Digistore24 Privacy Policy

Last updated: 4 November 2025

Statement on the handling of personal data

1 – Name and address of the controller
2 – Name and address of the data protection officer
3 – General information on data processing
4 – Provision of website and creation of log files
5 – Use of cookies
6 – Newsletter
7 – Registration
8 – Contact form and email contact
9 – Rights of the data subject
10 – Privacy policy Google Analytics
11 – Hotjar
12 – Order form
13 – Credit check
14 – Sample texts for vendors & affiliates
15 – Blog

1 - Name and address of the controller

The controller within the meaning of the UK General Data Protection Regulation (UK GDPR) as well as other data protection legislation is:

Digistore24 Ltd (company number 12063218) of 15 Cambridge Court, 210 Shepherds Bush Road, London W6 7NJ Email: datenschutz@digistore24.com

2 - Name and address of the data protection officer

MFG Services Ltd (company number 03049282) of 15 Cambridge Court, 210 Shepherds Bush Road, London W6 7N

Email: mfg@mfglon.co.uk

3 – General information on data processing

1 – Scope of personal data processing

We only collect and use the personal data of our users insofar as this is necessary to provide a functional website as well as our contents and services. The collection and use of the personal data of our users regularly takes place only with the consent of the user. This is subject to an exception where prior consent cannot be obtained for practical reasons and/or the processing of the data is otherwise permitted by law.

2 – Legal basis for the processing of personal data

Article 6 (1)(a) of the UK GDPR serves as the legal basis where we obtain your consent or the processing of personal data.

Article 6(1)(b) of the UK GDPR serves as the legal basis for the processing of personal data required for the performance of a contract to which you are a party. This includes (without limitation) processing operations that are necessary to carry out pre-contractual measures.

Article 6(1)(c) of the UK GDPR serves as the legal basis insofar as the processing of personal data is necessary for compliance with a legal obligation to which we are subject.

Article 6(1)(f) serves as the legal basis insofar as it is necessary to protect a legitimate interest of our company or a third party, and your interests, fundamental rights and freedoms do not override the former interest

3 – Data erasure and storage period

Personal data shall be retained only for as long as it is required to fulfil the purpose for which it was collected or until exercise a right of objection to further processing.

4 – Provision of website and creation of log files

1 – Description and scope of data processing

Every time you visit our web page, our system automatically collects data and information from the computer system of the visiting computer.

The following data is collected:

Information about the browser type and version used
The operating system of the user
The internet service provider of the user
The IP address of the user
Date and time of access
Websites from which the system of the user reaches our web page
This data is not stored together with other personal data of the user.

2 – Legal basis for data processing

The legal basis for the temporary storage of data and log files is Article 6(1)(f) of the UK GDPR.

3 – Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the computer of the user. For this to happen, the IP address of the user must remain stored for the duration of the session.

The data is stored in log files to ensure the functionality of the website. In addition, the data serves to ensure the security of our information technology systems. Data processed in contemplation of this section is not processed for marketing purposes.

4 – Duration of storage

Personal data shall be retained only for as long as it is required to fulfil the purpose for which it was collected or until you object to receiving further communications; or as otherwise required or provided for by law.

Storage of data in the log files: The IP address and the HTTP user agent are stored in plain text in the web server log files for a maximum of 6 weeks to detect and analyse attacks on our website.

Storage of data in our database: An anonymous storage as hash is carried out in our database for 7 days in order to be able to assign and pay out the sales commission to our affiliates.

5 – Use of cookies

1 – Description and scope of data processing

Our website uses cookies. Cookies are text files stored in the internet browser/by the internet browser on the computer system of the user. If a user visits a website, a cookie may be stored on the operating system of the user. This cookie contains a typical character string that enables a unique identification of the browser when the website is called up again. We use cookies with two durations:

We store cookies until the end of the session to enable a login (a session). This is necessary so that our server recognizes your web browser after you have entered your login data. A session is also started during an order process so that the order can be processed correctly.
We store cookies for up to 185 days:
- for affiliate tracking (so that we can provide our service i.e. the sale of a product. This is only possible in combination with the IP address and cookie)
- the screen size (for a better display of the website)
- for certain authorizations (e.g. for the authorization to make test purchases)
- to prevent double orders (the cookie ensures that a warning message appears if you place a double order)
- for the language setting
- for the “Stay signed in” function
- Products that have been placed in the shopping cart

Cookies are necessary for the correct functioning of our website.

2 – Legal basis for data processing

The legal basis for the processing of personal data by using necessary cookies is Article 6(1)(b) and (f) of the UK GDPR.

3 – Purpose of data processing

The main service of Digistore24 is the sale of digital, physical and other similar products over the internet. To this end, the buyer is given information and guidance about the products on the websites of third parties. In order for the providers of this information to be able to maintain their service, Digistore24 often reimburses their advertising costs. This is necessary for the provision of Digistore24’s services.

The purpose of using necessary cookies is to simplify the use of websites for you. Some of the functions on our website cannot be offered without using cookies. In this regard, it is necessary that the browser is recognized even after a page change.

4 – Duration of storage, possibility of objection and disposal

Cookies are stored on the user’s computer and transmitted to our page. Therefore, you as a user also have full control over the use of cookies. You can deactivate or limit the transmission of cookies by adjusting the settings in your internet browser. Cookies that have already been stored can be erased at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to fully use all of the website functions.

6 – Marketing Communications / Newsletter

1 – Description and scope of data processing

If you have purchased our services or used our platform and have provided your email address to us in connection with your role as a vendor or affiliate, we may subsequently use this information to send marketing communications. These communications will only relate to our own similar products, initiatives, and services and our newsletter.

We do not send unsolicited marketing communications to individuals or entities with whom we have no prior or existing relationship, nor do we share contact details with third parties for their own marketing purposes without a lawful basis.

2 – Processed Personal Data

First and last name
Email address

3 – Legal basis for data processing

The purpose of processing is to inform existing or prospective vendors and affiliates about our own products, initiatives, and services that may be relevant to them and to promote our business. Within the United Kingdom, the legal basis for this processing is our legitimate interest under Article 6(1)(f) of the UK GDPR, together with the conditions set out in Regulation 22(3) of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), which permit limited direct marketing to existing customers or partners, subject to an easy opt-out option or by contacting helpdesk@digistore24.co.uk.

For recipients in the United States, processing is carried out in accordance with the CAN-SPAM Act of 2003, which permits commercial emails on an opt-out basis, provided that each message identifies the sender, includes a valid postal address, and contains a clear unsubscribe mechanism.4 - Duration of storage

4 – Categories of recipients

In connection with the sending of marketing communications and/or our newsletter, data may be shared with our marketing service providers acting as processors.

5 – Duration of Storage

Personal data shall be retained only for as long as it is required to fulfil the purpose for which it was collected or until you object to receiving further communications. Your contact details shall be stored for the duration of your vendor or affiliate relationship with us; however, you may unsubscribe from any marketing communication or newsletter at any time by contacting helpdesk@digistore24.co.uk.

6 – Transmission to third countries

No transfer of your data to third countries shall take place, unless required for communication with U.S. recipients in accordance with the CAN-SPAM Act.

7 – Possibility of objection and disposal

You may object to or unsubscribe from marketing communications or the newsletter at any time and free of charge. Each message includes an unsubscribe link, and you may also contact us directly to withdraw your consent or object to further processing at helpdesk@digistore24.co.uk. All opt-out requests are promptly recorded and honoured to ensure that no further marketing messages are sent to those addresses.

7 – Registration

1 – Description and scope of data processing

On our website we offer you the opportunity to register by providing personal data concerning you. The data is entered into an input mask and is transferred to us and then stored. The data shall not be passed on to third parties.

The following data is collected during the registration process:

The IP address of the user
Date and time of registration
First name
Last name
Address
Email address
Bank details or PayPal email address

2 – Legal basis for data processing

To the extent that registration is contemplated by a contract to which the user is a party or the implementation of pre-contractual measures, then the legal basis for the processing of this data is Article 6(1)(b) of the UK GDPR.

3 – Purpose of data processing

The user must register in order to make the following content and services available on our website: provision of the Digistore24 software and performance of the B2B contract with our business customers.

4 – Duration of storage

The data is erased as soon as it is no longer necessary to achieve the purpose for which it was collected.

Notwithstanding the conclusion of the contract, it may still be necessary to store personal data of the contractual partner in order to fulfil contractual or legal obligations.

5 - Possibility of objection and disposal

As a user you have the possibility to cancel the registration or change the data stored about you at any time. You can change the data stored about you at any time. To make a corresponding request, you can contact helpdesk@digistore24.co.uk. We will honour this request provided we are not subject to a contractual or legal obligation preventing us from doing so.

8 – Contact form and email contact

1 – Description and scope of data processing

On our website there is a contact option which refers you to our general email address. In this case, the personal data transmitted with the email shall be stored.

In this context, the data will not be passed on to any third parties.

2 – Legal basis for data processing

The legal basis for the processing of the data transmitted in the course of sending an email is point Article 6(1)(b) and (f) of the UK GDPR.

3 – Purpose of data processing

In additional to facilitating the conversation, data is processed to prevent misuse of the contact form and to ensure the security of our information technology systems.

4 – Duration of storage

The data is erased as soon as it is no longer necessary to achieve the purpose for which it was collected. Personal data collected during the sending process will be erased after a period of seven days from the end of the conversation.

5 – Possibility of objection and disposal

You have the possibility to revoke your consent to the processing of personal data at any time. If you contact us via email, you can object to the storage of personal data concerning you. In such a case, the conversation cannot be continued and all personal data stored in the course of contacting us will be erased.

9 – Rights of the data subject

If personal data relating to you is processed, you are the data subject as defined by the UK GDPR and you have the following rights vis-a-vis us as the controller:

1 – Right of access

You can ask us to confirm whether personal data concerning you will be processed by us. If such processing has happened, you can request the following information from us:

the purposes for which the personal data is processed;
the categories of personal data concerned;
the recipients or categories of recipient to whom the personal data concerning you has been or is still being disclosed;
the planned storage duration of the personal data concerning you, or, if specific information is not possible, criteria for determining the storage period;
the existence of a right to have personal data concerning you corrected or erased, a right to have processing restricted by the controller or a right to object to such processing;
the existence of the right to lodge a complaint to a supervisory authority;
any available information on the source of the data if the personal data is not collected from the data subject;
the existence of automated decision-making, including profiling referred to in Article 22 (1) and (4) the UK GDPR and, at least in these cases, meaningful information on the logic involved, as well as the significance and the envisaged consequences for the data subject.

You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organisation. In this context, you have the right to be informed of the appropriate safeguards pursuant to Article 46 of the UK GDPR relating to the transfer.

2 – Right to rectification

You have the right to rectification and/or completion of personal data concerning you if it is incorrect or incomplete. We must make the rectification without undue delay.

3 – Right to restriction of processing

Under the following conditions you may request that the processing of personal data concerning you be restricted:

if you contest the accuracy of the personal data concerning you for a period that enables us to verify the accuracy of the personal data;
the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
we no longer need the personal data for the purposes of the processing, but you do need them for the establishment, exercise or defence of legal claims, or
if you have objected to processing pursuant to Article 21 (1) UK GDPR pending the verification whether our legitimate grounds override your grounds.

If the processing of personal data concerning you has been restricted, such data shall – with the exception of storage – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

If the restriction of the processing is carried out pursuant to the conditions mentioned above, we shall inform you before the restriction is lifted.

4 – Right to erasure

Right to be forgotten

You can ask us to erase the personal data and we will erase this data without undue delay where one of the following grounds applies:

The personal data concerning you is no longer necessary in relation to the purposes for which it was collected or otherwise processed;

You withdraw your consent on which the processing in accordance Articles 6(1)(a) and Article 9 of the UK GDPR, and where there is on other legal ground for the processing.

You object to the processing pursuant to Article 21(1) of the UK GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the UK GDPR.

Personal data concerning you has been unlawfully processed.

the personal data has to be erased for compliance with a legal obligation to which we are subject;

Personal data concerning you has been collected in relation to the offer of information society services referred to in Article 8(1) of the UK GDPR.

Information to third parties

If we have made personal data concerning you public and are obligated to erase it pursuant to Article 17(1) of the UK GDPR, we shall take appropriate measures, including those of a technical nature, taking into account the available technology and implementation costs, to inform those responsible for the data processing who process the personal data that you as the data subject have requested the erasure of all links to this personal data or of copies or replications of this personal data.

Exemptions

The right to be forgotten does not exist insofar as the processing is necessary

to exercise the freedom of expression and information;
to fulfil a legal obligation required for processing under domestic law to which we are subject or to perform a task in the public interest or in the exercise of official authority conferred on us;
for reasons of public interest in the area of public health pursuant to Articles 9(2)(h) and (i) and Article 9(3) of the UK GDPR;
for archiving purposes in the public interest, scientific or historical purposes or statistical purposes in accordance with Article 89(1) of the UK GDPR insofar as the exercise of the right of erasure would likely render impossible or seriously impair the attainment of the objectives of such processing, or
for the establishment, exercise or defence of legal claims.

5 – Right to information

If you have exercised your right to rectification, erasure or restriction, we are obligated to inform all recipients to whom personal data concerning you has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or would give rise to disproportionate difficulties.

You have the right to be informed of these recipients.

6 – Right to data portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to which the personal data has been provided, where:

the processing is based on consent pursuant to Articles 6(1)(a) and (b) and 9(2) of the UK GDPR and
the processing is carried out by automated means.

In exercising this right, you shall also have the right to request that the personal data concerning you be transferred directly from one data controller to another data controller, insofar as this is technically feasible. The freedoms and rights of other persons shall not be affected by this.

7 – Right to object

You shall have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) or (f), including profiling based on these provisions.

In these circumstances no longer process personal data relating to you unless we can provide compelling grounds for processing that outweigh your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.

Where the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data will no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding the PECR, you may exercise your right to object by automated means using technical specifications.

8 – Right to revoke the data protection declaration of consent

You shall have the right to revoke your data protection declaration at any time. The revocation of consent shall not affect the lawfulness of the processing carried out on the basis of the consent until revocation.

9 – Right of appeal to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right of appeal to a supervisory authority if you believe that the processing of personal data concerning you is contrary to the UK GDPR. The supervisory authority to which the complaint has been lodged will inform you as the complainant of the status and results of the complaint, including the possibility of a judicial remedy under Article 78 UK GDPR.

The supervisory authority in the United Kingdom is:

The Information Commissioner's Office

Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

https://ico.org.uk/make-a-complaint/

10 – Google Analytics

We use Google Analytics on our website, an analysis service of the US company Google Inc. ("Google"), 1600 Amphitheatre Parkway, Mountain View, CA 94043, U.S.A. Google Analytics uses "cookies", small text files that are stored on your computer. These cookies are used to analyse your use of our website. The corresponding data about your user behaviour is forwarded to a Google server in the US where it is evaluated and stored.

If IP anonymization is activated on this website within the member states of the European Union and the Agreement on the European Economic Area, Google will shorten your IP address for the purposes of anonymization. Only in exceptional cases will there be an uncut transmission to the USA with shortening of the IP address on a server there.

Google uses this information at the initiative of the owner of this website to evaluate how you use the website. In addition, Google uses this information to produce reports on website activity and provide other services in connection with the use of the website and the internet for its operators. Google does not amalgamate the IP address transmitted by your browser through the use of Google Analytics with other Google data.

You can prevent the storage of cookies yourself by adjusting an appropriate setting in your browser. However, in this case you may not be able to fully use all the website functions. You can prevent the collection of data generated by the cookie (including your IP address) about your use of the website and the processing of this data by Google. All you need to do is to download and install an additional browser plugin. You can download this plugin using the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

11 – Hotjar

We use Hotjar to better understand the needs of our users and to optimize the offer on this website. With the help of Hotjar technology, we get a better understanding of our users' experiences (e.g. how much time users spend on which pages, which links they click on, what they like and what they do not like, etc.) and this helps us to tailor our offer to our users' feedback. Hotjar uses cookies and other technologies to collect information about the behaviour of our users and their devices (in particular the IP address of the device (collected and stored in anonymous form only), screen size, device type (unique device identifiers), information about the browser used, location (country only), language preferred for displaying our website). Hotjar stores this information in a pseudonymized user profile. Neither we nor Hotjar use this information to identify individual users and it is not amalgamated with other data about individual users. You can object to the storage of a user profile and information about your visit to our website by Hotjar and the setting of Hotjar tracking cookies on other websites by clicking on this opt-out link: https://www.hotjar.com/legal/compliance/opt-out

The Hotjar privacy policy provides information about the handling of personal data at Hotjar: https://www.hotjar.com/legal/policies/privacy

12 – Order form

The data requested on the order form will be transmitted to the product manufacturer for the performance of the contract pursuant Article 6(1)(b) of the UK GDPR. In addition, the product manufacturer may operate various tracking tools on the order form at their own responsibility. We have no insight into or control over the data processed in this way. Digistore24 is a pure platform in this context, and is available to the customer for individual design. For further information on tracking, please contact the respective product manufacturer.

13 – Sample texts for vendors & affiliates

Below, you will find explanations of how various Digistore24 tools function. As a vendor or affiliate, you can include these texts in your own privacy policy or place a link to them on this policy.

Digistore24 WordPress plugin

The WordPress plugin offers the possibility to embed various Digistore24 services on your own website e.g. the Social Proof Bubble, the affiliate advertising material generator or other tools.

Each time you embed something, non-personal data is reloaded from the Digistore24 server (e.g. a JavaScript file).

When reloading, your web browser retrieves a web page from the Digistore24. Our server has no control over the extent to which your web browser transmits data to the Digistore24 server. In this context, our server does not transmit any data to the Digistore24 servers.

The data that Digistore24 stores and processes when you access this website is set out by Digistore24 Ltd as the contractor in its own privacy policy. The Digistore24 privacy policy can be found here: https://www.digistore24.com/dataschutz

Affiliate advertising material generator

The affiliate advertising material generator allows advertising materials to be created automatically. It provides an input field in which you can enter your Digistore24 ID. This way, you receive advertising material with which you can advertise products and services in a quick and easy manner.

In addition to the above, depending on your entry, the system checks whether an affiliate partnership exists. For more details, please refer to the Digistore24 privacy policy: https://www.digistore24.com/dataschutz

Promolinks / Content links

On our website we use various links to Digistore24 offers. The purpose of the links is to draw your attention to products that may be of interest to you.

Some of these links are links to the domain digistore24.com of the company Digistore24 Ltd.

If you click on one of the links, you call up a web page on the Digistore24 server.

Our server does not transmit any data to Digistore24, but rather the data is transferred from your browser to Digistore24, as is the case with any visit to a website. We have no control over the extent to which your web browser transmits data to Digistore24.

For more information about the scope of Digistore24 with data from website visits, please read the Digistore24 privacy policy: https://www.digistore24.com/dataschutz

Conversion tools / Shopping cart

Digistore24 offers the possibility to embed different services on your own website via HTML and JavaScript codes e.g. the Social Proof Bubble or the Digistore24 shopping cart.

Each time you embed something, non-personal data is reloaded from the Digistore24 server (e.g. a JavaScript file).

14 – Blog

The following data is transmitted to Digistore24 when the comment function is used:

First Name
Name
Email address
IP address

In addition, other users of the blog can see the written comments and the corresponding name at the end of each post.

Your consent is obtained for the processing of data within the scope of the sending process and is referenced on this privacy statement. The data will not be passed on to third parties in this context. The data shall be used exclusively to process the conversation.

If you have granted your consent, the legal basis for processing the data is Article 6(1)(a) of the UK GDPR.

You have the possibility to revoke your consent to the processing of personal data. If you contact us via email, you can object to the storage of your personal data at any time. In such a case, the conversation cannot be continued. All personal data stored during the period of contact shall be deleted accordingly.