Privacy Policy (Website)

Controller within the meaning of the GDPR

General Information

Your personal data within the meaning of Art. 4 No. 1 GDPR (e.g. IP address, username, email address) is processed by us only in accordance with the provisions of German data protection law and taking into account the European General Data Protection Regulation (GDPR).

Processing of personal data within the meaning of Art. 4 No. 2 GDPR is lawful pursuant to Art. 6 GDPR if one of the following conditions is met:

• The data subject has given consent to the processing of their personal data for one or more specific purposes;
• processing is necessary for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract;
• processing is necessary for compliance with a legal obligation;
• processing is necessary in order to protect the vital interests of the data subject or of another natural person;
• processing is necessary for the performance of a task carried out in the public interest;
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

Cookies

We use cookies on our website. These are small files that your browser automatically creates and that are stored on your device when you visit our website. Cookies do not cause any damage to your device and do not contain viruses, Trojans or other malware.

The use of cookies serves to make the use of our services more convenient for you. You can configure your browser so that no cookies are stored on your computer. However, completely disabling cookies may mean that you cannot use all functions of our website.

Contact

If you contact us by email or telephone, your inquiry, including all personal data resulting from it (name, inquiry), will be stored and processed by us for the purpose of handling your request. We do not disclose this data without your consent.

The data you send us in connection with contact inquiries will remain with us until you request deletion, withdraw your consent to storage or the purpose for data storage no longer applies. Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

User Rights

You may request information about the personal data stored about you at any time and free of charge. Your rights also include confirmation, rectification, restriction, blocking and erasure of such data and the provision of a copy of the data, as well as withdrawal of consent previously given and the right to object.

Your rights arise in particular from the following provisions of the GDPR:

• Article 15 – Right of access by the data subject
• Article 16 – Right to rectification
• Article 17 – Right to erasure (“right to be forgotten”)
• Article 18 – Right to restriction of processing
• Article 20 – Right to data portability
• Article 21 – Right to object
• Article 77 – Right to lodge a complaint with a supervisory authority

To exercise your rights, please contact the body specified under “Controller within the meaning of the GDPR”.

Competent Supervisory Authority

Hosting and Storage of Access Data

You can visit our websites without providing any personal information. We host our websites (loyalista.de and help.loyalista.de) as well as our systems with the following providers:

• Vercel Inc. (Frontend hosting and Content Delivery Network)
• Amazon Web Services EMEA SARL (Infrastructure, backend and helpdesk in the Frankfurt am Main region)

The providers of the websites automatically collect and store information in so-called server log files, which your browser automatically transmits to us. These include:

• Browser type / browser version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

This data cannot be assigned to specific persons. This data is not combined with other data sources. We reserve the right to review this data retrospectively if we become aware of specific indications of unlawful use.

The purpose of processing results from our legitimate interest within the meaning of Art. 6 para. 1 sentence 1 lit. f) GDPR in ensuring the secure, fast and reliable provision of our websites.

Corresponding data processing agreements (DPA) have been concluded with the hosting providers named above, generally by accepting the providers’ legally binding Terms of Service, which include these standards.

Helpdesk, Support and Authentication

For processing support inquiries, providing help articles and creating and managing support tickets, we use a self-hosted helpdesk solution (Frappe) on our servers at Amazon Web Services (AWS) in Frankfurt am Main.

Magic Link and Cookies: When you log in to our helpdesk, we use a so-called passwordless “Magic Link” procedure. For this purpose, you receive an email (sent via Microsoft Ireland Operations Limited) containing a one-time link that is valid for 30 minutes for security reasons.

After successfully clicking the link, you will be logged in and a technically necessary session cookie (name: loyalista_help_session) will be set in your browser. This cookie has a lifetime of 7 days and is used exclusively to authenticate you for the duration of your session so that you can, for example, view and reply to tickets or like articles. The legal basis for this is Art. 6 para. 1 lit. b GDPR (performance of a contract) and § 25 para. 2 TDDDG (technically necessary cookie).

Registration/Login

Registration is required in order to make full use of the services we offer. The data you enter in the input form is collected and stored. It is not disclosed to third parties unless this is necessary for the performance of the contractual relationship. You can change or delete the data at any time. After deletion of the data, the service can no longer be provided to you unless you register again.

In addition to the data entered by you, the IP address as well as the date and time of registration are stored. IP data is stored to prevent misuse and to investigate criminal offences.

Google Web Fonts

This website uses so-called web fonts provided by Google for the consistent display of fonts. When you access a page, your browser loads the required web fonts into its browser cache in order to display text and fonts correctly.

For this purpose, the browser you use must connect to Google’s servers. As a result, Google becomes aware that our website was accessed via your IP address. Google Web Fonts are used in the interest of a consistent and attractive presentation of our online services. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR.

If your browser does not support web fonts, a standard font from your computer will be used.

Further information about Google Web Fonts can be found at https://developers.google.com/fonts/faq and in Google’s privacy policy: https://www.google.com/policies/privacy/

Stripe

We offer payment via the external payment processing service Stripe. The provider for customers within the EU is Stripe Payments Europe, Ltd.,1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (hereinafter “Stripe”).

Data transfers to the USA are based on the Standard Contractual Clauses of the European Commission. Details can be found here: https://stripe.com/de/privacy and https://stripe.com/de/guides/general-data-protection-regulation

The use of Stripe is based on our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.

Details can be found in Stripe’s privacy policy at the following link: https://stripe.com/de/privacy

Inquiry by Email or Telephone

If you contact us by email or telephone, your inquiry, including all personal data resulting from it (name, inquiry), will be stored and processed by us for the purpose of handling your request. We do not disclose this data without your consent.

This data is processed on the basis of Art. 6 para. 1 lit. b GDPR insofar as your inquiry is related to the performance of a contract or is necessary in order to take steps prior to entering into a contract. In all other cases, processing is based on your consent (Art. 6 para. 1 lit. a GDPR) and / or on our legitimate interests (Art. 6 para. 1 lit. f GDPR), as we have a legitimate interest in effectively processing inquiries addressed to us.

The data you send us in connection with contact inquiries will remain with us until you request deletion, withdraw your consent to storage or the purpose for data storage no longer applies (e.g. after your request has been fully processed). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

Security of Your Data / SSL Encryption

In accordance with the statutory provision under § 13 para. 7 TMG, this website uses SSL encryption, identifiable by a lock symbol in the address bar of your browser. When SSL encryption is enabled, transmitted data cannot be read by third parties.

As a rule, 256-bit encryption is used. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can tell whether an individual page of our website is transmitted in encrypted form by the closed key or lock symbol in the lower status bar of your browser.

We also use appropriate technical and organisational security measures (TOM) to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

User Rights

You may request information about the personal data stored about you at any time and free of charge. Your rights also include confirmation, rectification, restriction, blocking and erasure of such data and the provision of a copy of the data in a form suitable for transmission, as well as withdrawal of consent previously given and the right to object. Statutory retention obligations remain unaffected.

Your rights arise in detail in particular from the following provisions of the GDPR:

• Article 7 para. 3 – Right to withdraw consent under data protection law
• Article 12 – Transparent information, communication and modalities for the exercise of the rights of the data subject
• Article 13 – Information to be provided where personal data is collected from the data subject
• Article 14 – Information to be provided where personal data has not been obtained from the data subject
• Article 15 – Right of access by the data subject, right to confirmation and provision of a copy of the personal data
• Article 16 – Right to rectification
• Article 17 – Right to erasure (“right to be forgotten”)
• Article 18 – Right to restriction of processing
• Article 19 – Notification obligation regarding rectification or erasure of personal data or restriction of processing
• Article 20 – Right to data portability
• Article 21 – Right to object
• Article 22 – Right not to be subject to a decision based solely on automated processing – including profiling
• Article 77 – Right to lodge a complaint with a supervisory authority

To exercise your rights (with the exception of Art. 77 GDPR), please contact the body specified under “Controller within the meaning of the GDPR” (e.g. by email).

Competent Supervisory Authority: