Data-processing terms
Version: 24 October 2026 · CVJanssens BV
Parties and scope
For personal data included in authorized store information, the merchant is the controller and CVJanssens BV is the processor. The subject is operation of StockKompas during the service and the limited deletion/backup period described in the privacy notice. Processing consists of receiving, storing, displaying, calculating, exporting and deleting the information necessary for the service. Categories are store owner/staff identifiers and business contact data, plus any personal data incidentally contained in merchant-provided stock/supplier fields. Customer records and sensitive personal data must not be submitted.
Instructions and confidentiality
We process personal data only on documented instructions, including authorized app use and support requests, unless law requires otherwise. We inform the merchant if an instruction appears to infringe applicable data-protection law or if a legally required disclosure must occur, unless notification is prohibited. Personnel authorized to access data must be subject to confidentiality obligations and limited access.
Security and incidents
Measures include HTTPS, store-authenticated separation, limited server-key access, private credentials, non-root application processes, security updates and database backups. Measures are reviewed as the service changes. We notify the controller without undue delay after becoming aware of a personal-data breach affecting its data and provide available information and assistance for its obligations.
Subprocessors and transfers
The merchant authorizes Hetzner Online GmbH for app infrastructure and backups in Germany. Shopify provides the merchant-selected platform and its APIs under the applicable Shopify agreements. We impose appropriate data-protection obligations on any subprocessor we engage. We inform affected merchants of intended additions or replacements of our subprocessors with an opportunity to object before the change. Transfers outside the EEA require an applicable lawful safeguard and necessary information for the controller.
Assistance and evidence
Taking account of the processing and information available, we assist with rights requests, security, breach notifications, assessments and regulator enquiries. We provide information needed to demonstrate compliance and allow proportionate audits or inspections agreed with the controller, subject to protecting other merchants’ information and system security.
Return and erasure
At the controller’s choice, current app data can be returned or erased at the end of service unless law requires retention. Authenticated uninstall and shop-redaction notifications erase active records and sessions. Backup copies expire within 30 days; deletion instructions must be reapplied after restoration. These terms do not authorize processing for unrelated purposes.