Privacy Policy — AUX Fulfillment

1. Controller

The controller responsible for the processing of personal data on this platform is:

Ahsen Supply GmbH
Steinerne Furt 44, 86167 Augsburg
Germany
Email: privacy@auxfulfillment.de
Commercial Register: HRB 38440, Amtsgericht Augsburg
EUID: DED2102V.HRB38440
Tax ID (Steuernummer): 103/121/30144
VAT ID (USt-IdNr.): DE359057614

2. Data We Process

We process the following categories of personal data:

Account data: name, email, phone number, company information of subscribers (merchants).
Marketplace integration data: OAuth tokens and seller IDs for Amazon, eBay, Otto.
Order data: order details processed through connected marketplaces, including buyer name, shipping address, phone number, and order items.
Technical data: IP address, browser type, access logs, session identifiers.
Billing data: invoice address, payment method tokens (no full card numbers stored).

3. Purposes and Legal Bases

Service provision (Art. 6(1)(b) GDPR – contract): processing orders, generating shipping labels, syncing inventory.
Legal compliance (Art. 6(1)(c) GDPR): VAT invoicing, tax retention periods (10 years per AO §147), incident reporting.
Legitimate interests (Art. 6(1)(f) GDPR): fraud prevention, service security, anonymized analytics.
Consent (Art. 6(1)(a) GDPR): optional newsletter, optional analytics cookies.

4. Recipients and Sub-Processors

We share personal data with the following categories of recipients, strictly for the purpose of providing the service:

Marketplace platforms: Amazon Services Europe S.à.r.l. (Luxembourg), eBay GmbH (Germany), Otto GmbH & Co KG (Germany) — order data syncing.
Shipping carriers: DHL Paket GmbH, Hermes Germany GmbH, UPS, FedEx — buyer name, address, phone for label generation.
Infrastructure provider: Hetzner Online GmbH (Germany, EU) — server hosting and backups.
Email delivery: Mailgun (Sinch Germany GmbH, EU region) — transactional emails only.
Error monitoring: Sentry (EU region) — error logs, with PII scrubbing enabled.
Tax authorities: as required by EU VAT law.

All sub-processors are located in the EU/EEA or operate under standard contractual clauses (SCC) where applicable. We do not share Amazon data with marketing or analytics partners.

5. Data Storage Location

All personal data is processed and stored on servers physically located in Germany (Hetzner Online GmbH, Frankfurt or Nuremberg). Backups are encrypted (AES-256) and stored in a geographically separate EU location.

6. Retention Periods

Order PII (buyer name, address, phone): retained for 30 days after fulfillment is complete, then anonymized.
Tax-relevant records (invoices, transaction logs): 10 years (German tax law, AO §147).
System access logs: 90 days, then deleted.
Marketplace OAuth tokens: until the merchant disconnects the integration; refresh tokens revoked immediately upon disconnection.
Inactive accounts: deleted 24 months after last login (unless legal retention applies).

7. Security Measures

We implement appropriate technical and organizational measures (Art. 32 GDPR), including:

AES-256 encryption at rest, TLS 1.2+ in transit.
Role-based access control with multi-factor authentication (MFA).
Centralized access logging and intrusion detection.
Network segmentation (VPC), whitelisted admin IPs.
Quarterly vulnerability scans, annual penetration tests.
Personnel training and confidentiality agreements.
Incident response plan with notification to affected parties within 72 hours.

8. Your Rights (GDPR)

You have the following rights regarding your personal data:

Right of access (Art. 15)
Right to rectification (Art. 16)
Right to erasure (Art. 17)
Right to restriction of processing (Art. 18)
Right to data portability (Art. 20)
Right to object (Art. 21)
Right to withdraw consent at any time
Right to lodge a complaint with a supervisory authority (e.g., the data protection authority of your federal state in Germany).

To exercise your rights, contact us at privacy@auxfulfillment.de.

9. International Data Transfers

Personal data is processed within the EU/EEA. If any sub-processor processes data outside the EU/EEA (e.g., for incidental support), it is governed by standard contractual clauses (SCC) approved by the European Commission.

10. Changes to This Policy

We may update this policy. The current version is always available at this URL. Material changes will be communicated by email to active account holders at least 30 days in advance.

11. Contact

Data Protection Officer:
dpo@auxfulfillment.de

1. Verantwortlicher

Verantwortlich für die Verarbeitung personenbezogener Daten auf dieser Plattform ist:

Ahsen Supply GmbH
Steinerne Furt 44, 86167 Augsburg
Deutschland
E-Mail: privacy@auxfulfillment.de
Handelsregister: HRB 38440, Amtsgericht Augsburg
EUID: DED2102V.HRB38440
Steuernummer: 103/121/30144
USt-IdNr.: DE359057614

2. Verarbeitete Daten

Kontodaten: Name, E-Mail, Telefon, Firmendaten der Abonnenten (Händler).
Marketplace-Integrationsdaten: OAuth-Token und Seller-IDs für Amazon, eBay, Otto.
Bestelldaten: Käufername, Lieferadresse, Telefon, Artikel.
Technische Daten: IP-Adresse, Browser, Zugriffsprotokolle.
Abrechnungsdaten: Rechnungsadresse, Zahlungsmethoden-Token (keine vollständigen Kartennummern gespeichert).

3. Zwecke und Rechtsgrundlagen

Vertragserfüllung (Art. 6 Abs. 1 lit. b DSGVO): Bestellabwicklung, Versandetiketten, Bestandssynchronisation.
Rechtliche Verpflichtung (Art. 6 Abs. 1 lit. c DSGVO): USt-Rechnungsstellung, steuerliche Aufbewahrungsfristen (10 Jahre, AO §147), Meldepflichten.
Berechtigtes Interesse (Art. 6 Abs. 1 lit. f DSGVO): Betrugsprävention, Servicesicherheit.
Einwilligung (Art. 6 Abs. 1 lit. a DSGVO): optionaler Newsletter, optionale Analyse-Cookies.

4. Empfänger und Auftragsverarbeiter

Marktplätze: Amazon Services Europe S.à.r.l. (Luxemburg), eBay GmbH (Deutschland), Otto GmbH & Co KG (Deutschland).
Versanddienstleister: DHL Paket GmbH, Hermes Germany GmbH, UPS, FedEx.
Infrastruktur: Hetzner Online GmbH (Deutschland) — Hosting und Backups.
E-Mail-Versand: Mailgun (Sinch Germany GmbH, EU-Region) — nur transaktionale E-Mails.
Fehler-Monitoring: Sentry (EU-Region) — mit PII-Filterung.
Steuerbehörden: gemäß deutschem Steuerrecht.

Alle Auftragsverarbeiter sitzen in der EU/EWR oder verarbeiten unter Standardvertragsklauseln (SCC). Amazon-Daten werden nicht an Marketing- oder Analyse-Partner weitergegeben.

5. Speicherort

Sämtliche personenbezogene Daten werden auf Servern in Deutschland (Hetzner Online GmbH, Frankfurt oder Nürnberg) verarbeitet und gespeichert. Backups sind verschlüsselt (AES-256) und in einem geografisch getrennten EU-Standort hinterlegt.

6. Aufbewahrungsfristen

Bestell-PII: 30 Tage nach Abwicklung, danach Anonymisierung.
Steuerlich relevante Daten: 10 Jahre (AO §147).
System-Zugriffsprotokolle: 90 Tage.
Marketplace-OAuth-Token: bis zur Trennung durch den Händler.
Inaktive Konten: Löschung 24 Monate nach letztem Login.

7. Sicherheitsmaßnahmen

AES-256 Verschlüsselung at-rest, TLS 1.2+ in-transit.
Rollenbasierte Zugriffskontrolle mit MFA.
Zentralisierte Protokollierung, Intrusion Detection.
Netzwerksegmentierung (VPC), IP-Whitelisting.
Quartalsweise Schwachstellenscans, jährliche Penetrationstests.
Vorfallmanagementplan mit 72-Stunden-Meldepflicht.

8. Ihre Rechte (DSGVO)

Auskunft (Art. 15)
Berichtigung (Art. 16)
Löschung (Art. 17)
Einschränkung (Art. 18)
Datenübertragbarkeit (Art. 20)
Widerspruch (Art. 21)
Widerruf der Einwilligung
Beschwerderecht bei der Aufsichtsbehörde

Kontakt zur Ausübung Ihrer Rechte: privacy@auxfulfillment.de

9. Internationale Datenübermittlung

Verarbeitung erfolgt in der EU/EWR. Bei Drittlandübermittlungen gelten Standardvertragsklauseln (SCC).

10. Änderungen

Wesentliche Änderungen werden aktiven Konten mindestens 30 Tage im Voraus per E-Mail mitgeteilt.

11. Kontakt

Datenschutzbeauftragter:
dpo@auxfulfillment.de

1. Veri Sorumlusu

Bu platformda kişisel verilerin işlenmesinden sorumlu kişi:

Ahsen Supply GmbH
Steinerne Furt 44, 86167 Augsburg
Almanya
E-posta: privacy@auxfulfillment.de
Ticaret Sicili: HRB 38440, Amtsgericht Augsburg
EUID: DED2102V.HRB38440
Vergi No (Steuernummer): 103/121/30144
AB KDV No (USt-IdNr.): DE359057614

2. İşlenen Veriler

Hesap verileri: Aboneye (satıcı) ait ad, e-posta, telefon, şirket bilgisi.
Marketplace entegrasyon verileri: Amazon, eBay, Otto için OAuth token ve seller ID.
Sipariş verileri: alıcı adı, teslimat adresi, telefon, ürünler.
Teknik veriler: IP adresi, tarayıcı, erişim logları.
Faturalama verileri: fatura adresi, ödeme yöntemi token'ı (tam kart no saklanmaz).

3. İşleme Amaçları ve Hukuki Dayanak

Hizmet sağlama (GDPR Md. 6/1-b): sipariş işleme, kargo etiketi, stok senkron.
Yasal yükümlülük (GDPR Md. 6/1-c): KDV faturalama, 10 yıllık vergi saklama.
Meşru menfaat (GDPR Md. 6/1-f): dolandırıcılık önleme, güvenlik.
Açık rıza (GDPR Md. 6/1-a): opsiyonel bülten, analiz çerezleri.

4. Alıcılar ve Alt İşleyiciler

Marketplace'ler: Amazon, eBay GmbH, Otto GmbH.
Kargo firmaları: DHL, Hermes, UPS, FedEx.
Altyapı: Hetzner Online GmbH (Almanya).
E-posta gönderimi: Mailgun (Sinch Germany GmbH, AB bölgesi).
Hata izleme: Sentry (AB bölgesi, PII filtreli).

Tüm alt işleyiciler AB/EEA içinde veya SCC kapsamında çalışır. Amazon verisi pazarlama amaçlı paylaşılmaz.

5. Saklama Yeri

Tüm veriler Almanya (Hetzner, Frankfurt/Nürnberg) sunucularında işlenir ve saklanır. Yedekler AES-256 ile şifrelidir.

6. Saklama Süreleri

Sipariş PII: teslimattan 30 gün sonra anonimleştirilir.
Vergi kayıtları: 10 yıl.
Sistem logları: 90 gün.
OAuth token: satıcı bağlantıyı kesene dek.
Aktif olmayan hesap: son giriş + 24 ay sonra silinir.

7. Güvenlik Önlemleri

AES-256 (rest) + TLS 1.2+ (transit) şifreleme.
Rol bazlı erişim + MFA.
Merkezi log + intrusion detection.
VPC + IP whitelist.
Üç aylık zafiyet taraması, yıllık sızma testi.
72 saatlik ihlal bildirim planı.

8. Haklarınız (GDPR)

Bilgi alma, düzeltme, silme, sınırlama, taşınabilirlik, itiraz, rıza geri çekme, denetim otoritesine şikayet hakkınız vardır. Talep için: privacy@auxfulfillment.de

9. Uluslararası Veri Aktarımı

Veriler AB/EEA içinde işlenir. AB dışına aktarım yapılırsa SCC uygulanır.

10. Değişiklikler

Önemli değişiklikler aktif kullanıcılara 30 gün önceden bildirilir.

11. İletişim

Veri Koruma Sorumlusu:
dpo@auxfulfillment.de

Privacy Policy Datenschutzerklärung Gizlilik Politikası