Omnibus – EU Compliant Price: Privacy Policy
Last updated: 10 November 2026
This notice explains how Made in Evolve S.r.l. processes personal data in connection with the Shopify app Omnibus – EU Compliant Price (the App), available on the Shopify App Store. It is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and of the Italian Privacy Code (Legislative Decree 196/2003). It applies to merchants who install the App, to their staff and, where relevant, to the customers of their stores. The use of the App is also governed by the Terms of Service; for the website madeinevolve.com the general Privacy Policy applies.
1. Controller and contact details
The controller is Made in Evolve S.r.l., Via Rosalba Carriera 26, 41126 San Damaso, Modena (MO), Italy, Tax Code and VAT no. 03497200364, REA MO-392876.
| Channel | Reference |
|---|---|
| Data protection email | privacy@madeinevolve.com |
| General email | hello@madeinevolve.com |
| Certified email (PEC) | madeinevolve@pec.it |
| Telephone | +39 059 788 0854 |
| Form for privacy requests | /policy/data-removal |
Made in Evolve is the controller of the data concerning the merchant that installs the App and its staff. The App does not process data of the merchant’s customers (see section 3). Shopify is an independent controller of the data processed on its platform, under its own privacy policy.
The Controller has not appointed a Data Protection Officer (DPO), as the conditions of Article 37 GDPR are not met.
2. What the App does
The App records the price history of the merchant’s product variants, including the prices of Shopify Markets catalogues, calculates the lowest price applied in the 30 days before a price reduction and saves it in a product metafield. A theme app block then shows that price on the product page of the online store, to help the merchant comply with the price-reduction rules of Directive 98/6/EC as amended by Directive (EU) 2019/2161 (the Omnibus Directive).
At installation the App asks Shopify only for the following permissions: read_products, write_products, read_themes, read_markets.
3. Data processed
| Category | Data | Source |
|---|---|---|
| Store data | Store domain, access token issued by Shopify, granted permissions, store currency, App language, synchronisation status and dates. | Shopify, at installation and during use |
| Catalogue data | Product and variant identifiers, prices and catalogue (market) prices with the date of each change, widget settings chosen by the merchant. | Shopify, through the Admin API |
| Staff data | Shopify makes the store owner’s basic details (name, email, phone, address) available to all apps. The App does not store them. | Shopify |
| Support chat | Messages exchanged in the in-App support chat, the store domain and the technical data of the browser used (including IP address). | The merchant or its staff |
| Technical logs | IP address of the requests reaching the App server, date and time, requested address, outcome and error messages. | Automatically |
The App does not access the data of the merchant’s customers or orders and does not request the permissions to read them. The block displayed in the online store reads the price saved in the product metafield, is served by Shopify and does not send any data about store visitors to Made in Evolve.
The App does not use cookies to authenticate the merchant: access takes place through Shopify session tokens. The support chat stores technical data in the browser to keep the conversation open between pages. The App does not use advertising or profiling tools and takes no automated decisions about people.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Installing the App and providing its functions to the merchant | Performance of the contract with the merchant (Art. 6(1)(b) GDPR) |
| Managing plans and billing through Shopify | Performance of the contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)) |
| Answering support requests | Performance of the contract (Art. 6(1)(b)) |
| Security, error diagnosis and prevention of abuse (technical logs) | Legitimate interest in keeping the service working and secure (Art. 6(1)(f)) |
| Handling Shopify privacy requests and data subject requests | Legal obligation (Art. 6(1)(c)) |
| Establishing, exercising or defending legal claims | Legitimate interest (Art. 6(1)(f)) |
Providing the store data is necessary to use the App: without them the App cannot work.
5. Retention
| Data | Retention period |
|---|---|
| Price history | Rolling 30 days: older entries are deleted at each synchronisation, because the Omnibus rules look back 30 days. |
| Store data and settings | For as long as the App is installed; deleted when Shopify sends the shop/redact request (48 hours after uninstallation). |
| Access token | Deleted when the App is uninstalled. |
| Support chat | For as long as needed to provide support and in any case no longer than 24 months from the last message; it can be deleted earlier on request. |
| Technical logs | For a limited period, no longer than 12 months. |
At the end of these periods the data are deleted or made anonymous, unless they must be kept longer to comply with a legal obligation or to defend a right. Billing data are kept by Shopify, which issues the invoices for the App.
6. Recipients and sub-processors
Data are processed by authorised staff and collaborators of Made in Evolve bound to confidentiality, and only to the extent necessary for their tasks. They are also processed by the following parties:
| Party | Activity | Role | Location |
|---|---|---|---|
| Shopify International Limited (Ireland) and its group companies | Platform on which the store runs: the App reads and writes data only through the Shopify APIs; Shopify also manages the App’s billing | Independent controller | Ireland, Canada and other countries, under its own safeguards |
| DigitalOcean, LLC (United States) | Hosting: cloud servers and database of the App | Processor | See section 7 |
| Crisp IM SAS (France) | In-App support chat | Processor | EU |
Data may also be disclosed to public authorities where required by law, and to professional advisers bound to confidentiality where necessary to establish, exercise or defend legal claims. We do not sell personal data, do not use them for advertising and do not use them to train artificial intelligence models.
7. Transfers outside the European Economic Area
The App’s data are stored on DigitalOcean infrastructure. DigitalOcean, LLC and Shopify have their parent companies outside the European Economic Area (United States and Canada), and the support chat provider may use technical sub-processors outside the EEA. Where personal data are transferred, or may be accessed, outside the EEA, the transfer takes place on the basis of an adequacy decision of the European Commission (including, for US providers that participate in it, the EU-US Data Privacy Framework) or of the Standard Contractual Clauses adopted by Decision (EU) 2021/914. A copy of the safeguards can be requested at privacy@madeinevolve.com.
8. Shopify privacy requests (mandatory webhooks)
The App is subscribed to the three privacy webhooks that Shopify requires of all public apps, and accepts them only if their cryptographic signature is valid:
customers/data_requestandcustomers/redact: Because the App does not hold any data of the store’s customers,customers/data_requestandcustomers/redactrequests are acknowledged to Shopify with nothing to deliver or delete; the contact details contained in those requests are not recorded.shop/redact: Shopify sends it 48 hours after the App has been uninstalled, if it has not been reinstalled in the meantime. On receipt, the App permanently deletes all the data of that store from its database.app/uninstalled: on uninstallation the App immediately deletes the store’s access credentials.
9. Your rights and how to exercise them
Under Articles 15 to 22 GDPR you may ask at any time and free of charge for access to your data and a copy of them, rectification, erasure, restriction of processing, portability of the data you provided, and you may object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of the processing carried out before.
Requests can be sent through the privacy request form or by email to privacy@madeinevolve.com. We reply within one month of receipt, extendable by two further months where necessary given the complexity or number of requests (Article 12(3) GDPR). Uninstalling the App does not limit these rights.
If you are a customer of a store that uses the App, the App does not hold any of your data: for the data processed by the store, please contact the store directly.
If you believe that the processing infringes the GDPR, you may lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, or with the authority of the Member State where you live or work.
10. Security
Traffic between the merchant’s browser, Shopify and the App is always encrypted (HTTPS). Access tokens are used only to call the Shopify APIs within the permissions granted, messages from Shopify are accepted only with a valid signature, and access to servers and databases is limited to authorised staff. The measures adopted are described in the Information Security Policy.
11. Changes to this notice
This notice may be updated when the App, its providers or the applicable rules change; the date at the top shows the latest version. Substantial changes (new categories of data, new purposes, new sub-processors or different retention periods) are announced in the App before they take effect.
12. Contacts
For any question about this notice or about the processing of personal data through the App, write to privacy@madeinevolve.com.