Privacy Policy
1. Controller
mamasys GmbH, Schwarzer Weg 16, 41564 Kaarst
Phone: 02131 7909-20, Email: info@mamasys.com
Represented by the managing director: Udo Päffgen
2. Data Protection Officer
Our data protection officer can be reached at the following email address: datenschutz@mamasys.com
3. General information
We process your data exclusively on the basis of statutory provisions. In this privacy notice we inform you about the most important aspects of data processing in connection with this website.
4. What data we process
For the purpose of performing the contract, we store the data you provide to us:
- name and address
- email address and phone number
- the domain purchased and the purchase price
- for price offers, the amount bid
This data is required to perform the contract or to carry out pre-contractual measures (Art. 6(1)(b) GDPR). Without it we cannot enter into a contract with you.
When you access the pages, our hosting provider processes technically necessary access data (IP address, time, resource accessed, browser type) on the basis of our legitimate interest in secure operation (Art. 6(1)(f) GDPR).
Data is transmitted only for accounting-relevant transactions to our tax advisor and to the tax authorities.
5. Retention period
After the contract has been fully performed, the data is first stored for the duration of the warranty period, and thereafter in accordance with statutory retention periods, in particular under tax and commercial law, and is deleted once those periods expire, unless you have consented to further processing. Deletion after the retention period expires follows the principle of proportionality.
6. Cookies
This website uses only technically necessary cookies:
- a cookie that keeps your shopping cart across multiple page views
- a cookie that remembers your chosen language
- during sign-in and for signed-in users, technical cookies (including a session cookie)
No cookies are set for analytics, advertising or tracking purposes. Consent is therefore not required, so no cookie banner is shown.
7. Cookie-free reach measurement
To see how often a domain page is visited, we count page views without cookies and without recognising you across sites. No cookies are set and nothing is stored in your browser.
So that only humans and not automated requests are counted, a bot detection runs in your browser when the page loads. For this it examines technical characteristics of the browser — such as automation markers, the list of browser plugins, information about graphics output and the window size. These characteristics serve solely to tell humans from machines; they are not stored, not passed to third parties and not combined into a recognisable profile. The library used for this is served from our own server; no connection to an outside provider is made.
From your IP address, the browser identifier, the domain name visited and a random value that changes daily, we derive a non-reversible check value so that the same visit is not counted twice. The IP address is used for this calculation and briefly to limit the request rate, and is not stored. The previous day's random value is deleted; after that the check value can no longer be attributed.
We store only the date, the domain visited, the check value and — if present — the name of the referring website without any path. No personal reference remains.
The legal basis is our legitimate interest in assessing demand for the domains we offer (Art. 6(1)(f) GDPR).
8. Payment processing (Stripe)
Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. During checkout, the payment data you enter is transmitted directly to Stripe; we ourselves do not receive or store complete card data. The legal basis is Art. 6(1)(b) GDPR. Details: stripe.com/privacy
9. Email delivery (Mailgun) and sign-in (Keycloak)
For sending order, offer and transfer emails, as well as the email you request under "Save package by email", we use Mailgun Technologies, Inc. (Sinch). This involves processing your email address and the content of the message.
We send the saved-package email only if you voluntarily provide your email address for it before any order has been placed; the legal basis for this is Art. 6(1)(b) GDPR (a pre-contractual measure taken at your request). For the order, offer and transfer emails the legal basis is performance of the contract, also Art. 6(1)(b) GDPR.
For signing in to the customer account we run Keycloak on our own infrastructure; it processes your username, email address and sign-in times. The legal basis is Art. 6(1)(b) GDPR.
10. Transfer to a third country (USA)
Mailgun Technologies, Inc. (see section 9) is based in the USA. Sending the emails described there therefore involves transferring your email address and the content of the relevant message to a country outside the EU/EEA (Art. 44 et seq. GDPR).
Based on our current understanding, this transfer relies on the European Commission's standard contractual clauses or on the provider's certification under the EU-US Data Privacy Framework; which safeguard applies in a given case depends on the data processing agreement concluded with Mailgun.
11. Your rights
Where the legal requirements are met, you have the following rights under Art. 15 to 20 GDPR:
- access to the data processed
- rectification of inaccurate data
- erasure
- restriction of processing
- data portability
Under Art. 21(1) GDPR you have the right to object to processing based on Art. 6(1)(f) GDPR, as well as to processing for the purposes of direct marketing.
Under Art. 77 GDPR you have the right to lodge a complaint with the supervisory authority. The competent authority is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Postfach 20 04 44, 40102 Düsseldorf, Phone 0211/38424-0, poststelle@ldi.nrw.de
We reserve the right to amend this notice from time to time in order to reflect changes in the law, in our data processing, or in the services we use.