Source: https://commercetools.com/privacy
Timestamp: 2019-04-26 07:58:58+00:00

Document:
commercetools GmbH, Adams-Lehmann-Strasse 44, 80797 Munich (hereinafter only “commercetools”) operates the website commercetools.com and wants to inform you in the following data privacy statement of the extent to which data is gathered for our website commercetools.com and the purposes for which this data is used.
Below are further details on how we process your data for the purposes of advertising. Unless stated otherwise, all processing described below is carried out on the basis of Art. 6 (1)(a) GDPR, that is to say your explicit and voluntary consent. Any consents granted electronically to sending the newsletter shall always be in the form of a double opt-in, while written consents (that is to say, confirmed with your signature) shall regularly be made in the form of a single opt-in.
Mailshots: We use your name and your postal address as well as other information assigned to you (professional, industry, business description, name, title, academic level, address and year of birth) in order to send you advertising by post. This processing is carried out on the basis of Art. 6 (1)(f) GDPR. Pursuant to Art. 21 (2) GDPR, you have the right to object to the processing for the purposes of mail advertising at any time and without stating reasons. You will then receive no further mail advertising from us in future. Please send your objection via email or post to the responsible body mentioned in Section 1.
Personalised offers: We want to provide you with offers that are as individual as possible. Therefore, we use the information automatically generated when you visit our website and transmitted to us in order to provide you with advertising that is tailored to you and your interests. For this we use available information, such as your purchase history, email receipts and read confirmations, the date and time of your visit to our website and the products you have viewed. We use this information purely in pseudonym form. By analysing and evaluating this information, we can provide you with advertising that is individually tailored to your interests. We want to make our advertising as useful and interesting as possible. Therefore you will receive advertising such as newsletters and product recommendations that match your interests, by email or direct mail. This processing is carried out on the basis of Sections 13 (1), 15 (3) TMG, unless you have consented to this pursuant to Art. 6 (1)(a) GDPR. You have the right to object to the processing of data for the purpose of individualised advertising at any time and without stating reasons. To exercise your right to object, click the cookie settings button below.
Newsletter: On our website as well as in the web applications offered by us, you have the option to subscribe to our newsletter at various places. The newsletter informs of current commercetools events, new products and new clients and partners. You can find the data required to subscribe as well as other details in the subscription form linked in the data privacy statement. You can revoke the consent to the newsletter at any time and without stating reasons with effect for the future. Please send your objections to the responsible body mentioned in Section 1 or use the unsubscribe function in the newsletter email. If you revoke your consent, you will no longer receive any newsletters from us in future.
On this website we use HubSpot for our online marketing activities. HubSpot is a US-based software company with a presence in Ireland. Contact: HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland, Phone: +353 1 5187500.
This is an integrated software solution that covers various aspects of our online marketing.
These include: E-mail marketing (newsletters and automated mailings, eg for the provision of event details), social media publishing & reporting, reporting (eg traffic sources, access, etc. …), contact management (eg user segmentation & CRM), landing pages and contact forms.
The legal basis for the use of the services of Hubspot is Art. 6 I f GDPR – legitimate interest. Our legitimate interest in using this service is the optimization of our marketing efforts and the improvement of our service quality on the website.
HubSpot is certified under the terms of the “EU – US. Privacy Shield Frameworks ” and governed by the TRUSTe’s Privacy Seal as well as the “U.S. – Swiss Safe Harbor“ Framework.
At this point we wish to inform you in detail about usage-based online advertising. Our website, or the website from which you have just been directed, records and processes your user behaviour anonymously. As a user, you benefit from this because you receive advertising that matches your fields of interest and thus, less random advertising is delivered to you. To record your user behavior, a cookie is stored on your computer. Cookies are small text files that are installed on the hard drive of your computer, enabling you to be recognised, but preventing you from being personally identified. The processing is carried out on the basis of Sections 13 (1) and 15 (3) TMG [the German law pertaining to telemedia].
We also use Facebook communications tools for usage-based online advertising, especially Custom Audiences and Website Custom Audiences. Basically, a non-reversible and non-personal related hash value is generated from your user data, which can be conveyed to Facebook for analysis and marketing purposes. The Facebook cookie is targeted for Website Custom Audiences. The processing is carried out on the basis of Sections 13 (1) and 15 (3) TMG [the German law pertaining to telemedia]. You will find more information on the purpose and scope of data collection and on the further processing and use of data by Facebook, as well as about the possible settings options to protect your privacy, from Facebook’s data privacy guidelines which you may review here.
Public bodies, on the basis of legal requirements.
Affiliated companies, for the purpose of fulfilling the contract or to provide the products of the information society.
The data processor within the meaning of Art. 28 GDPR in the course of data processing.
Other third parties in the course of transfer of function.
an adequacy decision of the European Commission within the meaning of Art. 45 GDPR.
an approved certification mechanism pursuant to Art. 42 GDPR, together with legally binding and enforceable obligations of the controller or the data processor in the third country.
standard data clauses which have been issued by the Commission pursuant to the review procedure under Art. 93 (2) GDPR.
Your personal data shall not be processed to execute automated case-to-case decisions, including profiling pursuant to Art. 22 (1) and (4) GDPR.
commercetools takes the legally required technical and organisational measures in order to protect personal data from loss, destruction, manipulation and unauthorised access.
Personal data shall only be kept safe for as long as is necessary to satisfy the purposes mentioned here, or as stipulated by the safekeeping periods provided by the legislator. After the purpose no longer applies or after the expiry of the safekeeping periods, the data shall be erased in accordance with the statutory provisions.
Right to information pursuant to Art. 15 GDPR.
Right to rectification pursuant to Art. 16 GDPR.
Right to erasure pursuant to Art. 17 GDPR.
Right to object pursuant to Art. 21 GDPR.
If you would like to make use of your rights, please address your concerns via email to privacy@commercetools.com or by post to the address mentioned in Section 1. Besides that, pursuant to Art. 77 (1) GDPR you have a right to complain to a supervisory authority. You can receive further information from the supervisory authority which is locally competent for you.
The purpose of this privacy statement on data protection pursuant to Art. 13 et seq. GDPR is to ensure compliance with the obligation to provide information in regard to the collection of personal data within the context of relationships with prospective customers and business partners.
The processing of personal data is necessary for the fulfilment of the aforementioned purposes, in order to carry out sales and marketing activities. In the case of a contract, the legal basis for data processing is Article 6(1) lit. b) GDPR, in order to contact you in the context of contract execution.
The legal basis for data processing in case of you have given us a consent is Article 6(1) lit. a) GDPR. According to Article 7 GDPR, you can always revoke your given consent with effect for the future under the e-mail address specified in point 11.
Without a separate consent, the legal basis may also be our legitimate interest for the purpose of direct addressing (pursuant to Article 6(1) lit. f) GDPR and Article 95 GDPR, Section 7 (3) UWG) unless your fundamental rights and freedoms are in conflict. According to Article 21 GDPR, you may object to data processing at any time with future effect due to our legitimate interest under the e-mail address specified in point 11.
You are required to provide the data stated in section 3. It will not be possible to enter into or perform a contract if this data is not provided.
commercetools does not carry out any form of profiling.
Data transfers to countries outside of the EU and the European Economic Area (“third countries”) take place within the context of support services for our Service Desk and our customer database, via our affiliated company in the United States. Transfers are organised on the basis of a Data Processing Agreement or Joint Controller Agreement, as well as standard EU data protection clauses (Art. 46(2) lit. c) GDPR).
commercetools submits data to cloud computing service providers (Salesforce, Hubspot) in the provision of the CRM-database as part of order processing.
We process personal data that we have received in the course of sales and marketing activities.
Where an explicit duration of storage is not stated at the time it is collected (e.g. as part of a declaration of consent), your personal data will be erased as soon as it is no longer required for fulfilment of the purpose for which it was stored, except where statutory retention periods (e.g. retention periods under commercial and tax law) prohibit its erasure.
Right to information according to Art. 15 GDPR.
Right to rectification according to Art. 16 GDPR.
Right to erasure according to Art. 17 GDPR.
Right to restriction of processing according to Art. 18 GDPR.
Should you wish to exercise your rights, kindly submit your requests by email to security@commercetools.com or by post to the address stated under section 1. You also have the right to lodge a complaint with a supervisory authority pursuant to Art. 77(1) GDPR. For further information, contact the competent supervisory authority in your region.
The purpose of this privacy statement on data protection pursuant to Art. 13 et seq. GDPR is to ensure compliance with the obligation to provide information in regard to the collection of personal data within the context of relationships with our suppliers and business partners.
The processing of personal data is necessary for the fulfilment of the aforementioned purposes, including the (contractual) business relationships with the supplier or business partner.
Unless otherwise explicitly specified, the legal basis for data processing is Article 6(1) lit. b) GDPR, or our legitimate interest in processing the name of our business partner’s contact partner according to Article 6(1) lit. f) GDPR.
You are required to provide the data stated in section 3 if you submit or make a contractual offer. It will not be possible to enter into or perform a contract if this data is not provided.
commercetools may transfer personal data to courts of law, supervisory authorities or law practices where such is legally permissible and necessary for compliance with applicable law or in order to assert, exercise or defend against legal claims. commercetools cooperates with service providers (contract processors), such as providers of IT maintenance services. These service providers act exclusively on the instructions of commercetools and are contractually required to comply with the applicable data protection regulations.
We process personal data that we have received in the course of business-related contact with suppliers and business partners.

References: Art. 6
 Art. 6
 Art. 21
 Art. 6
 Art. 6
 Art. 28
 Art. 45
 Art. 42
 Art. 93
 Art. 22
 Art. 15
 Art. 16
 Art. 17
 Art. 21
 Art. 77
 Art. 13
 Art. 15
 Art. 16
 Art. 17
 Art. 18
 Art. 77
 Art. 13