Data Protection Information

I. Scope

As the controller, we hereby inform data subjects about the handling of personal data in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR). This document has been in effect since October 2026. Due to potential future changes in data processing procedures or as a result of updated legal or regulatory requirements, it may become necessary to amend this document. The current version is always available at https://www.comrce.io/rechtliches/datenschutz.

II. Who is responsible for data processing?

The controller for data processing as defined by Art. 4 No. 7 GDPR is:

comrce GmbH, Arolser Str. 10, 34477 Twistetal, The full legal notice is available here: https://www.comrce.io/rechtliches/impressum

III. Is there a data protection officer?

The controller for data processing has appointed the following data protection officer:

Marc Oliver Giel, datamog, Lagerstraße 11 A, 64807 Dieburg, email address: giel @ datamog.de

IV. Why do we process your data?

In addition to the processing described below, please also note the information on cookies in Section XI.

IV.1. Log files / Hosting

If you visit our website without registering or otherwise providing us with information, we only collect the following data that your browser transmits to our server (so-called "server log files"):

  • The individual pages of our website (URL)
  • Date and time of access
  • Amount of data sent in bytes
  • Source/reference from which you reached the page
  • Browser used
  • Operating system used
  • IP address used (if applicable, in anonymized form)

Our website is stored and made available for retrieval by a hosting provider. The web server used stores the aforementioned server log files.

  • Purpose of processing: Hosting the website
  • Legal basis and legitimate interests: Processing is based on our overriding legitimate interest (Art. 6 (1) lit. f GDPR) in the security and stability of our website by commissioning a service provider to provide infrastructure and platform services, computing capacity, storage space, database services, security services, and technical maintenance services.
  • Data recipients/processors: Webflow, Inc. https://webflow.com/
  • Privacy information from Webflow, Inc.: https://webflow.com/legal/eu-privacy-policy
  • Third-country transfer: Webflow, Inc. is based in the USA. Data processing takes place there.
  • Adequacy decision of the Commission: Regarding data transfers to Webflow, Inc., we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/
  • Storage duration: 7 days

IV.2. Cookie Consent Management

Cookies and consent management

In addition to storing cookies (see separate section), we manage the consent declarations of our website users using a cookie consent tool.

  • Purpose of processing: Fulfillment of the legal obligation for consent management
  • Legal basis: Art. 6 (1) sentence 1 lit. c GDPR
  • Storage duration: Until consent for cookie storage is withdrawn, at the latest until the respective cookie expires. The storage duration of the individual cookies is listed in the cookie table.

As mentioned below, we have commissioned the following service provider for consent management:

Cookiebot

This is a service provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, https://www.cookiebot.com/de/

IV.3. Contacting us

When you contact us (e.g., via contact form, email, telephone, or fax), personal data is collected. The data collected via a contact form can be seen from the respective form. This data is stored and used exclusively for the purpose of responding to your request or for establishing contact and the associated technical administration. Without this mandatory information, we cannot process your request. All other information is provided voluntarily.

  • Purpose of processing: Responding to your request
  • Legal basis: Art. 6(1)(b) GDPR for pre-contractual or contractual matters. Art. 6(1)(a) GDPR for your voluntary information.
  • Data recipients: Email service providers for emails, hosting providers for contact form inquiries
  • Storage duration: Your data will be deleted after your request has been fully processed. This is the case when it can be inferred from the circumstances that the matter in question has been conclusively resolved, provided there are no statutory retention obligations to the contrary. In the case of pre-contractual and contractual matters, your request will be stored until the contract is terminated and then restricted from further processing. If there is no longer a legal basis for storage, the data will be deleted.

IV.4. Online forms

We have integrated the online form "Jotform" from Jotform Ltd. into our website. The data entered into the form is transmitted to and stored by Jotform. For the purpose of sending requested information, the data is forwarded to Peaberry Software, Inc. Jotform stores the data on European servers.

  • Purpose of processing: Responding to inquiries, sending information
  • Data recipients / processors: Jotform Ltd., https://www.jotform.com (Form hosting), Peaberry Software, Inc., https://customer.io (Email delivery)
  • Jotform privacy policy: https://www.jotform.com/privacy/
  • Peaberry privacy policy: https://customer.io/legal/privacy-policy
  • Legal bases: Art. 6(1)(b) GDPR for mandatory information in the form. Art. 6(1)(a) GDPR for all optional information as well as for the newsletter subscription.
  • Withdrawal of consent: You have the right to withdraw your consent at any time with effect for the future. Please contact the controller via the email address provided above.
  • Requirement to provide data: You must provide the data marked as mandatory fields in the form. Otherwise, we will be unable to provide you with the requested information.
  • Storage duration: Until you unsubscribe from the newsletter.

IV.5. Content Delivery Network

IV. 5. a. Webflow

On our website, we use a Content Delivery Network ("CDN") from Webflow, Inc. ("Webflow"). A Content Delivery Network is an online service used to deliver static website data, in particular, through a network of globally distributed servers connected via the Internet. Essentially, this involves your IP address and your browser data in order to transmit the website data to you. We ourselves do not have access to the data collected by Webflow.

  • Purpose of processing: Optimization of the loading speeds of our website.
  • Legal basis and legitimate interests: Processing is based on our overriding legitimate interest (Art. 6(1)(f) GDPR) in the speed, security, and stability of our website by commissioning a service provider to supply infrastructure and platform services, computing capacity, storage space, database services, security services, and technical maintenance.
  • Data recipient: Webflow, Inc. https://webflow.com/
  • Third-country transfer: To the extent that non-anonymized data is transferred to Webflow, data processing takes place in the USA.
  • Adequacy decision by the Commission: Regarding data transfers to Webflow, we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework under Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

IV. 5. b. Amazon

On our website, we use a Content Delivery Network ("CDN") from the technology service provider Amazon Web Services ("Amazon"). A Content Delivery Network is an online service used to deliver static website data, in particular, through a network of globally distributed servers connected via the Internet. Essentially, this involves your IP address and your browser data in order to transmit the website data to you. We ourselves do not have access to the data collected by Amazon.

  • Purpose of processing: Optimization of the loading speeds of our website.
  • Legal basis and legitimate interests: Processing is based on our overriding legitimate interest (Art. 6(1)(f) GDPR) in the speed, security, and stability of our website by commissioning a service provider to supply infrastructure and platform services, computing capacity, storage space, database services, security services, and technical maintenance.
  • Data recipient: Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109-5210, USA
  • Privacy information from Amazon: Amazon has compiled extensive information in its GDPR Center compiled.
  • Third-country transfer: To the extent that non-anonymized data is transferred to Amazon Web Services, Inc., data processing takes place in the USA.
  • Commission adequacy decision: Regarding data transfers to Amazon Web Services, Inc., we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

IV. 5. c. Cloudflare

On our website, we use a Content Delivery Network ("CDN") from the technology service provider Cloudflare Inc. ("Cloudflare"). A Content Delivery Network is an online service used to deliver large media files (such as graphics, page content, or scripts) via a network of regionally distributed servers connected via the Internet.

  • Purpose of processing: Optimization of the loading speeds of our website
  • Legal basis and legitimate interests: Processing is based on our overriding legitimate interest (Art. 6(1)(f) GDPR) in the security and stability of our website by engaging a service provider to deliver infrastructure and platform services, computing capacity, storage space, database services, security services, and technical maintenance.
  • Data recipient: Cloudflare, Inc., 101 Townsend St. San Francisco, CA 94107, USA
  • Privacy information from Cloudflare Inc: https://www.cloudflare.com/privacypolicy/
  • Third-country transfer: To the extent that non-anonymized data is collected, data processing takes place in the USA.
  • Commission adequacy decision: Regarding data transfers to Cloudflare, Inc., we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

IV.6. Website tracking

IV. 6. a. Google

Google Tag Manager

On our website, we use the Google Tag Manager from the company Google. Google Tag Manager is an online tool that allows us to integrate and manage website tags centrally via a user interface. Tags are small code snippets that, for example, record your activities on our website. For this purpose, JavaScript code snippets are inserted into the source code of our website. The tags come from sources such as Google Ads or Google Analytics, but tags from other companies can also be integrated and managed via the manager. Such tags perform various tasks. They can collect browser data, integrate buttons, set cookies, and also track users across multiple websites. In the Tag Manager account settings, we have allowed Google to receive anonymized data from us. However, this only concerns the use and operation of our Tag Manager and not your data that is stored via the code snippets.

  • Purposes of processing: Tracking (e.g., interest/behavior-based profiling), analysis of visitor actions, interest-based and behavior-based marketing, profiling (creation of user profiles), conversion measurement (measuring the effectiveness of marketing measures), reach measurement (e.g., access statistics, recognition of returning visitors). These purposes apply to both us and Google and its parent company. As far as we are aware, Google also uses the data collected in this way (anonymized) for its own purposes. In this regard, we refer to Google's privacy policy.
  • Legal basis and legitimate interests: The integration of Google Tag Manager on our website is carried out in accordance with Art. 6 (1) lit. f GDPR based on our legitimate interest in the statistical analysis of user behavior for optimization and marketing purposes. The use of the various tags then takes place in accordance with the separately described sections with the express consent of the user.
  • Storage duration: Regarding the storage duration by Google, please refer to their privacy policy.
  • Data recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
  • Google Privacy Policy: https://policies.google.com/privacy
  • Third-country transfer: To the extent that non-anonymized data is transferred to Google LLC, data processing takes place in the USA.
  • Commission adequacy decision: Regarding data transfers to Google LLC, we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework under Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

Google Analytics 4

(a) General: Our website uses Google Analytics, a web analytics service provided by Google Ireland Ltd. (Google), which can be used to analyze the use of websites. In this process, we receive various usage data, such as page views, time spent, operating systems used, and the user's origin.

(b) Consent mode: When you first visit a page on our website, you will be asked via our cookie consent tool, among other things, to give us your consent to the setting of optional cookies by Google. Without your consent, certain information about your usage behavior is collected and processed using so-called "pings."

(c) After your consent: If you give us your consent to set cookies, demographic features, Google Signals, and Google Remarketing (see the following paragraphs) will also be used.

(d) Demographic features: Through a special function, so-called "demographic features," Google Analytics 4 enables the creation of statistics with information about your age, gender, and interests based on an analysis of interest-based advertising and the inclusion of third-party information. This makes it possible to determine and differentiate between website user groups for the purpose of target-group-optimized marketing measures. However, data collected via "demographic features" cannot be assigned to a specific person and therefore not to you personally.

(e) Google Signals: We also use the "Signals" service from Google on our website. With "Signals," we can have Google create cross-device reports (so-called "cross-device tracking"). If you have activated "personalized ads" in your Google account settings and have linked your internet-enabled devices to your Google account, Google can analyze usage behavior across devices and create database models based on this, provided you have given your consent to the use of Google Analytics 4. This takes into account the logins and device types of all website users who were logged into a Google account and performed a conversion. The data shows, among other things, which device you first clicked an ad on and on which device the corresponding conversion took place. When using Google Signals, we do not receive any personal data from Google, but only statistics created on the basis of Google Signals.

(f) Google Remarketing: On our website, we also use the functions of Google Analytics Remarketing in conjunction with the cross-device functions of Google Ads and Google DoubleClick. This function makes it possible to link the advertising target groups created with Google Analytics Remarketing with the cross-device functions of Google Ads and Google DoubleClick. In this way, interest-based, personalized advertising messages that have been adapted to you based on your previous usage and surfing behavior on one device (e.g., mobile phone) can also be displayed on another of your devices (e.g., tablet or PC). To support this function, Google Analytics collects Google-authenticated IDs of users, which are temporarily linked to our Google Analytics data to define and create target groups for cross-device advertising.

(g) Further details:

  • Purposes of processing: Tracking (e.g., interest/behavior-based profiling), analysis of visitor actions, interest-based and behavior-based marketing, profiling (creation of user profiles), conversion measurement (measuring the effectiveness of marketing measures), reach measurement (e.g., access statistics, recognition of returning visitors). These purposes apply to both us and Google and its parent company.
  • Legal basis and legitimate interests: For the use of Google Analytics, you may provide us with your consent in accordance with Art. 6 (1) sentence 1 lit. a GDPR, which you can revoke at any time with effect for the future by reversing your selection for "Marketing" or "Google Analytics 4" in the cookie settings on our site. Without your consent, we use Google Analytics 4 with so-called "pings" based on our overriding legitimate interest (Art. 6 (1) sentence 1 lit. f GDPR) to achieve the purposes of processing (see above).
  • Retention period: We store the anonymized data collected in this way for a maximum period of 14 months. After this, the data is automatically deleted. Regarding the retention period by Google, please refer to their privacy policy. Data collected via the "demographic features" function is stored for two months and then deleted.
  • Objection / Opt-Out: You can object to the collection of your data by installing a browser add-on to deactivate Google Analytics: https://tools.google.com/dlpage/gaoptout?hl=en

    Here you can determine for yourself which data should be used by Google: https://g.co/privacytools

    In addition, you can deactivate personalized advertising directly with Google: https://www.google.com/settings/ads/onweb/

    Further information from Google on how you can block certain ads and disable cross-device analysis in connection with Google Signals can be found here: https://support.google.com/ads/answer/2662922?hl=de

    You can also set your preferences regarding online advertising across different providers here: https://www.youronlinechoices.com/de/

    Alternatively, you can use the Network Advertising Initiative management page: http://www.networkadvertising.org/consumer/opt_out.asp

Google AdSense

Our website uses "AdSense" from Google Ireland Ltd. (Google) to place ads within the Google advertising network (e.g., in search results, videos, on websites, etc.) so that they are displayed to users who have a presumed interest in the ads. Furthermore, we measure the conversion of the ads. However, we only learn the anonymous total number of users who clicked on our ad and were redirected to a page equipped with a so-called "conversion tracking tag." We ourselves do not receive any information that could be used to identify users. However, as part of so-called conversion measurement, we can check which of our online marketing methods have led to a conversion, i.e., for example, to a contract conclusion with us. Conversion measurement is used solely to analyze the success of our marketing measures.

Our website uses Google AdSense exclusively with an anonymized IP address. This means your IP address is truncated by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to Google's parent company in the USA and truncated there.

  • Responsibilities: We are responsible for the integration of Google's software products and for conducting the analyses, insofar as we have access to them. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and its parent company, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, are responsible for their own data processing, over which we have no influence.
  • Purposes of processing: Tracking (e.g., interest-based/behavioral profiling), visitor action analysis, interest-based and behavioral marketing, profiling (creation of user profiles), conversion measurement (measuring the effectiveness of marketing measures), reach measurement (e.g., access statistics, recognition of returning visitors). These purposes apply to both us and Google and its parent company.
  • Legal basis: For the use of cookies for Google AdSense, you may provide us with your consent in accordance with Art. 6 (1) sentence 1 lit. a GDPR, which you can revoke at any time with future effect by deselecting "Marketing" or "Google AdSense" in the cookie settings on our website. Our overriding legitimate interest pursuant to Art. 6 (1) sentence 1 lit. f GDPR lies in the promotion of our products and services.
  • Storage duration: Regarding the storage duration by Google, please refer to their privacy policy.
  • Objection / Opt-Out: You can disable personalized advertising directly via Google: https://www.google.com/settings/ads/onweb/
    Further information from Google on how to block specific advertisements can be found here: https://support.google.com/ads/answer/2662922?hl=de

    You can also set your preferences regarding online advertising across different providers here: https://www.youronlinechoices.com/de/

    Alternatively, you can use the Network Advertising Initiative's management page:http://www.networkadvertising.org/consumer/opt_out.asp
  • Google Privacy Policy: https://policies.google.com/privacy
  • Third-country transfer: To the extent that non-anonymized data is transferred to Google LLC, data processing takes place in the USA.
  • Commission adequacy decision: Regarding data transfers to Google LLC, we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework under Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

Google Ads Conversion

Our website uses the online advertising program "Google Ads Conversion" from Google Ireland Ltd. (Google). We use this advertising program to draw attention to our offerings on external websites with the help of advertising materials (so-called Google Adwords). We can determine how successful individual advertising measures are in relation to the data from the advertising campaigns. Our goal is to show you advertisements that are of interest to you, to make our website more interesting for you, and to achieve a fair calculation of the advertising costs incurred. The advertising program uses so-called cookies. The cookie for conversion tracking is set when a user clicks on an ad served by Google. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognize that the user clicked on the ad and was redirected to this page. Each Google Ads customer receives a different cookie. Cookies cannot therefore be tracked across the websites of Google Ads customers. The information obtained using the conversion cookie is used to create conversion statistics for Google Ads customers who have opted for conversion tracking. Customers learn the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users.

  • Purposes of processing: Conversion measurement (measuring the effectiveness of marketing activities). These purposes apply to both us and Google and its parent company.
  • Legal bases and legitimate interests: For the use of cookies for Google Ads conversion, you may have provided your consent in accordance with Art. 6(1)(a) GDPR, which you can revoke at any time with future effect by deselecting "Marketing" or "Google Ads Conversion" in our site's cookie settings. Our overriding legitimate interest pursuant to Art. 6(1)(f) GDPR lies in the promotion of our products and services.
  • Storage duration: Regarding the storage duration by Google, please refer to their privacy policy.
  • Objection / Opt-Out: You can disable personalized advertising directly via Google: https://www.google.com/settings/ads/onweb/

    Further information from Google on how to block specific advertisements can be found here: https://support.google.com/ads/answer/2662922?hl=de
    You can also permanently opt out of Google Ads conversion tracking cookies by downloading and installing the browser plug-in available at the following link: https://www.google.com/settings/ads/plugin?hl=de

    You can also set your preferences for online advertising across different providers here:https://www.youronlinechoices.com/de/

    Alternatively, you can use the Network Advertising Initiative's management page:http://www.networkadvertising.org/consumer/opt_out.asp
  • Data recipient/processor: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
  • Google Privacy Policy: https://policies.google.com/privacy
  • Third-country transfer: To the extent that non-anonymized data is transferred to Google LLC, data processing takes place in the USA.
  • Adequacy decision of the Commission: Regarding data transfers to Google LLC, we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework under Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

IV. 6. b. Meta (Facebook)

Facebook Pixel

We use the Facebook Pixel function on our website, a product of Meta Platforms Ireland Ltd ("Facebook"). This enables Facebook to identify visitors to our website as a target group for the display of advertisements (so-called "Facebook ads"). We use the Facebook Pixel to ensure that the Facebook ads we place are only shown to users on Facebook and within the services of partners cooperating with Facebook (so-called "Audience Network" https://www.facebook.com/audiencenetwork/) who have shown an interest in our online offering or who possess certain characteristics (e.g., interest in specific topics or products, which can be determined based on the websites visited) that we transmit to Facebook (so-called "Custom Audiences"). Furthermore, we want to ensure that our Facebook ads correspond to the potential interest of the users and are not perceived as intrusive. With the help of the Facebook Pixel, we can also track the effectiveness of Facebook ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook ad (so-called "conversion measurement").

  • Controllers / Data recipients: In accordance with Art. 4 No. 7 and Art. 26 GDPR, we are joint controllers for the processing of so-called "event data" with: Meta Platforms Ireland Ltd. (hereinafter referred to as "Facebook"), 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Parent company: Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. This joint responsibility is limited exclusively to the collection of data and its transfer to Facebook. Processing by Facebook after the transfer is not part of the joint responsibility. Facebook is responsible for the data security of Facebook products. The essential contents of the joint controller agreement under Art. 26 GDPR can be accessed here: https://www.facebook.com/legal/controller_addendum
  • Purposes of processing: a) Displaying content and advertising information that corresponds to the presumed interests of users; b) Delivery of commercial and transaction-related messages (e.g., contacting users via Facebook Messenger); c) Improving ad delivery and personalizing features and content (e.g., improving the identification of which content or advertising information is likely to correspond to the interests of users)
  • Legal basis: For the use of Facebook Conversion, you may provide us with your consent pursuant to Art. 6(1)(a) GDPR, which you can revoke at any time with future effect by deselecting "Marketing" or "Facebook/Meta" in the cookie settings on our website.
  • Storage duration: We store the anonymized data collected in this way for a maximum period of 14 months. After this, the data is automatically deleted. Regarding the storage duration by Meta, we refer to their privacy policy at https://www.facebook.com/policy
  • Facebook Privacy Center (setting privacy preferences): https://www.facebook.com/privacy/center/
  • Facebook Data Policy (information on the handling of personal data): https://www.facebook.com/policy
  • Your rights regarding Facebook: Via this Contact form you can contact Facebook directly regarding the exercise of your data subject rights.
  • Third-country transfer: To the extent that non-anonymized data is transferred to the parent company (Meta Platforms, Inc., 1 Hacker Way, Menlo Park, California 94025, USA), data processing takes place in the USA.
  • Commission adequacy decision: Regarding data transfers to Meta Platforms, Inc., we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

Facebook Conversion API

We have integrated the Facebook Conversion API into our website. The provider of this service is Meta Platforms Ireland Limited (hereinafter referred to as "Facebook"). The Facebook Conversion API allows us to record your interactions with our website and share them with Facebook to improve advertising performance on Facebook.

For this purpose, the time of access, the website visited, your IP address, and your user agent, as well as any other specific data (e.g., purchased products, shopping cart value, and currency), are recorded. A complete overview of the data that can be collected can be found here: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters.

  • Purpose of processing: Tracking (e.g., interest-based/behavioral profiling), analysis of visitor actions, interest-based and behavioral marketing, profiling (creation of user profiles), conversion measurement (measuring the effectiveness of marketing activities), and reach measurement (e.g., access statistics, recognition of returning visitors). These purposes apply to both us and Meta and its parent company.
  • Controllers / Data recipients: Pursuant to Art. 4(7) and Art. 26 GDPR, we are joint controllers for the processing of conversion data with: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Parent company: Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. This joint controllership is limited exclusively to the collection of data and its transmission to Facebook. The subsequent processing by Facebook after the transmission is not part of the joint controllership. Facebook is responsible for the data security of Facebook products. The essential contents of the joint controllership agreement pursuant to Art. 26 GDPR can be accessed here: https://www.facebook.com/legal/controller_addendum
  • Legal basis: For the use of Facebook Conversion, you may provide us with your consent pursuant to Art. 6(1)(a) GDPR, which you can revoke at any time with future effect by deselecting "Marketing" or "Facebook/Meta" in the cookie settings on our website.
  • Storage period: We store the anonymized data collected in this way for a maximum period of 6 months. After this, the data is automatically deleted. Regarding the storage period by Meta, please refer to their data policy at https://www.facebook.com/policy
  • Facebook Privacy Center (setting privacy preferences): https://www.facebook.com/privacy/center/
  • Facebook Data Policy (information on the handling of personal data): https://www.facebook.com/policy
  • Your rights regarding Facebook: Via this Contact form you can contact Facebook directly regarding the exercise of your data subject rights.
  • Third-country transfer: To the extent that non-anonymized data is transferred to the parent company (Meta Platforms, Inc., 1 Hacker Way, Menlo Park, California 94025, USA), data processing takes place in the USA.
  • Commission adequacy decision: Regarding data transfers to Meta Platforms, Inc., we rely on the decision of July 10, 2023, for the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. The list of companies participating in the EU-U.S. Data Privacy Framework is available at https://www.dataprivacyframework.gov/

IV. 6. c. Conversion Expert

We have integrated the "ABlyft" tool from Conversion Expert GmbH into our website. This tool collects information on user behavior to improve the website's user-friendliness. To this end, cookies are set with the user's consent. The user's IP address is processed in the tracking proxy or snippet proxy, but is not used for A/B testing.

  • Purpose of processing: A/B testing to improve the user-friendliness of the website
  • Data recipient / Processor: Conversion Expert GmbH, Zeppelinring 52c, 24146 Kiel, https://ablyft.com
  • Legal basis: For the use of ABlyft cookies, you may provide us with your consent pursuant to Art. 6(1)(a) GDPR, which you can revoke at any time with future effect by deselecting "Marketing" or "ABlyft" in the cookie settings on our website.
  • Storage duration: User data (IDs, etc.) is not stored. The cookies set are deleted after a maximum of 6 months.
  • Opt-out / Objection: You can object to the use of ABlyft at any time by clicking on the following link: https://www.comrce.io/rechtliches/datenschutz?ablyft_opt_out=true

IV.7. comrce-Hub

On our website https://app.comrce.io, we use a "single sign-on" login and authentication system with a comrce-Hub account. This is a process that allows users to log in to our tool providers using a comrce-Hub user account. A prerequisite for single sign-on authentication is that the user is registered with the comrce-Hub and confirms the single sign-on login by clicking the button.
When you visit the login page of one of our tool providers that offers "single sign-on" with the comrce-Hub, your browser establishes a direct connection to our servers. Through this integration, we receive information that your browser has accessed the corresponding page of the tool provider, even if you are not currently logged in to our service. This information (including your IP address) is transmitted directly from your browser to us and stored there.

When using the comrce-Hub, the following (personal) data must be provided:

  • Email address
  • First and last name
  • Company name
  • Postal address
  • Country

Without this mandatory information, we cannot complete your registration for the comrce-Hub.
The following (personal) data can be provided voluntarily:

  • Phone number
  • VAT ID

When using 2-factor authentication, you can use a suitable 2FA app or verify yourself via your registered email address.

IV. 8. Website translations

We have integrated the "Weglot" tool from Weglot SAS into our website. Weglot is loaded when the website is accessed, allowing you to change the language via the language icon in the website header. As a result, a direct connection between your browser and the Weglot server may be established when you visit this website. Weglot thereby receives the information that you have visited this website with your IP address.

  • Purpose of processing: Professional translation of our websites into other languages
  • Legal basis: The use of Weglot is based on our overriding legitimate interest in presenting our websites in a customer-friendly manner in other languages, in accordance with Art. 6 (1) sentence 1 (f) GDPR.
  • Data recipient / processor: Weglot SAS, https://www.weglot.com/de
  • Weglot Privacy Policy: https://www.weglot.com/privacy
  • Storage duration: Storage of the IP address .

IV. 9. Roadmap at https://roadmap.comrce.io/

On our subpage https://roadmap.comrce.io/, we present the future of our tools. Users have the option to request specific features and comment on existing entries. Creating a user profile is required for this. Only an email address is needed for the user profile. After registration, users receive status updates on the features they have commented on or created.

  • Purpose of processing: User-friendly presentation of our product roadmap
  • Legal basis: User agreement pursuant to Art. 6 (1) sentence 1 lit. a GDPR.
  • Data recipients / processors: Sleekplan GmbH, Weglot SAS
  • Storage period: We store user profiles until the user agreement is terminated.

V. What are my data protection rights?

1. As a data subject, you have the following rights:

  • Confirmation of data processing: You have the right to request confirmation from us as to whether your personal data is being processed. The requirements for this can be found in Art. 15 GDPR;
  • Access: You have the right to request information about your personal data that we process. The requirements for this can be found in Art. 15 GDPR;
  • Rectification: You have the right to request the immediate rectification of inaccurate personal data concerning you. The requirements for this can be found in Art. 16 GDPR;
  • Erasure: You have the right to request the immediate erasure of personal data concerning you. The requirements for this can be found in Art. 17 GDPR;
  • Restriction of processing: You have the right to request the restriction of the processing of your personal data. The requirements for this can be found in Art. 18 GDPR;
  • Data portability: You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format. Furthermore, you have the right to have this data transmitted by us to another controller. The requirements for this can be found in Art. 20 GDPR;
  • Withdrawal of consent: You have the right to withdraw your consent at any time if the processing is based on Art. 6 (1) lit. a or Art. 9 (2) lit. a GDPR. Data processing remains lawful until the withdrawal. The withdrawal only applies to the future. The requirements for this can be found in Art. 7 (3) GDPR;
  • Complaint: You have the right, without prejudice to any other administrative or judicial remedy, to lodge a complaint with a supervisory authority if you believe that the processing of personal data concerning you violates the GDPR. The requirements for this can be found in Art. 77 GDPR. You may contact the supervisory authority responsible for the controller or the one in your country or state. A list of all supervisory authorities can be found here: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html

2. Right to object

  • You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you which we process on the basis of our overriding legitimate interest (Art. 6 (1) lit. e or f GDPR), with effect for the future; this also applies to profiling based on these provisions within the meaning of Art. 4 No. 4 GDPR. If you lodge an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or if the processing serves the establishment, exercise, or defense of legal claims.

3. Right to object to the processing of data for direct marketing and product review purposes

  • We collect and process your personal data for the purpose of direct marketing. You have the right to object at any time to the processing of personal data concerning you for the purpose of such direct marketing; this also applies to profiling, insofar as it is related to such direct marketing.
  • In individual cases, we process and use your personal data to send you a review request and/or product recommendation via email that is exclusively related to your purchase, contract, and/or other similar transactions. Furthermore, we may use your email address and/or postal address in this context to send you product recommendations for similar goods and/or services offered by us via email and/or post. You will receive these review requests and product recommendations from us regardless of whether you have subscribed to a newsletter.
  • Exercising your right to object: You can object to this data processing for direct marketing purposes at any time by letter to comrce GmbH, Arolser Str. 10, 34477 Twistetal or by email to hello @ comrce.io and/or at the end of every promotional email with effect for the future, without incurring any costs other than the transmission costs according to the basic tariffs. Your right to object also automatically applies to any potential profiling, insofar as it is related to such direct marketing.
  • If you object to processing for direct marketing purposes, we will immediately stop processing your personal data for these purposes.

VI. How long will my data be stored?

Unless otherwise specified above, the following criteria apply to determining the storage period:

  • In the case of Consent in accordance with Art. 6 (1) (a) GDPR, the data will be stored until the data subject withdraws their consent.
  • In the case of pre-contractual and contractual purposes in accordance with Art. 6 (1) (b) GDPR, the data will be retained beyond the end of the contract until the expiry of relevant limitation periods (e.g., 3 years in accordance with Section 195 of the German Civil Code (BGB)) arising from the concluded contract.
  • In the case of our overriding legitimate interest in accordance with Art. 6 (1) (f) GDPR, the data will be stored until the data subject exercises their right to object pursuant to Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or the processing serves the establishment, exercise, or defense of legal claims.
  • In the case of Direct marketing in accordance with Art. 6 (1) (f) GDPR, the data will be stored until the data subject exercises their right to object pursuant to Art. 21 (2), (3) GDPR.
  • For obligations incumbent upon us Retention obligations the relevant documents will be kept until the expiry of the applicable statutory provisions (e.g., 10 or 6 years in accordance with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB)).
  • Prospective customer dataare stored for as long as it can be assumed that there is still an interest in working with us. If we assume that there is no longer any interest, we will delete this data.
  • Business partner data are stored for as long as it can be assumed that there is still an interest in working with us. If we assume that there is no longer any interest, we will delete this data no earlier than 3 years after the end of the last business relationship, provided there are no statutory retention obligations.
  • Supplier data we store this until the supplier objects and delete it no earlier than 3 years after the end of the last business relationship, provided there are no statutory retention obligations.

Otherwise, personal data is only stored for as long as there is a legal basis for storage.

VII. Where does the personal data come from?

We process personal data that we have received from you or from the recipients of personal data.

VIII. Am I obliged to provide data?

As part of the fulfillment of our contractual or legal obligations, you as the data subject may be required to provide our company with personal data that is necessary for the establishment, execution, and termination of the contractual relationship and the fulfillment of the associated contractual obligations, or which we are legally required to collect. Without this data, we will generally have to refuse to conclude the contract or will no longer be able to execute an existing contract and may have to terminate it.

IX. Cookies

IX.1. General information

(aa) Definitions

Below you will find comprehensive information about "cookies" and other storage technologies ("web storage"). This is information that is often stored in databases on your device. Every type of "cookie" or "web storage" can contain personal data. In many cases, however, the data is pseudonymized. The following terms may be used below:

  • First-party cookie: This cookie is stored or modified by the website you are currently browsing.
  • Third-party cookie: This cookie is stored or modified by third parties with whom the website operator is associated (e.g., an advertising network, a social media platform, etc.).
  • Session cookie: This cookie is deleted from your device when you close your browser. A session cookie often only stores a session ID to assign multiple requests from a user on a page to their session.
  • Persistent cookie: This cookie is stored on your device until it expires or you delete it manually or automatically in your browser.
  • Strictly necessary: Without this cookie and web storage, the service you have requested cannot be provided.
  • Optional: This cookie and web storage enable us to use additional functions and are only used if you provide your consent for this.
  • Local storage: Part of what is known as "web storage." This information is also stored in your web browser until it is manually deleted.
  • Session storage: Part of what is known as "web storage." This information is also stored in your web browser until the browser window is closed.

(bb) Legal bases

  • Strictly necessary cookies and web storage: The storage of and access to information is based on the legal grounds of Section 25 (2) No. 2 of the TDDDG.
  • Optional cookies and web storage: The storage of information and access to it are based on your individual, personal, and voluntary consent in accordance with Section 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR. You can revoke your consent at any time with effect for the future. Data processing remains lawful until the time of revocation. Please note that if you do not accept optional cookies, some functions of our website may be limited.

(cc) Data recipients / Access options

  • First-Party Cookies: Only we, as the data controller and website operator, have access to these.
  • Third-Party Cookies: Only the third party that placed these cookies has access to them. For example, only Google has access to a cookie placed by Google and can read or modify it.
  • Web Storage: Only we, as the data controller and website operator, have access to this.

(dd) Storage duration

  • Session Cookies: These are only stored temporarily in your browser until the end of the browser session or can be deleted by you beforehand.
  • Persistent Cookies: These remain stored on your device for as long as specified for the respective cookie or until you delete them.
  • Local Storage: This remains stored until it is manually deleted.
  • Session Storage: This remains stored until the browser window is closed.

The exact storage duration is specified under "Cookies and Web Storage Used".

(ee) Deletion options / Objection

Please note that you can configure your browser to inform you about the placement of cookies and decide individually whether to accept them, or you can exclude the acceptance of cookies for specific cases or in general. Each browser manages cookie settings differently. This is described in the help menu of each browser, which explains how you can change your cookie settings. You can find these for the respective browsers at the following links:

A general objection to the use of cookies for online marketing purposes can be declared for a large number of services, especially in the case of tracking, via the US website https://www.aboutads.info/choices/ or the EU website https://www.youronlinechoices.com/.

IX.2. Cookies and Web Storage Used

‍

TERMS AND CONDITIONSData protectionImprint
Cookie Preferences
contact

hello@comrce.io

DE
EN

Copyright © 2025 - comrce GmbH - Where your e-commerce grows