Legal information

Privacy

Effective date: 15 October 2026

Purpose and scope

PIKASTORE s.r.o., company ID 19693311, info@pikastore.cz operates Ship x Qualify as processor for the merchant. The app processes order data for pickup selection, transactional reminders and enabled shipping labels. Depending on the feature, it reads name, email, phone, address and shipment details. Reminders retrieve email and first name when sending without storing a copy; sending defaults off. Data is not sold or used for advertising.

Storage and access

We store shop configuration, administrator sessions, order states, pickup history, reminder status and shipment records. Personal data, including PDF content, contact configuration and any personal data within JSON fields, is encrypted at application level using AES-256-GCM. Transfers use HTTPS/TLS. Administrator and ERP shipment/PDF access, exports and cleanup are recorded in an access log without data content. We do not store IP addresses; any future recording must use an HMAC hash only.

Retention

Label PDFs contain names, addresses and phone numbers and are stored for repeat printing. Merchants choose 30, 90, 180 or 365 days after label creation in Settings; the default is 180 days. Daily automated cleanup then deletes PDFs. Uninstallation and shop erasure remove PDFs immediately. Recipient data and shipment request contents are anonymised after 180 days from shipment creation, but no earlier than the PDF retention deadline; tracking, carrier and status remain for operational records until order or shop erasure. Personal reminder metadata is removed 90 days after the last send or completion; counts, status and timestamps may remain. Pickup change audits, local ShippingOrder records and access logs are deleted after 365 days. Daily cleanup normally runs within 24 hours of a deadline. Shop configuration and sessions remain for service provision until disconnection or erasure.

Recipients and backups

Necessary delivery data is provided to the merchant’s selected carrier (Packeta, GLS, PPL or DPD); email uses connected Google Gmail or Resend. Shopify provides the platform and order data. VPS and database hosting is provided by subprocessor netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. Official carrier widgets receive browser network data; GLS loads OpenStreetMap maps. See /dpa for providers and transfers outside the EEA. Daily backups use AES-256 encryption, an encrypted offsite copy and rotation of 30 copies. Deleted data may remain only in isolated backups until rotation; deletions and retention must be reapplied before resuming a restored service.

Rights and termination

Customers exercise access, rectification, erasure, restriction, objection and applicable portability rights through their merchant as controller, and may complain to a supervisory authority. Assistance: info@pikastore.cz. The app handles signed Shopify customers/data_request and customers/redact requests. Following uninstallation, shop/redact deletes the shop and associated data. Merchants may request return of available data before termination.