Nordtrack is provided by:
Christian Kistenmacher, Nordtrack
Jakobstraße 6
68623 Lampertheim, Germany
Email: support@nordtrack.de
This policy describes how personal data is processed when you visit our information pages, contact us or use the Nordtrack Shopify app.
We are responsible for managing our customer relationships, handling support requests and operating our own information pages.
Where Nordtrack processes store visitor and order data for a merchant, it does so on that merchant's behalf. The merchant determines how the app is used and is the point of contact for data processing in their store. Processing on behalf of the merchant is governed by a separate data processing agreement under Article 28 GDPR, which applies upon installation of the app. The agreement is available through the corresponding notice in the App Store listing and within the app.
OpenAI and Shopify also process data under the terms applicable to their respective services. This policy does not replace the privacy notices of the merchant or these providers.
This privacy policy and our other information pages are served through the same Render service that runs the app (see Section 7 on Render). The domain nordtrack.de redirects to these pages through domain forwarding at united-domains. united-domains does not host any content itself and does not process data from the page visit beyond what is technically necessary for the redirect.
When a page is requested, Render processes connection data that is technically necessary, particularly the IP address and requested URL. This serves to deliver, troubleshoot and secure the service. The legal basis is our legitimate interest in secure operation under Article 6(1)(f) GDPR.
These general technical access logs are not stored permanently. They are automatically deleted or overwritten after a short period and are used exclusively for short-term troubleshooting and security, not for ongoing analysis.
If you contact us by email, we process your email address, the contents of your message and any additional information you provide to handle your request. For contract-related enquiries, this processing is necessary to perform the contract or take steps prior to entering into a contract. For other enquiries, it is based on our interest in responding to them.
We are legally required to retain contract-related correspondence (commercial correspondence within the meaning of Section 257 of the German Commercial Code, HGB, such as correspondence concerning the conclusion, amendment or termination of an app contract) for six years, after which we delete it. Support requests unrelated to a contract are deleted earlier, once the request has been resolved and no further enquiries are expected, and no later than after 12 months.
Email services are provided by united-domains AG, Gautinger Str. 10, 82319 Starnberg, under the "Mail M" package.
We do not use analytics or advertising trackers on these information pages. The app stores the user's selected interface language in local browser storage.
To provide Nordtrack, we process the store domain, app settings, connection and processing statuses, and plan and subscription information. We also process Shopify access and session data. Depending on the session provided by Shopify, this may include a user ID, name, email address, language and account role.
OpenAI API keys and SFTP passwords supplied by the merchant are stored in encrypted form. For product feeds, Nordtrack processes catalogue data such as product and variant IDs, titles, descriptions, prices, availability, image and product URLs, and merchant information about the target country and returns.
When the performance features are used, the app retrieves advertising account and campaign reports, including campaign IDs and names, statuses, spend, clicks and impressions. This information is displayed to the authorised merchant and analysed alongside the results available in Nordtrack.
This processing serves to provide the agreed features and manage the app contract. App subscription payments are handled through Shopify; Nordtrack does not ask you to enter credit card details.
The legal basis is Article 6(1)(b) GDPR where the person acting is themselves a party to the contract or clearly installs and operates the app on that party's behalf. Where the merchant's employees instead operate the app on behalf of the contracting party, we base the processing of their session data on our legitimate interest in performing our contract with the merchant under Article 6(1)(f) GDPR.
Nordtrack can process page views, product views, additions to the cart, checkout starts and purchases. Depending on the event, event data includes:
The pseudonymous visitor ID is derived from the Shopify visitor ID and the store domain using a secret key. It does not contain a real name, but it allows events to be associated with each other and may be linked to orders. It is therefore not automatically anonymous data.
Regular tracking records do not contain separate fields for customer names, email addresses, shipping addresses, telephone numbers or IP addresses. However, connection data still arises during technical communications. Privacy requests submitted by Shopify may also contain identity and contact information, which is processed separately. Page paths may contain information even after their query parameters have been removed.
To verify a purchase, Nordtrack reads the corresponding order from Shopify. This allows order amounts, currency and items to be checked against the browser event and helps avoid duplicate purchase reports.
Nordtrack uses the privacy settings reported by Shopify. The current pixel extension processes tracking events only when Shopify reports the required permissions for marketing, analytics and the setting labelled "sale of data". The latter is a technical Shopify status and does not mean that we sell data for money.
The merchant provides the required information and consent options in the store. Nordtrack does not provide its own store consent banner. In particular, consent is required for access to information on end-user devices under Section 25(1) TDDDG and for processing for marketing purposes, in each case before the relevant events are transmitted to OpenAI.
When transmission is enabled, Nordtrack sends the event ID, event type, timestamp, cleaned source URL, advertising click reference where available, and product and value information to OpenAI. The internal pseudonymous visitor ID is not included in the current conversion payload. The purchase event ID contains the order ID. Product feeds are transmitted according to the merchant's configuration.
Validation mode also transmits event data to OpenAI. It is not a purely local test mode.
When the integration reports a withdrawal of consent, the pixel extension stops further tracking transmissions. Nordtrack removes associated older events and click attributions and temporarily stores a withdrawal record to reject delayed events. Transmissions that have already been sent cannot technically be recalled; deletion by recipients must be handled separately.
| Provider | Purpose and data involved |
|---|---|
| Render | Hosting and the app's live database, as well as these information and privacy pages. The current service is configured in Frankfurt. |
| GitHub | Private project and encrypted database backups. Backup archives are encrypted before transmission. |
| Shopify | Store platform, app authentication, required store and order data, privacy notifications and app billing. |
| OpenAI | Receipt of conversion data and product feeds, and provision of advertising account and campaign reports according to the connected features. Data is transmitted at the merchant's instruction to their own OpenAI advertising account. In this respect, OpenAI is not our subprocessor but processes the data under its own agreement with the merchant. |
| united-domains | Domain management (nordtrack.de), with forwarding to the pages hosted by Render, and email communications, particularly support. No separate web hosting. |
A server location in Frankfurt does not mean that all service providers, subprocessors or support access are located exclusively within the EU.
Basis for transfers to third countries (research as of September 2026 — not legal advice; confirm with the providers before publication):
Current information on the applicable transfer mechanisms is available from the providers listed above.
| Data | Current handling in Nordtrack |
|---|---|
| Individual tracking events | Automatically deleted when the retention period selected by the merchant in the app expires (default: 30 days). The app offers several retention periods to choose from. |
| Advertising click attribution | Automatically expires after the attribution window selected by the merchant (default: 7 days). The app offers several attribution windows to choose from. |
| Consent withdrawal record | Automatically removed, currently after seven days. |
| Privacy requests | Contact details and request contents are retained until completion or applicable deletion; the contents are removed upon completion. The completion record is removed after 30 days. Open requests do not expire automatically. |
| Aggregated revenue figures | Date, store, currency, count and amount, without visitor, order or product IDs. These remain available for historical reporting beyond the event retention period. |
| Settings, credentials, catalogue and other store data | Retained to operate the installed app. When an uninstall or store deletion notification is successfully processed, the associated data is removed from the app's live database. |
| GitHub backup archives | Daily encrypted backups; retention is currently set to seven days. Data that has already been deleted may remain in older backups until they expire. |
In addition to the periods listed in this table, technical operations at Render may create further short-lived backup copies. These are also automatically deleted as part of normal operating procedures. The event retention period does not trigger automatic deletion by OpenAI or other recipients that process data independently.
Shopify may forward a merchant's privacy requests to Nordtrack. For an access request, the app provides only events relating to the orders identified by Shopify for that store. A browser ID is not treated as proof that all browser events belong to the same person.
For a corresponding deletion request, the specified order events, associated browser events without an order, and click attributions are removed. Other orders are retained, even if they originated on the same device. Please initially direct enquiries about your purchase to the relevant merchant, who will also coordinate any necessary action with other recipients.
Subject to the applicable legal requirements, you may request access, rectification, erasure, restriction of processing and data portability. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation; a specific right to object applies to direct marketing. You may withdraw consent with effect for the future.
You may lodge a complaint with a data protection supervisory authority, particularly in the place where you live or work or where the alleged infringement occurred. The authority responsible for us is:
The Hessian Commissioner for Data Protection and Freedom of Information (HBDI)
Gustav-Stresemann-Ring 1, 65189 Wiesbaden
Telephone: 0611 1408-0
Email: poststelle@datenschutz.hessen.de
https://datenschutz.hessen.de
If you have any questions, you can contact us at support@nordtrack.de.
We update this policy when the processing activities described in it change. The currently published version applies.
Published version dated: 20 September 2026