This Privacy Policy explains how AUTOMATION FOR BUSINESS IT SRL (“we”, “us”, “our”), the developer of the CUIC (CUI Validator) Shopify application (the “App”), collects, uses, and protects personal data when a merchant installs the App on their Shopify store and when a customer completes checkout on that store.
For personal data processed through the App, we act as a data processor on behalf of the merchant (who is the data controller), in accordance with the EU General Data Protection Regulation (GDPR) and applicable Romanian data protection law.
CUIC is a checkout-only extension. At checkout, it reads the value that a customer enters in the billing address “Company” field and validates whether it matches the format of a Romanian company fiscal code (CUI — Cod Unic de Înregistrare). If the value is not a valid CUI, the App displays a message and can block checkout progress until it is corrected or cleared.
To provide its functionality, the App is granted the following Shopify access:
| Permission / source | Data | Purpose |
|---|---|---|
| Billing address at checkout | The value entered in the “Company” field (intended to be a business CUI). | Validate that the entered CUI has a correct format. |
read_customers |
Customer records associated with the store (e.g. name, email, addresses, order-related details). | Support checkout validation and Shopify’s app functionality. |
read_protected_customer_data |
Protected customer fields as defined by Shopify. | Access is limited to what is required to perform CUI validation; used per Shopify’s Protected Customer Data requirements. |
We do not collect payment card details, and we do not sell or rent personal data to third parties.
Where we process personal data on behalf of the merchant, the legal bases are:
CUIC is an extension-only application. It does not maintain its own separate database of customers or orders; personal data continues to reside within the merchant’s Shopify store. The App’s supporting infrastructure processes personal data only transiently and only as needed to respond to Shopify’s mandatory compliance requests (see section 8). We retain personal data no longer than necessary for the purposes described in this policy or as required by law.
We rely on the following service providers to operate the App:
| Provider | Role | Region |
|---|---|---|
| Shopify Inc. | E-commerce platform hosting the merchant store and checkout | Per Shopify’s data policies |
| Amazon Web Services (AWS) | Backend processing of Shopify compliance webhooks | European Union (eu-central-1 / eu-west-3) |
| GitHub Pages | Hosting of this informational website | Global CDN |
Our processing infrastructure is located in the European Union. Where any data transfer outside the European Economic Area occurs through our sub-processors, it is carried out under appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
Under the GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. Because the merchant is the controller of the data processed through the App, please direct data subject requests to the merchant’s store first; we will assist the merchant in fulfilling them.
The App supports Shopify’s mandatory GDPR compliance webhooks:
customers/data_request — we assist the merchant in providing a customer’s data upon request;customers/redact — we delete any customer personal data we may hold when a customer requests erasure;shop/redact — we delete store-related personal data 48 hours after a merchant uninstalls the App.You may also contact us directly at nick@ab-it.io.
We use appropriate technical and organizational measures to protect personal data, including transport encryption (HTTPS/TLS) and least-privilege access. No method of transmission or storage is completely secure, but we work to protect data in line with industry practice.
The App is a business tool and is not directed to children. We do not knowingly process personal data of children.
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date at the top of this page.
For any questions about this Privacy Policy or our data practices, contact:
AUTOMATION FOR BUSINESS IT SRL
Municipiul București, Sector 2, Str. Grigore Ionescu nr. 63, Camera nr. 1, Bl. T73, Sc. 2, Et. 4, Ap. 42
CUI: RO 36746568 · Nr. înmatriculare: J2016015061400
Email: nick@ab-it.io