Privacy Policy

RR Commerce is the trade name of RR Commerce Nederland B.V., Pieter Goedkoopweg 22, 2031EL Haarlem, The Netherlands. Chamber of Commerce (KvK) number 83205047, VAT number NL862768810B01.

We run webshops ourselves and offer the software and services behind them to other webshops, including RR Commerce Suite (a back office for e-commerce companies) and RR Commerce Fulfilment.

For any question about privacy, contact us at [email protected] or +31 (0)23-8200486.

As a processor.When a webshop (the “merchant”) uses RR Commerce Suite, we process the merchant's business data on the merchant's behalf and only on its instructions. The merchant is the controller of that data.

As a controller. We decide how we process the data needed to run our own relationship with merchants and their users: accounts, usage of our services and support.

To provide RR Commerce Suite, we process the data the merchant connects or enters, such as:

• Orders: order lines, prices, payment and shipping status, returns and refunds.
• Customers of the merchant: names, email addresses, phone numbers, delivery and billing addresses, and customer service conversations.
• Products: catalog data, prices, stock, product texts and images.
• Data from connected platforms the merchant chooses, such as Shopify, Bol, Mollie, Google, SnelStart and Magento.

We use this data only to provide the features the merchant uses. We do not sell it and do not use it for our own purposes.

• Account data: name, email address, company, role and login details of the people who use RR Commerce Suite. We use this to give access, secure accounts and contact you about the service.
• Usage data: log data such as IP address, browser, time of access and actions taken in the software. We use this to keep the service secure, fix problems and improve it.
• Support data: messages you send us and our replies. We use this to help you.
• Contract and billing data: company details and invoices, which we keep because the law requires it.

Our legal grounds are the performance of our contract with you, our legitimate interest in running a secure and reliable service, and compliance with legal obligations.

RR Commerce Suite lets a merchant connect their own Google accounts. We access Google user data only after a user of the merchant signs in with Google and explicitly grants access, and only for the services that user connects.

Which Google APIs we use and what we access

• Google Ads API:the merchant's Google Ads accounts, campaigns, ad groups, ads, keywords, budgets and performance reports (such as impressions, clicks, costs and conversions).
• Google Merchant Center:the merchant's product data, product status and issues, feeds and product performance.
• Google Search Console API: search performance (queries, pages, clicks, impressions and position) and indexing status for the sites the merchant has verified.
• The email address of the connected Google account, so the merchant can see which account is connected.

How we use it

We use Google user data only to provide the features the merchant has set up in RR Commerce Suite: showing advertising, product and search performance; creating and updating campaigns, ads and budgets when the merchant tells us to; and uploading and updating the merchant's products in Merchant Center.

How we store and protect it

Google user data is stored on servers in the European Union (Germany and France). It is encrypted in transit (TLS) and at rest. Access tokens are stored encrypted and only the systems that need them can use them. Only staff who need access to operate or support the service can reach it.

Who we share it with

We share Google user data only with the sub-processors listed in section 8, and only to run the service.

Performance data from Google APIs (for example Search Console search terms and click statistics for the merchant's own pages, and Google Ads and Merchant Center data) may be included in requests to our AI sub-processors only to generate content the merchant asked for. Our AI sub-processors are bound by contract to not use this data to train their models or for any purpose other than returning the result. No Google user data is sold or used for advertising by us.

Retention and deletion

We keep Google user data as long as the Google account is connected and the merchant uses RR Commerce Suite. You can revoke our access at any time in RR Commerce Suite or in your Google account permissions. When access is revoked, we stop accessing the account and delete the Google user data we stored for it.

Limited Use

RR Commerce Suite's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the user-facing features of RR Commerce Suite that the merchant uses.
• We transfer it to others only as needed to provide those features, to comply with the law, or as part of a merger, acquisition or sale of assets after notifying users.
• We do not use or transfer it to serve advertising, including personalised, retargeted or interest-based advertising. Managing the merchant's own Google Ads campaigns on the merchant's instructions is the service itself.
• We do not sell it, and we do not use it to determine creditworthiness or for lending.
• No person at RR Commerce reads it unless the user has given permission for specific data, it is needed for security purposes such as investigating abuse, it is needed to comply with the law, or it has been aggregated and anonymised for internal operations.
• We never use Google user data to develop, improve or train generalised AI or machine learning models.

When a merchant installs our Shopify app, we receive the store's orders, customers and products through the Shopify API, as described in section 3, and process them only to provide RR Commerce Suite to that merchant.

We handle Shopify's privacy requests: when a customer of the merchant asks for their data or for it to be deleted, we provide or delete it. When the merchant uninstalls the app, we delete the store's data within 30 days.

• Our servers and databases are hosted in the European Union (Germany and France).
• Data is encrypted in transit (TLS) and at rest.
• Access is limited to staff who need it, protected by individual accounts and strong authentication.
• We keep backups so data can be restored, and we monitor our systems for misuse.
• If a personal data breach occurs, we inform affected merchants and, where required, the Dutch Data Protection Authority without undue delay.

We use the following sub-processors. Each processes data only on our instructions under a data processing agreement.

AI and web research providers receive only the content needed to generate text the merchant asks for, such as product data and, where relevant, performance data from Google APIs (see section 5). They may not use it to train their models or for any purpose other than returning the result. Where a sub-processor is outside the European Economic Area, we rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

• Merchant data: for as long as the contract with the merchant runs. After it ends, we delete it or return it to the merchant, as agreed in the data processing agreement.
• Shopify app: deleted within 30 days after the merchant uninstalls the app.
• Google user data: until access is revoked or the Google account is disconnected, then deleted (see section 5).
• Account, usage and support data: for as long as the account exists and as needed for security and support.
• Invoices and financial records: seven years, as required by Dutch tax law.

Under the GDPR you have the right to access, correct or delete your personal data, to restrict or object to its processing, and to receive it in a portable format. You can also withdraw any consent you have given. Send your request to [email protected]; we reply within one month.

If you are a customer of a merchant that uses RR Commerce Suite, please contact that merchant first, as they control your data. We help merchants respond to such requests.

You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Merchants can request our data processing agreement at any time at [email protected].

This website (rrcommerce.com) does not use cookies, analytics or tracking.

RR Commerce Suite uses only strictly necessary cookies to keep you signed in and to protect your account. It does not use advertising or tracking cookies.

If you find a security vulnerability or suspect that data has been exposed, please email [email protected]with the subject “Security”. We will respond as soon as possible.

We may update this policy when our services change. The date at the top shows when it was last updated. We inform merchants of important changes in advance.