Privacy Policy

Provider and data controller within the meaning of Art. 4(7) GDPR for the operation of the PackFlow - Returns app as a software service is:

For the processing of customer data in the course of individual return requests, Timmgard GmbH acts as processor under Art. 28 GDPR; the controller in that respect is the merchant (shop owner).

We process personal data in three categories: merchant data, customer data (accessed on behalf of the merchant via the Shopify Admin API), and technical analytics data.

Merchant Data

• Shopify shop domain and store name
• DHL business account credentials: the DHL API key is stored in plaintext, the DHL API password is encrypted at rest using AES-256-GCM with a rotatable master key
• App configuration and settings, including a country filter (ISO country codes the merchant excludes from returns - configuration only, no personal data)
• Cached subscription metadata from Shopify: plan name, billing status, trial end date, monthly order count, and last-check timestamp. PackFlow does not process payment data - billing runs exclusively through Shopify as Merchant of Record. We never see credit cards, bank accounts, or merchant invoicing addresses

Customer Data (processed on the merchant's behalf via the Shopify Admin API)

• Customer name and email address (to identify the order when a return is submitted)
• Shipping address (for generating DHL return labels)
• Postal code (only when the customer searches for a nearby Packstation via the DHL location finder)
• Order information: order number, line items, fulfillment status
• Shopify customer ID (where issued by the shop)
• Return note: an optional free-text field the customer may use to describe the reason for return. The content may contain personal information and is stored as the customer entered it

Technical / Analytics Data

• Internal return-status lookups: order number, success flag, and timestamp. This is pseudonymous, not anonymous within the meaning of Art. 4(5) GDPR, as the order number is re-identifiable in combination with Shopify data. No email addresses or tracking numbers are stored in this table
• Webhook deduplication markers to prevent duplicate processing (no PII, 90-day auto-retention)
• Return label URL and QR code URL: links pointing to PDF files hosted by DHL containing customer data. The PDF files themselves reside with DHL, not with PackFlow

We use the collected data exclusively to provide the App's functionality:

• Matching incoming returns to specific orders based on order number and email
• Generating DHL return labels and QR codes via the DHL Parcel DE Returns API using the customer's shipping address
• Tracking return shipment status via the DHL Shipment Tracking Unified API - used internally only, to document arrival at the merchant. PackFlow does not operate a public tracking portal for end customers
• Locating nearby Packstations via the DHL Unified Location Finder API based on the postal code provided by the customer
• Managing return workflows (approval, rejection, status updates)
• Sending transactional status emails to the customer (a confirmation when the return is submitted, an email with the return label or QR code, an optional rejection notice - disabled by default) and an internal notification email to the merchant, via our email service provider Resend (see Section 5)
• Syncing completed returns to Shopify's native returns system (shopifyReturnId) so the merchant can see the return within the Shopify admin
• Exchange orders: when a customer chooses an exchange instead of a refund, PackFlow creates a Shopify draft order containing the customer data from the original order. The draft order resides with Shopify; PackFlow stores only the exchangeOrderId reference
• Shopify Flow triggers: for the events “dhl-return-created”, “dhl-label-created”, and “dhl-return-status-changed”, PackFlow passes the fields customer_id, customer_email, order_number, return_reason, item_count, and return_id to Shopify's Flow engine. This data does not leave the Shopify ecosystem
• Merchant analytics (return rate, return reasons, timeline)
• Subscription enforcement via Shopify Managed Pricing based on the monthly order count

Where Timmgard GmbH processes personal data as controller (in particular merchant data and technical operations data), processing is based on the following legal grounds:

• Art. 6(1)(b) GDPR: performance of the contract on the use of the App vis-à-vis the merchant, in particular providing the returns portal, generating DHL return labels, and managing return workflows
• Art. 6(1)(c) GDPR: compliance with legal obligations, in particular fulfilment of the Shopify compliance webhooks and the demonstrability of timely handling of data subject requests (Art. 12(3) GDPR)
• Art. 6(1)(f) GDPR: legitimate interest in the secure and stable operation of the App, in particular internal status-lookup logging, webhook deduplication to prevent duplicate processing, and abuse prevention

Where PackFlow processes customer data on behalf of the merchant (Art. 28 GDPR), the merchant is the controller; determining the legal basis for that processing (typically Art. 6(1)(b) GDPR - handling the return as part of the purchase contract) is the merchant's responsibility.

We share personal data only with the sub-processors listed below. Each is engaged under a data processing agreement per Art. 28 GDPR; the full DPA is available at https://tg-ai.de/en/dpa/packflow-returns. We do not sell, rent, or share personal data with any other third parties for marketing, advertising, or profiling purposes.

Shopify Inc. (Canada / USA)

Shopify Inc., 151 O'Connor Street, Ottawa, Ontario K2P 2L8, Canada, is our primary sub-processor. All order, customer, product, fulfillment, returns, and draft order data originates from and resides at Shopify; PackFlow accesses it via the Shopify Admin API. As Merchant of Record, Shopify also handles merchant billing. Transfers outside the EEA are safeguarded by the adequacy decision for Canada (Decision 2002/2/EC) and EU Standard Contractual Clauses per Implementing Decision (EU) 2021/914 within the Shopify DPA.

Deutsche Post DHL Group (Germany)

DHL processes data via three distinct APIs, each limited to the minimum fields required:

• Parcel DE Returns (return label generation): customer name, email address, and full return shipping address
• Shipment Tracking Unified (return shipment status): tracking number only
• Unified Location Finder (nearby Packstation lookup): postal code only

DHL processes this data on EU infrastructure according to its own privacy policy.

Render Services Inc. (USA)

Render Services Inc., 525 Brannan St, Suite 300, San Francisco, CA 94107, USA, is the hosting provider for the application and the PostgreSQL database. Primary server location: Frankfurt, Germany (EU). Render is certified under the EU-US Data Privacy Framework since 6 January 2025; subsidiarily, EU Standard Contractual Clauses 2021/914 apply. Render operates the infrastructure but does not actively process personal data on our behalf beyond storage. Database backups are encrypted.

Resend Inc. (USA)

Resend Inc., 2261 Market Street, San Francisco, CA 94114, USA, sends the App's transactional emails (return confirmation, label email, optional rejection notice, merchant notification) using the sender address [email protected]. The sending infrastructure is located in the EU (Ireland, AWS eu-west-1); account metadata and sent logs reside on US infrastructure. Resend is certified under the EU-US Data Privacy Framework since March 2025; subsidiarily, EU Standard Contractual Clauses 2021/914 apply.

The App infrastructure and the database operate exclusively within the EU (Frankfurt, Germany). Transfers to third countries occur only with the sub-processors listed in Section 5 and are safeguarded as follows:

• Shopify Inc. (Canada): adequacy decision of the European Commission for Canada (Decision 2002/2/EC) and EU Standard Contractual Clauses under Implementing Decision (EU) 2021/914 within the Shopify DPA
• Render Services Inc. (USA): primary server location Frankfurt, Germany (EU); certified under the EU-US Data Privacy Framework since 6 January 2025; subsidiarily SCCs 2021/914
• Resend Inc. (USA): sending infrastructure in the EU (Ireland, AWS eu-west-1); account metadata and sent logs on US infrastructure; certified under the EU-US Data Privacy Framework since March 2025; subsidiarily SCCs 2021/914
• Deutsche Post DHL Group (Germany): processing on EU infrastructure; no third-country transfer

Supplementary technical and organisational measures (transport encryption, access restrictions) apply.

PackFlow implements appropriate technical and organisational measures under Art. 32 GDPR:

• All data is stored on servers hosted by Render in the EU (Frankfurt, Germany)
• DHL API passwords are encrypted at rest using AES-256-GCM with a rotatable master key
• Customer data (name, email, address, return notes) is protected at rest by database access control and encrypted backups; PackFlow is a processor and must be able to read this data to provide the service, so no end-to-end encryption is applied
• All data transmission uses TLS 1.3
• Database backups are encrypted
• Access to personal data is restricted to authorised personnel only

The following retention periods apply:

• Return records and return items: personal data (name, email address, shipping address, return notes, label and QR code URLs) is anonymised 6 months after the return reaches a final status (completed, cancelled, or rejected); the remaining pseudonymous return record is deleted 24 months after completion. Returns still in progress are not affected
• Uninstallation: deletion of all shop data (returns, configuration, cached subscription metadata) is triggered immediately upon Shopify's uninstallation webhook and additionally safeguarded via the shop/redact compliance webhook (sent by Shopify about 48 hours after uninstallation); encrypted backups are overwritten within 30 days at the latest
• Analytics data (status-lookup events, webhook deduplication markers): 90-day automatic cleanup, regardless of installation state
• Individual customer records on request: pseudonymised immediately upon receipt of Shopify's customers/redact compliance webhook (within the 30-day window provided by Shopify); order references subject to statutory commercial and tax retention obligations (Section 257 HGB, Section 147 AO) are retained
• Payment-related records: managed by Shopify as Merchant of Record; not within PackFlow's scope

PackFlow does not carry out any automated individual decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning data subjects.

PackFlow processes return data on behalf of the merchant for customers who have previously placed an order with the shop. Age verification at the point of sale is the merchant's responsibility. The App does not collect data directly from minors and is not directed at children under 16 within the meaning of Art. 8 GDPR.

If you are a customer of a merchant using the App, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): request a copy of the personal data we hold about you
• Right to rectification (Art. 16 GDPR): request correction of inaccurate personal data
• Right to erasure (Art. 17 GDPR): request deletion of your personal data
• Right to restriction (Art. 18 GDPR): request limitation of processing
• Right to data portability (Art. 20 GDPR): request transfer of your personal data
• Right to object (Art. 21 GDPR): object to the processing of your personal data
• Right to withdraw consent (Art. 7(3) GDPR): withdraw a given consent with effect for the future, where processing is based on consent

Note on the right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation.

To exercise these rights, please contact the merchant (shop owner) directly as they are the controller. The merchant can forward data subject requests to us, which we handle via Shopify's mandatory compliance webhooks.

Data subjects have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for Timmgard GmbH is:

Timmgard GmbH is not required to appoint a data protection officer under Section 38(1) of the German Federal Data Protection Act (BDSG) because it has fewer than 250 staff and no core activity involving large-scale regular monitoring or the processing of special categories of data. Privacy requests are handled centrally at [email protected] and answered within the statutory deadlines (Art. 12(3) GDPR, generally no longer than 30 days).

The App implements all Shopify-required GDPR compliance webhooks:

• customers/data_request: returns all stored data for a specific customer
• customers/redact: anonymises or deletes all personal data for a specific customer
• shop/redact: deletes all data associated with a merchant's shop (48 hours after uninstallation)

The App does not set cookies or use browser local storage for identification. Authentication within the embedded admin is handled via Shopify session tokens.

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. Continued use of the App after changes constitutes acceptance of the updated policy.

For questions about this Privacy Policy or data processing:

For data subject requests, please contact the merchant (shop owner) who installed the App on their Shopify store.