Privacy notice for customers

The controller is Benedict Herrnleben, sole trader, trading as Digitale Stempelkarten, Berlepschstraße 1, 14165 Berlin, Germany.

You reach him by email at hello@stampcards.eu or by telephone on +49 152 33532268.

There is no data protection officer. German law requires one only above a size that a one person business does not reach (Article 37 GDPR, Section 38 BDSG). Benedict Herrnleben answers data protection questions himself, at the address above.

Every processing has a purpose and a legal basis. Where we rely on a legitimate interest (Article 6(1)(f) GDPR), we say which one.

• Account: your email address, your password (stored only as a hash, never in plain text), the language of your account and the times you signed up and logged in. You need this to open the account and log in. Legal basis: Article 6(1)(b) GDPR (the contract and the steps before it).
• Setting up your stamp card: legal entity, business name, address, country, contact email, plan and billing interval, the design of your card and landing page with logo and images, and the links you enter there. Legal basis: Article 6(1)(b) GDPR.
• Concluding the contract and keeping proof of it: plan, prices, the versions of the main agreement and the data processing agreement with their checksum and language, the details of the parties, the time, your IP address and the identifier of your browser (user agent). Legal basis: Article 6(1)(b) GDPR for the contract itself; Article 6(1)(f) GDPR for the IP address and the browser identifier. Our legitimate interest is to be able to prove, in a dispute, who concluded which text and when.
• Invoices and VAT: invoice details (legal entity, address, contact email, service period, amount), the receipt of your payment and, if your business is outside Germany and you give it to us, your VAT identification number with the result and time of its check. Legal basis: Article 6(1)(b) GDPR and Article 6(1)(c) GDPR together with Section 14 of the German VAT Act (UStG) and Section 147 of the German Fiscal Code (AO). We check the VAT number because an invoice without VAT (reverse charge) requires a confirmed number (Article 6(1)(c) GDPR together with Article 18(1)(a) of Council Implementing Regulation (EU) No 282/2011).
• Payment handling through Stripe: your customer number at Stripe, the payment method you choose (card, SEPA direct debit, PayPal or bank transfer), the payment status of your invoices, the invoices themselves and our record of them (reminder, deadline, block under Section 5(6) of the Agreement). Card number, IBAN and mandate are held by Stripe alone, your PayPal log-in details by PayPal alone; we neither see nor store them. Legal basis: Article 6(1)(b) GDPR and, for the record as an accounting document, Article 6(1)(c) GDPR in conjunction with Section 147 AO.
• Emails sent by the application: confirming your sign up, resetting your password, confirming the contract and later changes of plan or billing interval, notices about the card limit on the free plan. We do not measure whether you open an email or click a link. Legal basis: Article 6(1)(b) GDPR.
• Correspondence: what you send us by email, by telephone or through the enquiry form for several locations (name, business, email address, telephone number, content). Legal basis: Article 6(1)(b) GDPR where it concerns your contract or the steps before it; otherwise Article 6(1)(f) GDPR, with the legitimate interest of answering your enquiry.
• Security: attempts to sign up, log in, reset a password or send the enquiry form are stored with IP address and time so that we can slow down mass attempts. The server logs every request with IP address, time, requested address, browser identifier and status code. Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is secure operation that protects accounts against password guessing and our mailbox against abuse.
• Display near your shop: if you start the address search for this feature in the portal, we send the address of your business to a geocoding service and store the coordinates you confirm. Without that click, no address is sent there. Legal basis: Article 6(1)(b) GDPR.

No law obliges you to give us any of this data. The contract does need some of it: without an email address and a password there is no account, and without legal entity, address and contact email we can neither conclude a contract nor write an invoice. If one of these is missing, the step cannot be completed.

The VAT identification number is optional. Without it, we invoice you as we would invoice a customer who has none.

Processors, who act only on our instructions (agreements under Article 28 GDPR are in place):

• netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany: server hosting, data centre Nuremberg
• Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513: account and log-in, database and file storage, region EU (Frankfurt am Main)
• Heinlein Hosting GmbH (“mailbox.org”), Schwedter Straße 8/9A, 10119 Berlin, Germany: sending the emails of the application, and our mailbox
• KEPTAGO LTD (“Geoapify”), Paphos, Cyprus: converting the address of your business into coordinates through the EU endpoint, only if you set up the display near your shop

One recipient has two roles: our payment service provider Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. For the payment itself, Stripe is a controller in its own right, with its own obligations under payment services law, anti money laundering and fraud prevention rules and the requirements of the card networks. For issuing invoices and managing your subscription, by contrast, Stripe acts on our instructions, under the data processing agreement of Stripe (Article 28 GDPR).

We give Stripe the legal entity, address, country, contact email, any VAT identification number, plan and billing interval. On the pages of Stripe (payment page, invoice page and the customer portal for payment methods and invoices) the privacy notice of Stripe applies; that is also where you enter a card number or an IBAN. Stripe receives no data about your guests.

Other recipients, who receive the data as controllers in their own right:

• European Commission, Brussels: checking your VAT identification number through the VAT Information Exchange System (VIES). Only the country code and the number are sent; the Commission queries the register of your country.
• Finom Payments B.V., Amsterdam, Netherlands: our business account, into which your bank transfer or the payout from Stripe is made. Where you pay through Stripe, Stripe creates the invoice; otherwise we create it ourselves
• PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg: only if you choose PayPal on the payment page of Stripe. Stripe then passes the payment details on to PayPal, and PayPal handles the payment through your PayPal account. The privacy statement of PayPal applies to this
• Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland: only if you pay with Google Pay on the payment page of Stripe. Google then processes details of that payment; the Google Payments privacy notice applies to this
• Apple Distribution International Ltd., Cork, Ireland, and Google Ireland Ltd., Dublin, Ireland: the business name, logo, colours and texts of your card, because your guests save the card in Apple Wallet or Google Wallet
• tax authorities and other public authorities, where a law obliges us to hand data over

We sell no data and pass none on for advertising.

Database, files and servers are located in Germany. Supabase has its registered office in Singapore; supplementary remote access by Supabase and its sub-processors may also take place outside the European Economic Area. There is no adequacy decision of the European Commission for Singapore. The transfer is safeguarded by the EU standard contractual clauses, which are part of our agreement with Supabase.

You can obtain a copy of these clauses by writing to hello@stampcards.eu.

If you pay through Stripe, data is transferred to Stripe, LLC, South San Francisco, United States. For the United States there is an adequacy decision of the European Commission, as far as the receiving company is certified under the EU-US Data Privacy Framework; Stripe, LLC is listed there. If that certification ceases to apply, the EU standard contractual clauses apply, which form part of the data processing agreement of Stripe. You can request a copy of those clauses too.

Apple and Google are controllers in their own right with their registered offices in Ireland. Whether and how they transfer data to countries outside the EU is governed by their own privacy notices. All other recipients are located in the EU.

• Account and the data of your business: for as long as the contract runs, then until the end of the retrieval period under Section 8 of the Agreement, unless a retention obligation requires longer. We delete an account without a contract when you ask us to. We may delete a business you started setting up and have not worked on for 30 days, so that its address becomes free again.
• Proof of contract, including IP address and browser identifier: six years from the end of the calendar year in which the contract ends (Section 147(1) nos. 2 and 3 and (3) of the German Fiscal Code, AO).
• Invoices and accounting records: eight years from the end of the calendar year (Section 147(1) no. 4 and (3) AO, Section 14b(1) UStG). This also applies to the VAT identification number and the result of its check, where an invoice is based on them.
• Payments through Stripe: customer number, payment method, payment status and our record of them are accounting records and are kept for eight years from the end of the calendar year (Section 147(1) no. 4 and (3) AO, Section 14b(1) UStG). How long Stripe itself keeps the data from handling the payment is set out in the privacy notice of Stripe.
• Emails and enquiries: with customers for the term of the contract and three further years, unless they have to be kept for six years as business letters; with prospective customers who do not sign a contract, twelve months after the last contact.
• Attempts to sign up, log in, reset a password or send the enquiry form: 7 days; they are deleted with the next attempt that comes in after that.
• Server logs, including those on sending emails: 14 days.

You have the right of access to your data (Article 15 GDPR), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18) and to data portability for the data you gave us for the contract (Article 20).

You can change many details yourself in the portal. For everything else, write to hello@stampcards.eu. We answer within one month (Article 12(3) GDPR), and it costs you nothing.

Where a retention obligation prevents erasure, we keep the data for that purpose only and delete it as soon as the period has expired.

Where we process data on the basis of a legitimate interest (Article 6(1)(f) GDPR: IP address and browser identifier in the proof of contract, protection against abuse, answering enquiries), you may object at any time on grounds relating to your particular situation. We then stop processing the data, unless we demonstrate compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims.

You may object to the use of your data for advertising at any time and without giving a reason; it then stops. There is no newsletter.

An informal sentence to hello@stampcards.eu is enough.

None of the processing above is based on consent (Article 6(1)(a) GDPR), so there is no consent to withdraw. If we ever ask you for consent, we will tell you at that point how to withdraw it.

You can complain to a data protection supervisory authority, and you do not have to contact us first. The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Alt-Moabit 59-61, 10555 Berlin, Germany, mailbox@datenschutz-berlin.de, www.datenschutz-berlin.de

You may also complain to the supervisory authority of the EU country where you live or work or where you believe the infringement took place.

There is one decision the application takes without a human being involved: blocking your access because of unpaid invoices under Section 5(6) of the Agreement. For this it asks our payment service provider every hour whether an invoice is still open and what amount is outstanding. If an invoice is still open once the payment period of 14 days has run out, the application sends a reminder with a deadline of seven days; if the invoice is still open when it asks again after that deadline, it blocks your access. A SEPA direct debit that is still being processed does not count as an outstanding amount. Only the status and the outstanding amount of your own invoices, the invoice and reminder dates and these deadlines are used. There is no profiling, no scoring of you as a person, no payment forecast and nothing from outside sources.

What it means: while your access is blocked, the scanner, the issuing of new cards and messages to your guests are paused. Cards already issued remain, your account and your data are untouched, and your obligation to pay remains. The block ends automatically as soon as the invoice is paid or cancelled; if we merely write it off in our own books, the block stays. This decision is permitted because it is necessary for the performance of our contract (Article 22(2)(a) GDPR).

You can at any time ask for a person to review the decision, put your own point of view to us and contest the decision (Article 22(3) GDPR). An informal email to hello@stampcards.eu is enough. Benedict Herrnleben then looks at your case himself and can lift the block even while an invoice is still open. We reply as fast as we can, at the latest within one month (Article 12(3) GDPR).

Nothing else is decided about you automatically. The check of your VAT identification number only compares your number with the register; if you think the result is wrong, write to us and we will check it by hand. Stripe checks payments for fraud on its own responsibility and can decline a single payment; the privacy notice of Stripe applies to that. You can then pay by another route, in particular by bank transfer.

When you log in, the Supabase log-in sets cookies whose names begin with “sb-”. They keep you logged in until you log out, for at most 400 days, and are strictly necessary for that; no consent is needed for them (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG).

We use no analytics or tracking services.