1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
52commerce (brand Blue Carbon®)
Keurenplein 49
1069 CD Amsterdam
The Netherlands
E-mail: info@bluecarbonbarber.com
A data protection officer is not legally required and has not been appointed. For any question about data protection, write to the e-mail address above.
2. Hosting and server logs
This website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Pages). When you open a page, Cloudflare processes technically necessary data: IP address, date and time of the request, the page requested, the amount of data transferred, browser type and operating system, and the referring page.
This data is needed to deliver the website, to fend off attacks and to detect faults. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and stable operation). Cloudflare keeps log data only briefly and does not combine it with other data. Cloudflare is certified under the EU-US Data Privacy Framework; the EU standard contractual clauses apply in addition. More information: cloudflare.com/privacypolicy.
3. Analytics without cookies
We use Cloudflare Web Analytics to see how many visitors open which pages, for example how often the QR code on our packaging is scanned. Cloudflare Web Analytics sets no cookies, builds no user profiles and uses no fingerprinting. The statistics are aggregated and cannot be traced back to an individual. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in understanding how the website is used).
This website sets no cookies of its own and uses no advertising trackers, no Google Analytics and no social media plugins. There are no contact forms, no user accounts and no newsletter.
4. Contact by e-mail
If you write to us by e-mail, we store your details (e-mail address, name, content of the message) in order to answer your request. The legal basis is Art. 6(1)(b) GDPR where the request concerns a purchase or a complaint, otherwise Art. 6(1)(f) GDPR. We delete the message once the request has been dealt with, unless statutory retention periods require otherwise. Our e-mail runs through the European provider Migadu (Switzerland).
5. Links to Amazon
Our products are sold through Amazon. All buy buttons and product links lead to amazon.de. As soon as you click such a link you leave our website; from then on the privacy notice of Amazon Europe Core S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg, applies (amazon.de/privacy). The links carry campaign parameters (for example utm_source) that only describe where the click came from and contain no personal data. We receive no data from Amazon about who clicked or bought.
6. Our application with Login with Amazon and the Amazon APIs
52commerce operates its own software application to manage our Amazon seller accounts and our advertising campaigns. This application is connected to the Amazon Ads API and the Selling Partner API through Login with Amazon. It is used only by us, for our own accounts; there are no users outside our company.
Which data is processed
- During authorisation through Login with Amazon: the name, e-mail address and account identifiers of the authorising Amazon account, together with the access tokens issued by Amazon.
- Through the Amazon Ads API: data of our own advertising accounts, such as campaigns, bids, budgets, search terms and performance reports.
- Through the Selling Partner API: data of our own seller accounts, such as listings, inventory, orders in pseudonymised form, fees and reports. Amazon provides this data in a way that does not identify buyers to us; we do not request customer addresses or other personal buyer data.
Purpose and legal basis
The data serves solely to manage and analyse our own Amazon accounts (advertising, listings, inventory, reports). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in running our business) and, as far as the authorisation by an employee is concerned, Art. 6(1)(b) GDPR.
Sharing, storage, revocation
We do not share this data with third parties and we do not sell it. Access tokens and retrieved data are stored on our own access-protected systems in the European Union, only for as long as needed for the purpose described. An authorisation can be revoked at any time in the settings of the Amazon account under "Login with Amazon"; the stored tokens then become invalid. Amazon's own processing is governed by Amazon's privacy notice.
7. Your rights
With regard to your personal data you have the following rights towards us:
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
To exercise them, write to info@bluecarbonbarber.com. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); you may also contact the authority of your place of residence.
8. Changes
We update this policy when our website, our application or the legal situation changes. The version published here applies.