SERVICE INFORMATION · Updated 23 October 2026

Privacy policy

Who operates this service

UnyMarket is provided by ARTHEON SOLUTIONS GROUP S.L., Spanish tax identifier B23982978, represented for service enquiries by José Antonio Toledo Reyes, Calle Patinillos 27, 41658 Martín de la Jara, Seville, Spain. Contact: contact@unymarket.com.

For merchant account administration, service security and our own contractual records, the provider acts as controller. For a merchant's customer and order information, the merchant normally acts as controller and UnyMarket processes the information on that merchant's documented instructions. This policy does not replace a merchant's customer privacy notice or the applicable data processing agreement.

Information and purposes

With the merchant's authorization, connected commerce platforms may provide order identifiers, items, quantities, prices, customer names, addresses, telephone numbers, email addresses, tax details, delivery instructions and personalized product information. UnyMarket uses the permitted fields to manage the catalogue, prepare orders, obtain shipping documents, reconcile tracking, display returns or exceptions and maintain the merchant's accounting records.

Account information, roles, authentication factors, connection credentials and limited security metadata support access control, fraud prevention, diagnostics and recovery. Customer information is not sold, used for unrelated marketing, or used to train general-purpose AI models. Only the scopes and functions available for the merchant's authorized connection are used.

Legal grounds and instructions

The provider processes account and service information to perform the service agreement, meet applicable legal obligations and protect the service under its legitimate interests. Customer information is processed under the merchant's instructions and the relevant platform agreement. Merchants must have an appropriate legal basis and provide required notices before connecting their shops.

Recipients and hosting

The application and its PostgreSQL database run on a managed-by-us Hostinger VPS in Frankfurt, Germany. Each installation has its own database, credentials and storage. The central connection service routes signed notifications and authorization returns to the registered merchant instance. Temporary notification contents and application credentials held by that service are encrypted and access restricted. Hostinger supplies the infrastructure. Authorized shipping integrations, including Envia and Packlink, receive the recipient and parcel information needed for the shipment selected by the merchant. Connected marketplaces receive the operational updates permitted by their APIs.

Carrier and platform recipients depend on the merchant's connections and chosen service. Access is limited to authorized operators and necessary service providers. Public image assets do not receive customer order data. The subprocessor register and applicable processing agreements are available from the contact address. Transfers outside the EEA require an assessed transfer mechanism and any required contractual safeguards before that processing is enabled.

Retention and deletion

For Amazon order data, the platform policy requires deletion of buyer personal information no later than 30 days after confirmed delivery, unless specific law requires a narrowly limited retention for that legal purpose. UnyMarket supports that delivery-based deadline. A stored 30-day setting is not an active deletion rule: the operator must enable the rule and verify its execution for the relevant merchant. Non-personal item references, quantities, amounts and reconciliation states can remain after personal-data deletion.

The service operator manages retention separately for each merchant and platform through Control. Rules can use confirmed delivery, first collection or documented termination of the service. Automatic erasure, raw-message minimization and backup pruning are disabled by default until explicitly enabled. Disabling a rule preserves the information; ignoring a reminder does not erase it. The operator must configure and review retention in accordance with applicable law, platform agreements and documented instructions. A setting does not override those obligations.

Verified rights requests may result in a separately reviewed deletion. Personal-data erasure removes customer contacts, addresses and associated shipping documents while retaining non-personal amounts, item references and reconciliation states. Legal exceptions must identify their precise basis, purpose and expiry. Security evidence is retained for at least 12 months. A failed connection to Control prevents automatic erasure rather than reusing an old enabled policy.

Recovery copies are encrypted and access restricted. A separate erasure journal is replayed before a restored application opens, so restoring an older copy does not undo a completed deletion. Backup rotation and removal of copies predating an erasure are separately controlled and recorded. Copies in external custody are reconciled when that authorized device is connected.

Your rights

Contact the merchant that handled your order, or write to contact@unymarket.com and identify the merchant and relevant order reference. Depending on the circumstances, you may request access, correction, deletion, restriction, portability or object to processing. We verify the requester's identity proportionately, coordinate with the controller, and respond within the applicable deadline. Do not email passwords, authentication codes or a full identity document unless a secure verification process specifically requires it.

You can raise a concern with the competent supervisory authority, including the Spanish Data Protection Agency at aepd.es. No decision with legal or similarly significant effects on a buyer is made solely by an automated UnyMarket decision process.

Cookies and changes

The application uses necessary session and interface-preference storage. This installation does not add advertising trackers. Material policy changes are recorded with a new effective date and communicated through the service or account contact when required.