Privacy policy
Last updated: November 12, 2026
This policy explains what personal data ShopKollect processes, why, for how long, and what your rights are.
1. Who is responsible?
- For merchants and visitors of https://shop.pixelorigin.com, the controller is Pixelorigin (see the legal notice).
- For shop customers (orders, customer accounts), the controller is the shop's merchant; ShopKollect acts as a processor on their behalf. The shop's legal notice and privacy policy apply; to exercise your rights, contact the merchant first.
2. Data processed
| Who | Data | Why | Legal basis | Retention |
|---|---|---|---|---|
| Merchants | name, e-mail, phone, company, address, company and VAT numbers, password (hashed), language | create and manage the account and shop, support | contract | account lifetime, then 3 years |
| Merchants | invoices, payments (PayPal or transfer reference, no card number) | invoicing, accounting | legal obligation | 10 years |
| Shop team | name, e-mail, role | access to the dashboard | contract | duration of access |
| Shop customers (for the merchant) | name, phone, e-mail, orders, pickup time, note, customer account | process the order, tracking, account | contract with the merchant | set by the merchant; orders kept for their accounting obligations |
| App users | device notification token, language, tracked orders | notify when the order is ready | legitimate interest / your request | until unregistration, app removal or 2 days after the order for the order link |
| Everyone | IP address, technical logs | security, abuse prevention | legitimate interest | 1 year |
We do not sell any data, show no advertising and do no profiling.
3. Recipients and sub-processors
Data is accessible to our authorised staff and, for a shop's data, to the merchant and their team. We use:
- our hosting: servers run by Pixelorigin in France; encrypted backups on a second server in France (kept up to 12 months);
- PayPal (Europe) S.à r.l. et Cie, S.C.A.: subscription payments;
- Google Firebase Cloud Messaging: app notifications (only the device token and the notification text are sent).
Some of these providers may transfer data outside the European Union; such transfers are covered by the European Commission's standard contractual clauses or an adequacy decision.
4. The ShopKollect app
The app keeps your list of shops, your cart and your tracked orders on your phone. Your customer account token is stored in the phone's secure storage. The camera is only used to read a shop's QR code: no image is saved or sent. Notifications can be turned off at any time in the phone's settings. You can delete your customer account from the app (My account → Delete my account).
5. Security
Encrypted connections (HTTPS), hashed passwords, each shop's data isolated in the database, restricted access, daily backups and restore tests.
6. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability. Customers can download their data and delete their account from the shop or the app. For any request: benjouabde@gmail.com. You can also lodge a complaint with the CNIL (www.cnil.fr).