Sect. 1 General
We will process your personal data (e.g. title, name, address, e-mail address, phone number) solely in accordance with the provisions of the German data protection law and the data protection law of the European Union (EU). The following provisions will inform you, besides the information about the processing purposes, recipients, legal bases and storage periods, also about your rights and the controller for your data processing. This privacy policy applies only to our websites. If you are directed to other sites via links on our pages, please familiarise yourself with the respective use of your data there.
Sect. 2 Contract and order data
(1) Purpose of data processing
We process your personal data, which you make available to us in the order process, for the purpose of fulfilling the contract. If you send us a request by e-mail or by using the contact form, etc. before concluding the contract, we process the obtained data to carry out pre-contractual measures and answer your questions about e.g. our products.
(2) Legal basis
The legal basis for such processing is set out in Article 6 (1) (b) of the GDPR.
(3) Recipient categories
Payment service provider, hosting provider.
(4) Duration of Storage
We store the data required for contract execution until the statutory warranty and, if applicable, contractual warranty periods expire.
We store the data required under commercial and tax law for the statutory periods, generally ten years (cf. § 257 German Commercial Code (HGB), § 147 Regulation of Taxation (AO)).
The data processed for the execution of pre-contractual measures will be deleted as soon as the measures have been carried out and the contract cannot be concluded.
Sect. 3 Customer account
(1) Purpose of data processing
When you purchase a product, a customer account is created for you. It holds your contact and billing details, your order history and your licence keys, and it lets you download purchased files, retrieve invoices and manage your licences.
(2) Legal basis
The legal basis for such processing is set out in Article 6 (1) (b) of the GDPR.
(3) Recipient categories
Hosting provider.
(4) Duration of Storage
We store the account data for as long as the account exists. You may request deletion of your account at any time; data which we are required to retain under commercial and tax law is retained for the statutory periods and blocked from further processing.
Sect. 4 Server log files and hosting
(1) Purpose of data processing
Each time our website is accessed, our hosting provider automatically records information that your browser transmits. This includes the IP address, the date and time of the request, the page requested, the referring page, the browser type and version, and the operating system used. The data is processed to deliver the website, to ensure its stability and security, and to investigate misuse.
(2) Legal basis
The legal basis for such processing is set out in Article 6 (1) (f) of the GDPR.
(3) Legitimate interest
Our legitimate interest is the secure and reliable operation of our website.
(4) Recipient categories
Host Europe GmbH, Hansestrasse 111, 51149 Cologne, Germany (hosting provider). The same applies to our documentation subdomain docs.getasa2.com.
(5) Duration of Storage
Log files are deleted after seven days at the latest, unless a specific entry is required as evidence in the investigation of an incident.
(6) Right of objection
You have the right to object at any time to the processing of data which was performed according to Article 6 (1) (f) of GDPR for reasons arising from your particular situation.
Sect. 5 Information about cookies
(1) Purpose of data processing
This website uses technically necessary cookies. These are small text files that are stored in or by your Internet browser on your computer system. Cookies which are not technically necessary — in particular the referral cookie of our affiliate programme described below — are set only with your consent.
(2) Legal basis
The legal basis for such processing is set out in Article 6 (1) (f) of the GDPR.
(3) Legitimate interest
Our legitimate interest is the functionality of our website. The user data collected by technically necessary cookies are not used to create user profiles. This preserves your interest in data protection.
(4) Duration of storage
The technically necessary cookies are usually deleted when the browser is closed. Persistent cookies have different validity period from a few minutes to several years.
(5) Right of objection
If you do not wish these cookies to be stored, please deactivate the use of cookies in your Internet browser. However, this may cause a functional limitation of our website. You can also delete persistent cookies at any time by changing your browser settings.
Sect. 6 Consent management
(1) Purpose of data processing
We use a consent management tool to obtain and document your consent to the use of cookies and comparable technologies. When you make a selection in the consent banner, the tool stores your choice together with the time of the selection, the version of the consent banner and an anonymised record of the request, so that we can demonstrate that consent was given and so that you are not asked again on every visit.
(2) Legal basis
The legal basis for storing your choice is Article 6 (1) (c) of the GDPR in conjunction with our obligation under Article 7 (1) of the GDPR to be able to demonstrate consent.
(3) Recipient categories
Hosting provider. The consent record is stored on our own web server and is not transmitted to the provider of the tool.
(4) Duration of Storage
The consent record is stored for a period of twelve months, after which you will be asked again.
(5) Right of revocation
You may revoke your consent at any time with effect for the future by changing your selection in the consent banner, which can be reopened from any page of this website.
Sect. 7 Contact forms and support requests
(1) Purpose of data processing
You can contact us through the contact forms on this website and through our support form. We process the data you enter there — in particular your name, your e-mail address and the content of your message, and in the case of support requests also the details you provide about your licence and your website — in order to answer your enquiry. Submitted messages are stored in the database of this website in addition to being sent to us by e-mail.
(2) Legal basis
Where your enquiry relates to an existing or prospective contract, the legal basis is Article 6 (1) (b) of the GDPR. In all other cases the legal basis is Article 6 (1) (f) of the GDPR.
(3) Legitimate interest
Our legitimate interest is answering enquiries addressed to us.
(4) Recipient categories
Hosting provider, e-mail service provider.
(5) Duration of Storage
We store enquiries until the matter has been dealt with in full and no further questions arise, and thereafter for as long as retention obligations under commercial and tax law require.
(6) Right of objection
You have the right to object at any time to the processing of data which was performed according to Article 6 (1) (f) of GDPR for reasons arising from your particular situation.
Sect. 8 Comments
(1) Purpose of data processing
Adding comments is possible. Your personal data (e.g. name/pseudonym, email address, website) collected in this scope will be solely processed for the purpose of publishing your comments.
(2) Legal basis
The legal basis for such processing is set out in Article 6 (1) (f) of the GDPR.
(3) Legitimate interest
Our legitimate interest is the public exchange of user opinions on specific topics and products. The publication serves, among other things, the purpose of transparency and opinion-forming. Your interest in data protection is preserved, as you can publish your comment under a pseudonym.
(4) Duration of Storage
There is no provision for a certain storage period. You may request the deletion of your comment at any time.
(5) Right of objection
You have the right to object at any time to the processing of data which was performed according to Article 6 (1)(f) of GDPR and which does not serve direct marketing for reasons arising from your particular situation. In the case of direct marketing, however, you may object to the processing at any time without stating any reasons.
Sect. 9 Product reviews
(1) Purpose of data processing
Customers can publish reviews of our products. We process the name or pseudonym you provide, your rating and the text of your review for the purpose of publishing it on the product page.
(2) Legal basis
The legal basis for such processing is set out in Article 6 (1) (f) of the GDPR.
(3) Legitimate interest
Our legitimate interest is enabling prospective customers to form an opinion about our products on the basis of the experience of other customers. Your interest in data protection is preserved, as you may publish your review under a pseudonym.
(4) Recipient categories
Hosting provider. Reviews are publicly accessible on this website.
(5) Duration of Storage
There is no provision for a certain storage period. You may request the deletion of your review at any time.
(6) Right of objection
You have the right to object at any time to the processing of data which was performed according to Article 6 (1) (f) of GDPR for reasons arising from your particular situation.
Sect. 10 Payment processing via Stripe
(1) Purpose of data processing
Payments in our shop are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”). When you pay for an order, the payment details you enter — in particular your card details — are transmitted directly to Stripe and are not stored by us. We receive only the information we need to fulfil the contract, such as the payment status, the payment method and the last four digits of the card number.
Stripe additionally processes technical information about the device and browser used, including the IP address, in order to detect and prevent fraudulent payments.
(2) Legal basis
The legal basis for processing payment data is Article 6 (1) (b) of the GDPR. The legal basis for fraud prevention is Article 6 (1) (f) of the GDPR.
(3) Legitimate interest
Our legitimate interest, and that of Stripe, is preventing payment fraud and thereby protecting both our customers and ourselves against financial loss.
(4) Recipient categories
Stripe Payments Europe, Ltd., Dublin, Ireland; Stripe, Inc., South San Francisco, USA.
(5) Transfer to a third country
Stripe may transfer data to the United States. Stripe, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission issued an adequacy decision on 10 July 2023. In addition, the transfer is based on the standard contractual clauses of the European Commission.
(6) Duration of Storage
We store the payment information we receive for as long as required to fulfil the contract and, thereafter, for the statutory retention periods under commercial and tax law. Storage by Stripe is governed by Stripe’s own privacy policy, available at https://stripe.com/privacy.
(7) Right of objection
You have the right to object at any time to the processing of data which was performed according to Article 6 (1) (f) of GDPR for reasons arising from your particular situation.
Sect. 11 Invoicing, value added tax and statutory retention
(1) Purpose of data processing
We issue an invoice for every order and make it available in your customer account. The invoice contains your name, your billing address, the items purchased and the value added tax applied.
Because we sell digital products to customers throughout the European Union, we are required to determine and document the country in which you are resident in order to apply the correct rate of value added tax. For this purpose we process your IP address in addition to the billing country you provide, and we retain both as evidence.
(2) Legal basis
The legal basis for such processing is Article 6 (1) (c) of the GDPR in conjunction with our obligations under value added tax law and under Section 147 of the German Regulation of Taxation (AO) and Section 257 of the German Commercial Code (HGB).
(3) Recipient categories
Hosting provider, tax adviser, tax authorities where required by law.
(4) Duration of Storage
Invoices and the associated location evidence are retained for the statutory period, generally ten years.
Sect. 12 Licence activation and update checks
(1) Purpose of data processing
Our products are licensed per website. In order to activate a licence, to verify that it is valid and to deliver updates, the WordPress installation on which our product is used connects to our server. In doing so it transmits the licence key, the address of the website on which the product is installed, the product version in use and the IP address of the requesting server.
Please note that this processing concerns the website on which our product is installed. If you install our product on a website which is not your own, the operator of that website should be informed accordingly.
(2) Legal basis
The legal basis for such processing is Article 6 (1) (b) of the GDPR, as the activation and the delivery of updates are part of the contract concluded with us. Insofar as we evaluate activations in order to detect the unauthorised use of licences, the legal basis is Article 6 (1) (f) of the GDPR.
(3) Legitimate interest
Our legitimate interest is ensuring that our products are used within the scope of the licence acquired.
(4) Recipient categories
Hosting provider.
(5) Duration of Storage
Activation records are stored for as long as the licence exists and are deleted once the licence has expired and no further claims arise from it.
(6) Right of objection
You have the right to object at any time to the processing of data which was performed according to Article 6 (1) (f) of GDPR for reasons arising from your particular situation.
Sect. 13 Affiliate programme
(1) Purpose of data processing
We operate an affiliate programme which allows partners to refer customers to us and to receive a commission for referred sales. When you reach our website through a partner link, we store a cookie on your device which records the partner concerned, so that a subsequent purchase can be attributed to that partner. This cookie is set only if you have consented to it.
If you register as a partner yourself, we additionally process the data required to run the partnership, in particular your name, your e-mail address, your payout details and, where legally required, your tax details.
(2) Legal basis
The legal basis for storing the referral cookie is Article 6 (1) (a) of the GDPR and Section 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). The legal basis for processing partner data is Article 6 (1) (b) of the GDPR; where tax details are processed, the legal basis is Article 6 (1) (c) of the GDPR.
(3) Recipient categories
Hosting provider, payment service provider for commission payouts, tax adviser, tax authorities where required by law.
(4) Duration of Storage
The referral cookie is stored for a limited period and is deleted at the latest upon expiry of that period. Partner data is stored for the duration of the partnership and thereafter for the statutory retention periods.
(5) Right of revocation
You may revoke your consent to the referral cookie at any time with effect for the future by changing your selection in the consent banner, and you may delete the cookie in your browser settings at any time.
Sect. 14 Display of Amazon products
(1) Purpose of data processing
On some pages of this website we demonstrate the product displays which our software generates. These demonstrations show real products from Amazon. The product images shown are loaded directly from Amazon’s servers when the page is displayed, which means that your IP address and information about your browser are transmitted to Amazon. The product links contain a partner identifier which allows Amazon to attribute a purchase to us.
We participate in the Amazon partner programme. We receive a commission on qualifying purchases; this does not affect the price you pay.
(2) Legal basis
The legal basis for such processing is set out in Article 6 (1) (f) of the GDPR.
(3) Legitimate interest
Our legitimate interest is demonstrating the function of the software we sell using genuine product data, since this is what the software does.
(4) Recipient categories
Amazon Europe Core S.a.r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg; Amazon.com, Inc., Seattle, USA.
(5) Transfer to a third country
Amazon may transfer data to the United States. Amazon.com, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission issued an adequacy decision on 10 July 2023.
(6) Duration of Storage
We do not store this data ourselves. Storage by Amazon is governed by Amazon’s own privacy notice.
(7) Right of objection
You have the right to object at any time to the processing of data which was performed according to Article 6 (1) (f) of GDPR for reasons arising from your particular situation.
Sect. 15 Google reCAPTCHA
(1) Purpose of data processing
On the pages of this website which contain a contact form we use reCAPTCHA, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), in order to distinguish entries made by human visitors from automated entries. For this purpose reCAPTCHA evaluates the behaviour of the visitor on the page and transmits, among other information, the IP address, the duration of the visit, mouse movements and keystrokes to Google.
(2) Legal basis
The legal basis for such processing is set out in Article 6 (1) (f) of the GDPR.
(3) Legitimate interest
Our legitimate interest is protecting our forms against automated misuse and spam.
(4) Recipient categories
Google Ireland Limited, Dublin, Ireland; Google LLC, Mountain View, USA.
(5) Transfer to a third country
Google may transfer data to the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission issued an adequacy decision on 10 July 2023.
(6) Duration of Storage
Storage is governed by Google’s own privacy policy, available at https://policies.google.com/privacy.
(7) Right of objection
You have the right to object at any time to the processing of data which was performed according to Article 6 (1) (f) of GDPR for reasons arising from your particular situation.
Sect. 16 Newsletter
(1) Purpose of data processing
You can subscribe to our newsletter, which informs you about our products, updates and offers. To subscribe you provide your e-mail address. We use the double opt-in procedure: after you subscribe, we send you an e-mail asking you to confirm the subscription, and we log the time of the subscription and of the confirmation.
The newsletter contains a tracking pixel and links which are individually marked. This allows us to see whether and when a newsletter was opened and which links were clicked. We use this information to measure how our newsletters are received and to improve them.
(2) Legal basis
The legal basis for such processing is set out in Article 6 (1) (a) of the GDPR. Your consent covers both the sending of the newsletter and the measurement of opening and click rates described above.
(3) Recipient categories
Intuit Inc. (Mailchimp), 2700 Coast Avenue, Mountain View, CA 94043, USA.
(4) Transfer to a third country
Mailchimp is operated by Intuit Inc. in the United States. Intuit Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission issued an adequacy decision on 10 July 2023. In addition, the transfer is based on the standard contractual clauses of the European Commission.
(5) Duration of Storage
Your e-mail address and the measurement data are stored for the duration of your subscription and are deleted once you unsubscribe. The record documenting your subscription and confirmation is retained beyond that point as evidence that consent was given.
(6) Right of revocation
You may revoke your consent at any time with effect for the future. Every newsletter contains an unsubscribe link for this purpose. Revoking your consent does not affect the lawfulness of the processing carried out before the revocation.
Sect. 17 Rights of the data subject
If your personal data is being processed, you are the ‘data subject’ in terms of GDPR and you have the following rights towards the controller:
1. Right of access by the data subject
You may ask the controller to confirm whether your personal data is processed.
In the case of such processing, you may request the following information from the controller:
(1) the purposes of the processing of the personal data;
(2) the categories of personal data concerned;
(3) the recipients or categories of recipient to whom the personal data have been or will be disclosed;
(4) the estimated period of time for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
(5) the right to request from the controller to rectify or erase the personal data or the right to restrict the processing of personal data concerning the data subject or to object to such processing;
(6) the right to lodge a complaint with a supervisory authority;
(7) the right to all available information on the source of the data if the personal data are not collected from the data subject;
(8) the existence of automated decision-making, including profiling in accordance with Article 22 (1) and (4) of the GDPR and – at least in these cases – meaningful information for your about the logic involved, as well as the consequences and intended effects of such processing.
As a data subject, you have the right to be informed whether the personal data concerning you are transferred to a third country or to an international organisation. In this regard, you may request to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer.
2. Right to rectification
You have the right to have corrected and/or completed your personal data from the controller if your personal data processed is incorrect or incomplete. The controller has to make the correction without delay.
3. Right to restriction of processing
You have the right to obtain from the controller restriction of processing where one of the following applies:
(1) if you contest the accuracy of the personal data relating to you for a period of time that enables the controller to verify the accuracy of the personal data;
(2) the processing is unlawful and you refuse to erase the personal data and request the restriction of the use of the personal data instead;
(3) the controller no longer needs the personal data for the purposes of processing, but you need them to establish, exercise or defend legal claims; or
(4) if you have lodged an objection against the processing in accordance with Art. 21 (1) GDPR and it has not yet been determined whether the legitimate reasons of the controller outweigh your grounds.
Where processing of personal data relating to you has been restricted, such data may, with the exception of storage, only be processed with your consent or for the purpose of establishing, exercising or defending legal claims or for the protecting of the rights of another natural or legal person or for reasons of an important public interest of the Union or of a Member State.
If the restriction of processing has been restricted in accordance with the conditions mentioned above, you will be informed by the controller before the restriction of processing is lifted.
4. Right to erasure
a) Obligation regarding erasure
You have the right to obtain from the controller the erasure of your personal data immediately and the controller is obliged to erase this data without delay where one of the following reasons applies:
(1) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
(2) you withdraw your consent on which the processing is based accordance to point (a) of Article 6 (1), or point (a) of Article 9 (2) GDPR and where there is no other legal ground for the processing;
(3) you submit an objection to the processing accordance to Article 21 (1) of the GDPR, and there are no legitimate reasons for the processing, or you lodge an objection against the processing accordance to Article 21 (2) of the GDPR;
(4) your personal data have been unlawfully processed;
(5) your personal data need to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
(6) your personal data have been collected in relation to the offer information society services referred to Article 8 (1);
b) Obligation to inform other controllers (third parties)
If the controller has made your personal data public and is obliged to erase them accordance to Article 17 (1) of the GDPR, he has to take reasonable steps, taking into account the available technology and the cost of implementation, including technical measures, to inform the controllers who process the personal data that you, as the person concerned, have requested the erasure of any links to, or copy or replication of those personal data.
c) Exceptions
The right to erasure does not apply to the extent that processing is necessary:
(1) for exercising the right of freedom of expression and information;
(2) for fulfilment of a legal obligation which requires processing by the law of the Union or of the Member States to which the controller is subject, or for the performance of a task carried out in the public interest or the exercise of official authority transferred to the controller;
(3) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9 (2) as well as Article 9 (3) of the GDPR;
(4) for archiving purposes in the public interest, scientific or historical research or for statistical purposes in accordance with Article 89 (1), insofar as the right referred to in paragraph 1 is likely to make it impossible or seriously impair the achievement of the objectives of such processing; or
(5) for the establishing, exercising or defending legal claims.
5. Notification obligation
If you have made use of your right to correct, erase or restrict the processing of your personal data, the controller is obliged to inform all recipients to whom the personal data have been disclosed of this correction or erasure of the data or limitation of the processing, unless this proves to be impossible or involves a disproportionate effort.
You have the right to be informed of these recipients by the controller.
6. Right to data portability
You have the right to receive the personal data relating to you which you have provided to the data controller, in a structured, commonly used and machine-readable format. In addition, you have the right to transmit this data to another controller without hindrance by the controller, who has been provided with the personal data, where:
(1) the processing is based on a consent in accordance with the point (a) of Article 6 (1) or point (a) of Article 9 (2) or on a contract in accordance with the point (b) of Article 6 (1); and
(2) the processing is carried out using automated means.
In exercising this right, you also have the right to have your personal data are transmitted directly from one controller to another, as far as this is technically feasible. Freedoms and rights of other persons may not be affected thereby.
The right to data portability is not applicable to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority given to the data controller.
7. Right to object
For reasons arising from your particular situation, you have the right to object at any time to processing of personal data concerning you, which is carried out based on point (e) or (f) of Article 6 (1); this also applies to profiling based on these provisions.
The controller will no longer process the personal data concerning you, unless the controller can prove that there are compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms or the processing serves to establish, exercise or defend legal claims.
Where the personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing; this also applies to profiling, insofar as it is related to such direct marketing.
Where you object to the processing for the purposes of direct marketing, the personal data concerning you will no longer be processed for these purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you have the possibility of exercising your right to object by automated means using technical specifications.
8. Right to withdraw the declaration of consent under Data Protection Act
You have the right to withdraw your declaration of consent under Data Protection Act at any time. The withdrawal of the consent does not affect the legality of the processing carried out on the basis of the consent until the withdrawal.
9. Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which has legal effect on you or which significantly impairs you in a similar manner.
This does not apply if the decision:
(1) is necessary for entering into, or performance of, a contract between you and a data controller;
(2) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
(3) is based on your explicit consent.
However, these decisions may not be based on special categories of personal data in accordance with Article 9 (1), unless point (a) or (g) of Article 9 (2) applies and appropriate measures to safeguard the rights and freedoms and your legitimate interests are in place.
Regarding the cases referred to in (1) and (3), the data controller has to take appropriate measures to safeguard the rights and freedoms and your legitimate interests, at least the right to obtain human intervention on the part of the data controller, to state his or her own position and to contest the decision.
10. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of your personal data infringes this Regulation.
The supervisory authority with which the complaint has been lodged is to inform the complainant on the progress and the outcome of the complaint including the possibility of judicial remedy accordance to Article 78.
Responsible for data processing:
Internet Solutions Timo Reith
Friedensstr. 28
63179 Obertshausen
Telefon: +491796819190
info@ifeelweb.de