Legal
Information on the processing of personal data pursuant to Art. 13, 14 GDPR
Last updated: June 2026
The controller responsible for the processing of your personal data within the meaning of Art. 4 (7) GDPR is:
[COMPANY LEGAL NAME]
Hermann-Löns-Str. 8
63456 Hanau, Germany
Email: privacy@vaittob2b.com
Phone: [TO FILL]
When you apply for or create an account, we collect: company name, legal form, registered address, VAT identification number, contact person name, email address, and phone number.
Legal basis: Art. 6 (1)(b) GDPR — performance of a contract or pre-contractual steps.
For wholesale and dropship orders: order details, delivery addresses (including end customer addresses for dropship), billing information, and order history.
Legal basis: Art. 6 (1)(b) GDPR — performance of a contract.
Technical data collected automatically: IP address, browser type, pages visited, session duration, referring URL, and device type.
Legal basis: Art. 6 (1)(f) GDPR — legitimate interest in operating and improving the platform securely.
Messages sent through the platform messaging system, support emails, and newsletter subscriptions (where opted in).
Legal basis: Art. 6 (1)(b) GDPR (contractual communication) and Art. 6 (1)(a) GDPR (newsletter consent).
| Data Category | Retention Period | Basis |
|---|---|---|
| Account data | Duration of account + 3 years | Contractual / legitimate interest |
| Order and invoice data | 10 years | § 147 AO (German tax law) |
| Usage/log data | 90 days | Security / legitimate interest |
| Newsletter consent | Until unsubscribe + 3 years | § 7 UWG / GDPR |
| Support communications | 3 years from last contact | Limitation periods |
We use the following service providers who process data on our behalf under Data Processing Agreements (Art. 28 GDPR):
| Provider | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, file storage | USA (SCCs in place) |
| [Hosting Provider — TO FILL] | Web hosting and CDN | [Location — TO FILL] |
| [Payment Provider — TO FILL] | Payment processing | [Location — TO FILL] |
Where data is transferred to third countries (e.g. USA), transfer is based on Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR.
Under the GDPR you have the following rights regarding your personal data:
Right of access (Art. 15 GDPR)
You may request confirmation of whether we process your data and obtain a copy.
Right to rectification (Art. 16 GDPR)
You may request correction of inaccurate or incomplete data.
Right to erasure (Art. 17 GDPR)
You may request deletion of your data where no legal retention obligation applies.
Right to restriction (Art. 18 GDPR)
You may request that we restrict processing under certain conditions.
Right to data portability (Art. 20 GDPR)
You may request your data in a structured, machine-readable format.
Right to object (Art. 21 GDPR)
You may object to processing based on legitimate interests at any time.
Right to withdraw consent (Art. 7 GDPR)
Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
To exercise any of these rights, contact us at: privacy@vaittob2b.com
You have the right to lodge a complaint with the competent supervisory authority. The authority responsible for our registered address (Hanau, Hesse) is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI)
Postfach 3163
65021 Wiesbaden, Germany
Website: datenschutz.hessen.de
For detailed information on our use of cookies, please refer to our Cookie Policy.
We may update this Privacy Policy from time to time. The current version is always available at vaittob2b.com/privacy. Material changes will be communicated to registered users by email.