Privacy Policy

Controller

shopware AG takes the protection of personal data seriously and operates the Agentic Commerce Alliance and the Agentic Commerce Maturity Index (ACMI).

Controller responsible for data processing

Data Protection Officer

Data we process

Website delivery and security

When you access ACMI, the systems used to deliver and protect the website may process connection and usage data such as your IP address, requested URL, date and time, referrer, browser, device information, and technical error data. This is necessary to deliver the service, maintain availability, and detect misuse or security incidents.

Anonymous visitor cookie

ACMI uses one essential, first-party visitor cookie named __Host-acmi_visitorin production. It contains a random credential that lets the service associate assessments with your browser and restore the assessments available on that device. The raw credential remains in your browser; only a cryptographic hash is stored in the database. The cookie is HttpOnly, Secure, SameSite=Lax, and expires after one year.

Assessment and result data

When you use ACMI, we store an assessment identifier, assessment status and timestamps, your selected answers, the content version used, and the calculated overall and pillar results. You can complete the assessment and view your result without providing your name or email address.

Before showing your result, the assessment asks for your company's country, industry, and size band. We store these with the assessment and use them only to compare results against companies of a similar kind. They are not passed to our customer relationship management system.

Share links

Every completed result has its own share link, containing a random token. Anyone who has the link can view the result and the selected answers, and download the report and the pillar guide, without signing in. A shared result does not include your country, industry, company size, name, or email address. We do not publish the link; it reaches others only if you or someone you sent it to passes it on. The link does not expire. If you want it to stop working, ask us to erase the assessment (see Your rights).

The Agentic Commerce Brief

The results page offers an optional monthly brief from the Agentic Commerce Alliance. If you subscribe, we process your email address and your consent to receive the brief, in order to send it to you. Your subscription is not linked to your assessment or your result. Every issue contains a link to unsubscribe.

Alliance membership application

The results page offers an optional application to join the Agentic Commerce Alliance. It is never required to take the assessment or to see your result. If you choose to apply, we process the details you enter in that form: whether you apply as a merchant or a vendor, your first and last name, your email address, your role at the company, and your company's name, website, size, and a short description of what it sells.

The application is submitted directly from your browser to the Alliance website atwww.agentic-commerce.org and is managed there. shopware AG operates both the Alliance and ACMI, so this is not a disclosure to a separate controller; it is the same controller processing your application for a different purpose. ACMI itself does not store the contents of the application.

Product events

ACMI records server-side product events to understand whether the assessment works as intended—for example, that an assessment was started, an answer was saved, or a result was completed. These events use anonymous or assessment-scoped identifiers. Raw email addresses, company names, and free-text profile fields are excluded.

Opening and submitting the Alliance membership form are recorded as product events as well, so that we can tell how the results page performs. Those events carry only whether the application was as a merchant or a vendor and the selected company size band. Your name, email address, company name, website, and description are not included.

Messages you send us

If you contact us by email, we process your contact details, the contents of your message, and related correspondence so that we can answer your request.

Purposes and legal bases

• Providing ACMI and its recovery features: Art. 6(1)(b) GDPR where processing is necessary to provide the service you request, and Art. 6(1)(f) GDPR for our legitimate interest in operating a reliable, secure assessment.
• Essential visitor cookie: § 25(2) no. 2 TDDDG because it is strictly necessary to provide the assessment and device-based recovery requested by you.
• Security, diagnostics, and pseudonymous product measurement: Art. 6(1)(f) GDPR, based on our legitimate interests in protecting the service, resolving faults, and understanding whether the assessment flow functions effectively.
• The Agentic Commerce Brief: Art. 6(1)(a) GDPR, based on your consent. You may withdraw it at any time with effect for the future, for example through the unsubscribe link in every issue.
• Alliance membership application: Art. 6(1)(b) GDPR to take steps at your request prior to membership and to administer it, and Art. 6(1)(f) GDPR for our legitimate interest in operating the Alliance's membership process.
• Responding to inquiries: Art. 6(1)(b) GDPR for pre-contractual or service-related requests, or Art. 6(1)(f) GDPR for our legitimate interest in responding to other inquiries.
• Legal obligations and claims: Art. 6(1)(c) GDPR where retention or disclosure is required by law, and Art. 6(1)(f) GDPR where necessary to establish, exercise, or defend legal claims.

Recipients and transfers

Personal data is available only to the teams and service providers that need it for the purposes described above. These may include providers for website hosting, databases, infrastructure, email delivery, monitoring, security, and professional advice. Processors act under data processing agreements in accordance with Art. 28 GDPR.

Amplitude product analytics

If the optional server-side analytics forwarder is enabled, pseudonymous product events may be sent to Amplitude, Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA, using its EU endpoint. ACMI does not load the Amplitude browser SDK and does not set Amplitude cookies. Transfers outside the EU/EEA are protected using an adequacy decision where available, including the EU–US Data Privacy Framework, or the European Commission's Standard Contractual Clauses and supplementary safeguards as required.

Counting landing-page visits

When the ACMI landing page is opened, the browser reports that one view to our own API. No cookie is set and no data is stored in the browser for this. To tell one visit from another on the same day, the server computes a one-way hash of the request's IP address, the browser's user agent string and the website address, combined with a random value that changes every day. The IP address and user agent are used for that calculation only and are never stored; the daily random value is deleted after two days, after which the visit identifiers of that day cannot be reproduced by anyone, ourselves included. The result is that visits can be counted for one day, and cannot be linked to a person, to another day, or to any other website. The legal basis is our legitimate interest in knowing how the service is used, Art. 6(1)(f) GDPR.

HubSpot customer relationship management

Membership applications submitted through the Alliance are processed in HubSpot, the customer relationship management platform used to administer Alliance membership and the contact that follows from it. The portal is configured for data hosting in the European Union (Frankfurt, Germany), so application data is stored within the EU.

If you subscribe to the Agentic Commerce Brief, your email address is stored in HubSpot as a contact so that the brief can be sent to you. Nothing else is transmitted: not your assessment, your answers, your result, or the country, industry, and company size the assessment asked for.

HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA acts as a processor under a data processing agreement in accordance with Art. 28 GDPR. Where administration, support, or sub-processors require access from outside the EU/EEA, that access is protected using an adequacy decision where available, including the EU–US Data Privacy Framework, or the European Commission's Standard Contractual Clauses and supplementary safeguards as required.

Applying does not by itself subscribe you to marketing, including the brief. Subscribing is a separate choice, based on your consent, which you may withdraw at any time with effect for the future.

Storage and deletion

We retain personal data only for as long as it is needed for the purpose for which it was collected, to preserve the result and recovery functions you request, or to meet legal retention and documentation duties. The anonymous visitor cookie expires after one year. Technical logs are kept only for the period required for security and operations. Contact data is deleted when it is no longer required for the request, for sending the brief you subscribed to, or for applicable legal obligations, such as documenting a consent you gave. Data may be retained longer where necessary for the establishment, exercise, or defence of legal claims.

Your rights

Subject to the conditions of the GDPR, you have the right to:

• request access to your personal data under Art. 15 GDPR;
• request rectification of inaccurate data under Art. 16 GDPR;
• request erasure under Art. 17 GDPR;
• request restriction of processing under Art. 18 GDPR;
• receive data you provided in a portable format under Art. 20 GDPR;
• object to processing based on legitimate interests under Art. 21 GDPR; and
• withdraw consent at any time with effect for the future.

Right to object

Where processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. If personal data is processed for direct marketing, you may object at any time without giving reasons.

Right to complain

You also have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for shopware AG is:

Data security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Measures include encrypted transport, restricted access, pseudonymisation where appropriate, security monitoring, and procedures for handling incidents.

Questions and updates

For questions about this policy or to exercise your rights, contactinfo@shopware.com. General questions about the Alliance or ACMI can be sent toinfo@agentic-commerce.org.

We may update this policy when the service, legal requirements, or our processing activities change. The effective date above identifies the version currently published.

Organizational and controller details are based on the Agentic Commerce Alliance'ssource privacy policy.