How we handle your data and your rights

The following information is intended to give you an overview of how we process your personal data and the rights arising from this. The specific data processed and how it is used depends largely on the services requested or agreed upon. Therefore, not all statements contained here will apply to you.

Data Controller

The controller within the meaning of the GDPR is:

Contact for data protection inquiries

Please direct any questions concerning data protection to: [email protected]

Types of personal data processed

We process the following personal data received from you in the course of our business relationship:

• Company name with legal form and address
• Salutation, title, names
• Phone numbers
• Email addresses
• Field of activity or position
• Shop and order data: e.g. eBay transaction data, item descriptions, sales statistics
• Technical access data: API tokens for marketplace integration (stored encrypted, AES-256)
• End-customer (buyer) data: name, delivery address and order details of our customers' buyers for logistics handling

Purposes and legal bases of data processing

We process personal data in accordance with the provisions of the GDPR and the German Federal Data Protection Act (BDSG).

To fulfill contractual obligations (Art. 6(1)(b) GDPR)

Data is processed for the performance of:

• The service agreement (Software-as-a-Service delivery)

Due to legal requirements (Art. 6(1)(c) GDPR)

We are subject to various legal obligations that entail data processing, including:

• Tax laws and statutory bookkeeping requirements
• Responding to inquiries and requirements from supervisory or law enforcement authorities
• Tax-related control and reporting obligations

Based on legitimate interests (Art. 6(1)(f) GDPR)

We process data to ensure IT security, prevent fraud, and optimize our software interfaces based on our legitimate interest.

Recipients of data

Internal recipients

Within our company, the following departments or persons may access your data:

• Contact person / customer support

Within the scope of processing on our behalf

Your data may be passed on to the following types of service providers acting as processors:

• IT support and maintenance
• Accounting
• Cloud infrastructure & hosting: servers located within the EU
• AI interfaces for data processing: use of specialized language models for analyzing order data and automated message generation. Data is transmitted solely for processing and not used to train the models.
• Payment processors: for handling subscription fees

All service providers are contractually bound and obligated to treat your data confidentially.

Storage period

We process and store your personal data for as long as necessary for the fulfillment of our contractual and legal obligations. When data is no longer needed, it is routinely deleted.

Exceptions arise:

• Where statutory retention obligations must be met (e.g. under the German Commercial Code and Tax Code). The retention periods are generally six to ten years.
• For the preservation of evidence within statutory limitation periods. According to §§ 195 et seq. of the German Civil Code, these can be up to 30 years, with the regular limitation period being 3 years.

Where processing is based on a legitimate interest, the personal data will be deleted as soon as this interest no longer exists, subject to the exceptions noted above.

Your data protection rights

As a data subject, you have the following rights:

• Right of access under Article 15 GDPR
• Right to rectification under Article 16 GDPR
• Right to erasure under Article 17 GDPR
• Right to restriction of processing under Article 18 GDPR
• Right to object under Article 21 GDPR
• Right to data portability under Article 20 GDPR

Restrictions may apply to the rights of access and erasure under §§ 34 and 35 BDSG.

You also have the right to lodge a complaint with a competent data protection supervisory authority (Article 77 GDPR in conjunction with § 19 BDSG). The authority responsible for us is:

Provision required or necessary

Within the scope of the contractual relationship, you must provide such personal data as is necessary for the establishment, performance, and termination of the contract and for fulfilling the associated contractual obligations, or which we are required by law to collect. Without this data, we will generally not be able to enter into or perform the contract with you.

Information on your right to object under Article 21 GDPR

Case-by-case right to object

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Article 6(1)(f) GDPR (data processing on the basis of a balancing of interests), including profiling based on that provision within the meaning of Article 4(4) GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

Recipient of an objection

Objections may be submitted informally with the subject „Objection" stating your name, address, and date of birth, and should be directed to:

Changes to this privacy information

This privacy information may be updated from time to time. The current version is always available on our website at: https://shopmanage.de/dsgvo-info