Privacy notice

Controller

The controller for the purposes of Art. 4(7) GDPR is the provider named in our imprint. The address and email address given there are also how you reach us about data protection.

This notice covers this website only. For processing inside a tenant we host, our customer is the controller and we act as a processor under Art. 28 GDPR.

Hosting and where data is held

This website and the services behind it run on servers inside the European Union. Nothing on this website is transferred to a third country, with the single intra-EU exception described under “Checking a VAT number” below.

The legal basis for operating it is our legitimate interest in providing this offering securely and reliably, Art. 6(1)(f) GDPR.

Server logs

When you open this website we process the connection data a web server needs: IP address, time, the address requested, the amount of data transferred, the status code, and the identification and language preference your browser sends.

This data is needed to serve the page, to spot faults and to defend against automated attacks — in particular to limit how many signup attempts one source can make. The legal basis is Art. 6(1)(f) GDPR.

Cookies

This website sets exactly one cookie, and only if you switch the language in the header. It contains nothing but the language code you chose, and expires after a year.

It is a function you explicitly asked for, so no consent is required. We set no analytics, advertising or third-party cookies on this website, and no content is loaded from anyone else's servers.

The signup form

When you create an account we process what you enter: your company, a contact name, an email address, your country, a VAT number where you give one, and the shop address you would like.

The purpose is assessing and carrying out your request to use this service. The legal basis is Art. 6(1)(b) GDPR: the processing is for steps taken at your request before entering into a contract.

To protect the form against automated submissions we hold a random token for each rendered form in our own cache for at most two hours. The token holds nothing about you.

Checking a VAT number

If you give a VAT number, we send that number to the European Commission's VAT Information Exchange System (VIES), which passes the query to the tax administration of the member state concerned. What is sent is the number itself; what comes back is whether it is registered and, where available, the registered name and address.

The transfer is for pre-contractual steps under Art. 6(1)(b) GDPR and takes place within the European Union. If you give no number, no such transfer happens and a person reviews your application instead.

Documents we send you as a link

When we send you a quote, a purchase order or an invoice as a link on our document site, we record when the link was first and last opened, how often, and - only if you were signed in - which account opened it. We record no IP address, location or device, and we put no tracking pixel in any mail.

This tells us whether a document reached you, so we know when to follow up. The legal basis is Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR where the document is sent to a business. The record is kept as long as the document it belongs to.

How long we keep it

If your application is accepted, the details become part of your customer record and are kept for the periods that apply to it, in particular the statutory commercial and tax retention obligations.

A refused or withdrawn application is kept too, and we say so plainly: we need to be able to show whom we refused and why, and a deleted refusal could no longer be answered for. The basis is our legitimate interest under Art. 6(1)(f) GDPR in being able to account for our own decisions. You may object to this under Art. 21 GDPR.

Who receives the data

Inside our company, only the people who need it to handle your application have access. Beyond that we use infrastructure providers, who act for us as processors under Art. 28 GDPR and exclusively within the European Union.

Nothing is passed on for advertising. The only transfer outside that circle is the VAT number check described above.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object (Art. 21 GDPR).

An informal message to the address in our imprint is enough. We answer within the time limits of Art. 12 GDPR.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence or of the alleged infringement.

Changes to this notice

We update this notice when the processing it describes changes. The version published on this page is the one that applies.