Privacy Policy

1. Controller

The controller for the data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

2. Collection and storage of personal data and the nature and purpose of its use

a) When visiting the website (server log files)

This website is hosted with GitHub Pages (GitHub, Inc. – see section 4). When our website is accessed, the browser used on your device automatically transmits information to the servers of our host, where it is stored in so-called log files. The following information is recorded without any action on your part:

• IP address of the requesting computer
• date and time of access
• name and URL of the file retrieved
• website from which access is made (referrer URL)
• browser used and, where applicable, the operating system of your computer as well as the name of your access provider

The data referred to above is processed by us for the following purposes:

• ensuring a smooth connection to the website
• ensuring convenient use of our website
• evaluating system security and stability, and for further administrative purposes

The legal basis for the data processing is Art. 6(1) sentence 1(f) GDPR. Our legitimate interest follows from the purposes for data collection listed above. Under no circumstances do we use the data collected for the purpose of drawing conclusions about your person.

Storage period: We ourselves have no access to these log files and do not evaluate them. Storage takes place on the systems of our host GitHub, Inc.; according to its own information, access data including IP addresses is stored for a maximum of 30 days and thereafter deleted or aggregated. Longer storage takes place only where this is necessary in order to investigate a specific security incident or case of misuse; in that event the data records concerned are deleted as soon as the incident has been conclusively clarified.

b) Contact form

You can send us an enquiry using the contact form on this website. The details you enter are transmitted: name, e-mail address, service requested and message text.

Transmission is effected technically via the form service FormSubmit (formsubmit.co), which receives the form data and forwards it as an e-mail to our address. The service is operated by a provider outside the European Union and, according to the information on its own website, is attributable to the provider Devro LABS; complete, verified provider details (legal form and registered office) are not currently available to us. The data transmitted comprises your name, your e-mail address, the service selected, your message text and your IP address. Processing takes place on servers outside the European Economic Area (in particular in the USA).

The legal basis for processing your enquiry is Art. 6(1)(b) GDPR (performance of pre-contractual measures). We base the transfer to a third country exclusively on your explicit consent pursuant to Art. 49(1)(a) GDPR, which you grant by ticking the consent checkbox and submitting the form. You may withdraw this consent at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of the processing carried out up to the withdrawal remains unaffected.

If you wish to avoid this, please write to us directly by e-mail at b2b@prepcenterfba.eu instead. Use of the contact form is not necessary in order to contact us; you will suffer no disadvantage by using e-mail.

We are working to replace this form service with a solution hosted in the European Union and will amend this privacy policy once the changeover has taken place.

Your enquiry is processed by us in order to deal with it and in case of follow-up questions. Enquiries that do not lead to the conclusion of a contract are deleted by us no later than six months after the enquiry has been finally dealt with. Where a contract is concluded, the retention periods under commercial and tax law apply (depending on the type of document, generally six, eight or ten years pursuant to § 257 HGB (German Commercial Code) and § 147 AO (German Fiscal Code)).

c) Contact by e-mail

If you contact us by e-mail, we process the details transmitted in that context (sender address, name, content of the message) in order to deal with your enquiry. The legal basis is Art. 6(1)(b) GDPR insofar as the enquiry is directed towards the conclusion of a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). The periods set out in section 2 b apply accordingly to erasure.

d) Contact via WhatsApp

You can contact us via WhatsApp on +43 676 9559138. Use of this channel is voluntary and is not necessary in order to contact us; equivalent alternatives are e-mail and the contact form.

The provider of the service is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. WhatsApp Ireland Limited is an independent controller in respect of the processing carried out within the messenger service; we have no influence on the nature and extent of that processing. WhatsApp Ireland Limited additionally transfers data to its parent company Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA, and to further companies of the Meta group; according to the provider, the transfer to the USA takes place on the basis of certification under the EU-US Data Privacy Framework together with supplementary standard contractual clauses.

The data processed in this context comprises in particular your mobile telephone number, your profile name and profile picture, metadata of the communication (time, frequency, online status, device and connection information) as well as the content of your messages. Message contents are end-to-end encrypted; the metadata is not. We process the messages you send us in order to deal with your enquiry and to perform the contractual relationship. The legal basis in this respect is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR (legitimate interest in a fast, direct communication channel for business customers).

For details of the data processing carried out by the provider, please refer to its privacy policy: whatsapp.com/legal/privacy-policy-eea.

e) Processing in the course of order fulfilment

In the course of our prep and logistics services we process contact and contract data of our clients (contact persons, invoicing and delivery data). The legal basis is Art. 6(1)(b) GDPR. In order to carry out the inbound delivery to Amazon FBA and for despatch, we pass on the data required for this purpose to the relevant transport undertaking.

Insofar as we despatch consignments to our clients' end customers on their behalf (FBM despatch) or process returns, we process personal data of the end customers (name, delivery address, order and consignment data) exclusively on the instructions of and on behalf of the respective client. In these cases the controller within the meaning of Art. 4(7) GDPR is the client; we are the processor (see section 7).

3. No cookies – exclusively local storage (localStorage)

This website sets no cookies – neither technically necessary cookies nor marketing, tracking or analytics cookies. No web analytics and no tracking take place; no third-party script is loaded when the pages are accessed. For that reason there is also no cookie banner and no consent request on this website.

The only browser technology used is localStorage (local storage) for two technically necessary entries. These entries remain on your device and are not transmitted to us or to any third party. Because access to this information is strictly necessary in order to provide the service expressly requested by you, no consent is required for it under § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). The legal basis for the subsequent processing is Art. 6(1)(f) GDPR (legitimate interest in a functioning website displayed in the desired language).

No data is transmitted to third parties via local storage; with regard to the service providers used by us (form service, hosting) please see sections 2 b and 4.

Storage technologies used

Neither entry contains personal profile data, and neither enables recognition across websites. You may remove local storage in full at any time in the settings of your browser (“clear site data”); the website will remain fully usable thereafter and will merely start again in the language specified by your browser.

4. Hosting

This website is hosted on GitHub Pages. The host processes on our behalf the server log files arising when the website is accessed (see section 2 a), in particular IP addresses. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient provision of our online offering).

Transfer to the USA and safeguards (Art. 13(1)(f) GDPR): When the website is accessed, data is transferred to servers of GitHub, Inc. in the USA. The transfer is based on two grounds: first, GitHub, Inc. is certified under the EU-US Data Privacy Framework; for transfers to certified undertakings in the USA there is an adequacy decision of the European Commission of 10 July 2023 (Art. 45 GDPR). Second, we have concluded the GitHub Data Protection Agreement with GitHub, Inc., which incorporates a data processing agreement (DPA) under Art. 28 GDPR and, in addition, the standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914) as a safeguard pursuant to Art. 46(2)(c) GDPR.

A copy of the standard contractual clauses and of the Data Protection Agreement is available on request at b2b@prepcenterfba.eu.

5. Third-party providers and disclosure of data

Beyond hosting and the form service referred to in section 2 b, this website integrates no further external services: no web analytics, no social media plug-ins, no external fonts, no advertising networks. Personal data is disclosed to third parties only insofar as this is necessary for the performance of the contract (e.g. transport undertakings, tax advisers), we are legally obliged to do so, or you have expressly consented.

6. Necessity of provision and no automated decision-making

Provision of your data (Art. 13(2)(e) GDPR): The provision of personal data is required neither by statute nor by contract, and you are under no obligation to provide it. The details in the contact form are given voluntarily. Without your name, e-mail address and message text, however, we are unable to deal with your enquiry or to send you an offer – no other consequence, in particular no disadvantage of a legal nature, arises for you as a result. Where a contract is concluded, those data are additionally required which we need in order to perform the contract and to comply with obligations under commercial and tax law (in particular company name, address, invoicing and consignment data); without such data we are unable to conclude or perform the contract.

No automated decision-making (Art. 13(2)(f) GDPR): Automated decision-making, including profiling, within the meaning of Art. 22(1) and (4) GDPR does not take place. We do not use any procedures that take decisions about you without human involvement, and we do not create user profiles.

7. Processing on behalf of a controller and record of processing activities

In respect of part of our services – in particular FBM despatch to the end customers of our clients and the processing of returns – we process personal data on behalf of our business customers. For these processing operations we make available to our clients a data processing agreement (DPA) under Art. 28 GDPR; the contractual terms are published as Annex 1 to our General Terms and Conditions and are signed separately on request.

We maintain a record of processing activities pursuant to Art. 30 GDPR. Business customers receive on request an extract of the processing operations concerning them as well as an overview of our technical and organisational measures pursuant to Art. 32 GDPR. Please address enquiries to b2b@prepcenterfba.eu.

8. Data subject rights

You have the right:

• pursuant to Art. 15 GDPR to request information about your personal data processed by us;
• pursuant to Art. 16 GDPR to request without undue delay the rectification of inaccurate personal data or the completion of your personal data stored by us;
• pursuant to Art. 17 GDPR to request the erasure of your personal data stored by us;
• pursuant to Art. 18 GDPR to request the restriction of the processing of your personal data;
• pursuant to Art. 20 GDPR to receive your personal data which you have provided to us in a structured, commonly used and machine-readable format;
• pursuant to Art. 7(3) GDPR to withdraw consent once given at any time vis-à-vis us;
• pursuant to Art. 77 GDPR to lodge a complaint with a supervisory authority. The authority with jurisdiction is generally the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

9. Right to object

10. Data security

Within your visit to the website we use the widely used SSL (Secure Socket Layer) procedure in conjunction with the highest level of encryption supported by your browser in each case. This is generally 256-bit encryption.

11. Currency and amendment of this privacy policy

This privacy policy is currently valid and is dated August 2026. As a result of the further development of our website and of the offerings provided through it, or on account of changed statutory or regulatory requirements, it may become necessary to amend this privacy policy.