Merchant data terms

A development-store test acceptance records a rehearsal. These terms take effect when the merchant accepts this version through the live acceptance flow.

Parties and processing instructions

The Shopify merchant is the controller of buyer data it enters in BoothPad. Cengiz Mert Türkmen, a sole proprietor operating as CodEven in Türkiye, processes this data on the merchant’s documented instructions. These terms and the connected actions initiated by authorized users document those instructions. CodEven will inform the merchant if it believes an instruction violates applicable data protection law.

BoothPad captures wholesale order requests, checks product prices and availability, and creates unpaid Shopify drafts on request. Processing may include buyer labels, optional references and notes, product lines, store identifiers, and authorization and transfer metadata. The people concerned are merchant staff and buyers or their representatives. CodEven handles its own billing and support administration separately where it determines the purposes of that processing.

Confidentiality and security

CodEven restricts access to authorized personnel under confidentiality obligations and uses access controls, encrypted device storage, HTTPS and encryption of hosted Shopify session tokens. The merchant controls access to its devices and explicit CSV and JSON downloads. Avoid unnecessary personal data in order notes and store exported files securely.

Providers and transfers

The merchant authorizes Hostinger to provide VPS hosting and recovery services. CodEven will give the merchant notice of changes to its subprocessors and an opportunity to object, and will impose equivalent data protection obligations and remain responsible for their performance. BoothPad sends connected order operations to Shopify at the merchant’s instruction. CodEven will use the applicable safeguards where the processing involves a regulated international transfer.

Retention and deletion

These terms apply for as long as CodEven processes merchant data. Offline connection links expire after two minutes, OAuth states after ten minutes, review approvals after five minutes, and standalone sessions after at most twelve hours. The live service checks for expired records every minute. Technical transfer and purchase records support duplicate prevention and pass verification while the store is connected. BoothPad records the accepted version, time and a pseudonymous signer identifier.

At the merchant’s choice, CodEven will return or delete personal data it controls at the end of the service and delete copies unless applicable law requires retention. Verified Shopify uninstall or shop-deletion notices remove shop-linked records from the live database. Hostinger’s weekly backup rotation retains the two most recent weekly copies. The merchant manages local device copies, exported files and drafts in Shopify.

Requests, incidents and audits

CodEven assists the merchant, taking into account the nature of the processing and information available, with data subject requests, security and breach obligations, impact assessments, and regulator consultations. CodEven will notify the merchant without undue delay after becoming aware of a personal data breach affecting merchant data. CodEven will provide the information needed to demonstrate compliance with these terms and cooperate with reasonable audits, including inspections.

For requests, notices or a copy of the acceptance record, contact codeven@codeven.io. Include the store domain and request type.