Privacy policy

Skonto Pay: B2B & D2C · last updated 12 October 2026

Skonto Pay is a Shopify app by Shopfabrik Berlin GmbH, Friedrichstr. 155, 10117 Berlin, Germany (“we”). This policy explains which data the app processes when a merchant installs it, where the data is kept and how it is deleted.

Roles

For the data of a shop’s customers, the merchant is the controller and we act as a processor on the merchant’s behalf. For the merchant’s own account data (the shop’s domain and settings) we are the controller.

What the app processes

Data	Purpose	Where it is kept
Shop domain, time zone, name of the Skonto payment method, plan, the app’s access token	Running the app for the shop, billing through Shopify	Our database
Skonto settings, including the bank details the merchant enters for its buyers	Showing the terms and bank details in checkout, on the thank-you page and on the order status page	In Shopify (shop metafield); a copy of each saved version in our audit log
Skonto orders: order ID and number, Skonto status, the two deadlines, the customer’s Shopify ID	Checking deadlines once a day, the limit of unpaid Skonto orders per customer, the monthly order count of the plan	Our database (no names, emails or addresses)
Skonto terms, status and the confirmed payment of an order	Showing the terms to buyer and staff, reducing the order after a timely payment	In Shopify (order metafields)
Company name and order contents	Read from Shopify when staff open the app or an order; shown, not stored	Not stored by the app
Audit log: which staff member changed the settings and when; automatic cancellations	Traceability for the merchant	Our database

The app does not process payment card data, does not track buyers and does not use data for advertising or profiling.

Where the data is processed

Shopify – the shop’s own platform; the app reads and writes there through Shopify’s APIs.
DigitalOcean – our application server and database, in Frankfurt, Germany.
Sentry (Functional Software, Inc., USA) – error reports. They contain technical details and can contain a shop domain and an order ID; they do not contain buyers’ names, emails or addresses.

How long the data is kept

While the app is installed: records of orders that were paid or cancelled are deleted 180 days later, audit log entries after two years.
When the app is uninstalled, the access token and the order index are deleted at once.
48 hours after the uninstall Shopify asks apps to erase the shop’s data; all remaining records of the shop are then deleted.
When Shopify forwards a customer’s erasure request, the records of that customer’s orders are deleted or detached from the customer.

Rights of buyers and merchants

Buyers address requests for access, correction or erasure to the shop they bought from; the merchant forwards them through Shopify and the app answers them automatically. Merchants can contact us directly. Everyone has the right to lodge a complaint with a data protection authority.

Contact

Shopfabrik Berlin GmbH, Friedrichstr. 155, 10117 Berlin, Germany · info@shop-fabrik.net

Shopfabrik Berlin GmbHPrivacy policy info@shop-fabrik.net