Privacy Policy

1. Who we are

Rommerce OS is a multi-channel commerce operations platform: a merchant connects webshops, marketplaces, couriers and invoicing providers, and manages products, stock, orders, shipments, invoices and profitability in one place. The service is operated by Piemsoft Yazılım ve Eğitim San.Tic.Paz.Ltd.Şti, 7281195865, with its registered office at Vatan Mahallesi 230.Cad No:101 Merkez/Isparta ("we", "us").

For any question about this policy or about your personal data, write to info@piemsoft.com.

2. Two roles: controller and processor

Which rules apply depends on whose data it is:

• We are the data controller for the data of the people who use the platform: merchants, their team members, visitors of this website and people who contact us. This policy describes that processing.
• We are a data processor for the data that merchants bring into the platform about their own customers: names, delivery addresses, phone numbers, e-mail addresses, orders, invoices, shipments and returns. The merchant is the controller of that data and decides why and how it is used; we process it only on the merchant's instructions, under our Data Processing Agreement. If you bought something from a shop that uses Rommerce OS, please contact that shop first - it is the one that can answer your request, and we will help it do so.

3. What data we collect

Account and team data

• name, e-mail address, password (stored only as a one-way hash), preferred language;
• the organisation you belong to, your role and permissions in it, invitations you sent or received;
• two-factor authentication secrets and recovery codes, stored encrypted;
• company details of the merchant: legal name, tax identification number, address, time zone and currency.

Security and usage records

• IP address, browser user agent and time of sign-ins and of security-relevant actions;
• an audit trail of critical changes in an organisation (who changed what, and when), which the organisation's own administrators can read;
• session records needed to keep you signed in.

Billing data

• the plan you subscribed to, its status, invoices and payment events;
• card details are entered on the payment provider's own hosted page (Stripe or iyzico). We never receive or store your full card number.

Integration credentials

• API keys, tokens and webhook secrets for the marketplaces, webshops, couriers and invoicing providers a merchant connects. They are encrypted at rest, never shown again after saving and never written to logs.

Support and contact

• the name, e-mail address and messages you send when you contact us or open a support request.

Data we do not collect

• We do not use advertising cookies, third-party analytics or tracking pixels on this website or in the application.
• We do not knowingly collect special categories of data (health, beliefs, biometric data) and the service is not directed at children.
• Location and device metadata (EXIF, GPS) embedded in product photos is removed automatically when a photo is uploaded, because those photos are published on sales channels.

4. Why we use it and on what legal basis

• Providing the service - creating your account, running synchronisations, showing your data to you - is necessary to perform our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Billing, accounting and tax records are kept because the law requires it (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).
• Security - audit logs, sign-in records, abuse prevention, IP allow-lists - rests on our legitimate interest in keeping the platform and its tenants safe (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• Service messages - invitations, payment reminders, alerts you switched on - are part of the contract. We send no marketing e-mail without your consent, and you can withdraw that consent at any time.

We do not make decisions that produce legal effects about you by purely automated means. The repricing and automation features act on a merchant's product prices and orders according to rules the merchant defines; they do not profile individuals.

5. Who receives the data

We share personal data only with those who need it to run the service:

• Infrastructure providers - hosting, database, backups and e-mail delivery.
• Payment providers - Stripe and iyzico, for subscription payments.
• AI features - when a merchant asks for a category, description, translation or attribute suggestion, the product's text is sent to a language-model provider; when a merchant asks for a background removal, the product photo is sent to remove.bg. These features work on product data, not on customer data, and only run when a merchant clicks them.
• Providers the merchant connects - marketplaces, webshops, couriers and invoicing services (for example eMAG, Trendyol, Shopify, WooCommerce, FAN Courier, Sameday, SmartBill). Data flows to them because the merchant instructed it, under the merchant's own contract with that provider.
• Authorities, where the law obliges us.

The current list of our sub-processors is part of the Data Processing Agreement. We do not sell personal data and we do not share it for anyone else's marketing.

6. Transfers outside the EEA and outside Turkey

Our primary data storage is in the European Union. Some providers (for example payment or AI providers) may process data in other countries. Where that happens we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses, and for data subject to KVKK on the transfer conditions of KVKK Art. 9.

7. How long we keep it

• Account data - for as long as the account exists. When an organisation is closed, its data is deleted or irreversibly anonymised, except for what the law requires us to keep.
• Billing and accounting records - for the period required by applicable tax and accounting law.
• Audit and security logs - for as long as they are needed to investigate incidents and demonstrate compliance.
• Customer data held for merchants - for as long as the merchant keeps it in the platform. A merchant can erase an individual customer's personal details while keeping the order record its own accounting needs.
• Backups - overwritten on a rolling schedule; data deleted from the live system disappears from backups as they expire.

8. How we protect it

• every record belongs to exactly one organisation and every query is scoped to it, so one merchant can never read another's data;
• integration credentials and two-factor secrets are encrypted at rest; passwords are hashed;
• all traffic is served over HTTPS;
• two-factor authentication, mandatory for platform administrators and available to merchants; optional IP allow-lists; session and token revocation;
• role-based permissions inside each organisation, and an audit log of critical changes;
• incoming webhooks are accepted only with a valid signature.

If a personal data breach occurs that is likely to put your rights at risk, we will notify the competent authority and the people affected as the law requires, and affected merchants without undue delay.

9. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where processing is based on consent. Under KVKK Art. 11 you additionally have the right to learn whether your data is processed, to whom it is transferred in Turkey or abroad, and to claim compensation for damage caused by unlawful processing.

To exercise any of these rights, write to info@piemsoft.com. We answer within one month (within thirty days for KVKK requests) and free of charge. We may ask you to confirm your identity first.

You also have the right to lodge a complaint with a supervisory authority: in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro); in Turkey, the Personal Data Protection Authority (KVKK, kvkk.gov.tr); or the authority of the EU country where you live.

10. Cookies

We use only the cookies needed to sign you in and keep the site secure. Details are in our Cookie Policy.

11. Changes to this policy

When we change this policy we update the date at the top of this page. If a change materially affects how we use your data, we notify account owners by e-mail or inside the application before it takes effect.