Privacy notice for business contacts

The controller for this processing is Benedict Herrnleben, sole trader, trading as Digitale Stempelkarten, Berlepschstraße 1, 14165 Berlin, Germany.

You reach him by email at hello@stampcards.eu or by telephone on +49 152 33532268.

There is no data protection officer. German law requires one only above a threshold that a one person business does not reach (Article 37 GDPR, Section 38 BDSG). Benedict Herrnleben answers data protection questions himself, at the address above.

The controller is established in the European Union, so there is no representative under Article 27 GDPR.

We write to small, owner-run businesses with walk-in customers (for example cafes, bakeries, hairdressers, nail salons, restaurants, studios) with a business offer. Our main product is a digital stamp card that your customers add to Apple Wallet or Google Wallet, without installing an app.

The purpose is to contact you about our products and services for your business, and the conversation that may follow.

We use your address only to contact you about our products for your business. There is no sale and no transfer to anyone else for their own purposes. The email concerns your business only and is addressed to you in your professional capacity.

We process your data on the basis of our legitimate interest, Article 6(1)(f) GDPR. Recital 47 of the GDPR names direct marketing as a legitimate interest.

Our interest is to let businesses know about products that are built for them. Without the address a business publishes for contact, a first approach is not possible at all, and advertising or travelling to another country is out of proportion for a one person business.

Your interests were weighed before the first email went out. Anyone who publishes a business address so that people can get in touch can expect offers about that business. The intrusion is small: the data is public and business related, there are no special categories of data (Article 9 GDPR), no data about children and no profiling of individuals. You can object at any time, simply and without giving a reason, and every mailing is checked against our suppression list first. Our emails contain no tracking pixel. The balancing test is written down, dated, and reviewed when the processing changes.

Whether an advertising email is allowed at all also follows from the law of your own country. We write only to businesses in countries whose law allows a business offer by email without prior consent.

The entry for your business holds:

• the name and postal address of the business and the country it is in,
• the business email address you publish,
• the name and role of the owner or contact person, where your business publishes them; we note the role where the law of your country depends on it,
• the source the address came from and the date we noted it,
• which template we sent, when we sent it, whether you replied, whether a call was arranged and whether you objected,
• notes on our contact with you.

We hold no addresses that a business has not published for contact, no bank details and no data about your own customers.

Your data comes from publicly accessible business sources: the website of your business, its Google Business Profile, its business profiles on social networks, and business directories. Our email names the source we used for your address.

We research businesses in these sources, partly with automated tools.

The email is sent through our email provider Heinlein Hosting GmbH (“mailbox.org”), Berlin, Germany. It processes the data on our behalf under Article 28 GDPR and runs its servers in Germany.

Recipients of the data are our email provider and, where we use them, tools that help us manage contacts, all under Article 28 contracts. Public authorities receive data only where the law obliges us to hand it over.

We keep the data in the EU. If a provider transfers data outside the EEA, it does so under the safeguards of Chapter V GDPR (adequacy decision or standard contractual clauses).

You can ask for a copy of these safeguards at hello@stampcards.eu.

We keep your entry for as long as we offer products for businesses like yours in your country and you have not objected. We review the list from time to time and remove entries we no longer need.

Two things change this:

• You become a customer: the data moves into our customer records, and from that point our privacy notice for customers applies to it.
• You object: we keep your email address permanently on a separate suppression list, so that a second email can never reach you. Nothing is kept with it except the date and the reason. The legal basis for that list is Article 6(1)(c) together with Article 21(3) GDPR: once you have objected, we may not process your address for direct marketing again, and a list of addresses not to write to is the only way to keep that promise.

You can object to this processing at any time. You do not have to give a reason, and it costs you nothing.

Two ways, both of which reach a person:

• reply to our email with the word STOP, or
• write to hello@stampcards.eu from any address and name the business.

We act on your objection without delay, and in any case before we send any further email: before every mailing we process our mailbox and check every address against our suppression list. After that you will never get another email from us. For direct marketing this right is absolute (Article 21(2) and (3) GDPR): there is no balancing of interests, we do not ask you to justify it, and we do not ask you to confirm it a second time.

There is deliberately no form on this page. An objection that arrives as an email is one we can prove we received, and you keep your own copy of it.

For as long as we hold data about you, you have the rights the GDPR gives you: access to that data (Article 15), rectification of anything wrong (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20).

Write to hello@stampcards.eu and say what you want. We answer within one month (Article 12(3) GDPR), and if we ever need longer we tell you why and by how much. Exercising a right costs you nothing.

There is no consent here to withdraw: this processing is not based on consent (Article 6(1)(a) GDPR), so the withdrawal under Article 7(3) does not apply to it. The right that matters here is the right to object above.

You can complain to a data protection supervisory authority, and you do not have to contact us first. The authority responsible for the controller is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany, mailbox@datenschutz-berlin.de, www.datenschutz-berlin.de

You may also complain to the supervisory authority of the EU country where you live, where you work or where you believe the infringement happened (Article 77 GDPR), for example the Data Protection Commission in Ireland, the Autoriteit Persoonsgegevens in the Netherlands, the CNIL in France or the Office of the Data Protection Ombudsman in Finland.

There is no automated decision-making within the meaning of Article 22 GDPR in this processing.