Privacy Policy

KID og EHF · Last updated 14 October 2026

This policy explains what personal data the Shopify app KID og EHF (“the app”) processes, why, for how long, and what rights you have. The app generates Norwegian KID payment references and invoices (PDF and EHF/Peppol) for Shopify merchants.

1. Who is responsible

For data about merchants (the shops that install the app), we are the data controller. For data about the merchant’s customers, the merchant is the data controller and we act as the merchant’s data processor under our Data Processing Agreement.

2. What data we process

About merchants

• Shop domain and the access token Shopify issues to the app.
• Settings the merchant enters: company name, organisation number, address, bank account number, invoice email, VAT status, payment terms and KID format.

About the merchant’s customers (on the merchant’s behalf)

• Order and draft order identifiers, order numbers, line items and amounts.
• KID numbers assigned to orders.
• On invoices: the buyer’s company name, organisation number, billing address, and, if present, an email address and a contact person/reference.

We do not process payment card data, passwords, or special categories of personal data. We only request the Shopify access scopes needed for these features (orders, draft orders and customers).

3. Why we process it

• To generate and store KID numbers and show them on orders and invoices.
• To create invoices as PDF and EHF 3.0 (Peppol BIS Billing 3.0) files, and, when the merchant enables it, to deliver them through a Peppol access point.
• To provide support and keep the service secure.

We use the data only for these purposes. We do not sell personal data, do not use it for marketing or advertising, do not build profiles, and do not make automated decisions with legal or similarly significant effects.

Legal basis: for merchant data, performance of our contract with the merchant (GDPR art. 6(1)(b)). For customer data, we process only on the merchant’s documented instructions (GDPR art. 28).

4. Who we share data with

Data is stored in the EU/EEA.

5. How long we keep data

• Invoices are kept until the end of the fifth year after the year they were issued, in line with bookkeeping retention rules (Norwegian bokføringsloven § 13, Swedish bokföringslagen ch. 7), and then deleted automatically.
• When Shopify notifies us that a customer’s data must be erased, we remove the customer’s email and contact person from stored invoices and delete any other data linked to that customer. The invoice itself (company details, amounts, KID) is kept because the law requires it to be retained.
• When a merchant uninstalls the app, Shopify asks us 48 hours later to erase the shop’s data, and we then delete all data for that shop: settings, KID records, invoices and logs.
• A minimal log of privacy requests (request type, date, Shopify customer ID and affected invoice numbers – no names or emails) is kept as evidence that the request was handled, and deleted together with the shop’s data.
• An access log records who viewed, created, downloaded or sent invoices and when (Shopify staff ID, action and invoice number – no names or emails). Entries are deleted after 365 days, or with the shop’s data.

6. Security

• All traffic to the app uses HTTPS, and the app requires an encrypted (TLS) connection to its database.
• Data is encrypted at rest by the hosting provider at the storage level.
• Access to production data is limited to the service provider named above and is used only for operating and supporting the service.
• Access to invoices containing customer data is logged, and merchants can review the log in the app.
• We notify affected merchants without undue delay if a personal data breach occurs, and no later than 48 hours after becoming aware of it, following our Security Incident Policy.

7. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and object to processing, and to data portability. If you are a customer of a shop, contact that shop first – it is the controller of your data, and we help the shop respond (Shopify forwards such requests to us automatically). If you are a merchant, contact us at igorkazazic1989@gmail.com. We respond within one month.

You can complain to a supervisory authority, for example the Swedish Authority for Privacy Protection (IMY, imy.se) or the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no).

8. Changes

We will update this page if our processing changes and, for material changes, notify merchants in the app or by email before the change takes effect.