DEPOTO WMS ("the App") provides warehouse management and order fulfillment services ("the Service") to merchants who use Shopify to power their stores. The App is operated by DEPOTO s.r.o., with registered office at Pernerova 293/11, 186 00 Praha 8 – Karlín, Czech Republic, Company ID: 19285957, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 383908 ("we", "us", or "the Controller").

This Privacy Policy describes how personal information is collected, used, and shared when you install or use the App in connection with your Shopify-supported store.

1. Personal Information the App Collects

1.1 Information from Your Shopify Account

When you install the App, we are automatically able to access certain types of information from your Shopify account, including:

Store information: store name, domain, contact email address, and billing address
Order data: order details, shipping addresses, customer names, and order statuses required to manage warehouse operations and fulfillment
Product data: product listings, SKUs, inventory levels, and variants necessary for stock management
Fulfillment and shipping data: carrier information, tracking numbers, and delivery statuses

1.2 Information Collected Independently

Additionally, we collect the following types of personal information directly from you and/or your customers once you have installed the App:

Account registration information: name, email address, phone number, and billing information of persons accessing the App on behalf of your store
Usage data: information about how you interact with the App, including log files that record IP addresses, browser types, referring pages, and timestamps
Customer data processed on your behalf: end-customer names, delivery addresses, email addresses, and phone numbers, as provided through your Shopify orders for the purpose of fulfillment

1.3 Tracking Technologies

We collect personal information using the following technologies:

Cookies: data files placed on your device that may include an anonymous unique identifier. For more information about cookies, and how to disable them, visit http://www.allaboutcookies.org
Log files: records of actions occurring within the App, collecting data such as IP address, browser type, internet service provider, and date/time stamps
Web beacons, tags, and pixels: electronic files used to record information about how you browse and use the App

2. Legal Basis for Processing Personal Data

The legal basis for processing your personal data is as follows:

Performance of a contract: processing is necessary for the performance of the service agreement between you and DEPOTO s.r.o., or to take steps prior to entering into such an agreement, pursuant to Article 6(1)(b) of the General Data Protection Regulation (EU) 2016/679 ("GDPR")
Compliance with legal obligations: processing is necessary to fulfil legal obligations applicable to DEPOTO s.r.o., pursuant to Article 6(1)(c) GDPR, including obligations under Czech VAT Act No. 235/2004 Coll., Income Tax Act No. 586/1992 Coll., and Accounting Act No. 563/1991 Coll.
Legitimate interests: processing for purposes such as improving the App and preventing fraud, where these interests are not overridden by your rights and interests

3. How We Use Your Personal Information

We use the personal information we collect from you and your customers in order to provide the Service and to operate the App. Specifically, we use this personal information to:

Fulfill and manage warehouse operations, stock management, and order dispatch on your behalf
Maintain and administer your user account within the App
Communicate with you regarding the Service, including support requests and operational notifications
Optimize and improve the App's functionality, performance, and user experience
Comply with applicable legal and regulatory requirements, including tax and accounting obligations
Detect, investigate, and prevent fraudulent activity and violations of our terms of service

No automated individual decision-making, including profiling with legal or similarly significant effects, takes place within the meaning of Article 22 GDPR.

4. Sharing Your Personal Information

We may share your personal information with the following categories of recipients:

Service providers and processors: third parties who perform technical, organisational, accounting, or tax services on our behalf and under our instruction, acting as data processors in accordance with GDPR
Competent authorities: tax administration bodies or other relevant public authorities where required by applicable law
Shopify Inc.: as required by the Shopify platform in connection with providing the App

DEPOTO s.r.o. does not intend to transfer your personal data to a third country outside the European Union or to an international organisation. Where any such transfer becomes necessary, appropriate safeguards will be implemented in accordance with GDPR requirements.

We may also share your personal information to comply with applicable laws and regulations, to respond to a subpoena, search warrant, or other lawful request for information we receive, or to otherwise protect our legal rights.

5. Data Retention

Your personal data will be processed for the duration of the contractual relationship between you and DEPOTO s.r.o. and for the period necessary for archiving purposes in accordance with applicable mandatory legal provisions — in particular, for the periods prescribed by Czech tax, accounting, and commercial law.

Once the applicable retention period has elapsed, your personal data will be securely deleted unless and until you request deletion earlier, subject to any overriding legal obligations.

6. Your Rights

Under the conditions set out in the GDPR, you have the following rights with regard to your personal data:

Right of access: you may request confirmation as to whether we process personal data about you and, if so, to obtain a copy of that data
Right to rectification: you may request correction of inaccurate or incomplete personal data
Right to erasure ("right to be forgotten"): you may request deletion of your personal data where no overriding legal basis for retention applies
Right to restriction of processing: you may request that we limit the processing of your personal data in certain circumstances
Right to data portability: you may request to receive your personal data in a structured, commonly used, machine-readable format
Right to object: you may object to processing of your personal data where it is based on our legitimate interests
Right to lodge a complaint: if you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority — in the Czech Republic, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.cz)

Please note that providing personal data is a necessary requirement for entering into and performing the service agreement. Without providing the required personal data, it is not possible to conclude or perform the agreement on our part.

7. Changes

We may update this Privacy Policy from time to time in order to reflect changes to our practices or for other operational, legal, or regulatory reasons. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

8. Contact Us

For more information about our privacy practices, if you have questions, or if you would like to exercise any of your data subject rights or make a complaint, please contact us:

Email: info@depoto.cz

Phone: (+420) 602 315 212

Postal address: DEPOTO s.r.o., Pernerova 293/11, 186 00 Praha 8 – Karlín, Czech Republic

Data Protection Officer: DEPOTO s.r.o. has not appointed a Data Protection Officer.

Depoto WMS App privacy policy