Privacy policy — PickPick Pickup & Payments
Last updated: 2026-10-15
PickPick Pickup & Payments (“the app”) is a Shopify app that offers carrier pickup points (PostNL, bpost, DPD via MyParcel) as shipping rates at checkout, writes the chosen pickup point onto the order, and renames, hides or reorders payment methods at checkout.
This policy describes exactly which data the app processes, where it is stored, who it is shared with and how long it is kept. It applies to merchants who install the app and to the buyers of those merchants’ stores.
Who we are
The app is operated by OWM (OUX Works Merchandising B.V., Dutch Chamber of Commerce (KvK) number 98654896, VAT number NL868586584B01, Rijder 1B10, 1507 DP Zaandam, Netherlands). Contact: support@pickpick.nl.
For the personal data of a store’s buyers, the merchant is the controller and OWM acts as processor on the merchant’s behalf (see “Roles” below and the data processing terms in our Terms of Service at https://app.pickpick.nl/terms).
What the app stores
The app keeps one database. Everything in it is tied to a store (its myshopify.com domain):
| Data | Purpose | Kept until |
|---|---|---|
| Store domain and the Shopify access session: access token, refresh token, granted scopes, expiry. Tokens are encrypted. | Calling the Shopify Admin API for the store. | Deleted when the app is uninstalled. |
| MyParcel API key and, optionally, a Google Maps API key (both encrypted). | Looking up pickup points; showing a map in the buyer’s order confirmation. | Deleted after uninstall (shop/redact). |
| App settings: carriers and on/off per country, number of pickup points, checkout placement, widget texts, contact URL, logo URLs, the IDs of the carrier service and customizations the app created, and a random token that authenticates Shopify’s rate requests (encrypted). | Running the app as the merchant configured it. | Deleted after uninstall (shop/redact). |
| Payment rule configuration (rename/hide/order rules for payment method names). | Applying the merchant’s payment rules at checkout. | Deleted after uninstall (shop/redact). |
| Pickup points offered at checkout: carrier, location code, location name, the location’s public street address and coordinates, and its distance from the searched address at the time of the search. Encrypted. Not linked to an order, a buyer or a buyer’s address. | Writing the full pickup point onto the order when the order comes in (the shipping rate code is too short to carry it). | Deleted 180 days after the point was last offered, or after uninstall (shop/redact), whichever comes first. |
| Checkout block check: per store, the time the app’s thank-you block and order status block last showed for a pickup order, the block’s version number, and the time the last pickup order came in. No order, buyer or request data. | Showing the merchant whether the app’s blocks are actually placed in the checkout. | Deleted after uninstall (shop/redact). |
The app requests offline (store-level) access only, so it does not store the names or email addresses of the merchant’s staff. Should Shopify ever hand the app a staff user’s name or email with a session, they are encrypted in the same way as the tokens.
What the app does not store
- No buyer names, email addresses, phone numbers or addresses.
- No order numbers or order IDs, and no tracking numbers or tracking URLs.
- No payment details.
- No IP addresses in the app database.
- No cookies or tracking on buyers; no analytics or advertising.
The app only has Shopify’s Level 1 protected customer data access: it does not request the customer name, email, phone or address fields through the Admin API or in webhooks. The only buyer address data that reaches the app is the shipping address in Shopify’s shipping rate requests (see below): the app uses the country, postcode and house number from it to look up pickup points at MyParcel and stores none of it.
What the app processes without storing it
- Shipping rate requests. When a buyer enters or changes their shipping address at checkout, Shopify sends the app the destination address (which can include the buyer’s name, company, phone number and email address), the cart items, the currency and the checkout language. The app uses only the country, the postcode and a house number taken from the first address line, and sends those three values to MyParcel to find nearby pickup points. The address is not written to the database or to the logs. The resulting list of pickup points is cached in the server’s memory for up to 6 hours under a one-way SHA-256 hash of the store, carrier, country, postcode and house number, so repeated requests do not call MyParcel again.
- New orders (orders/create webhook). The app reads the order’s shipping line code, existing note attributes and order ID to recognise a pickup order, and writes the chosen pickup point onto the order in Shopify as note attributes (pickup_*). Nothing from the order is stored by the app, apart from the time the last pickup order came in (see above). If writing the attributes fails, the error log may contain the order number.
- Fulfillments (fulfillments/create and fulfillments/update webhooks). The app reads the tracking number, tracking URL and order ID, and copies the tracking number and URL onto pickup orders in Shopify as note attributes (pickup_tracking_*). They are not stored by the app.
- Tracking barcode. On the order status page of a pickup order with a tracking number, the buyer’s browser loads a barcode image of that number from the app itself (https://app.pickpick.nl/barcode/). The app draws the image on the fly; it does not store the number, and the request log replaces it with [redacted]. No other party is involved.
- Block check. When the thank-you or order status block shows for a pickup order, the buyer’s browser loads a blank 1-pixel image from the app itself (https://app.pickpick.nl/beacon/). Its address carries only the store’s myshopify.com domain and the block’s version number. Nothing about the order or the buyer is in it; the browser’s IP address reaches the app as with any request, but is not logged or stored. The app stores only the time (see above).
- The pickups screen in the Shopify admin. It reads the store’s 50 most recent orders (order ID, order number, date, note attributes, shipping line title and code) from Shopify to display them, and does not store them. A postcode and house number the merchant types in to search pickup points are sent to MyParcel and not stored.
- Webhook payloads are processed in memory and discarded when the request ends.
Sub-processors and third parties
| Party | What it receives | Why |
|---|---|---|
| Hetzner Online GmbH, Germany (data centre in Nuremberg) | Hosts the server and the database described above. | Hosting. |
| MyParcel (api.myparcel.nl), the Netherlands | Country, postcode and house number of a checkout shipping address, or of a merchant’s search; the merchant’s MyParcel API key. | Finding nearby pickup points. The pickup points themselves belong to the carrier (PostNL, bpost, DPD). |
| Google (Maps Static API), only if the merchant enters a Google Maps key | The buyer’s browser loads a map image of the chosen pickup point’s public address on the order confirmation page; Google receives that address, the merchant’s key and the buyer’s IP address. When the merchant saves a key, the app sends one test request (geocoding “Amsterdam”) with that key. | Showing where the pickup point is. |
The thank-you and order status blocks also load carrier logos from https://app.pickpick.nl/logos/ (or from logo URLs the merchant sets), the order status block loads the tracking barcode from https://app.pickpick.nl/barcode/, and both load a blank check image from https://app.pickpick.nl/beacon/; all are served by the app itself. Shopify itself is the platform the merchant contracted with and is not our sub-processor. We do not sell data and do not share it with anyone else.
Retention and deletion
- Access sessions (tokens) are deleted as soon as Shopify tells the app it was uninstalled (app/uninstalled webhook).
- Shopify sends the shop/redact webhook about 48 hours after uninstall; the app then deletes every row it holds for that store: settings, API keys, payment rules, pickup points, block-check times and sessions.
- Stored pickup points are deleted automatically 180 days after they were last offered at checkout (checked at start-up and daily).
- The in-memory pickup point cache expires after 6 hours, or earlier when the server restarts.
- Server logs. The app’s server writes one line per request (method, path, status, size and duration) and error messages. Secret tokens and tracking numbers in a request path are replaced by [redacted]; the log holds no buyer names, addresses or IP addresses, and the hosting platform’s proxy keeps no access log. Error messages can contain a store domain and, if writing to an order failed, an order number. The log is capped at 30 MB (three files of 10 MB, the oldest deleted first) and deleted entirely when a new version of the app is deployed.
- Backups. There are no automatic backups of the database, and the hosting provider makes no backups or snapshots of the server. Before a risky update we may copy the database file on the same server volume; such copies are deleted automatically 14 days after they were made (checked at start-up and daily). Data deleted from the database is therefore gone from every copy within 14 days.
Buyer data requests
Shopify forwards buyers’ GDPR requests to the app as customers/data_request and customers/redact webhooks. Because the app stores no data about individual buyers (see above), there is nothing to return or erase; the app acknowledges these requests. Data the app wrote onto an order (pickup point and tracking note attributes) lives in the merchant’s Shopify store and is covered by the merchant’s own handling of the request.
Security
- All traffic to and from the app uses HTTPS (TLS).
- Encryption at rest at field level with AES-256-GCM: Shopify access and refresh tokens, staff name and email if ever present, the MyParcel and Google Maps API keys, the token that authenticates Shopify’s rate requests, and stored pickup point data. The key is kept outside the database, in the server’s environment. Tampered values are rejected, never read as valid.
- Webhooks are verified with Shopify’s HMAC signature. Shopify’s rate requests are authenticated with a random per-store token, compared in constant time; the server’s request log replaces that token with [redacted].
- Access to the server and database is limited to the operator.
Roles under the GDPR
For buyer data processed during checkout (country, postcode, house number) and for data written onto orders, the merchant is the controller and OWM is the processor, acting only on the merchant’s instructions as given through the app’s settings. The data processing terms are part of our Terms of Service (https://app.pickpick.nl/terms#dpa). For the merchant’s own account data with us (store domain, settings, contact with us), OWM is the controller.
Merchants should mention the use of pickup point lookups (and of Google Maps, if enabled) in their own privacy policy.
Your rights
Under the GDPR you have the right to access, rectify, erase, restrict and port your personal data and to object to its processing. Buyers should contact the store they ordered from first, as the store is the controller; we will help the store respond. Merchants can contact us at support@pickpick.nl. You can also lodge a complaint with a supervisory authority; in the Netherlands that is the Autoriteit Persoonsgegevens.
Changes
We update this policy when the app’s data processing changes, and change the date at the top. Material changes are announced to merchants before they take effect.
Contact
OWM (OUX Works Merchandising B.V., Dutch Chamber of Commerce (KvK) number 98654896, VAT number NL868586584B01, Rijder 1B10, 1507 DP Zaandam, Netherlands) — support@pickpick.nl