Privacy policy

1. Who we are

CERTISYT GROUP LTD (company number 17238897) is a private limited company registered in England and Wales. Its registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. MyShopStock is a product operated by the company and is not a separate legal entity.

Certisyt Group Ltd’s ICO registration reference is ZC190180. You can contact us about privacy at [email protected].

2. The roles we take

For account administration, authentication, service security, support and our own business records, Certisyt Group Ltd acts as a data controller.

A business customer decides what stock-room information to enter and who may access it. For personal data contained in that customer’s workspace, the customer will generally act as controller and Certisyt Group Ltd will process the information on the customer’s instructions to provide and secure MyShopStock. The customer is responsible for giving its team members any notices required for its use of the service. We will support data requests about customer workspace records through the customer’s authorised business administrator where appropriate.

3. Information we handle

• Account and sign-in details: name, email address, password hash, sign-in provider identifier and session/security information. If Google sign-in is enabled and used, Google provides the account name, email address and Google account identifier needed to authenticate you.
• Business and team details: business and shop names, branch areas, team member names and email addresses, roles, shop access, invitations and account status.
• Stock-room records: product names, categories, SKUs, barcodes, supplier pack and stock units, supplier contact details, quantities, stock movements, references, alerts, lot and expiry information, and records of actions taken in the workspace.
• Technical and security information: session and login events, failed login/rate-limit records, request and diagnostic information used by the hosting platform to operate and protect the service.
• Support correspondence: details you choose to include when contacting us.

MyShopStock is an inventory and replenishment tool. It does not process retail payments or connect to a point-of-sale till. Do not enter payment-card data or personal information about retail customers into the service. If you include personal data in free-text references or supplier records, your business remains responsible for deciding that it is necessary and lawful to do so.

4. Why we use information

• To create and manage accounts, authenticate users, associate them with registered businesses and provide the stock-management features requested. Our basis is performing a contract or taking steps at the customer’s request before a contract.
• To store, display and protect a business’s products, supplier details, branches, stock levels, movements and audit history on that business’s instructions.
• To protect accounts, prevent abuse, troubleshoot faults and maintain the integrity of the service. We rely on our legitimate interests in operating a secure service and, where applicable, legal obligations.
• To respond to support requests and communicate important service or security information. We rely on contract, legitimate interests or legal obligations, depending on the communication.
• To meet legal obligations and establish, exercise or defend legal claims where necessary.

We do not sell personal data or use stock-room records for advertising. We do not make decisions about people with legal or similarly significant effects solely by automated means.

5. Authentication and cookies

The service uses essential cookies to keep users signed in and protect sign-in flows. Session cookies are configured as Secure, HttpOnly and SameSite. A short-lived cookie is used during Google sign-in if that option is enabled. We do not use advertising cookies in the application. The hosting provider may use necessary technical or security mechanisms to deliver and protect the site.

Google sign-in uses Google’s authentication service and the basic OpenID Connect identity scopes (openid, email and profile). It does not grant MyShopStock access to a user’s Gmail, Drive or other Google Workspace content.

6. Who may receive information

Workspace information is available to the customer’s authorised users according to the roles and shop access set by that customer. We use infrastructure providers to host and operate the application and database, including OpenAI Sites and Cloudflare. If Google sign-in is enabled, Google processes sign-in information as part of its authentication service. We may also disclose information to professional advisers, law-enforcement or regulatory authorities where needed to comply with law, protect rights or respond to a valid request.

Service providers may process information in countries outside the UK. Where required by data protection law, appropriate transfer safeguards will be used. You can contact us for information about the safeguards relevant to a particular transfer.

7. How long we keep it

We keep account information while the account is active and for as long as it is needed to provide the service, handle support, meet legal obligations, resolve disputes or protect the service. Workspace stock and activity records are kept while the customer workspace is active, unless the customer instructs us otherwise or a legal or security need requires longer retention.

When a business closes its workspace or asks us to delete information, contact us at [email protected]. We will arrange deletion or return of information where applicable, subject to legal retention duties, security records and removal of any residual copies held in service-provider backups. Retention periods may vary according to the type of record and the reason it is held.

8. Security

We use safeguards appropriate to the service, including password hashing, hashed session tokens, secure session cookies, role-based access and server-side checks that keep each business’s workspace separate. No internet service can be guaranteed to be completely secure. Customers should use strong, unique passwords, invite only authorised team members and promptly remove access that is no longer needed.

9. Your rights and complaints

Depending on the circumstances, UK data protection law gives individuals rights to request access to or correction/deletion of personal data, restriction or objection to certain processing, and data portability. Where we process data for a business customer, contact that business first about information in its workspace; we will assist the customer as required. For information we control, contact us at [email protected].

You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. We would appreciate the chance to address your concern first.

10. Changes and contact

We may update this policy when the service or our data practices change. The revised version and its effective date will be published on this page. For privacy questions, data requests or concerns, contact [email protected] or write to CERTISYT GROUP LTD at its registered office stated above.