Privacy & Data Protection Policy

Version 1.0 — Effective 9 October 2026 · Reviewed and updated at least annually
This policy is written in English as the operating language for partner compliance reviews; it implements the EU General Data Protection Regulation (GDPR).

1. Data controller

Zephir Solutions (operator: Laura Gioia), France — contact: info@zephir.solutions. The controller determines the purposes and means of processing personal data for the services it operates.

2. Data location

All production data is physically stored and processed on self-hosted infrastructure located in France (European Union). Supporting services (DNS, transactional email, version control) are provided by EU-based or GDPR-compliant providers; no production personal data is transferred to, or stored in, third countries outside the EU/EEA.

3. Data we process

• Seller data received through authorised TikTok Shop API scopes (shop identifiers, product, inventory, order and event data strictly limited to the scopes approved by the seller).
• Operational data necessary to provide the service (webhook delivery records, minimal logs with a short retention window).

We apply data minimisation: only the fields required for the subscribed event types and features are stored.

4. Purpose and legal basis

• Purpose: operating inventory and catalogue synchronisation between the seller's InvenTree stock system and TikTok Shop, on the basis of the seller's explicit authorisation (OAuth consent) and the partnership agreement.
• Legal basis: performance of a contract / legitimate interest in providing the integration service; consent where required.

5. User rights — assistance to sellers and TikTok Shop

We will assist sellers and TikTok Shop, without undue delay, with requests from end users to access, update, delete, or obtain their personal data processed through our systems. Requests can be sent to info@zephir.solutions and are handled within the GDPR deadlines (one month, extendable where lawful).

6. Retention and deletion

• Personal data is kept only for as long as the seller authorisation is active and the service is operating.
• At the end of the contractual relationship, all collected customer data in our possession is deleted, including cached tokens, event payloads and derived records, within 30 days, except where a longer retention is required by law.
• Operational logs are rotated automatically after a short retention window (days, not months).

7. Security measures

Processing is protected according to our published Information Security Policy: encryption in transit (TLS 1.2+), private-network isolation of services, key-only administrative access, multi-factor authentication, secrets kept out of version control, automatic security updates, and intrusion prevention.

8. Sub-processors

Production personal data is not passed to sub-processors. Infrastructure providers used for adjacent services (DNS, email relay, code hosting) are GDPR-compliant and process only the minimal metadata their service requires (e.g. an email address to deliver a message).

9. Data Protection Officer

As a micro-enterprise whose core activities do not consist of large-scale systematic monitoring or processing of special categories of data, Zephir Solutions is not required to appoint a DPO under GDPR Article 37. Data protection questions are handled directly by the controller at info@zephir.solutions.

10. Breach notification

We maintain a notification process to alert TikTok Shop and affected sellers without undue delay upon confirming a suspected or identified data breach involving their data, in line with GDPR Article 33/34 and platform requirements.

11. Complaints and supervisory authority

Data subjects may lodge a complaint with the French supervisory authority: CNIL, 3 Place de Fontenoy, 75007 Paris, France — www.cnil.fr.