Privacy Policy
This policy explains how we process personal data when you visit this website, use the FABULOUS DELIVERY merchant portal (app.fabulous.delivery) or install the FABULOUS DELIVERY app in your Shopify store.
1. Who we are
FABULOUS CODE UG (haftungsbeschränkt)
Conventstraße 15, 22089 Hamburg, Germany
Managing director: Berkay Uğur Çankıran
Commercial register: Amtsgericht Hamburg, HRB 181347
Email: hello@fabulous-code.com
FABULOUS DELIVERY is a third-party logistics (3PL) service operated by FABULOUS CODE UG.
2. Our role
- Merchant data (your account, your store, your products and stock): we are the controller.
- Your customers' data (buyer name and shipping address of orders we fulfil for you): we process it on your behalf as a processor (Art. 28 GDPR), solely to pick, pack and ship your orders. A data processing agreement (Art. 28 GDPR) is available on request.
3. Data we receive from Shopify
When you install the app and approve its permissions, Shopify shares the following with us:
- Store details: shop domain, shop name, shop owner name and email address (to create and secure your portal account).
- Products: product and variant titles, SKUs, barcodes, images and weights (to identify the goods we store for you).
- Inventory: stock levels at the FABULOUS DELIVERY location, which we keep up to date.
- Fulfillment orders assigned to us: order number, ordered items and quantities, payment status, and the buyer's name, company, shipping address, phone number and email address (to create shipping labels and ship the order).
We only receive orders that Shopify routes to the FABULOUS DELIVERY location. We do not access payment details, and we do not use any of this data for advertising, profiling, or sell it to anyone.
4. Purposes and legal bases
- Providing the fulfillment service, the portal and the Shopify integration — performance of contract (Art. 6(1)(b) GDPR); for buyer data on your instructions as processor.
- Service emails (account setup, order and stock notifications) — performance of contract.
- Security, fraud prevention and keeping the service running (e.g. login throttling, error logs) — legitimate interest (Art. 6(1)(f) GDPR).
- Statutory retention of business records — legal obligation (Art. 6(1)(c) GDPR).
5. Recipients
- Shipping carriers (DHL, DPD): buyer name, shipping address and, where required for delivery, phone number or email.
- DigitalOcean, LLC: hosting of the portal and its database.
- Postmark (ActiveCampaign, LLC): delivery of service emails to merchants.
- Shopify: we send stock levels, fulfillment status and tracking numbers back to your store.
Where a provider is located outside the EU/EEA, transfers are protected by the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
6. How long we keep data
- Buyer data (name, address, phone, email) is automatically erased 90 days after an order has been shipped, cancelled or rejected. Order numbers, items and tracking numbers remain for your order history.
- When Shopify asks us to erase a buyer's data (customers/redact), we erase it from all their orders.
- When you uninstall the app, our access ends immediately; when Shopify sends the shop erasure request (about 48 hours later) we delete your account and all store data. Invoices and records we must keep by law are retained for the statutory period.
- Password-reset links expire automatically; login-attempt records are deleted after 1 day.
7. Security
All connections are encrypted with TLS. Passwords are stored as salted hashes. Shopify access tokens expire and are refreshed automatically. Access to buyer data is limited to the warehouse staff who need it to ship orders, and our database runs on managed infrastructure with encrypted storage and backups.
8. Cookies
The portal uses one strictly necessary session cookie to keep you signed in. We use no analytics, advertising or tracking cookies. This website itself sets no cookies.
9. Website analytics
To see how this website is used, we use our own privacy-friendly analytics service, FABULOUS ANALYTICS (app.fabulous-analytics.com). It sets no cookies, stores no IP addresses and creates no profiles or fingerprints. It records only anonymous page views: the page, the referring website, campaign parameters, browser, operating system, device type, screen size, the country derived from the browser's time zone, time on page and scroll depth. Nobody can be identified from this data. Legal basis: legitimate interest in improving our website (Art. 6(1)(f) GDPR). The analytics script is not used in the merchant portal.
10. Website access logs
When you visit this website or the portal, the server briefly processes technical data (IP address, time, requested page, browser) to deliver the pages and protect them from abuse — legitimate interest (Art. 6(1)(f) GDPR).
11. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and to object (Art. 15–21 GDPR), and to lodge a complaint with a supervisory authority, e.g. the Hamburg Commissioner for Data Protection and Freedom of Information. Buyers of a Shopify store should contact the store first; we support the merchant in answering such requests. To exercise your rights, email hello@fabulous-code.com.
12. Changes
We update this policy when our service changes. The current version is always available at fabulous.delivery/privacy.html.