Legal

Privacy

Last updated: October 2026

Contents

Controller and contact
Overview and legal bases
Hosting, server logs and security
Cookies, consent and cookie settings
Customer account, login and guest orders
Orders, delivery, downloads and licence transfers
Payment and credit checks
Business customers and invoice purchase
Contact, forms and customer service
Emails and newsletter
Protection against abuse (reCAPTCHA)
Analytics and marketing (only with your consent)
Trusted Shops and customer reviews
Links to social networks
Transfers to third countries
Retention periods
Your rights

1. Controller and contact

The controller responsible for processing your personal data in this online shop is:

Allwarehouse24 GmbH
Papenreye 63
22453 Hamburg
Germany
Phone: +49 40 524797319 (Mon–Fri 10:00–19:00 German time)
Email: support@vollversion-software.de

If you have questions about data protection, contact us using these details. We have not appointed a data protection officer because we are not legally required to do so.

2. Overview and legal bases

We process personal data only where this is permitted. The main legal bases are:

Art. 6 (1) (a) GDPR (consent), e.g. for analytics and marketing, newsletter;
Art. 6 (1) (b) GDPR (contract and pre-contractual measures), e.g. orders, delivery, customer account, enquiries;
Art. 6 (1) (c) GDPR (legal obligations), e.g. retention under tax and commercial law, handling a withdrawal;
Art. 6 (1) (f) GDPR (legitimate interests), e.g. secure operation of the shop, protection against abuse, enforcement of claims.

We store or read information on your device (e.g. cookies) under § 25 (1) TDDDG only with your consent, unless it is strictly necessary for the service you have requested (§ 25 (2) no. 2 TDDDG).

We need the details we mark as mandatory in the order process for the contract; without them, we cannot process your order. We do not make decisions based solely on automated processing within the meaning of Art. 22 GDPR; for credit checks by payment providers, see section 7.

3. Hosting, server logs and security

Our shop is hosted by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, in a data centre in Germany. We have a data processing agreement with AWS (Art. 28 GDPR). Access by the US parent company cannot be ruled out (see section 15).

Until the changeover in October 2026, our shop was hosted by Shopify (Shopify International Limited, Dublin, Ireland). We transferred customer accounts and orders from there to the new shop (Art. 6 (1) (b) and (f) GDPR). We will delete the Shopify account once the changeover is complete.

Each time you visit, our servers automatically store access data: IP address, date and time, page requested, amount of data transferred, browser and operating system, and the page you visited before. We use this data to keep the shop secure and stable and protect it against attacks (Art. 6 (1) (f) GDPR). The connection to the shop is encrypted with TLS.

Audience measurement without cookies: We measure how our shop is used with our own statistics on our own servers. The data recorded includes pages viewed, the page you visited before, details of your browser, operating system and device, and shop events such as basket, search and purchase (for a purchase, only the order value, the number of items and whether you have ordered from us before). No cookies are set and nothing is stored on your device. Your IP address is processed only briefly, to form a hash value together with details of your browser and a random value that changes every month, and to determine country, region and city; it is not stored in the statistics. We do not share the data. The legal basis is our legitimate interest in a data-minimising analysis of our offering (Art. 6 (1) (f) GDPR).

4. Cookies, consent and cookie settings

We set technically necessary cookies so that the shop works, for example for the basket, login and your cookie choices (§ 25 (2) no. 2 TDDDG, Art. 6 (1) (b) and (f) GDPR).

We set all other cookies and similar technologies only with your consent. We manage your choices with Usercentrics (Usercentrics GmbH, Munich). So that we can prove your consent, we store your choices, a consent ID, the date and time, and browser information (Art. 6 (1) (c) GDPR).

Withdrawal: You can change or withdraw your consent at any time by using the fingerprint icon at the bottom left or emailing us, with any change or withdrawal applying from that point onwards.

If you decline analytics and marketing, Google services receive only cookieless signals without identifiers (e.g. that a page view took place), which are not linked to any user (advanced consent mode).

5. Customer account, login and guest orders

For a customer account, we store your title, name, email address, addresses, the company name and VAT identification number for businesses, and your orders (Art. 6 (1) (b) GDPR). In your account you will find orders, invoices, product keys and downloads.

You log in with a code that we send you by email. If you wish, you can also secure your login with an authenticator app. For this we process your email address, the code and details of the login attempt such as time and browser (Art. 6 (1) (b) and (f) GDPR).

Stay logged in: If you tick “Stay logged in for 30 days”, you stay logged in on your device for 30 days, even after closing the browser. For this we store the technically necessary cookie “__Host-remember-login” with a random key on your device and a verification value for it in your customer account. The cookie contains no personal data and is not passed to third parties. It is valid for 30 days from the login with the code; after that, you log in again once with a code. After every automatic login, we set the auxiliary cookie “remember-login-bounce” for 15 seconds (§ 25 (2) no. 2 TDDDG, Art. 6 (1) (b) GDPR). We delete the cookie and the verification value after these 30 days, or earlier if you log out, choose “Log out on all devices” in your account, or delete your account.

You can also order without a customer account and add your previous guest orders to a customer account later using a code sent by email.

We delete your customer account on request; just send us a message. We restrict the processing of data that we must keep for legal reasons until the retention periods have expired.

6. Orders, delivery, downloads and licence transfers

To process an order, we process your order, address, contact and payment data (Art. 6 (1) (b) GDPR).

Digital delivery: We send product keys and download links by email and make them available in your customer account.
Licence transfers (e.g. client access licences): For the transfer document, we process your name, company, address, order number and the licences transferred. Service providers in the EU, working on our behalf, support us with this.
Physical media (USB stick, DVD): For packing and dispatch, we pass your name, the company if applicable, the delivery address, your email address, and the product and quantity to our shipping service provider. Deutsche Post receives your name and delivery address.

7. Payment and credit checks

We process online payments through Stripe Payments Europe, Ltd., Dublin, Ireland. Stripe processes the data needed for the payment (name, email address, billing address, amount, payment details) and checks payments for fraud (Art. 6 (1) (b) and (f) GDPR). The Stripe app that connects our shop to Stripe receives the full order data for payments, refunds and cancellations (details as in section 13). Depending on the payment method, the relevant provider also receives the data it needs and acts as an independent controller for it, e.g. PayPal, Klarna, Billie (invoice purchase for businesses), Apple Pay, Google Pay or Amazon Pay.

Credit check: If you choose Klarna or Billie, the provider checks your identity and creditworthiness and decides whether you can use that payment method. The provider's privacy notice applies and is shown during the payment process.

For bank transfer (prepayment), our bank processes your transfer details.

8. Business customers and invoice purchase

For the business customer programme, we process the details in your application (company, legal form, address, contact person, contact details, VAT identification number, industry) and the supporting document you upload, such as a trade licence or commercial register extract (Art. 6 (1) (b) GDPR). We delete the supporting document 30 days after we decide on the application.

At the Business Pro tier and above, we approve invoice orders automatically if they meet the requirements for your invoice limit, outstanding invoices and order quantity. A member of staff reviews all other invoice orders; there is no rejection based solely on automated processing (Art. 6 (1) (b) and (f) GDPR). To determine your account tier, we use the value of your paid purchases over the last 365 days.

9. Contact, forms and customer service

If you contact us by email, phone or through a form (contact, complaint, quote request, withdrawal, business customer application), we process your details to deal with your request (Art. 6 (1) (b) GDPR; for a withdrawal, Art. 6 (1) (c) GDPR). In the complaint form, you can upload a screenshot of the error message; please redact any data we do not need.

10. Emails and newsletter

We send order, delivery and service emails through our hosting provider (section 3). We keep copies of these emails for 90 days to trace delivery problems and answer your queries (Art. 6 (1) (b) and (f) GDPR).

Newsletter: With your consent (Art. 6 (1) (a) GDPR), we send you offers and news about software. You confirm your subscription through a link in an email (double opt-in); we store the time as proof. You can unsubscribe at any time using the link in every email or by sending us a message.

Klaviyo: We send newsletters and promotional emails with Klaviyo (Klaviyo, Inc., Boston, USA), which works on our behalf. Klaviyo receives your email address, your name and your newsletter status. For every order, even without a subscription, Klaviyo also receives the products purchased, the amount and the date (Art. 6 (1) (f) GDPR). You receive promotional emails only if you have subscribed.

11. Protection against abuse (reCAPTCHA)

We protect our forms against spam and automated attacks with Google reCAPTCHA v3 (Google Ireland Ltd., Dublin, Ireland). reCAPTCHA is loaded only when you use a form. It uses your IP address, browser information and interactions to check whether the entry comes from a human (Art. 6 (1) (f) GDPR; § 25 (2) no. 2 TDDDG). If a form does not work because of this, you can reach us by email or phone.

12. Analytics and marketing (only with your consent)

We use the following services only if you have given consent in the cookie banner (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). We manage them through Google Tag Manager (Google Ireland Ltd.) and a service from Stape (Stape Inc., USA), which runs for us in Germany as a processor. Access from the USA cannot be ruled out (see section 15). Stape passes data only to the services you have consented to.

Google Analytics 4 (Google Ireland Ltd.): audience measurement and analysis of shopping behaviour, e.g. pages viewed, products viewed, basket contents and purchases. Cookies: “_ga”, “_ga_RQ6609FY29”, “FPID”, “FPLC” and “FPGSID”.
Google Ads (Google Ireland Ltd.): measuring advertising effectiveness and remarketing. When you make a purchase, we also send your email address, phone number (if available), name and address so that Google can attribute the purchase to an ad (enhanced conversions); according to Google, it converts this data into hash values before storing it. Cookies: “FPAU”, after a click on an ad “FPGCLAW”, and “IDE” from doubleclick.net.
Microsoft Advertising (Microsoft Ireland Operations Ltd., Dublin): measuring advertising effectiveness and remarketing through the UET tag and server-side tracking. When you make a purchase, we send your email address and, if available, phone number only as hash values (enhanced conversions). Cookies: “_uetsid”, “_uetvid” and “uet_vid”, after a click on an ad “_uetmsclkid” and “uet_msclkid”, and “MUID”, “MR” and “SRM_B” from bing.com.
Microsoft Clarity (Microsoft Ireland Operations Ltd.): heatmaps and session recordings based on mouse movements, clicks and scrolling, to improve usability. Text and user input are not recorded. Cookies: “_clck” and “_clsk”, and “CLID”, “MUID”, “MR”, “SM” and “ANONCHK” from clarity.ms.
ThoughtMetric (ThoughtMetric Inc., Boston, USA): analysis of which marketing channels lead to purchases. When you make a purchase, we send your customer number and email address for this purpose. The basis for the transfer to the USA is the European Commission's standard contractual clauses. Cookie: “__thoughtmetric_uid”.
Klaviyo (Klaviyo, Inc., Boston, USA): records which products you view and add to your basket so that we can tailor our emails accordingly. Cookies: “__kla_id” and “od-klaviyo-track-allow”.
Webgains (Webgains GmbH, Nuremberg): affiliate network. If you come to us through a partner, the click is stored for up to 60 days so that the partner receives a commission when you make a purchase.

13. Trusted Shops and customer reviews

We use the Trustbadge of Trusted Shops SE, Cologne. It shows our trustmark and our reviews and offers buyer protection. When it loads, Trusted Shops processes your IP address and access data (Art. 6 (1) (f) GDPR). After an order and each time its status changes, we send Trusted Shops the full order data, including order number, date, status, amounts, payment and shipping method, the products purchased, your title, name, customer number and email address, billing and delivery address (for businesses, with company name and VAT identification number), your phone number if provided, and a technical access code for your order. This allows you to use buyer protection and submit a review (Art. 6 (1) (b) and (f) GDPR).

Logged-in customers can submit product reviews in our shop. We publish the name provided or an abbreviated version of it, the review and the date.

14. Links to social networks

Our pages contain simple links to our profiles on Instagram, YouTube, X, Pinterest, Threads and Trustpilot. No plugins are loaded; data is transferred only when you click a link and open the network's page.

15. Transfers to third countries

Some service providers are based in the USA or access data from there (e.g. Google, Microsoft, Amazon, Stripe, Stape, Klaviyo and ThoughtMetric). We base the transfer on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the EU Commission's standard contractual clauses (Art. 46 (2) (c) GDPR).

16. Retention periods

Order and invoice data: 8 years for supporting accounting documents and invoices, 6 years for commercial correspondence (§ 147 AO, § 257 HGB), in each case from the end of the calendar year.
Customer account: until deletion; after that, as for order data.
“Stay logged in” cookie: 30 days from the login with the code.
Supporting evidence submitted with business customer applications: 30 days after our decision.
Shipping data held by the shipping service provider: 90 days.
Enquiries and tickets: 2 years after closure, unless a retention obligation applies.
Copies of emails sent: 90 days.
Server and security logs: up to 90 days, unless we need them to investigate a security incident.
Google Analytics: 14 months.
Audience statistics: 26 months.
Clarity recordings: 30 days; a sample for up to 9 months.
Consent records: for as long as consent remains valid and up to 3 years afterwards.
Newsletter: until you unsubscribe; proof of consent for up to 3 years afterwards.

17. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7 (3)).

Right to object (Art. 21 GDPR): If we process your data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims. You can object to processing for direct marketing purposes at any time without giving reasons.

You can lodge a complaint with a data protection supervisory authority, in particular the authority responsible for us: The Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Straße 22, 20459 Hamburg.