Privacy Policy - BM On Demand

PRIVACY POLICY

BMC ON DEMAND – Last Mile
Last Updated: February 3, 2026

‍

1. Introduction

BMC ON DEMAND (the "Application") is a logistics solution developed by Business Mail & Cargo (BM Cargo) that enables the synchronization of orders and delivery statuses between Shopify and BM Cargo's internal systems.

This Privacy Policy explains how personal data is collected, used, stored, and protected when a merchant installs the Application through the Shopify App Store.

‍

2. Data Processing Roles

For the purposes of the General Data Protection Regulation (GDPR) and similar privacy laws:

• The Merchant acts as the Data Controller.
• BM Cargo acts as the Data Processor, processing personal data solely on behalf of and under the instructions of the Merchant.
• Shopify acts as an independent ecommerce infrastructure provider.

‍

3. Personal Data Processed

The Application only accesses the data necessary to provide its logistics functionality.

‍

3.1 Store Data

• Store name
• Store domain
• Store ID
• Administrative email address

‍

3.2 Order and Customer Data

• Customer name
• Email address
• Phone number
• Shipping address
• City/Country
• Order ID
• Tracking number
• Products associated with the order
• Delivery status

The Application does not access or store:

• Payment card information
• Banking information
• Financial credentials

‍

4. Purpose of Data Processing

Personal data is processed exclusively for the following purposes:

• Logistics synchronization
• Tracking generation and updates
• Delivery management
• Technical support
• Compliance with contractual obligations

We do not sell personal data or use it for advertising or marketing purposes.

‍

5. Data Segregation (Multi-Tenant Architecture)

Our infrastructure is designed using a multi-tenant architecture that includes:

• Logical isolation of each merchant's data
• Separate credentials for each store
• Access restrictions based on unique merchant identifiers
• Role-based access controls

‍

6. Data Retention

Personal data is retained:

• While the Application remains installed and active;
• For up to 30 days after uninstallation to complete any pending operational processes;
• Automatically deleted following Shopify's required app/uninstalled webhook.

We comply with Shopify's mandatory privacy webhooks:

• customers/redact
• shop/redact
• customers/data_request

‍

7. Subprocessors

We may use trusted technology service providers, including:

• Amazon Web Services (AWS)
• Monitoring and logging services
• Transactional email service providers

All subprocessors operate under confidentiality agreements and comply with applicable GDPR requirements.

‍

8. International Data Transfers

Personal data may be stored or processed outside the Merchant's country through:

• Standard Contractual Clauses (SCCs)
• Internationally certified cloud infrastructure

‍

9. Data Subject Rights

Depending on the applicable law, individuals may have the right to:

• Access their personal data
• Request correction of inaccurate data
• Request deletion of personal data
• Request data portability
• Request restriction of processing

To exercise these rights or submit a privacy-related request, please contact:

rsanchez@bmacargo.com

‍