Thinkdigi Oy
Thinkdigi Oy (Business ID 3232935-3), Vähäheikkiläntie 56 C 5, 20810 Turku, Finland. Contact: support@thinkdigi.fi
Privacy Policy – TD B2B Business Portal.
Last updated: November 5, 2026. Suomeksi: Tietosuojaseloste.
Controller and processor
For merchant (shop) account data, Thinkdigi Oy is the controller. For data about a merchant's B2B customers and their staff, the merchant is the controller and Thinkdigi Oy is the processor. We process that data only on the merchant's instructions, as set out in the Shopify Partner Program Agreement and the Shopify API Terms.
Data we process
| Category | Examples | Source |
|---|---|---|
| Shop data | shop domain, encrypted access tokens, settings, enabled modules, subscription status | Shopify |
| Company data | company name, Business ID, address, business line, registry status | Merchant, buyer, PRH/YTJ open data API |
| E-invoice details | e-invoice address (OVT), operator | Buyer or merchant |
| Contacts and staff | name, work email, role, cost centre, Shopify customer/contact ID | Buyer, merchant, Shopify B2B |
| Brand assets | logos, brand colours, print placements, proofs | Buyer or merchant uploads |
| Orders | order IDs and line references needed for print jobs | Shopify orders/create |
| Verification | hashed one-time email codes, hashed session tokens, short-lived strong-ID attempts | Generated by us |
| Email logs | recipient, delivery status, message ID | Resend |
We do not ask for personal identity numbers, payment card data or customer phone numbers.
Purposes and legal bases (GDPR art. 6)
- Providing the app under the contract with the merchant (6(1)(b)).
- Registering B2B buyers and checking their companies against public registers, as the processor on the merchant's behalf.
- Security, fraud prevention and keeping logs (6(1)(f)).
- Billing through Shopify Billing API (6(1)(b)). Shopify handles payment.
- Meeting legal obligations, such as accounting (6(1)(c)).
Sub-processors and transfers
| Provider | Purpose | Location |
|---|---|---|
| Shopify Inc. / Shopify International Ltd | Platform, billing | IE / CA |
| Cloudflare, Inc. (Workers, D1, R2) | Hosting, database, file storage | United States, global network: processing may take place outside the EU. The transfer basis is the EU–US Data Privacy Framework and the Standard Contractual Clauses in Cloudflare's data processing addendum. |
| Resend (Plus Five Five, Inc.) | Transactional email | US |
| PRH / YTJ open data API | Company lookup (public data, no personal data sent) | FI |
| Strong-ID broker | Strong identification | Not in use |
| AI provider | AI features | Not in use |
Transfers outside the EEA rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
Retention
Print job files are kept 30 days by default (the merchant can configure this). Customer data is deleted when a customers/redact request arrives. All shop data is deleted on shop/redact, 48 hours after uninstall.
Rights of data subjects
Buyers should contact the merchant, who is the controller. We help merchants answer requests through Shopify's customers/data_request and customers/redact webhooks and the export in Settings. Merchants can contact support@thinkdigi.fi. You can also lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).
Security
Data is encrypted in transit (TLS). Shop access tokens are encrypted at rest, and session tokens and email codes are stored only as hashes. Webhooks and OAuth calls are verified with HMAC, download links are signed, and access is scoped per shop.
Changes
We will announce material changes in the app and by email to the merchant's contact.