DL Special Orders privacy policy

DL Special Orders is provided by Dolphinland 360 S.L., located at C. Parranda de los Buches, 18, Local 3, 35500 Arrecife, Las Palmas, España. For privacy-related questions, contact support@dolphinland.org.

The Shopify merchant is normally the data controller for customer information processed through DL Special Orders. Dolphinland 360 S.L. processes that information on the merchant's behalf to provide the app. Dolphinland 360 S.L. may act as an independent controller for account, security, billing, support and legal-compliance information relating to merchants and app users.

The app may process the Shopify store domain, Shopify customer ID, customer name and email address, merchant and staff identifiers, special-order details, products and custom items, quantities, suppliers, employee assignments, statuses, estimated arrival dates, comments, partial receipts, notification history and Shopify draft-order references. The app also stores configuration information, including encrypted email-provider credentials when a merchant configures email delivery.

We receive information from Shopify through its APIs and verified webhooks, from merchants and authorized staff when they use the app, and from email providers when a merchant configures or uses customer notifications.

We use the information to create and manage special orders, associate orders with customers, search Shopify products, assign suppliers and employees, track order progress and item receipts, create Shopify draft orders when explicitly requested by an authorized user, send customer notifications when requested, provide exports, verify subscription plans, protect the service, troubleshoot errors and comply with privacy requests and legal obligations.

For merchant and app-user information, processing is based on providing the requested service, performing our contract with the merchant, our legitimate interests in operating and securing the app, and compliance with legal obligations. Merchants are responsible for establishing an appropriate legal basis for entering and using their customers' personal data in the app and for sending customer notifications.

We use Shopify to provide store authentication and commerce data, Vercel to host the application, and Neon to host the application database. Email may be delivered through Resend or through the SMTP, Gmail, Google Workspace or custom webhook provider selected by the merchant. These providers process information only as needed to deliver their services. We may also disclose information when legally required.

Some service providers may process data outside the European Economic Area. Where required, transfers are protected through appropriate contractual or legal safeguards made available by the relevant provider.

Special-order and configuration data is retained while it is needed to provide the app and until it is deleted following a valid customer request, a Shopify shop-redaction request after uninstall, or another applicable deletion request. Protected-data access logs are retained for 12 months. Secure customer-data export links expire after 30 days. Some information may be retained longer when required to comply with legal obligations or resolve disputes.

DL Special Orders supports Shopify's mandatory customer data request, customer redaction and shop redaction webhooks. A verified customer data request creates a secure export for the authenticated store owner. Customer redaction deletes matching special orders and related data. Shop redaction deletes the application data associated with the store.

We use encrypted HTTPS connections, Shopify authentication, access controls, protected-data access logging and separation between development and production environments. Email-provider credentials are encrypted before being stored and are not displayed in full after saving. No method of storage or transmission can guarantee absolute security.

DL Special Orders does not use personal data for automated decisions that produce legal or similarly significant effects. We do not sell customer or merchant personal data and do not use it for third-party advertising.

DL Special Orders runs as an embedded application inside the Shopify admin and relies on Shopify authentication and session mechanisms. The app does not install advertising cookies or use customer information for advertising. Shopify and the infrastructure providers may process technical information under their own policies.

Depending on applicable law, individuals may request access, correction, deletion, restriction, portability or objection. Customers should normally contact the Shopify merchant that collected their information. Requests may also be sent to support@dolphinland.org, and we may need to coordinate with the relevant merchant to verify and complete them.

We may update this policy when the app, its providers or legal requirements change. The latest version and its effective date will remain available on this page.

For privacy questions or to exercise applicable rights, email support@dolphinland.org. You may also lodge a complaint with the Spanish Data Protection Agency or another competent supervisory authority.