PDF Invoices: Privacy
Which personal data the PDF Invoices module for OXID eShop 7.x stores, where it is kept, where it is sent and what happens on deactivation.
PDF Invoices: Privacy
This documentation always describes the latest published version.
The module processes order data to create invoices from it. This page describes which data is kept where. It is a technical description and not legal advice.
Stored data
| Location | Content |
|---|---|
Table mmd_pdfinvoice, column SNAPSHOT_DATA |
Order data at the time of invoice creation as JSON: billing and delivery address, phone, fax, email address, VAT ID, items, totals and payment method |
Table mmd_pdfinvoice, other columns |
Order ID, shop ID, invoice number, invoice date, file path, hash value, sent status with timestamps |
Table mmd_pdfinvoice_seq |
Counter per shop and year, no personal data |
| PDF files in the storage path | The finished invoice with the customer's name and address |
For the payment method direct debit (oxiddebitnote) the snapshot additionally contains the customer's IBAN, BIC or bank code, bank name and account holder. The customer's IBAN is also printed in full on the PDF.
Sending
The module only sends data by email:
- as an attachment of the order confirmation to the customer or the order notification to the shop owner (depending on the "Email attachment" setting)
- as a separate invoice email to the customer's billing address when you trigger it in the admin area
The module itself does not connect to any external service. The PDF is created locally in the shop with Dompdf.
Access protection
- On activation the module creates
export/invoicesand writes an.htaccesswithDeny from allinto it. This only protects the files on Apache servers that evaluate.htaccess. - For a custom storage path the module does not create an
.htaccess. You then have to block access to the directory yourself. - The download in the admin area is reached through the order in the OXID backend and is therefore limited to logged-in admin users.
Retention and deletion
- The module does not delete invoices. There is no delete function and no automatic cleanup run.
- When the module is deactivated, tables and PDF files are kept.
- Deleting an order does not automatically remove the associated invoice. The module does not hook into the deletion of orders.
- As the shop operator you have to observe retention and deletion periods yourself, for example for files and database rows.
Related pages
- Technical: database structure and snapshot layout
- Configuration: storage path and email delivery