Sendo AS

Privacy Policy

Last updated: 14 October 2026

This privacy policy explains how Sendo AS collects, uses, shares, protects and deletes personal data when you use our website, the Sendo platform, or one of our integrations: Sendo Connect for Shopify and Sendo One for WooCommerce. We process personal data lawfully, securely and transparently, in compliance with the EU/EEA General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act.

1. Who we are

Sendo AS is a Norwegian company that provides software for booking, managing and tracking shipments. Sendo is a tool: shipments are booked with the carriers you connect, under your own or our partners’ carrier agreements. Our websites include sendo.no and the Sendo platform. Sendo AS is the data controller for the data described in this policy, except where we process order data on behalf of a merchant — then the merchant is the controller and Sendo AS the processor.

2. What personal data we collect

We collect only the personal data needed to provide the service you have asked for.

When you use the Sendo platform

  • Company name and organisation number
  • Name, e-mail address and phone number of contact persons and users
  • Billing and shipping addresses
  • Shipment information: sender, recipient, package details and tracking data
  • Technical information such as IP address, browser type, device information and log data
  • Communication history and support requests

Sendo Connect for Shopify

When a merchant installs Sendo Connect, we receive data through Shopify’s APIs to create and book shipments:

  • Through Shopify APIs: shop domain, store contact e-mail, order numbers, recipient name, delivery address, phone number, e-mail address, order line items, product weight, parcel dimensions and fulfillment status.
  • Directly from the merchant: the link to the merchant’s Sendo account, contact person details, shipping configuration, and system and error logs within the app.
  • Not from the merchant’s customers: Sendo Connect does not collect personal data directly from storefront buyers. We set no tracking cookies, run no behavioural analytics scripts and do not log how buyers browse the store.

Sendo One for WooCommerce

When a WooCommerce store is connected to Sendo, we receive the data needed to create and book shipments:

  • Store URL, API keys or access tokens, and technical connection details
  • Order information: products ordered, quantities, prices, order date and order status
  • Customer name, delivery address, e-mail address and phone number of the recipient
  • Product, weight, shipping method and package information
  • Payment status (paid or not, and the payment method). We never receive or store card numbers or other payment details
  • Shipment status, tracking numbers and error logs

Newsletter

If you subscribe to our newsletter, we store your e-mail address for that purpose only. You can unsubscribe at any time, and your address is deleted automatically 30 days after you unsubscribe.

3. How we use personal data

We process personal data for these purposes:

  • To create shipping labels and book shipments with the carriers you use, through the Sendo platform
  • To send tracking numbers and fulfillment status back to your store (Shopify or WooCommerce) and to notify recipients about their shipment
  • To operate, secure and improve the Sendo platform and our integrations
  • To communicate with you and provide customer service and technical support
  • To comply with legal obligations, including accounting and bookkeeping requirements

We do not sell, rent or monetize personal data, and we never use it for marketing to recipients, advertising, profiling or behavioural tracking. We do not make automated decisions with legal or similarly significant effects. Where a customer’s consent decision is passed to us by a store, we respect it. The legal bases for our processing are the performance of a contract, our legitimate interest in operating and securing the service, and legal obligations.

4. Who we share personal data with

We share personal data only when it is necessary to provide the service, and only with:

  • Carriers: the carrier you book a shipment with (for example Bring, PostNord, Schenker, Norlines, Helthjem, Instabee or Porterbuddy) receives the sender and recipient details needed to deliver the parcel.
  • Your store platform: Shopify or WooCommerce receives tracking numbers and fulfillment status for your orders.
  • Hosting and e-mail providers: our hosting and database providers, with data centres in the EEA, and our provider of transactional e-mail (shipment and account notifications). They process data on our behalf under data processing agreements.

Personal data is not transferred outside the EEA. We never share personal data with third parties for their own marketing.

5. Storage and security

All personal and shipment data is stored and processed exclusively on secured servers located within the EEA. We protect it with technical and organisational measures that include:

  • Encryption in transit: all traffic between your browser, your store, Shopify, the carriers and Sendo uses TLS/HTTPS.
  • Encryption at rest: databases and database backups are encrypted at rest. Shopify and WooCommerce access tokens are additionally encrypted with AES-256-GCM before they are stored.
  • Separate test and production environments: test and production data are kept in separate systems with separate credentials.
  • Restricted staff access: only staff who need it to provide support can view customers’ personal data. Staff accounts require strong passwords.
  • Access logging: every time Sendo staff view or export end-customer personal data, the access is recorded in an access log.
  • Incident response: we have a security incident response procedure, and we notify affected merchants and the authorities as required by the GDPR.

6. Retention and deletion

We keep personal data only as long as necessary to provide the service, resolve delivery disputes and meet legal requirements. Shipment records are kept for five years because the Norwegian Bookkeeping Act requires transport documents to be retained, but the personal data in them is anonymised when a deletion request is received. When you uninstall Sendo Connect, the store’s access tokens are made unusable immediately, and the remaining store data is deleted when Shopify sends the shop redaction request (see section 8). When a WooCommerce store is disconnected, its access tokens are revoked. Data that is no longer needed is deleted securely.

7. Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you
  • Have incorrect or incomplete data corrected
  • Have your personal data deleted when it is no longer needed
  • Restrict or object to certain processing
  • Receive the data you have provided in a machine-readable format (data portability)
  • Lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) or your local supervisory authority

To exercise your rights, contact us at post@sendo.no. We reply free of charge within 30 days. If you are a customer of a store that uses Sendo, you can also contact the store directly; we assist the store in responding.

8. Shopify’s mandatory privacy webhooks

Sendo Connect implements the three privacy compliance webhooks Shopify requires of every app:

  • Customer data request (customers/data_request): we record the request and provide the merchant with all stored personal data about the customer, so the merchant can respond within the 30-day deadline.
  • Customer redact (customers/redact): we anonymise the customer’s personal data within 30 days. The shipment records themselves are kept without personal data, as required by Norwegian accounting law.
  • Shop redact (shop/redact): Shopify sends this request 48 hours after the app is uninstalled. We then delete the store’s settings and access tokens and anonymise its customers’ personal data, keeping only what the law requires us to retain.

The same rights apply to WooCommerce stores and their customers; requests are handled through post@sendo.no.

9. Cookies

Our website (sendo.no) uses cookies to remember your language choice and, through Google Tag Manager, to analyse how the site is used so we can improve it. You can manage or block cookies in your browser settings.

Sendo Connect uses only strictly necessary session tokens to authenticate the merchant within the Shopify admin, in line with Shopify App Bridge. Neither Sendo Connect nor Sendo One sets cookies in the merchant’s storefront or checkout, and we use no third-party tracking or advertising cookies.

10. Changes to this policy

Updates to this policy are published on this page with a new date. Significant changes are communicated directly to our customers. Changes apply from the date they are published.

11. Contact

If you have questions about this privacy policy or how we process personal data, or wish to exercise your rights, contact us:

Sendo AS
Org. no: 995601540MVA
Granlunden 11, 4018 Stavanger, Norway
E-mail: post@sendo.no