Privacy Policy

Controller

commercewerk 1440 GmbH i. G.
Franz-Krinninger-Weg 24
85604 Zorneding

Authorized Representative: Pavel Rossinsky, Managing Director

Email address: support@commercewerk.de

Imprint: https://commercewerk.de/imprint

Overview of Data Processing

The following overview summarizes the types of data processed, their purposes, and the data subjects involved.

Types of Processed Data

• Master data.
• Payment data.
• Contact data.
• Content data.
• Contract data.
• Usage data.
• Meta, communication, and procedural data.
• Log data.

Categories of Data Subjects

• Service recipients and clients.
• Prospects.
• Communication partners.
• Users.
• Business and contractual partners.

Purposes of Processing

• Provision of contractual services and fulfillment of contractual obligations.
• Communication.
• Security measures.
• Office and organizational procedures.
• Organizational and administrative procedures.
• Feedback.
• Registration procedure.
• Provision of our online services and user-friendliness.
• Business processes and economic procedures.
• Payment processing.
• IT infrastructure.
• Error analysis and performance optimisation.
• Conversion measurement (only with consent).

Applicable Legal Bases

Applicable legal bases under the GDPR: Below is an overview of the legal bases of the GDPR upon which we process personal data. Please note that in addition to the regulations of the GDPR, national data protection regulations may apply in your or our country of residence or business. If there are specific legal bases that apply in individual cases, we will inform you in the privacy policy.

• Consent (Art. 6 para. 1 sentence 1 lit. a GDPR) - The data subject has consented to the processing of their personal data for a specific purpose or purposes.
• Contract performance and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR) - Processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of pre-contractual measures taken at the request of the data subject.
• Legal obligation (Art. 6 para. 1 sentence 1 lit. c GDPR) - Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR) - Processing is necessary for the purposes of legitimate interests pursued by the controller or a third party, provided that the interests, fundamental rights, and freedoms of the data subject do not override those interests.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national data protection laws in Germany may apply. In particular, this includes the Federal Data Protection Act (BDSG), which contains special provisions regarding the right to information, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and the transmission of data as well as automated decision-making, including profiling. Additionally, the data protection laws of individual federal states may apply.

Notice regarding the applicability of the GDPR and Swiss Data Protection Act (DSG): These privacy notices are intended to inform both under the Swiss DSG and the GDPR. Therefore, please note that the terms used in the GDPR are applied due to their broader spatial application and understanding. Specifically, instead of terms used in the Swiss DSG such as "processing" of "personal data," "overriding interest," and "particularly sensitive personal data," the terms used in the GDPR, such as "processing" of "personal data" and "legitimate interest" and "special categories of data," are used. However, the legal meaning of these terms continues to be determined under the Swiss DSG for its scope.

Security Measures

We take appropriate technical and organizational measures in accordance with legal requirements, considering the state of the art, implementation costs, and the nature, scope, circumstances, and purposes of processing as well as the different probabilities and the extent of the threat to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data as well as access to, input, transmission, availability security, and separation. Furthermore, we have implemented procedures that ensure the exercise of data subject rights, data erasure, and responses to data threats. Additionally, we consider the protection of personal data already in the design or selection of hardware, software, and procedures according to the principle of data protection by design and by default.

International Data Transfers

Some of the service providers we use are based in the USA or belong to groups of companies based in the USA. Personal data may therefore be processed there or accessed from there. We only transfer data to third countries if an adequate level of data protection is ensured. For the USA this is the case in particular if the recipient is certified under the EU-US Data Privacy Framework (DPF), for which the EU Commission adopted an adequacy decision on 10 July 2023. Otherwise we base the transfer on the EU Commission’s standard contractual clauses. For each service in this privacy policy we state which basis applies. You can obtain information about the applicable transfer safeguards and a copy of the relevant standard contractual clauses at support@commercewerk.de.

• Legal Bases: Adequacy decision (Art. 45 GDPR); standard contractual clauses (Art. 46 para. 2 lit. c GDPR).

General Information on Data Storage and Deletion

We delete personal data we process in accordance with legal provisions as soon as the underlying consents are withdrawn or no further legal grounds for processing exist. This applies to cases where the original processing purpose is no longer relevant, or the data is no longer required. Exceptions exist where legal obligations or special interests require a longer retention or archiving of data.

In particular, data that must be stored for commercial or tax reasons or whose storage is necessary for legal proceedings or to protect the rights of other natural or legal persons must be archived accordingly.

Our privacy notices contain additional information on data retention and deletion specific to certain processing activities.

If there are multiple retention periods or deletion deadlines for a particular type of data, the longest period applies.

Statutory retention periods begin as prescribed by the applicable legislation. Retention periods for cookies and consent records instead begin when the cookie is set or the consent record is created. In the case of ongoing contractual relationships where data is stored, the triggering event is the date on which the termination or other cessation of the legal relationship becomes effective.

Data that is no longer required for its original purpose but must be stored due to legal requirements or other reasons will be processed only for the purposes that justify their retention.

Additional Notes on Processing Procedures, Services, and Data:

• Retention and Deletion of Data: The following general retention periods apply under German law:
  • 10 years - Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, and other necessary working instructions and organizational documents (§ 147 para. 1 no. 1 in conjunction with para. 3 AO, § 257 para. 1 no. 1 in conjunction with para. 4 HGB).
  • 8 years - Accounting records such as invoices and expense receipts (§ 147 para. 1 no. 4 in conjunction with para. 3 sentence 1 AO, § 14b para. 1 UStG and § 257 para. 1 no. 4 in conjunction with para. 4 HGB).
  • 6 years - Other business documents: received trade or business correspondence, copies of sent trade or business letters, and other documents that are important for taxation, e.g., hourly wage slips, operating accounting forms, calculation documents, price labeling, but also payroll documents, as far as they are not already accounting records or cash register slips (§ 147 para. 1 no. 2, 3, 5 in conjunction with para. 3 AO, § 257 para. 1 no. 2 and 3 in conjunction with para. 4 HGB).
  • 3 years - Data required to handle potential warranty and compensation claims or similar contractual claims and rights, based on previous business experience and standard industry practices, are stored for the duration of the regular statutory limitation period of three years (§§ 195, 199 BGB).

Rights of Data Subjects

Rights of data subjects under the GDPR: As a data subject, you have various rights under the GDPR, particularly under Articles 15 to 21 GDPR:

• Right to Object: You have the right to object, at any time, to the processing of your personal data based on Article 6 para. 1 lit. e or f GDPR, for reasons related to your particular situation. This also applies to profiling based on these provisions. If your personal data is being processed for direct marketing purposes, you also have the right to object to the processing of your personal data for such marketing at any time, including profiling related to such marketing.
• Right to Withdraw Consent: You have the right to withdraw any consent you have given at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right to Access: You have the right to request confirmation as to whether your data is being processed, as well as access to your data and further information in accordance with legal requirements.
• Right to Rectification: You have the right to request the completion or rectification of inaccurate data concerning you in accordance with legal requirements.
• Right to Erasure and Restriction of Processing: You have the right, in accordance with legal requirements, to request the immediate deletion of personal data concerning you, or alternatively, to request the restriction of processing.
• Right to Data Portability: You have the right to receive the personal data concerning you that you have provided to us, in a structured, commonly used, and machine-readable format, or to request the transmission of the data to another controller, in accordance with legal requirements.
• Right to Lodge a Complaint with a Supervisory Authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, especially in the member state of your habitual residence, place of work, or the place of the alleged infringement, if you believe that the processing of your personal data infringes the GDPR.

The supervisory authority competent for us is the Bavarian State Office for Data Protection Supervision (BayLDA), https://www.lda.bayern.de.

Business Services

We process data of our contractual and business partners, e.g., customers and prospects (collectively referred to as "contract partners"), within the scope of contractual and comparable legal relationships as well as related measures, and in regard to communication with the contract partners (or pre-contractual), such as answering inquiries.

We use this data to fulfill our contractual obligations. This includes, in particular, the duties to provide the agreed services, any update obligations, and remedies for warranty and other service disruptions. Furthermore, we use the data to safeguard our rights and for administrative tasks related to these obligations, as well as company organization. In addition, we process the data based on our legitimate interests, both in proper and business-oriented management of the company, as well as for security measures to protect our contract partners and our business operations against misuse, threats to their data, secrets, information, and rights (e.g., involving telecommunications, transportation, and other auxiliary services, as well as subcontractors, banks, tax and legal advisors, payment service providers, or financial authorities). In accordance with applicable law, we will only share contract partner data with third parties to the extent necessary for the aforementioned purposes or to fulfill legal obligations. Contract partners will be informed about other forms of processing, such as for marketing purposes, within the scope of this privacy policy.

We inform contract partners, prior to or during data collection (e.g., in online forms), about which data is required for the aforementioned purposes, such as through special markings (e.g., colors) or symbols (e.g., asterisks, etc.), or personally.

We delete the data after the statutory warranty and comparable obligations have expired, i.e., generally after three years, unless the data is stored in a customer account, e.g., as long as it must be retained for legal archival purposes (invoices and accounting vouchers eight years, books and annual financial statements ten years). Data that has been disclosed to us by the contract partner within the scope of an order will be deleted in accordance with the provisions and, in principle, after the completion of the order.

• Processed Data Types: Master data (e.g., full name, residential address, contact information, customer number, etc.); payment data (e.g., bank details, invoices, payment history); contact data (e.g., postal and email addresses or phone numbers); contract data (e.g., subject of the contract, term, customer category); usage data (e.g., page views and duration, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions). Meta, communication, and procedural data (e.g., IP addresses, time stamps, identification numbers, involved persons).
• Affected Persons: Service recipients and clients; prospects. Business and contract partners.
• Purposes of Processing: Provision of contractual services and fulfillment of contractual obligations; security measures; communication; office and organizational procedures; organizational and administrative procedures. Business processes and business management procedures.
• Storage and Deletion: Deletion according to the information in the section "General Information on Data Storage and Deletion".
• Legal Bases: Fulfillment of contracts and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR); legal obligations (Art. 6 para. 1 sentence 1 lit. c GDPR). Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Additional Information on Processing Procedures, Methods, and Services:

• Prepaid credit in the customer area: customers top up credit for QuickAuth SMS in advance; payment is handled by Stripe (see "Payment Processing"); Legal Bases: Performance of contracts and pre-contractual requests (Art. 6 para. 1 sentence 1 lit. b GDPR).

Payment Processing

To purchase prepaid credit in the customer area we use the payment service provider Stripe. You are redirected to a Stripe payment page and enter your payment details (e.g. card number) directly there; we do not receive them. For billing we create a customer record at Stripe and transmit name or company, email address, phone number, billing address and VAT ID; Stripe issues the invoices on our behalf. Stripe also processes data under its own responsibility where necessary to meet its own legal obligations (e.g. anti-money-laundering) and for fraud prevention.

• Processed Data Types: Master data (e.g. name, address); payment data (e.g. invoices, payment history); contract data; contact data.
• Affected Persons: Customers.
• Purposes of Processing: Provision of contractual services and fulfilment of contractual obligations; payment processing; business processes.
• Storage and Deletion: We generally retain invoices and accounting vouchers for eight years from the end of the relevant calendar year, longer only where required by law; otherwise deletion after the end of the contract according to the section "General Information on Data Storage and Deletion".
• Legal Bases: Performance of a contract and pre-contractual requests (Art. 6 para. 1 sentence 1 lit. b GDPR); legal obligation (Art. 6 para. 1 sentence 1 lit. c GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Further Information on Processing Procedures, Methods, and Services:

• Stripe: payment processing and invoicing; Service provider: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland; Website:https://stripe.com; Privacy policy:https://stripe.com/privacy; Basis for third-country transfers: Data Privacy Framework (DPF), standard contractual clauses (Stripe, LLC, USA).

Provision of the Online Services and Web Hosting

We process users’ data in order to provide our online services, including the customer area. For this purpose we process in particular the IP address, which is required to deliver content and functions to the user’s browser or device. The website and the customer backend run on servers of a hosting provider in Germany. The account and billing data of the customer area are held in a database at MongoDB Atlas (see below).

When you access our online services, our servers process technical request data, particularly your IP address and the requested address, to respond to the request. Additional performance and error monitoring is described in the relevant section.

• Processed Data Types: Usage data (e.g. pages visited, times, device types and operating systems); meta, communication and process data (e.g. IP addresses, time information); master, contact and payment data of the customer area.
• Affected Persons: Users (e.g. website visitors, users of online services).
• Purposes of Processing: Provision of our online services and usability; security measures; IT infrastructure.
• Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); for the customer area, performance of a contract and pre-contractual requests (Art. 6 para. 1 sentence 1 lit. b GDPR).

Further Information on Processing Procedures, Methods, and Services:

• Hetzner: server infrastructure (cloud servers, location Falkenstein, Germany); Service provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website:https://www.hetzner.com; Privacy policy:https://www.hetzner.com/legal/privacy-policy.
• MongoDB Atlas: database of the customer area (account, billing and usage data); location: Frankfurt am Main, Germany; Service provider: MongoDB Limited, Building Two, Number One Ballsbridge, Dublin 4, Ireland; Legal Bases: Performance of a contract (Art. 6 para. 1 sentence 1 lit. b GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR) where you are not personally a contracting party; Website:https://www.mongodb.com; Privacy policy:https://www.mongodb.com/legal/privacy/privacy-policy; Basis for third-country transfers: standard contractual clauses (MongoDB, Inc., USA).

Use of Cookies

The term "cookies" refers to functions that store and read information on users' devices. Cookies can serve different purposes, such as ensuring the functionality, security, and convenience of online services, as well as creating analytics of visitor flows. We use cookies in accordance with legal regulations. To do so, we obtain users' consent in advance if required. No consent is required where storing and reading information is strictly necessary to provide explicitly requested content and functions. This includes, for example, storing settings and ensuring the functionality and security of our online service. Consent can be revoked at any time. We clearly inform users about the scope of cookies used.

Notes on Data Protection Legal Grounds: Storage on and access to your device requiring consent are governed by Section 25 (1) TDDDG. Storage and access strictly necessary to provide services you expressly request fall under Section 25 (2) No. 2 TDDDG. We identify the legal basis for subsequent personal-data processing under each service.

Retention Period: Regarding retention duration, the following types of cookies are distinguished:

• Temporary Cookies (also known as Session Cookies): Temporary cookies are deleted at the latest when a user leaves an online service and closes their device (e.g., browser or mobile application).
• Permanent Cookies: Permanent cookies remain stored even after the device is closed. For example, the login status can be stored, and preferred content can be directly displayed when the user revisits a website. Additionally, user data collected via cookies may be used for reach measurement. If we do not provide explicit information regarding the type and retention duration of cookies (e.g., during consent collection), users should assume that they are permanent and that the retention period may be up to two years.

General Notes on Revocation and Objection (Opt-out): Users can revoke their given consent at any time and also object to the processing in accordance with legal provisions, including via the "Privacy settings" link and the privacy settings of their browser.

• Processed Data Types: Meta, communication, and procedural data (e.g., IP addresses, time stamps, identification numbers, involved persons).
• Affected Persons: Users (e.g., website visitors, users of online services).
• Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR). Consent (Art. 6 para. 1 sentence 1 lit. a GDPR).

Additional Information on Processing Procedures, Methods, and Services:

• Usercentrics Consent Management Platform: collection, storage, management and proof of consent. Processed: a pseudonymous consent ID, time and content of your decision, version and language of the consent dialogue, and browser and device information. Your decision is stored in your browser’s local storage until you change it or clear the storage, and logged with the provider as proof; the provider deletes these proof records after one year. You can change or withdraw your consent at any time via the "Privacy settings" link; Service provider: Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany; Legal Bases: Legal obligation (Art. 6 para. 1 sentence 1 lit. c in conjunction with Art. 7 para. 1 GDPR); storage on the device under Section 25 (2) No. 2 TDDDG; Website:https://usercentrics.com.
• Information stored on your device: "lang" (cookie): selected language, one year; consent decision (local storage, Usercentrics); login state in the customer area (IndexedDB, until sign-out); "cw-i18n-reload" (session storage): technical flag for load errors, ends with the session; session identifier of the browser monitoring (local storage, only with consent, see "Performance and Error Monitoring"); Legal Bases: Section 25 (2) No. 2 TDDDG and legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); for browser monitoring, consent (Section 25 (1) TDDDG, Art. 6 para. 1 sentence 1 lit. a GDPR).

Registration, Login, and User Account

Users can create a user account. During the registration process, the users are informed about the required mandatory information, and the data is processed for the purpose of providing the user account based on contractual obligations. The processed data includes, in particular, login information (name, email address and password; later phone number, billing address and VAT ID).

Registration and login are handled by our authentication provider (see below), which processes the IP address and the time of login to protect against misuse and other unauthorised use.

Users may be informed by email about activities relevant to their user account, such as technical changes.

• Processed Data Types: Master data (e.g., full name, address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or phone numbers); usage data (e.g., page views, duration of stay, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and functions). Log data (e.g., log files related to logins or data retrieval or access times).
• Affected Persons: Users (e.g., website visitors, users of online services).
• Purposes of Processing: Provision of contractual services and fulfillment of contractual obligations; security measures; organizational and administrative procedures. Provision of our online offer and user-friendliness.
• Storage and Deletion: Deletion according to the information in the section "General Information on Data Storage and Deletion." Deletion after termination.
• Legal Basis: Contract fulfillment and pre-contractual inquiries (Art. 6 Para. 1 S. 1 lit. b) GDPR). Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR).

Further Information on Processing Procedures, Processes, and Services:

• Firebase Authentication: registration, login, email verification and password reset in the customer area. Processed: email address, name, password for verification by Firebase Authentication (passwords are stored there as hashes), a user ID, times of registration and login, and IP address and browser information for abuse prevention. The login state is kept in your browser’s local storage (IndexedDB) while you are signed in; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal Bases: Performance of a contract and pre-contractual requests (Art. 6 para. 1 sentence 1 lit. b GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR) where you are not personally a contracting party, and for abuse prevention; Website:https://firebase.google.com; Privacy policy:https://firebase.google.com/support/privacy; Basis for third-country transfers: Data Privacy Framework (DPF), standard contractual clauses.
• User Profiles are Not Public: User profiles are not publicly visible or accessible.

Single Sign-On Login

"Single Sign-On" or "Single Sign-On Login or Authentication" refers to processes that allow users to log in to our online service using a user account with a Single Sign-On provider (e.g., a social network). The prerequisite for Single Sign-On authentication is that the users are registered with the respective Single Sign-On provider and enter the required login details in the provided online form or are already logged in with the Single Sign-On provider and confirm the Single Sign-On login via a button.

The authentication takes place directly with the respective Single Sign-On provider. As part of such authentication, we receive a user ID indicating that the user is logged in under this user ID with the respective Single Sign-On provider, and an ID (so-called "User Handle") that cannot be used for other purposes. Whether additional data is transmitted to us depends solely on the Single Sign-On procedure used, the data sharing choices made during authentication, and which data users have made available in the privacy or other settings of their user account with the Single Sign-On provider. Depending on the Single Sign-On provider and the user's choice, this can include various data, typically email address and username. The password entered during the Single Sign-On process with the provider is neither visible to us nor stored by us.

Users are asked to note that their data stored with us may automatically be reconciled with their user account with the Single Sign-On provider, but this is not always possible or actually performed. For example, if users change their email addresses, they must manually update them in their user account with us.

If you choose Google Single Sign-On, we process the necessary authentication data to provide your customer account. The legal basis is Art. 6 para. 1 lit. b GDPR where you are personally a contracting party; otherwise, Art. 6 para. 1 lit. f GDPR applies through our legitimate interest in providing account access to authorised contacts of our business customers.

If users decide not to use the link between their user account and the Single Sign-On provider for Single Sign-On authentication anymore, they must disconnect this link within their user account at the Single Sign-On provider. If users wish to delete their data with us, they must terminate their registration with us.

• Processed Data Types: Master data (e.g., full name, address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or phone numbers); usage data (e.g., page views, duration of stay, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and functions). Meta-, communication, and procedural data (e.g., IP addresses, time data, identification numbers, involved persons).
• Affected Persons: Users (e.g., website visitors, users of online services).
• Purposes of Processing: Provision of contractual services and fulfillment of contractual obligations; security measures; login process. Provision of our online offer and user-friendliness.
• Storage and Deletion: Deletion according to the information in the section "General Information on Data Storage and Deletion." Deletion after termination.
• Legal Basis: Contract fulfillment and pre-contractual inquiries (Art. 6 Para. 1 S. 1 lit. b) GDPR). Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR).

Further Information on Processing Procedures, Processes, and Services:

• Google Single Sign-On: Authentication services for user logins, provision of Single Sign-On features, management of identity information, and application integrations. If you choose this option, we receive your name, email address, possibly your profile picture and a Google user ID from Google; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal Bases: Performance of a contract and pre-contractual requests (Art. 6 para. 1 sentence 1 lit. b GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR) where you are not personally a contracting party; Website: https://www.google.de; Privacy Policy: https://policies.google.com/privacy; Basis for transfers to third countries: Data Privacy Framework (DPF).

Contact and Enquiry Management

If you contact us by email or phone, we process your details (e.g. name, email address, phone number, company, shop address and content of the enquiry) to handle the enquiry and answer follow-up questions. Our mailboxes are operated by Microsoft.

• Processed Data Types: Master data; contact data; content data; meta, communication and process data.
• Affected Persons: Communication partners; prospects; customers.
• Purposes of Processing: Communication; organisational and administrative procedures; feedback.
• Storage and Deletion: Deletion once the enquiry is closed, unless statutory retention duties apply (e.g. six years for business letters).
• Legal Bases: Performance of a contract and pre-contractual requests (Art. 6 para. 1 sentence 1 lit. b GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Further Information on Processing Procedures, Methods, and Services:

• Microsoft 365: email hosting; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; Privacy policy:https://privacy.microsoft.com/privacystatement; Basis for third-country transfers: Data Privacy Framework (DPF), standard contractual clauses.

Performance and Error Monitoring

To ensure the stability and performance of our online services, a monitoring service on our servers analyses requests and errors (application performance monitoring). It records technical request data on the server, e.g. requested URL, time, response times, status codes, browser identifier (user agent), referrer and error messages. No information is stored on or read from your device.

Only if you agree in our consent dialogue does your browser additionally load a script of the same service (browser monitoring). It measures load times, JavaScript errors and page changes and can record the course of your visit as a session replay (e.g. page rendering, clicks, scrolling). Form input and displayed text are masked, so they are not recorded in clear text. The script stores a random session identifier in your browser’s local storage, which ends after 30 minutes of inactivity and after four hours at the latest. You can withdraw your consent at any time via the "Privacy settings" link.

• Processed Data Types: Usage data (e.g. page views, interactions, load times); meta, communication and process data (e.g. IP addresses, time information, device type, browser); log data.
• Affected Persons: Users (e.g. website visitors, users of online services).
• Purposes of Processing: Security measures; error analysis and performance optimisation; provision of our online services and usability.
• Storage and Deletion: Deletion by the provider after 8 days (request and error data, browser monitoring including session replays).
• Legal Bases: Server-side monitoring: legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR). Browser monitoring: consent (Art. 6 para. 1 sentence 1 lit. a GDPR, Section 25 (1) TDDDG).

Further Information on Processing Procedures, Methods, and Services:

• New Relic: performance and error monitoring; data stored in the provider’s EU region; Service provider: New Relic, Inc., 188 Spear Street, Suite 1000, San Francisco, CA 94105, USA; Website:https://newrelic.com; Privacy policy:https://newrelic.com/termsandconditions/privacy; Basis for third-country transfers: Data Privacy Framework (DPF), standard contractual clauses.

Conversion Measurement

With your consent we use Google Ads conversion tracking to measure whether visitors who reached us via one of our ads then carry out certain actions on our website. The Google tag is only loaded after your consent. Cookies are then set or read, and data such as IP address, device and browser information, page visited, ad click identifier and timestamps are transmitted to Google. We pass your consent decision to Google via Google Consent Mode. You can withdraw your consent at any time via the "Privacy settings" link.

• Processed Data Types: Usage data; meta, communication and process data; conversion data.
• Affected Persons: Users; prospects.
• Purposes of Processing: Conversion measurement; marketing.
• Storage and Deletion: Cookies on our website (_gcl_*) for up to 90 days; cookies Google sets on its own domains (e.g. "IDE" on doubleclick.net) for up to 13 months; Google retains the data transmitted to it under its own retention policy (https://policies.google.com/technologies/retention).
• Legal Bases: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR, Section 25 (1) TDDDG).

Further Information on Processing Procedures, Methods, and Services:

• Google Ads: conversion measurement; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Website:https://ads.google.com; Privacy policy:https://policies.google.com/privacy; Basis for third-country transfers: Data Privacy Framework (DPF).

Processing on Behalf of Shop Operators (QuickAuth)

Where shop operators use our QuickAuth service, we process their customers’ phone numbers and the login codes sent solely on behalf of and on the instructions of the respective shop operator (Art. 28 GDPR). The shop operator is the controller; data subjects find information in the shop operator’s privacy policy.

Changes and Updates

We ask you to regularly check the content of our privacy policy. We adjust the privacy policy as soon as changes in the data processing we perform make this necessary. We will inform you if changes require your participation (e.g., consent) or any other individual notification.

If we provide addresses and contact information of companies and organizations in this privacy policy, please note that the addresses may change over time and we ask you to verify the information before contacting them.