Privacy policy
This policy explains what personal data B2B Desk collects, why, who we share it with, how long we keep it and what rights you have. It covers the B2B Desk app for Shopify, including its storefront blocks and hosted application pages, and this website.
Who we are
B2B Desk is made by EvoLabs, a sole proprietorship (preduzetnik) registered in the Republic of Serbia (“EvoLabs”, “we” or “us”).
For anything about this policy or your data, email djordje42@gmail.com.
We follow the Serbian Law on Personal Data Protection and, where it applies to us, the EU and UK General Data Protection Regulation (GDPR).
Our role
We’re the controller of personal data about merchants who install B2B Desk and their staff, people who contact us, and visitors to this website. We decide how and why that data is used.
We’re a processor of personal data about a merchant’s customers: people who apply for a wholesale account, and B2B buyers who use the Order Pad. The merchant is the controller of that data. We process it only to provide B2B Desk to the merchant, following the merchant’s settings and instructions.
If you applied for a wholesale account with a store, or buy from a store that uses B2B Desk, that store’s privacy policy applies to you, and the store is the best place to send requests about your data. If you contact us instead, we’ll pass your request on to the store or tell you how to reach it.
Data we collect
About merchants
When you install B2B Desk, you approve the store data it can access on Shopify’s install screen. B2B Desk reads and changes only what its features need: companies, company locations and contacts, customers, catalogs, B2B markets, products and prices, payment terms, files, and the date of each company location’s latest order. You need to approve this access to use B2B Desk.
Our database stores:
- Store details from Shopify: your store’s myshopify.com address, name, contact email, time zone, currency and Shopify plan.
- The access token Shopify gives B2B Desk, so it can work in the background, for example to finish an approval.
- App preferences, such as tips you’ve dismissed.
- Usage counts, such as how many applications were submitted each month. These are totals, not records about people.
- Records of bulk changes on the Catalogs page, so they can be undone. These hold Shopify IDs and settings, not personal data.
Your Shopify store holds, as data that belongs to B2B Desk:
- Your settings, approval presets, auto-approve rules and email templates.
- The staff email addresses, Slack webhook and webhook URL you set up for notifications.
- The Shopify ID of the staff member who approved or declined each application.
If you contact us, we get your name, your email address and what you write.
About your customers
When someone applies for a wholesale account, through the form on your store or the hosted application page, B2B Desk collects for you:
- The company name, and the contact’s name, email address and phone number.
- Billing and shipping addresses.
- Tax ID, website and expected order volume.
- Answers to your own questions, and documents they upload, such as a resale certificate.
- The application’s status and history, including requests for more information and the reason for a decline.
Applicants need to fill in the fields your form marks as required to apply.
When you approve an application, B2B Desk uses these details to create the company, location and contact in your Shopify store, and saves application details such as the tax ID and answers on the company.
When a B2B buyer uses the Order Pad, B2B Desk receives their Shopify customer ID, looks up the products they paste or upload, and stores the order lists they save: a name, their company location, products and quantities.
All of this is stored in your Shopify store, not in our database. Our servers handle it only while doing something with it, such as saving an application or sending an email.
Collected automatically
- Server logs. Our servers log each request: IP address, browser user agent, the address requested, the time, the result and any error. Our logging removes fields like email addresses, phone numbers, street addresses and access tokens.
- Spam and abuse limits. We count requests per IP address, email address or customer to stop spam and abuse. We store only a scrambled (hashed) form of these and delete it within 2 days.
- Bot checks. Application forms can use Cloudflare Turnstile to check that a person, not a bot, is sending them. Turnstile receives the visitor’s IP address and information about their browser and device.
On this website
This website doesn’t use cookies, analytics or advertising trackers, and its fonts load from our own server. Help center search runs in your browser. Like any website, the servers that deliver it receive your IP address and the pages you ask for, and may keep short-term logs for security.
How we use data, and why
Data protection law requires a legal basis for each use of personal data. Article 12 of the Serbian Law on Personal Data Protection and Article 6 of the GDPR list the same bases.
| What we do | Legal basis |
|---|---|
| Run B2B Desk for merchants: connect to your store, run the features you use, send the emails and alerts you set up | Our contract with you |
| Process your customers’ and applicants’ data | Your instructions as the merchant. You choose the legal basis. |
| Keep B2B Desk secure, stop spam and abuse, and fix problems, using logs, limits and bot checks | Our legitimate interest in a secure, working service |
| Count usage to see how features are used | Our legitimate interest in improving B2B Desk |
| Answer your messages | Our legitimate interest in helping you, or our contract with you |
| Handle privacy requests from Shopify and answer lawful requests from authorities | Our legal obligations |
We don’t sell personal data, use it for advertising or profiling, track you across other websites or use it to train AI models. We never use your customers’ data for anything except providing B2B Desk to you.
Automatic decisions
Merchants can set auto-approve rules that approve an application, decline it or send it to a reviewer, based on criteria the merchant picks, such as email domain, country or expected volume. The merchant decides whether to use rules and what they do. If a store’s rule declined your application, you can ask the store to have a person review it.
Who we share data with
We use these service providers. They process data only for us and under data protection terms.
| Provider | What it does | Data | Where |
|---|---|---|---|
| Railway (Railway Corporation) | Hosts our servers, database and logs | Everything our servers process and store | EU (Netherlands). Logs are stored in the United States. |
| Plunk | Sends applicant emails and staff notifications | Each recipient’s email address and the email | EU (Germany). Delivery may pass through other countries. |
| Cloudflare (Cloudflare, Inc.) | Turnstile bot checks on application forms | IP address and information about the browser and device | United States and worldwide |
B2B Desk also sends data to:
- Shopify. B2B Desk runs on Shopify and keeps applications and other app data in your Shopify store. Shopify’s privacy policy covers how Shopify handles it.
- Places you choose. Staff notification emails go to the addresses you enter. If you connect Slack or a webhook, B2B Desk posts new-application alerts there with the company name and a link to the application. If you use the Shopify Flow triggers, B2B Desk passes the company name, the contact’s name and email, the country, the application’s source, Shopify IDs and any decline reason to Flow.
- Authorities, when the law requires it. We may disclose data to comply with the law, a court order or a lawful request from authorities, or to protect the rights and safety of our users, the public or us.
- A new owner. If EvoLabs sells or transfers B2B Desk, data may pass to the new owner, who must keep protecting it as this policy describes.
International transfers
EvoLabs is in Serbia. Our servers, database and email provider are in the European Union. Some data goes to the United States: Railway is a US company and stores our server logs there, and Cloudflare runs Turnstile bot checks worldwide. When personal data goes to a country without an adequacy decision, we rely on safeguards such as the standard contractual clauses in our providers’ data processing agreements, or the EU-U.S. Data Privacy Framework where a provider is certified. Email us for a copy of these safeguards.
How long we keep data
| Data | How long |
|---|---|
| Store details and bulk change records | While B2B Desk is installed. Deleted 48 hours after you uninstall, when Shopify asks us to erase your store’s data. |
| Access token | Until you uninstall |
| Usage counts | 13 months, or until you uninstall |
| Hashed IP addresses and emails used for spam limits | Up to 2 days |
| Server logs and background job records | Up to 30 days |
| Applications and their documents, in your store | Approved, declined and spam applications are deleted 12 months after the decision, with their documents. Open applications are kept until they’re decided or deleted. |
| Saved order lists, in your store | Until the buyer deletes them or you uninstall |
| Emails sent through Plunk | As long as Plunk needs them to deliver emails and investigate delivery problems |
| Messages you send us | As long as we need them to help you and keep a record of the conversation |
Deleted data can stay in our database backups for up to 3 months, until they’re overwritten.
When you uninstall B2B Desk, we delete the access token right away, and the rest of your store’s data in our database 48 hours later. B2B Desk’s app data in your store, including applications, saved order lists and settings, is deleted with the app. The companies, contacts, catalogs and payment terms B2B Desk created stay in your store, and so do uploaded documents, which are in your Files. Export your applications first if you want a copy.
Privacy requests through Shopify. When a customer asks a store to erase their data, Shopify tells B2B Desk, and B2B Desk deletes their applications, uploaded documents and saved order lists. When a customer asks a store for a copy of their data, the store can export their applications from B2B Desk as a CSV file and find their documents in its Files.
How we protect data
- All connections to B2B Desk and this website are encrypted (HTTPS).
- Your customers’ contact details and documents stay in your Shopify store, not in our database.
- B2B Desk checks Shopify’s signature on webhooks and on requests from your storefront.
- Links that let applicants send more information expire after 14 days.
- Only EvoLabs can access our systems, using strong, unique passwords and two-factor authentication wherever the service offers it.
No system is perfectly secure. If a breach affects your data, we’ll tell you, and the authorities where the law requires, without undue delay.
Cookies and browser storage
- This website doesn’t use cookies or browser storage.
- In your Shopify admin, B2B Desk signs you in with Shopify session tokens, not cookies.
- The hosted application page sets one cookie that protects the form against forged submissions. It holds a random value and expires after 2 hours.
- On your storefront, the wholesale bar remembers that a visitor closed it, in the browser’s session storage, until they close the tab. If application forms use Cloudflare Turnstile, Cloudflare’s privacy policy covers it.
These are needed for features visitors use, so they don’t require consent.
Your rights
Depending on where you live, you can ask us to:
- Give you a copy of your personal data.
- Correct it if it’s wrong.
- Delete it.
- Limit how we use it.
- Send it to you or another company in a machine-readable format.
- Stop using it where we rely on our legitimate interests.
You also have the right not to be subject to a decision based only on automated processing that significantly affects you.
To make a request, email djordje42@gmail.com. We’ll reply within 30 days, and may ask you to confirm your identity first. Requests are free. If we handle your data for a store, we’ll pass your request to the store and help it respond.
You can complain to Serbia’s Commissioner for Information of Public Importance and Personal Data Protection, or to the data protection authority where you live or work. We’d appreciate the chance to fix the problem first.
US state privacy rights
If you live in California or another US state with a consumer privacy law, you can ask to know what personal information we collect and how we use and disclose it, and ask us to correct or delete it. We don’t sell personal information or share it for targeted advertising. We won’t treat you differently for using your rights. You can make a request through an authorized agent, and we may ask them to show they’re authorized.
Children
B2B Desk is a tool for businesses and isn’t meant for children. We don’t knowingly collect personal data from anyone under 16. If you think a child has given us personal data, email us and we’ll delete it.
Changes to this policy
We’ll post changes on this page and update the date at the top. If a change significantly affects how we handle your data, we’ll tell merchants by email or in B2B Desk before it takes effect.
Contact us
EvoLabs, Republic of Serbia. Email djordje42@gmail.com.