Privacy policy

Last updated 6 August 2026. PPWR Compliance.com is operated by Hawkins Tech Inc ("we"). Contact: andy@hawkins.app.

What PPWR Compliance.com does with data

PPWR Compliance.com computes packaging weight declarations that merchants owe under EU Extended Producer Responsibility rules. To do that we process order information belonging to the merchants who use us. We act as a processor on the merchant's behalf for this data.

What we process, and what we keep

From an uploaded order export or a connected Shopify store we read: order date, fulfillment status, destination country, and item count. Files may contain more (names, emails, addresses). We discard those fields during parsing. What we store per order is: a hashed order reference, the date, the ISO country code, and the item count. No customer name, email, street address, phone number, or order value is ever written to our systems.

Retention

• Free analyses: deleted 30 days after creation.
• Purchased declaration packs: retained 400 days so you can retrieve them through a filing year, then deleted.
• Connected Shopify stores: synced order aggregates are deleted immediately on app uninstall, and the store record is deleted entirely on Shopify's shop-redact notice.

Security

All traffic is encrypted in transit (TLS). Shopify access tokens are encrypted at rest. Backups are encrypted. Access to production systems is limited to operator staff and is logged.

Payments

Payments are handled by Stripe. We receive the payer's email address from Stripe to associate the purchase with the report; we do not receive or store card details.

Subprocessors

• DigitalOcean, LLC: cloud hosting.
• Stripe, Inc.: payment processing.
• Shopify Inc.: order data source, for merchants who install our Shopify app.

Your rights

We do not sell data, run advertising, or profile individuals. Merchants can request deletion of their data at any time via andy@hawkins.app. For personal data of a merchant's customers, note that we hold none in identifiable form; requests under GDPR or similar laws should go to the merchant as controller, and we honour Shopify's data request and redaction webhooks automatically.