Privacy policy · LG Desistimiento UE

Last updated: 10 September 2026

This policy explains which personal data the LG Desistimiento UE app for Shopify (the “app”) processes, for which purpose and for how long. The app lets a store’s customers exercise their right of withdrawal through a form, records every declaration and sends an acknowledgement of receipt by email.

1. Controller and processor

Controller: the merchant (the Shopify store that installs the app), who decides to process their own customers’ data and determines the purpose of the processing.

Processor: the app developer, who processes the data on behalf of the merchant and solely to provide the service:

2. Data processed by the app

Data provided by the customer in the form

• First name and last name.
• Email address.
• Order number or reference.
• Selected order items, in the case of a partial withdrawal.
• An optional comment written by the customer.

Store data the app accesses

The app requests the following Shopify permissions and uses them exclusively as described:

• read_orders: find the order by number and email address and read its line items (products and images) in order to show them in the form and match the request to the order.
• read_products: read product tags and collections in order to flag items that are not eligible for withdrawal.
• read_content: list the store’s pages so the merchant can select their policy or privacy page.

Technical data

• Customer language, and the date and time of the declaration.
• Anti-spam flags (submission rate limit and, if the merchant enables it, Cloudflare Turnstile verification).

The app does not use tracking or advertising cookies and does not profile customers.

3. Purpose and legal basis

The data is processed to enable and record the exercise of the right of withdrawal set out in Directive (EU) 2011/83 and Directive (EU) 2023/2673, to send the customer the acknowledgement of receipt on a durable medium and to notify the merchant of the request.

The legal basis is compliance with the merchant’s legal obligations and the performance of the contract with the customer.

4. Storage and security

• The customer’s first name, last name and email address are stored encrypted with AES-256-GCM.
• The email address is additionally indexed with a non-reversible HMAC-SHA256 hash, so requests can be searched and erasure requests handled without decrypting the value.
• Credentials configured by the merchant (their SMTP password and their Turnstile secret key) are also stored encrypted, never in plain text.
• All traffic between the store, the app and Shopify is encrypted over TLS/HTTPS, and form submissions are validated with Shopify’s App Proxy HMAC signature.

5. Recipients and sub-processors

• Shopify: the platform the store runs on and the source of the order data.
• SMTP email provider: used to send the acknowledgement to the customer and the notification to the merchant. By default the developer’s mail server is used; merchants on the Plus plan can configure their own SMTP server, in which case delivery goes through their provider.
• Cloudflare Turnstile: only if the merchant enables this verification. When the widget is verified, the verification token and, where applicable, the visitor’s IP address are sent to Cloudflare.

Personal data is never sold or shared with third parties for commercial purposes, and it is not used to train artificial intelligence models.

6. Retention

Requests are retained for as long as the merchant needs them to evidence how the withdrawal was handled, and at most until the merchant deletes them from the app’s dashboard, until an erasure request is received, or until the app is uninstalled from the store. On uninstall, Shopify notifies the app and the data belonging to that store is deleted.

7. Data subject rights

Anyone may exercise their rights of access, rectification, erasure, restriction, portability and objection. Because the controller is the merchant, the primary route is to contact the store where the order was placed. The app implements Shopify’s mandatory compliance webhooks so the merchant can respond:

• customers/data_request: the data stored about the requesting customer is provided to the merchant.
• customers/redact: requests belonging to that customer are deleted.
• shop/redact: all data belonging to the store is deleted.

You may also write directly to soporte@lineagrafica.es or to the data protection officer at dpo@lbo-abogados.com. If you believe your rights have not been respected, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with your local supervisory authority.

8. International transfers

The app is hosted in the European Union. Shopify and Cloudflare may process data outside the European Economic Area on the basis of the European Commission’s standard contractual clauses and their own additional safeguards.

9. Changes to this policy

If the processing changes, this page will be updated and the date at the top amended. Previous versions can be requested from the support address.