Skip to content
MiixNederlands
Menu

Privacy policy Laposta for Shopify

This is a translation of the Dutch privacy policy. In case of differences, the Dutch text prevails. Last updated 12 November 2026.

1. Introduction

This privacy policy explains how the Laposta Integration app ("the App"), developed by Miix, handles data when you install it on your Shopify store. We process data in accordance with the General Data Protection Regulation (GDPR). For your customers' data you are the controller and we are the processor; our arrangements are in the data processing agreement, which you accept by installing the App.

2. What data the App uses

The App can access the following customer data in Shopify, insofar as you map it:

  • Name (first name, last name)
  • Email address
  • Phone number (if available)
  • Address (street, city, zip code, country)
  • Company name (if available)
  • Email marketing consent status
  • Other fields you map, such as tags, locale, order count and total spent

3. How the App uses the data

  • Customer data is read from Shopify and sent to your Laposta list through the Laposta API, with your own API key.
  • With two-way sync on, subscriptions, unsubscriptions and changes in Laposta are written back to Shopify.
  • We use the data for this only. We don't sell it and don't combine it with data from other stores.

4. What we store

Customer data passes through the App during a sync but is not kept in the App's database. The App only stores:

  • Your Shopify session data (needed to sign in)
  • Your Laposta API key
  • Your list connections and field settings

Operational server logs may contain customer email addresses so we can fix problems. These logs are kept for at most 30 days.

5. Hosting and sub-processors

The App runs on Railway Corporation. The application is in a data centre in the Netherlands, the database in the United States. That transfer outside the EEA is covered by the European Commission's Standard Contractual Clauses. The database and backups are encrypted (AES-256).

Shopify and Laposta are not our sub-processors: you have your own agreements with them (Shopify privacy policy, Laposta privacy policy). The App exchanges data between those two services on your behalf.

6. Retention and deletion

When you uninstall the App, your session data is deleted immediately and your settings (API key, list connections) within 48 hours, on Shopify's deletion request. Customer data already synced to Laposta or Shopify stays there under your control.

7. Your rights and your customers' rights

Under the GDPR, you and your customers have the right of access, rectification, erasure, restriction of processing, data portability and objection. Since customer data lives in your Shopify store and your Laposta account, you handle most requests there. The App supports Shopify's privacy webhooks for data requests and erasure. For data about the App's settings, contact us.

8. Security

  • HTTPS for every connection with Shopify, Laposta and the database
  • Encryption of the database and backups (AES-256)
  • Every incoming webhook is verified: HMAC signatures for Shopify, a per-store token and a signature for Laposta
  • Data strictly separated per store, and a separate test environment
  • Daily, weekly and monthly backups
  • A documented security incident procedure; in case of a data breach we inform you within 48 hours

9. Changes

We may change this privacy policy. The date at the top shows when it last changed.

10. Contact

Miix / Fred Klopper
Groningensingel 51-45
6835 EB Arnhem, the Netherlands
Chamber of Commerce (KvK) 09114618
Email: hallo@miix.dev

You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).