Privacy Policy
Protecting your data matters to us. Below we explain the nature, scope and purpose of the processing of personal data on this website.
1. Controller and scope
The controller for this website is Artur Hoffmann (sole trader, zrapp.group), Okenstraße 352b, 77654 Offenburg, Germany. Contact us at support@zrapp.de or +49 1522 6939034 (Mon–Fri 8–17, Europe/Berlin). This notice covers website visits, enquiries and registration for the withdrawal button offered on this domain. The privacy notices and data processing agreements linked for each product additionally govern the use of our Shopify apps.
2. Hosting and server logs
The website is served from servers in Germany hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur. Processing includes IP address, date and time, requested address, data volume, HTTP status and, where supplied, browser, operating system and referrer information. Our hosting provider receives these data as a processor under Art. 28 GDPR. Art. 6(1)(f) GDPR applies; our legitimate interest is delivering, protecting and troubleshooting the website. Logs are retained only as long as necessary for these purposes and then deleted or overwritten. A specific security incident may require retention until it is resolved. Fonts, images and embedded videos are served by this website; loading them does not create an additional connection to Google Fonts, YouTube or an external font CDN.
3. Cookies and local storage
We use no analytics or advertising cookies and no visitor analytics scripts on the website. After your selection, we store your chosen appearance under “zrapp_theme” (light/dark); acknowledging the notice stores that acknowledgement under “zrapp_cookie” in your browser’s localStorage. The page address determines the language, which is not stored in localStorage. Access serves the function you selected or management of the notice (§ 25(2) no. 2 TDDDG). Where personal data are involved, Art. 6(1)(f) GDPR applies to our legitimate interest in providing your chosen settings. These entries are not transmitted to our server and remain until changed or deleted in the browser. You can remove them through your browser’s website data settings. Section 5 additionally applies when submitting the contact form.
4. Contact and project enquiries
When you contact us by form, email or telephone, we process your contact details and enquiry. The form transmits your name, email, message and selected project stage. Art. 6(1)(b) GDPR applies where the enquiry concerns a contract with you or steps towards one. For other enquiries, including those from company representatives, Art. 6(1)(f) GDPR applies; our legitimate interest is answering business enquiries. Contacting us is voluntary. We need the required form fields to assign and answer your enquiry; you can alternatively contact us directly by email or telephone.
5. Formcarry form service
Submitting the form sends your entries and technical connection data, such as IP address and browser information, to Formcarry for delivery and spam protection. Its provider is Teijal, Inc. (Formcarry), 3 Germay Dr, Unit 4 #1278, Wilmington, DE 19804, USA. Formcarry acts as a processor under the DPA incorporated into its terms. It reports storage in Frankfurt; US remote access and US subprocessors, including for spam filtering and email delivery, remain possible. Its transfer safeguards include EU Standard Contractual Clauses. Details and a copy of the safeguards: https://formcarry.com/legal/data-processing-agreement; privacy: https://formcarry.com/legal/privacy-policy. Sections 4 and 7 explain the legal bases and retention purposes.
6. Other recipients and international transfers
Access is provided to the people and service providers necessary for processing enquiries, hosting and email communication. Disclosure to authorities or courts takes place where legally required (Art. 6(1)(c) GDPR); necessary legal claims or defence rely on Art. 6(1)(f) GDPR. Processing on our behalf is subject to Art. 28 GDPR. Processing outside the European Economic Area may occur particularly through Formcarry; section 5 identifies its safeguards. For the withdrawal button, we also use Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, with Amazon SES in Frankfurt (eu-central-1) to send confirmation and notification emails. For access from third countries, the transfer safeguards provided by AWS apply, particularly Standard Contractual Clauses: https://aws.amazon.com/compliance/eu-data-protection/.
7. Retention
Enquiries, including submissions stored in Formcarry, are deleted once concluded and no further correspondence, contractual processing, statutory retention or legal claims require storage. Where applicable, business correspondence must be retained for six years, and accounting records and invoices generally for eight years (§ 257 HGB, § 147 AO, § 14b UStG). The relevant period generally starts at the end of the applicable calendar year. Pending proceedings or other legal requirements may require longer retention; processing is then restricted to that purpose. Section 3 covers local storage; section 8 and the relevant DPA cover withdrawal data.
8. Withdrawal button registration and data
Registration at /widerruf/ involves your shop name, domain, notification email, supplied legal notice and privacy addresses, language and appearance settings, registration IP, timestamps, confirmation token and accepted DPA version. A confirmation link valid for 48 hours verifies the email address. Art. 6(1)(b) GDPR covers registration and provision of the service; Art. 6(1)(f) GDPR covers preventing abuse and documenting the agreement. Registration data are needed to operate the account; contact support@zrapp.de to end the service and request deletion. After the contract ends, we delete them unless evidence or retention obligations remain. For incoming withdrawals, we act on the merchant’s behalf: name, email, order number, optional contract details and receipt time are processed to confirm and forward the withdrawal and stored as evidence. The intended retention period is 1,095 days, subject to an earlier deletion instruction. This is not a statutory minimum retention period. The DPA at https://zrapp.group/avv/ sets out details, recipients and merchant rights. Customers should contact their merchant about their data; we assist the merchant in responding.
9. Links and use of Belegio
External websites and the Shopify App Store are accessed when you follow a link. Their respective providers are responsible for their processing. This website does not read orders or customer data from your Shopify store. Processing during installation and use of Belegio is described separately at https://rechnung.zrapp.de/legal/privacy. The Belegio DPA is available at https://zrapp.group/belegio/avv/ and the terms of use at https://rechnung.zrapp.de/legal/terms. The privacy policy of the Shopify app zrapp (sevdesk and Lexware Office) is at https://zrapp.group/zrapp/datenschutz/, that of zrapp für BuchhaltungsButler at https://zrapp.group/buchhaltungsbutler/datenschutz/ (both in German).
10. Your rights and withdrawal of consent
Subject to the statutory conditions, you have rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and portability (Art. 20). Contact support@zrapp.de to exercise them. Where processing relies on consent, you can withdraw it at any time for the future; earlier processing remains lawful. Merely submitting an enquiry is not treated as consent to advertising or tracking.
11. Right to object under Art. 21 GDPR
You may object at any time to processing under Art. 6(1)(f) GDPR on grounds relating to your particular situation. We will then stop processing the relevant data unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or processing serves legal claims. You may object to processing for direct marketing at any time without giving such grounds. An informal message to support@zrapp.de is sufficient.
12. Right to complain
You may complain to a data protection supervisory authority, particularly where you live, work or suspect an infringement (Art. 77 GDPR). Our competent authority is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany; https://www.baden-wuerttemberg.datenschutz.de/.
13. Security and automated decisions
We use HTTPS/TLS for transmission to our website and restrict access to the people needed for each purpose. This website service does not involve decisions based solely on automated processing with legal or similarly significant effects under Art. 22 GDPR. The form provider’s technical spam protection serves to block unwanted messages.