Privacy Policy

Last updated: September 7, 2026

This Privacy Policy explains how V.O.F. LMRT Commerce (“DropDesk”, “we”, “us”) collects, uses, shares and protects personal data when you use the DropDesk dashboard and the DropDesk application for Shopify (together, the “Service”). We act as a data controller for your account data, and as a data processor on behalf of the merchant for store data we access through Shopify.

1. Who we are

The Service is operated by V.O.F. LMRT Commerce, Kastanjelaan 2, 5581 HE Waalre, Nederland, Chamber of Commerce (KvK) no. 42079800. For any privacy question you can reach us at privacy@dropdesk.nl.

2. Data we collect

2.1 Account & usage data (we are controller)

Identity & contact: name, email address, company name, password (stored hashed).
Billing data: plan, invoices and payment status (card details are handled by our payment processor, not stored by us).
Technical & usage data: IP address, browser type, log data, cookies and actions taken inside the dashboard.
Support communications you send us.

2.2 Shopify store data (we are processor)

When a merchant connects a Shopify store, we access data through the Shopify Admin API using the scopes the merchant approves. This may include:

Orders and transactions (amounts, dates, financial and fulfilment status, line items).
Products, variants and inventory levels.
Fulfilments and shipping information.
Customer information (name, email, address) — “Protected Customer Data” under Shopify’s rules.
Store metadata (shop domain, currency, name).

We access this data only to provide dashboard, analytics, order-management and profit-reporting features to the merchant that owns the store.

3. How we use data

To provide, operate and secure the Service and its features.
To display analytics, orders, products, revenue and profit reporting.
To authenticate you and manage your account and subscription.
To provide support and communicate about the Service.
To comply with legal obligations and prevent fraud or abuse.

4. Legal basis (GDPR)

Performance of a contract — to deliver the Service you signed up for.
Legitimate interests — to secure, improve and support the Service.
Legal obligation — e.g. accounting and tax retention.
Consent — where required, e.g. for non-essential cookies.

5. Sharing & subprocessors

We do not sell personal data. We share it only with service providers that help us run the Service, under appropriate data-processing agreements:

Provider	Purpose
Shopify	Source of store data via the Admin API
Hosting provider	Servers and data storage
Payment processor (e.g. Stripe)	Subscription billing
Email provider	Transactional and support email
AI provider (where AI features are used)	Processing content you submit to AI features

We may also disclose data where required by law.

6. International transfers

Where data is processed outside the European Economic Area, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

7. Retention & deletion

Account data is kept while your account is active and for as long as needed for legal and accounting purposes afterwards.
Store data is retained while the store is connected. When a merchant uninstalls the app or disconnects a store, we delete or anonymise the associated store data.
In line with Shopify requirements, we honour the mandatory compliance webhooks customers/data_request, customers/redact and shop/redact: on a redaction request we delete the relevant customer or shop data, and on a data-request we provide the data we hold.

8. Security

We use appropriate technical and organisational measures, including hashed passwords, encrypted transport (HTTPS), access controls and storing sensitive data (including access tokens) outside the public web root. No method of transmission or storage is 100% secure, but we work to protect your data.

9. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and the right to data portability. You may also lodge a complaint with a supervisory authority (in the Netherlands, the Autoriteit Persoonsgegevens). To exercise your rights, email privacy@dropdesk.nl. If your personal data was provided to us by a merchant (as part of store data), please contact that merchant directly.

10. Cookies

We use strictly necessary cookies to keep you logged in and to remember your language preference. We may use limited analytics to understand usage. You can control cookies through your browser settings.

11. Children

The Service is intended for businesses and is not directed at children under 16.

12. Changes

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email. The “last updated” date above reflects the latest version.

13. Contact

V.O.F. LMRT Commerce
Kastanjelaan 2, 5581 HE Waalre, Nederland
Email: privacy@dropdesk.nl