Privacy Policy

The provider and controller within the meaning of Art. 4(7) GDPR for operating the Frutoli app as a software service is:

Timmgard GmbH

Kurhausstraße 78a

53773 Hennef

Germany

Commercial register: HRB 17527 (Local Court of Siegburg)

VAT ID: DE359202464

Represented by: S. Timm

Email: [email protected]

Contact form: https://tg-ai.de/en/kontakt - we usually reply within 24 hours

For the processing of data in the context of specific booking transactions, Timmgard GmbH is a processor under Art. 28 GDPR; the merchant (shop operator) is the controller in that respect - see Section 2.

Timmgard GmbH processes personal data in two capacities:

•As controller for installation, operation and billing vis-à-vis the merchant: shop master data, the Shopify user ID of staff for sign-in and language settings, the records of acceptance of the terms of service and the data processing agreement, the support chat and the log of the Shopify compliance webhooks.

•As processor under Art. 28 GDPR for all data processed to carry out the rental: booking and renter data, waitlist entries, team members, the calendar feed and the staff identifier insofar as it is recorded as the actor in the booking history and the audit log. The merchant is the controller for this data. The basis is the data processing agreement (DPA) at https://tg-ai.de/en/dpa/frutoli, which the merchant accepts in the App.

The merchant, as controller, is itself responsible for providing its own privacy policy, determining the legal bases of its processing and answering data subject requests from its end customers. As the provider of its online shop, it must also inform visitors about the browser storage entries used by the booking widget (Section 16).

We process personal data in the following categories. Data that does not come from the data subject is obtained from the merchant's Shopify shop via the Shopify Admin API or Shopify webhooks (Art. 14(2)(f) GDPR).

Merchants and staff

•Shopify shop domain, shop name, the shop's contact address and app settings, as well as the access tokens of the Shopify installation

•The Shopify user ID of staff who open the App, with their language setting

•Record of acceptance of the terms of service and DPA: shop domain, Shopify user ID of the accepting person (where Shopify provides it), time, language and the versions of the terms of service and DPA

•The subscribed plan. Billing status is queried from Shopify when needed and only cached briefly in memory. Frutoli processes no payment data: billing runs exclusively through Shopify, and we do not see merchants' credit cards, bank accounts or billing addresses

•Support chat messages, onboarding ratings and feature requests

Team members

Contacts for pickups, returns and notifications: first and last name, email address, optional phone number, role, responsibility per rental item, absence periods and notification settings. On installation, the App takes the shop owner's name and email address from Shopify as the first team member; the merchant creates further team members. Team members receive no separate app access; who may open the App is governed by Shopify.

Customers and renters (per booking)

•Name and - where entered in the booking form - first and last name separately

•Email address

•Phone number, only if entered in the App's booking form or in a manual booking by the merchant

•Booking language

•Shopify customer ID (where assigned by the shop or created or linked by the App)

•Customer note: an optional free-text field that may contain personal information and is stored as entered

•Answers to additional questions defined by the merchant

•Marketing consent (yes/no), as well as the booked rental period, rental item, quantity, price, deposit and order reference

•Differing purchaser: if someone other than the renter pays, their name, email address and Shopify customer ID are also stored

•Information recorded by the merchant: internal notes on the booking, notes in the booking history, the reason for retaining part of a deposit and, where applicable, a no-show fee

If a booking comes about through a Shopify order without the App's form, the App takes only the customer ID, name, email address and language from the order. No delivery or billing address is collected; handover takes place at the merchant's pickup location.

Reservations

While a rental period is held in the cart, the App stores the details from the booking form and an irreversible key (SHA-256 hash) derived from the shop domain, the visitor's IP address and a random browser identifier (see Section 16). The key is used only to limit the number of simultaneous reservations per visitor; it is pseudonymous data. The IP address itself is not stored.

Waitlist

When joining the waitlist of a fully booked rental item: first and last name, email address, optional phone number, language, marketing consent, desired period and quantity, the product page and the double opt-in confirmation status (the confirmation link is stored only as a hash). To limit entries per visitor, the same key as for reservations is derived.

Calendar feed

On the BUSINESS plan, the merchant can subscribe to its bookings in a calendar app via a secret link. The calendar contains rental item, quantity, order number, period, status and pickup location, but no customer names or contact details.

Email delivery and suppression list

The App maintains a send queue and a delivery log of emails. It stores the recipient and sender address, email type, language, delivery status, the delivery provider's message identifier and, where applicable, an error message, but no email content - content is generated at send time from the then-current data. Delivery notifications from the email provider are stored briefly. To suppress further deliveries after a permanent bounce, complaint or manual block, we keep a suppression list per shop in which the address is stored as a SHA-256 hash; this hash is also pseudonymous data.

Technical data and logs

•Accountability log (audit log): shop, action type, actor and timestamp; the details contain no email addresses or other plaintext customer data

•Log of the Shopify compliance webhooks (type of request, times, status); for erasure requests, the Shopify customer ID is stored only as a keyed hash (HMAC-SHA256)

•Webhook deduplication markers to prevent duplicate processing (no personal content)

•View counters for rental calendars on product pages (daily counts per rental item, no personal data)

•IP address: processed only ephemerally in memory for rate-limiting (abuse prevention) and for the key described above, and not stored in the database

We use the collected data exclusively to provide the App's functions:

•Checking availability, reserving rental periods and managing bookings (including conflict and cancellation detection)

•Creating and linking Shopify orders or draft orders and, at the merchant's request, creating or linking a Shopify customer

•Managing deposits, no-show fees and refunds via Shopify

•Sending transactional emails to customers (including booking confirmation, receipt, acceptance or rejection of a request, cancellation, deposit refund, pickup and return reminders, notice of an overdue return, waitlist confirmation and notification) and to the merchant's team members via Amazon SES (see Section 6)

•Running and notifying the waitlist with double opt-in

•Automatically assigning new bookings to responsible team members

•Calendar feed for the merchant

•Recording acceptance of the terms of service and DPA

•Providing a support chat between merchant and provider

•Triggering Shopify Flow events (the transmitted payload contains no customer names or email addresses)

•Abuse prevention via rate-limiting and signed cart line items

•Handling the Shopify compliance webhooks and recording their handling

Where Timmgard GmbH processes personal data as controller:

•Art. 6(1)(b) GDPR - performance of the contract for using the App, in particular sign-in, billing and support

•Art. 6(1)(f) GDPR - legitimate interest in secure and stable operation (audit logging, webhook deduplication, rate-limiting) and in being able to prove the conclusion of the contract and the proper handling of data subject requests in order to defend against claims (acceptance records, compliance log)

Where Frutoli processes data on the merchant's behalf (Art. 28 GDPR), the merchant is the controller and determines the legal basis (generally Art. 6(1)(b) GDPR - carrying out the rental; for waitlist entries and marketing consent possibly Art. 6(1)(a) GDPR).

We do not sell, rent or transfer personal data to third parties for advertising, profiling or marketing purposes.

Shop platform

•Shopify Inc. (151 O'Connor Street, Ottawa, Ontario K2P 2L8, Canada) is the platform on which the merchant runs its shop. On the merchant's instructions, the App reads data from its Shopify shop and writes orders, customers and refunds back to it; in doing so, Shopify acts as the merchant's service provider, not as our sub-processor. The connection of the App is governed by the Shopify partner and API terms; the App is billed to the merchant via Shopify.

Processors (with a data processing agreement under Art. 28 GDPR)

•Render Services Inc. (525 Brannan St, Suite 300, San Francisco, CA 94107, USA) - hosting of the application and the PostgreSQL database. Server location: Frankfurt, Germany (EU). DPF-certified since 6 January 2025; subsidiarily EU Standard Contractual Clauses (SCCs) 2021/914.

•Amazon Web Services EMEA SARL (38 Avenue John F. Kennedy, L-1855 Luxembourg; services operated by Amazon Web Services, Inc., USA) - delivery of the App's emails via Amazon SES and reporting of bounces and complaints via Amazon SNS. The sender is a platform address under mail.frutoli.app or, if the merchant has set it up and verified it, an address under the merchant's own domain; replies go to the reply-to address set by the merchant or the shop's contact address. Processing takes place in the EU region eu-north-1 (Stockholm, Sweden). Amazon Web Services, Inc. is certified under the EU-U.S. Data Privacy Framework as part of the certification of Amazon.com, Inc.; SCCs 2021/914 apply subsidiarily under the AWS DPA.

•Slack Technologies Limited (a Salesforce company; Salesforce Tower, 60 R801, North Dock, Dublin, Ireland) - delivery of the support chat to our support team. Transmitted are the merchant's messages with shop domain and shop name as well as notices about installation, plan changes, read receipts, feature requests and onboarding ratings. No renter, waitlist or order data is transmitted unless the merchant writes it into the chat itself. Contracting party in Ireland (EU); the processing infrastructure is located in the USA. DPF-certified (Salesforce/Slack since July 2023); subsidiarily SCCs 2021/914.

For the data we process on the merchant's behalf, Render and Amazon Web Services are also the sub-processors authorised in the DPA at https://tg-ai.de/en/dpa/frutoli (Annex 3).

The App and its database run in the EU (Frankfurt, Germany); emails are sent in the EU (Stockholm, Sweden). Transfers to third countries may occur to the service providers named in Section 6 or their group companies and are safeguarded by:

•Render Services Inc. (USA): DPF-certified since 6 January 2025; subsidiarily SCCs 2021/914

•Amazon Web Services (Luxembourg/USA): Amazon Web Services, Inc. DPF-certified; subsidiarily SCCs 2021/914

•Slack/Salesforce (Ireland/USA): DPF-certified since July 2023; subsidiarily SCCs 2021/914

•Shopify (Canada/USA, the merchant's service provider): adequacy decision for Canada (Decision 2002/2/EC) and the safeguards of the Shopify DPA

Transfers to the USA rely on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework of 10 July 2023. An appeal against this decision is pending before the Court of Justice of the European Union; should the decision cease to apply, the transfers will rely on the Standard Contractual Clauses mentioned. Supplementary technical and organisational measures (transport encryption, access restrictions) apply.

We implement appropriate technical and organisational measures under Art. 32 GDPR:

•Storage on Render-operated servers in the EU (Frankfurt); database backups with point-in-time recovery according to the Render plan booked

•TLS encryption for all data transfers

•HMAC signature verification and insert-first deduplication of incoming webhooks; compliance and uninstall webhooks reject on an invalid signature or error (fail-closed)

•Tenant isolation via the shop identifier in all database queries

•Signed cart line items (HMAC) against manipulation of booking data

•Email suppression list only as a hash; no email content in the delivery log

•Ephemeral, non-stored processing of the IP address

•Masking of email addresses in application logs; Shopify Admin API permissions limited to what is needed

•Access to personal data restricted to authorised personnel

As a processor, Frutoli must be able to read customer and renter data to provide the service; end-to-end encryption therefore does not take place.

•Bookings: the personal fields of a booking (name, email address, phone number, note, answers, purchaser data, notes and reason for a deposit retention) are removed 365 days after the rental ends by default; the merchant can configure this period (at least 30 days). The recipient addresses of the related emails are cleared at the same time. The remaining booking record (rental period, rental item, quantity, price, order reference) is kept for correct availability calculation until the shop data is deleted. Via the order reference, the merchant can link the booking to a person again in Shopify; the record is therefore pseudonymised, not anonymous.

•Reservations: form data and the visitor key are deleted 2 days after the reservation expires.

•Waitlist: unconfirmed entries after 48 hours, confirmed entries 30 days after the end of the desired period; the visitor key after 24 hours.

•Email delivery log: 90 days after sending; delivery notifications from the email provider after 30 days.

•Email suppression list: until the shop data is deleted, also after an erasure request, so that a blocked address is not contacted again (Art. 6(1)(f), Art. 17(3) GDPR).

•Audit log and support chat in the App: until the shop data is deleted. In our support team's Slack channel, messages are deleted after 12 months.

•Acceptance records: 3 years after the shop data is deleted (limitation period for contractual claims).

•Compliance webhook log: 3 years after the request is completed.

•Webhook deduplication and view counters: automatic cleanup, no personal data.

•Uninstallation: the uninstall webhook deletes the access sessions. All other shop data is deleted on receipt of the shop/redact compliance webhook, which Shopify sends about 48 hours after uninstallation; after that, it remains in database backups for at most 7 days.

•Individual customers on request: immediately upon receipt of the customers/redact compliance webhook (see Section 15).

•Payment and order data: managed by Shopify and outside Frutoli's responsibility.

Before uninstalling, the merchant can export all of its shop's data in the App under Settings > Legal & data.

Frutoli carries out no automated decision-making within the meaning of Art. 22 GDPR producing legal effects on data subjects, and performs no profiling. The merchant decides manually whether to accept or reject a booking request; open requests are not rejected automatically.

Frutoli processes booking data, on the merchant's behalf, of customers who have made a booking in the shop. The App does not specifically collect data from minors and is not directed at children. Whether and how the age of customers is to be verified is decided by the merchant.

Data subjects have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent with future effect (Art. 7(3)).

Note on the right to object (Art. 21 GDPR): where we process data as controller on the basis of Art. 6(1)(f) GDPR (Section 5), you have the right to object at any time on grounds relating to your particular situation.

As a customer of a merchant, please contact the merchant (shop operator) directly; the merchant is responsible for your booking data and responds to your request within the period under Art. 12(3) GDPR (generally one month). Requests received via Shopify are carried out through the compliance webhooks (Section 15). For data we process as controller, you can reach us at [email protected].

Data subjects have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for Timmgard GmbH is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)

Kavalleriestraße 2-4

40213 Düsseldorf

Germany

https://www.ldi.nrw.de

Timmgard GmbH is not required under Section 38 of the German Federal Data Protection Act (BDSG) to appoint a data protection officer, as generally fewer than 20 persons are permanently engaged in the automated processing of personal data and no processing takes place that is subject to a data protection impact assessment or whose core activity consists of large-scale regular monitoring or processing of special categories of personal data. Data protection inquiries are handled centrally at [email protected] and answered within the statutory periods.

The App processes all compliance webhooks mandated by Shopify:

•customers/data_request: the request is logged, and the merchant can download an export of all data stored about the customer in the App under "Data requests" (bookings including history and deposit, waitlist entries, email metadata).

•customers/redact: the customer fields of affected bookings are removed (the pseudonymised booking record is kept for availability calculation); notes, free-text fields, the reason for a deposit retention and form data of unfinished reservations are deleted; related waitlist entries are deleted; not-yet-sent emails to the customer are stopped and the recipient addresses in the delivery log are cleared. The suppression list entry is retained (Section 9). In the compliance log, the customer ID is recorded only as a hash.

•shop/redact: all data associated with a merchant's shop is deleted (about 48 hours after uninstallation), except for the acceptance records and the compliance log, which are kept for the periods in Section 9.

The storefront booking widget sets no cookies and embeds no analytics, marketing or third-party services. For the booking function, it stores the following entries in the visitor's browser storage:

•Session storage "rentkit:client": a randomly generated identifier with no link to the person. It is created only when the visitor reserves, books or joins a waitlist, is sent to the App with the request and used there only as part of the hash described in Section 3. It ends when the browser tab is closed.

•Local storage "rentkit:reservations": expiry times of the reservations held in the cart, so that the cart notice can show the remaining time. Expired entries are removed.

•Local storage "rentkit:notice-min": remembers whether the cart notice was minimised or closed; deleted as soon as no reservation remains.

•Session storage "rentkit:selection:…": the current calendar selection for at most 30 minutes, so that it is kept when the page is reloaded.

•Session storage "rentkit:viewed:…": prevents a calendar view from being counted more than once in the same session. This entry is set only if the visitor has consented to analytics via the shop's consent banner (Shopify Customer Privacy API). Without consent, the widget counts views without any access to browser storage.

The other entries serve solely to provide the booking expressly requested by the visitor (Section 25(2) no. 2 TDDDG). Session storage entries end when the browser tab is closed; the visitor can delete all entries at any time in the browser settings. The embedded admin dashboard uses only technically necessary session cookies of the Shopify platform; these are set by Shopify, not by the App.

We amend this privacy policy when processing changes or legal requirements so require. The current version is available at this URL. Version date: 10 November 2026.

Timmgard GmbH, Kurhausstraße 78a, 53773 Hennef, Germany - email: [email protected]. For requests about booking data, please contact the merchant (shop operator) you booked with.