Privacy Policy

Last updated: 20 October 2026 · Version 1.0

1. Controller and contact

Controller within the meaning of the General Data Protection Regulation (GDPR) for the processing described in this policy is:

Eucashbox Logistik GmbH
Dellenfeld 25, 42653 Solingen, Germany
Telephone: +49 2173 8555339
E-mail: info@eucashbox.com
Managing Director: Ridvan Yemelek
Register court: Amtsgericht Wuppertal, HRB 31738 · VAT ID: DE320895164

Questions about data protection, and requests to exercise your rights, can be sent to info@eucashbox.com with the subject line “Data protection”. We do not employ a statutory data protection officer; the managing director is responsible for data protection matters.

2. Scope of this policy

This policy covers two things:

• This website (eucashbox.com and its subpages), including enquiries sent through the contact form, by e-mail or by telephone.
• The Eucashbox Omnichannel Fulfillment & Logistics Management Platform, the web application we provide to merchants, including data received from sales channels a merchant has connected.

Where we act as a processor for a merchant, the merchant's own privacy notice applies to the relationship with their customers, and our processing is governed by the data processing agreement concluded with that merchant. This policy describes that processing as well, so that it is transparent for everyone involved.

3. Data we process and why

3.1 Visiting this website

When you open a page, our hosting infrastructure processes the data technically required to deliver it: IP address, date and time of the request, requested page, referrer, browser type and version, operating system. These entries are used to deliver the page, to detect and remedy faults, and to defend against attacks. They are deleted after 7 days, unless a security incident requires longer storage.

3.2 Enquiries

If you contact us by e-mail, telephone or the contact form, we process the data you provide — name, company, e-mail address, telephone number, message content — in order to answer your enquiry. We do not use this data for advertising and do not add you to a newsletter without a separate, explicit consent.

3.3 Using the platform

Category	Data	Purpose
Account data	Name, business e-mail, role, tenant, login times, two-factor status	Providing access, permission management, security
Order data	Order number, date, status, marketplace, currency, amounts, item SKUs and quantities	Processing, despatch, invoicing, reconciliation
Delivery data	Recipient name, delivery address, carrier, tracking number, delivery status	Despatch, tracking, returns handling, carrier claims
Inventory and listing data	Stock levels, inbound quantities, SKU attributes, dimensions, weight	Stock synchronisation, carrier routing, mapping
Usage data	Actions in the application, exports, configuration changes, error logs	Operation, support, security, traceability
Billing data	Company, address, VAT ID, invoices, payment status	Contract performance and statutory accounting

We do not process special categories of personal data (Article 9 GDPR) and do not ask you to send any. We do not carry out profiling for advertising purposes and do not create scoring values about individuals.

4. Legal bases

• Article 6(1)(b) GDPR — performance of a contract or steps prior to entering into a contract: providing the platform, answering an enquiry you initiated, invoicing.
• Article 6(1)(c) GDPR — compliance with legal obligations: retention of invoices and accounting records, tax law.
• Article 6(1)(f) GDPR — legitimate interests: operating a secure and stable website and application, defending against attacks, asserting or defending legal claims. Our interest is the secure and economic operation of our business; we weigh it against your rights in each case.
• Article 6(1)(a) GDPR — consent, where we ask for it separately, for example before sending product information by e-mail. Consent can be withdrawn at any time with effect for the future.

5. Data from sales channels (including Amazon)

When a merchant connects a sales channel, the platform receives the data that channel makes available through its official interface. For Amazon this is the Selling Partner API, authorised by the merchant through Amazon's OAuth flow. We do not ask for, and do not receive, the merchant's Seller Central password.

For data received from Amazon, we commit to the following:

• We use the data exclusively to provide the service to the merchant who authorised the connection.
• We do not sell, rent, publish or otherwise disclose the data to third parties, except to the sub-processors listed in section 7 and only to the extent needed to operate the service.
• We do not use the data for advertising, market research, profiling, benchmarking or to train models for other customers.
• We do not combine data of different merchants and do not make one merchant's data visible to another.
• We request only the interface roles required for the functions described on our Features page.
• We do not request access to buyer personally identifiable information beyond the delivery data Amazon supplies with an order, and that data is deleted 90 days after delivery.
• When a merchant revokes the authorisation, we stop requesting data immediately and delete the stored channel data in accordance with section 9.

This corresponds to the requirements of Amazon's Data Protection Policy and Business Solutions Agreement, to the extent they apply to us as a provider of an application that uses the Selling Partner API.

6. Controller and processor roles

We are the controller for the data of our own website visitors, enquirers, contract partners and platform users. We decide why and how that data is processed, and this policy describes it.

We are a processor where we process order, delivery and returns data on behalf of a merchant in order to fulfil that merchant's orders, including when we store and handle their goods. In that case the merchant is the controller, their privacy notice applies to their customers, and we process only on their documented instructions under a data processing agreement pursuant to Article 28 GDPR.

If you are a buyer and have a question about an order, please contact the merchant you bought from. We will support the merchant in answering it, but we cannot decide about your order ourselves.

7. Recipients and sub-processors

Data is disclosed only where this is necessary for the purposes above, where you have consented, or where we are legally obliged. Recipients are:

• Hosting and infrastructure providers in Germany and the Netherlands, for operation, database and backups.
• E-mail delivery providers in the EU, for transactional messages such as order and alert notifications.
• Carriers, where a shipment requires transmission of the delivery address and the parcel data.
• Payment and invoicing providers in Germany, for billing and dunning.
• Tax advisers, auditors and lawyers, where required by law or to assert legal claims.
• Our own staff, limited by role and only where the task requires access.

All processors are bound by written agreements pursuant to Article 28 GDPR. A current list of sub-processors, including names and locations, is available on the Security and Data page and in the data processing agreement. Changes are announced at least 30 days in advance.

8. Transfers outside the EEA

Our production systems, backups and support are located within the European Union. We do not transfer personal data to countries outside the European Economic Area. Should such a transfer become necessary in an individual case, it will only take place on the basis of an adequacy decision of the European Commission or the EU Standard Contractual Clauses together with additional safeguards, and we will inform affected customers in advance.

9. Retention and deletion

Data	Retention period
Server log files for this website	7 days
Enquiries that do not lead to a contract	6 months after the last contact
Contract and billing documents	10 years after the end of the calendar year (§ 147 AO, § 257 HGB)
Order and invoice records in the platform	10 years after the end of the calendar year
Recipient name and delivery address	90 days after delivery, then deleted
Inventory, listing and report data	Current plus 24 months of history
User accounts and access logs	Duration of the contract plus 12 months
Support tickets	24 months after closure
Backups	35 days, rolling

Statutory retention obligations can require longer storage for individual documents; in that case the data is blocked for any other use. After the retention period the data is deleted or anonymised.

Deletion on termination. When the contract ends, we return the merchant's data on request in a machine-readable format (CSV) and delete it within 30 days, unless statutory retention requires continued storage. Deletion from backups follows with the next backup rotation, at the latest after 35 days. Deletion requests can be sent to info@eucashbox.com.

10. Security measures

We protect data with technical and organisational measures, in particular: TLS 1.2 or higher with HSTS for all connections; AES-256 encryption at rest; role-based access with mandatory two-factor authentication for internal staff; logging of authentication and export events; encrypted backups with tested restore; logically separated tenant environments; regular updates, vulnerability scanning and dependency review. Details are published on the Security and Data page.

If a personal data breach occurs that is likely to result in a risk to your rights, we notify the competent supervisory authority within 72 hours and inform affected parties where required. Where we act as a processor, we inform the responsible controller without undue delay.

11. Cookies and this website

This website uses no marketing, analytics or profiling cookies and embeds no advertising networks, social media plugins, external fonts or third-party tracking scripts. A session cookie is set only where it is technically required — for example to remember that the mobile navigation was opened. This storage is strictly necessary within the meaning of § 25(2) TDDDG and therefore does not require consent.

If you follow an external link, for example to a map service or a carrier's tracking page, the privacy notice of that provider applies once you leave our site.

12. Your rights

You have the following rights regarding your personal data:

• Access (Article 15 GDPR) — confirmation of whether we process your data, and a copy of it.
• Rectification (Article 16 GDPR) — correction of inaccurate or incomplete data.
• Erasure (Article 17 GDPR) — deletion, unless a legal obligation or a legitimate interest prevents it.
• Restriction (Article 18 GDPR) — limitation of processing, for example while accuracy is being verified.
• Data portability (Article 20 GDPR) — receipt of data you provided in a structured, machine-readable format.
• Objection (Article 21 GDPR) — objection to processing based on legitimate interests.
• Withdrawal of consent (Article 7(3) GDPR) — at any time, with effect for the future.
• Complaint (Article 77 GDPR) — to a supervisory authority, without prejudice to other remedies.

To exercise a right, write to info@eucashbox.com. We answer within one month; where a request is complex we extend by up to two further months and tell you why. Requests are free of charge unless they are manifestly unfounded or excessive.

The supervisory authority responsible for us is Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany. You may also complain to the authority in your own country of residence.

13. Automated decision-making

We do not use automated decision-making that produces legal effects or similarly significantly affects you within the meaning of Article 22 GDPR. Operational rules in the platform — for example stock allocation or the routing of an order to a warehouse — relate to goods and are always subject to human review on request.

14. Changes to this policy

We update this policy when the processing changes or the legal framework requires it. The version published on this page applies. If a change materially affects how data is used, we inform customers in advance by e-mail or in the application. The date at the top of this page shows when the current version took effect.

---

German version: Datenschutzerklärung · Legal notice: Impressum