Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Next Commerce GmbH
Ahornweg 5 · 97990 Weikersheim
Email: [email protected]

2. Collection and Processing of Personal Data

We collect personal data when you voluntarily provide it to us as part of your order, when opening a customer account, when registering as a dealer or manufacturer or when registering. For dealers, this includes company and contact data, the location used for dealer selection in the checkout and the status of the Stripe account (see the section “The Dealer's Stripe Account”). The data collected can be seen in the respective input forms. We use the data you provide to perform the contract and to handle your inquiries.

3. Legal Bases for Processing

Your personal data is processed on the following legal bases:

• Art. 6(1)(a) GDPR: consent
• Art. 6(1)(b) GDPR: performance of a contract
• Art. 6(1)(f) GDPR: legitimate interest

4. Disclosure of Data

As a rule, your personal data is not transferred to third parties unless this is necessary to perform the contract or you have expressly consented.

Payment Processing via Stripe. Payments via Dealer Checkout are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland (“Stripe”). The end customer enters payment data (in particular card data) directly with Stripe; it does not reach Next Commerce. The information required for the payment is transmitted to Stripe: amount and currency, order number, name, email address, billing and delivery address of the end customer and the dealer's identifier. The legal basis is Art. 6(1)(b) GDPR. Stripe processes this data as an independent controller in accordance with the Stripe Privacy Policy. Stripe may transfer data to affiliated companies in the USA; for this, Stripe relies on the EU-US Data Privacy Framework and on the European Commission's Standard Contractual Clauses.

5. The Dealer's Stripe Account

Dealers who receive payments via Dealer Checkout open their own account with Stripe or connect an existing Stripe account to Next Commerce. Stripe collects the information required for this (company data, persons authorized to represent the company, identity document data, bank details) directly from the dealer on the basis of the contract between the dealer and Stripe and Stripe's legal obligations to verify identity. Next Commerce receives from Stripe the account identifier and status information on the account (for example whether payments and payouts are enabled and which information is still missing), so that it can show the dealer in the checkout and inform the dealer about open steps. The legal basis is Art. 6(1)(b) GDPR. On the dealer's behalf, Next Commerce reads payment and payout data from the dealer's Stripe account in order to provide statements and reports in the dealer account. If the dealer disconnects the account, this access ends.

6. Buy Now Page and Buy Now Marketplace

Through a Buy Now Page and through Buy Now Marketplace, you can buy a product directly from a dealer. The seller is always the dealer named on the page, not Next Commerce. Next Commerce provides the page, the presentation of the offer and the technical processing of the order. The use of these services is governed by the buyer terms linked on the order page.

Order and Transmission to the Dealer. For an order, we collect the information shown in the order form: first and last name, street and house number including address supplement, postal code, city and country, email address and telephone number, on request a different delivery address and, if you buy as a business, additionally the company name and the VAT identification number. In addition, there is the order data: item, quantity, price, shipping and packaging costs, tax amount, currency, order number and time. The legal basis is Art. 6(1)(b) GDPR.

We transmit this data to the dealer who fulfills the order. The dealer is an independent controller for the processing of this data for its own purposes. The dealer performs the purchase contract, ships the goods, issues the invoice, handles withdrawals and defects and is subject to its own legal obligations in doing so, in particular retention obligations under commercial and tax law. The dealer's privacy policy governs this processing; we make it available insofar as the dealer has provided it to us. If an order includes items from several dealers, each dealer receives only the data of the partial order that concerns it.

Payment. The payment service provider processes the payment via the dealer's account. Section 4 applies; you enter payment data, in particular card data, directly there and it does not reach Next Commerce. If you use a wallet payment, your device transmits the information stored in the wallet, in particular name, email address and address, to the payment service provider and to us so that the order can be fulfilled.

Messages About Your Order. We send the order confirmation and messages about the progress of the order by email. For this, we use an email delivery service provider as a processor. The legal basis is Art. 6(1)(b) GDPR.

Nearest Dealer. To mark the dealer closest to you, we derive an approximate location at city level from the technical data of your page request, which our hosting provider supplies. This information is evaluated only during the page request. We do not store it and we do not store your IP address for this purpose. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in an order of offers that is useful to you. If you enter a postal code yourself, it is stored only on your device and is not transmitted to us.

Audience Measurement. For each request of a Buy Now Page, we store an entry with the time, country code, the referring page, the step of the ordering process reached and the campaign information of the requested address. Campaign information means the parameters utm_source, utm_medium, utm_campaign, utm_content, utm_term and ref that a link or an ad carries. Whether the address contained a click identifier of an advertising network (gclid, msclkid, fbclid) or a referral code, we store only as yes or no, never its value. The entry contains no IP address and no attribute with which we could recognize you; it cannot be attributed to any person. We delete these entries after 400 days. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in measuring the use of our own pages.

Web Analytics by Vercel. On Buy Now Marketplace and the Buy Now Pages, we additionally use Vercel Web Analytics, a service of Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When a page is requested, your browser transmits to Vercel the time, the requested address, the referring page and the operating system, browser and device type with version; from the request, Vercel derives an approximate location (country, region, city). Of the requested address, we transmit only the utm campaign parameters named above; we remove all other parts beforehand, such as order or dealer identifiers. Vercel does not set cookies and stores nothing on your device. To group the page requests of a visit, Vercel creates a hash value from the incoming request, which is discarded after 24 hours; the recorded page requests are not linked to your IP address. We receive only aggregated statistics that cannot be attributed to any person. Vercel acts as our processor (Art. 28 GDPR); Section 9 applies to the transfer to the USA. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in measuring the reach of our pages and the origin of our visitors.

Storage on Your Device. If you reach a Buy Now Page via a link or an ad that we served, we store an entry in your browser's local storage to attribute this visit: the requested address, the referring page, your browser's identifier and the time. An IP address is not part of it. If you open the page directly, without such a link, nothing is stored. In Buy Now Marketplace, we additionally store in the same way your saved list, a postal code you entered, your answer to the consent request and the personalization signals described below. These entries remain on your device.

This storage and access to it take place only with your consent under § 25(1) TDDDG, which you give via the notice on your first visit; insofar as personal data is processed in the process, the legal basis is Art. 6(1)(a) GDPR. Technically necessary storage that is required to carry out an order takes place without consent under § 25(2) no. 2 TDDDG. You can withdraw your consent at any time and delete the stored entries at any time via your browser settings. A withdrawal does not affect the processing carried out up to that point.

Personalization of the Feed. In Buy Now Marketplace, your device counts which products you view and for how long and what you tap, for example save, share, offers or a quick swipe onward. From these counters, your device calculates the order of the feed. The counters do not leave your device, they are not shown to anyone and we do not build a profile of you from them. There is no rating function and there are no publicly visible signals. The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. Without this consent, you receive a fixed order by general popularity and no signals are stored.

Price Alert. If you would like to be notified when the price of a product drops, we process the email address you provide and the product for which you requested the alert. We confirm the sign-up via a link in an email to this address and send only after your confirmation. The legal basis is Art. 6(1)(a) GDPR. You can unsubscribe from the alert at any time; we then delete your address for this purpose. As proof of consent, we store the time of the sign-up and of the confirmation.

Saved List. Your saved list is stored on your device. If, at your request, you back it up by email, we process the address you provide in order to send you an access link to this list. The legal basis is Art. 6(1)(a) GDPR.

Sharing. If you share an offer, the generated link contains only the address of the product page and no information about you. The sharing itself takes place via your device and via the service you choose; the respective provider is responsible for its processing.

Recipients. In addition to the dealer who fulfills your order and is an independent controller for it, the following categories of recipients receive data: hosting providers, web analytics providers, email delivery service providers and payment service providers. Section 4 applies to the payment service provider. Insofar as these recipients act as processors for us, contracts under Art. 28 GDPR are in place. There is no disclosure for the advertising purposes of third parties.

Storage Period. Section 10 applies to the order data. We delete the audience measurement entries after 400 days. The entries on your device do not expire on their own; you can delete them via your browser settings. We store the email address for a price alert until you unsubscribe.

Transfer to Third Countries. Insofar as data is transferred to the USA during payment processing, Section 4 applies. Section 9 applies to hosting and web analytics by Vercel.

Your rights are set out in Section 11. Please direct concerns that relate to the dealer as an independent controller to the dealer; we forward any request we receive without delay and name the responsible dealer to you.

7. Cookies

Our website uses only technically necessary cookies. We do not use tracking cookies or advertising cookies without your separate consent.

8. Fonts

The fonts used on this website are stored on our own server and are delivered from there. When a page is requested, no connection is made to Google or other font providers.

9. Hosting

This website (next-commerce.io) is hosted on servers of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare may log technical access data (IP address, timestamp, requested URLs). For details, please refer to Cloudflare's privacy policy.

The portal for dealers and manufacturers (portal.next-commerce.io), Dealer Checkout, the Buy Now Pages and Buy Now Marketplace (buy-now.page) are hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. The servers on which our application runs are located in Frankfurt am Main; the pages are delivered via Vercel's worldwide server network. In doing so, Vercel processes technical access data (IP address, timestamp, requested address, browser identifier) in order to deliver the pages and to fend off attacks. Vercel acts as our processor; a contract under Art. 28 GDPR is in place. Vercel is certified under the EU-US Data Privacy Framework; in addition, the European Commission's Standard Contractual Clauses apply. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in the secure and reliable provision of our services. For details, please refer to the Vercel Privacy Policy.

10. Storage Period

Personal data is deleted as soon as it is no longer required for the purpose for which it was collected, unless statutory retention obligations prevent deletion (e.g. retention obligations under commercial and tax law of up to 10 years).

11. Your Rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)

To exercise your rights, please contact: [email protected]

You also have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority for Baden-Württemberg is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg).

12. Data Protection Contact

If you have any questions about data protection, please contact:
Next Commerce GmbH · Ahornweg 5 · 97990 Weikersheim
[email protected]