Privacy policy

1. Scope and controller

This policy applies to the voucher shop shop.privadi.com. It describes which personal data are processed when you visit it, for what purpose and for how long.

This is a translation for your convenience. In case of doubt, the German version is legally binding.

The controller is: Privadi, Martin Schröder Ernst-Kromayer-Straße 28 06112 Halle (Saale) Deutschland Phone: +49 177 480 90 10 Email: info@privadi.net

A data protection officer has not been appointed; the legal requirements for such an appointment are not met.

2. Server and accessing the pages

The shop runs on a server in Germany operated by a German hosting provider. The connection is encrypted (TLS). A data processing agreement under Art. 28 GDPR is in place with the server provider.

When you access a page, your browser transmits technically necessary data to the server: IP address, date and time, the address requested, the volume of data transferred, a message about whether the request succeeded, the page you came from, and details of your browser and operating system.

These data are required for the page to be delivered and serve the security of operations. Without them the page cannot be displayed. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the stable and secure operation of the website.

The server logs are deleted after 15 days at the latest.

3. Visitor counting without cookies

shop.privadi.com sets no cookies. No third-party services for analytics, audience measurement or advertising, such as Google Analytics, are used.

We count ourselves how often visitors arrive at the shop. Only the page on which a visit begins is counted, not every further click. We store only the date, the page accessed and, if available, the page you came from.

We additionally store the visitor’s country, that is only the country code such as “DE”. It is determined from the IP address when the page is opened, on our own server, using a country list held there. The IP address itself is neither stored nor passed on, and no third-party service is asked. A country allows no conclusion about a person or a place. The country list comes from DB-IP (IP Geolocation by DB-IP, https://db-ip.com, licence CC BY 4.0).

We do not store: IP addresses, identifiers of any kind, cookies or other features that would allow a visitor to be recognised again. Nothing is stored on or read from your device.

The count is kept by PrivadiOffice, which is run by the same controller (item 1) and runs on the same server as the shop. The shop's figures are stored there together with those of our other websites.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to understand how the shop is found and used.

Fonts are stored on our own server. Nothing is loaded from Google Fonts or any other font provider.

We do not make automated decisions and do not carry out profiling.

4. Ordering a voucher

If you order a voucher, we process your name, the delivery address, your email address, the voucher and the chosen design, the amounts, the time of payment, the order number and the voucher number.

The purpose is to handle the order: sending the voucher by post, confirming by email and redeeming it later. The legal basis is Art. 6(1)(b) GDPR.

The order is stored in PrivadiOffice on our server in Germany (item 2). The order and payment details are accounting records, which we keep for eight years (§ 147(1) no. 4 and (3) AO, § 257(1) no. 4 and (4) HGB). Emails about the order and about a cancellation are business letters, which we keep for six years (§ 147(1) nos. 2 and 3, (3) AO, § 257(1) nos. 2 and 3, (4) HGB). The periods start at the end of the calendar year in which the order was received or the email was received or sent (§ 147(4) AO, § 257(5) HGB). They are extended for as long as the records are relevant to a tax whose assessment period has not yet expired (§ 147(3) sentence 5 AO). The legal basis is Art. 6(1)(c) GDPR.

If you cancel your order using the online function “Withdraw from contract”, we process your name, the order number, your email address and the date and time of receipt. We use them to match the cancellation to your order, forward it by email to our mailbox and send you the confirmation of receipt required by law (Art. 6(1)(c) GDPR in conjunction with § 356a BGB). These details are only contained in the emails, not in the database.

5. Payment via Stripe

You pay via the payment service provider Stripe Payments Europe, Limited, Dublin, Ireland (“Stripe”). The button “Order with obligation to pay” takes you to a payment page run by Stripe.

There you enter your email address, the delivery address and your payment details. We do not receive or store card or account details. Stripe sends us the name, delivery address, email address, the amount paid and an identifier of the payment. The legal basis is Art. 6(1)(b) GDPR.

Stripe processes the data partly on our behalf and partly under its own responsibility, for instance for fraud prevention and its own legal obligations. Data may be transferred to Stripe, Inc. in the USA. According to Stripe, this is based on the EU-U.S. Data Privacy Framework and the standard contractual clauses of the European Commission. Details: https://stripe.com/privacy

If your device offers Apple Pay or Google Pay, you can also use it on Stripe's payment page. Apple or Google then receive details of the payment, such as amount and recipient, and process them under their own responsibility, also in the USA. Details: https://www.apple.com/legal/privacy/ and https://policies.google.com/privacy

Depending on the payment method you choose, further providers are involved. If you choose Revolut Pay or Amazon Pay, Revolut or Amazon Payments Europe S.C.A., Luxembourg, receive details of the payment via Stripe, such as amount and recipient, and process them under their own responsibility. The legal basis is Art. 6(1)(b) GDPR. Details: https://www.revolut.com/legal/pay-with-revolut-checkout-privacy/ and https://pay.amazon.de/help/201212490

6. Emails about your order

After payment we send a confirmation with the order details and the cancellation policy to the email address you entered at Stripe. At the same time the order is sent by email to our own mailbox so that we can post the voucher.

The emails are sent via our sender noreply@privadi.net. Our email provider processes the contents of the message as our processor. If an email cannot be delivered, we receive a message with recipient, subject and reason so that we can fix the problem (Art. 6(1)(f) GDPR).

7. Contact by phone or email

If you call or write to us, we process your details to answer your request. The legal basis is Art. 6(1)(b) GDPR if it concerns an order, otherwise Art. 6(1)(f) GDPR.

8. Recipients

We do not sell data and do not pass it on for advertising purposes.

Recipients are our server provider (item 2), Stripe and, where applicable, Apple, Google, Revolut or Amazon (item 5) and our email provider (item 6). Beyond that we only pass on data where we are legally obliged to do so.

9. Your rights

Under the General Data Protection Regulation you have the right of access to the data stored about you (Art. 15), rectification of inaccurate data (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).

You have the right to object to processing based on legitimate interests (Art. 21). You can withdraw consent you have given at any time with effect for the future (Art. 7(3)).

For all of these matters a message to info@privadi.net is sufficient.

You may also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für den Datenschutz Sachsen-Anhalt, Otto-von-Guericke-Straße 34a, 39104 Magdeburg.

10. Changes to this policy

If something in the shop changes that affects the handling of data, we adjust this policy at the same time and move the date forward.