Skip to content
Keen Convert

Privacy policy

Last updated

This policy explains how Keen Convert handles personal data. Keen Convert is a trading name of NBT 360 FZE, a company registered in Sharjah, United Arab Emirates (the “Operator”, “we”, “us”). It covers two things: this website, keenconvert.com, and the Shopify apps we publish (the “Apps”).

We follow the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”), the EU and UK General Data Protection Regulation (the “GDPR”) where they apply to merchants and shoppers in those regions, and the data protection requirements of the Shopify App Store.

1. Our two roles

We act in two different roles, and your rights depend on which one applies.

  • Controller. For data we collect through this website, for our contact and launch list forms, and for the account information of merchants who install our Apps, we decide why and how the data is used. We are the controller.
  • Processor. For data about a merchant’s customers that passes through our Apps, for example a shipping address checked by Keen Address, the merchant is the controller and we process the data only on the merchant’s instructions and only to provide the App. Section 5 describes this in detail.

2. Data we collect on this website

  • Contact and launch list forms. Name, email address, the subject you choose, your message, and, for the launch list, your store URL and approximate monthly order volume. We use this to reply to you and to send the updates you asked for. Legal basis: your consent and our legitimate interest in responding to enquiries.
  • Analytics. We use Google Analytics 4 with IP anonymisation to understand which pages are read. This produces aggregated statistics. You can block it with a browser extension or by disabling JavaScript.
  • Server logs. Our hosting provider, Cloudflare, records request metadata (IP address, user agent, requested URL, timestamp) for security and to keep the site running. Logs are retained for a short period and are not combined with form data.

We do not use advertising pixels or sell personal data.

3. Data we collect from merchants who install an App

When you install one of our Apps from the Shopify App Store, Shopify shares with us:

  • Your store domain, store name, contact email, plan, currency and timezone.
  • An access token scoped to the permissions you approved during installation.

We use this to run the App, to send you service messages about it (for example a failed check, a change to the App or a billing notice), and to provide support. Legal basis: performance of our contract with you.

4. Data our Apps process on behalf of merchants

Each App processes the minimum data needed for its purpose. For Keen Address:

  • Shipping address fields of orders shipped to Saudi Arabia: address lines, city, district, postal code, country, and the shopper’s phone number when the WhatsApp fallback is enabled.
  • Order identifiers: order ID, order number, tags, and the short address we attach.

Keen Address checks addresses in real time against the Saudi National Address database and writes the result to the order in your Shopify store. We keep an operational log of checks (order ID, outcome, timestamp) so that the dashboard can show resolved and unresolved orders. We do not keep a separate copy of customer records, and the log is deleted when you uninstall the App (see section 7).

Where a merchant enables the WhatsApp fallback, the shopper’s phone number and the confirmation message are transmitted through the WhatsApp Business Platform operated by Meta Platforms Ireland Limited under the merchant’s approved sender. Meta’s own terms apply to that transmission.

5. Processor terms for merchants

When we process customer data on your behalf, the following terms apply and form part of our agreement with you:

  1. We process customer data only to provide the App and on your documented instructions, which include the App’s settings you choose.
  2. We do not sell customer data, use it for advertising, or use it to build profiles of shoppers.
  3. We keep customer data confidential and ensure that anyone who accesses it on our behalf is bound by confidentiality.
  4. We maintain appropriate technical and organisational security measures (section 8).
  5. We use the sub-processors listed in section 6 and will give you notice of any change by updating this page and, for material changes, by email, so that you can object.
  6. We assist you, taking into account the nature of the processing, in responding to requests from your customers to exercise their rights, and in meeting your own security, breach notification and impact assessment obligations.
  7. On uninstall we delete the customer data we hold within the period set by Shopify (section 7).
  8. We make available the information you reasonably need to demonstrate compliance, and we allow audits by you or an auditor you appoint, subject to reasonable notice and confidentiality.
  9. Where we transfer customer data outside the UAE, the EU or the UK, we do so under appropriate safeguards (section 9).

6. Sub-processors and third parties

Provider Purpose Location
Shopify Inc. Commerce platform that sends us order and store data Canada, global
Cloudflare, Inc. Hosting, edge network, security Global network
Saudi Post (SPL) National Address API Address lookup for Keen Address Saudi Arabia
Meta Platforms Ireland Ltd (WhatsApp Business Platform) Optional shopper confirmation messages Ireland, global
Resend, Inc. Transactional email for forms and service messages United States
Google LLC Website analytics (GA4) United States, global

We do not share personal data with anyone else except when the law requires it, or to protect our rights, or in connection with a sale or reorganisation of our business, in which case this policy continues to apply.

7. Shopify mandatory webhooks and retention

Our Apps implement the three privacy webhooks that Shopify requires:

  • customers/data_request. When a shopper asks a merchant for their data, Shopify notifies us and we provide the merchant with the data we hold for that customer within 30 days.
  • customers/redact. When a merchant asks us to erase a customer’s data, we delete the operational log entries and any stored short address for that customer’s orders within 30 days, unless we are legally required to keep them.
  • shop/redact. 48 hours after a merchant uninstalls an App, Shopify notifies us. We delete all store data, including access tokens and operational logs, within 30 days of that notice.

Website form data is retained for as long as needed to handle your enquiry and, for launch list subscribers, until you unsubscribe. Every update email includes an unsubscribe link.

8. Security

We use encryption in transit (TLS) for all connections, encrypt data at rest, scope access tokens to the minimum Shopify permissions required, restrict staff access to production systems, and log administrative actions. No system is perfectly secure; if we become aware of a breach affecting personal data we will notify affected merchants without undue delay and, where the PDPL or the GDPR requires it, the relevant authority.

9. International transfers

We are based in the UAE and our providers operate globally. Where personal data is transferred from the EU or UK, we rely on the provider’s Standard Contractual Clauses or the UK International Data Transfer Addendum. Where personal data is transferred out of the UAE, we do so in line with the PDPL, either to a jurisdiction with adequate protection or under contractual safeguards.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to its processing, and to withdraw consent. If you are a shopper, please contact the merchant you bought from first, because they are the controller of your data and we will support them in responding. Otherwise, email support@keenconvert.com. We respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority: the UAE Data Office, or your local authority in the EU or UK.

11. Children

Our website and Apps are for businesses and are not directed at children under 18. We do not knowingly collect personal data from children.

12. Changes to this policy

We will post any changes on this page and update the “Last updated” date. For material changes affecting merchants we will also send an email to the store’s contact address.

13. Contact

NBT 360 FZE, trading as Keen Convert Sharjah, United Arab Emirates support@keenconvert.com