Privacy and data processing

1. Who we are

Prodyflow is an online business platform (ERP, webshop and sales tools) operated by Weborigo ("we", "us"). This page explains how personal data is processed when you use Prodyflow and its website.

Our company details and the way to contact us about data protection are in the Weborigo privacy notice: https://weborigo.hu/adatkezelesi-tajekoztato

2. Our two roles

When a company (our customer, the "webshop") uses Prodyflow to run its business, the webshop is the controller of the personal data it puts into the system, such as the data of its own customers, orders, deliveries, invoices, employees and suppliers. The webshop decides why and how this data is used, and is responsible for its own privacy notice and for answering requests of the people concerned. In this case we are the processor: we process the data only on behalf of the webshop and on its documented instructions.

For the data we need to run our own relationship with the webshop (accounts, contracts, billing, support and security of the service), we are the controller.

3. Data processed on behalf of webshops

Depending on the modules a webshop uses, Prodyflow stores and processes:

• contact, delivery and invoicing data of the webshop's customers and partners (name, address, email, phone, tax number);
• orders, baskets, payments (status and references; the card data itself is handled by the payment provider the webshop chose), deliveries, returns and invoices;
• customer messages and support tickets, including attachments uploaded by customers or staff;
• the webshop's staff accounts, roles, and their activity in the system;
• product, stock, production and other business data, and files such as images, documents and videos;
• technical data needed to run the service (logs, IP addresses, device and browser information).

4. Data we process as controller

For our own purposes we process the following about the people who register for or use Prodyflow:

• account and contact data (name, email, phone, company details) and the language setting;
• contract, subscription and billing data;
• communication with us (support requests, messages);
• security and technical logs of the service.

5. Purposes and legal bases

As processor, we process data to provide the service to the webshop, on the webshop's instructions (Article 28 GDPR). The webshop chooses the purposes and the legal basis of its own processing.

As controller, we process data to conclude and perform our contract with the webshop (Article 6(1)(b) GDPR), to meet our legal obligations such as accounting and tax rules (Article 6(1)(c)), and for our legitimate interest in the security, stability and improvement of the service and in handling claims (Article 6(1)(f)).

6. Sub-processors and where data is stored

To run Prodyflow we use the providers below. They store data or carry it as part of the service, and their own privacy notices apply to their services. Server hosting is provided by Hetzner, Rackforest and Time4VPS. Backups are stored with Backblaze, in its EU region. DNS and network protection are provided by Cloudflare and Amazon Route 53.

A webshop may also switch on integrations, such as payment providers, couriers or invoicing services. These are chosen and contracted by the webshop, which is responsible for them; we send them only the data the integration needs.

7. Transfers outside the European Economic Area

Some of the providers are companies seated outside the EEA. Where personal data is transferred to a country without an adequacy decision, we rely on the safeguards of Chapter V of the GDPR, such as the standard contractual clauses or the provider's certification under the EU-US Data Privacy Framework, as available for that provider. Backups are stored in the EU region of the backup provider.

8. How we protect the data

We use technical and organisational measures that fit the risk, including:

• a separate database for every webshop, so the data of webshops is kept apart;
• role-based access control for the accounts of the webshop's staff;
• private files (for example ticket attachments) are served only through short-lived, signed links;
• regular backups of the files and databases, kept in a separate storage from the production servers;
• access to the production systems limited to the people who need it.

9. Retention and deletion

The webshop decides how long its own data is kept, and can delete it in the system. For example, the files of tickets can be set to expire after a number of days, and then they are deleted, together with their backup copy.

When the contract ends, the data of the webshop is returned or deleted as agreed in the contract. Data we keep as controller is kept for as long as the contract lasts and afterwards for the periods our legal obligations and the limitation of claims require.

10. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw a consent you gave.

If your data is in a webshop or its business system, send your request to that webshop, which is the controller; we help the webshop to answer it. For data we process as controller, contact us as described in the Weborigo privacy notice.

You may also lodge a complaint with the supervisory authority; in Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, https://naih.hu), and you may turn to a court.

11. This website

This website does not use analytics or advertising cookies or trackers. To show the pages, your browser loads fonts and icons from third-party servers (Google Fonts and the cdnjs service of Cloudflare), which receive your IP address and browser details when doing so.

12. Changes

When we add or replace a sub-processor or change how we process data, we update this page first. The date of the last update is shown at the top.