This Privacy Policy is intended to inform:
(hereinafter referred to respectively as “Merchants” and “data subjects”),
of the conditions under which personal data is processed, in accordance with the General Data Protection Regulation (GDPR – EU 2016/679), the PSD2 directive, and Shopify’s customer data requirements.
FINCORY collects:
For more information on the terms of use of the application, please refer to our Terms of Use.
The processing of personal data is carried out by FINCORY,
a simplified joint-stock company (SAS) with a share capital of €1,000, registered with the Paris Trade and Companies Register under number 987 625 522.
Registered office: 5 rue François Bonvin, 75015 Paris – France.
Email: contact@fincory.com
FINCORY acts as the data controller for the collection, segmentation, and management of pseudonymized banking data of end users, in compliance with the GDPR.
Merchants, for their part, remain solely responsible for any data processing they perform based on the segments received through the FINCORY application.
FINCORY does not process any Merchant data for targeting or profiling purposes. Only technical and contractual information necessary for the use of the Application (such as name, email, and store ID) is retained.
FINCORY does not collect or store any directly identifying data such as the name, surname, or email address of the data subjects.
FINCORY exclusively processes the following pseudonymized banking data:
This data is provided exclusively by our partner Linxo Connect, a PSD2-licensed aggregator operating under the trade name of OXLIN, a payment institution authorized by the ACPR (Autorité de Contrôle Prudentiel et de Résolution) under registration number 17248, and a subsidiary of the Crédit Agricole Group. It is transmitted only after the data subject's explicit consent, in full compliance with regulatory requirements.
Linxo Connect ensures the secure hosting of this data but does not use it in any way: there is no resale, nor any commercial or advertising use.
This data is pseudonymized, does not allow direct identification, and is processed within a framework strictly defined by the GDPR.
The data is obtained, with proper authorization, through secure Open Banking interfaces implemented by Linxo Connect, FINCORY’s technical provider and a PSD2-licensed service provider.
In addition, certain technical data from the Shopify API (e.g., internal customer ID, order ID) is stored to associate a behavioral segment with a customer profile, without any independent storage or reuse by FINCORY.
Banking data is processed exclusively for the following purposes:
FINCORY never uses this data for purposes like scoring or third-party advertising. All marketing actions enabled by FINCORY are conducted solely by and for the Merchant, for their own customers.
Processing is based on Article 6.1.a of the GDPR: explicit consent of the data subject, obtained via a PSD2-compliant partner interface.
No data is collected without the user’s informed and voluntary action.
FINCORY performs automated processing for the purpose of marketing segmentation using pseudonymized banking data.
While this processing does not produce legal effects, it may significantly impact the individual. Therefore, under Article 22(2)(c) of the GDPR, FINCORY collects explicit consent and provides users with the means to withdraw it at any time.
Segments are shared with the Merchant, who may use them to trigger personalized offers.
Under Article 13(2)(f) of the GDPR, data subjects have the right to:
FINCORY enables the exercise of these rights as described in Section 10 of this Privacy Policy.
Banking data is retained for a maximum of 5 years from the date of collection.
After this period, it is irreversibly deleted or anonymized, unless a legal obligation dictates otherwise.
Merchant data is stored for the duration of their contractual relationship with FINCORY and may be archived beyond that period for legal (e.g., tax or accounting) compliance.
Data may be transmitted to Shopify Merchants using FINCORY only as pseudonymized segments (e.g., loyal customer, premium, inactive), with no identifiable data such as email, IBAN, or name. These segments enable Merchants to target their own customers without access to raw banking data.
FINCORY does not sell, resell, or transfer data to unauthorized third parties.
No identifying data is ever shared between Merchants. However, a user who has given consent across multiple stores may be linked to different segments based on distinct behaviors. No Merchant receives access to the user’s full raw data or full history.
Pursuant to Article 32 of the GDPR, FINCORY implements appropriate technical and organizational measures to ensure the security, confidentiality, and integrity of personal data. These include:
FINCORY complies with Shopify’s security requirements for protected customer data levels 1 and 2, as outlined in the official Shopify API Access Scopes and App Store Requirements.
All data is hosted exclusively within the European Union:
No data transfers outside the EU occur, unless covered by appropriate safeguards such as Standard Contractual Clauses or a valid EU adequacy decision.
Under Articles 15 to 22 of the GDPR, you have the right to:
To exercise any of the rights outlined in Section 10, data subjects may submit a request to the following address: contact@fincory.com
Requests must clearly specify the nature of the inquiry (e.g., access, erasure, objection, information about segment classification).
In accordance with the GDPR, you have the right to:
A copy of an identity document may be requested only when the nature of the request justifies it, particularly in the following cases:
FINCORY is committed to responding within a maximum of 30 days, in accordance with Article 12 of the GDPR.
This policy may evolve based on regulatory or technical changes.
In the event of a substantial update, FINCORY will inform users: