This Privacy Policy ("Policy") explains the information collection, use, and sharing practices of Shop Circle Holdings Ltd (trading as Keystone), One Kingdom Street, Paddington Central, London W2 6BD, United Kingdom ("we," "us," "Keystone" and "our").
Shop Circle Holdings Ltd reserves the right to update this Privacy Policy from time to time. Your continued use of our Services after any such changes constitutes your acceptance of the revised Policy.
Shop Circle Holdings Ltd has designed its applications to be used by merchants ("Store Owners") on the Shopify platform. Unless otherwise stated, references to collecting, using, or disclosing personal information in this Policy describe actions taken by the Store Owner (as the data controller), carried out through the functionality of our applications.
Before you use or submit any information through or in connection with the Services, please carefully review this Privacy Policy. By using any part of the Services, you understand that your information will be collected, used, and disclosed as outlined in this Privacy Policy.
Information We Collect
We collect information in multiple ways, including when you provide information directly to us, and when third parties or automated systems provide information to us.
Information You Provide Directly
Some areas of the Services may require you to submit information in order for you to benefit from the specified features (such as newsletter subscriptions, tips/pointers, or order processing) or to participate in a particular activity. You will be informed what information is required and what information is optional.
Information from Third-Party Sources
We may also obtain information from other sources, such as the Shopify platform, and combine that with information we collect about you. This includes order data, customer data, and store data that merchants share with us through installing and using our applications.
Information Automatically Collected
We automatically collect certain information when you visit the Services. This information includes your IP address, browser type, device type, operating system, referring URLs, and information about the usage of our Services, including information collected through cookies, pixel tags, and other tracking technologies.
We use Google Analytics and Amplitude for web analytics. Google Analytics and Amplitude collect and process data about your use of the Services.
The specific categories of personal data we process through the Keystone applications include: contact information (name, email address, phone number, WhatsApp); order and checkout data (order ID, products ordered, quantities, discounts, taxes, shipping, custom properties); device and usage information (IP address, browser type, device info, session behaviour); location data (country, city, country code); marketing preferences (newsletter opt-ins, campaign data); app usage analytics (feature usage, dashboard interactions); cookie data (session ID, CSRF token, Shopify OAuth); and customer birthdays (date of birth, where provided for loyalty rewards). The specific categories collected depend on which Keystone application(s) the Store Owner uses.
Aggregate/De-Identified Information
We may aggregate and/or de-identify any information collected through the Services so that such information can no longer be linked to you or your device. We may use such information for any purpose, including without limitation for research and marketing purposes, and may also share such data with any third parties.
How We Use Your Information
We use the information we collect for the following purposes:
- To provide, maintain, and improve the Services;
- To communicate with you, including to respond to your comments, questions, and requests;
- To monitor and analyse trends, usage, and activities in connection with our Services;
- To detect, investigate, and prevent fraudulent transactions and other illegal activities;
- To personalise and improve the Services and provide content or features that match your profile and interests;
- For any other purpose for which the information was collected.
How We Share Your Information
We may share your information in the following situations:
- With third-party vendors, consultants, and other service providers who need access to such information to carry out work on our behalf;
- In response to a request for information if we believe disclosure is in accordance with, or required by, any applicable law, regulation, or legal process;
- If we believe your actions are inconsistent with our user agreements or policies, or to protect the rights, property, and safety of us or others;
- In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company;
- With your consent or at your direction.
Third-Party Services and Websites
The Services may contain content from and hyperlinks to websites, locations, platforms, and services operated and owned by third parties. These third parties may use your information in ways that differ from this Privacy Policy. We encourage you to review the privacy policies of these third parties.
Online Analytics
We use third-party web analytics services (such as Google Analytics and Amplitude) on our Services to collect and analyse usage information through cookies and similar technologies. The information is used to analyse the use of the Services, including the frequency with which users visit various parts of the Services and what features they use.
EU and UK Data Subject Rights
If you are located in the European Economic Area ("EEA"), the United Kingdom and other regions with laws governing data collection and use that may differ from laws in the United States, please note that we may transfer information, including personal information, to a country and jurisdiction that does not have the same data protection laws as your jurisdiction. We may transfer your data to the United States, where our application infrastructure operates.
Where we transfer personal data outside the EEA or the United Kingdom, we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and/or the UK International Data Transfer Addendum issued by the ICO under Section 119A of the Data Protection Act 2018. Our primary application data servers are located in Frankfurt, Germany (European Union).
Under certain circumstances, you have rights under data protection laws in relation to your personal data, including the right to:
- Request access to your personal data
- Request correction of your personal data
- Request erasure of your personal data
- Object to processing of your personal data
- Request restriction of processing
- Request transfer of your personal data
- Right to withdraw consent
- Right to lodge a complaint with a supervisory authority (in the UK, the Information Commissioner's Office (ICO); in the EU, the relevant national data protection authority)
If you wish to exercise any of these rights, please contact us at info@key-stone.app.
Data Controller and Processor
For the purposes of applicable data protection law, the Store Owner (merchant) is the data controller in respect of the personal data of their customers that is processed through our applications. Shop Circle Holdings Ltd acts as a data processor on behalf of the Store Owner. In relation to certain analytics, usage data, and account information, Shop Circle Holdings Ltd acts as an independent data controller.
Children's Privacy
Our Services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you become aware that a child has provided us with personal data, please contact us at info@key-stone.app and we will take steps to delete such information.
Right to Complain
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with a supervisory authority. In the United Kingdom, this is the Information Commissioner's Office (ICO) at https://ico.org.uk. In the EU, you may contact your local data protection authority.
Security
We take steps to ensure that your information is treated securely and in accordance with this Privacy Policy. Unfortunately, no system is 100% secure, and we cannot ensure or warrant the security of any information you provide to us. To the fullest extent permitted by applicable law, we do not accept liability for unauthorised access, use, disclosure, or loss of personal information.
Changes
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational, legal, or regulatory reasons. We encourage you to review this Policy periodically.
Governing Law
This Privacy Policy and any disputes arising out of or in connection with it shall be governed by and construed in accordance with the laws of England and Wales. The courts of England and Wales shall have non-exclusive jurisdiction.
Contact
For questions about this Privacy Policy, contact us at info@key-stone.app.