This Privacy Policy explains how Dotcase – EU Compliance (the "App") collects, uses, stores, and shares personal data. The App is a Shopify application that helps merchants comply with EU consumer-law obligations (the statutory right of withdrawal and the legal guarantee of conformity notice).
The App is operated by:
Dotcase – Özgür Kadir Taşkesen
Nienburg, Germany
Contact: privacy@dotcaseglobal.com
For personal data that the App processes on behalf of a merchant (see Section 2), the merchant is the data controller and we act as a data processor. For data we process for our own purposes (for example, operating and securing the App, or merchant account data), we act as the data controller.
The App involves two groups of people:
We process personal data of both groups, as described below.
When a customer submits a withdrawal request, or when the App processes their order to manage such a request, the App may process:
Some of this data is entered by the customer; some is retrieved automatically from Shopify (for example, the customer's name may be pre-filled on their order page to make the form easier to complete).
When a merchant installs and configures the App, we process:
If a merchant enables our optional location features ("show the form only to EU/EEA visitors" and/or "auto-select the visitor's language"), the App determines the visitor's country from their IP address. This lookup is performed locally, using a local copy of the MaxMind GeoLite2 database. The visitor's IP address is never sent to any third party for this purpose, and it is never stored in our database. It is held only briefly in memory to perform the lookup and is discarded.
If a merchant enables the optional anti-spam protection (Cloudflare Turnstile), the visitor's IP address and browser signals are processed by Cloudflare for bot detection. This happens only when the merchant turns that feature on.
We process personal data to:
The legal bases under the GDPR are:
Where a merchant is the data controller, the legal basis for their customers' data is determined by the merchant.
Personal data is hosted on Railway, in the European Union (Amsterdam, Netherlands), in a PostgreSQL database. Data is encrypted at rest by the hosting provider.
We use the following third-party providers to operate the App. We share only the data necessary for each provider's function.
| Provider | Location | Data shared | Purpose |
|---|---|---|---|
| Railway | EU (Amsterdam) | All stored data (hosting/database) | Hosting and database |
| Shopify | Global | Shop domain, authentication tokens, order/return data | Authentication, order verification, returns synchronisation, customer account features |
| Resend | USA (under Standard Contractual Clauses) | Customer name, email, order reference and products; merchant notification email | Sending transactional emails |
| Cloudflare (Turnstile) | Global | Visitor IP and browser signals | Optional bot/spam protection — only if the merchant enables it |
We do not sell personal data, and we do not use it for advertising.
Where data is transferred outside the EU/EEA (for example, to Resend in the USA), the transfer is covered by appropriate safeguards such as the EU Standard Contractual Clauses.
On the storefront (the part customers see), the App uses no cookies, no analytics, and no tracking pixels, and stores nothing in the customer's browser. The optional Cloudflare Turnstile anti-spam feature, if enabled by the merchant, may set its own client-side mechanisms for bot detection.
In the merchant admin area, the App stores only functional preferences in the browser (such as which table columns are shown). This contains no customer personal data.
If you are in the EU/EEA, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. You also have the right to lodge a complaint with a supervisory authority.
To provide its features, the App requests the following Shopify permissions: reading orders (to verify requests and calculate deadlines), reading and writing returns (to create returns when a request is approved), writing content (to create the withdrawal page), and reading themes (to detect where the App is installed). The customer-account feature reads the customer's name and address to pre-fill the withdrawal form; this requires Shopify's protected customer data access.
We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest version. Material changes will be communicated through the App where appropriate.
We monitor application and platform logs for security events. If a personal data breach occurs, we contain the affected systems, assess the scope, and notify affected merchants without undue delay. Where the breach is notifiable under GDPR Art. 33, we notify the competent supervisory authority within 72 hours and inform affected individuals where required under Art. 34. Each incident is documented for audit and prevention.
For any privacy question or request:
Dotcase – Özgür Kadir Taşkesen
Nienburg, Germany
privacy@dotcaseglobal.com