Privacy Policy — Skybooks E-commerce

Effective date: 1 November 2025

Last updated: 2 September 2026

1. Who we are

Skybooks E-Commerce is an e-commerce accounting application operated by:

Multihub SIA, trading as Skybooks

Registration No. 50203639171

VAT No. LV50203639171

Sesavas street 8, Jurmala, LV-2008, Latvia

Email: info@skybooks.lv

Telephone: +371 20187773

Accounting service licence No. AGL0003687

Multihub SIA is the data controller for the personal data described in this policy.

This policy applies to the Skybooks E-Commerce application at https://connect.skybooks.lv and to the connections it makes to Etsy and other sales channels. A separate notice applies to our website at skybooks.lv.

Our contact point for all data protection matters, including requests to exercise your rights, is info@skybooks.lv.

2. Who can use Skybooks E-Commerce

Skybooks E-Commerce is available to Skybooks accounting clients. Accounts are created by Skybooks and the application is provided as part of the accounting services agreed under a separate engagement agreement. It is not sold as a standalone subscription.

3. What data we process

3.1 Account data

Name, business name, business registration and VAT numbers, email address, telephone number, and login credentials.

3.2 Etsy shop data

When you authorise Skybooks E-Commerce through Etsy, we retrieve the following for the shop you authorised:

Shop identification data (shop ID, shop name)
Orders and sales transactions, including line items
Transaction dates, amounts and currencies
Payments, settlements and payouts
Refunds and cancellations
Etsy marketplace fees and charges
Tax and VAT amounts, and the customer's country or region where required for VAT and OSS determination

Etsy order records may contain personal data relating to your buyers, including buyer names, delivery countries and, where present in the record, delivery addresses. We process this only as it appears in the accounting records we import, and only for the purposes in Section 4.

3.3 Authorisation data

The OAuth access and refresh tokens issued by Etsy when you authorise the connection. These are stored encrypted and used solely to retrieve the data described above.

3.4 Technical data

Server logs, IP addresses, browser type, access timestamps and actions taken in the application, kept for security and troubleshooting.

We never collect or store your Etsy password. Authentication takes place on Etsy's own systems.

4. Why we process it, and our legal basis

Purpose	Legal basis (GDPR Article 6)
Providing the application and importing your sales data	Performance of a contract — Art. 6(1)(b)
Bookkeeping, reconciliation and financial reporting	Performance of a contract — Art. 6(1)(b)
Preparing VAT, OSS and other tax filings on your behalf	Performance of a contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c)
Retaining accounting records for statutory periods	Legal obligation — Art. 6(1)(c)
Customer due diligence and record-keeping under anti-money-laundering law	Legal obligation — Art. 6(1)(c)
Securing the application, preventing misuse, investigating incidents	Legitimate interests — Art. 6(1)(f)
Service communications about your account	Performance of a contract — Art. 6(1)(b)

Where buyer personal data appears in imported order records, we process it under Art. 6(1)(c) and Art. 6(1)(f), on the basis that it forms part of accounting records we are engaged and legally required to maintain.

5. What we do not do

We do not sell Etsy member data or any other personal data.
We do not share Etsy data with advertising networks or use it for advertising, profiling or marketing.
We do not use Etsy data to contact your buyers.
We do not use screen scraping. All Etsy data is obtained through Etsy's official API with your authorisation.
We do not request Etsy permissions beyond those needed to deliver the functions described here.
We do not permit any client to access another client's data.

We disclose personal data only to:

Infrastructure and service providers acting on our instructions under written contracts, listed in Section 7.
Our IT service provider, who maintains the application under a written data processing agreement.
The Latvian State Revenue Service (VID) and other competent authorities, where we submit filings on your behalf or are required by law to disclose information.
Professional advisers such as auditors or legal counsel, under a duty of confidentiality.

We do not otherwise transfer your data to third parties.

7. Where your data is held

Skybooks E-Commerce and its database run on infrastructure provided by Fly.io, Inc., in a data centre region located within the European Union. Backups are held in the same region.

Fly.io, Inc. is incorporated in the United States. Although your data is stored and processed on servers inside the EU, Fly.io is a US-established provider, so its involvement constitutes a transfer of personal data to a third country within the meaning of the GDPR. That transfer is covered by a data processing agreement with Fly.io and by Fly.io's participation in the EU–US Data Privacy Framework.

We currently use no other sub-processor. If we add one, we will update this section before it begins processing your data.

8. How long we keep data

Accounting source documents and transaction records: retained for the periods required by Latvian accounting legislation — at least 5 years for supporting documents, and 10 years for annual reports.
Anti-money-laundering records: retained for 5 years following the end of the business relationship.
Account data: retained for the duration of the business relationship, then deleted, subject to the statutory periods above.
OAuth tokens: deleted immediately when you disconnect your Etsy shop, revoke access via Etsy, or when your account is closed.
Server logs: 12 months.

Data we are legally required to retain cannot be deleted on request until the retention period expires.

9. Your control over the Etsy connection

You authorise Skybooks E-Commerce yourself, through Etsy's own authorisation process, and you decide whether to grant the permissions requested.

You can withdraw that authorisation at any time, using the Disconnect function in Skybooks E-Commerce or through Etsy's Connected Apps settings. Once access is revoked, we can no longer retrieve any new information from your shop.

Data already imported may be retained where it forms part of accounting records we are required to keep, or where it is needed to complete services already agreed.

10. Your rights

You have the right to access the personal data we hold about you, have inaccurate data corrected, have data erased where no legal retention obligation applies, restrict or object to processing in certain circumstances, receive your data in a portable format, withdraw consent where processing rests on consent, and lodge a complaint with a supervisory authority.

To exercise any of these, contact info@skybooks.lv. We will respond within one month.

Our supervisory authority is the Data State Inspectorate (Datu valsts inspekcija), Elijas iela 17, Riga, LV-1050, Latvia, https://www.dvi.gov.lv. If you are located in another EU or EEA country, you may also complain to your local authority.

11. Security

We apply technical and organisational measures appropriate to the risk, including:

Encryption of data in transit (TLS) and encryption of OAuth tokens at rest
Server-side-only handling of Etsy credentials and tokens; tokens are never exposed to the browser or written to logs
Role-based access controls and enforced separation between clients' data
Logging and monitoring of access to the application
Regular encrypted backups

No system can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the Data State Inspectorate and, where required, you, in accordance with the GDPR.

12. Cookies

Skybooks E-Commerce uses only cookies that are strictly necessary for the application to function, such as maintaining your login session. We use no advertising cookies, no third-party tracking and no analytics.

13. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you by automated means.

14. Changes to this policy

We may update this policy. The current version is always published at https://connect.skybooks.lv/privacy with the date of the last update. Where changes are material, we will notify you by email.

15. Contact

Multihub SIA (Skybooks)