Privacy Policy

Controller

We have not appointed a data protection officer because there is no legal obligation to do so. We answer data protection questions at the email address above.

Name

Yavuz Selim Deveci

Trading as

Baya Software (sole proprietorship)

Address

Ruländerstraße 5, 89250 Senden, Germany

Email

info@bayasoftware.de

Phone

+49 176 34541858

Website hosting and server logs

The website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. When you open it, Netlify automatically processes the technical data your browser sends: IP address, date and time of access, the page requested, referrer URL, browser and operating system. We need this data to deliver the website securely and reliably and to detect attacks. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. Log data is kept only as long as these purposes require. We have a data processing agreement with Netlify under Art. 28 GDPR.

Cookies and local storage on the website

We do not set cookies on the website and use no analytics or marketing services. Fonts are loaded from our own server. If you switch between the light and dark theme, your choice is saved in your browser's local storage (localStorage, entry "allindash-theme"). This value never leaves your device. The legal basis is section 25(2) no. 2 TDDDG, because storing it is strictly necessary for the function you chose. You can delete the entry in your browser settings at any time.

Contact form

When you write to us through the contact form, we process your name, email address and message to answer your request. The legal basis is Art. 6(1)(b) GDPR if your request aims at a contract, otherwise our legitimate interest in answering requests under Art. 6(1)(f) GDPR. We cannot reply without these details.

The message is delivered by email to our mailbox. For sending email and for the mailbox we use Google Workspace from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, under a data processing agreement. A transfer to Google LLC in the USA cannot be ruled out. We delete requests once they are settled and no statutory retention period applies.

Cloudflare Turnstile

To protect the contact form against spam and automated requests we use Cloudflare Turnstile from Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile loads once you reach the contact form. Cloudflare processes technical signals such as your IP address, your browser's user agent and a TLS fingerprint to tell people from bots, and may read information from your device for this purpose. The legal basis is our legitimate interest in preventing abuse under Art. 6(1)(f) GDPR. Access to your device is strictly necessary under section 25(2) no. 2 TDDDG to provide the form securely.

Cloudflare processes these signals as our processor and also uses them under its own responsibility to improve bot detection. Details: https://www.cloudflare.com/turnstile-privacy-policy/

AllinDash platform

The platform consists of the web interface at marketplace.allindash.com, the interface api.allindash.com and our own file storage for shipping labels, attachments and images. It is intended exclusively for businesses. To scan barcodes it can access your camera with your permission, the images are processed only in your browser.

User accounts

Accounts are created by invitation only. For each account we process name, business email address, company affiliation, login data and, where set up, passkeys and two-factor data. For every session we store the IP address and browser identifier to protect accounts against misuse. In addition we process the customer's contract and billing data. The purpose is to provide the platform and perform the contract, the legal basis is Art. 6(1)(b) and (f) GDPR.

On behalf of the merchant the platform records which user works on orders, products and requests, and evaluates response times per team member. The merchant is responsible for this evaluation.

Cookies and local storage in the platform

The platform sets only technically necessary cookies: a session cookie (7 days), short-lived cookies during sign-in with a two-factor code or passkey, cookies for language and time zone (12 months each) and a cookie for the sidebar state. In your browser's local storage we keep display settings such as theme and table layout and your recent searches. The legal basis is section 25(2) no. 2 TDDDG. We do not use analytics or advertising cookies.

Order and buyer data processed for merchants

Merchants connect their sales channels, for example Shopify, eBay or SumUp, as well as shipping and accounting services to AllinDash. In doing so we process their buyers' data: name, shipping and billing address, email address, phone number, order contents, return, refund and payment information, customs details, gift messages and order notes.

We use this data only to process orders for the merchant, create shipping labels, deliver invoices and inform buyers about their order, for example when a delivery address is wrong. If the merchant connects a mailbox (IMAP and SMTP) or eBay messages, we process the messages with their attachments, match them to orders and send replies through the merchant's mailbox. Attachments are scanned for malware automatically.

The merchant is the controller for this data. We act as processor under Art. 28 GDPR, on the basis of a data processing agreement and only on the merchant's instructions. Buyers who want access to or deletion of their data should contact the merchant. Requests that reach us are forwarded to the merchant.

Connected services

Merchants connect their accounts with sales channels, carriers and accounting software to AllinDash, partly through the merchant's own access and partly through developer access we registered with the provider. For every service we store login data and API keys encrypted, use them only for that merchant's account and never pass them on to third parties. The providers process the data under their own responsibility and privacy policies. What we exchange with each service:

Shopify

Orders, customers, products and stock, plus tracking numbers sent back to the store

eBay

Orders, listings and stock, payout overviews and messages between buyers and the merchant. We act on eBay's marketplace account deletion notifications.

SumUp

Point of sale transactions, without personal buyer data

DHL and UPS

Recipient name, delivery address, email and phone number for shipping labels and tracking

sevDesk

Contact and invoice data to create and send invoices

Email mailbox

Messages and attachments via IMAP, replies via SMTP from the merchant's mailbox

Platform hosting and service providers

The platform runs on servers of netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, in a data centre in Vienna (Austria). Encrypted backups are kept in a netcup GmbH data centre in Nuremberg. Traffic passes through the network of Cloudflare, Inc., which protects the platform against attacks and provides the encrypted connection.

To detect and fix technical errors we use Sentry from Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA, with data stored in the EU. Error reports include user ID, name and organisation. In case of an error a recording of the session may also be sent, in which texts, inputs and images are already masked in your browser. Through the error reporting function you can voluntarily send your name, email and a screenshot.

Platform emails, including system messages and messages to buyers on behalf of the merchant, are sent through ALL-INKL.COM, Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf. Product images from Shopify stores are loaded by your browser directly from Shopify's servers, so Shopify receives your IP address.

The legal basis is Art. 6(1)(b) and (f) GDPR. We have data processing agreements with all providers named here.

Retention

Session data is deleted after 7 days, requests in the inbox trash after 7 days. Order and buyer data is kept for the term of the contract with the merchant and deleted when the contract ends, unless the merchant instructs otherwise. User accounts are deleted on request, login data is removed immediately. Backups are overwritten after 30 days at the latest. Invoice and contract data is kept as long as commercial and tax law require.

Data security

We protect personal data with technical and organisational measures under Art. 32 GDPR and keep them in line with the state of the art. These include TLS encryption for all connections, encrypted storage of login data and API keys, sign-in with passkeys or two-factor codes, and regular backups. Merchants receive a detailed description of these measures with the data processing agreement.

We report security incidents that may affect merchants' data or the login data of a connected service to the affected merchants without delay and, where relevant, to the operator of that service.

Transfers to third countries

Netlify, Cloudflare, Google LLC and Functional Software (Sentry) are based in the USA. For transfers there we rely on the European Commission's adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which all four companies are certified. Shopify is based in Canada, for which an adequacy decision of the European Commission also exists. Apart from this we only disclose personal data where we are legally obliged to.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). An informal message to info@bayasoftware.de is enough.

No automated decision making, including profiling, under Art. 22 GDPR takes place.

Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.