Services Privacy & Data Processing Notice

Publisher: Fennorica Oy, Business ID 3434751-2, Vantaa, Finland. Privacy contact: info@fennorica.com.

For tenant-configured processing, the merchant or white-label tenant normally determines the purposes of its customer data and Fennorica processes that data through CoreX to provide the configured service. Fennorica separately acts as controller for its own contracting, billing, security administration and legal-compliance records.

CoreX Connect / Shopify Level 1

CoreX Connect processes order/product identity and reconciliation data, commercial entitlement state, payment/refund state, fulfilment/tracking state, minimal trust/evidence lifecycle state, and bounded webhook/compliance records. It does not request or intentionally process Shopify customer Name, Address, Email or Phone fields, payment-card data, or special-category data.

Purposes

The purposes are merchant-installation binding, order/product reconciliation, entitlement reconciliation, payment/refund lifecycle reconciliation, fulfilment/tracking lifecycle reconciliation, current-vs-historical trust/evidence state, webhook security/idempotency/recovery, and Shopify privacy-request handling.

Retention and deletion

Operational copies follow the canonical finite retention schedule. Raw Shopify privacy webhook payloads are not persisted. Merchant token material is deleted/redacted on shop redaction and revocation processing. Historical integrity hashes may outlive deleted payloads only when they no longer contain protected/personal source data.

Rights and requests

Requests concerning tenant-controlled data should normally be directed to the relevant merchant/tenant controller. Fennorica assists controllers under the applicable DPA and supports Shopify's mandatory data-request and redaction webhooks.