Privacy policy
Privacy policy
This is a convenience translation of the German original. The German version is the legally binding one and prevails in case of any discrepancy.We process personal data (hereinafter mostly referred to simply as "data") only to the extent necessary and for the purpose of providing a functional and user-friendly website, including its content and the services offered there.
Pursuant to Article 4 no. 2 of Regulation (EU) 2016/679, the General Data Protection Regulation (hereinafter "GDPR"), "processing" means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
With the following privacy policy we inform you in particular about the nature, scope, purpose, duration and legal basis of the processing of personal data, insofar as we decide on the purposes and means of processing either alone or jointly with others. We also inform you below about the third-party components we use for optimisation purposes and to improve the quality of use, insofar as third parties thereby process data under their own responsibility.
Our privacy policy is structured as follows:
I. Information about us as the controller
II. Rights of users and data subjects
III. Information about the data processing
I. Information about us as the controller
The controller responsible for this website within the meaning of data protection law is:Frion UG (haftungsbeschränkt)
Am Buttermarkt 40
51371 Leverkusen
Germany
FRION UG is represented by its managing director: Jörg Frießner. The registered office of the company is Leverkusen, Germany.
Fax: +49 2173 1016338
E-mail: info@weddingphotos.live
II. Rights of users and data subjects
With regard to the data processing described in more detail below, users and data subjects have the right- to obtain confirmation as to whether data concerning them is being processed, to information about the data processed, to further information about the data processing and to copies of the data (cf. also Article 15 GDPR);
- to rectification or completion of inaccurate or incomplete data (cf. also Article 16 GDPR);
- to immediate erasure of the data concerning them (cf. also Article 17 GDPR) or, alternatively, insofar as further processing is necessary pursuant to Article 17 (3) GDPR, to restriction of processing in accordance with Article 18 GDPR;
- to receive the data concerning them and provided by them, and to have this data transmitted to other providers/controllers (cf. also Article 20 GDPR);
- to lodge a complaint with the supervisory authority if they are of the opinion that data concerning them is being processed by the provider in breach of data protection provisions (cf. also Article 77 GDPR).
Under Article 21 GDPR, users and data subjects likewise have the right to object to the future processing of data concerning them, insofar as the data is processed by the provider pursuant to Article 6 (1) (f) GDPR. In particular, an objection to data processing for the purpose of direct marketing is permissible.
III. Information about the data processing
Your data processed when using our website is erased or blocked as soon as the purpose of storage no longer applies, no statutory retention obligations prevent erasure, and no divergent information about individual processing procedures is given below.Server data
For technical reasons, and in particular to ensure a secure and stable website, data is transmitted by your internet browser to us or to our hosting provider. These so-called server log files record, among other things, the type and version of your internet browser, the operating system, the website from which you switched to our website (referrer URL), the page(s) of our website you visit, the date and time of the respective access, and the IP address of the internet connection from which our website is used.The data collected in this way is stored temporarily, but not together with other data of yours.
This storage takes place on the legal basis of Article 6 (1) (f) GDPR. Our legitimate interest lies in improving the stability, functionality and security of our website.
We store your IP address in these logs only in shortened form – the first two of four blocks for IPv4 addresses, the first 32 bits for IPv6 addresses – so that it can no longer be attributed to an individual connection. The logs are limited in size; older entries are continuously overwritten. Entries that we need to clarify a security incident are exempt from erasure until it has been clarified.
Hosting and e-mail (Strato)
The servers on which our website runs and on which we store the data we process ourselves – including customer accounts, streams with photos and videos, and guest data – are operated for us by Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, in data centres in Germany. We also use mailboxes at Strato to send our e-mails (such as activation, purchase and notification e-mails) and to receive the e-mails you send us.Strato processes this data exclusively on our behalf and in accordance with our instructions; we have concluded a data processing agreement with Strato pursuant to Article 28 GDPR. The legal basis is Article 6 (1) (b) and (f) GDPR; our legitimate interest lies in the secure and reliable operation of our website.
Determining the country
We determine the country a request comes from based on the IP address. We use this to show suitable prices and language, as proof of location at purchase, and to check whether photos and videos are uploaded from the country for which a stream was booked. The lookup takes place exclusively on our own server using a country database; the IP address is not transmitted to anyone for this purpose. When a guest uploads, we store only the determined country with the guest's device identifier (cookie), not the IP address; this information is deleted together with the stream.The legal basis is Article 6 (1) (b) and (f) GDPR. Our legitimate interest is that a stream is used in the country for which it was booked and that prices apply to the correct country.
The country database is provided by IP Geolocation by DB-IP and licensed under CC BY 4.0.
Cookies
We use so-called cookies on our website. Cookies are small text files that your internet browser stores on your device. Your browser's local storage, which we also use, works in a similar way.a) Technically necessary cookies
We set the following cookies ourselves because our website does not work without them:- ppl_session (30 days): keeps you logged in to your customer account;
- ppl_guest (1 year): pseudonymous device identifier for guests, see "Guest data";
- ppl_auth_… (24 hours): remembers that you have entered the password of a protected stream;
- ppl_std_… (90 days): remembers the same for a password-protected Save the Date page;
- ppl_locale (1 year): remembers your language;
- ppl_theme (1 year): remembers the light or dark display;
- ppl_einwilligung (6 months): stores your choice regarding the cookies that require consent.
The legal basis for storing and reading this information on your device is Section 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). The legal basis for the further processing is Article 6 (1) (b) GDPR insofar as it serves the initiation or performance of a contract, and otherwise Article 6 (1) (f) GDPR; our legitimate interest lies in a functioning website.
b) Cookies only with your consent
The following cookies are only set once you have consented to the respective category ("Statistics" or "Marketing"). The legal basis is then Section 25 (1) TDDDG in conjunction with Article 6 (1) (a) GDPR.- ppl_herkunft (30 days), our own cookie: if you come to us via a link with campaign information (utm parameters), it remembers this information if you have consented to "Statistics", and the click identifier of the advertising platform (fbclid, ttclid or epik) if you have consented to "Marketing". If you make a purchase, we store the campaign information with the purchase in order to see which channels lead to purchases; we do not pass this information on. We use the click identifier only for reporting the purchase to the respective platform (see the sections on the pixels).
- _ga, _ga_… (2 years): Google Analytics, category "Statistics";
- _fbp, _fbc (90 days): Meta pixel, category "Marketing";
- _ttp (13 months): TikTok pixel, category "Marketing";
c) How to remove cookies
You can prevent or restrict the installation of cookies through a setting in your internet browser. You can also delete cookies that have already been stored at any time. The steps and measures required for this depend on the internet browser you use. If you have any questions, please use the help function or documentation of your internet browser or contact its manufacturer or support.If you prevent or restrict the installation of cookies, this may mean that not all functions of our website can be used to their full extent.
Contract performance
The data you transmit in order to make use of our goods and/or services is processed by us for the purpose of performing the contract and is necessary for that purpose. Conclusion and performance of the contract are not possible without the provision of your data.The legal basis for the processing is Article 6 (1) (b) GDPR.
We erase the data upon complete performance of the contract, but must observe the retention periods under tax and commercial law.
In the course of performing the contract, we pass on your data to the transport company commissioned with delivery or to the financial service provider, insofar as this is necessary for delivery or for payment purposes.
The legal basis for passing on the data is then Article 6 (1) (b) GDPR.
Customer account / registration function
If you create a customer account with us via our website, we store the information you provide when doing so and later in your account: at registration your e-mail address, your password (only as a non-reversible hash value) and your language, and for a purchase also your name and billing address. We use this information exclusively for pre-contractual services, for the performance of the contract or for the purpose of customer care (for example in order to provide you with an overview of your purchases and invoices). In addition, we store the date and time of your registration, the domain via which you registered, and the time of your last login; we need the latter for the deletion of inactive accounts described below.In the course of the further registration process, your consent to this processing is obtained and reference is made to this privacy policy. The data collected by us in this context is used exclusively for the provision of the customer account.
Insofar as you consent to this processing, Article 6 (1) (a) GDPR is the legal basis for the processing.
Where the opening of the customer account also serves pre-contractual measures or the performance of a contract, Article 6 (1) (b) GDPR is an additional legal basis for this processing.
You can withdraw the consent you gave us to the opening and maintenance of the customer account at any time with effect for the future in accordance with Article 7 (3) GDPR. All you have to do is inform us of your withdrawal.
The data collected in this respect is erased as soon as the processing is no longer necessary. We must, however, observe the retention periods under tax and commercial law.
If you do not confirm a registration within ten days via the link in the activation e-mail (counted from the most recent activation e-mail), we automatically delete the registration together with all data stored for it.
If you do not log in for twelve months and your last stream expired at least twelve months ago, we delete your customer account together with all associated data (including streams, wedding planner, guest list and save-the-date page). We announce this 30 and 7 days in advance by e-mail; if the e-mail cannot be delivered, we delete the account three months after that day even without an announcement. If you log in before then, the account remains. We retain invoices and accounting records for the statutory period of eight years (section 147 AO, section 257 HGB).
Contact enquiries / contact options
If you contact us via a contact form or by e-mail, the data you provide will be used to process your enquiry. Providing the data is necessary in order to process and answer your enquiry — without it we cannot answer your enquiry, or can do so only to a limited extent.The legal basis for this processing is Article 6 (1) (b) GDPR.
For enquiries via our contact form we additionally store your IP address and your browser identifier in order to detect and prevent misuse of the form (Article 6 (1) (f) GDPR). We delete the IP address after 30 days. For the translation of e-mails you send us, see "Translations (DeepL)".
Your data is erased once your enquiry has been conclusively answered and no statutory retention obligations prevent erasure, such as in the case of any subsequent performance of a contract.
Translations (DeepL)
For machine translations we use the service of DeepL SE, Maarweg 165, 50825 Cologne, Germany. Only the texts to be translated are transmitted to DeepL:- the descriptions of our packages and services; they contain no personal data;
- e-mails received in our support mailbox: the subject and text are sent to DeepL so that we can detect the language and translate an e-mail that is written neither in German nor in English into German; for longer e-mails, only an excerpt is transmitted at first to detect the language;
- comments, messages and other texts from guests only if translation of guest texts is switched on and someone requests the translation of a text. We keep translations on our server for up to 90 days so that the same text does not have to be transmitted again.
Storage period of photos and videos
We store the photos, videos, guestbook entries, comments and messages of a stream for the booked validity period. After that, the stream is no longer accessible to guests; after a grace period of currently 30 to 60 days depending on the package, we permanently delete it with all its content. The legal basis is Article 6 (1) (b) GDPR.If a customer deletes a stream themselves, it is no longer accessible immediately; seven days after deletion we permanently remove it with all photos, videos and other content.
When converting uploaded files, we remove the metadata embedded in them: for photos, for example, the location (GPS coordinates), device and time of capture, and for videos and audio recordings likewise all metadata including the location. We only keep the unaltered original file – including its metadata – if the "Keep original files" add-on has been booked for the stream.
Guest data
Guests at a celebration use a couple's stream without a customer account, usually via a QR code or link. Depending on which functions the couple has switched on, we process:- uploaded photos and videos as well as photos from the photo booth;
- optionally, a name that you enter as a guest and that appears with your contributions;
- comments, emoji reactions and messages, which may also appear on the big screen;
- voice and video recordings for the audio and video guestbook, and signatures drawn with a finger together with a message;
- quiz answers with response time and name; the best participants appear with their names in a leaderboard on the big screen;
- with "Where am I sitting?", the name you search for in the couple's guest list. The couple created this list; it contains names, table assignments and, where available, e-mail addresses. The search only shows results once three characters have been entered and only displays the name and table of matching entries; the complete list cannot be retrieved;
- with "Receive photos by email", your e-mail address (see below).
Replies (RSVPs) on a couple's Save the Date page are described in the section "Replies (RSVPs) on a Save the Date page", face recognition in the section of the same name.
"Receive photos by email": you can enter your e-mail address to be notified once as soon as the couple releases the photos. We use the double opt-in procedure for this: your subscription only takes effect once you click the link in our confirmation e-mail. As proof, we store the time and IP address of the subscription and of the confirmation. The couple cannot see your e-mail address, only the number of subscriptions. The legal basis is your consent pursuant to Article 6 (1) (a) GDPR; you can withdraw it at any time via the unsubscribe link in the e-mail, and we then delete your e-mail address. We delete unconfirmed subscriptions after seven days and the IP addresses after twelve months – the time of confirmation remains stored as proof – and everything else together with the stream.
The couple decides which functions are switched on and which content is collected in a stream. The couple is responsible for the content relating to its celebration and its guests; we process this content on its behalf (Article 28 GDPR, cf. § 8 no. 1 of our terms and conditions). Please contact the couple with questions or requests regarding your contributions; you can, however, also contact us. We process guest data under our own responsibility only for security and technical operation, for example the device identifier, protection against misuse and determining the country. The legal basis for this is Article 6 (1) (f) GDPR; our legitimate interest lies in a secure and functioning stream.
We delete guests' contributions together with the stream – after expiry and the grace period (§ 8 no. 7 of our terms and conditions) or seven days after the couple has deleted it themselves – and together with the couple's customer account (§ 6 of our terms and conditions). You can delete your own uploads yourself beforehand; the couple can also remove individual contributions.
Face recognition
A couple can switch on face recognition for its stream. It allows the people in the photos to be grouped and named, and lets guests use "Find my photos" to look for the photos in which they appear. For this purpose, we compute a facial feature for each detected face – a sequence of numbers describing the face – and store it together with the position of the face in the photo. Such features are biometric data and belong to the special categories of personal data within the meaning of Article 9 GDPR.The analysis only runs if the couple has switched on the function and expressly confirmed that the persons depicted have agreed; we store the time of this confirmation. Photos uploaded by guests are only analysed if the guest expressly agrees when uploading; without this consent, the photos appear in the stream but are not analysed. We compute the facial features exclusively on our own servers in Germany; we do not pass them on to third parties.
For "Find my photos", you as a guest take a selfie after giving your consent. It is used only for this one comparison and deleted immediately afterwards; we do not store the feature computed from it. If the couple has switched this on, guests can also suggest names for persons not yet named; we store the suggestion with the device identifier and, if provided, your guest name.
The legal basis is explicit consent pursuant to Article 6 (1) (a) and Article 9 (2) (a) GDPR. You can withdraw it at any time with effect for the future, vis-à-vis the couple or us. If the couple switches the function off, we no longer analyse any further photos. We delete stored face data as soon as the couple resets it in the stream settings, together with the respective photo, and at the latest together with the stream.
E-mails about your stream
We send notices about the expiry of your stream to the e-mail address of your customer account: 30, 14 and 3 days beforehand, upon expiry and one week before deletion. These notices are part of the performance of the contract; the legal basis is Article 6 (1) (b) GDPR.We also send tips on using your own stream: one day after you create it, a tip for trying it out; one week before your celebration, a checklist; and the day after, an overview of what came together. For this we use the date of the celebration that you entered for the stream or in the wedding planner. The legal basis is Article 6 (1) (f) GDPR; our legitimate interest is that your stream works on the day of the celebration. You can unsubscribe from these tips at any time via the link in every e-mail or in your customer account.
Ideas, offers and review requests by e-mail
Only if you have expressly consented at registration or in your customer account do we occasionally send you ideas and offers around your celebration and ask after the celebration how you liked it. Consent given at registration only takes effect once you have confirmed your e-mail address via the link in the activation e-mail. We store the time of consent as proof. The legal basis is Article 6 (1) (a) GDPR in conjunction with Section 7 (2) no. 2 of the German Act against Unfair Competition (UWG). You can withdraw your consent at any time with effect for the future – via the link in every e-mail or in your customer account.Testimonials
In your customer account you can submit a review with text, stars, a name of your choice and, optionally, an occasion. With your consent, we publish this information on our website after reviewing it; your e-mail address is not published. The legal basis is Article 6 (1) (a) GDPR. You can withdraw your testimonial at any time in your customer account; it is then deleted immediately, as it is when you delete your customer account.Notifications about news on a Save the Date page
On a couple's Save the Date page you can enter your e-mail address to be notified by e-mail when the couple publishes something new there. We use the double opt-in procedure for this: after you enter your address, you receive an e-mail containing a link; only once you have confirmed your subscription with it do we send you notifications. To be able to prove your consent, we store the time and IP address of the subscription and of the confirmation. The couple cannot see your e-mail address, only how many guests have subscribed.The legal basis is your consent pursuant to Article 6 (1) (a) GDPR. You can withdraw it at any time with effect for the future, for example via the unsubscribe link in every notification; we then erase your e-mail address. Subscriptions that are not confirmed are erased after seven days. If the couple withdraws its Save the Date page or deletes its customer account, the subscriptions are erased as well.
We delete the IP addresses of the subscription and of the confirmation after twelve months; the time of confirmation remains stored as proof of your consent.
Replies (RSVPs) on a Save the Date page
On a couple's Save the Date page you can say whether you will attend. For this we process your name, your reply, the number of people and – only if you provide it voluntarily – your e-mail address. Only the couple can see this information; they use it to plan their celebration and can transfer it to their guest list. So that you can change your reply later, the page recognises your device by means of the technically necessary cookie ppl_guest (see "Cookies"); to prevent misuse we also store the IP address of the reply and delete it after twelve months.The legal basis is Article 6 (1) (f) GDPR; the legitimate interest lies in enabling the couple to plan their celebration. The information is erased as soon as the couple deletes it, withdraws its Save the Date page or deletes its customer account.
Map of the venue (OpenStreetMap)
If a couple enters a place on their Save the Date page, we look up this place with the Nominatim service of the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom, and draw a map image from OpenStreetMap map data. Both happen via our server: only the place entered is transmitted, no information about the couple or the guests. Visitors load the finished map image from our server; OpenStreetMap receives neither their IP address nor any other data. The legal basis is Article 6 (1) (b) GDPR (performance of the contract with the couple).Withdrawal via our online form
If you withdraw from a contract via our online form, we process your name, your e-mail address, your details of the contract and your message in order to handle the withdrawal and confirm its receipt to you by e-mail. To be able to prove receipt and to prevent misuse of the form, we also store the time, your IP address and your browser identifier. The legal basis is Article 6 (1) (c) GDPR and, for the proof, Article 6 (1) (f) GDPR; our legitimate interest lies in being able to demonstrate in the event of a dispute when and how a withdrawal was received. We delete the IP address after three years, the end of the regular limitation period.Meta Pixel (Facebook) – conversion tracking
On our website we use the Facebook visitor action pixel, a web analytics and conversion measurement service of Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, a subsidiary of Meta Platforms Inc., 1601 S. California Ave., Palo Alto, CA 94304, USA (hereinafter "Facebook").The Facebook visitor action pixel helps us analyse user behaviour on our website and promote our services on the Facebook platform. The basis for this is Article 6 (1) (a) GDPR. Users can withdraw their consent to its use at any time with effect for the future in accordance with Article 7 (3) GDPR via the settings of the consent manager ("cookie settings") on our website.
The visitor action pixel establishes a connection to Facebook's servers in the USA. Facebook thereby records the IP address and information about the user's browser. In addition, an individual pixel ID is stored together with the user's associated website activity.
If you have consented to the "Marketing" category and make a purchase from us, we additionally report the purchase directly from our server to Facebook (Conversions API) as soon as the payment has been confirmed. The report contains your e-mail address and your customer number, both only as SHA-256 hash values, your IP address, your browser identifier (user agent), the values of the _fbp and _fbc cookies, the amount and currency of the purchase, the address of the page and an identifier of the purchase by which Facebook recognises this report and that of the pixel as the same purchase. This means a purchase is recorded even if the pixel was blocked in your browser. We delete the IP address, browser identifier, page address and cookie values that we store with the purchase for this purpose after 90 days. The legal basis is your consent pursuant to Article 6 (1) (a) GDPR; after a withdrawal we no longer report purchases started afterwards.
Meta Platforms Inc. is part of the "Data Privacy Framework", for which the European Commission has adopted an adequacy decision pursuant to Article 45 GDPR:
https://www.dataprivacyframework.gov/list
Thanks to this data processing, Facebook can show the user personalised advertising from us on Facebook or on third-party sites. Conversion measurement also allows us to analyse and evaluate user behaviour after a click on a Facebook ad and the subsequent redirection to our website, in order to increase the effectiveness of our Facebook ads.
In this context we are jointly responsible with Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, within the meaning of Article 26 GDPR.
The joint controllers have set out their respective obligations under the GDPR in an agreement. This agreement can be viewed at the following link:
https://www.facebook.com/legal/terms/page_controller_addendum
The data protection officer of Meta Platforms Ireland Limited can be reached via a contact form:
https://www.facebook.com/help/contact/540977946302970
Detailed information on data processing by Facebook and on users' rights and options for protection is set out in Facebook's privacy notices:
https://www.facebook.com/policy.php
Google Analytics
On our website we use Google Analytics, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter "Google").Google Analytics helps us analyse the use of the website and measure the effectiveness of our marketing campaigns. The legal basis is Article 6 (1) (a) GDPR. Users can withdraw their consent to the use of Google Analytics at any time with effect for the future in accordance with Article 7 (3) GDPR via the "cookie settings" on our website.
Information such as the time, place and frequency of website visits and interactions with the website (e.g. click paths and clicks on links), including the user's IP address, is transmitted to a Google server and stored in the USA for a maximum of 2 months.
Google LLC is part of the "Data Privacy Framework", for which the European Commission has adopted an adequacy decision pursuant to Article 45 GDPR:
https://www.dataprivacyframework.gov/list
We have switched off the advertising and personalisation features of Google Analytics. In particular, so-called Google signals are deactivated: Google therefore does not link the use of our site to a Google account, does not analyse it across devices and does not provide us with information on the age, gender or interests of visitors. The data collected is not used for personalised advertising.
According to Google, Google Analytics 4 does not store IP addresses; they are only used to derive the approximate location and are then discarded.
Google uses the data collected to evaluate the user's visit to the website and to compile reports on website activity for us. The data is also used to provide further services related to website and internet use. Google may pass this information on to third parties where required by law or where third parties process this data on Google's behalf.
According to its own statements, Google will in no case link the user's IP address with other Google data. Google provides further information and options for preventing the use of data here:
https://www.google.com/intl/en/policies/privacy/partners
If the user does not agree to the collection, they can also prevent it by installing the browser add-on for deactivating Google Analytics once.
TikTok Pixel
On our website we use the TikTok Pixel, a web analytics and conversion measurement service of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (hereinafter "TikTok").The TikTok Pixel serves to analyse the use of the website and to promote our services on the TikTok platform. The legal basis for this is Article 6 (1) (a) GDPR. Users can withdraw their consent pursuant to Article 7 (3) GDPR at any time with effect for the future via the settings of the consent manager ("cookie settings") on our website.
The use of the TikTok Pixel establishes a connection to TikTok's server. TikTok thereby records the IP address and information about the user's browser. TikTok also stores an individual pixel ID and the associated website activity of the user.
If you have consented to the "Marketing" category and make a purchase from us, we additionally report the purchase directly from our server to TikTok (Events API) as soon as the payment has been confirmed. The report contains your e-mail address and your customer number, both only as SHA-256 hash values, your IP address, your browser identifier (user agent), the value of the _ttp cookie and TikTok's click identifier (ttclid), the amount and currency of the purchase, the address of the page and an identifier of the purchase by which TikTok recognises this report and that of the pixel as the same purchase. We delete the IP address, browser identifier, page address and cookie value that we store with the purchase for this purpose after 90 days. The legal basis is your consent pursuant to Article 6 (1) (a) GDPR; after a withdrawal we no longer report purchases started afterwards.
Transfers to third countries cannot be ruled out:
https://www.tiktok.com/legal/page/eea/transferee-countries/de
Appropriate safeguards have been put in place through standard contractual clauses pursuant to Article 46 GDPR. For third countries for which an adequacy decision exists, that decision also applies.
This processing enables TikTok to show the user personalised advertising from us on TikTok or on third-party sites. Conversion measurement also helps us record and evaluate the behaviour of users after a click on our TikTok ad and the redirection to our website. This allows us to optimise our TikTok ads further.
For this processing, in particular so-called insight reporting and the collection and transmission of event data, we are jointly responsible with TikTok Technology Limited within the meaning of Article 26 GDPR.
The joint controllers have set out their respective obligations under the GDPR in an agreement. This agreement is available at the following link:
https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms
The data protection officer of TikTok Technology Limited can be reached via a contact form:
https://www.tiktok.com/legal/report/DPO
Detailed information on the collection and use of data by TikTok and on users' rights and options for protection is set out in TikTok's privacy notices:
https://www.tiktok.com/legal/page/eea/privacy-policy/de
Stripe
For purchases that we bill ourselves, we use Stripe for payment processing.For European customers the provider is in particular Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Depending on the payment service, other companies of the Stripe group may be involved in the processing.
In particular, the following data may be processed in the course of a payment:
- name and contact details,
- invoice information,
- payment method,
- payment amount and currency,
- transaction data,
- technical data, and
- information required for fraud prevention and payment processing.
We use Stripe if your billing address is in a member state of the European Union. For such a purchase we transmit your name (or, if you provide a company, its name), your billing address and your e-mail address to Stripe. Stripe uses this to create a customer record, which we reuse for later purchases with the same e-mail address and update with the address then provided. We also transmit the services purchased with amount and currency, our transaction and customer number, and the language of the page so that the payment page appears in your language. You enter card or account details directly on Stripe's payment page; they do not reach our servers.
If Stripe's payment page offers PayPal as a payment method and you choose it, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, additionally receives the data required for the payment and processes it under its own responsibility.
The legal basis for our transmission of the data required for payment processing is Article 6 (1) (b) GDPR.
Stripe also processes certain data under its own responsibility within the scope of its statutory and regulatory obligations.
Stripe operates internationally. Personal data may therefore also be processed outside the European Economic Area. According to its own statements, Stripe uses the applicable statutory transfer mechanisms for this.
Further information can be found in Stripe's privacy notices.
Paddle
For certain purchases outside the European Union, Paddle.com Market Limited, Judd House, 18–29 Mora Street, London EC1V 8BT, United Kingdom, may act as merchant of record and reseller.In this case Paddle collects and processes the data required for the purchase, in particular for carrying out the order, payment processing, invoicing, tax handling, fraud prevention and compliance with legal obligations.
This may include in particular name, contact details, invoice information, payment data, transaction information and technical data.
Paddle sends us the information required to provide the purchased service.
In this capacity Paddle processes buyer data under its own data protection responsibility.
Paddle operates internationally. Insofar as data is transferred to countries outside the European Economic Area, Paddle uses, according to its own statements, the respectively required statutory safeguards, in particular adequacy decisions or standard contractual clauses.
Further information can be found in Paddle's privacy notices.
Model privacy policy of the law firm Weiß & Partner