Billbee Privacy Policy | Your Data & GDPR

I. Scope

As the controllers, we are providing data subjects with information regarding the handling of personal data in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR). This document has been in effect since September 2026. It may become necessary to update this document due to future changes in data processing procedures or as a result of changes in legal or regulatory requirements. The current version is always available at https://www.billbee.io/rechtliches/datenschutz.

II. Who is responsible for data processing?

II.1. Primary Controller

The controller responsible for data processing in general pursuant to Art. 4 (7) GDPR is:
Billbee GmbH, Arolser Str. 10, 34477 Twistetal. The full legal notice is available at: https://www.billbee.io/impressum/

II.2. Joint Controllers

Billbee GmbH, Arolser Str. 10, 34477 Twistetal, and comrce GmbH, Arolser Str. 10, 34477 Twistetal, process personal data in the customer area as joint controllers within the meaning of Art. 26 GDPR. The essential content of the agreement between the parties is set out below.

II.2.a Processes

Joint controllership relates in particular to customer-related processes in the areas of customer management, support, marketing, website operation, digital advertising campaigns, event management, social media, content management, customer education, affiliate marketing, partner management, product management, product development, business intelligence, reporting, billing, and technical infrastructure.

This may involve the processing of customer data, contact person data, communication data, support data, prospect and lead data, marketing and usage data, event data, partner and business partner data, billing and transaction data, product and feedback data, as well as technical data.

Outside of the described processing operations, each company is independently responsible for any processing for which it alone determines the purposes and means.

II.2.b Distribution of responsibilities

Billbee GmbH is primarily responsible where it acts as the contractual partner or primary point of contact for customers, prospective customers, business partners, partner companies, or event participants, and where it establishes the legal framework for processing within its area of responsibility.

comrce GmbH is primarily responsible for content management, organization, and operational execution of customer-related processes, as well as for defining organizational workflows, system configurations, communication structures, and reporting, support, marketing, product, partner, billing, and infrastructure processes.

Billbee GmbH generally provides data subjects with the information required under Articles 13 and 14 of the GDPR, including this information regarding joint controllership. comrce GmbH supports this by providing the necessary information from its area of responsibility.

II.2.c Purposes and legal bases

Processing is carried out in particular on the basis of:

Art. 6(1)(b) GDPR, insofar as it is necessary for the performance of a contract or for the implementation of pre-contractual measures;
Art. 6(1)(c) GDPR, insofar as legal obligations exist;
Art. 6(1)(f) GDPR, insofar as legitimate interests are pursued; and
in individual cases, Art. 6(1)(a) GDPR, provided that consent is obtained.

The legitimate interest lies, in particular, in the uniform, efficient, secure, and quality-assured organization of customer-related processes within the corporate group.

II.2.d Data breaches

Each company fulfills the relevant reporting and notification obligations under Articles 33 and 34 of the GDPR. The companies will inform each other immediately in the event of data breaches or other security incidents and will support each other in their investigation, remediation, and any necessary reporting.

II.2.e Rights of data subjects

Data subjects may exercise their rights under the GDPR, in particular the rights to access, rectification, erasure, restriction of processing, data portability, and objection, against either of the two companies.

Requests are generally processed by the company that receives them. The other company will provide support as needed by supplying the necessary information from its area of responsibility.

Contact options

Billbee GmbH: privacy@bilbee.io
Comrce GmbH: privacy@comrce.io

III. Is there a data protection officer?

The controller responsible for data processing has appointed the following data protection officer:

Marc Oliver Giel, Lagerstr. 11 A, 64807 Dieburg, email address: giel @ datamog.de
Data subject requests via email must be sent exclusively to: privacy@billbee.io

IV. Why do we process your data?

In addition to the processing described below, please also note the information on cookies in section IX.

IV.1. Log files / Hosting

If you visit our website without registering or otherwise providing us with information, we only collect the following data that your browser transmits to our server (so-called "server log files"):

The individual pages of our website (URL)
Date and time of access
Amount of data sent in bytes
Source/referral from which you reached the site
Browser used
Operating system used
IP address used (in anonymized form, if applicable)

Our website is stored and made available for retrieval by a hosting provider. The web server used stores the aforementioned server log files.

Purpose of processing: Hosting the website
Legal basis and legitimate interests: Processing is based on our overriding legitimate interest (Art. 6(1)(f) GDPR) in the security and stability of our website by commissioning a service provider to supply infrastructure and platform services, computing capacity, storage space, database services, security services, and technical maintenance.
Data recipient/processor: Webflow, Inc. https://webflow.com/
Privacy information from Webflow, Inc.: https://webflow.com/legal/eu-privacy-policy
Third-country transfer: Data processing takes place in the USA.
Commission adequacy decision: Regarding data transfers to Webflow, Inc., we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework under Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

IV.2. Cookie consent management

Cookies and consent management

In addition to storing cookies (see separate section), we manage the consent declarations of our website users using a cookie consent tool.

Purpose of processing: Fulfillment of the legal obligation for consent management.
Legal basis: Art. 6(1)(c) GDPR
Data recipient/processor: Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, https://www.cookiebot.com/de/
Usercentrics privacy policy: https://www.cookiebot.com/de/privacy-policy/
Storage duration: Until consent for cookie storage is withdrawn, or at the latest until the respective cookie expires. The storage duration for each cookie is listed in the cookie table.

IV.3. Web fonts

Our website uses web fonts provided by the respective provider for the uniform presentation of fonts. When you visit a page, your browser loads the required web fonts into your browser cache to display texts and fonts correctly.

For this purpose, the browser you use must connect to the respective provider's servers. This informs the provider that our website was accessed via your IP address. If your browser does not support web fonts, a standard font from your computer will be used.

Purpose of processing: Uniform presentation of our website across all media.
Legal basis and legitimate interests: Integration is based on our legitimate interests (Art. 6(1)(f) GDPR) in the technically secure, maintenance-free, and efficient use of fonts, their uniform presentation, and consideration of potential licensing restrictions for their integration.
Data recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Google Privacy Policy: https://policies.google.com/privacy
Third-country transfer: To the extent that non-anonymized data is transferred to Google LLC, data processing takes place in the USA.
Commission adequacy decision: Regarding data transfers to Google LLC, we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

IV.4. Web tracking, marketing, conversion tracking

IV.4.a. Google

Google Tag Manager

On our website, we use the Google Tag Manager from the company Google. Google Tag Manager is an online tool that allows us to integrate and manage website tags centrally via a user interface. Tags are small snippets of code that, for example, record your activities on our website. For this purpose, JavaScript code snippets are inserted into the source code of our website. The tags come from sources such as Google Ads or Google Analytics, but tags from other companies can also be integrated and managed via the manager. Such tags perform various tasks. They can collect browser data, integrate buttons, set cookies, and even track users across multiple websites. In the Tag Manager account settings, we have allowed Google to receive anonymized data from us. However, this only concerns the use and operation of our Tag Manager and not your data that is stored via the code snippets.

Purposes of processing: Tracking (e.g., interest-based/behavioral profiling), analysis of visitor actions, interest-based and behavioral marketing, profiling (creation of user profiles), conversion measurement (measuring the effectiveness of marketing activities), and reach measurement (e.g., access statistics, recognition of returning visitors). These purposes apply to both us and Google and its parent company. As far as we are aware, Google also uses the data collected in this way (anonymized) for its own purposes. In this regard, we refer to Google's privacy policy.
Legal bases and legitimate interests: The integration of Google Tag Manager on our website is carried out in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in the statistical analysis of user behavior for optimization and marketing purposes. The use of the various tags then takes place in accordance with the separately described sections with the user's express consent.
Storage duration: Regarding the storage duration by Google, we refer to their privacy policy.
Data recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Google Privacy Policy: https://policies.google.com/privacy
Third-country transfer: To the extent that non-anonymized data is transferred to Google LLC, data processing takes place in the USA.
Commission adequacy decision: Regarding data transfers to Google LLC, we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

Google Analytics 4

(a) General: Our website uses Google Analytics, a web analytics service provided by Google Ireland Ltd. (Google), which allows for the analysis of website usage. In this process, we receive various usage data, such as page views, duration of stay, operating systems used, and the user's origin.

(b) Consent mode: When you first visit a page on our website, you will be asked via our cookie consent tool, among other things, to grant us your consent to set optional Google cookies. Without your consent, certain information about your usage behavior is collected and processed using so-called "pings."

(c) After your consent: If you grant us your consent to set cookies, demographic characteristics, Google Signals, and Google Remarketing (see the following paragraphs) will also be used.

(d) Demographic characteristics: Google Analytics 4 uses a special feature, so-called "demographic characteristics," to generate statistics providing insights into your age, gender, and interests based on an analysis of interest-based advertising and by incorporating third-party information. This enables the identification and differentiation of website user groups for the purpose of optimizing marketing activities. However, data collected via "demographic characteristics" cannot be assigned to any specific person and therefore not to you personally.

(e) Google Signals: We also use the "Signals" service from Google on our website. With "Signals," we can have Google generate cross-device reports (so-called "cross-device tracking"). Provided you have activated "personalized ads" in your Google account settings and have linked your internet-enabled devices to your Google account, Google can analyze usage behavior across devices upon your consent to the use of Google Analytics 4 and create database models based on this. This takes into account the logins and device types of all website users who were logged into a Google account and performed a conversion. The data shows, among other things, which device you first clicked an ad on and on which device the corresponding conversion took place. When using Google Signals, we do not receive any personal data from Google, but only statistics generated on the basis of Google Signals.

(f) Google Remarketing: On our website, we also use the features of Google Analytics Remarketing in conjunction with the cross-device capabilities of Google Ads and Google DoubleClick. This feature makes it possible to link the advertising target groups created with Google Analytics Remarketing with the cross-device capabilities of Google Ads and Google DoubleClick. In this way, interest-based, personalized advertising messages that have been adapted to you based on your previous usage and browsing behavior on one device (e.g., mobile phone) can also be displayed on another of your devices (e.g., tablet or PC). To support this feature, Google Analytics collects Google-authenticated user IDs, which are temporarily linked to our Google Analytics data to define and create target groups for cross-device advertising.

(g) Further details:

Purposes of processing: Tracking (e.g., interest-based/behavioral profiling), analysis of visitor actions, interest-based and behavioral marketing, profiling (creation of user profiles), conversion measurement (measuring the effectiveness of marketing activities), and reach measurement (e.g., access statistics, recognition of returning visitors). These purposes apply to both us and Google and its parent company.
Legal basis and legitimate interests: For the use of Google Analytics, you may provide us with your consent in accordance with Art. 6 (1) sentence 1 lit. a GDPR. Without your consent, we use Google Analytics 4 with so-called "pings" based on our overriding legitimate interest (Art. 6 (1) sentence 1 lit. f GDPR) to achieve the purposes of processing (see above).
Storage period: We store the anonymized data collected in this way for a maximum period of 14 months. After this, the data is automatically deleted. Regarding the storage period by Google, please refer to their privacy policy. Data collected via the "demographic features" function is retained for two months and then deleted.
Withdrawal of consent: You have the right to withdraw your consent at any time with effect for the future by deselecting "Marketing" or "Google Analytics 4" in the cookie settings on our website.
Objection / Opt-Out: You can object to data processing based on our legitimate interest at any time by installing a browser add-on to disable Google Analytics: https://support.google.com/analytics/answer/181881?hl=de
Here you can determine for yourself which data should be used by Google: https://g.co/privacytools
You can also disable personalized advertising directly via Google: https://safety.google/intl/de_ALL/settings/ad-settings/
Further information from Google on how to block specific ads and disable cross-device analysis in connection with Google Signals can be found here: https://support.google.com/ads/answer/2662922?hl=de
You can also set your preferences for online advertising across multiple providers here: https://www.youronlinechoices.com/de/
Alternatively, you can use the Network Advertising Initiative's opt-out page:
https://thenai.org/how-to-opt-out/
Data recipient/processor: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Google Privacy Policy: https://policies.google.com/privacy
Google data privacy information for Google Analytics: https://support.google.com/analytics/answer/6004245
Third-country transfer: To the extent that non-anonymized data is transferred to Google LLC, data processing also takes place in the USA.
Commission adequacy decision: Regarding data transfers to Google LLC, we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

Google AdSense

Our website uses "AdSense" from Google Ireland Ltd. (Google) to place advertisements within the Google advertising network (e.g., in search results, videos, on websites, etc.) so that they are displayed to users who are likely to be interested in them. We also measure the conversion of these ads. However, we only receive the anonymous total number of users who clicked on our ad and were redirected to a page equipped with a "conversion tracking tag." We do not receive any information that would allow us to identify individual users. Through conversion measurement, we can determine which of our online marketing methods have led to a conversion, such as a contract being concluded with us. Conversion measurement is used solely to analyze the success of our marketing efforts.

Our website uses Google AdSense exclusively with an anonymized IP address. This means your IP address is truncated by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to Google's parent company in the USA and truncated there.

Responsibilities: We are responsible for integrating Google's software products and for conducting analyses to the extent that we have access to them. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and its parent company, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, are responsible for their own data processing, over which we have no control.
Purposes of processing: Tracking (e.g., interest-based/behavioral profiling), analysis of visitor actions, interest-based and behavioral marketing, profiling (creation of user profiles), conversion measurement (measuring the effectiveness of marketing campaigns), and reach measurement (e.g., access statistics, recognition of returning visitors). These purposes apply to both us and Google and its parent company.
Legal basis and legitimate interest: You may provide us with your consent for the use of cookies for Google AdSense in accordance with Art. 6(1)(a) GDPR. Our overriding legitimate interest pursuant to Art. 6(1)(f) GDPR lies in the promotion of our products and services.
Right to withdraw consent: You have the right to withdraw your consent at any time with future effect by deselecting "Marketing" or "Google AdSense" in the cookie settings on our website.
Objection / Opt-out: You can object to data processing based on our legitimate interest at any time by disabling personalized advertising at Google: https://safety.google/intl/de_ALL/settings/ad-settings/
You can also set your preferences regarding online advertising across different providers here: https://www.youronlinechoices.com/de/
Alternatively, you can use the Network Advertising Initiative's management page:
https://thenai.org/how-to-opt-out/
Storage duration: Regarding the storage duration by Google, please refer to their privacy policy.
Google Privacy Policy: https://policies.google.com/privacy
Third-country transfer: To the extent that non-anonymized data is transferred to Google LLC, data processing takes place in the USA.
Commission adequacy decision: Regarding data transfers to Google LLC, we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

Google Ads Conversion

Our website uses the online advertising program "Google Ads Conversion" from Google Ireland Ltd. (Google). We use this advertising program to draw attention to our offers on external websites with the help of advertising materials (so-called Google Adwords). We can determine how successful individual advertising measures are in relation to the data from the advertising campaigns. Our goal is to show you advertisements that are of interest to you, to make our website more interesting for you, and to achieve a fair calculation of the advertising costs incurred. The advertising program uses so-called cookies. The cookie for conversion tracking is set when a user clicks on an ad placed by Google. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognize that the user clicked on the ad and was redirected to this page. Each Google Ads customer receives a different cookie. Cookies can therefore not be tracked across the websites of Google Ads customers. The information obtained using the conversion cookie is used to create conversion statistics for Google Ads customers who have opted for conversion tracking. Customers learn the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users.

As part of Google Ads, we use "enhanced conversion tracking for the web." Further information on how this works is available from Google at:
https://support.google.com/google-ads/answer/9888656?hl=de

Information on how Google uses and protects the data collected in this way is available at:
https://support.google.com/adspolicy/answer/9755941

Purposes of processing: Conversion measurement (measuring the effectiveness of marketing measures). These purposes apply to both us and Google and its parent company.
Legal bases and legitimate interests: For the use of cookies for Google Ads Conversion, you may provide us with your consent pursuant to Art. 6(1)(a) GDPR. Our overriding legitimate interest pursuant to Art. 6(1)(f) GDPR lies in the promotion of our products and services.
Withdrawal of consent: You have the right to withdraw your consent at any time with effect for the future by deselecting "Marketing" or "Google Ads Conversion" in the cookie settings on our website.
Objection / Opt-out: You can object to data processing based on our legitimate interest at any time by disabling personalized advertising at Google:
https://safety.google/intl/de_ALL/settings/ad-settings/
You can also set your preferences regarding online advertising across different providers here: https://www.youronlinechoices.com/de/
Alternatively, you can use the Network Advertising Initiative's management page:
https://thenai.org/how-to-opt-out/
Storage duration: Regarding the storage duration by Google, please refer to their privacy policy.
Data recipient/processor: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Google Privacy Policy: https://policies.google.com/privacy
Third-country transfer: To the extent that non-anonymized data is transferred to Google LLC, data processing takes place in the USA.
Commission adequacy decision: Regarding data transfers to Google LLC, we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

IV.4.b. LinkedIn

LinkedIn Insight Tag

We use the LinkedIn Insight Tag on our website. The provider of this service is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

With the help of the LinkedIn Insight Tag, we receive information about visitors to our website. If a website visitor is registered with LinkedIn, we can analyze professional details (e.g., career level, company size, country, location, industry, and job title) of our website visitors and thus better tailor our site to the respective target groups. Furthermore, we can use LinkedIn Insight Tags to measure whether visitors to our websites make a purchase or perform another action (conversion tracking). Conversion tracking can also be performed across devices (e.g., from PC to tablet). The LinkedIn Insight Tag also offers a retargeting function, which allows us to show targeted advertising to our website visitors outside of our website, whereby, according to LinkedIn, no identification of the advertising recipient takes place.

LinkedIn also collects so-called log files (URL, referrer URL, IP address, device and browser properties, and time of access). IP addresses are truncated or (if used to reach LinkedIn members across devices) pseudonymized.

For the aforementioned functions to work properly, various cookies must be stored on or read from the user's device.

Purposes of processing: Tracking (e.g., interest-based/behavioral profiling), analysis of visitor actions, interest-based and behavioral marketing, profiling (creation of user profiles), conversion tracking (measuring the effectiveness of marketing activities), reach measurement (e.g., access statistics, recognition of returning visitors). These purposes apply to both us and LinkedIn.
Legal basis: For the use of the LinkedIn Insight Tag with cookies, you may provide us with your consent pursuant to Art. 6 (1) sentence 1 lit. a GDPR, which you can revoke at any time with effect for the future by deselecting "Marketing" or "LinkedIn" in the cookie settings on our site.
Data recipient: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland
LinkedIn Privacy Policy: https://de.linkedin.com/legal/privacy-policy
Storage duration: Direct identifiers of LinkedIn members are deleted by LinkedIn after seven days. The remaining pseudonymized data is then deleted within 180 days.
Objection / Opt-Out: You can object to the analysis of usage behavior and targeted advertising by LinkedIn via the following link: https://www.linkedin.com/mypreferences/g/guest-retargeting-opt-out
Furthermore, LinkedIn members can control the use of their personal data for advertising purposes in their account settings. To prevent LinkedIn from linking data collected on our website to your LinkedIn account, you must log out of your LinkedIn account before visiting our website.
Third-country transfers: see Data Processing Agreement and list of sub-processors
Appropriate safeguards: We have entered into a Data Processing Agreement (DPA) with LinkedIn to protect your personal data. This also includes the EU Standard Contractual Clauses, which are considered appropriate safeguards under Art. 46 (2) c GDPR for the transfer of data outside the EU, the EEA, or countries recognized by the European Commission as providing an "adequate" level of data protection.

IV.4.c. Meta (Facebook)

Facebook Pixel

We use the Facebook Pixel, a product of Meta Platforms Ireland Ltd ("Facebook"), on our website. This allows Facebook to identify visitors to our website as a target group for displaying advertisements (so-called "Facebook ads"). We use the Facebook Pixel to ensure that our Facebook ads are only shown to users on Facebook and within the services of Facebook's partners (the "Audience Network" https://www.facebook.com/audiencenetwork/) who have shown an interest in our online services or who possess certain characteristics (e.g., interests in specific topics or products identified based on the websites visited) that we transmit to Facebook (so-called "Custom Audiences"). We also want to ensure that our Facebook ads align with the potential interests of users and are not perceived as intrusive. Furthermore, the Facebook Pixel helps us track the effectiveness of Facebook ads for statistical and market research purposes by allowing us to see whether users were redirected to our website after clicking on a Facebook ad (so-called "conversion tracking").

Controllers / Data recipients: In accordance with Art. 4(7) and Art. 26 GDPR, we are joint controllers for the processing of so-called "event data" with: Meta Platforms Ireland Ltd. (hereinafter referred to as "Facebook"), 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Parent company: Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. This joint responsibility is limited exclusively to the collection of data and its transfer to Facebook. Any processing by Facebook that occurs after the transfer is not part of this joint responsibility. Facebook is responsible for the data security of Facebook products. The essential contents of the joint controller agreement pursuant to Art. 26 GDPR can be found here: https://www.facebook.com/legal/controller_addendum
Purposes of processing: a) Displaying content and advertising information that corresponds to the presumed interests of users; b) Delivery of commercial and transactional messages (e.g., contacting users via Facebook Messenger); c) Improving ad delivery and personalizing features and content (e.g., improving the detection of which content or advertising information is likely to correspond to the interests of users).
Legal basis: For the use of Facebook Conversion, you may have provided us with your consent in accordance with Art. 6(1)(a) GDPR, which you can revoke at any time with future effect by deselecting "Marketing" or "Facebook/Meta" in the cookie settings on our website.
Storage period: We store the anonymized data collected in this way for a maximum period of 14 months. After this, the data is automatically deleted. Regarding the storage period by Meta, please refer to their privacy policy.
Facebook Privacy Center (managing privacy settings): https://www.facebook.com/privacy/center/
Facebook Privacy Policy: https://www.facebook.com/privacy/policy/
Your rights regarding Facebook: You can contact Facebook directly via this contact form to exercise your data subject rights: https://help.meta.com/support/privacy/
Third-country transfer: To the extent that non-anonymized data is transferred to the parent company, Meta Platforms, Inc., the data processing takes place in the USA.
Commission adequacy decision: Regarding data transfers to Meta Platforms, Inc., we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework under Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

Facebook Conversion API

We have integrated the Facebook Conversion API into our website. The provider of this service is Meta Platforms Ireland Limited (hereinafter referred to as "Facebook"). The Facebook Conversion API allows us to record your interactions with our website and share them with Facebook to improve advertising performance on Facebook.

For this purpose, the time of access, the webpage visited, your IP address, and your user agent, as well as any other specific data (e.g., products purchased, shopping cart value, and currency), are collected. A complete overview of the data that can be collected can be found here: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters.

Purpose of processing: Tracking (e.g., interest-based/behavioral profiling), analysis of visitor actions, interest-based and behavioral marketing, profiling (creation of user profiles), conversion measurement (measuring the effectiveness of marketing activities), and reach measurement (e.g., access statistics, recognition of returning visitors). These purposes apply to both us and Meta and its parent company.
Controllers / Data recipients: In accordance with Art. 4(7) and Art. 26 GDPR, we are joint controllers for the processing of conversion data with: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Parent company: Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. This joint responsibility is limited exclusively to the collection of data and its transfer to Facebook. Any processing by Facebook that occurs after the transfer is not part of this joint responsibility. Facebook is responsible for the data security of Facebook products. The essential contents of the joint controller agreement pursuant to Art. 26 GDPR can be found here: https://www.facebook.com/legal/controller_addendum
Legal basis: For the use of Facebook Conversion, you may have provided us with your consent in accordance with Art. 6(1)(a) GDPR, which you can revoke at any time with future effect by deselecting "Marketing" or "Facebook/Meta" in the cookie settings on our website.
Storage period: We store the anonymized data collected in this way for a maximum period of 6 months. After this, the data is automatically deleted. Regarding the storage period by Meta, please refer to their privacy policy.
Facebook Privacy Center (managing privacy settings): https://www.facebook.com/privacy/center/
Facebook Privacy Policy: https://www.facebook.com/privacy/policy/
Your rights regarding Facebook: You can contact Facebook directly via this contact form to exercise your data subject rights: https://help.meta.com/support/privacy/
Third-country transfer: To the extent that non-anonymized data is transferred to the parent company, Meta Platforms, Inc., data processing takes place in the USA.
Adequacy decision of the Commission: Regarding data transfers to Meta Platforms, Inc., we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

IV.4.d. Microsoft

Microsoft Advertising

On our website, we use the following tools, which are provided and operated by Microsoft Corporation ("Microsoft").

Conversion Tracking

This is a tool for measuring the reach of our advertisements. It determines how successful our advertising efforts are on Bing and Yahoo. This allows us to display only the advertising that is of interest to the respective user. For this purpose, the Microsoft UET (Universal Event Tracking) tag is integrated into our website. This JavaScript code enables Microsoft to collect pseudonymized data about user visits and the use of our website via cookies (e.g., regarding the browser session and the displayed website) and to provide us with aggregated, non-personal statistics based on this (e.g., how many visitors reached a specific landing page).

Purposes of processing: Marketing, profiles with user-related information (creation of user profiles)
Legal bases: For the use of Microsoft Ads, you may provide us with your consent in accordance with Art. 6(1)(a) GDPR, which you can revoke at any time with effect for the future by deselecting "Marketing" or "Microsoft Ads" in the cookie settings on our website.
Storage duration: Regarding the storage duration by Microsoft, please refer to their privacy policy.
Objection / Opt-Out: If you do not want information about your behavior to be used by Microsoft as explained above, you can refuse the necessary cookie placement – for example, via browser settings that generally deactivate the automatic placement of cookies. Furthermore, you can prevent the collection of data generated by the cookie and related to your use of the website, as well as the processing of this data by Microsoft, by using the following link to https://account.microsoft.com/privacy/ad-settings/signedout declare your objection.
Data recipient: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA
Microsoft Privacy Policy: https://privacy.microsoft.com/de-de/privacystatement.
Third-country transfer: To the extent that non-anonymized data is transferred to Microsoft Corp., data processing takes place in the USA.
Adequacy decision of the Commission: Regarding data transfers to Microsoft Corporation, we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework under Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

IV.4.e. Mixpanel

On our website, we use the tool Mixpanel, provided by Mixpanel Inc. We use this tool for product analysis.

Mixpanel uses cookies to collect your browser type, operating system, language settings, and IP address, and to transmit this data to a Mixpanel server. We receive your IP address from Mixpanel only in an anonymized form to ensure that your privacy remains protected.

Purpose of processing: Tracking (e.g., interest-based/behavioral profiling), analysis of visitor actions, interest-based and behavioral marketing, profiling (creation of user profiles), conversion measurement (measuring the effectiveness of marketing measures), reach measurement (e.g., access statistics, recognition of returning visitors). These purposes apply to both us and Mixpanel.
Data recipient / Processor: Mixpanel, Inc., One Front Street, Floor 28, San Francisco, CA 94111, USA
Legal basis: For the use of Mixpanel, you may provide us with your consent in accordance with Art. 6(1)(a) GDPR, which you can revoke at any time with effect for the future by deselecting "Marketing" or "Segment" in the cookie settings on our website.
Storage duration: Regarding the storage duration by Mixpanel, please refer to their privacy policy.
Mixpanel Privacy Policy: https://mixpanel.com/legal/privacy-policy
Mixpanel information on GDPR compliance: https://mixpanel.com/legal/mixpanel-gdpr
Third-country transfer: To the extent that non-anonymized data is transferred to Mixpanel, data processing takes place in the USA.
Commission Adequacy Decision: Regarding data transfers to Mixpanel, Inc., we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

IV.4.f. Segment

We use a marketing tool from Segment, provided by the company Segment.io Inc. ("Segment"), on our website. This tool allows us to analyze user behavior on our website. For this purpose, usage profiles are created using pseudonyms.

Purposes of processing: Tracking (e.g., interest-based/behavioral profiling), analysis of visitor actions, interest-based and behavioral marketing, profiling (creation of user profiles), conversion measurement (measuring the effectiveness of marketing measures), reach measurement (e.g., access statistics, recognition of returning visitors). These purposes apply to both us and Segment.
Legal basis: For the use of Segment, you may have provided us with your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR, which you can revoke at any time with future effect by deselecting "Marketing" or "Segment" in the cookie settings on our website.
Data recipient/processor: Segment.io, Inc. 100 California Street, Suite 700 San Francisco, CA 94111 USA, https://segment.com/
Storage duration: Regarding the storage duration by Segment, please refer to their privacy policy.
Segment Privacy Policy: https://segment.com/legal/privacy/
Third-country transfer: To the extent that non-anonymized data is transferred to Segment, data processing takes place in the USA.
Commission Adequacy Decision: Regarding data transfers to Segment, we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

IV.4.g. Mouseflow

We use the Mouseflow tool provided by Mouseflow ApS on our website. We use this tool for product analytics.

Mouseflow performs "A/B testing," "click tracking," and "heatmaps" on our behalf to understand the impact of various changes to our website (e.g., changes to input fields, design, etc.). A/B tests are used to improve the usability and performance of online services. In this process, website users are shown different versions of a webpage or its elements, such as input forms, where the placement of content or the labeling of navigation elements may differ. Based on user behavior—such as longer dwell times on the website or more frequent interaction with specific elements—it can then be determined which of these webpages or elements better meet user needs. "Click tracking" allows for an overview of user movements across an entire online service. Since the results of these tests are more accurate when user interaction can be tracked over a certain period, cookies are generally stored on the users' computers for these test purposes. "Heatmaps" represent user mouse movements aggregated into an overall image, which helps identify, for example, which webpage elements are preferred and which are less preferred by users.

Purpose of processing: Tracking (e.g., interest-based/behavioral profiling), visitor action analysis, interest-based and behavioral marketing, profiling (creation of user profiles), conversion measurement (measuring the effectiveness of marketing activities), reach measurement (e.g., access statistics, recognition of returning visitors). These purposes apply to both us and Mouseflow.
Data recipients / Processors: Mouseflow Aps, Flaesketorvet 68, 1711 Copenhagen V, Denmark, https://mouseflow.com/de/
Legal basis and legitimate interests: For the use of cookies for Mouseflow, you may provide us with your consent in accordance with Art. 6(1)(a) GDPR, which you can revoke at any time with future effect by deselecting "Marketing" or "Mouseflow" in the cookie settings on our website. Our overriding legitimate interest pursuant to Art. 6(1)(f) GDPR lies in the promotion of our products and services.
Opt-out: Mouseflow provides an "opt-out" link that generally prevents you from being tracked by Mouseflow while browsing the internet. To do this, Mouseflow places a cookie on your device that informs the website you are visiting not to track you via Mouseflow. This function remains active only until you delete this cookie. Link: https://mouseflow.com/opt-out/
Storage duration: Regarding the storage duration by Mouseflow, please refer to their privacy policy.
Mouseflow privacy policy: https://mouseflow.com/legal/privacy-policy/
Mouseflow cookie information: https://help.mouseflow.com/en/articles/4282966-what-is-your-cookie-policy

IV.4.h. Reddit

Our website uses "Reddit Conversion Tracking" from the company Reddit Netherlands B.V. This allows us to analyze how many users have clicked on our ads on Reddit and subsequently reached our website. To this end, a tracking pixel is set with your consent to analyze the actions you take on our website. The data collected in this way is used to create conversion statistics for us. This tells us the total number of users who responded to our ad and were then redirected to a page equipped with a Reddit pixel. We do not receive any information during this process that would allow us to personally identify you as a user.

By integrating Reddit conversion pixels, Reddit receives information that you have visited the corresponding page of our website or clicked on one of our ads. If you are registered with a Reddit service, Reddit can associate the visit with your account. Even if you are not registered with Reddit or have not logged in, it is possible that the provider will obtain and store your IP address and other identifiers.

Purposes of processing: Advertising, marketing, tracking (e.g., interest-based/behavioral profiling), visitor action analysis, interest-based and behavioral marketing, profiling (creation of user profiles), conversion measurement (measuring the effectiveness of marketing activities), reach measurement (e.g., access statistics, recognition of returning visitors).
Legal basis and legitimate interests: For the use of the Reddit pixel and cookies for Reddit, you may provide us with your consent in accordance with Art. 6(1)(a) GDPR, which you can revoke at any time with future effect by deselecting "Marketing" or "Reddit" in the cookie settings on our website. Our overriding legitimate interest pursuant to Art. 6(1)(f) GDPR lies in the promotion of our products and services and in measuring the effectiveness of our marketing activities.
Data recipients: Reddit Netherlands B.V. Euro Business Center Keizersgracht 62, 1015CS Amsterdam, Netherlands
Reddit privacy policy: https://www.reddit.com/de-de/policies/privacy-policy
Storage duration: Regarding the storage duration by Reddit, please refer to their privacy policy.

IV.5. Website Security

We have integrated the services of Myra Security GmbH (hereinafter "Myra") into our Billbee app. The firewall used monitors web traffic on our website and protects it against cyberattacks, among other things. To do this, the firewall collects the user's IP address and the URL accessed. Cookies are also used.

Purpose of processing: Improving security and protection against cyberattacks using the Myra Hyperscale Web Application Firewall (WAF)
Legal basis and legitimate interests: The use of Myra is based on our overriding legitimate interest in the technical security of our website and IT systems in accordance with Art. 6 (1) sentence 1 lit. f GDPR.
Data recipient / processor: Myra Security GmbH, https://www.myrasecurity.com/de/
Myra Privacy Policy: https://www.myrasecurity.com/de/datenschutz/
Storage period: 10 days in Myra, then 12 months in Datadog

IV.6. Web Monitoring

We have integrated the monitoring services of Datadog, Inc. (hereinafter "Datadog") into our Billbee app. The system notifies us of potential errors on our pages. For this purpose, user log data is collected to analyze and resolve errors.

Purpose of processing: Automated monitoring to ensure availability and security
Legal basis and legitimate interests: The use of Datadog is based on our overriding legitimate interest in the technical security and availability of our website and IT systems in accordance with Art. 6 (1) sentence 1 lit. f GDPR.
Data recipient/processor: Datadog Inc., https://www.datadoghq.com
Datadog Privacy Policy: https://www.datadoghq.com/legal/privacy/
Storage period: 12 months
Third-country transfer: Unless anonymized data is transferred to Datadog, data processing takes place in the USA.
Appropriate safeguards: We have entered into a Data Processing Agreement (DPA) with Datadog to protect your personal data. This also includes the EU Standard Contractual Clauses, which are considered appropriate safeguards under Art. 46 (2) c GDPR for the transfer of data outside the EU, the EEA, or countries recognized by the European Commission as providing an "adequate" level of data protection.
Commission adequacy decision: Furthermore, Datadog is certified under the EU-U.S. Data Privacy Framework. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/. The EU Commission's decision of July 10, 2023, serves as an adequacy decision pursuant to Art. 45 GDPR.

IV.7. Affiliate

FirstPromoter

We use an affiliate tool from Igil Webs SRL ("FirstPromoter") on our website. This tool allows us to manage our affiliate links and pay out commissions to eligible individuals. For this purpose, users who click on the affiliate links (so-called "leads") are tracked using their IP address. In individual cases,

Purposes of processing: Marketing, direct advertising. FirstPromoter collects and processes the IP address for fraud analysis and data security purposes in order to detect and block fraudulent sign-ups, to block IP addresses with suspicious behavior, to limit the number of API requests, and to mitigate DDoS attacks on specific users.
Legal bases and legitimate interests: For the use of cookies for FirstPromoter, you may provide us with your consent pursuant to Art. 6(1)(a) GDPR, which you can revoke at any time with effect for the future by deselecting "Marketing" in the cookie settings on our website. Our overriding legitimate interest pursuant to Art. 6(1)(f) GDPR lies in the promotion of our products and services.
Data recipient/processor: Igil Webs SRL, Str. Talmacelului, nr. 30, Talmaciu, Sibiu, Romania, https://www.firstpromoter.com/
Storage duration: Regarding the storage duration by FirstPromoter, please refer to their privacy policy.
FirstPromoter Privacy Policy: https://www.firstpromoter.com/privacy and https://www.firstpromoter.com/gdpr
Objection / Opt-out / Data subject rights: Data subject rights can be exercised against FirstPromoter via the following link: https://firstpromoter.gdprform.io/de

IV.8. Review Seal

ProvenExpert

We use a review seal from Expert Systems AG ("ProvenExpert") to display service reviews from other customers. When you visit a page, your browser loads the necessary resources into its browser cache to display the review seal correctly.

For this purpose, the browser you are using must connect to the ProvenExpert servers. As a result, ProvenExpert becomes aware that our website has been accessed via your IP address.

Purpose of processing: Displaying customer reviews on our website
Data recipient: Expert Systems AG, Quedlinburger Straße 1, 10589 Berlin
Legal basis and legitimate interests: Our overriding legitimate interest pursuant to Art. 6 (1) sentence 1 lit. f GDPR in a professional and consumer-oriented presentation of our online services.
ProvenExpert Privacy Policy: https://www.provenexpert.com/de-de/datenschutzbestimmungen/
ProvenExpert Terms of Use: https://www.provenexpert.com/de-de/nutzungsbedingungen/

IV.9. Videos

YouTube Videos

Our website uses the embedding function of YouTube, which belongs to Google Ireland Ltd. (Google). When you visit a page with an embedded YouTube video, a connection to YouTube's servers is established. This informs YouTube which pages you are visiting. If you are logged into your YouTube account, YouTube can associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your YouTube account beforehand. When a YouTube video is started, Google uses cookies that collect information about user behavior. Further information on the purpose and scope of data collection and processing by YouTube can be found in Google's privacy policies.

Purposes of processing: Provision of a comprehensive and professional online presence, including videos. User-friendly playback without leaving the website. Speed of video playback.
Legal basis: For the use of YouTube, you may provide us with your consent in accordance with Art. 6 (1) sentence 1 lit. a GDPR, which you can revoke at any time with effect for the future by deselecting "External Media" or "YouTube" in the cookie settings on our site. The analysis by Google is carried out in accordance with Art. 6 (1) lit. f GDPR based on Google's legitimate interests in displaying personalized advertising, market research, and/or designing its website according to requirements. You have the right to object to the creation of these user profiles; to exercise this right, you must contact YouTube.
Storage duration: We store the anonymized data collected in this way for a maximum period of 14 months. After this, the data is automatically deleted. Regarding the storage duration by Google, please refer to their privacy policy.
Data recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Google Privacy Policy: https://policies.google.com/privacy
Right to object (opt-out plugin): https://tools.google.com/dlpage/gaoptout?hl=de
Third-country transfer: Unless anonymized data is transferred to Google LLC, data processing takes place in the USA.
Commission adequacy decision: Regarding data transfers to Google LLC, we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

IV.10. Contacting us

When you contact us (e.g., via contact form, email, telephone, or fax), personal data is collected. The data collected via a contact form can be seen from the respective form. This data is stored and used exclusively for the purpose of responding to your request or for establishing contact and the associated technical administration. We cannot process your request without this mandatory information. All other information is provided voluntarily.

Purpose of processing: Responding to your request
Legal basis: Art. 6(1)(b) GDPR for pre-contractual or contractual matters. Art. 6(1)(a) GDPR for your voluntary information.
Data recipients: Email service providers for emails, hosting providers for contact form inquiries
Storage duration: Your data will be deleted once your request has been fully processed. This is the case when it is clear from the circumstances that the matter in question has been conclusively resolved and provided there are no statutory retention obligations to the contrary. In the case of pre-contractual and contractual matters, your request will be stored until the contract is terminated, after which processing will be restricted. If there is no longer a legal basis for storage, the data will be deleted.

IV.11. Online forms

We have integrated an online form, "Jotform," provided by Jotform Ltd., into our website. The data entered into the form is transmitted to and stored by Jotform. For the purpose of sending requested information, the data is forwarded to Peaberry Software, Inc. Jotform stores the data on European servers.

Purpose of processing: Responding to inquiries, sending information
Data recipients / processors: Jotform Ltd., https://www.jotform.com (Form hosting), Peaberry Software, Inc., https://customer.io (Email delivery)
Jotform Privacy Information: https://www.jotform.com/privacy/
Peaberry Privacy Information: https://customer.io/legal/privacy-policy
Legal bases: Art. 6(1)(b) GDPR for mandatory information in the form. Art. 6(1)(a) GDPR for all optional information as well as for the newsletter subscription.
Revocation of consent: You have the right to revoke your consent at any time with effect for the future. Please contact the email address of the controller (see above).
Requirement to provide data: You must provide the data marked as mandatory fields in the form. Otherwise, we cannot provide you with the requested information.
Storage duration: Until the newsletter is unsubscribed.

IV.12. BEE Support Chat

On our website, we use the technical infrastructure of GUURU for "BEE Support."

You can submit your support request via a chat input and receive answers within moments regarding the use of the Billbee app from other Billbee users ("BEEs") who have registered with GUURU. GUURU uses cookies to provide its service.

Purpose of processing: Use of support regarding our Billbee app.
Data recipients: GUURU Solutions GmbH, Rothusstrasse 21, 6331 Hünenberg, Switzerland (data processor), other Billbee users ("BEEs")
Legal basis: For the storage of cookies by GUURU, you may provide us with your consent pursuant to Art. 6(1) sentence 1(a) GDPR, which you can revoke at any time with effect for the future by reversing your selection in the cookie settings on our site. For the use of GUURU, you enter into a user agreement (Art. 6(1) sentence 1(b) GDPR) with GUURU; see under https://www.guuru.com/de/terms-of-service/
Storage duration: Regarding the storage duration at GUURU, we refer to their privacy policy.
GUURU Privacy Policy: https://www.guuru.com/de/privacy-policy/
Third-country transfer: Data processing by GUURU takes place in Switzerland.
Appropriate safeguards: Regarding Switzerland, there is an adequacy decision by the European Commission pursuant to Art. 45 GDPR. This is considered an appropriate safeguard under Art. 44 GDPR.

IV.13. Newsletter

IV. 13.a Customer Newsletter

We send the following newsletters via email to our customers and their employee accounts:

Billbee news: Our monthly marketing newsletter about our company, our products, services, promotions, and offers.
Product news: Our newsletter regarding the Billbee app, upcoming product versions, features, and similar updates.
Onboarding news: Our emails following onboarding to help you get to know the Billbee app.
Transactional emails: Contract-relevant information regarding the Billbee app, critical information concerning the account, such as upcoming maintenance times or pending changes to the account.

For distribution, we use the first name and email address. We also process so-called delivery metrics. These are essentially information about whether an email was sent, delivered, opened, clicked, marked as spam, or suppressed, as well as whether delivery failed or the user unsubscribed. Further information is available from the service provider (see below).

Purpose of processing: Direct marketing, customer communication
Legal basis and legitimate interests: The sending of "transactional emails" is based on our contractual relationship with you (Art. 6 (1) sentence 1 lit. b GDPR). The sending of other newsletters is based on our legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR) in regular customer communication and sales promotion through direct marketing.
Right to object (Opt-out): You can object to the receipt of our newsletters (with the exception of "transactional emails") at any time with effect for the future by clicking the link found at the end of every newsletter or by changing your preferences in the customer area of the Billbee app.
Obligation to provide data: To send you the newsletter, we require at least your valid email address. Otherwise, it is not possible to send it.
Storage period: Your data for "transactional emails" will be stored until the termination of the contract between us and thereafter restricted in processing until the expiration of existing retention obligations. Your data for other newsletters will be stored until you object. Thereafter, processing will be restricted and the data will be blocked for further newsletter distribution. Newsletters to employee accounts are only sent if there has been a login to the Billbee app within the last 90 days.

IV. 13.b Advent Calendar Newsletter

We send newsletters via email to registered users as a reminder to participate in our Advent calendar giveaway. The newsletter is sent daily during the Advent season each year. In addition to the mandatory fields "First Name" and "Email Address," we collect so-called delivery metrics when sending the emails. These are essentially information about whether an email was sent, delivered, opened, clicked, marked as spam, or suppressed, as well as whether delivery failed or the user unsubscribed. Further information is available from the service provider (see below).

Purpose of processing: Direct marketing, customer communication
Legal basis: When registering for our newsletter, the user provides their consent (Art. 6 (1) sentence 1 lit. a GDPR).
Double opt-in procedure: Registration for our newsletter generally follows a so-called double opt-in procedure. After registering, you will receive an email asking you to confirm your registration. This confirmation is necessary to verify the accuracy of your email address. Newsletter registrations are logged to be able to prove the registration process in accordance with legal requirements. This includes storing the time of registration and confirmation as well as the IP address.
Right of withdrawal/Opt-out: You can cancel the receipt of our newsletter at any time, i.e., withdraw your consent, by informing us via email or by clicking the link found at the end of every newsletter. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
Obligation to provide data: To send you the newsletter, we require at least your valid email address. Otherwise, it is not possible to send it.
Storage period: Your data will be stored until you withdraw your consent, at the latest until the end of a calendar year. Thereafter, processing will be restricted and the data will be stored for up to three years in order to be able to provide proof of previously granted consent in a legally compliant manner. This is based on our legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR) in being able to demonstrate data protection compliance.

IV. 13.c Newsletter Service Providers

customer

Data recipient: Peaberry Software, Inc., 9450 SW Gemini Dr., Suite 43920, Beaverton, Oregon 97008-7105, USA, https://customer.io/
Peaberry privacy policy: https://customer.io/legal/privacy-policy
Information on delivery metrics: https://docs.customer.io/journeys/analytics/#delivery-metrics
Retention period: Your data will be stored until you withdraw your consent. Afterward, processing will be restricted and the data will be stored for up to three years to provide legal proof of previously granted consent.
Third-country transfer: To the extent that non-anonymized data is transferred to Peaberry, data processing takes place in the USA.
Adequacy decision by the Commission: Regarding data transfers to Peaberry, we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

IV.14. Comment function

If you use the option to submit a comment on our website, we require the mandatory information indicated in the comment form based on the user agreement concluded with you. We cannot publish your comment without this mandatory information.

Purpose of processing: Publication of your personal comment on our website.
Legal basis: User agreement (Art. 6(1)(b) GDPR)
Retention period: We store your comment and any other non-published data until the end of the contract, at which point we restrict processing. Once there is no longer a legal basis for storage, the data will be deleted.

IV.15. "E-Commerce & Friends" Podcast

Podigee Podcast

We have integrated a plugin from Podigee on our website to provide our podcast episodes for playback. Podigee processes IP addresses and device information to enable podcast downloads/playback and to determine statistical data, such as access numbers. This data is anonymized or pseudonymized before being stored in Podigee's database, provided it is not required for the provision of the podcasts.

Purposes of processing: Member support, marketing
Legal basis: When you start playing the podcast, you are using our free service in accordance with Art. 6 (1) sentence 1 lit. b GDPR.
Data recipient: Podigee GmbH, Schlesische Straße 20, 10997 Berlin, https://www.podigee.com/de/
Storage duration: Regarding the storage duration by Podigee, we refer to their privacy policy.
Podigee Privacy Policy: https://www.podigee.com/de/ueber-uns/datenschutz

IV.16. Login via social media accounts

We use "single sign-on" or "single sign-on login/authentication" on our website. These are procedures that allow users to log in to our website using a user account from a single sign-on provider (e.g., a social network). A prerequisite for single sign-on authentication is that the user is registered with the respective single sign-on provider and enters the required access data in the provided online form, or is already logged in to the single sign-on provider and confirms the single sign-on login via a button.

When you visit a page on our website that contains such a login option, your browser establishes a direct connection to the social network's servers. The content of the plugin is transmitted directly from the respective social network to your browser and integrated into the page. Through this integration, the social network receives the information that your browser has accessed the corresponding page of our website, even if you do not have a profile with that social network or are not currently logged in. This information (including your IP address) is transmitted directly from your browser to a server of the social network and stored there.

When using "single sign-on," we receive a user ID with the information that the user is logged in to the respective single sign-on provider under this user ID, as well as an ID that we cannot use for other purposes (a so-called "user handle"). Whether additional data is transmitted to us depends solely on the single sign-on method used, the data sharing permissions selected during authentication, and which data the user has released in the privacy or other settings of their user account with the single sign-on provider. This usually includes an email address and username. Further information may include: profile picture, age, and gender. We do not receive or store the password for the social network.

Purpose of processing: Convenient login to our services without separate (new) access data
Legal basis: Your consent pursuant to Art. 6 (1) sentence 1 lit. a GDPR
Right of withdrawal: You have the right to withdraw your consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. If the link between the social network and our access area is to be removed, the user must disconnect the access data from the respective social network and cancel their registration with us.
Storage duration: Until you withdraw your consent

We offer single sign-on via the following social networks:

Facebook Connect

Responsibilities: Pursuant to Art. 4 No. 7, 26 GDPR, we are joint controllers for the processing of so-called "event data" with: Meta Platforms Ireland Ltd. (hereinafter referred to as "Facebook"), 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Parent company: Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. The essential contents of the joint controller agreement pursuant to Art. 26 GDPR can be found here: https://www.facebook.com/legal/controller_addendum
Purpose of processing: a) Displaying content and advertising information that corresponds to the presumed interests of the users; b) Delivery of commercial and transactional messages (e.g., contacting users via Facebook Messenger); c) Improving ad delivery and personalizing features and content (e.g., improving the identification of which content or advertising information is likely to correspond to the users' interests)
Legal basis: see Facebook's data policy at: https://www.facebook.com/privacy/policy/
Storage duration: see Facebook's data policy at: https://www.facebook.com/privacy/policy/
Third-country transfer: To our knowledge, Facebook Ireland transfers user data to its parent company in the USA.
Commission adequacy decision: Regarding data transfers to Meta Platforms, Inc., we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

Google Sign-In

Data recipient: Google Ireland Limited (hereinafter referred to as "Google"), Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Purpose of processing: Authentication of login credentials
Legal basis: see Google's privacy policy at: https://policies.google.com/privacy
Storage duration: see Google's privacy policy at: https://policies.google.com/privacy
Third-country transfer: To our knowledge, Google Ireland transfers user data to its parent company in the USA.
Commission adequacy decision: Regarding data transfers to Google LLC, we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

IV.17. Opening a customer account

If you open a personal customer account with us for future orders, the following provisions apply:

Purpose of processing: User agreement for the personal customer account.
Legal basis: Contract pursuant to Art. 6 (1) (b) GDPR. For data provided voluntarily by you, your consent applies pursuant to Art. 6 (1) (a) GDPR.
Obligation to provide data: The mandatory information is indicated in the registration form. Without this data, we cannot open an account for you.
Data recipients: The customer account is managed via our online shop. This is operated by our web host (see above).
Storage period: Your data in the customer account will be stored for as long as the user agreement with us exists. Voluntary information will be stored until you withdraw your consent. Thereafter, processing will be restricted and the data stored for up to three years to be able to provide proof of previously granted consent in a legally compliant manner. This is based on our legitimate interests (Art. 6 (1) sentence 1 (f) GDPR) in the provability of data protection compliance.

IV.18. Ordering services

IV.18.a. General

Purpose of processing: Execution of your order.
Legal bases and legitimate interests: Contract pursuant to Art. 6 (1) (b) GDPR. For data provided voluntarily by you, your consent applies pursuant to Art. 6 (1) (a) GDPR. For other processing, Art. 6 (1) (f) GDPR applies. Our overriding legitimate interests: debt collection and enforcement; measures for business management and further development of services and products.
Data recipients: Web host of our platform (see above). Payment service providers. Legal counsel, collection agencies, business consultants.

IV.18.b. Payment processing

Purpose of processing: Execution of the order. Processing of payment.
Legal basis: Contract pursuant to Art. 6 (1) (b) GDPR.
Obligation to provide data: Depending on the selected payment method, you must provide us or the payment service provider with the necessary payment data.
Data recipients: The payment service providers used are listed below:

PayPal

Service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, https://www.paypal.com/de
PayPal Privacy Policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
Credit check: For the payment methods credit card via PayPal, direct debit via PayPal, or—if offered—"purchase on account" or "installment payment" via PayPal, PayPal reserves the right to perform a credit check. For this purpose, your payment data may be passed on to credit agencies in accordance with Art. 6 (1) (f) GDPR, based on PayPal's legitimate interest in determining your solvency. PayPal uses the result of the credit assessment regarding the statistical probability of payment default to decide on the provision of the respective payment method. The credit report may contain probability values (so-called score values). Where score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of the score values includes, among other things, but not exclusively, address data.

Stripe

If you choose a payment method from the payment service provider Stripe, payment processing is carried out by Stripe Payments Europe Ltd., to whom we transmit the information you provided during the ordering process along with information about your order (name, address, account number, bank code, credit card number if applicable, invoice amount, currency, and transaction number) in accordance with Art. 6 (1) (b) GDPR.

Service provider: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, https://stripe.com/de
Stripe Privacy Policy: https://stripe.com/de/privacy#translation
Further information on the handling of personal data can be found in the Privacy Center: https://stripe.com/de/privacy-center/legal
Third-country transfer: Unless non-anonymized data is transferred to Stripe, Inc., data processing takes place in the USA.
Commission adequacy decision: Regarding data transfers to Stripe, Inc., Stripe Payments Europe relies on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/. Further information is provided by Stripe at: https://stripe.com/de/legal/data-privacy-framework

IV.18.c. Direct marketing

Purpose of processing: Direct marketing, sales promotion
Legal basis and legitimate interests: Our overriding legitimate interest pursuant to Art. 6 (1) (f) GDPR consists of direct marketing and sales promotion.
Data recipients: Agency, lettershop

IV.18.d. Legal obligation

Purpose of processing: Fulfillment of legal obligations (e.g., information, notification, disclosure, and retention obligations, payment of taxes and duties)
Legal basis: The respective statutory provision in conjunction with Art. 6 (1) (c) GDPR applies.
Data recipients: Authorities, government institutions, legal counsel, tax advisors, and, if applicable, the data protection officer

IV.19. Sweepstakes

If you participate in our sweepstakes, the following data processing takes place:

Purpose of processing: Execution and administration of the sweepstakes.
Legal basis: For the required data, we rely on Art. 6 (1) lit. b GDPR. For any additional data provided voluntarily by participants, we rely on Art. 6 (1) lit. a GDPR.
Data recipients: We pass on the names and email addresses of the respective daily winners to the sponsors of the prizes who provide the prize on the corresponding day. The sponsors are identified in the terms and conditions of participation and the sweepstakes announcement.
Required data: As part of the sweepstakes, we inform participants which of their details are required for participation. Participation is not possible without this information.
Retention period: Participant data will be deleted as soon as the sweepstakes has ended and the data is no longer required to notify winners or because no further inquiries regarding the sweepstakes are expected. In principle, participant data is deleted no later than 6 months after the end of the sweepstakes. Data of winners may be retained longer, e.g., to answer questions regarding the prizes or to fulfill the prize obligations; in this case, the retention period depends on the nature of the prize and is, for example, up to three years for goods or services in order to process warranty claims. Furthermore, participant data may be stored for longer periods, e.g., in the form of reporting on the sweepstakes in online and offline media.
If data is collected for other purposes as part of the sweepstakes, its processing and retention period are governed by the privacy policy applicable to that specific use (e.g., in the case of newsletter registration during a sweepstakes).

IV.20. Login via comrce-Hub

We use a "Single Sign-On" login and authentication system on our website via a comrce-Hub account. This is a process that allows users to log in to our website using a comrce-Hub user account. A prerequisite for Single Sign-On authentication is that the user is registered with the comrce-Hub and confirms the Single Sign-On login by clicking the button.

When using "Single Sign-On" via the comrce-Hub, the following personal data is processed:

Email address
First and last name
User ID
Country

When you visit a page on our website that contains such a login option, your browser establishes a direct connection to the comrce-Hub servers. Through this integration, comrce-Hub receives information that your browser has accessed the corresponding page of our website, even if you are not logged in there at the time. This information (including your IP address) is transmitted directly from your browser to comrce-Hub and stored there.

Purpose of processing: Convenient registration for our services without separate (new) login credentials, authentication of login data.
Legal basis: Service agreement pursuant to Art. 6 (1) sentence 1 lit. b GDPR. Consent pursuant to Art. 6 (1) sentence 1 lit. a GDPR for voluntarily provided personal data.
Data recipient: comrce GmbH, Arolser Str. 10, 34477 Twistetal, https://www.comrce.io
Storage period: Until the end of the service agreement. In addition, data is stored to fulfill any statutory retention obligations.

V. What are my data protection rights?

1. As a data subject, you have the following rights:

Confirmation of data processing: You have the right to request confirmation from us as to whether your personal data is being processed. The requirements for this can be found in Art. 15 GDPR;
Access: You have the right to request information about your personal data that we process. The requirements for this can be found in Art. 15 GDPR;
Rectification: You have the right to request the immediate rectification of inaccurate personal data concerning you. The requirements for this can be found in Art. 16 GDPR;
Erasure: You have the right to request the immediate erasure of personal data concerning you. The requirements for this can be found in Art. 17 GDPR;
Restriction of processing: You have the right to request the restriction of the processing of your personal data. The requirements for this can be found in Art. 18 GDPR;
Data portability: You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format. You also have the right to have this data transmitted by us to another controller. The requirements for this can be found in Art. 20 GDPR;
Withdrawal of consent: You have the right to withdraw your consent at any time if the processing is based on Art. 6 (1) (a) or Art. 9 (2) (a) GDPR. The lawfulness of data processing carried out before your withdrawal remains unaffected. The withdrawal only applies to the future. The requirements for this can be found in Art. 7 (3) GDPR;
Complaint: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the GDPR. The requirements for this can be found in Art. 77 GDPR. You may contact the supervisory authority responsible for the controller or the one in your country or state. A list of all supervisory authorities can be found here: https://www.bfdi.bund.de/DE/Service/Anschriften/anschriften_node.html

2. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on our overriding legitimate interests (Art. 6 (1) (e) or (f) GDPR), with effect for the future; this also applies to profiling based on these provisions as defined in Art. 4 No. 4 GDPR. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or if the processing serves the establishment, exercise, or defense of legal claims.

3. Right to object to the processing of data for direct marketing and product review purposes

We collect and process your personal data for the purpose of direct marketing. You have the right to object at any time to the processing of personal data concerning you for such direct marketing; this also applies to profiling to the extent that it is related to such direct marketing.

In individual cases, we process and use your personal data to send you review requests and/or product recommendations via email that are exclusively related to your purchase, contract, and/or other similar transactions. Furthermore, we may use your email address and/or postal address in this context to send you product recommendations for similar goods and/or services offered by us via email and/or post. You will receive these review requests and product recommendations from us regardless of whether you have subscribed to a newsletter.
Exercising your right to object: You may object to this data processing for direct marketing purposes at any time by sending a letter to Billbee GmbH, Arolser Str. 10, 34477 Twistetal, or an email to privacy@bilbee.io and/or by clicking the link at the end of any promotional email, with effect for the future, without incurring any costs other than the transmission costs at the basic rates. Your right to object also automatically applies to any potential profiling associated with such direct marketing.

If you object to processing for direct marketing purposes, we will immediately cease processing your personal data for these purposes.

VI. How long will my data be stored?

Unless otherwise specified above, the following criteria apply to determining the storage period:

In the case of Consent pursuant to Art. 6 (1) (a) GDPR, the data will be stored until the data subject withdraws their consent.
In the case of pre-contractual and contractual purposes pursuant to Art. 6 (1) (b) GDPR, storage takes place after the end of the contract until the expiry of relevant limitation periods (e.g., 3 years in accordance with Section 195 of the German Civil Code (BGB)) arising from the concluded contract.
In the case of our overriding legitimate interest pursuant to Art. 6 (1) (f) GDPR, the data will be stored until the data subject exercises their right to object in accordance with Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or the processing serves the establishment, exercise, or defense of legal claims.
In the case of Direct marketing pursuant to Art. 6 (1) (f) GDPR, the data will be stored until the data subject exercises their right to object in accordance with Art. 21 (2), (3) GDPR.
In the case of Retention obligations the relevant documents will be kept until the expiry of the applicable statutory provisions (e.g., 10 or 6 years in accordance with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB)).
Prospective customer data are stored for as long as it can be assumed that there is still an interest in working with us. If we assume that there is no longer any interest, we will delete this data.
Business partner data are stored for as long as it can be assumed that there is still an interest in working with us. If we assume that there is no longer any interest, we will delete this data no earlier than 3 years after the end of the last business relationship, provided there are no statutory retention obligations.
Supplier data we store this until the supplier objects and delete it no earlier than 3 years after the end of the last business relationship, provided there are no statutory retention obligations.

Otherwise, personal data is only stored for as long as there is a legal basis for storage.

VII. Source of personal data

We process personal data that we have received from you or from the recipients of personal data.

VIII. Obligation to provide data

As part of the fulfillment of our contractual or legal obligations, you as the data subject may be required to provide our company with personal data that is necessary for the establishment, execution, and termination of the contractual relationship and the fulfillment of the associated contractual obligations, or which we are legally required to collect. Without this data, we will generally have to refuse to conclude the contract or will no longer be able to execute an existing contract and may have to terminate it.

IX. Cookies

IX.1. General

(aa) Definitions

Below you will find comprehensive information about "cookies" and other storage technologies ("web storage"). These are pieces of information that are often stored in databases on your device. Every type of "cookie" or "web storage" can contain personal data. In many cases, however, the data is pseudonymized. The following terms may be used below:

First-party cookie: This cookie is stored or modified by the website you are currently browsing.
Third-party cookie: This cookie is stored or modified by third parties with whom the website operator is affiliated (e.g., an advertising network, a social media platform, etc.).
Session cookie: This cookie is deleted from your device when you close your browser. A session cookie often only stores a session ID to assign multiple requests from a user on a page to their session.
Persistent cookie: This cookie is stored on your device until it expires or you delete it manually or automatically in your browser.
Strictly necessary: Without this cookie and web storage, the service you have requested cannot be provided.
Optional: This cookie and web storage enables us to use additional functions and is only used if you provide your consent for this.
Local storage: Part of what is known as "web storage." This information is also stored in your web browser until it is manually deleted.
Session storage: Part of what is known as "web storage." This information is also stored in your web browser until the browser window is closed.

(bb) Legal grounds

Strictly necessary cookies and web storage: The storage of and access to this information is based on the legal grounds of Section 25 (2) No. 2 of the TDDDG (German Telecommunications Digital Services Data Protection Act).
Optional cookies and web storage: The storage of information and access to it are based on your individual, personal, and voluntary consent in accordance with Section 25 (1) TDDDG in conjunction with Art. 6 (1) lit. a GDPR. You can withdraw your consent at any time with effect for the future. Data processing remains lawful until the point of withdrawal. Please note that if you do not accept optional cookies, some functions of our website may be limited.

(cc) Data recipients / Access

First-party cookies: Only we, as the data controller and website operator, have access to these.
Third-party cookies: Only the third party that set these cookies has access to them. For example, only Google has access to a cookie set by Google and can read or modify it.
Web storage: Only we, as the data controller and website operator, have access to this.

(dd) Storage duration

Session cookies: These are only stored temporarily in your browser until the end of the browser session or can be deleted by you beforehand.
Persistent cookies: These remain stored on your device for as long as specified for the respective cookie or until you delete them beforehand.
Local storage: This remains stored until it is manually deleted.
Session storage: This remains stored until the browser window is closed.

The exact storage duration is specified under "Cookies and web storage used".

(ee) Deletion options / Right to object

Please note that you can configure your browser to notify you when cookies are set, allowing you to decide on a case-by-case basis whether to accept them or to exclude the acceptance of cookies for specific cases or in general. Each browser manages cookie settings differently. This is described in the help menu of each browser, which explains how you can change your cookie settings. You can find these for the respective browsers at the following links:

A general opt-out for cookies used for online marketing purposes can be declared for a large number of services, particularly in the case of tracking, via the US website https://www.aboutads.info/choices/ or the EU website https://www.youronlinechoices.com/.

Privacy statement