Privacy policy

General information

Compliance with data protection regulations and the protection of your privacy is very important to Alpakas Technologies GmbH ("Alpakas" - hereinafter "we" or "us"). We treat your personal data confidentially and in accordance with the legal data protection regulations and on the basis of this privacy policy. The legal basis can be found in particular in the General Data Protection Regulation (DS-GVO) as well as in the Federal Data Protection Act (BDSG) and all other relevant data protection regulations.

Personal data is information that relates to an identified or identifiable person (Art. 4 No. 1 DS-GVO). This includes, above all, information that allows conclusions to be drawn about your identity, such as your name, telephone number, address or e-mail address. Statistical data that we collect, for example, during a visit to our website and that cannot be associated with your person do not fall under the concept of personal data. With the following privacy policy, we would like to inform you how, for what purpose and to what extent we process your personal data and what rights you have.

Responsible party:

The responsible party within the meaning of the DS-GVO and the applicable national data protection laws (esp. BDSG) as well as other data protection regulations is:

Dominik Fünkner

Anschrift:
Leopoldstr. 21
80802 München

Telefon:
+4989250039227

E-Mail:
consulting@datenschutzexperte.de

Purpose and legal basis of data processing

1. access data and hosting

Type: You can visit our websites without providing any personal information. Each time you call up a website, the web server only automatically saves a so-called server log file, which contains, for example, the name of the requested file, your IP address, the date and time of the call, the amount of data transferred and the requesting provider (access data) and documents the call.

Purpose: This access data is evaluated solely for the purpose of ensuring trouble-free operation of the site and improving our offering.

Legal basis: The legal basis for this processing is Art. 6 para. 1 lit. f) DS-GVO. The processing of the aforementioned data is necessary for the provision of a website and thus serves to protect a legitimate interest of our company.

Duration: All access data is deleted no later than 30 days after the end of your visit to the site.

1.1 Hosting via AWS Cloud Computing Services:

Type: We host our website on AWS. The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg (hereinafter: AWS).

We have concluded an order processing contract with AWS in accordance with §28 DS-GVO.

Purpose: The use of the services is necessary to provide a secure and fast offer of our website.

Third country transfers: When you visit our website, your personal data is processed on the servers of AWS. The servers we have chosen are located in Frankfurt.

However, a transfer of data to the USA and access by US authorities to the data stored by AWS cannot be ruled out. The USA is currently considered a third country from a data protection perspective. You do not have the same rights there as within the EU/EEA. You may not have any legal remedies against access by authorities.

For the USA, there is no adequacy decision of the European Commission and no appropriate safeguards according to Art. 46 DS-GVO are used by Intercom. It is not excluded that American authorities can access the data stored at AWS.

For more information, please refer to the privacy policy of AWS: https://aws.amazon.com/de/privacy/?nc1=f_pr.

Legal basis: The use of AWS is based on Art. 6 (1) lit. f DSGVO. We have a legitimate interest in ensuring that our website is presented as reliably as possible. If a corresponding consent was requested, the processing is based exclusively on Art. 6 para. 1 lit. a DSGVO; the consent can be revoked at any time.

Storage period: The storage period of your data depends on the types of processing listed below.

2. data collection and use for contract processing

2.1 Processing when opening a customer account

Type: We collect personal data when you voluntarily provide it to us as part of your order, when contacting us (e.g. via contact form or e-mail) or when opening a customer account. Mandatory fields are marked as such, because in these cases we need the data to process the contract, or to process your contact or opening a customer account and without their information you can not complete the order and / or the account opening, or the contact can not be sent. Which data is collected can be seen from the respective input forms.

Purpose: The data is processed for contract processing; for processing your contact, opening the customer account and processing your order.

Legal basis: We use the data provided by you in accordance with Art. 6 para. 1 p. 1 lit. b DSGVO for contract processing and processing your requests.

Storage period: Your data will be deleted by us after deletion of your customer account, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this statement. The deletion of your customer account is possible at any time and can be done either by sending a message to the contact option described below or via a function provided for this purpose in the customer account.

Contact option: contact@alpaka.app/ kontakt@alpakas.app

2.2 Data processing for contract processing and delivery

Type and purpose: We use the following data: Name, address, e-mail address, telephone number, order details (value and content) to compile and deliver the order after you have placed it.

Legal basis: Art. 6 para. 1 lit. b) DS-GVO

2.3 Data processing by analysis service providers

2.2.1 Tracking by Routific

Purpose: To optimize our deliveries we use Routific, 555 W Hastings St Suite 1410, Vancouver, BC V6B 4N6, Canada.

Type: The name, address, email address, phone number and order details, such as the value of the order, are used.

Legal basis: By consenting to the use of alpakas delivery services and this privacy policy, you consent to the processing of the above data by Routific Inc. pursuant to Art. 6 para. 1 lit. a) DS-GVO.

Routific has its registered office in Vancouver, Canada. For Canada, an adequacy decision of the European Commission is available. You can find it here: Adequacy Decision. This confirms that in Canada there is a level of data protection comparable to that in the EU.

The privacy policy of Routific Inc. can be found here: here and here the contact form.

Contact option: contact@alpaka.app/ kontakt@alpakas.app

2.2.2 Communication Intercom

Type and purpose: In order to be able to communicate with customers and to enable a smooth delivery, we use the service Intercom. For this purpose we use name, e-mail address and order details, if any. These are entered manually into the Intercom system.

Third Country Transfer: Intercom is headquartered in San Francisco. San Francisco HQ 55 2nd Street, 4th Floor, San Francisco, CA 94105.

Because Intercom is headquartered and has various offices outside of the European Union and the EEA, transfers of your data to countries outside of the EU, such as the United States, the United Kingdom, and Australia, are possible.

For transfers to the UK, the following implementing decision is available: https://ec.europa.eu/info/files/decision-adequate-protection-personal-data-united-kingdom-general-data-protection-regulation_de, which confirms an adequate level of protection.

A transfer of data to the USA and access by US authorities to the data stored at Intercom cannot be ruled out. The USA is currently considered a third country from a data protection perspective. You do not have the same rights there as within the EU/EEA. You may not have any legal remedies against access by authorities.

The current privacy policy can be found here and a contact form in the footer of this website.

Legal basis: For the transfer of data, their consent to this privacy policy and the processing set out here is the legal basis under Article 6 (1) (a) and Article 49 (1) (a) DS-GVO.

Storage period: Your data will be deleted by us after deletion of your customer account, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this declaration. The deletion of your customer account is possible at any time and can be done either by sending a message to the contact option described below or via a function provided for this purpose in the customer account.

Contact option: contact@alpaka.app/ kontakt@alpakas.app

2.2.3 Use of Airtable

Nature and Purpose: We continue to use Formagrid Inc's Airtable service to track our returnable containers. This requires the name, order number, and quantity of containers and the value to be refunded.

This data is manually entered into a spreadsheet operated and stored by Formagrid Inc.

Third Country Transfer: Formagrid Inc. is located in San Francisco ,799 Market Street, 8th Floor, San Francisco, CA 94103 in the United States. The privacy policy can be found here.

A transfer of data to the USA and access by US authorities to the data stored by Formagrid Inc. cannot be ruled out. The USA is currently considered a third country from a data protection perspective. You do not have the same rights there as within the EU/EEA. You may not be entitled to legal remedies against access by authorities.

For the USA, there is no adequacy decision of the European Commission and Formagrid does not use appropriate safeguards according to Art. 46 DS-GVO. It is not excluded that American authorities can access the data stored by Formagrid Inc.

The privacy policy of Airtable can be found here.

Legal basis: For the transfer of data, your consent to this privacy policy and the processing set out here is the legal basis according to Art. 6 para. 1 lit. a and Art. 49 para. 1 lit. a DS-GVO.

Storage period: Your data will be deleted by us after deletion of your customer account, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this declaration. The deletion of your customer account is possible at any time and can be done either by sending a message to the contact option described below or via a function provided for this purpose in the customer account.

Contact option: contact@alpaka.app/ kontakt@alpakas.app

2.4 Processing by payment service providers

2.4.1 Stripe

Nature and legal basis: We offer the option of processing the payment transaction via the payment service provider Stripe, Legal Process, 510,Townsend St., San Francisco, CA 94103 (Stripe). This is in line with our legitimate interest in offering an efficient and secure payment method (Art. 6 para. 1 lit. f DSGVO). In this context, we share the following data with Stripe to the extent necessary for the performance of the contract (Art. 6 para. 1 lit b. DSGVO).

Name of the cardholder, email address, customer number, order number, bank details, credit card details, credit card validity period, credit card verification number (CVC), date and time of the transaction, transaction amount, name of the provider,location.

We cannot process a payment through Stripe without the submission of your personal information. [You have the option to choose a different payment method].

Stripe has a dual role as a data controller and processor in data processing activities. As a controller, Stripe uses your submitted data to comply with regulatory obligations. This is in accordance with Stripe's legitimate interest (pursuant to Art. 6 (1) lit. f DSGVO) and serves the performance of the contract (pursuant to Art. 6 (1) lit. b DSGVO). We have no influence on this process.

Stripe acts as an order processor in order to be able to complete transactions within the payment networks. Within the scope of the order processing relationship, Stripe acts exclusively according to our instructions and has been contractually obligated within the meaning of Art. 28 DSGVO to comply with the provisions of data protection law.

Third country transfers: A transfer of data to the USA and access by US authorities to the data stored by Stripe cannot be ruled out. The USA is currently considered a third country from a data protection perspective. It cannot be ruled out that US authorities will access the data stored with Stripe. You do not have the same rights there as within the EU/EEA. You may not have legal remedies against access by authorities.Stripe has implemented compliance measures for international data transfers. These apply to all global activities where Stripe processes personal data of individuals in the EU. These measures are based on the EU Standard Contractual Clauses (SCCs).

More information and the retention period for this can be found here: https://stripe.com/de/privacy

2.4.2 Paypal

We offer the option of processing the payment process via the payment service provider PayPal (PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg). Paypal is the responsible party for data processing in this regard.

Legal basis: This corresponds to our legitimate interest in offering an efficient and secure payment method (Art. 6 para. 1 lit. f DSGVO).

Type: In this context, we pass on the following data to PayPal, insofar as it is necessary for the fulfillment of the contract (Art. 6 para. 1 lit b. DSGVO).

First name, last name, address, e-mail address, telephone number.

Without the transmission of your personal data, we can not carry out a payment via PayPal.

Storage period: Your data will be stored until the completion of payment processing. This includes the period necessary for processing refunds, claims management and fraud prevention.

The privacy policy of Paypal can be found here.

3. cookies and web analysis

Purpose: In order to make the visit to our website attractive and to enable the use of certain functions, to display suitable products or for market research, we use so-called cookies on various pages.

Type and duration: Cookies are small text files that are automatically stored on your terminal device. Some of the cookies we use are deleted at the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your end device and allow us to recognize your browser the next time you visit (persistent cookies). The duration of storage can be found in the overview in the cookie settings of your web browser. You can set your browser so that you are informed about the setting of cookies and decide individually about their acceptance or exclude the acceptance of cookies for certain cases or in general. Each browser differs in the way it manages cookie settings. This is described in the help menu of each browser, which explains how you can change your cookie settings. This can be found for each browser at the following links:

Internet Explorer™: https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies

Safari™:

https://support.apple.com/de-de/guide/safari/sfri11471/12.0/mac/10.14

Chrome™:

https://support.google.com/chrome/answer/95647?hl=de&hlrm=en

Firefox™:

https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen

Opera™:

https://help.opera.com/de/latest/web-preferences/#cookies

Legal basis: This serves to protect our legitimate interests in an optimized presentation of our offer, which prevail in the context of a balancing of interests, in accordance with Art. 6 (1) p. 1 lit. f DS-GVO.

If cookies are not accepted, the functionality of our website may be limited.

3.1 Use of Google (Universal) Analytics for Web Analysis

Insofar as you have given your consent, this website uses Google Analytics 4, a web analytics service provided by Google LLC. The responsible entity for users in the EU/ EEA and Switzerland is:

Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

Scope and nature of processing: Google Analytics uses cookies that enable an analysis of your use of our websites. The information collected by means of the cookies about your use of this website is generally transferred to a Google server in the USA and stored there.

[OPTIONAL: We use the User ID function. With the help of the User ID, we can assign a unique, permanent ID to one or more sessions (and the activities within these sessions) and analyze user behavior across devices].

Google Analytics 4 has IP address anonymization enabled by default. Due to IP anonymization, your IP address will be truncated by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. According to Google, the IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

During your website visit, your user behavior is recorded in the form of "events". Events can be:
Page views

First visit to the website

Start of session

Your "click path", interaction with the website

Scrolls (whenever a user scrolls to the bottom of the page (90%))

clicks on external links

internal search queries

interaction with videos

file downloads

seen / clicked ads

language setting

Also recorded:

Your approximate location (region)

your IP address (in shortened form)

technical information about your browser and the end devices you use (e.g. language setting, screen resolution)

your internet service provider

the referrer URL (via which website/ via which advertising medium you came to this website)

Purpose: On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, and compiling reports on website activity. The reports provided by Google Analytics are used to analyze the performance of our website.

Recipients: Recipients of the data are/may be.

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor according to Art. 28 DSGVO).

Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

Alphabet Inc, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

Third-country transfer: Insofar as data is processed outside the EU/EEA and there is no level of data protection corresponding to the European standard, we have concluded EU standard contractual clauses with the service provider to establish an appropriate level of data protection. The parent company of Google Ireland, Google LLC, is based in California, USA. A transfer of data to the USA and access by US authorities to the data stored by Google cannot be ruled out. The USA is currently considered a third country from a data protection perspective. It cannot be ruled out that US authorities will access the data stored by Google. You do not have the same rights there as within the EU/EEA. You may not have any legal remedies against access by authorities.

Storage period: The data sent by us and linked to cookies are automatically deleted after 14 months. The deletion of data whose retention period has been reached takes place automatically once a month.

Legal basis: The legal basis for this data processing is your consent pursuant to Art.6 para.1 p.1 lit.a DSGVO and Art. 49 para. 1 lit a) DS-GVO.

Revocation: You can revoke your consent at any time with effect for the future by calling up the cookie settings [SET THE LINK TO CONSENT TOOL SETTINGS HERE] and changing your selection there. The lawfulness of the processing carried out on the basis of the consent until revocation remains unaffected.

You can also prevent the storage of cookies from the outset by setting your browser software accordingly. However, if you configure your browser to reject all cookies, this may result in a restriction of functionalities on this and other websites. In addition, you can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google, by

a. Not giving your consent to the setting of the cookie or

b. downloading and installing the browser add-on to disable Google Analytics HERE.

For more information on Google Analytics' terms of use and Google's privacy policy, please visit https://marketingplatform.google.com/about/analytics/terms/de/ and https://policies.google.com/?hl=de.

3.2 Facebook Pixel:

Furthermore, we use the so-called "Facebook Pixel" of Meta Platforms Incorporated on our website. The responsible party for users from the EU and the EEA is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.

Type: Through the Facebook pixel, your browser automatically establishes a direct connection with the Facebook server. We have no influence on the scope and further use of the data collected by Facebook through the use of this tool and therefore inform you according to our state of knowledge: Through the integration of the Facebook pixel, Facebook receives the information that you have clicked on an ad from us or called up the corresponding web page of our website. If you are registered with a Facebook service, Facebook can assign the visit to your account. Even if you are

are not registered with Facebook or have not logged in, it is possible that the provider may learn and store your IP address and other identifying features.

Purpose: This allows the users of our website to be identified in the context of visiting the

Facebook social network or other websites that also use this procedure can be shown interest-based advertisements ("Facebook ads").

Legal basis: The legal basis is their consent pursuant to Art. 6 para. 1 lit. a DS-GVO. You can object to the use of the Facebook Pixel at any time by using the following opt-out option.

Third country transfer: Facebook is operated by Meta Platforms Ireland Limited and data may be transferred or transmitted to the USA or other third countries or stored and processed there.

For this purpose, Meta Platforms Ireland Limited uses the standard contractual clauses approved by the European Commission and relies on the adequacy decisions issued by the European Commission with respect to certain countries, where applicable, for data transfers from the EEA to the US and other countries. A transfer of data to the USA and access by US authorities to the data stored by Facebook cannot be ruled out. The USA is currently considered a third country from a data protection perspective. It cannot be ruled out that US authorities will access the data stored at Google. You do not have the same rights there as within the EU/EEA. You may not have any legal remedies against access by authorities.

The privacy policy of Facebook can be found here.

Storage period: The data is stored by Meta for a maximum of two years.

3.3 Appsflyer

This app uses technologies provided by AppsFlyer Ltd. (https:/www.appsflyer.com) to collect and store data for marketing and optimisation purposes.

4. social media: online presence on Facebook and Instagram

4.1 Use of the Insights function:

Type and scope: Facebook provides alpakas with page insights for its pages on Instagram and Facebook. Page Insights are aggregated data that allow alpakas to gain insight into how people interact with our pages.

Page insights are aggregate statistics that are generated based on certain events logged by meta servers when people interact with pages and the content associated with them.

These can be used, for example, to serve advertisements within and outside the platforms that presumably correspond to your interests. Cookies are generally used on your terminal device for this purpose. Visitor behavior and interests are stored in these cookies.

Such events consist of different data points, which, depending on the particular event, include, for example, the following: Actions, such as:

And information about the action, the person who took the action, and the browser/app used to take it.

Alpakas does not have access to the Personal Data processed as part of Events, but only to the aggregated Page Insights. Events used to create Page Insights do not store IP addresses, cookie IDs, or any other identifiers associated with individuals or their devices, other than a Facebook user ID for individuals logged into Facebook.

The events that Facebook logs to create Page Insights are determined solely by Facebook and cannot be set up, changed, or otherwise influenced by Alpakas.

Alpakas and Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland are jointly responsible for the processing of Insights data pursuant to Art. 26 DS-GVO. You can find the agreement here.

Purpose: Our presence on social networks and platforms serves a better, active communication with our customers and prospects. We provide information there about our products and ongoing special promotions. The data collected in this context is used for market research and advertising purposes.

Storage period: The data is stored at Meta for up to 90 days.

Legal basis: This serves according to Art. 6 para. 1 lit. f. DSGVO, this serves to protect our legitimate interests in an optimized presentation of our offer and effective communication with customers and interested parties, which prevail in the context of a balancing of interests. If you are asked by the respective social media platform operators for consent (agreement) to the data processing, e.g. by means of a checkbox, the legal basis for the data processing is Art. 6 (1) lit. a DSGVO.

Third country transfer: Facebook and Instagram are operated by Meta Platforms Ireland Limited and data may be transferred or transmitted to the USA or other third countries or stored and processed there.

For detailed information on the processing and use of data by the providers on their sites, as well as a contact option and your rights and setting options in this regard to protect your privacy, in particular objection options (opt-out), please refer to the privacy notices of the providers linked below. If you still require assistance in this regard, you can contact us.

Facebook:

https://www.facebook.com/about/privacy/

Data processing is carried out on the basis of an agreement between jointly responsible parties pursuant to Art. 26 DSGVO, which you can view here:

https://www.facebook.com/legal/terms/page_controller_addendum

Instagram:

https://help.instagram.com/519522125107875

Option to object (opt-out):

Facebook:

https://www.facebook.com/settings?tab=ads

Instagram:

https://help.instagram.com/519522125107875

6. e-mail newsletter, e-mail advertising with registration for the newsletter.

Type and purpose: If you subscribe to our newsletter, we use the data required for this purpose or separately provided by you to send you our e-mail newsletter on a regular basis. Specified data are your e-mail address and possibly your postal code.

Legal basis: The processing of your data is based on your consent pursuant to Art. 6 para. 1 p. 1 lit. a DSGVO.

With your consent to receive our newsletter, you agree that we pass on the necessary data, your e-mail address, to the service provider Omnisend Inc. This company is based in Great Britain. For the transfer of personal data to the United Kingdom, there is an adequacy decision of the European Commission according to Article 45 (1) DS-GVO. This can be found here. The privacy policy of Omnisend Inc. can be viewed here.

Storage period: Unsubscribing from the newsletter is possible at any time and can be done via a link provided for this purpose in the newsletter. After unsubscribing, we will delete your email address unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this statement.

7. contact options and your rights

As a data subject, you have the following rights:

Right to information: pursuant to Art. 15 DS-GVO, the right to request information about your personal data processed by us to the extent specified therein;

Right of correction: pursuant to Art. 16 DS-GVO, the right to demand the correction of incorrect or completion of your personal data stored by us without delay;

Right to erasure: pursuant to Art. 17 DS.GVO, the right to request the erasure of your personal data stored by us, unless the further processing is

- to exercise the right to freedom of expression and information; - to comply with a legal obligation; - for reasons of public interest or - to assert, exercise or defend legal claims.

is necessary;

Right to restriction of processing: pursuant to Art. 18 DSGVO, the right to request the restriction of the processing of your personal data insofar as

- the accuracy of the data is disputed by you;

- the processing is unlawful, but you object to its erasure;

- we no longer need the data, but you require it for the assertion, exercise or defense of legal claims; or

- you have objected to the processing in accordance with Art. 21 DSGVO;

Right to data portability: in accordance with Art. 20 DSGVO, the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transferred to another data controller

Right to complain to a supervisory authority: pursuant to Art. 77 DSGVO, the right to complain to a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company headquarters for this purpose.

Right of objection:

Insofar as we process personal data as explained above in order to protect our legitimate interests that prevail in the context of a balancing of interests, you may object to this processing with effect for the future. If the processing is carried out for direct marketing purposes, you can exercise this right at any time as described above. If the processing is carried out for other purposes, you will only have the right to object if there are grounds arising from your particular situation.

After exercising your right to object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves to assert, exercise or defend legal claims.

This does not apply if the processing is for direct marketing purposes. Then we will not further process your personal data for this purpose.

If you have any questions about the collection, processing or use of your personal data, for information, correction, restriction or deletion of data, as well as revocation of consent given or objection to a particular use of data, please contact us directly via the contact details in our imprint

20.04.2022