Privacy notice
This notice explains which personal data is processed when you visit this website and order a takedown against a fake shop. We set no cookies and use no advertising or tracking services.
1. Controller
The controller for this website, the order form and the performance of your order is:
Cloudkasten GmbHSeestr. 20 G
50374 Erftstadt, Germany
Represented by: Alexander Hagemann, Managing Director
Email: [email protected]
2. Hosting and visiting the website
This website is delivered as a static site through Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Pages). Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA rely on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). We have a data processing agreement with Cloudflare.
When you visit, the hosting provider processes technically necessary data sent by your browser: IP address, date and time of the request, the page requested, referrer URL, browser type and version and operating system (server log files). This is necessary to deliver the website, keep it stable and fend off attacks. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). We do not store or analyse access logs ourselves. Cloudflare processes connection data to deliver the site and fend off attacks and deletes it according to its own retention periods.
Fonts are loaded from our own server. No content from Google Fonts or other third parties is embedded.
3. No cookies, no advertising trackers
We set no cookies. The only thing stored on your device is your currency, so that prices are shown in it (local storage, no tracking). There are no advertising pixels, no social media plugins and no cross-device profiles.
4. No audience measurement
We currently use no audience measurement or web analytics services.
5. Orders through the form
The form is filled in in your browser only. Only when you click the button to continue to payment are your details transmitted, encrypted (TLS):
- the addresses of the fake shops, the affected brand, your genuine website and details of your registered trade mark, if given,
- your answers to the questions about your situation, your notes and the name of the shop operator, if given,
- the uploaded files,
- your company, your name, your email address and optionally your phone number,
- the currency and the price shown to you, the address of the page you sent the form from including any campaign parameters (utm parameters), and technical data of the transmission such as IP address and time.
The details pass through a function on Cloudflare’s infrastructure (section 2) to our order system (section 8); they are not stored at Cloudflare. Your IP address is passed on to fend off too many orders in a short time.
Purposes and legal bases: we process your details to check your order, handle the payment, send you the order confirmation and carry out the order (Art. 6(1)(b) GDPR). We process technical data of the transmission to prevent abuse (Art. 6(1)(f) GDPR). Providing your data is voluntary; without the fields marked as required, however, we cannot process your order.
6. Payment through Stripe
After you send the form, you are taken to Stripe. We process payments through Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe receives your order number, the number of shops, the currency, your email address and what you enter on the payment page (company, billing address, VAT number if any, payment details). Stripe creates the invoice and calculates any VAT. The legal basis is the performance of the order (Art. 6(1)(b) GDPR) and our legal obligation to issue invoices (Art. 6(1)(c) GDPR). Stripe may transfer data to the USA; Stripe, Inc. is certified under the EU-US Data Privacy Framework. To prevent fraud, Stripe also processes payment data as a controller in its own right (stripe.com/privacy).
7. Takedown procedure against fake shops
Evidence capture and analysis: the shops you name and their imprints are fetched automatically as soon as your order arrives and stored as evidence (screenshot, source code, time of capture and hash value). We also query publicly available infrastructure data, such as DNS records and domain registration data (RDAP), to identify the host, registrar, CDN and the age of the domain. Evidence capture, monitoring and order records run on our servers at Microsoft Azure (Microsoft Ireland Operations Ltd. as processor) in the Germany West Central region in Frankfurt am Main.
Monitoring and search: while the order runs, we fetch the reported shops regularly to check whether they are still reachable. We also search publicly available sources for further shops using your brand, such as new domains with your brand name. This data may include personal data of the operators or of third parties, for example when a fake shop uses another company’s imprint. The legal basis is our clients’ legitimate interest in enforcing their rights and our interest in carrying out the order (Art. 6(1)(f) GDPR).
Notices: we send notices to registrars, hosts, CDNs and Google (Safe Browsing) on your behalf, by email or through the recipients’ report forms. The notices name your company as the owner of the brand, because recipients require this to process a notice, and may contain the details of your brand. The legal basis is the performance of the order (Art. 6(1)(b) GDPR). The recipients process these details as controllers in their own right. Some recipients are based outside the EU, such as Google in the USA or registrars and hosts in third countries. Where there is no adequacy decision for the country concerned, the transfer takes place because it is necessary to establish and exercise your legal claims (Art. 49(1)(e) GDPR).
Sending emails: we send notices, reminders and the weekly status reports through Twilio SendGrid (Twilio Inc., San Francisco, USA) as our processor. Twilio is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); we have a data processing agreement with Twilio.
8. Order system and storage
Orders, uploaded files, evidence, notices and reports are stored in our own order system. Only the people at Cloudkasten GmbH working on your order have access.
9. Contact by email
If you contact us directly by email, we process your details to answer your request (Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR).
10. How long we keep data
If no order is concluded, we delete your details, your documents and the evidence captured on receipt at the latest 6 months after our last message to you. After an order is completed, we keep the order records with evidence, notices and reports for three years, so that you and we can prove the course of events later. Invoices, order confirmations and business letters are kept for the statutory retention periods (§ 257 German Commercial Code, § 147 German Fiscal Code).
11. Recipients
Your data is received only by the people at Cloudkasten GmbH working on your order, Stripe (section 6), the recipients of notices named in section 7 and the service providers named in sections 2 and 7. We pass data to courts or authorities only if we are legally obliged to or you ask us to.
12. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). Where data is processed on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (ldi.nrw.de).
The German version of this notice is the legally binding one.