The General Data Protection Regulation (GDPR) sets rules for how businesses handle the personal data of people in the EU and EEA. This article explains how Growave handles your customers’ data, what you’re responsible for as a store owner, and which Growave settings can help.
⚠️ Important: This article is a general overview to help you understand how Growave handles personal data. It isn’t legal advice. Growave’s legal documents, including the App Privacy Notice and Data Processing Agreement, are available in the Growave Legal Center. If anything in this article differs from those documents, the Legal Center documents apply. For advice about your store’s GDPR obligations, consult your own legal advisor.
What is GDPR?
GDPR gives people in the EU and EEA more control over their personal data. It applies to any business that processes their data, wherever the business is located. It focuses on transparency, accountability, and security, and non-compliance can lead to substantial penalties.
Key GDPR principles
Lawful basis: Personal data can only be processed on a lawful basis, such as consent, performance of a contract, or legitimate interests. When consent is used, it must be freely given, specific, and informed, and it can be withdrawn at any time.
Transparency: People have the right to know what data is collected and how it’s used.
Data security: Personal data must be stored securely and protected from misuse or unauthorized access.
Data subject rights: People can request to access, correct, delete, or export their personal data, and object to or restrict its processing.
Who is responsible for your customers’ data
You, the store owner, are the data controller. You decide why and how your customers’ personal data is processed.
Growave is the data processor. Growave processes your customers’ data on your behalf to provide app features such as rewards, reviews, and wishlists.
Growave’s obligations as a processor, including the list of sub-processors, are set out in the Data Processing Agreement (EU).
📖 Learn more in the Growave App Privacy Notice and the Growave Legal Center.
How Growave protects your customers’ data
Growave processes your customers’ data on your behalf to provide app features, as described in the App Privacy Notice.
Growave uses sub-processors only under data processing agreements and notifies you at least 30 days before changing them.
When a customer’s data is erased through Shopify, Growave deletes it from its systems within 48 hours. Backups are deleted automatically within 7 days for our primary database and within 14 days for other systems.
Your role as a store owner
As the data controller, you’re responsible for:
Telling customers clearly how their personal data is collected, processed, and stored.
Making your store’s privacy policy easy to find.
Handling your customers’ privacy requests. Customers exercise their rights by contacting you, not Growave.
How to handle a customer’s request to delete their data
In your Shopify admin, go to Customers and open the customer’s profile.
Click More actions → Erase personal data.
Shopify sends the erasure request to your installed apps, including Growave.
Once Growave receives the request, it deletes the customer’s data within 48 hours. Backups are deleted automatically within 7 days for our primary database and within 14 days for other systems.
📖 Learn more about processing customer data requests in Shopify.
📘 Note: If a customer contacts Growave directly, Growave doesn’t act on the request without your authorization and lets you know about it.
How to handle a customer's request to opt out of the loyalty program
If a customer wants to leave the loyalty program but keep their store account, you can easily exclude them by applying tags in the customer eligibility settings (Forbid).
Settings that support transparency and opt-in
Rewards program consent
Make joining your loyalty program opt-in. Customers must agree to join before they can earn points or access rewards.
To activate this, go to Rewards → Settings → General → Rewards availability settings and enable Require customer consent to join the Rewards program.
Review usage consent
Require customers to agree to the processing of their personal data and the content they submit, such as text and media, before posting a review. You can also link to your store’s privacy policy.
To activate this, go to Reviews → Settings → General → Moderation and display and enable Require customers to provide consent before posting a review.
📘 Note: These settings help you be transparent with your customers and let them choose to take part. They don’t make your store GDPR compliant on their own.
If you have any questions regarding GDPR compliance, contact us at [email protected] or use the chat in the bottom-right corner of your Growave admin panel.