Privacy Policy

Shopium ("we," "our," or "us") is an e-commerce platform headquartered in Tunisia. We operate the Shopium website, merchant dashboard, and associated services (collectively, the "Platform"). This Privacy Policy applies to all merchants, administrators, and visitors who interact with the Platform.

We collect and process personal data only as necessary to provide our services, improve the Platform, and comply with our legal obligations under Tunisian law, including the provisions of Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data, as administered by the Instance Nationale de Protection des Données Personnelles (INPDP).

We do not sell your personal data to third parties. We do not use your data for purposes beyond what is described in this policy without first obtaining your explicit consent.

We collect information in three ways: directly from you when you register or use the Platform, automatically as you interact with our services, and from third parties where applicable.

When you subscribe to a paid Shopium plan, we collect billing information necessary to process your subscription payment. This includes your name, billing address, and payment method details.

We retain billing records and invoices for a minimum of 5 years in accordance with Tunisian accounting and tax regulations. Payment history is accessible at any time from your account dashboard under Settings → Billing.

• Subscription invoices are emailed to your registered address automatically on each billing cycle.
• We do not share your payment details with any party other than our payment processor and tax authorities where legally required.
• In the event of a failed payment, we may contact you using your registered email or phone number to resolve the issue.

Shopium uses cookies and similar tracking technologies on both the Shopium platform and on merchant storefronts to ensure proper functionality, improve performance, and provide relevant analytics and marketing insights.

Essential cookies are strictly necessary for the Platform to function and cannot be disabled. Analytics and marketing cookies are optional and activated only with your consent, which you can manage at any time through the cookie preferences banner displayed on first visit.

The Shopium platform integrates with a number of third-party services to deliver its full feature set. Each of these third parties operates under their own privacy policies and data practices. We encourage you to review their policies.

All third-party processors we engage are bound by data processing agreements (DPAs) that require them to handle your data securely, process it only for the purposes specified, and not transfer it to unauthorised parties.

We do not sell, rent, or trade your personal data. We share your information only in the following limited circumstances:

• Service providers: We share data with vetted third-party providers (hosting, payment, email, analytics) strictly to operate and improve the Platform, as described in Section 05.
• Legal obligations: We may disclose your data when required to do so by Tunisian law, court order, or a competent governmental authority, including the INPDP.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to the same privacy protections.
• With your consent: We will share your data with any other party only if you have given us explicit, informed consent to do so.
• Aggregated analytics: We may share anonymised, aggregated statistical data (e.g. total number of active stores in a region) that cannot be used to identify any individual.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. Our key security practices include:

• All data in transit is encrypted using TLS 1.2 or higher (HTTPS across all Platform endpoints).
• Data at rest is encrypted using AES-256 encryption on all production databases and file storage.
• Access to personal data is restricted to authorised Shopium personnel on a strict need-to-know basis, enforced through role-based access controls.
• Regular automated backups are performed and stored in geographically redundant locations.
• We conduct periodic security audits and vulnerability assessments of our infrastructure.
• Passwords are hashed using a strong one-way algorithm (bcrypt) and are never stored in plaintext.
• Two-factor authentication (2FA) is available and strongly recommended for all merchant accounts.

In the event of a personal data breach that poses a risk to your rights, we will notify you and the INPDP without undue delay, and no later than 72 hours after becoming aware of the breach, in accordance with applicable law.

Under Tunisian law and our own commitment to transparency, you have the following rights regarding the personal data we hold about you. To exercise any of these rights, contact us at privacy@shopium.tn. We will respond within 30 days.

If you believe your privacy rights have been violated and we have not adequately addressed your concern, you have the right to lodge a complaint with the Instance Nationale de Protection des Données Personnelles (INPDP) at www.inpdp.nat.tn.

Shopium is the data controller for personal data collected through the Platform. For any privacy-related questions, data requests, or concerns, please contact our Privacy team:

• Email: privacy@shopium.tn
• Subject line: "Privacy Request. [Your Name]"
• We aim to acknowledge all requests within 5 business days and resolve them within 30 days.