Privacy Policy
Data processed
To issue your invoices, FacturePro processes order and customer data transmitted by Shopify: order ID and amounts, the customer's name, billing address and email, as well as the details of the items purchased. No other personal data is collected.
This data is not subject to any profiling or automated decision-making, and is neither sold nor shared for commercial purposes.
Purpose and legal basis
The data is processed for a single purpose: issuing, on behalf of the merchant, invoices and credit notes compliant with the Factur-X (the French hybrid PDF/XML e-invoicing format) format and the EN 16931 (the European e-invoicing semantic standard).
The legal basis for processing is the performance of the contract entered into with the merchant, as well as the legal obligation to issue invoices. The merchant is the data controller; FacturePro acts as a data processor within the meaning of Article 28 of the GDPR.
Security
- Personal data and access tokens are encrypted at rest (Fernet / AES-128 with HMAC).
- All transmissions take place exclusively over HTTPS.
- Every access to personal data is recorded in an access log.
- Backups are encrypted.
- Incoming webhooks are verified with an HMAC-SHA256 signature.
Data retention
Generated invoices and credit notes are kept for 10 years, the legal retention period for accounting documents in France, then automatically deleted. Store data is deleted within 30 days of the application being uninstalled. The access log is kept for 2 years.
Your rights (GDPR)
You have the right to access, rectify, erase, restrict and port the data concerning you.
Erasure requests are executed immediately for data that has not yet been consolidated into a tax document. Invoices already issued are kept until the 10-year legal obligation expires (Article 17.3.b of the GDPR, legal obligation), then automatically deleted.
The merchant can exercise these rights via Shopify or by writing to the contact address below.
Subprocessors
Two subprocessors are involved in the processing of the data:
- Shopify, the source of the data and host of the platform.
- Brevo, for sending invoice emails.
No other recipient has access to the data.
Contact
For any question regarding your data, contact us at facturepro@outlook.it.