Legal
Sortimentor – Privacy Policy
Draft – version of 26 October 2026.
1. Who is responsible
PAWSY STAYS, dejavnost spletnih iskalnikov, d.o.o., Prečna ulica 20, 1230 Domžale, Slovenia, [email protected] (we).
For data in the files merchants upload and in their shops, the merchant is the controller and we process the data on their behalf under our Data Processing Agreement. This policy explains what we process and, where we decide ourselves, why.
2. What we process
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Shop details from Shopware when the app is installed: shop ID, shop URL, API credentials for the app, Shopware version | To connect the app to the shop | Art. 6(1)(b) GDPR (contract) | Until the app is uninstalled |
| Administrator details Shopware sends when the app page opens: Shopware user ID and interface language | To show the app in the right language and keep the session (cookies, below) | Art. 6(1)(b) GDPR | Session, at most 12 hours |
| Uploaded supplier files: rows and columns (usually product data; may contain names or contact details of supplier staff) | To run the import, show the preview and allow rollback | On behalf of the merchant (Art. 28 GDPR) | 30 days, then deleted |
| Saved supplier profiles: column names, mapping and import settings | To map the next file from the same supplier automatically | On behalf of the merchant | Until deleted by the merchant or uninstall with data deletion |
| Plan and usage: which plan the shop bought (signed information from Shopware) and how many products were imported per month | To apply plan limits | Art. 6(1)(b) GDPR | Until uninstall with data deletion |
| Apply log: shop ID and URL, file name, a checksum of the imported rows, numbers of rows and changes, how the mapping was made, the price rule, safety warnings shown, time of the "I checked the preview" confirmation and of any rollback (no file contents) | To show what was confirmed if an import is disputed | Art. 6(1)(f) GDPR (establishing and defending legal claims) | 3 years after the import, also after uninstall |
| Files sent to support (only when the merchant clicks "Send file to support" and ticks the consent box): a mark that the uploaded file may be viewed by our support, the contact email entered, the optional message, the file name, the number of rows and the time | To look at the file and help with the import | Consent, Art. 6(1)(a) GDPR; for the file contents, the merchant's instruction under the DPA | Deleted together with the uploaded file, 30 days after the upload; not extended by sharing |
| Support emails | To answer requests | Art. 6(1)(b) or (f) GDPR | Up to 2 years after the request is closed |
We do not access customer or order data in the merchant's shop. The app's Shopware permissions are limited to products, manufacturers, properties, taxes, currencies, sales channels and settings.
We keep no access logs of requests or IP addresses. Error logs contain technical details (e.g. which API call failed), not file contents, and are rotated automatically.
3. AI column mapping
When a merchant uploads a file from a supplier we have not seen before, we send the column names and up to 30 sample rows to Mistral AI (Paris, France) to get a proposed column mapping. The whole file is never sent. Mistral processes the data in the EU under a data processing agreement; training on our data is switched off and zero data retention is requested. The merchant always sees and can change the proposed mapping before anything is written. AI proposals and notes are marked as AI-generated in the app.
4. Sending a file to support
The merchant can send an uploaded file to our support from the app ("Send file to support"). This happens only after they enter a contact email and tick the consent box. Our support staff can then look at the file's rows (as stored for the import), its mapping and the preview result. No copy is kept beyond the normal retention: the file, the contact email and the message are deleted with the import 30 days after the upload. Consent can be withdrawn at any time by email to [email protected]; we then remove the share immediately (and any working copy our support made).
When a file is shared, we may send a short notice to our own internal support channel ([CHANNEL – e.g. self-hosted chat or email]) with the reference number, shop domain, file name, row count, message and contact email. The file content is never part of this notice. If this channel is run by a third party, it is listed as a subprocessor.
5. Cookies
The app page sets two technically necessary cookies when opened from the Shopware administration: shop (identifies the shop) and session (start time of the session, expires after 12 hours). Both are signed, contain no personal data beyond the shop ID, and are not used for tracking. No analytics or advertising cookies are used.
6. Recipients
- Euronodes – server hosting in the EU (Portugal/Czech Republic).
- Mistral AI – AI column mapping, EU.
- shopware AG – sells and bills the app as an independent controller under its own privacy policy. We receive no payment data.
There are no transfers to countries outside the EU/EEA.
7. Your rights
You have the right to access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR). For data we process on behalf of a merchant, please contact the merchant; we will support them. Contact: [email protected].
You can lodge a complaint with a supervisory authority, for example the Slovenian Information Commissioner (Informacijski pooblaščenec, www.ip-rs.si) or the authority in your country.
8. Security
Connections use HTTPS. Requests from Shopware are signed and checked. Each shop's data is kept apart. Access to the server is restricted to key-based login. Details are in the technical and organisational measures of our Data Processing Agreement.