Privacy notice for the gift wrapping app
veryuu GmbH · in force from 8 September 2026 · WooCommerce added October 2026 · data processing agreement 22 October 2026
For merchants who install the Veryuu gift wrapping app in their shop — on Shopify the app, on WooCommerce the plugin — and for their customers. This notice describes the app. It does not describe veryuu.com, which has a privacy policy of its own.
1. Who is responsible for what
When a shop installs the app, the merchant decides that their customers' data may be used to produce a gift wrapping. The merchant is the controller. veryuu GmbH processes that data on the merchant's instructions and is the processor.
The agreement between them under Art. 28 GDPR is part of veryuu's terms for merchants, which every shop accepts when it connects, on Shopify and on WooCommerce. It consists of the European Commission's standard contractual clauses, and this notice fills in their annexes: what veryuu processes, for what, for how long, how it is protected and with whom. A merchant who needs a separate data processing agreement as its own signed document can ask for one at info@veryuu.com.
veryuu GmbH, Prinz-Friedrich-Leopold-Straße 31, 14129 Berlin, Germany. Managing directors Kathrin Bräuer-Niekamp and Gunnar von Reden. Amtsgericht Charlottenburg, HRB 187264 B. Contact: info@veryuu.com.
2. What the app takes from the shop
Two fields, and this is the complete list. When an order in the shop contains a gift wrapping, the app keeps:
- the buyer's email address, so the gift link can be sent to them;
- the buyer's language, so the pages they see are in it. On WooCommerce, which records no language on an order, this is the language the shop is set to.
No name, no postal address, no telephone number, no payment details. The order's own identifiers, its total and its line items are kept with it so that the right wrapping is produced for the right purchase; they say nothing about a person. Everything else in the order stays with the merchant.
On Shopify the app requests access to the customer email field alone in Shopify's protected customer data settings, and not to name, phone or address, so nothing else reaches it. It asks for what it uses.
On WooCommerce there is no such setting: the key a merchant approves when connecting lets the app read an order whole. The app reads only the orders that contain a wrapping, keeps what is listed above and discards the rest as it reads it. Nothing else from the order is stored.
3. What the buyer adds themselves
After the purchase the buyer opens a page where they make the gift. Whatever they put there is stored:
- a message, and the names they choose to write in the “to” and “from” fields;
- an upload — a photograph, a video, an audio file or a PDF.
Nothing here is asked for. A buyer who wants to send only a message sends only a message. The app does not read, analyse or classify what is uploaded; it stores it and shows it to whoever opens the gift link.
On Shopify the merchant sees it too. What the buyer writes and uploads is also written back onto their order in the shop's own Shopify admin, where the merchant can read it and cannot change it. This is not the app's choice: Shopify requires an app to return customer data collected through Shopify's own surfaces to the merchant's admin, and the gift is filled in on the shop's pages. It adds nobody to section 6 — the shop is the source of the data and its controller either way, and this only puts the data where the controller can reach it. On WooCommerce nothing is written back to the order.
Special categories of data within the meaning of Art. 9 GDPR are neither requested nor required. An upload is free-form, so a buyer could place anything in one, and that is their choice rather than the app's purpose.
4. What it is used for, and on what basis
To produce the gift wrapping the buyer paid for, to deliver it as a link, and to send the buyer that link by email. Nothing is used for advertising, nothing is profiled, and nothing is sold or shared for anyone else's purposes.
The legal basis is the performance of the contract between the buyer and the merchant, Art. 6(1)(b) GDPR, carried out by veryuu on the merchant's instructions under Art. 28 GDPR.
5. How long it is kept
Deletion is automatic and runs on a schedule. Nobody has to remember to do it.
| What | Kept for |
|---|---|
| A gift's photograph, message and names, once it is paid for | 3 months |
| A gift that was never paid for, uploads included | 3 months, then deleted |
| An upload the buyer never attached to a gift | 7 days |
The record that a wrapping was sold survives longer, because it is what the merchant is invoiced from. It holds the order's identifier and its price and no personal data.
The clock runs from the last time the gift was touched, not from the moment it was delivered. Nothing records when a gift was opened, so a promise measured from delivery would not be true.
6. Where it is processed, and who else is involved
The app runs in Amsterdam, the Netherlands. No personal data leaves the European Union in normal operation.
| Who | What for | Where |
|---|---|---|
| Railway Corp. | Hosting: the application, its databases and its file storage | Amsterdam, Netherlands |
| IONOS SE | Sending the email that carries the gift link | Germany |
No other outside service receives any of this data. The shop platform is not on this list because it is the merchant's own platform and the source of the data rather than someone veryuu engaged.
On WooCommerce veryuu invoices the merchant itself, through Stripe. Stripe is told that a wrapping was sold, under the gift's identifier; it receives nothing about the buyer.
7. How it is protected
- In transit and at rest. HTTPS throughout. Databases and uploaded files sit on encrypted storage. The keys that let the app talk to a shop are encrypted a second time by veryuu, so a copy of the database alone does not open anybody's shop.
- Who may look. Access to a customer's own data belongs to one role inside veryuu and is refused to every other. Staff passwords must be at least twelve characters.
- A record of looking. Opening a screen that shows a customer's data writes an entry naming the account, the moment and the record. The entry holds no personal data itself.
- Backups are taken daily and weekly and are encrypted. Restoring them has been tested rather than assumed.
8. Rights, and how to use them
Everyone whose data is processed has the right to ask what is held about them, to have it corrected, to have it deleted, to have its processing restricted, to receive it in a portable form, and to object. Complaints can be made to a supervisory authority.
Ask the shop you bought from. The merchant is the controller, so a request goes to them. On Shopify the request reaches the app electronically, so it can be handled without anybody writing to veryuu by hand. On WooCommerce the merchant passes it to info@veryuu.com, and veryuu answers the merchant. A request a buyer sends to info@veryuu.com is passed to the merchant it concerns.
9. Breaches
If personal data is exposed, veryuu informs the merchant without undue delay, so the merchant can meet their own obligation to notify the supervisory authority within 72 hours under Art. 33 GDPR.
10. Changes
The version published here is the one in force. Merchants are told about changes that affect what is processed or for how long.
11. Words used here
- Personal data — anything that identifies a person or can be traced back to one. In this app that is an email address, a language, and whatever a buyer chooses to write or upload into a gift.
- Controller — whoever decides why personal data is processed. For everything described here that is the merchant whose shop made the sale.
- Processor — whoever processes it on the controller's instructions and for no purpose of their own. That is veryuu GmbH.
- Sub-processor — a service veryuu engages to do part of the work. There are two, and section 6 names them both.
- Merchant — the shop that installed the app. Buyer — the person who bought from that shop. Recipient — whoever opens the gift link.