Privacy Policy

Last updated: 2026-06-24

Who we are

Faktwise is operated by Emanuel José Vargas Luís (sole trader, Portugal), referred to as "we". The controller for this website within the meaning of Art. 4(7) GDPR is:

Emanuel José Vargas Luís
Avenida do Atlântico 16, 14º, Escritório 8
1990-019 Lisboa, Portugal
VAT ID / NIF: PT233800263
Email: support@faktwise.com

Full provider details are in our Imprint. For invoice data processed on behalf of merchants, the merchant is the controller and we act as processor under the Data Processing Agreement. Order and customer data is received from the merchant's connected Shopify store.

What we process and why

• Merchant account data (shop domain, business identity, bank details such as IBAN/BIC, and contact email entered in settings): to provide the service and put the legally required details on invoices. Legal basis: contract (Art. 6(1)(b) GDPR).
• Order-derived customer data (name, billing/shipping address, email, country, VAT ID): to generate legally required invoices on the merchant's behalf. Legal basis (merchant's): legal obligation, Art. 6(1)(c) GDPR with §14 UStG and equivalents.
• VAT ID validation: VAT IDs are checked against the EU VIES service (European Commission); the consultation number returned is stored as evidence of the check.

The order payload Shopify sends may also include technical metadata (for example the order's IP address and browser/device information). We receive it as part of the order but do not use it for invoicing and do not retain it beyond what the invoicing workflow needs.

We do not sell data, run advertising, build profiles, or use your data to train AI models.

Where the customer data comes from

We do not collect order-derived customer data directly from the data subject. We receive it from the merchant's connected Shopify store when an order is created, so that we can issue the invoice the merchant is legally required to provide (Art. 14(2)(f) GDPR: source of the data). The categories of data are those listed above.

Recipients

We keep the number of recipients to a minimum. Personal data may be disclosed to:

• alwaysdata SAS (Paris, France): hosting and email infrastructure, acting as our processor within the EU.
• The EU VIES service operated by the European Commission: a VAT ID is transmitted to VIES solely to confirm its validity for invoicing.

We do not transfer data to any other third parties except where required by law. A current list of subprocessors is maintained in the Data Processing Agreement.

Retention

Issued invoices are retained for 10 years. The German statutory minimum is 8 years (§14b UStG / §147 AO since 1 January 2025); we keep them 10 years as a conservative archiving policy. Erasure requests for invoice data are subject to the Art. 17(3)(b) GDPR exemption (compliance with a legal obligation). Operational data (sessions, tokens, settings) is erased promptly after we receive Shopify's shop/redact webhook, which Shopify sends 48 hours after a merchant uninstalls the app. Deletion requests for individual store customers, routed through Shopify's customers/redact and customers/data_request webhooks, are honoured in the same way, subject to the statutory invoice-retention exemption above.

Where data lives

Application and invoice data is hosted in the EU (Paris, France) with alwaysdata SAS as our hosting subprocessor. Transport is TLS-encrypted; access tokens and personal invoice data are encrypted at rest. The only processing that may occur outside the EEA is support email handling; where that involves a transfer, it is to a country covered by an EU adequacy decision (see "Server logs and support email" below).

Cookies and tracking

This website sets no cookies and runs no analytics or tracking scripts. The Faktwise app itself uses only strictly necessary session cookies required for secure login inside the Shopify admin. There is no advertising, no profiling and no automated decision-making.

Server logs and support email

Our hosting provider (alwaysdata SAS, Paris) keeps standard web server logs including IP addresses for security and operations (legal basis: legitimate interest, Art. 6(1)(f) GDPR); logs are kept only as long as needed for these purposes and are deleted on a short rolling cycle. Support emails to support@faktwise.com are received in our support mailbox and kept only as long as needed to answer you; where answering involves a transfer outside the EEA, it is to a country covered by an EU adequacy decision.

Your rights

Access, rectification, erasure (within legal-retention limits), restriction, portability, objection: write to support@faktwise.com. Store customers should contact the merchant they bought from (the controller); we support merchants in fulfilling such requests.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular with the Portuguese authority CNPD (cnpd.pt) or the authority of your own member state.

Changes to this policy

We may update this policy to reflect changes to the service or the law. The current version is always the one published here, dated at the top of the page.