Privacy policy

Controller

The controller for data processing on this website is GrowScan, Inh. Eyobe Bezabhe, Reigersbergstraße 15, 63743 Aschaffenburg, Germany. Email: info@growscan.de.

A data protection officer is not required by law and has therefore not been appointed.

Principle

We collect only the data needed to run the shop and fulfil your order. This website uses no analytics tools, no advertising pixels, no social media plugins and no externally loaded fonts. Fonts are served from our own server.

Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States. The provider processes the data on our behalf. Pages are delivered through the provider’s global server network, usually from a location near you. The order functions run on servers in Frankfurt am Main.

When you visit the website, your browser transmits technical data that the provider stores in log files: the address requested, date and time, volume of data transferred, a message about whether the request succeeded, browser type and operating system, and the IP address.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the technically correct and secure operation of the website. This data is not combined with other sources.

Data is transferred to the United States. This is safeguarded by the provider’s certification under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and by the European Commission’s standard contractual clauses.

A data processing agreement under Art. 28 GDPR is in place with the provider.

Local storage in your browser

So that your cart survives moving between pages, we store the selected cards, the links you entered and any discount code in your browser’s local storage. This data stays on your device and is not transmitted to us unless you submit an order.

This storage is strictly necessary for the service you requested, so no consent is required under § 25 (2) no. 2 TDDDG. You can delete the data at any time in your browser settings.

The site also remembers the language you last chose, so it can send you straight to the right version next time.

Forwarding when a card is tapped

Our cards open a short address at go.growscan.de, which forwards to the stored destination, for example a Google review form or an Instagram profile. We run the forwarding through the Short.io service of Short.cm Inc., USA. Data is stored on servers in the EU (Frankfurt am Main). The provider uses the Cloudflare network for delivery.

When a card is tapped, technically necessary data is processed: IP address, date and time, the short address opened and the browser and device type. This produces visit statistics. We only see aggregated figures, such as the number of visits per card, and do not combine them with other data.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in reliable forwarding, being able to change the destination without replacing the card, and protection against misuse.

Data may be transferred to the United States. This is safeguarded by the European Commission’s standard contractual clauses.

Orders and contract fulfilment

When you order, we process the details from the order form: company, email address, optionally VAT ID and a note, plus the links your cards should forward to. You enter your name and billing and delivery address on Stripe’s payment page, and we receive them from there for invoicing and shipping.

The legal basis is Art. 6 (1) (b) GDPR, since processing is necessary to perform the contract. For keeping invoice records, Art. 6 (1) (c) GDPR applies in conjunction with commercial and tax retention obligations.

We use the links you provide solely for the forwarding and for testing the card.

Payment processing

Payments are processed by Stripe. The provider for the European market is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

To pay, you are redirected to a payment page operated by Stripe (checkout.stripe.com). We pass on the ordered items, the amounts and your email address. You enter your billing and delivery address and your payment details directly there.

We never receive card numbers or credentials, only the information about whether a payment succeeded, the related transaction reference and the address needed for the invoice and the delivery.

The legal basis is Art. 6 (1) (b) GDPR. Transfers to the United States may occur. They are safeguarded by the European Commission’s standard contractual clauses and by the provider’s participation in the EU-US Data Privacy Framework.

Emails about your order

After a paid order we send you an order confirmation containing the order details and our terms and conditions as a file attachment. Once the parcel is on its way, a shipping notification with the tracking number follows.

These emails are part of performing the contract and are required by law, among others by § 312i (1) of the German Civil Code. The legal basis is Art. 6 (1) (b) and Art. 6 (1) (c) GDPR. No consent is required and no objection is possible while the contract is running.

The emails are sent from our mailbox at IONOS SE, Elgendorfer Strasse 57, 56410 Montabaur, Germany. Your email address and the content of the message are processed on that provider’s servers. A data processing agreement under Art. 28 GDPR is in place and the transmission is encrypted.

We do not send marketing emails. There is no newsletter and no tracking of whether an email has been opened.

Shipping

For delivery we pass your name and delivery address to the shipping company we use, currently DHL (Deutsche Post AG, Charles-de-Gaulle-Strasse 20, 53113 Bonn, Germany). If tracking by email is requested, we also transmit your email address for that purpose.

The legal basis is Art. 6 (1) (b) GDPR.

Accounting

For invoicing and bookkeeping we use accounting software (sevdesk GmbH, Hauptstrasse 115, 77652 Offenburg, Germany). Only the details required for a proper invoice are transmitted.

The legal basis is Art. 6 (1) (c) GDPR in conjunction with statutory retention obligations.

Getting in touch

If you email or call us, we process your details in order to handle your enquiry. The contact form on this website transmits nothing to our server; it opens your email program with a prepared message.

The legal basis is Art. 6 (1) (b) GDPR for contract related enquiries, otherwise Art. 6 (1) (f) GDPR based on our legitimate interest in replying.

Retention periods

We delete personal data as soon as the purpose of processing no longer applies and no statutory retention obligation stands in the way.

Invoices and accounting records are subject to commercial and tax retention periods of up to ten years. Plain enquiries without a contract are deleted once they are resolved.

Your rights

You have the right to information (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21).

A message to info@growscan.de is enough for any of these.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.

Encryption

This website uses an encrypted connection (TLS). You can recognise it by the address bar starting with https://.

Changes to this policy

We update this policy whenever the shop changes technically or legally. The version published here is the one that applies.