address transmitted within Google Analytics will not be gathered with other data from Google.
During your visit on our Website, among other, the following data will be collected:
- The sites you visited, called your “click-path”
- Reaching of “web-aims” (conversions, e.g., signing up to newsletters, downloads, purchases)
- User behavior (e.g., clicks, time spent, rate of drop outs)
- Approximate location (region)
- Your IP-address (shortened)
- Technical information about your browser and the devices used (e.g., language settings, display resolution)
- Internet provider
- Referrer-URL (from which web page/with which advertising medium have you reached the webpage)
(2) Processing Purpose
On behalf of operator of this Website, Google will use this information in order to analyze your use of the Website and to generate reports about the Website activities. The reports generated by Google Analytics serve to analyze the performance of our Website and the success of our marketing campaigns.
Receiver of the data is Google LLC 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. We have concluded the EU-Standard contractual clauses with Google.
Google LLC is located in California, USA and if need may be US-American authorities can access the data stored with Google.
(4) Period of Storage
Data provided by us and tied to cookies will be deleted automatically after 14 months. The deletion of data whose retention time has been reached will take place automatically once a month. Additionally, you can avoid the collection of data generated by cookies and by usage of our Website (incl. your IP address) by Google as well as processing by Google by
- Not giving your consent to the setting of cookies or
- Downloading browser add-on in order to deactivate Google Analytics Here and install it
You can also avoid storage of cookies using the respective browser settings, however, if you configure your browser so that all cookies are being rejected, this can lead to limitations of functionality on this and other websites.
(5) Legal Basis and Withdrawal of Consent
Legal basis for the processing of data is your consent pursuant to Art. 6 (1) 1 lit. a GDPR. You can always withdraw your consent moving forward if you open the cookie settings and change your choice there.
For more information about Google Analytics T&C and about data protection with Google, go here
7. Google Ads
We use the online marketing tool “Google Ads” provided by Google LLC 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. Legal basis is Art. 6 (1) 1 lit a GDPR. If you have reached our page using an ad placed by Google, Google Ads will place a cookie on your device. The cookie for the conversion-tracking will be set if a user clicks on an ad placed by Google. When this happens, the following personal data will be processed: Cookie-ID, IP-address, location, browser information, data of usage, date and time of your visit.
Cookies lose their validity after 90 days and do not serve for personal identification. Every Google-Ads customer will obtain a different cookie. Therefore, cookies cannot be tracked with the websites of ad customers. The information gathered with support of the conversion cookie serves to establish conversion statistics for ad customers that have opted for conversion tracking. The customer will be informed about total number of users that have clicked on the ad and that have been forwarded to a page that has been provided with a conversion tracking tag. They will not obtain any information, however, that will make it possible to identify the user personally. If you do not want to take part in tracking, you may deactivate the cookie using your browser settings and no longer be part of the conversion-tracking statistics.
The information about your use of this Website gathered with the cookies will be transferred to Google’s server and will be stored there. A data transmission to the USA cannot be excluded. The EU-Standard contractual clauses have been concluded regarding this data transfer. We cannot control the actual storage period or deletion. For more information visit https://policies.google.com/privacy?hl=en-US
8. Social Media Plug-Ins
(2) We neither have any influence on collected data or processing processes nor do we have complete knowledge about the extent of data collection, purpose of processing, or storage periods, nor do we do not have information regarding the deletion of data collected by plug-in provider.
(3) The plug-in provider will store your data as user profiles and will use them for marketing, market research and/or personalized configuration or its website. Such evaluation especially takes place (also for users not logged in) in order to present personalized advertisement and in order to inform other users of the social network about your activities on our Website. You have the right to object to the creation of such user profiles. For this, must contact the respective plug-in provider. Using the plug-ins, we offer you the possibility to interact with social networks and other users, so we can improve our offer and make it more interesting for you. Legal basis for the use of the plug-in is Art. 6 (1) 1 lit. f GDPR.
(4) The transmission of data takes place irrespective of you having an account with the plug-in provider or of you being logged in. If you are logged in with the plug-in provider your data collected by us will be allocated to the account, you have with the plug-in provider. If you confirm the activated button and e.g., link to the site, the plug-in provider will also store this information to your account and will share this with your contacts publicly. We suggest you log off from the account on a regular basis when using a social network, especially before activating the button, thus being able to avoid the allocation to your profile with the plug-in provider.
a) Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland; http://www.facebook.com/policy.php ; weitere Informationen zur Datenerhebung: http://www.facebook.com/help/186325668085084 .
c) Twitter, Inc., 1355 Market St, Suite 900, San Francisco, California 94103, USA; https://twitter.com/privacy .
f) LinkedIn Corporation, 2029 Stierlin Court, Mountain View, California 94043, USA; http://www.linkedin.com/legal/privacy-policy .
We use Shopify in order to provide our online-shop and the return portal Return Magic. European service provider for these tools is the Shopify International Limited (Victoria Buildings, 2. Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.)
Using cookies Shopify processes, the following Personal Data of our customers if you access our shop:
- Name, company name
- Phone number, email-address
- Delivery and invoice address, payment data
- Information about orders you have placed
- Information about the seller-shops supported by Shopify that you visit
- Information about the used device, network connection and the browser.
Shopify uses the information in order to provide different support services such as handling of orders, risk and fraud assessment, authentication and payment. Furthermore, Shopify uses this information to improve its services.
If you sign up for Shop Pay, Shopify will store and use this information in order to pre-fill out the checkout information. Furthermore, this information will be used in order to adapt your visit to you and to improve your experience, presenting goods and services to you that most probably are of interest for you.
Some of the Personal Data that Shopify communicates (e.g., IP-addresses or payment data) will be used for automated decision up to a certain degree, in order to automatically block transaction that might be fraudulent for certain time.
Legal basis for the use of Shopify is Art. 6 (1) 1 lit. f GDPR. Our legal basis lies in a user friendly offer of our online-shop and the safe execution of orders.
For more information see https://www.shopify.com/legal/privacy.