Privacy policy
DRAFT v1, not yet reviewed by a lawyer. Not in force until a lawyer has approved it.
Last updated: [date]
This policy exists in Dutch and English. If the two differ, the Dutch text prevails.
This privacy policy covers codesaur’s plugins and apps, such as “VAT & Company Autofill”, the website plugins.codesaur.nl and support. It has three parts, because what codesaur receives from you depends on how you use the software:
- Part A. Plugins you install yourself (Shopware, WooCommerce, Adobe Commerce/Magento, PrestaShop): codesaur receives no personal data.
- Part B. Hosted apps (Shopify, Lightspeed): codesaur processes data as a processor for the shop.
- Part C. This website and support: codesaur is the controller.
Summary
Section titled “Summary”- A plugin on your own server sends nothing to codesaur: no telemetry, no usage data.
- With a hosted app, codesaur processes buyers’ data only on the shop’s instructions, under a data processing agreement, within the European Economic Area.
- codesaur does not sell data and does not use it to train AI models.
- No cookies on this website, no analytics, no external fonts or scripts.
1. Who codesaur is
Section titled “1. Who codesaur is”codesaur is the sole proprietorship (eenmanszaak) of Hans de Jong, registered with the Dutch Chamber of Commerce under number 42167270, established at De Dintel 19, 5463 NR Veghel, the Netherlands. Privacy questions: [privacy@codesaur.nl, confirm]. codesaur has not appointed a data protection officer; it is not required to.
Part A. Plugins you install yourself
Section titled “Part A. Plugins you install yourself”A1. codesaur receives nothing
Section titled “A1. codesaur receives nothing”The plugins for Shopware, WooCommerce, Adobe Commerce (Magento) and PrestaShop run on your shop’s server. They send no data to codesaur: no telemetry, no usage statistics and no licence check, except Freemius for WooCommerce Plus (A3). For these plugins codesaur is therefore not a processor, and you do not need a data processing agreement with codesaur.
A2. You are the controller
Section titled “A2. You are the controller”You decide which checks the plugin performs. The plugin then contacts these sources directly from your server:
| Source | What the plugin sends | Run by |
|---|---|---|
| VIES | VAT number and country | European Commission |
| PDOK | postcode and house number | Kadaster (Netherlands) |
| BeST | postcode, street and house number | Belgian authorities (address register) |
| KVK API, only if you switch it on, with your own key | KvK number or search term | Dutch Chamber of Commerce |
What the plugin stores in your shop’s database, such as a temporary cache of answers, a log with masked input and the result of a VAT check on the customer, is under your control. You inform your buyers about this in your own privacy policy. A list of the sources, with links to their terms and privacy policies, is at plugins.codesaur.nl/vat-company-autofill/external-services/.
A3. Freemius (WooCommerce Plus only)
Section titled “A3. Freemius (WooCommerce Plus only)”The paid WooCommerce Plus add-on is sold through Freemius. Freemius handles payment, invoices, VAT and licence keys as the seller (merchant of record) and is itself the controller for that data [confirm role]. The add-on contacts Freemius to check your licence and deliver updates. In doing so, [your site address, the licence key and the add-on version, confirm] are sent to Freemius. Freemius usage tracking is switched off [confirm]. What Freemius does with your data is governed by Freemius’s privacy policy. codesaur receives from Freemius [the buyer’s name, e-mail address, country and licence details, confirm], to provide the licence and support (performance of the contract, Art. 6(1)(b) GDPR). codesaur keeps this data while the licence runs and for [period] after; data that belongs to an invoice for 7 years (Dutch tax retention duty).
Part B. Hosted apps (Shopify, Lightspeed)
Section titled “Part B. Hosted apps (Shopify, Lightspeed)”B1. Two roles
Section titled “B1. Two roles”- For a shop’s buyers (anyone who enters a VAT number, KvK number or address at checkout): the shop is the controller. codesaur processes that data only on the shop’s instructions, as a processor. The arrangements are in the data processing agreement at plugins.codesaur.nl/legal/dpa/. If you are a buyer with a question or request about your data, please contact the shop first; codesaur helps the shop answer.
- For merchants (anyone who signs in to the app’s dashboard): codesaur is the controller for the data in B3.
B2. What codesaur processes for shops (as processor)
Section titled “B2. What codesaur processes for shops (as processor)”| Data | Why | Kept |
|---|---|---|
| VAT number, KvK number, postcode, house number, street | to check them in the public registers and fill in the form | answers cached: VIES 24 hours; PDOK, BeST and KvK 7 days |
| Masked copy of the input and the result (no IP address) | to show the shop why a check failed | 1 to 180 days, set by the shop (default 30) |
| One-way code (keyed hash) of the IP address | to stop abuse (rate limits) | at most 1 day |
| Data that Shopify sends in a webhook, encrypted | to carry out the shop’s or Shopify’s request | until the request is done or the buyer is erased; the record 7 days |
| Database backups | recovery after an outage | 14 days |
codesaur queries VIES (European Commission), PDOK (Kadaster), BeST (Belgian address register) and, if the shop switched it on, the KVK API with the shop’s own key. These registers receive the number or address being checked. They are not codesaur’s sub-processors; they act under their own terms.
B3. What codesaur processes for merchants (as controller)
Section titled “B3. What codesaur processes for merchants (as controller)”| Data | Why | Legal basis | Kept |
|---|---|---|---|
| E-mail addresses allowed to sign in | to send sign-in links | performance of the contract (Art. 6(1)(b) GDPR) | until removed in the dashboard or the shop deletes its data |
| Sign-in link and session (as hash only), language | to keep you signed in safely | performance of the contract; legitimate interest in security (Art. 6(1)(f) GDPR) | sign-in link 15 minutes (link from the platform 5 minutes); session 2 hours idle, 12 hours at most |
| Shop data: domain, settings, plan, encrypted platform access token, encrypted KvK key | to provide the app | performance of the contract | until the app is removed or “Delete all data” is used; the Shopify access token is deleted when the app is removed |
| Number of KvK requests per month | to provide the app and show KvK costs | performance of the contract | 24 months |
| Server access log (IP address [shortened, confirm], sign-in tokens removed) | security and troubleshooting | legitimate interest (Art. 6(1)(f) GDPR) | [period, confirm] |
Payments run through Shopify or Lightspeed. codesaur receives no payment details, only which plan the shop has.
The dashboard sets only strictly necessary cookies: a session cookie and a cookie against cross-site request forgery. These need no consent (Art. 11.7a(3) Dutch Telecommunications Act). No tracking or advertising cookies.
B4. Recipients and location
Section titled “B4. Recipients and location”codesaur uses the providers in the sub-processor list at plugins.codesaur.nl/legal/subprocessors/: hosting, e-mail delivery and backup storage. All data is processed within the European Economic Area. codesaur does not transfer data to countries outside it.
B5. Seeing and deleting your data
Section titled “B5. Seeing and deleting your data”In the dashboard (“Your data”) the merchant can download all data, empty the log at once and delete all data. On Shopify, the app also handles Shopify’s privacy requests automatically.
Part C. This website and support
Section titled “Part C. This website and support”C1. Website
Section titled “C1. Website”plugins.codesaur.nl is a static website. It sets no cookies, uses no analytics and loads no fonts, scripts or other files from third parties.
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| Web server access log: shortened IP address, time, page requested, status code, browser type [confirm fields] | to deliver and secure the website and fix problems | legitimate interest (Art. 6(1)(f) GDPR) | at most 3 months (90 days) |
The IP address is shortened before it is stored IPv4 to /16, IPv6 to /32. The logs are kept in codesaur’s own monitoring system (SigNoz, self-hosted) on a server in [EU location, confirm]. Nobody else has access.
C2. Support by e-mail
Section titled “C2. Support by e-mail”If you e-mail support@codesaur.nl, codesaur processes your name, e-mail address, the content of your message and what you attach, such as the “Copy diagnostics” text (versions, settings and masked error messages, without keys).
- Why: to answer your question and to improve the software based on reported errors.
- Legal basis: performance of the contract (Art. 6(1)(b) GDPR); without a contract, legitimate interest (Art. 6(1)(f) GDPR).
- Kept: as long as needed to help you, at most 2 years after the last message.
- Recipients: [e-mail provider, confirm], as processor.
Please do not send your buyers’ personal data unless it is needed.
C3. Support through a store
Section titled “C3. Support through a store”For Shopware, PrestaShop and the free WooCommerce plugin, support runs through the store’s ticket system or forum. That store processes what you write there under its own privacy policy. codesaur sees your message and your name in that system and uses them only to answer you.
2. Your rights
Section titled “2. Your rights”You have the right to access, rectify, erase and restrict your data (Art. 15 to 18 GDPR), to data portability (Art. 20 GDPR) and to object to processing based on legitimate interest (Art. 21 GDPR). If the data is processed by codesaur for a shop (part B2), that shop handles your request. codesaur answers within one month. codesaur makes no decisions about you based solely on automated processing.
3. Security
Section titled “3. Security”codesaur protects data with appropriate measures, such as encrypted connections (TLS), encrypted storage of API keys, masked logs, only hashes of sign-in tokens and short sessions. The measures for the hosted apps are in Annex 2 of the data processing agreement.
4. Contact and complaints
Section titled “4. Contact and complaints”Questions or requests about your data: [privacy@codesaur.nl, confirm]. If you are not satisfied with the answer, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the supervisory authority in your own country (Art. 77 GDPR).
5. Changes
Section titled “5. Changes”If this privacy policy changes, the date at the top changes too. codesaur announces material changes for the hosted apps at least 30 days in advance in the dashboard.