Privacy Policy

Digital Product Passport · Shopify App · Last updated 22 October 2026

1. Who we are

BrandUp Factory GmbH, Duvenstedter Berg 55, 22397 Hamburg, Germany (“BrandUp”, “we”) provides the Shopify app “Digital Product Passport”. Contact: info@brandupfactory.com.

2. Roles

For the data merchants enter about their products and their company, the merchant is the controller and BrandUp acts as processor and Digital Product Passport service provider. For the merchant account data we need to run and bill the app, BrandUp is the controller.

3. Data we process

Store data from Shopify — Shop domain, shop name, contact email, primary domain, and product data (title, handle, image, SKU, barcode, vendor, product type) for products the merchant creates passports for.

Data entered by the merchant — Economic operator details (legal name, address, contact details, VAT ID, EORI, operator ID, EPR numbers, EU responsible person) and product passport data (materials, origin, care, repair, end of life, documents).

Session and billing data — Shopify session tokens and the subscription status provided by Shopify Billing.

Support — Name, email and message content when the merchant contacts us.

Passport page visits — An aggregated view counter per passport. We do not set cookies on passport pages and do not store IP addresses or other data about shoppers.

The app does not access or store Shopify customer data (shoppers’ names, orders or addresses).

4. Purposes and legal bases

• Providing the app and publishing the merchant’s product passports (Art. 6(1)(b) GDPR, contract; Art. 28 GDPR processing).

• Billing through Shopify (Art. 6(1)(b) GDPR).

• Transactional emails about installation, uninstallation and support (Art. 6(1)(b) and (f) GDPR).

• Keeping published passports available and verifiable, including version history with checksums, as expected for Digital Product Passports under Regulation (EU) 2024/1781 (Art. 6(1)(c) GDPR).

5. Recipients and sub-processors

Shopify — Platform, authentication, billing.

Salesforce / Heroku — Application hosting, EU region.

Amazon Web Services — Database hosting, Frankfurt, Germany.

Resend — Transactional email.

Sentry — Error monitoring, if enabled.

Ecobalyse (French government service) — Only when the merchant calculates the French environmental cost; we send product composition, weight and countries, no personal data.

Where data is transferred outside the EU/EEA, this is based on the EU Standard Contractual Clauses or an adequacy decision.

6. Retention

When the app is uninstalled, sessions are deleted immediately and all shop data is deleted no later than 48 hours afterwards when Shopify sends the shop/redact request, unless the merchant reinstalls the app in the meantime. Published passport pages go offline when the app is uninstalled. Merchants can export all passport data as CSV at any time before uninstalling.

7. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection, and to lodge a complaint with a supervisory authority (in Hamburg: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit). Contact us at info@brandupfactory.com.

8. Security

All connections are encrypted (TLS). Passport pages are served through Shopify’s signed App Proxy, and every published passport version is stored with a SHA-256 checksum to detect changes.

9. Changes

We may update this policy, for example when the app gains new features. Changes are posted here with an updated date.

10. Contact

BrandUp Factory GmbH · info@brandupfactory.com · brandupfactory.com