Privacy Policy of RETEX
Version 1.1 · Last updated: 2026-10-11
RETEX is a returns and exchanges application for Shopify online shops, provided by ARSHIVE GROUP - FZCO, a Dubai free zone company, licence number 64407, IFZA Business Park, DDP, Premises no 64407-001, Dubai Silicon Oasis, Dubai, United Arab Emirates ("we", "us"). Contact for anything in this policy: support@retexapp.com. We have not appointed a data protection officer: Article 37 GDPR does not require one for the processing we carry out. EU representative (Article 27 GDPR): not yet appointed; we will name it here when we appoint one.
This policy explains how we handle personal data under Regulation (EU) 2016/679 (GDPR) and the national laws that supplement it. It covers two different roles that we have, so please read the part that applies to you.
| Role A: we are the controller | Role B: we are the processor | |
|---|---|---|
| Whose data | Merchants who install RETEX, their staff, and people who contact us or visit our public pages | The customers of those merchants: people who return or exchange an order through a merchant's shop |
| Who decides why and how the data is used | We do | The merchant does. We act only on the merchant's documented instructions, under our Data Processing Agreement |
| Where to exercise your rights | With us (support@retexapp.com) | With the merchant whose shop you bought from. We help the merchant respond (section 9) |
1. Role A: what we do as controller
1.1 Data we collect
| Data | Source | Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|---|---|
| Shop domain, shop name, shop owner and contact name and email, country, currency, language and time zone, Shopify plan | Shopify, when the merchant installs the app, and the merchant | To install, authenticate and operate the service for that shop | (b) performance of the contract with the merchant |
| Staff identity: Shopify user identifier and display name of staff who use the app; staff comments and actions recorded in the request history | Shopify session, the staff member | To provide the service, keep an audit trail of who did what, and keep the merchant's account secure | (b) contract; (f) our legitimate interest in security and accountability |
| Acceptance of our Terms and Data Processing Agreement (version, time) | The merchant | To keep a record of the agreement | (b) contract; (c) legal obligation where records are required; (f) |
| Chosen subscription plan and its status | Shopify | To apply the plan's features and limits. Payment is handled entirely by Shopify; we never see card or bank details | (b) contract |
| Messages to our support, and our replies | The person who contacts us | To answer questions and fix problems | (b) or (f) |
| Technical logs: request time, shop and request identifiers, error details. The request logs kept by our hosting provider also record the IP address of each request to our servers. Email addresses, tokens and credentials are removed from our application logs | Our servers | Security, fault finding, preventing abuse | (f) our legitimate interest in running a secure and reliable service |
| Accounting records for fees we receive from Shopify | Shopify, our accountant | Bookkeeping and tax | (c) legal obligation |
We do not use this data for advertising, we do not sell it, and we do not use analytics or tracking cookies (see our Cookie Notice).
1.2 Recipients
Our sub-processors that host or support our systems, our professional advisers and accountant, Shopify (as the platform), and public authorities where a law requires us to disclose data.
1.3 How long
While the shop uses RETEX, and afterwards only as described in our Retention Policy. Technical logs are kept for 30 days. Accounting records are kept for the period required by law.
2. Role B: what we do as processor for merchants
A merchant who installs RETEX uses it to receive and handle return and exchange requests from its own customers. For that purpose the merchant is the controller and decides what is collected, why, and on what legal basis; the merchant's own privacy notice to its customers is the notice that applies to the customers' data. We process this data only to provide the service and as the merchant instructs us.
2.1 Where the data comes from
- Through Shopify's APIs. With the merchant's permission and only for the access scopes the app has been granted (listed in the app's installation screen), we read order data: order number, date, line items and prices, discounts, shipping and billing address, delivery method (including a chosen parcel locker), payment and refund information, fulfilment status, and the customer's name, email address and phone number. We write back refunds, store credit, discount codes, replacement and exchange orders, draft orders (for payment differences) and inventory changes. Shopify classifies customer name, email, phone and address as protected customer data, and the app uses it only for the functions described here.
- From the merchant. Merchant settings (return window, fees, reasons, languages), trader details used on withdrawal forms, saved replies, internal comments, notes, ratings and flags about customers, and carrier or mailbox credentials. Credentials are stored encrypted.
- From the merchant's customers, in the return portal: name, email address and order number to find the order; the items to return or exchange; the reason and any free-text comment; photos of the goods; the preferred form of refund (original payment method, or store credit if the customer chooses it); the drop-off point; the replacement items for an exchange; and any electronic withdrawal notice.
- From email. If the merchant connects a mailbox, we read messages that relate to a return (they quote the return reference, belong to an existing thread, or come from a known customer) and store them with their attachments. Other mail in the mailbox is not stored.
- From carriers. If the merchant connects a carrier account, the carrier returns the label, tracking number and delivery events for the return shipment.
2.2 What we do with it
Look up the order, check whether it can be returned, record and track the request, show it to the merchant's staff, send acknowledgements and status emails to the customer, issue a return label or code through the carrier the merchant chose, record the received goods, and carry out the refund, store credit, exchange or restock that the merchant approves.
2.3 Special categories of data
RETEX is not designed to collect health data or other special categories of personal data (Art. 9 GDPR). A customer might nevertheless mention such information in the free-text reason or in a photo or message, for example that a product caused a skin reaction. We treat free text and photos as potentially sensitive: we apply the same access controls and retention limits to them, we do not analyse or reuse them, and we delete or anonymise them with the request (see the Retention Policy). Merchants should tell customers not to send more than is needed.
2.4 Ratings, tiers and flags about customers (profiling)
Merchants can record, within their own shop only, a 1–5 rating for a customer after a request, a trusted or problem flag, and a short note. The average of a customer's ratings gives a customer tier shown to the merchant's staff.
- Recording ratings and flags, and the tier calculated from them, can amount to profiling in the sense of Art. 4(4) GDPR. It is carried out by the merchant, which is the controller. The merchant needs its own legal basis and must tell its customers about it in its privacy notice.
- RETEX never makes a decision about a customer on this basis. It does not reject, delay or change any request automatically because of a rating, tier or flag; a person at the merchant decides every request.
- Ratings, tiers and flags are kept separately for each shop. We never combine or share them across shops, and we never use them for our own purposes.
- Customers can ask the merchant for access to, correction of, or removal of this data, and the merchant can delete it in RETEX. It is deleted if the customer asks for erasure, and when the merchant uninstalls the app.
2.5 Recipients and retention for Role B
Recipients are the merchant and its staff; the sub-processors we use; the carrier that the merchant has chosen, which receives only what it needs to create the shipment; and, for refunds, Shopify. Retention periods are in our Retention Policy. In summary: closed and rejected requests are anonymised 24 months after closing unless the merchant chooses another period; unlinked inbound email is deleted after 30 days; a customer's data is erased or anonymised within 30 days of a request that reaches us; and all of a shop's data is deleted about 48 hours after the app is uninstalled.
3. International transfers
Our hosting, database and file storage are in the European Economic Area (Belgium, Google Cloud region europe-west1), and our email sending provider, Lettermint B.V., processes data in the EEA (EU (Netherlands)).
We are based in the United Arab Emirates, and our personnel access personal data from there, remotely, to operate, support and secure the service. The UAE has no adequacy decision of the European Commission. For the data we process for merchants (Role B), this access is covered by the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), which are part of our Data Processing Agreement, together with the supplementary measures described there. The data stays stored in the EEA. Data about merchants and their staff (Role A) we collect directly as a company established in the UAE; the GDPR applies to that processing, and we protect it in the same way.
Where a sub-processor, or its support staff, can access personal data from a country outside the EEA that the European Commission has not found to provide an adequate level of protection, we rely on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, together with the supplementary measures that are needed. When a merchant connects a carrier, the merchant's contract with that carrier governs any transfer by the carrier.
4. Security
We protect personal data with measures that include: encryption of connections (TLS); encryption of stored carrier and mailbox credentials; separation of every shop's data, so that one shop's staff can never see another's; verified requests from Shopify; short-lived, shop-bound download links for photos and labels; validation of uploaded files; removal of emails, tokens and credentials from logs; access to production systems limited to named people; and EU hosting. No system is perfectly secure. If a personal data breach affects data we process for a merchant, we notify the merchant without undue delay, as set out in the Data Processing Agreement.
5. Do you have to give us the data?
For a merchant: without the shop and account data in section 1 we cannot provide the service. For a customer of a merchant: whether you must provide data is decided by the merchant; without the data needed to identify the order and the goods, the return cannot be processed.
6. Automated decision-making
We do not take decisions about individuals based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR).
7. Children
RETEX is a tool for businesses and is not directed at children. We do not knowingly collect data from children for our own purposes.
8. Cookies
See our Cookie Notice. RETEX uses only strictly necessary storage.
9. Your rights
Under the GDPR you have the right to access your data and receive a copy; to have inaccurate data corrected; to have data erased; to restrict processing; to object to processing based on legitimate interests; to receive data you gave us in a structured, machine-readable format where processing is based on consent or contract and is automated; and to withdraw any consent at any time. These rights are subject to the conditions and exceptions in Articles 15–22.
- Merchants and their staff (Role A): write to support@retexapp.com. We answer within one month; we may extend this by up to two more months for complex requests and will tell you why.
- Customers of a merchant (Role B): please contact the merchant, who decides how your data is used. If you contact us, we will pass your request to the merchant without undue delay, and we do not respond to it ourselves unless the merchant instructs us to. We help the merchant by exporting, correcting or erasing your data in RETEX. Shopify's data-request and erasure notices from the merchant's shop reach us automatically, and we complete them within 30 days.
10. Complaints
You may lodge a complaint with the data protection supervisory authority of the EU or EEA country where you live, where you work or where the alleged infringement took place. We are not established in the EU, so no single authority leads for us. If you are a customer of a merchant, you can also complain to the authority responsible for that merchant. The European Data Protection Board lists the authorities at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.
11. Changes to this policy
We will update this page when our processing changes, and change the "Last updated" date. For a material change that affects merchants we will tell them by email or in the app before it takes effect.