Use the information needed for the customer’s task

Start with a purpose checklist

For a Shopify campaign, the question is not how much information is available but what is necessary to fulfill and explain the offer.

• Identify why each category of customer information is needed.
• Confirm who needs access for that purpose.
• Keep unnecessary personal information out of reports and routine correspondence.
• Assign retention and deletion responsibilities under the applicable requirements.
• Define who receives a suspected information-handling concern.

Keep sensitive card information out of ordinary workflows

Do not copy full card numbers, security codes, or authentication credentials into Shopify notes, campaign messages, ordinary email, or general support records. Card-sensitive tasks belong in the responsible service’s appropriate environment.

Coordinate when something goes wrong

The merchant and program parties should know who handles an incident, who communicates with affected people where required, and how responsibilities are coordinated. A website statement does not establish a security certification or replace the actual program’s controls.