Privacy Policy

Transfer to the licence manufacturer

Our licence keys come from the respective software manufacturers. So that a key can be issued and registered for you, we transmit the necessary details to the manufacturer of the respective product (for example Kaspersky, ESET, Bitdefender or Avast).

Transmitted: company name, name of the contact person, email address, telephone number, postal address and — where provided — the VAT identification number, together with the number and type of licences ordered.

Purpose: issuing, registering and administering your licence key with the manufacturer. Legal basis: Art. 6(1)(b) GDPR (performance of the contract of sale); procuring the licence is part of our contractual service.

The manufacturer processes this information as an independent controller for its own purposes, in particular licence administration and its own statutory obligations. We have therefore not concluded a data processing agreement with it. The manufacturer's own privacy terms apply to its processing; we will gladly name the respective manufacturer on request.

Verification of the VAT identification number (VIES)

If you provide a VAT identification number with an order, we verify its validity. The check is carried out via VIES, the system operated jointly by the Member States of the European Union for the exchange of VAT identification numbers. The query runs through the interface provided by the European Commission.

What is transmitted: the VAT identification number you provide and the country of your order. What we receive back: confirmation of whether the number is valid and, where applicable, the name and address of the business.

Purpose: to establish whether the conditions for the recipient being liable for the tax are met for a supply into another Member State of the European Union. Legal basis: Art. 6 Para. 1 lit. c GDPR in conjunction with our tax obligations (§ 14 UStG; § 18j UStG) and Art. 31 of Regulation (EU) No 904/2010 for the query itself. The result of the check, the number checked and the time of the check are stored with the order.

Customer account: creation, access and password

We only create a customer account where it is necessary for the service. This applies to hosting and services (web hosting, vServers, domains, email, IT support) and to subscriptions: you need to be able to manage these on an ongoing basis — websites, backups, schedules, contracts, renewals. For this, the account is necessary.

For a pure licence purchase we do not create an account. You receive your licence keys directly with the order confirmation by email. An account would not be necessary for a one-off purchase, and we therefore do not require one. You may create an account afterwards on a voluntary basis if you prefer to manage your orders and licences in the customer area.

The legal basis for the account for hosting and subscriptions is performance of a contract under Art. 6(1)(b) GDPR: without an account we could not provide these ongoing services and you could not manage them.For a pure licence purchase we do not base an account on that provision — it would not be necessary there.

You can order from us without creating an account. Guest checkout is the standard route, and it is just as simple as ordering with an account: you provide your email address and receive everything — order confirmation, invoice and licence keys — by email. No account is needed for this, and none is created unless you want one. If you create an account voluntarily — in the checkout by ticking the box, or later via the registration page — this is based on your consent under Art. 6(1)(a) GDPR. You may withdraw it at any time by having the account deleted; your orders and invoices remain unaffected.

You set the password yourself — we do not know it. No password is assigned when the account is created that could be disclosed to you or viewed by us. Instead, immediately after your order you receive an email containing a link with which you set your own password. The link is valid for a limited time and can be used only once.

We store your password only as a hash value using a one-way function (scrypt). The stored value cannot be used to reconstruct the password. If you request an email with a link to set your password, a single-use token is additionally stored for the duration of its validity; it expires once it has been used or once it lapses. Please note that an unencrypted email is generally not protected against being read in transit — the password itself, however, is never sent by email.

Country evidence for cross-border supplies (Art. 24f VAT Implementing Regulation)

We also sell software licences and hosting packages to customers in other Member States of the European Union. For these supplies, the applicable rate of VAT and the place of taxation depend on the customer's country. We are required to be able to evidence that country to the tax authorities. The invoice address alone is not sufficient for this, because it is entered by you.

We therefore store, for each order, the country information that the payment service provider transmits to us with your payment: the issuer country of the payment card used, the card's billing address held by the payment service provider and – for payment methods without a card – the country of the bank account. We also record which of these details was used for the check and at what time it was made.

Legal basis: Art. 6 Para. 1 lit. c GDPR in conjunction with the proof requirement under Art. 24f of Regulation (EU) No 282/2011 (VAT Implementing Regulation) and our participation in the One Stop Shop procedure under § 18j of the German VAT Act (UStG).

Retention: The country evidence forms part of the invoice records and is retained for 10 years (§ 147 Para. 3 of the German Fiscal Code, AO). The records for the One Stop Shop procedure are also subject to a ten-year retention period (Art. 47i of Regulation (EU) No 904/2010). The full card number is not stored.

Your rights vis-à-vis recipients

Where statutory retention obligations exist (in particular commercial and tax law periods), we are obliged to store certain data even after the end of the business relationship. Erasure is only possible to this extent once the statutory periods have expired.