Privacy Policy - Discount Kit
Effective Date: 21st July 2025
Last Updated: 21st July 2025
1. Introduction
Optizio Ltd (“we,” “us,” or “our”) operates the Discount Kit Shopify application (“App”). This Privacy Policy explains how we collect, use, disclose, and protect information when you use our App.
Company Information:
- Company Name: Optizio Ltd
- Address: 124 City Road, London, EC1V 2NX, United Kingdom
- Data Protection Officer: David Spanton
- Contact: support@optiz.io
When you install and use our App, we collect:
- Store Information: Store name, description, primary email, store ID, URL, Shopify plan, industry vertical, and country
- User Information: Names and email addresses of store staff who interact with the App’s admin interface
- Configuration Data: Shopify GIDs for products, collections, and discounts, as well as customer tag names required for discount functionality
- Technical Information: System information, app usage data, and performance metrics
- Support Information: Information provided during support interactions
- We do not collect personal data from your customers (end-users)
- We do not store or process credit card information
- We do not collect unnecessary personal information beyond what is required for app functionality
3.1 Primary Uses
We use the collected information for:
- App Functionality: Providing and maintaining the discount features and services
- Support Services: Responding to your inquiries and providing technical support
- Product Updates: Communicating important app updates and new features
- Analytics: Understanding app performance and usage patterns to improve our services
3.2 Legal Basis for Processing
We rely on different legal bases depending on jurisdiction:
- GDPR (EU/UK): Primarily legitimate interest for app functionality and business operations; contract performance where processing is necessary to fulfill our agreement with you
- Consent-based jurisdictions (Brazil LGPD, India DPDP, South Korea PIPA): Explicit consent obtained during app installation and configuration
- US State Laws: Legitimate interest for app functionality, with consent obtained where required by specific state requirements
- Other jurisdictions: Appropriate legal basis as required by local privacy laws
3.3 Consent Management
For jurisdictions requiring explicit consent, we:
- Obtain clear, informed consent during app installation and setup
- Provide easy mechanisms to withdraw consent through app settings or email
- Maintain records of consent and withdrawal for compliance purposes
- Re-obtain consent when required by law or when expanding data processing activities
- Honor consent withdrawal by ceasing relevant processing activities
4.1 Third-Party Service Providers
We share information with the following trusted third-party services:
Cloudflare
- Purpose: Session storage and caching for app functionality
- Data Shared: Technical and configuration data necessary for app operation
- Compliance: GDPR compliant with appropriate data processing agreements
Mantle
- Purpose: Business operations platform for support, analysis, and product updates
- Data Shared: Store information and usage data
- Compliance: Operates under a Data Processing Addendum
Intercom
- Purpose: Customer support services
- Data Shared: Name, email, country, store URL, user system information, and Shopify plan
- Data Location: Dublin, Ireland for EU customers
- Compliance: GDPR compliant
4.2 Shopify Integration
We share data with Shopify only as required for app functionality and in accordance with Shopify’s Partner Program requirements.
4.3 What We Don’t Share
- We do not sell, rent, or trade your personal information
- We do not share your data with advertisers or marketing companies
- We do not provide your information to third parties except as described in this policy
5. Data Security
We implement comprehensive security measures to protect your information:
- Encryption: All sensitive data is encrypted both at rest and in transit using industry-standard encryption (AES-256)
- Access Controls: Access to data is granted based on job roles and the principle of least privilege
- Authentication: Multi-factor authentication (MFA) is required for all critical systems
- Regular Updates: We maintain up-to-date software and security patches
- Monitoring: Continuous monitoring for security threats and incidents
- Compliance: We follow Shopify’s secure app development guidelines and maintain comprehensive security policies
For detailed information about our security practices, please refer to our Information Security Policy.
6. Data Retention
6.1 Retention Periods
We automatically delete data according to these schedules:
- App Configuration/Session Data: On app uninstall (automatic deletion)
- Support Data: 3 years after last interaction.
These retention periods comply with data minimization principles and are designed to meet the requirements of all applicable privacy laws.
6.2 Data Deletion
Upon request or at the end of retention periods, we will permanently delete your information from our systems and instruct our third-party service providers to do the same.
6.3 Data Breach Notification
In the event of a data breach that poses a risk to your rights and freedoms, we will:
- Notify relevant supervisory authorities within 72 hours where required by law
- Notify affected individuals without undue delay
- Provide clear information about the nature of the breach and steps being taken
- Comply with jurisdiction-specific notification requirements (GDPR, US state laws, PIPEDA, etc.)
- Follow New York SHIELD Act requirements for data security and breach notification
7. Your Rights and Choices
7.1 General Rights
You have the right to:
- Access: Request a copy of the personal information we hold about you
- Correction: Request correction of inaccurate or incomplete information
- Deletion: Request deletion of your personal information
- Portability: Request your data in a structured, machine-readable format
- Objection: Object to our processing of your personal information
7.2 GDPR Rights (EU/UK Users)
If you are located in the EU or UK, you have additional rights under GDPR:
- Right to restrict processing
- Right to data portability
- Right to object to processing based on legitimate interest
- Right to withdraw consent where processing is based on consent
7.3 US State Privacy Rights
California (CCPA/CPRA): If you are a California resident, you have rights under the California Consumer Privacy Act:
- Right to know what personal information is collected
- Right to delete personal information
- Right to opt-out of the sale of personal information (note: we do not sell personal information)
- Right to non-discrimination for exercising your privacy rights
Virginia (VCDPA): If you are a Virginia resident, you have rights under the Virginia Consumer Data Protection Act:
- Right to access, correct, and delete personal information
- Right to opt-out of targeted advertising and profiling
- Right to non-discrimination for exercising your privacy rights
Colorado (CPA): If you are a Colorado resident, you have rights under the Colorado Privacy Act:
- Right to access, correct, and delete personal information
- Right to opt-out of targeted advertising and profiling
- Right to data portability
Connecticut (CTDPA): If you are a Connecticut resident, you have rights under the Connecticut Data Privacy Act:
- Right to access, correct, and delete personal information
- Right to opt-out of targeted advertising and profiling
- Right to data portability
Utah (UCPA): If you are a Utah resident, you have rights under the Utah Consumer Privacy Act:
- Right to access and delete personal information
- Right to opt-out of targeted advertising
- Right to non-discrimination for exercising your privacy rights
7.4 US Federal Privacy Laws
COPPA (Children’s Online Privacy Protection Act): See Section 9 for our children’s privacy practices and age-appropriate data handling.
7.5 How to Exercise Your Rights
To exercise any of these rights:
- Through Shopify: Use Shopify’s built-in data request mechanisms
- Email Us: Contact support@optiz.io
- Response Time: We typically respond within 2 business days
8. International Data Transfers
Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place:
- EU/UK: We comply with GDPR requirements for international transfers
- Third-Party Services: Our service providers (Cloudflare, Mantle, Intercom) maintain appropriate data protection agreements and comply with applicable privacy laws
- Safeguards: We ensure adequate protection through contractual obligations and compliance certifications
9. Children’s Privacy
Our App is not intended for use by individuals under the applicable age of digital consent. We do not knowingly collect personal information from children under the relevant age threshold:
- GDPR (EU/UK): 16 years (or lower age set by member state law)
- COPPA (USA): 13 years
- PIPEDA (Canada): 13 years
- South Korea: 14 years
- Other jurisdictions: As required by local law
If you believe we have inadvertently collected information from a child under the applicable age, please contact us immediately and we will take steps to remove such information.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make changes:
- We will update the “Last Updated” date at the top of this policy
- For significant changes, we will notify you via email (if provided) or through in-app notifications
- We will provide at least 30 days advance notice of material changes
- Continued use of the App after changes constitutes acceptance of the updated policy
11. Compliance with Local Laws
11.1 Primary Jurisdictions
This Privacy Policy is designed to comply with privacy laws in multiple jurisdictions, including:
- GDPR (European Union and United Kingdom)
- US State Privacy Laws (California CCPA/CPRA, Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA)
- US Federal Laws (COPPA, New York SHIELD Act)
- PIPEDA (Canada)
11.2 Additional Jurisdictions
If you have questions about how local privacy laws apply to your use of our App, please contact us.
For questions about this Privacy Policy or to exercise your privacy rights:
Data Protection Officer: David Spanton
Email: support@optiz.io
Address: Optizio Ltd, 124 City Road, London, EC1V 2NX, United Kingdom
For GDPR-related inquiries in the EU/UK:
You also have the right to lodge a complaint with your local data protection authority.
For CCPA-related inquiries in California:
You may contact the California Attorney General’s office regarding privacy concerns.
This Privacy Policy is effective as of the 21st July 2025 and governs your use of the Discount Kit Shopify application.