Privacy

language

Privacy Policy

Last updated: 24.09.2025

We appreciate your interest in our website. The protection of your personal data is important to us. Below we explain the type, scope, and purpose of processing personal data on our website.

1. Controller under the GDPR

HAF UG (limited liability)
c/o Ilo Business Center
Bredeneyer Straße 2b, 45133 Essen, Germany
Represented by: Olaf Fuldner, Igor Albanese, Andreas Haaken

Phone: +49 (0)201 72230
E-Mail: info@bagless.io

2. Definitions

This policy uses terms of the EU General Data Protection Regulation (GDPR), in particular "personal data", "processing", "controller", "processor", and "consent". For definitions, see Article 4 GDPR.

3. Data Protection Officer

We currently do not have a data protection officer pursuant to Article 37 GDPR, as the legal requirements are not met.

4. Purpose and Legal Basis of Processing

a) Website Provision

Purpose: Ensure functionality, stability, and security of the website.

Data: IP address, browser type, operating system, referrer URL, timestamp, status code.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

Storage: Typically 7 days, unless longer storage is necessary for security incidents.

b) Contact

Purpose: Respond to inquiries via e-mail or contact form.

Legal basis: Art. 6(1)(b) GDPR (contractual measures) and Art. 6(1)(a) GDPR (consent).

Storage: Until the inquiry is fully processed, unless legal retention obligations exist.

c) Contract Execution

Purpose: Fulfillment of contracts, invoicing, customer service.

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (legal obligations).

Storage: According to statutory retention periods (6–10 years).

d) Analysis, Optimization, and Marketing

Processing in this category occurs only based on your consent via our cookie consent tool (Art. 6(1)(a) GDPR).

Matomo (self-hosted, EU server): Traffic analysis with pseudonymized data (truncated IP). Opt-out via the consent tool. More info: https://matomo.org/matomo-cloud-privacy-policy/
Amplitude (Amplitude Inc., USA): Product and UX analytics. Data transfer to the USA under Standard Contractual Clauses (SCCs). More info: https://amplitude.com/privacy
HubSpot (HubSpot Inc., USA & HubSpot Ireland Limited): Marketing automation, CRM, email. Transfers under SCCs and the EU-U.S. Data Privacy Framework. More info: https://legal.hubspot.com/de/privacy-policy
Tidio (Tidio LLC, USA & EU): Live chat and customer communication. Data: chat content, IP, browser data. Transfers under SCCs. More info: https://www.tidio.com/privacy-policy/
Gravitrec (Gravitrec GmbH, Germany): Tracking and conversion optimization. Pseudonymized usage data. More info: https://www.gravitrec.com/de/datenschutz
Usetiful (Bytecraft s.r.o., Slovakia – EU): Onboarding and product tours. Data: interaction and browser data. More info: https://usetiful.com/privacy

5. Recipients of Data

Internal: Employees of HAF UG involved in data processing.
External: Hosting and IT service providers and the tool providers listed above (with Data Processing Agreements).
Authorities: Only as required by law.

6. Transfer to Third Countries

If providers are located outside the EU/EEA (e.g., Amplitude, HubSpot, Tidio), transfers occur only with appropriate safeguards pursuant to Art. 44 ff. GDPR (SCCs, Data Privacy Framework, or your explicit consent).

7. Data Retention

We store personal data only as long as necessary for the respective purpose or as legally required. Thereafter, data is deleted or anonymized.

8. Rights of Data Subjects

Access (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection (Art. 21 GDPR)

To exercise your rights, contact us at info@bagless.io.

9. Withdrawal of Consent

You may withdraw your consent at any time with effect for the future (Art. 7(3) GDPR).

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, especially the one responsible for us:

North Rhine-Westphalia Data Protection Authority
Kavalleriestraße 2, 40213 Düsseldorf
E-Mail: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de

11. Cookies and Consent Management

We use a cookie consent tool to manage and document your consents.

Technically necessary cookies: Required for website operation (Art. 6(1)(f) GDPR).
Optional cookies (analytics/marketing): Only with your consent (Art. 6(1)(a) GDPR).

12. Data Security

We implement appropriate technical and organizational measures (TOMs) to protect your data against loss, manipulation, and unauthorized access. We use TLS/SSL during transmission.

13. Changes

We reserve the right to update this privacy policy to comply with legal requirements or to reflect changes in our services.