Privacy Policy

As of: 10 November 2026

Controller
Overview of Processing
Relevant Legal Bases
Security Measures
Transfer of Personal Data and Data Transfers to Third Countries
General Information on Data Storage and Deletion
Rights of Data Subjects
Provision of the Online Service and Web Hosting
Use of Cookies and Similar Technologies
Contact and Enquiry Management
Customer Account, Customer Portal and Orders
Payment Methods
Business Services and Business Processes
Free Website Check
Chatbot
Newsletter and Email Communication
Customer Reviews (Google Reviews)
Web Analytics
Online Marketing
Affiliate Programme
Social Media Presences
Links to Other Websites
Changes and Updates

Controller

Dimitriou eCommerce Web Services UG (haftungsbeschränkt), represented by the Managing Director Theodoros Dimitriou
Steinerne Furt 72, 86167 Augsburg
Email: theodoros@ecommercewebservices.de
Phone: +49 1573-1110011

Further details can be found in the Imprint.

Overview of Processing

The following overview summarises the types of data processed and the purposes of their processing, and names the data subjects concerned. Details are set out in the respective sections.

Types of Data Processed

Master data (e.g. name, company, address)
Contact data (e.g. email address, telephone number)
Content data (e.g. messages, uploaded documents)
Contract and payment data (e.g. services ordered, invoices, payment status)
Usage data (e.g. pages visited, times, devices and browsers used)
Meta, communication and procedural data (e.g. IP addresses, time details, identifiers)

Data Subjects

Visitors to this website
Prospective customers and persons making enquiries
Customers and their employees in the customer portal
Newsletter subscribers
Business and contractual partners, affiliate partners

Purposes of Processing

Provision, security and stability of this website
Responding to enquiries and communication
Provision of contractual services, invoicing and customer service
Newsletter and direct marketing (only with consent)
Audience measurement and measuring the success of advertising (only with consent)
Protection against misuse and spam

Relevant Legal Bases

We process personal data on the basis of the following provisions of the General Data Protection Regulation (GDPR). In the individual sections, we state the applicable legal basis in each case.

Consent (Art. 6(1)(a) GDPR): You have consented to the processing for one or more specific purposes.
Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR): The processing is necessary for a contract with you or for steps taken at your request prior to entering into a contract.
Legal obligation (Art. 6(1)(c) GDPR): The processing is necessary for compliance with a legal obligation, such as retention obligations under commercial and tax law.
Legitimate interests (Art. 6(1)(f) GDPR): The processing is necessary for the purposes of our legitimate interests or those of a third party, provided that your interests and fundamental rights do not override them.

In addition, Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) applies to the storage of information on your terminal device and access to it (e.g. cookies): access that is not technically necessary only takes place with your consent (Section 25(1) TDDDG); access that is strictly necessary takes place without consent (Section 25(2) no. 2 TDDDG).

In addition to the GDPR, the German Federal Data Protection Act (BDSG) in particular applies in Germany.

Security Measures

In accordance with the legal requirements, and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

These include in particular encrypted transmission (TLS, recognisable by the "https://" in the address bar), access restrictions on our database, two-factor sign-in for the administration area, and security headers that make it more difficult to embed and manipulate this website.

Transfer of Personal Data and Data Transfers to Third Countries

We only pass on personal data to other bodies where this is necessary for the stated purposes, for example to the service providers named in this policy. With service providers that process data on our behalf, we conclude data processing agreements (Art. 28 GDPR).

Some service providers have their registered office outside the EU, e.g. in the USA or in Singapore, or belong to companies based in the USA. A transfer to a country outside the EU or the EEA (third country) only takes place if the requirements of Art. 44 et seq. GDPR are met. For the USA, the adequacy decision of the European Commission of 10 July 2023 on the EU-US Data Privacy Framework (DPF) applies to companies certified under the DPF; the list of certified companies can be found at https://www.dataprivacyframework.gov/. Where a provider is not certified, we base the transfer on the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR).

General Information on Data Storage and Deletion

We delete personal data as soon as it is no longer necessary for the purpose for which it was collected, consent has been withdrawn, or no other legal basis exists. This does not apply to data that we must retain for legal reasons or that we need for the establishment, exercise or defence of legal claims; we process such data only for that purpose.

Under German law, the following retention periods apply in particular:

10 years: books and records, annual financial statements, inventories, management reports, opening balance sheets and the work instructions and other organisational documents required to understand them (§ 147(1) no. 1 in conjunction with (3) of the German Fiscal Code (AO), § 14b(1) of the German VAT Act (UStG), § 257(1) no. 1 in conjunction with (4) of the German Commercial Code (HGB)).
8 years: accounting vouchers, e.g. invoices and expense receipts (§ 147(1) nos. 4 and 4a in conjunction with (3) sentence 1 AO, § 257(1) no. 4 in conjunction with (4) HGB).
6 years: other business documents, e.g. commercial and business letters received and sent, as well as other documents insofar as they are relevant for taxation (§ 147(1) nos. 2, 3 and 5 in conjunction with (3) AO, § 257(1) nos. 2 and 3 in conjunction with (4) HGB).
3 years: data required to examine possible warranty and damages claims or similar contractual claims, for the duration of the regular limitation period (§§ 195, 199 of the German Civil Code (BGB)).

If a period does not expressly begin on a specific date and is at least one year, it begins at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contracts, this is the end of the contractual relationship.

Rights of Data Subjects

As a data subject, you have the following rights under the GDPR. To exercise them, a message to the contact details stated under "Controller" is sufficient.

Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to such processing (Art. 21 GDPR).
Right to withdraw consent: You may withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). You can change or withdraw your cookie consent at any time via the "Cookie settings" link at the bottom of every page.
Right of access: You may request confirmation as to whether we process data concerning you, as well as access to this data, further information and a copy (Art. 15 GDPR).
Right to rectification: You may request the completion of data concerning you or the rectification of inaccurate data (Art. 16 GDPR).
Right to erasure and restriction of processing: In accordance with the legal requirements, you may request that data concerning you be erased without undue delay or that its processing be restricted (Art. 17 and 18 GDPR).
Right to data portability: You may receive data that you have provided to us in a structured, commonly used and machine-readable format, or request its transmission to another controller (Art. 20 GDPR).
Complaint to a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of data concerning you infringes the GDPR (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, https://www.lda.bayern.de.

Provision of the Online Service and Web Hosting

Hosting: This website and its server functions (e.g. forms, website check, customer portal) are provided by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. Netlify delivers the pages via a worldwide server network. When a page is accessed, Netlify processes the data technically required for this: IP address, date and time, address accessed, amount of data transferred, referrer and browser identifier (server log files). The log files serve operation, security and error analysis and are deleted after a short time. Privacy policy: https://www.netlify.com/privacy/.

Database, sign-in and file storage: We store form entries, customer accounts and documents in a database provided by Supabase Pte. Ltd., Singapore, with servers in Frankfurt am Main (Germany). For any possible access from outside the EU (e.g. during maintenance), the standard contractual clauses of the European Commission apply. Privacy policy: https://supabase.com/privacy.

Protection against misuse: To protect forms and functions against automated mass requests, we briefly store a truncated hash of your IP address generated with a secret key (not the plain IP address) and use it to count requests. To combat spam, we also use an invisible check field and the "ALTCHA" computational challenge, which runs on our own servers and does not send any data to third parties.

Fonts: All fonts are hosted on our own server; no data is transmitted to Google or other font providers when pages are accessed.

Data processed: usage data, meta, communication and procedural data.
Legal basis: legitimate interest in the secure and efficient provision of the website (Art. 6(1)(f) GDPR); for forms and customer accounts additionally Art. 6(1)(b) GDPR.
Third-country transfer: see the section "Transfer of Personal Data and Data Transfers to Third Countries".

Use of Cookies and Similar Technologies

Cookies are small files or entries that are stored on your terminal device. We also use your browser's storage (localStorage). On your first visit, we ask you which categories you consent to. You can choose "Necessary only", accept all or make an individual selection; you can change or withdraw your choice at any time via "Cookie settings" at the bottom of every page.

Necessary (without consent): your cookie choice, language and colour scheme (localStorage, until you delete them) as well as sign-in to the customer portal. Legal basis: Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR.
Statistics (only with consent): Google Analytics, see "Web Analytics".
Marketing (only with consent): Meta Pixel and LinkedIn Insight Tag (see "Online Marketing") as well as the affiliate cookie (see "Affiliate Programme").

The legal basis for Statistics and Marketing is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Without consent, these services are not loaded. Further details can be found in our Cookie Policy.

Contact and Enquiry Management

If you contact us via the contact form, by email, by telephone or via the customer portal, we process your details (e.g. name, company, email address, telephone number, website, message) in order to respond to your enquiry and, where applicable, to prepare a quotation. We store enquiries in our database and in our customer management system; we are notified of new enquiries by email.

Legal basis: pre-contractual measures (Art. 6(1)(b) GDPR) and our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).
Storage period: for as long as is necessary for processing the enquiry and any resulting business relationship; thereafter in accordance with the provisions in the section "General Information on Data Storage and Deletion".

Customer Account, Customer Portal and Orders

In the customer portal, you can create an account, order and pay for services, access contracts, quotations and invoices, and exchange documents. For this purpose, we process sign-in data (email address, encrypted password, second factor if applicable), profile and company data (name, telephone, address, VAT ID number), team members, orders, invoices and documents. When you sign in, we store the sign-in and session data in order to protect your account against misuse. The customer portal is not public and is not indexed by search engines.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR), statutory retention obligations (Art. 6(1)(c) GDPR).
Storage period: until the account is deleted. We then retain orders and invoices for the statutory periods; the account itself is anonymised.

Payment Methods

We process payments in the shop and in the customer portal via Stripe: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your card details or account details directly with Stripe; we do not receive them, but only a confirmation of the payment and details such as the amount, payment method and the last digits of the card. If you book time for instant remote maintenance, the payment method may, with your consent, be stored with Stripe so that we can charge for additional time, as described when ordering. Stripe also processes data for fraud prevention under its own responsibility. Privacy policy: https://stripe.com/de/privacy.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR), legal obligations (Art. 6(1)(c) GDPR).
Third-country transfer: Stripe may transfer data to Stripe, Inc. in the USA; see the section on data transfers.

Business Services and Business Processes

We process data of our customers, prospective customers and business partners in the context of contracts and their initiation in order to provide and invoice our services, fulfil warranty and support obligations, and maintain our accounting and business organisation. Where necessary, we pass on data to tax advisers, banks, payment service providers, authorities or commissioned service providers.

Data processed: master, contact, contract, payment and content data.
Legal basis: performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR), legal obligation (Art. 6(1)(c) GDPR), legitimate interests in proper business management (Art. 6(1)(f) GDPR).

Free Website Check

If you use the website check, we check the website address you enter for loading time, accessibility, legal compliance and SEO. To measure the loading time, our servers transmit the website address to the Google PageSpeed Insights API (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); your IP address or other information about you is not transmitted in the process. We store the address checked, the result and a truncated IP hash to protect against misuse. If you request the full report, we additionally store your name, your email address, your company and your request in order to send you the report and to get in touch with you.

Legal basis: pre-contractual measures at your request (Art. 6(1)(b) GDPR) and our legitimate interest in protecting the service (Art. 6(1)(f) GDPR).
Storage period: as for enquiries (see "Contact and Enquiry Management").

Chatbot

An AI chat may be offered on this website. If it is active and you write to it, our servers send your messages and the previous conversation history to the AI provider OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, in order to generate a response. Your IP address is not transmitted to OpenAI in the process. We only store a random session identifier and the amount of text used, not the content of the conversation. Please do not enter any sensitive data in the chat.

Legal basis: legitimate interest in answering questions quickly (Art. 6(1)(f) GDPR) or pre-contractual measures (Art. 6(1)(b) GDPR).
Third-country transfer: OpenAI may transfer data to OpenAI, L.L.C. in the USA; see the section on data transfers.

Newsletter and Email Communication

You will only receive our newsletter with your consent. After you sign up, we send you an email in which you confirm your subscription (double opt-in). We log the sign-up, the confirmation and the wording of the consent with the time and a truncated IP hash in order to be able to demonstrate consent. We store your email address and, if provided, your name and your language. We record whether a newsletter was delivered; for individual issues, we may additionally record which links are clicked in order to improve the content. You can unsubscribe from the newsletter at any time via the link in every issue. After you unsubscribe, we keep your email address on a block list so that you are not contacted again.

We send emails (newsletters, confirmations, responses to enquiries) via our own mail server.

Legal basis: consent (Art. 6(1)(a) GDPR); proof of consent and block list: legitimate interest or legal obligation (Art. 6(1)(f) and (c) GDPR).

Customer Reviews (Google Reviews)

On our home page, in addition to our customer testimonials, we display the reviews from our business profile on Google. Our servers retrieve the reviews from Google (Google Places API, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) as soon as you scroll to this section. Your browser does not connect to Google in the process; we also load the reviewers' profile pictures via our own server. Only when you click a link to Google Maps (e.g. "Write a review") do Google's privacy terms apply: https://policies.google.com/privacy.

Legal basis: legitimate interest in displaying independent customer reviews (Art. 6(1)(f) GDPR).
Storage period: the reviews are retrieved afresh each time the page is accessed and are not stored.

Web Analytics

With your consent ("Statistics" category), we use Google Analytics 4 and Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand how our website is used, e.g. which pages are visited and where visitors come from. Google Analytics sets cookies and creates pseudonymous usage profiles; IP addresses are not stored in Google Analytics 4. Privacy policy: https://policies.google.com/privacy.

Legal basis: consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).
Storage period: the cookies are stored for up to two years; Google deletes the analytics data after the period we have set.
Third-country transfer: Google may transfer data to Google LLC in the USA; see the section on data transfers.
Withdrawal: via "Cookie settings" at the bottom of every page.

Online Marketing

With your consent ("Marketing" category), we use the following services to measure the effectiveness of our advertising and to show it to people who may be interested in our services. In the process, cookies are set and data about your visit (e.g. pages visited, browser and device information, IP address) is transmitted to the respective provider, which may link it to your account with that provider.

Meta Pixel: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. We are jointly responsible with Meta for the collection and transmission of the data (Art. 26 GDPR); the corresponding agreement can be found at https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for any further processing. Privacy policy: https://www.facebook.com/privacy/policy/.
LinkedIn Insight Tag: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Privacy policy: https://www.linkedin.com/legal/privacy-policy.
Legal basis: consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).
Third-country transfer: Meta and LinkedIn may transfer data to their parent companies in the USA; see the section on data transfers.
Withdrawal: via "Cookie settings" at the bottom of every page.

Affiliate Programme

Through our partner programme, partners can recommend our services and receive a commission when an order is placed. If you come to our website via a partner's link and have consented to marketing cookies, we store the partner's identifier in a cookie ("affiliate_ref") for 30 days so that we can attribute the commission. Without your consent, the cookie is not set, and withdrawing consent deletes it. With regard to the partners themselves, we process the details required for participation and invoicing (contact, bank and billing data).

Legal basis: consent for the cookie (Section 25(1) TDDDG, Art. 6(1)(a) GDPR); performance of a contract with partners (Art. 6(1)(b) GDPR).

Social Media Presences

We maintain company pages on LinkedIn and Facebook. When you visit them, the operators process your data in accordance with their own terms. We are jointly responsible with the respective operator for the page statistics ("Insights"):

Facebook: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; joint controller agreement: https://www.facebook.com/legal/terms/page_controller_addendum.
LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland; agreement: https://legal.linkedin.com/pages-joint-controller-addendum.

You can assert your right of access and other data subject rights most effectively directly with the operator; however, you may also contact us.

Legal basis: legitimate interest in providing information to and communicating with users (Art. 6(1)(f) GDPR).

Links to Other Websites

Our pages link to other websites, e.g. to our customers' projects or to Google Maps. Data is only transmitted to the respective provider once you follow such a link; that provider is itself responsible for its processing.

Changes and Updates

We amend this privacy policy as soon as changes to our processing make this necessary. The version published here at any given time applies; the date is shown at the top under "As of".