Privacy & Security

Is EcoReturns GDPR compliant?

EcoReturns is built to support GDPR compliance: it processes only the order and customer data needed to run returns, honors data-subject deletion requests within 14 days, and offers a Data Processing Agreement on request via [email protected].

By Saara Editorial Team · Updated

Direct answer

EcoReturns acts as a data processor on behalf of the merchant (the data controller). It processes the minimum order and customer data required to operate returns, exchanges, and refunds. Merchants can request a Data Processing Agreement, and end-customer deletion requests are processed within 14 days through the data deletion request page.

What data EcoReturns processes

Processing is limited to what the returns workflow needs.

  • Order details: order ID, items, prices, and fulfillment status.
  • Customer contact details: name, email, and shipping address as provided by the store.
  • Returns data: return reasons, RMA status, refund and exchange outcomes.
  • No payment card data is collected or stored by EcoReturns.

Your controls as a merchant

Merchants retain control of their data throughout the relationship.

  • Uninstalling the Shopify app stops EcoReturns' access to new store data.
  • Full account and data deletion can be requested at any time via the data deletion request page.
  • Deletion requests are confirmed by email and completed within 14 days.
  • Some records may be retained where the law requires it, such as billing records.
  • A DPA is available on request for merchants serving EU/EEA or UK customers.

Frequently asked questions

Does EcoReturns store payment card data?

No. Refunds are executed through the store's own platform (for example Shopify), and EcoReturns never sees or stores card numbers.

How long does data deletion take?

Deletion requests are confirmed by email and completed within 14 days of the request.

What happens to my data if I uninstall the app?

Uninstalling stops further data access. You can then request full deletion of stored data through the data deletion request page.

Sources