1. Introduction
This notice applies when you shop in, or contact, a webshop that runs on Prodyflow. Prodyflow is the online business platform (ERP and webshop) that the webshop uses. The webshop is the controller of your personal data: it decides why and how your data is used, and its own privacy notice applies to that. We, Weborigo, operate Prodyflow as the webshop's processor, and process your data only on behalf of the webshop and on its documented instructions. For one purpose, improving and developing Prodyflow, we also use data for our own purposes and are the controller of it (see section 3).
If this notice and the webshop's own privacy notice differ about what the webshop does with your data, the webshop's notice applies. This notice describes what we do as the webshop's processor.
Our company details and what applies to every notice are in the privacy overview.
2. What personal data we receive
Depending on what the webshop uses, Prodyflow stores and processes the following on its behalf:
- Contact and delivery information: your name, shipping and billing address, email, phone number and tax number, as you give them to the webshop.
- Account information: the account and settings you have in the webshop, such as language and marketing choices.
- Device information: your IP address (which can show your general location), device identifiers, the browser you use, your network connection, and logs.
- Payment information: the status of your payments and references to them. Your card data is handled by the payment provider the webshop chose; we do not store it.
- Activity in the webshop: the products you view and place in your basket, your orders, returns and invoices.
- Messages: your messages to the webshop and support tickets, including attachments you send.
3. How we use your personal data
We process your data mainly to provide the service to the webshop, on its instructions. As the webshop's processor, we do not use it to advertise to you. For one purpose, improving and developing Prodyflow, we act as controller. The data is used to:
- Provide the webshop: show you its pages, keep your basket, and show your order history and order status in your account.
- Take and deliver orders: receive, prepare, deliver and invoice your orders and handle returns.
- Handle payments: process your payment through the provider the webshop chose.
- Track and apply your settings and privacy preferences: apply the language, account settings and marketing choices you set in the webshop.
- Communicate with you: send order confirmations, answer your messages and support requests, and send other messages as the webshop decides and the law allows.
- Authentication, integrity, security and safety: authenticate your account, provide a secure shopping experience, and detect, investigate and prevent abuse and fraud.
- Improve and develop Prodyflow (our own purpose): develop, test and improve Prodyflow, troubleshoot problems, and analyse how Prodyflow and the webshops are used. For this we are the controller; our legal basis is our legitimate interest in improving the service (Article 6(1)(f) GDPR). For development we use only the data that is needed, and where possible in aggregated form.
- Legal reasons: comply with the law and valid legal requests, and the webshop's legal obligations.
4. Third parties who may receive personal data
Depending on the webshop and what you do in it, personal data may be given to the following categories of recipients:
- Service providers: companies that host, protect and support the systems Prodyflow runs on. They are listed in the privacy overview.
- Providers chosen by the webshop: payment providers, couriers, invoicing services and similar. The webshop chooses and contracts them, and sends them the data they need.
- Marketing and analytics tools of the webshop: only if the webshop switches them on in its own pages, as its own privacy notice describes.
- Change of control: actual or prospective acquirers in a sale, merger or restructuring of our or the webshop's business.
- Legal reasons: to comply with the law or answer a valid legal request, to detect and prevent fraud and abuse, and to protect rights and property.
- Sharing at your discretion: where you authorise it.
5. Third-party services and links
A webshop may link to, or use, services we do not control, such as a payment provider or a courier. They are governed by their own privacy notices, and the webshop is responsible for choosing them.
6. Your privacy rights and choices
Send your request to the webshop, which is the controller, using the contact details in its privacy notice. If you write to us instead, we pass the request on to the webshop and help it to answer. You can also change your account data and marketing choices in the webshop itself. For the data we use to improve Prodyflow, we are the controller: write to contact@prodyflow.com. You have the right to:
- Access: ask what data the webshop holds about you and get a copy.
- Correction: have inaccurate data corrected.
- Deletion: have your data erased, where the law allows.
- Objection and withdrawal: object to the use of your data, opt out of marketing and withdraw a consent you gave.
7. Retention
The webshop decides how long your data is kept. How long depends on:
- The order and the account: data is kept while it is needed for the order, your account or support.
- The law: accounting, tax and other rules can require a longer period.
- Claims: data can be kept while a claim could be made.
- The webshop's instructions: we delete or return the data as the webshop instructs us.
8. How to contact us
Questions about how Prodyflow processes data on behalf of webshops: contact@prodyflow.com. For your rights over the data the webshop holds, contact the webshop.
9. European data subjects
The legal basis of the processing of your data in a webshop is chosen by the webshop, and is stated in its privacy notice.
In addition to the rights above, you may object to processing that is based on legitimate interests and withdraw a consent at any time. You may lodge a complaint with the supervisory authority; in Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, https://naih.hu), and you may turn to a court.
