Privacy Policy

VISION AIR LTD, Manchester, United Kingdom, is the developer of the Widerruf: EU Withdrawal Button Shopify app (the “App”) and the controller for personal data processed through this website and the App's own records.

For data belonging to a merchant's customers, the merchant who installed the App is the controller and VISION AIR LTD acts as a processor on their behalf and instructions.

Contact for all privacy matters: admin@euwiderrufsbutton.app

Customer data (shoppers of the merchant's store). When a shopper submits a withdrawal form, the App processes their name, email address, the order the request refers to, the withdrawal reason they select, and any message they write. For fraud and spam detection the App also processes approximate geolocation, IP address, and browser and operating-system information.

Merchant and staff data. Store owner name, email address, phone number and business address, as provided by Shopify when the App is installed.

Store data. Order records — including the ability to edit order history from the last 60 days — so that approved withdrawals can be refunded and cancelled.

Website data. This marketing website does not use advertising or analytics cookies. Standard server logs may record IP address and user agent for security and availability purposes.

• To display the withdrawal form and record submissions as a legal audit trail.
• To send the shopper a timestamped confirmation email, and any decision email the merchant approves.
• To process refunds and order cancellations when a merchant approves a request.
• To detect suspicious or fraudulent withdrawal requests and protect merchants from abuse.
• To provide support, respond to enquiries, and keep the service secure and available.

• Article 6(1)(b) — contract. Processing a withdrawal request, issuing the refund and cancelling the order are necessary to perform the contract between the shopper and the merchant, and between the merchant and us.
• Article 6(1)(c) — legal obligation. Retaining a record of withdrawal requests supports the merchant's obligations under EU Directive 2023/2673 and national withdrawal-right law.
• Article 6(1)(f) — legitimate interests. Spam and fraud detection, service security, and product improvement, balanced against the rights of the people concerned.

We do not sell personal data. Data is shared only with the providers needed to run the service:

• Shopify — the platform the App runs on, and the source of order and store data. Billing is also handled by Shopify.
• Hosting and email delivery providers — engaged under data processing agreements to run the App and send confirmation and decision emails.

We may also disclose data where required by law or to establish, exercise or defend legal claims.

Where personal data is transferred outside the European Economic Area, the transfer is covered by an adequacy decision or by the European Commission's Standard Contractual Clauses together with the supplementary measures needed for the destination country.

Withdrawal request records are retained for as long as the merchant keeps the App installed, because they form the merchant's compliance audit trail, and thereafter for the period required by the merchant's own record-keeping obligations. Merchants can delete individual requests from the dashboard at any time.

When the App is uninstalled, associated store and request data is deleted within 30 days, except where a longer period is required by law. Support correspondence is kept for up to 24 months.

Subject to the conditions in the GDPR, you have the right to request access to your personal data, rectification, erasure, restriction of processing, portability, and to object to processing based on legitimate interests. You may also lodge a complaint with your local supervisory authority.

If you are a shopper, please contact the store you ordered from first — they are the controller for your data. You can also write to admin@euwiderrufsbutton.app and we will assist the merchant in responding.

Data is transmitted over TLS and stored on access-controlled infrastructure. Access to production data is limited to the people who need it to operate and support the App. If a breach affects your personal data, we will notify the relevant supervisory authority and, where required, the people concerned without undue delay.

The App is a business tool for merchants and is not directed at children. We do not knowingly collect data from children.

We may update this policy as the App changes. The effective date above always reflects the current version, and material changes will be communicated to merchants through the App or by email.

Questions about this policy or about how your data is handled: admin@euwiderrufsbutton.app. You can also review the App's data disclosures on its Shopify App Store listing.