Privacy Policy (Website)
1. Controller
Manuel Heithus
Im Mühlengarten 12a, 33428 Harsewinkel, Deutschland
Email: info@stockaro.de
2. Scope
This policy applies to your visit to the website stockaro.de. The processing of
personal data inside the Stockaro app (processing of Shopify order data on behalf of
the merchant) is covered by the separate
privacy policy of the app.
3. Website hosting
The website is served via GitHub Pages (GitHub, Inc., 88 Colin P Kelly Jr St, San Francisco,
CA 94107, USA). When you access the website, the hosting provider processes technically necessary
server log data (in particular IP address, date and time of the request, page requested, volume of
data transferred, referrer, browser type/user agent). The legal basis is Art. 6(1)(f) GDPR (secure
and stable operation of the website). The transfer to the USA is based on the EU Standard
Contractual Clauses (Art. 46(2)(c) GDPR).
Retention: This server log data arises solely at GitHub; we have no access to it and no
influence over how long or in what scope it is stored. GitHub's own data protection terms apply.
4. Contacting us via the contact form
If you use the contact form at stockaro.de/en/contact, we process the information you submit
— your name, email address and your message — solely in order to handle your enquiry. To
prevent spam and abuse, your IP address is not processed in clear text but only in pseudonymised
form as a hash generated with a secret key (technical rate limiting). The legal basis is
Art. 6(1)(b) GDPR (handling your enquiry) and Art. 6(1)(f) GDPR (secure, abuse-free operation of
this contact channel).
To be notified about your enquiry by email, we use the delivery provider Resend
(Plus Five Five, Inc., San Francisco, USA); the transfer to the USA is based on the EU Standard
Contractual Clauses (Art. 46(2)(c) GDPR). We then reply to you by email at the address you provided.
Retention: Completed enquiries are deleted no later than 90 days after they are closed.
Open enquiries are stored until they have been dealt with. If your enquiry leads to a contractual,
legal or abuse-related matter, the retention period follows that matter's own requirements.
5. Cookies, local storage and audience measurement
This website uses no tracking cookies, no remarketing and embeds no advertising networks.
No cookies are set for marketing or statistical purposes.
Two settings are stored locally in your browser so that the site remembers your choice: the
selected appearance (light/dark) and whether you have dismissed the notice banner. These
values contain no personal data, are never transmitted to us and serve only the behaviour of the
site that you requested; no consent is required for them (§ 25(2) no. 2 TDDDG). You can delete
them at any time via your browser's storage settings.
For audience measurement we use GoatCounter, open-source software that we host ourselves.
Measurement is cookieless and does not create personal profiles. For each page view we record
technical information (page requested, referrer, browser type/user agent, approximate origin at
country level, screen size). Your IP address is not stored; it is only processed transiently.
To count unique visits, a non-reversible hash value that changes daily is used. The software
runs on infrastructure operated by us at the hosting provider Railway Corp. (San Francisco,
USA); the statistical data is processed and stored on servers in the EU (Netherlands region).
Insofar as access from the USA cannot be ruled out, it takes place on the basis of the EU Standard
Contractual Clauses (Art. 46(2)(c) GDPR). The legal basis for audience measurement is
Art. 6(1)(f) GDPR (analysing and improving our website).
The measurement script additionally checks whether the identifier skipgc is present in your
browser — this lets you permanently exclude yourself from counting. Without that identifier,
nothing is stored.
Retention: The hash value used to recognise returning visits is regenerated daily and can no
longer be linked to a visit afterwards. The resulting statistics are retained indefinitely in
aggregated, non-personal form only.
6. Booking a demo appointment
To arrange demo appointments we use the appointment booking service Zeeg
(Zeeg GmbH, Friedrichstr. 155, 10117 Berlin, Germany). The "Book a demo" buttons on this website
are links to a booking page operated by Zeeg at zeeg.me — no Zeeg content is embedded into this
website. As long as you are using this website, no data is therefore transmitted to Zeeg.
Opening the booking page: If you follow the link, you leave our website. When the booking page
is opened, your IP address is transmitted to Zeeg for technical reasons. Zeeg is the independent
controller for that processing — in particular for the server and security logs of the booking
page; Zeeg's own privacy policy applies: https://zeeg.me/en/privacy-policy
Booking an appointment: If you book an appointment there, we process the details you provide —
in particular your name, email address, the chosen appointment slot and any voluntary information
about your request — in order to prepare and hold the appointment. The legal basis is
Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract), otherwise
Art. 6(1)(f) GDPR (efficient organisation of appointments). To that extent Zeeg processes this data
on our behalf as a processor under a data processing agreement pursuant to Art. 28 GDPR.
Processing takes place exclusively within the European Union; no transfer to third countries is
provided for. Zeeg engages Sendinblue GmbH (Brevo, Germany) for sending email and SMS
notifications and Telekom Deutschland GmbH (Open Telekom Cloud, server locations in Germany and
the Netherlands) for hosting as sub-processors.
Retention: We process appointment data for as long as it is needed to organise the appointment
and to deal with any request arising from it, and delete it afterwards. It is deleted at the latest
when we close our Zeeg account; Zeeg then deletes the processed data within seven days. If an
appointment becomes part of a contractual, legal or billing matter, the retention period follows
that matter's own requirements.
7. Your rights
You have the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to
restriction of processing (Art. 18) and to data portability (Art. 20 GDPR). To exercise them,
contact info@stockaro.de.
Right to object: You have the right to object at any time, on grounds relating to your
particular situation, to the processing of personal data concerning you which we base on
Art. 6(1)(f) GDPR (on this website: hosting under § 3 and audience measurement under § 5). We will
then no longer process that data unless we can demonstrate compelling legitimate grounds which
override your interests, rights and freedoms (Art. 21(1) GDPR). An informal message to
info@stockaro.de is sufficient to object.
You also have the right to lodge a complaint with the competent supervisory authority; for us this
is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
(LDI NRW).
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.
No data protection officer has been appointed, as the conditions of Art. 37 GDPR are not met;
please address data protection enquiries to the contact given above.
8. Language
This is a translation provided for your convenience. The German version of this privacy policy is
the authoritative one; in the event of any discrepancy, the German text prevails. Use the language
selector at the top of this page to switch to it.
Last updated: August 2026.