wooms

GDPR overview

Implementation is concrete rather than declaratory. wooms WMS GmbH names itself as controller at its Berlin address, has appointed a data protection officer reachable at datenschutz@wooms.io, and dates both documents openly: the privacy notice was last updated on 19 June 2026 and the terms on 28 May 2026. Data subject rights under Articles 15 to 21 are listed one by one. A processing agreement under Article 28 is supplied when the contract is signed, and any material change to the subprocessor list triggers thirty days' notice and a right to terminate. Third parties are named: Google, Zipy, LinkedIn, Spotify, OpenAI and Shopify, with standard contractual clauses covering US transfers. Security measures include encryption in transit and at rest, administrator MFA, daily backups and 72-hour breach notification. Minimum age: 16.

Who owns the data?

The terms are unusually direct on this point. Under clause 8.3, the customer keeps every right to the data they enter into the software, and wooms receives only the right to use that data to deliver the agreed service. Clause 2.4 backs this with permanently free export functions in CSV and JSON, so the data can be taken out at any time without asking. When a contract ends, clause 6.4 gives the customer thirty days of full export access before everything is irreversibly deleted, apart from records German commercial and tax law requires the vendor to keep. Written confirmation of that deletion is issued on request within fourteen days. For the branded returns portal, wooms acts only as a processor and the Shopify merchant remains the controller.

Reuse rights

Customers may reuse their own data freely: they hold the rights to it, the export functions are free and permanent, and the formats are open (CSV and JSON), so no permission request is involved. What wooms may do with that data is narrower. The privacy policy names the purposes it claims: running and optimising the warehouse management functions, improving the AI-assisted picking algorithms, analysing warehouse performance, synchronising with Shopify and other commerce platforms, and handling returns and quality control. In the returns portal, order details and chat input are sent to OpenAI's GPT-4o mini under an Article 28 processing agreement, and the policy states that OpenAI does not use that data to train its own models. Nothing on the site documents a way for a customer to exclude their own data from wooms's algorithm improvement work.

Data retention & training

Hosting summary

The clearest statement comes from the vendor's own llms.txt file, which says the service runs on AWS cloud infrastructure with servers in Germany and the EU, and describes itself as GDPR compliant. The terms of service corroborate the provider by naming AWS as the cloud infrastructure supplier whose price rises may be passed on. Beyond that, the evidence thins: the privacy notice never names a hosting country for wooms itself, and its references to servers in the United States all concern third parties - Google for Analytics, reCAPTCHA, Maps and YouTube, Zipy for session recording, and OpenAI for the returns assistant - each covered by standard contractual clauses. Transfers outside the EEA are permitted only where an adequate level of protection is ensured. The jurisdiction is German throughout: German law governs the contract, Berlin is the exclusive venue, and the marketing website itself resolves to a server in Frankfurt. Buyers with strict data residency requirements should ask for written confirmation of the hosting region, since a single marketing file is thin ground for a contractual commitment.