This policy explains how COEC processes personal data as a controller for ShopAssist: the data of our customers' staff, website visitors and people who contact us. For the data of your store's shoppers, the store is the controller; see shopper data.
Who we are
COEC, CVR Wird veröffentlicht, Denmark. Privacy questions: privacy@coec.dk.
What we process and why
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| Account data: name, email, password hash, role, sign-in history | You | Provide your account and keep it secure | Contract; legitimate interest in security |
| Billing data: company name, address, VAT number, invoices | You, Stripe or Shopify | Billing and bookkeeping | Contract; legal obligation |
| Support correspondence | You | Answer your requests | Contract; legitimate interest |
| Contact form messages | You | Answer your request | Legitimate interest; your consent to be contacted |
| Website visits | Server logs without IP addresses | Security and aggregate statistics | Legitimate interest |
| Demo chats on our website | You | Show the product; improve the demo | Legitimate interest |
| Newsletter subscription | You | Send product news | Consent |
| Legal acceptances | You | Record which terms you accepted | Legal obligation; legitimate interest |
We do not make decisions based solely on automated processing that significantly affect you.
Recipients
- Stripe processes payments for web signups as an independent controller.
- Shopify bills Shopify App Store installs on our behalf.
- Google processes sign-ins when you choose Sign in with Google.
- Our hosting, email and error-monitoring sub-processors, listed on the sub-processors page.
Transfers
We process data in the EU. Where a recipient has a parent company outside the EEA, Standard Contractual Clauses apply, as described on the sub-processors page.
Retention
Account data is kept while your account exists and deleted 30 days after you delete it. Invoices and bookkeeping records are kept for 5 years after the end of the financial year, as Danish law requires. Server logs are kept for 30 days. Demo chats are deleted after 30 days. Legal acceptance records are kept for 5 years after the organization is deleted.
Your rights
You can ask for access to, correction or deletion of your data, restriction of or objection to processing, and a copy of your data in a portable format. You can withdraw consent at any time. Write to privacy@coec.dk. You can complain to the Danish Data Protection Agency (Datatilsynet), datatilsynet.dk.
Cookies and storage
Our website sets no cookies and stores nothing on your device unless you sign in, choose a theme in the docs or open the demo chat. See the cookie and storage policy.
Shopper data
When a shopper chats with the assistant in a store, the store is the controller and COEC processes the data on the store's behalf. If you are a shopper, please contact the store. If you contact us, we forward your request to the store.