New Common for Brands: Privacy Policy

This policy covers brands that use the New Common app for Shopify and the Brand Panel. Our Brand Terms, with their Data Processing Agreement, are the contract; this page summarises them. Shoppers are covered by our Privacy Policy.

Who we are. Nine One Edition General Trading - FZCO, trading as NEW////COMMON, license no. 87746, Dubai Integrated Economic Zones Authority, IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates. Contact: naman@newcommon.com.

Our roles

• Your team's details: we are the controller.
• Your customers' data that reaches us from your store: you are the controller, and we are your processor (under India's DPDP Act, you are the Data Fiduciary and we are your Data Processor), as set out in the Data Processing Agreement in our Brand Terms.
• Our records of sales made through New Common: we also keep these for our own accounting and legal claims, as a separate controller.

What we collect

• About your team: names, work emails, roles, sign-in records and the record that your business accepted our Brand Terms. Legal basis: our legitimate interest in running our relationship with your business, or our contract with you. We need these details to give your team access to the Service.
• From your store, through the app: store details, your catalog, and the order and visit information we need to report the results New Common brings you. We do not keep your customers' names, contact details, or addresses.

We use this only to list your products, report results to you, and run the Service. We do not sell it, use it for advertising, contact your customers, access your payouts, or use it to train AI models.

How long we keep it

• While the app is installed, we keep what we need to run the Service.
• When you uninstall, your products come off New Common, and we delete your store's data when Shopify instructs us, 48 hours later.
• We keep records we need for accounting for as long as tax law requires (currently up to 7 years), and records we need to defend a legal claim until the claim period ends.
• Your team's details are deleted when you ask us, or once we no longer need them, unless the law requires us to keep them.

Who processes it for us

Service providers who host, run, maintain, and send email for New Common. They act only on our instructions and under written terms. We can provide a current list on request, and we give installed brands 30 days' notice before adding one that handles your customers' data. We and our providers may process data outside your country; where the law requires it, we protect transfers with the European Commission's standard contractual clauses and the UK Addendum. Email us for a copy.

Security

We use encryption, access controls and logging appropriate to the data, and we will tell you without undue delay if a breach affects your data.

Your rights

You can ask to see, correct, delete or restrict your data, or to take a copy elsewhere. You can object at any time to any use based on our legitimate interests. Email naman@newcommon.com; we reply within 5 business days. You can also complain to us, or to your data protection authority.

Changes

We will tell installed brands about significant changes in the app or the Brand Panel by email.