Legal
Information on the processing of personal data pursuant to Art. 13, 14 GDPR
Last updated: August 2026
The controller responsible for the processing of your personal data within the meaning of Art. 4 (7) GDPR is:
VAITTO GROUP
Hermann-Löns-Str. 8
63456 Hanau, Germany
Email: contact@vaitto.com
When you apply for or create an account, we collect: company name, legal form, registered address, VAT identification number, contact person name, email address, and phone number.
Legal basis: Art. 6 (1)(b) GDPR — performance of a contract or pre-contractual steps.
For wholesale and dropship orders: order details, delivery addresses, including addresses of third-party recipients nominated by the Retailer, billing information, and order history.
Legal basis: Art. 6 (1)(b) GDPR — performance of a contract.
Technical data collected automatically: IP address, browser type, pages visited, session duration, referring URL, and device type.
Legal basis: Art. 6 (1)(f) GDPR — legitimate interest in operating and improving the platform securely.
Messages sent through the platform messaging system, support emails, and newsletter subscriptions (where opted in).
Legal basis: Art. 6 (1)(b) GDPR (contractual communication) and Art. 6 (1)(a) GDPR (newsletter consent).
Where a Retailer specifies a delivery address belonging to a third party — for example its own customer or a freight forwarder — VAITTO processes the recipient's name, address and contact details solely on the documented instructions of the Retailer, for the purpose of despatching the consignment and, where required, completing customs formalities. In respect of that data the Retailer acts as controller and VAITTO acts as processor within the meaning of Art. 4 (8) GDPR. The data processing terms set out in the Terms & Conditions apply.
The Retailer warrants that it has a lawful basis for disclosing that data to VAITTO and that it has informed the recipient that their name and address will be passed to a third party in the European Union for the purpose of despatch and customs declaration, and that they may be liable for import duties and taxes.
Recipient data is retained for the period necessary to complete the order and to satisfy customs and tax record-keeping obligations, and is not used for any other purpose, in particular not for marketing.
| Data Category | Retention Period | Basis |
|---|---|---|
| Account data | Duration of account + 3 years | Contractual / legitimate interest |
| Order and invoice data | 10 years | § 147 AO (German tax law) |
| Usage/log data | 90 days | Security / legitimate interest |
| Newsletter consent | Until unsubscribe + 3 years | § 7 UWG / GDPR |
| Support communications | 3 years from last contact | Limitation periods |
We use the following service providers who process data on our behalf under Data Processing Agreements (Art. 28 GDPR):
| Provider | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, file storage | USA (SCCs in place) |
| Lovable (hosting and CDN) | Web hosting and content delivery | EU / USA (SCCs in place) |
| Stripe Payments Europe Ltd. | Payment processing | Ireland / EU |
| Resend (Plus Five Five, Inc.) | Transactional email delivery | USA (SCCs in place) |
Where data is transferred to third countries (e.g. USA), transfer is based on Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR.
Where personal data is transferred to a country outside the European Economic Area, the transfer takes place on the basis of an adequacy decision of the European Commission or, where no such decision exists, on the basis of Standard Contractual Clauses pursuant to Art. 46 GDPR.
Transfers to Japan. The European Commission adopted an adequacy decision in respect of Japan on 23 January 2019. Personal data transferred to business partners in Japan in connection with the supply of goods therefore benefits from an adequate level of protection and no additional transfer mechanism is required.
Japanese data protection law. Where VAITTO processes the personal data of individuals in Japan in connection with the supply of goods to Japan, it does so in accordance with the Act on the Protection of Personal Information (APPI). Enquiries relating to APPI may be directed to contact@vaitto.com.
Under the GDPR you have the following rights regarding your personal data:
Right of access (Art. 15 GDPR)
You may request confirmation of whether we process your data and obtain a copy.
Right to rectification (Art. 16 GDPR)
You may request correction of inaccurate or incomplete data.
Right to erasure (Art. 17 GDPR)
You may request deletion of your data where no legal retention obligation applies.
Right to restriction (Art. 18 GDPR)
You may request that we restrict processing under certain conditions.
Right to data portability (Art. 20 GDPR)
You may request your data in a structured, machine-readable format.
Right to object (Art. 21 GDPR)
You may object to processing based on legitimate interests at any time.
Right to withdraw consent (Art. 7 GDPR)
Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
To exercise any of these rights, contact us at: contact@vaitto.com
You have the right to lodge a complaint with the competent supervisory authority. The authority responsible for our registered address (Hanau, Hesse) is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI)
Postfach 3163
65021 Wiesbaden, Germany
Website: datenschutz.hessen.de
For detailed information on our use of cookies, please refer to our Cookie Policy.
We may update this Privacy Policy from time to time. The current version is always available at vaitto.com/privacy. Material changes will be communicated to registered users by email.