CashGear Shipping data processing terms

1. Parties

Cash Gear, Ismailia, Egypt ("Cash Gear", "we"); the owner of the Shopify store that installs CashGear Shipping ("the merchant"); and the merchant's shipping company that uses Cash Gear ERP and gave the merchant the invite code ("the shipping company").

2. Roles

The merchant controls its customers' personal data and shares what is needed for delivery with its shipping company under their own agreement. Cash Gear processes that data only on the instructions of the merchant and the shipping company, to provide the service in these terms.

3. The service

The app sends the merchant's orders to the shipping company, and sends the fulfillment, tracking number and delivery status back to the merchant's store in Shopify.

4. Data processed

For orders to be shipped: the receiver's name, phone numbers and shipping address; the order number, items and quantities, order note, weight, amount due on delivery and shipping method; and the store's Shopify address and access token. We do not process customers' email addresses or payment card data.

5. Purpose

Only to create, deliver and settle shipments, collect cash on delivery, and update the order in Shopify. No marketing, no sale, no sharing with third parties other than the hosting providers in section 8, and no automated decisions about customers.

6. Confidentiality and access

Only the shipping company's staff who handle shipments, the courier assigned to a parcel, and Cash Gear's support staff when needed can see the data. Everyone with access is bound to keep it confidential.

7. Security

Data is encrypted in transit (TLS) and the store's access token is stored encrypted (AES-256). Access in Cash Gear ERP is role-based, merchants and couriers see only their own shipments, staff passwords are at least 12 characters with account lockout after repeated failed sign-ins, data is backed up nightly, and we follow a written incident response policy.

8. Hosting providers

Servers and backups are hosted by the providers listed in our Privacy Policy (section 3.1). We will tell the shipping company before adding or replacing one.

9. Retention and deletion

Receivers' data is kept while a shipment is active and until it is settled, then erased after the period the shipping company sets, unless the law requires longer. When the merchant uninstalls the app, our access to the store ends at once. When Shopify asks us to erase a customer's or a store's data, we erase it, except what an unfinished shipment or the law requires us to keep. Backups age out within 30 days.

10. Customers' requests

We help the merchant answer customers' requests to see or erase their data, within 30 days of Shopify forwarding them.

11. Security incidents

We tell the shipping company within 24 hours of confirming a security incident affecting this data, tell the merchant directly or through the shipping company, and notify Shopify and the authorities where required.

12. Ending

The merchant can stop at any time by uninstalling the app; the shipping company can disconnect the store. Sections 9 to 11 continue to apply afterwards.

13. Law and contact

These terms are governed by Egyptian law, including the Personal Data Protection Law No. 151 of 2020. Contact: info@cashgearerp.com