Privacy policy
Last updated:
Data controller
Tacotech AB (reg. no. 559259-2132), Södra Bulltoftavägen 51, 212 22 Malmö, Sweden, is the controller for personal data processed on tacotech.se.
What we process
If you submit the contact form we process your name, email address, website, phone number and anything you write, in order to get in touch. If you email us we process the details you provide in the same way. Beyond that we use a visitor analytics tool, described below.
The form and our processor
The contact form is handled by Formspree Inc., which receives submissions and passes them on to us. Formspree acts as our data processor under a data processing agreement. Data is transferred to the United States. If you would rather avoid that, emailing us directly at the address above works just as well.
Retention
Email correspondence is kept for as long as the matter requires and is then deleted.
Visitor analytics
We use Apollo.io to see which companies visit the site. The tool reads the visitor’s IP address and looks up the company it belongs to, together with the pages visited. The purpose is to follow up with companies that have shown interest in our services. An IP address counts as personal data, and our legal basis is our legitimate interest in reaching potential customers. Apollo.io Inc. acts as our processor and part of the processing takes place in the United States. If you would rather not be measured you can block assets.apollo.io in your browser, or contact us and we will delete the data.
The Shopify app: our role
For our Tacotech Affiliate app, the merchant is the data controller and Tacotech is the processor. We process data on the merchant’s instructions, in order to attribute sales to the publisher who drove them and calculate the commission due. The terms are set out in our Data Processing Agreement, entered into when the app is installed.
What the app reads
From a merchant’s store the app reads and retains the order number and internal order identifier, order value, currency and tax treatment, discount codes applied, the checkout identifier, and order and refund timestamps and status.
What the app does not retain
The app does not read or retain customer names, email addresses, telephone numbers, billing or shipping addresses, IP addresses, order notes or line-item properties. Where Shopify includes such fields, they are removed before anything is written to storage. This is a technical control in the app, not only a policy commitment.
The cookie our tracking sets
Our tracking sets one first-party cookie, _tt_af, holding affiliate click identifiers so a later purchase can be attributed to the publisher who referred the visit. It contains no personal data and lasts 45 days. It is set only where the visitor’s consent choices permit: the tracking declares that it requires analytics and marketing consent, and Shopify’s customer privacy controls prevent it running where consent has not been given.
Sub-processors for the app
To attribute a sale and calculate commission we send the order number, order value and currency, affiliate click and channel identifiers, and the page address the purchase completed on to the affiliate network. No customer personal data is included in that transfer. Our sub-processors are Addrevenue AB, which operates the affiliate network, in Sweden, and Hetzner Online GmbH, which provides hosting and database, in Finland. We do not sell personal data and do not transfer it outside the EEA.
Where app data is stored, and how it is secured
All data is stored in the European Union, on infrastructure operated by Hetzner Online GmbH in Helsinki. Data in transit is protected with TLS, merchant access tokens are encrypted at rest with AES-256-GCM, and the database is not reachable from the public internet. Access to internal systems requires named accounts, and actions that change a merchant’s configuration are recorded in an audit log.
How long app data is kept
Affiliate click identifiers awaiting a matching order are kept for 60 days. Records of attributed sales are kept for the duration of the merchant agreement and afterwards for as long as invoicing and accounting obligations require. The merchant store record and access credentials are deleted when Shopify notifies us of an uninstall and requests erasure, normally within 48 hours.
Your rights
You have the right to request access to, correction of, or erasure of your personal data. Contact us at the address above. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).
Our services
This policy covers tacotech.se.