Workflow SuiteWorkflow Suite

Privacy Policy

1. Controller and contact

This Privacy Policy explains how Code Creation Labs GmbH ("we", "us") processes personal data on our company websites: our documentation and help centers, our app landing pages, our public status pages, and our newsletter. Each of our Shopify apps has its own privacy policy and data processing agreement, linked from that app's own website; this policy covers the websites themselves.

Controller: Code Creation Labs GmbH, Friedensstr. 1, 47647 Kerken, Germany, represented by Yann Faulhaber (Amtsgericht Kleve, HRB 20472, VAT ID DE451671933).

For any data-protection question or to exercise your rights, contact us at [email protected].

2. Hosting and access logs

Our websites are hosted on Google Cloud in the europe-west1 region (Belgium). Cloudflare sits in front of them as our DNS, TLS and edge provider. When you visit a page, the hosting and edge infrastructure processes technical connection data: your IP address, the page requested, date and time, browser and operating system, and the referring page. This data is needed to deliver the page, keep the service secure and defend against abuse (Art. 6(1)(f) GDPR). Access logs are kept for a short period and then deleted; we do not use them to profile visitors.

3. Cookies and local storage

Our public websites do not use tracking or advertising cookies and no third-party analytics. We store a small amount of data in your browser purely so the site works as you left it: your light/dark theme choice (local storage), and, on a password-protected status page, a cookie that remembers you have unlocked it. These are functional and require no consent.

4. Contact forms, support inbox and chat

When you contact us through a form on one of our websites, by email, through the chat widget or via WhatsApp, we process the details you provide (name, email address, phone number where applicable, your message and any attachments) together with the time of contact, in order to answer you and handle your request (Art. 6(1)(b) GDPR, or Art. 6(1)(f) for questions from people who are not our customers). Messages are stored in our support inbox and, where a request is about one of our apps, linked to your shop or company record so we can help you in context.

New requests may be mirrored to our internal Slack workspace so our team is notified quickly. If you contact us via WhatsApp, Meta Platforms Ireland processes the message under its own terms and privacy policy.

We keep support conversations for as long as needed to handle the request and for as long as statutory retention obligations require, then delete them.

5. Spam protection

Forms and chat on our websites are protected by Friendly Captcha, a privacy-friendly proof-of-work challenge that does not use cookies or track you across sites. Solving the challenge sends technical data (a puzzle solution and your IP address) to Friendly Captcha GmbH, Germany, so that we can tell people from bots (Art. 6(1)(f) GDPR).

6. Newsletter and product updates

If you subscribe to our updates, or you are a customer of one of our apps, we may email you product news and updates about the apps you use. The legal basis is your consent (Art. 6(1)(a) GDPR) or, for existing customers, our legitimate interest in informing you about the products you use (Art. 6(1)(f) GDPR, § 7(3) UWG).

Every such email contains an unsubscribe link, and you can also unsubscribe at any time by writing to [email protected]. To understand whether our updates are useful we measure whether an email was opened and which links were clicked. When you unsubscribe, your address is placed on a suppression list so that we never email you again by mistake; this list is kept for that purpose only.

Emails are delivered through Amazon Web Services (Amazon SES). Bounce and complaint notifications from the provider are processed so that we stop sending to addresses that do not work or that have objected.

7. Status page subscriptions

You can subscribe to a status page with your email address to be notified about incidents. We process the address only to send those notifications (Art. 6(1)(a) GDPR) until you unsubscribe.

8. Data processing agreements (DPA) requested online

When you request a signed data processing agreement for one of our apps through a landing page, we process the company and contact details you enter to generate the signed document and email it to you (Art. 6(1)(b) GDPR). We keep a record of each issued agreement, as we are contractually required to.

9. Recipients and processors

We use the following service providers as processors under Art. 28 GDPR, each bound by a data processing agreement:

  • Google Cloud EMEA Limited (hosting, databases, storage), region europe-west1, Belgium
  • Cloudflare, Inc. (DNS, TLS termination, edge delivery)
  • Amazon Web Services EMEA SARL (email delivery via Amazon SES)
  • Friendly Captcha GmbH (spam protection)
  • Slack Technologies Limited (internal team notifications)

10. International transfers

Where a provider processes data outside the EU/EEA (for example Cloudflare, Amazon Web Services or Slack in the United States), we rely on the provider's certification under the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, together with additional safeguards where appropriate.

11. Your rights

You have the right to access the personal data we hold about you (Art. 15 GDPR), to have it corrected (Art. 16) or erased (Art. 17), to restrict processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent you may withdraw it at any time with effect for the future (Art. 7(3)).

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestr. 2-4, 40213 Düsseldorf, Germany.

12. No automated decision-making

We do not make automated decisions about you, including profiling, that produce legal or similarly significant effects.

13. Changes

We update this policy when our websites or the law change. The current version is always published here; material changes to how we use newsletter data are announced by email.