For the purposes of this Privacy Policy, the following terms are defined as follows:
FINCORY Application: refers to the application installed by merchants on their Shopify store, enabling them to create retargeting campaigns based on their customers’ financial data (income, spending, loyalty) obtained via open banking.
Extension: refers to the banner displayed on the merchant’s website, visible to end users, through which they can give consent to the processing of their banking data by connecting their bank account (open banking). This extension is an integral part of the application’s overall functionality.
Merchant: refers to the professional client who has installed the FINCORY Application on their Shopify store.
End User: refers to any natural person (a customer of the merchant) whose banking data may be used (with their explicit consent) for marketing targeting purposes via the FINCORY Application.
This Privacy Policy aims to inform:
about the conditions under which personal data is processed, in accordance with Regulation (EU) 2016/679 on the protection of personal data and the free movement of such data (hereinafter “GDPR”), Directive (EU) 2015/2366 (hereinafter “PSD2”), and Shopify’s customer data requirements.
FINCORY collects:
For more information on the terms of use of the Application, please refer to our Terms of Use.
The processing of personal data is carried out by FINCORY.
Simplified joint-stock company (SAS) with a share capital of €1,000, registered with the Paris Trade and Companies Register under number 987 625 522.
Head office: 5 rue François Bonvin, 75015 Paris – France.
Email : contact@fincory.com
FINCORY acts as the data controller for the collection, segmentation, and management of pseudonymized banking data of End Users, in compliance with the GDPR.
Merchants, for their part, remain responsible for any processing they initiate based on the segments provided via the FINCORY Application.
FINCORY does not process any Merchant data for targeting or profiling purposes. Only technical and contractual information necessary for the use of the Application (such as name, email, and store ID) is retained.
4.1. Data Collected
FINCORY does not collect or store directly identifiable information such as the name, surname, or email address of data subjects.
FINCORY exclusively processes the following pseudonymized banking data :
This data is provided exclusively by Linxo Connect, a PSD2-licensed aggregator. Linxo Connect is the trade name of OXLIN, a payment institution authorized by the French Prudential Supervision and Resolution Authority (ACPR) under registration number 17248, and a subsidiary of the Crédit Agricole Group.
Linxo Connect ensures secure data hosting but does not in any way use or exploit the data: there is no resale, commercial use, or advertising usage of any kind.
These pseudonymized data do not allow direct identification and are processed strictly in accordance with the GDPR framework.
4.2. Data Origin
The data is obtained, with user consent, via secure open banking interfaces operated by Linxo Connect, FINCORY’s PSD2-licensed technical provider.
Additionally, certain technical data from the Shopify API (e.g., internal customer ID, order ID) may be stored in order to associate a behavioral segment with a customer profile. However, FINCORY does not store or reuse this data independently.
Banking data is processed solely for the following purposes.
FINCORY never uses the data for any other purposes, such as credit scoring or advertising on behalf of third parties. All marketing actions enabled by FINCORY are carried out exclusively for the benefit of the Merchant and directed toward their own customers.
The processing is based on Article 6.1.a of the GDPR: the explicit consent of the data subject, obtained through the partner interface in compliance with the requirements of the PSD2 directive.
No data is collected without the user’s voluntary and informed action.
FINCORY carries out automated processing for marketing segmentation purposes, based on pseudonymized banking data.
As this processing may have a significant impact on data subjects, FINCORY requests their explicit consent in accordance with Article 22(2)(c) of the GDPR before carrying out any profiling, and provides appropriate mechanisms for withdrawing such consent.
The resulting segments are shared with the Merchant, who may then choose to trigger personalized offers at their discretion.
In accordance with Article 13(2)(f) of the GDPR, every data subject has the right to :
FINCORY enables data subjects to exercise their rights as described in Article 10 of this Privacy Policy.
Banking data collected is retained for a maximum period of 5 years from the date of collection.
After this period, the data is either permanently deleted or irreversibly anonymized, unless a legal obligation requires otherwise.
Professional data relating to Merchants is retained for the entire duration of the contract between the Merchant and FINCORY and may be archived beyond that period in the event of a legal obligation (e.g., accounting or tax purposes).
Data may be shared with Shopify merchants using FINCORY, but only in the form of pseudonymized segments, i.e., behavioral categories (e.g., loyal customer, premium, inactive) without any identifying information (e.g., email, IBAN, name). These segments allow the Merchant to activate targeted marketing actions toward their own customers, without ever accessing raw banking data.
FINCORY does not sell, resell, or transfer data to unauthorized third parties.
FINCORY never shares identifying data between Merchants.
When the same user has consented to data sharing across multiple stores, they may be associated with different segments reflecting their individual purchasing behavior on each store. No direct access to raw data or a complete transaction history is ever provided to the Merchants.
In accordance with Article 32 of the GDPR, FINCORY implements appropriate technical and organizational measures to ensure the security, confidentiality, and integrity of the personal data it processes. The following security measures are applied by FINCORY:
FINCORY complies with the security requirements imposed by Shopify for Level 1 and Level 2 protected customer data, as described in Shopify’s official API Access Scopes and App Store Requirements documentation.
Data is hosted exclusively within the European Union.
No data is transferred outside the European Union.
In accordance with Articles 15 to 22 of the GDPR, you have the following rights:
To exercise these rights, data subjects may send their request to: contact@fincory.com.
The request must clearly specify the nature of the right being exercised (e.g., access, objection, erasure, information on segmentation, etc.).
A copy of a valid ID may be requested only when the nature of the request justifies it, particularly in the following cases:
FINCORY is committed to responding within a maximum of 30 days, in accordance with Article 12 of the GDPR.
This policy may evolve based on regulatory or technical changes.
In the event of a substantial update, FINCORY will inform users: