Privacy Policy

Last updated: 21 May 2025

This Privacy Policy describes how ACS Gift Cards ("the App", "we", "us") collects, uses, and protects personal information when you install and use the App on your Shopify store. By installing the App you agree to this Policy.

1. Who we are

ACS Gift Cards is a Shopify application that bridges Shopify-native gift cards with the ACS Interchange financial switch operated by Altron FinTech (South Africa). The App is operated as a multi-tenant service; each merchant's data is isolated by shop_domain.

2. Data we collect

We collect only the minimum data required to operate the gift card service:

• Merchant data: Shopify shop domain, OAuth access token (required by Shopify), ACS API credentials (encrypted at rest with AES-256-GCM).
• Order data: Order ID, line item IDs, order total, currency — received via theorders/paid Shopify webhook to trigger gift card issuance.
• Customer data: Shopify Customer GID (numeric ID only — no name, email, or phone stored by the App). This is used to associate a gift card with the purchasing customer.
• Gift card data: ACS primary account number (PAN) stored encrypted; Shopify gift card GID; balance in minor units; transaction history.
• Audit logs: Timestamped records of every operation (issue, redemption, top-up, block, balance query, admin actions, GDPR events). Logs contain no full PAN, no JWT, no customer name or email.

3. How we use your data

• Issuing gift cards to customers who purchase a gift card product.
• Processing redemptions when a gift card is used at checkout.
• Synchronising balances with the ACS Interchange financial switch.
• Providing merchants with reconciliation reports and transaction history.
• Fulfilling GDPR/POPIA data subject rights requests (access, erasure).
• Detecting and investigating fraud or misuse of the gift card programme.

4. Data sharing

We share data only with the following parties, and only to the extent necessary:

• Shopify Inc. — via the Shopify Admin API to create and update gift cards.
• Altron FinTech / ACS Interchange — encrypted card transactions are sent to the ACS API endpoint configured by the merchant. No customer PII is transmitted; only the ACS PAN, amount, and transaction identifiers.
• Hosting infrastructure — the App runs on HTTPS infrastructure; the hosting provider may process data as a sub-processor.

We do not sell, rent, or trade personal data to third parties.

5. Data retention

• Gift card and transaction records — retained for a minimum of 7 years to comply with POPIA s.14 and SARS financial record-keeping requirements.
• Audit logs — retained for 7 years (PCI DSS v4 Req. 10.5.1 minimum). Expired records are purged automatically.
• Session tokens — deleted immediately on app uninstall.

6. Your rights (GDPR Art. 17, 20 / POPIA s. 23, 24)

If you are a customer of a merchant using this App, you may exercise your data subject rights through that merchant's store. Merchants who receive a data request from Shopify (via thecustomers/data_request webhook) will receive a structured JSON export of all gift card and transaction data held for that customer. Merchants who receive an erasure request (viacustomers/redact) will have that customer's personally identifiable information anonymised from our records; financial transaction records are retained as required by law.

7. Security

• ACS PANs and JWT credentials are encrypted at rest with AES-256-GCM.
• All data in transit is protected with TLS 1.2+.
• Full audit logging is maintained per PCI DSS v4 Req. 10, ISO 27001:2022 A.8.15.
• No full card PAN is ever written to logs or returned to the browser.

8. Cookies

The App is embedded in the Shopify Admin and does not set any third-party cookies. Session management relies entirely on Shopify's session token mechanism (App Bridge).

9. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect any changes. Continued use of the App after changes constitutes acceptance.

10. Contact

For privacy enquiries or data subject requests, contact us at: privacy@example.com