Privacy policy
Last updated: 18 October 2026
1. Who we are
KSeF Faktury (the "App") is a Shopify app published by Lytvynov Production LLC (ТОВ «ЛИТВИНОВ ПРОДАКШН», EDRPOU 43293825), vul. Robocha 164-A, kv. 58, 49000 Dnipro, Ukraine ("we", "us"). Contact: kontakt@ksefshop.pl, https://ksefshop.pl.
The App issues Polish VAT invoices for paid orders of a Shopify store and sends them to KSeF, the Polish National e-Invoicing System run by the Ministry of Finance.
2. Our role
- Data about your store's buyers (people and companies who order in your store): the merchant is the controller. We process this data on the merchant's behalf and on its instructions, as a processor under art. 28 GDPR. The data processing terms are part of our Terms of Service.
- Data about the merchant (store and staff using the App): we are the controller.
3. What data we process
Buyer data, received from Shopify for orders where an invoice is due:
- buyer's company name or full name, NIP (tax identification number), billing address;
- buyer's email address (to send the invoice PDF);
- order number, date, currency, amounts, line items (product name, quantity, price, VAT rate), shipping line, discounts, refunds;
- order attributes entered in the cart: "I need a company invoice", NIP, company name.
Data we create:
- the invoice in FA(3) XML, the invoice PDF, the invoice number, the KSeF number and status messages from KSeF.
Merchant data:
- store domain, seller NIP, company name and address, place of issue, invoice number pattern, chosen language, plan name;
- Shopify access tokens for the store (stored to call the Shopify API on your behalf);
- if a staff member opens the App, Shopify may share the staff member's name, email and locale with the App session.
We do not collect buyer phone numbers, payment card data or browsing data. The App does not use cookies on the storefront; the cart field stores the NIP only as a cart attribute in Shopify.
4. Why we process it and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Issuing the VAT invoice and the correction invoice and sending them to KSeF | buyer name or company, NIP, address, order lines and amounts | Art. 6(1)(c) GDPR: legal obligation of the merchant to issue invoices through KSeF (art. 106a-106q of the Polish VAT Act of 11 March 2004, in particular art. 106ga) |
| Keeping issued invoices for the legally required period | invoice XML, PDF, KSeF number | Art. 6(1)(c) GDPR: art. 112 of the VAT Act |
| Delivering the invoice PDF to the buyer (email and order page link) | email, invoice PDF | Art. 6(1)(b) GDPR: performance of the sale contract between the merchant and the buyer, who asked for an invoice |
| Providing the App to the merchant, support, billing through Shopify | merchant data | Art. 6(1)(b) GDPR: contract with the merchant |
| Security, preventing misuse, error logs | technical logs, store domain | Art. 6(1)(f) GDPR: our legitimate interest in running a secure service |
We do not sell personal data, do not use it for advertising and do not make automated decisions with legal effects about buyers. Checking the NIP checksum only tells the buyer that the number is mistyped.
5. Who receives the data
| Recipient | Role | Location |
|---|---|---|
| Ministry of Finance of Poland, KSeF | Recipient required by law. Every invoice is stored in KSeF under the rules of the VAT Act | Poland |
| Hetzner Online GmbH | Processor: servers, database, file storage, backups | Germany, European Union |
| Shopify | Platform the App runs on; we write the invoice number, KSeF number and PDF link back to the order | see Shopify's privacy policy |
The App does not send emails to buyers yet. Before we enable invoice emails we will name the email provider here; if it is located outside the European Economic Area, we will rely on the European Commission's Standard Contractual Clauses or an adequacy decision.
6. How long we keep data
- Issued invoices (XML, PDF, KSeF number, invoice number, buyer details shown on the invoice): until the tax liability for the period becomes time-barred, which under art. 112 of the VAT Act in connection with art. 70 of the Tax Ordinance is in general 5 years from the end of the calendar year in which the tax payment deadline fell. After that the invoices are deleted.
- Order data used to prepare an invoice (copy of the order received from Shopify): kept together with the invoice record, because a later refund needs it for the correction invoice, and deleted when Shopify sends a customer or shop redaction request.
- Orders that do not need an invoice (no NIP, not paid): deleted within 90 days.
- After the merchant uninstalls the App: access tokens are deleted at once. 48 hours later Shopify asks us to erase shop data. We then erase settings and order data, but keep issued invoices until the end of the retention period above, because the law requires them to exist. The merchant can download them (CSV or ZIP with XML and PDF) before uninstalling.
- Backups: daily copies, each kept for 14 days.
KSeF itself keeps invoices for 10 years under the VAT Act. We have no control over that copy.
7. Security
Data is transmitted over TLS. The servers are located in a data centre in Germany. The connection to KSeF uses our certificate and the permission granted by the merchant in KSeF; we never receive the merchant's KSeF passwords or tokens. Invoice PDF links contain an unguessable token. Access to production systems is limited to named staff using personal SSH keys and two-factor authentication on the admin accounts.
8. Rights of data subjects
Buyers and merchant staff have the right to access, rectify, erase, restrict and port their data, and to object to processing based on legitimate interest. Some limits apply:
- an issued invoice cannot be changed or erased; a mistake is fixed with a correction invoice, and the invoice must be kept for the legal period;
- buyers should first contact the store they bought from, because the store is the controller. We help the store answer.
Requests to us: kontakt@ksefshop.pl. We reply within one month. You can also lodge a complaint with a supervisory authority, in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa), or the authority in your country of residence.
9. Shopify privacy requests
We handle Shopify's mandatory privacy webhooks:
- customer data request: we prepare the data we hold about that buyer and send it to the store within 30 days;
- customer redaction: we delete stored order data for the listed orders; issued invoices are kept for the legal period;
- shop redaction: we delete the shop's settings and order data; issued invoices are kept for the legal period.
9a. Our website (ksefshop.pl)
This section covers visitors of our website, not the App inside Shopify. With your consent (the "Accept" button in the cookie banner) we use Google Analytics 4 (Google Ireland Ltd) to count visits and Microsoft Clarity (Microsoft Ireland Operations Ltd) to see how pages are used through heatmaps and anonymised session recordings. Legal basis: consent (art. 6(1)(a) GDPR). Without consent Google Analytics runs in a cookieless mode that sends no identifiers, and Clarity does not load. You can change your choice at any time with "Cookie settings" in the site footer. Analytics data is kept for 14 months in Google Analytics and up to 13 months in Clarity.
Launch list. If you join the launch list on the site, we keep your email address, the language of the page and, if you give it, your store address. Purpose: one email when the App launches in the Shopify App Store and help with setup. Legal basis: consent (art. 6(1)(a) GDPR), which you can withdraw at any time by writing to kontakt@ksefshop.pl. We delete the list 3 months after the launch at the latest. We do not store your IP address.
10. Changes
We will post changes on this page and inform merchants in the App when the change is material.