Solutions
Digistore24 Digistore24
Vendors
Membership & Community
Events & Seminars
Software
Downloads & eBooks
Supplements
Affiliates
Affiliate Marketing Academy
Digistore24 Blog
Migration Service

A one-on-one experience with the Digistore24 team to ensure your offer is optimally set-up and ready to rake in the sales.

Features & Pricing
More
Hall of Fame Awards

Claim your Hall of Fame Award for your exceptional performance achieving over $1,000,000 in revenue with Digistore24.

Club24 Awards

The most exclusive community for Digistore24’s most elite marketers.

Digistore24 Blog

Discover marketing tips & trends for the successful digital entrepreneur

Svencast Podcast

Listen. Grow. Repeat. With the founder & CEO of Digistore24.

Migration Service

Switch to Digistore24 and we'll help migrate your business seamlessly.

Conversion report

Maximize profitability with the Conversion Cockpit, your sales funnel optimization tool.

Status Page

Check the uptime on our live status page.

Help

Search for help with Digistore24.

For Buyers
Cancel My Order
en
Select your language
Digistore24 PRIVACY POLICY

Digistore24 PRIVACY POLICY

Last updated: 28 September 2026

About Us

Digistore24 Ltd (“Digistore24”) is a private limited company incorporated in England and Wales with company number 12063218 and registered office at 12-18 Theobalds Road, London, England, WC1X 8PL (“we”/“us”/“our”). We provide a reseller-based online platform to enable sellers and affiliates to connect with and fulfil customer orders online (the “Services”).

By using the Services you agree to our use of your personal information (including sensitive personal information) in accordance with this Privacy Notice, as may be amended from time to time by us at our discretion. You also agree and consent to us collecting, storing, processing, transferring, and sharing your personal information (including sensitive personal information) with third parties or service providers for the purposes set out in this Privacy Notice.

Personal information subject to this Privacy Notice will be collected and retained by Digistore24, at their external data service providers AWS and Google located in Canada.

About our Privacy Policy

We respect your right to privacy and take seriously our responsibilities in relation to the processing of personal data. We do not collect or process personal data unnecessarily.

This privacy policy (the “Policy”) sets out important information about your rights in relation to the processing of your personal data, and the basis on which any personal data we collect from you, or that you provide to us, will be processed in connection with your use of this Website www.digistore24.com (“our Website” or “the Website”) and/or the Services.

We do not knowingly collect personal information from users who are under the age of 18 through the Website. If we become aware that we have unintentionally collected personal information from a child under the age of 18 through our Website, we will promptly delete the information from our records. Furthermore, if you believe that a child under the age of 18 may have provided us with personal information, please contact us with a thorough description of this information at datenschutz@digistore24.com. Digistore24 does not sell products for purchase by children. For clarity, Digistore24 sells products that are children products, however, they can only be purchased by adults.

Name and address of the controller

The controller within the meaning of the UK General Data Protection Regulation and other applicable UK data protection legislation is:

Digistore24 Ltd
Company number 12063218
12-18 Theobalds Road
London
England
WC1X 8PL

Email: datenschutz@digistore24.com

Name and address of the data protection officer

The data protection officer of the controller is:

Charlotte Scott-Mullings

Email: datenschutz@digistore24.com

General information on data processing

1 – Scope of personal data processing

If you choose to use the Website, your use and any dispute over privacy is subject to this Privacy Policy and our Terms of Use , including limitations on damages, resolution of disputes, and application of the applicable law of the United Kingdom. If you have any concern about privacy at Digistore, please contact datenschutz@digistore24.com with a thorough description, and we will try to resolve it. Our business changes constantly, and our Privacy Notice will change also. You should check our Website frequently to see recent changes.

Unless stated otherwise, our current Privacy Notice applies to all information that we have about you and your account. We stand behind the promises we make, however, and will never materially change our policies and practices to make them less protective of customer information collected in the past without the consent of affected customers.

We only collect and use the personal data of our users insofar as this is necessary to provide a functional Website as well as our content and services. The collection and use of the personal data of our users may, depending on the purpose for the processing, take place with the consent of the user. An exception applies in those cases where prior consent cannot be obtained for practical reasons, we have another valid legal basis to process personal data or the processing of the personal data is permitted by law.

Insofar as we obtain your consent for the processing of personal data, point (a) of Article 6 (1) of the UK General Data Protection Regulation (UK GDPR) serves as the legal basis for the processing of personal data.

Point (b) of Article 6 (1) UK GDPR serves as the legal basis for the processing of personal data required for the performance of a contract to which you are a party. This also applies to processing operations that are necessary to carry out pre-contractual measures.

Point (c) of Article 6 (1) UK GDPR serves as the legal basis insofar as the processing of personal data is necessary for compliance with a legal obligation to which we are subject.

If processing is necessary to protect a legitimate interest of our company or a third party, and your interests, fundamental rights and freedoms do not override the former interest, point (f) of Article 6 (1) serves as the legal basis for processing.

3 – Data erasure and storage period

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. This means that the period of time for which we store your personal data may depend on the type of data we hold. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. For more information about our data retention policies or if you want to have your data deleted, please contact us at datenschutz@digistore24.com.

Provision of Website and creation of log files

1 – Description and scope of data processing

Each time you visit our Website, our system automatically collects data and information from the computer system you are using to visit our Website.

The following data is automatically collected:

● Websites and files accessed from your system via our Website

● Amount of data transferred

● HTTP status codes (for example, error codes)

This data is not stored together with other personal data of the user.

The legal basis for the temporary storage of data and log files is point (f) of Article 6 (1) UK GDPR.

3 – Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable the Website to be delivered to the computer of the user. For this to happen, the IP address of the user must remain stored for the duration of the session.

The data is stored in log files to ensure the functionality of the website. In addition, the data serves to optimize the Website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not happen in this context.

In addition, log data may be used to detect, prevent and analyse attacks, investigate technical errors, and maintain the security and stability of our systems. Where used for these purposes, the data is not evaluated for marketing purposes.

The IP address and HTTP user agent may be retained in web server log files for up to six weeks for security, attack detection and analysis purposes. Data may be retained for longer where reasonably necessary in connection with a specific security incident, the preservation of evidence, or the establishment, exercise or defence of legal claims, and will be deleted or anonymised when the relevant purpose no longer applies.

Our legitimate interest in data processing pursuant to point (f) of Article 6 (1) UK GDPR also lies in these purposes.

4 – Possibility of objection and disposal

The collection of data for the provision of the Website and the storage of data in log files is absolutely necessary for the operation of the website. You therefore have no possibility of objection. However, if you no longer wish to have your data stored with us you may contact datenschutz@digistore24.com and request that your account is permanently removed.

Use of cookies

1 – Description and scope of data processing

Our Website uses cookies and similar technologies stored on your device. Cookies are text files stored in the internet browser/by the internet browser on the computer system or mobile device of the user. If a user visits a website, a cookie may be stored on the operating system of the user. These cookies are either necessary and are required to provide our Service or may be optional. We use cookies and similar technologies to measure and analyse how you use the Service, including the pages you view and how you interact with the content. Cookies and similar technologies are also used to enhance your experience with the Service, improve the Service, display promotions to you, and measure the effectiveness of promotions, sales pages and other content. We also use cookies to promote the Service on other websites. Web beacons are very small images or pieces of data embedded in an image, also known as "pixels” that recognize cookies, the time and date the page was viewed, a description of the page on which the pixel button was placed, and similar information from your computer or device. Some of these tools may enable us or third parties to collect information about how you act with our and other websites over time; however, these can be disabled at any time. These cookies and similar technologies contain a character string that enables a unique identification of the browser when the Website is visited again. We store this data for two time periods:

● We store cookies until the end of the session to enable a login (a session). This is necessary so that our server recognizes your web browser after you have entered your login data. A session is also started during an order process so that the order can be processed correctly.

● We store cookies for up to 185 days:

○ for affiliate tracking (so that we can provide our service i.e. the sale of a product. This is only possible in combination with the IP address and cookie)

○ the screen size (for a better display of the website)

○ for certain authorizations (e.g. for the authorization to make test purchases)

○ to prevent double orders (the cookie ensures that a warning message appears if you place a double order)

○ for the language setting

○ for the “Stay signed in” function

○ Products that have been placed in the shopping cart

Without cookies we cannot guarantee the correct functioning of our website or supply of services to you.

The legal basis for the processing of personal data by using technically necessary cookies is point (f) of Article 6 (1) UK GDPR.

Where the storing of or access to information on your device is not strictly necessary for the provision of a service requested by you, we obtain consent in accordance with the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), including Regulation 6, together with Article 6(1)(a) UK GDPR where personal data is processed. Further information about the categories, purposes and duration of cookies and similar technologies is set out in our Cookie and Similar Technologies Policy.

1 – Purpose of data processing

To enable Digistore24 to provide the Services, a buyer is given information and guidance about the products on the websites of third parties. In order for the providers of this information to be able to maintain their service, Digistore24 often reimburses their advertising costs. This is absolutely necessary for the operation of Digistore24.

The purpose of using technically necessary cookies is to simplify the use of Website for you. Some of the functions on our Website cannot be offered without using cookies. In this regard, it is necessary that the browser is recognized even after a page change.

Marketing Communications/ Newsletter

End Consumer Direct Marketing

In addition to the marketing activities described above in respect of vendors and affiliates, Digistore24 may, where you are an end consumer, send you direct marketing communications relating to products, services, promotions, incentives, offers, and marketing campaigns. Such communications will only be sent where you have provided your prior, explicit, and freely given consent by a clear affirmative opt-in (for example, by ticking an unchecked opt-in box at the time of purchase or registration). Marketing communications may be sent by email, SMS, telephone, or other electronic means and may include information about future product launches, promotional campaigns and incentives, related third-party partner offers, and similar products or services in categories that you have selected or expressed an interest in (such as health, wellness, supplements, business, or education).

Processed Personal Data: first and last name; email address; telephone number (where provided); marketing preferences and the categories of products or services in respect of which consent has been provided; and a record of your consent (including the date, time, and means of opt-in) and any subsequent withdrawal.

Legal Basis: the processing of your personal data for direct marketing purposes under this sub-section is based on your consent under point (a) of Article 6(1) UK GDPR. Where the marketing communication is sent by electronic means, processing is also carried out in accordance with Regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), which permits direct marketing by electronic means to consumers who have given their prior consent.

Withdrawal of Consent and Right to Object: your consent to the processing of your personal data for direct marketing is entirely voluntary and is not a condition of using the Website or purchasing any product or service. You may withdraw your consent, or object to the processing of your personal data for direct marketing purposes, at any time and free of charge, by using the unsubscribe link contained in each marketing communication or by contacting us at datenschutz@digistore24.com. The withdrawal of consent does not affect the lawfulness of any processing carried out before such withdrawal. Once we receive your withdrawal or objection, we will cease processing your personal data for direct marketing purposes without undue delay.

Storage Period: we retain your personal data for direct marketing purposes for as long as your consent remains in force, and we will delete or anonymise such data without undue delay following the withdrawal of consent or objection, save where we are required to retain a record of your consent and its withdrawal in order to demonstrate compliance with applicable data protection law.

Sharing of Personal Data with Third-Party Vendors: where you have provided your explicit consent through the combined opt-in described above, you acknowledge and agree that Digistore24 may share your personal data (specifically, your first and last name, email address, telephone number where provided, and the categories of products or services in respect of which consent has been given) with the third-party vendors named or identified in the opt-in form. Such sharing is carried out by means of our application programming interface (API) and other automated transmission mechanisms. The list of third-party vendors with whom your data may be shared, together with their respective contact details and privacy notices, is provided to you at the point of opt-in and is also available on request from datenschutz@digistore24.com.

Role of Third-Party Vendors: depending on the vendor, a third-party vendor with whom your personal data is shared may act either (i) as an independent data controller in respect of its own marketing activities, in which case its processing of your personal data will be governed by its own privacy notice, which we will make available to you; or (ii) as a processor acting on behalf of Digistore24 under a written contract that meets the requirements of Article 28 UK GDPR. Where a third-party vendor acts as an independent controller, we recommend that you review their privacy notice carefully before granting your consent. Digistore24 is not responsible for the further processing carried out by an independent controller after a lawful disclosure has been made to it.

Legal Basis for Sharing: the legal basis for the sharing of your personal data with third-party vendors for direct marketing purposes is your explicit consent under point (a) of Article 6(1) UK GDPR, given through the combined opt-in mechanism described above. Where electronic marketing is sent to you by such a third party, that processing is also subject to Regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).

International Transfers: some of the third-party vendors with whom your personal data may be shared are located outside the United Kingdom, including in the United States and other jurisdictions. Where this is the case, Digistore24 will ensure that an appropriate transfer mechanism under Chapter V UK GDPR is in place before any transfer is made. Depending on the recipient and circumstances, this may include UK adequacy regulations under Article 45 UK GDPR (including the UK Extension to the EU-U.S. Data Privacy Framework where applicable), the UK International Data Transfer Agreement, the UK Addendum to the European Commission Standard Contractual Clauses under Article 46 UK GDPR, together with any supplementary measures required following a transfer risk assessment, or another appropriate safeguard recognised under Chapter V UK GDPR. You may request a copy of, or further information about, the safeguards we rely on for any specific transfer by contacting datenschutz@digistore24.com.

Withdrawal of Consent in respect of Third-Party Sharing: you may withdraw your consent to the sharing of your personal data with third-party vendors at any time, free of charge, by contacting datenschutz@digistore24.com. Once we receive your withdrawal, Digistore24 will, without undue delay, cease further sharing of your personal data with the relevant third-party vendors and will notify those vendors of your withdrawal so that they may update their records accordingly. Where a third-party vendor is acting as an independent controller, you should also exercise your right to withdraw consent and to object to direct marketing directly with that vendor in accordance with their privacy notice. The withdrawal of consent does not affect the lawfulness of any processing or sharing carried out before such withdrawal.

1 – Description and scope of data processing

If you have purchased our services or used our platform and have provided your email address to us in connection with your role as a vendor or affiliate, we may subsequently use this information to send marketing communications. These communications will only relate to our own similar products, initiatives, and services and our newsletter.
We do not send unsolicited marketing communications to individuals or entities with whom we have no prior or existing relationship, nor do we share contact details with third parties for their own marketing purposes without a lawful basis.

2 – Processed Personal Data

The purpose of processing is to inform existing or prospective vendors and affiliates about our own products, initiatives, and services that may be relevant to them and to promote our business.

Within the United Kingdom, the legal basis for this processing is our legitimate interest under Article 6(1)(f) UK GDPR. Where PECR applies to an electronic marketing communication, we also comply with the applicable requirements of PECR, including the rules on consent and the existing-customer exemption where available. You may opt out at any time by using the unsubscribe mechanism in the communication or by contacting datenschutz@digistore24.com.

Group Sales and Business Development Activities

For the purposes described above, Digistore24 may use affiliated companies, including any direct or indirect parent company, and their respective personnel, contractors and service providers to provide sales, account-management, partner-development and business-development support on behalf of Digistore24.

Such activities may include contacting existing or prospective Vendors and Affiliates regarding Digistore24 products, services, platform features, initiatives, promotions, partnership opportunities and other business opportunities which Digistore24 reasonably considers relevant to their existing or prospective commercial relationship with Digistore24.

Where such processing is carried out on behalf of Digistore24, Digistore24 Ltd remains the controller of the relevant personal data and determines the purposes for which that personal data is processed. Any affiliated company or other service provider processing personal data solely on Digistore24's behalf shall do so only in accordance with Digistore24's documented instructions and the applicable requirements of data protection law.

The legal basis for this processing is Digistore24's legitimate interest under Article 6(1)(f) UK GDPR in managing and developing its commercial relationships with Vendors and Affiliates, promoting and developing the Services, and identifying relevant commercial and partnership opportunities, provided that such interests are not overridden by the interests, rights or freedoms of the individual concerned. Where applicable, electronic marketing communications will also be sent in accordance with applicable electronic communications and direct-marketing laws.

For recipients in the United States, processing is carried out in accordance with the CAN-SPAM Act of 2003, which permits commercial emails on an opt-out basis, provided that each message identifies the sender, includes a valid postal address, and contains a clear unsubscribe mechanism.

4 – Categories of recipients

In connection with the purposes described above, personal data may be disclosed or made accessible to service providers acting on behalf of Digistore24, including providers of marketing, customer relationship management, communications and technology services.

Personal data may also be disclosed or made accessible to affiliated companies within the Digistore24 group, including any direct or indirect parent company, where such companies and their personnel provide sales, account-management, partner-development, business-development, operational or other support services on behalf of Digistore24.

Where an affiliated company or other recipient processes personal data solely on behalf of Digistore24, appropriate contractual arrangements shall be implemented in accordance with Article 28 UK GDPR where applicable. Such recipients may use the personal data only for the purposes for which it has been made available to them and shall not acquire an independent right to use Vendor or Affiliate personal data for unrelated marketing or other purposes.

Communications made by such affiliated companies or their personnel on behalf of Digistore24 may identify the individual sender and their employing or affiliated company, but shall make clear, where appropriate, that the communication concerns the recipient's relationship or prospective relationship with Digistore24.

5 – Duration of Storage

Personal data shall be retained only for as long as it is required to fulfil the purpose for which it was collected or until you object to receiving further communications.
Your contact details shall be stored for the duration of your vendor or affiliate relationship with us however, you may unsubscribe to any marketing communication or newsletter at any time by contacting datenschutz@digistore24.com

6 – Transmission to third countries

In connection with the purposes described above, personal data may be accessed, processed or transferred outside the United Kingdom, including by affiliated companies, personnel and service providers located in the European Economic Area, the United States and other jurisdictions.

Where personal data is transferred to, or accessed from, a country outside the United Kingdom, Digistore24 shall ensure that the transfer is made in accordance with Chapter V UK GDPR and that an appropriate transfer mechanism or safeguard is in place.

Depending on the recipient and the circumstances of the transfer, Digistore24 may rely on UK adequacy regulations under Article 45 UK GDPR, including the UK Extension to the EU-U.S. Data Privacy Framework where applicable to an eligible U.S. recipient; the UK International Data Transfer Agreement or the UK Addendum to the European Commission Standard Contractual Clauses under Article 46 UK GDPR, together with any supplementary measures considered necessary following an appropriate transfer risk assessment; or another lawful transfer mechanism or safeguard recognised under Chapter V UK GDPR.

The fact that sales, account-management, partner-development or business-development personnel providing services on behalf of Digistore24 are located outside the United Kingdom, including in the United States, does not change Digistore24 Ltd's role as controller where those personnel process the personal data on Digistore24's behalf and in accordance with its instructions.

Further information regarding the safeguards applicable to a particular international transfer may be requested by contacting datenschutz@digistore24.com.

7 - Possibility of objection and disposal

You may object to or unsubscribe from marketing communications or newsletter at any time and free of charge. Each message includes an unsubscribe link, and you may also contact us directly to withdraw your consent or object to further processing at datenschutz@digistore24.com. All opt-out requests are promptly recorded and honoured to ensure that no further marketing messages are sent to those addresses.

Registration

1 - Description and scope of data processing

On our Website we offer you the opportunity to register by providing personal data concerning you. The data is entered into an input mask and is transferred to us and then stored. The data shall not be passed on to third parties.

The following data is collected during the registration process:

If registration serves the performance of a contract to which the user is a party or the implementation of pre-contractual measures, then the additional legal basis for the processing of the data is point (b) of Article 6 (1) UK GDPR.

3 - Purpose of data processing

The user must register in order to make the following content and services available on our website: provision of the Digistore24 software and performance of the B2B contract with our business customers.

4 - Possibility of objection and disposal

As a user you have the possibility to cancel the registration at any time. You can change the data stored about you at any time. To make a corresponding request, you can contact our data protection team using the email address given in chapter 2.

If the personal data is required to perform a contract or to carry out pre-contractual measures, premature erasure of the personal data is only possible insofar as there are no contractual or statutory obligations to the contrary.

Contact form and email contact

1 – Description and scope of data processing

On our Website there is a contact option which allows you to send emails to our general email address. In this case, any personal data you include in your email shall be stored by us.

In this context, the personal data shall be passed on to our third party customer experience software provider, Zendesk. The personal data is used exclusively for processing the conversation.

The legal basis for the processing of the data transmitted in the course of sending an email is point (f) of Article 6 (1) UK GDPR. If the aim of the email contact is to conclude a contract, then the additional legal basis for the processing is point (b) of Article 6 (1) UK GDPR.

3 - Purpose of data processing

In the case of contact via email, this also constitutes the necessary legitimate interest in the processing of the personal data for this purpose.

The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

4 - Possibility of objection and disposal

You may object to the processing of personal data at any time where such processing is based on point (f) of Article 6 (1) UK GDPR and your interests override our legitimate interests for processing. If you get in contact with us via email, you can object to such processing of personal data concerning you at any time. In such a case, the conversation cannot be continued. In this case, all personal data stored in the course of contacting us shall be erased except and to the extent that this may be processed or retained by applicable law.

AI-supported customer support and automated processing

To help us handle customer enquiries efficiently, we may use AI-supported tools to assist with activities such as classifying, routing, summarising or preparing responses to support requests. Where an AI-supported tool assists our personnel and a natural person remains responsible for the final decision, this does not constitute solely automated decision-making within the meaning of Article 22 UK GDPR.

For certain requests, including returns, withdrawals or terminations, automated workflows may assess defined criteria such as the type and time of the request, order or contract status, applicable deadlines, and relevant contractual or legal requirements. Where a decision is based solely on automated processing and produces legal effects concerning you or similarly significantly affects you, you have the right to request human intervention, express your point of view and contest the decision in accordance with Article 22 UK GDPR.

Where such automated decision-making is necessary for entering into, performing or terminating a contract, we rely on Article 22(2)(a) UK GDPR together with the applicable legal basis for the underlying processing. Where required, we will inform you of the principal reason for the automated outcome and how you may request a human review.

Personal data processed in connection with support requests is not used by us to train generally available AI models. Where an external service provider processes personal data on our behalf, we require appropriate contractual safeguards, including a data processing agreement under Article 28 UK GDPR where applicable. If personal data is transferred outside the United Kingdom, we use an applicable transfer mechanism under Chapter V UK GDPR, such as UK adequacy regulations, including the UK Extension to the EU-U.S. Data Privacy Framework where applicable, the UK International Data Transfer Agreement, or the UK Addendum to the European Commission Standard Contractual Clauses together with supplementary measures where required.

Support enquiries, related correspondence and data-subject requests may generally be retained for up to three years after the relevant matter has been completed, where this is necessary for documentation, compliance or the establishment, exercise or defence of legal claims. Longer retention may apply where required by law or justified by an overriding legal need.

Rights of the data subject

If personal data is processed by you, you are the data subject as defined by the UK GDPR and you have the following rights against the controller:

1 – Right of access

You can ask us to confirm whether personal data concerning you will be processed by us. If such processing has happened, you can request the following information from us:

You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organisation. In this context, you shall have the right to be informed of the appropriate safeguards pursuant to Article 46 UK GDPR relating to the transfer.

2 – Right to rectification

You have the right to rectification and/or completion of personal data concerning you if it is incorrect or incomplete. We must make the rectification without undue delay.

3 – Right to restriction of processing

Under the following conditions you may request that the processing of personal data concerning you be restricted:

If the processing of personal data concerning you has been restricted, such data shall – with the exception of storage – only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the United Kingdom.

If the restriction of the processing is carried out pursuant to the conditions mentioned above, we shall inform you before the restriction is lifted.

4 – Right to erasure

Right to be forgotten

You can ask us to erase the personal data concerning you immediately and we shall have the obligation to erase this data without undue delay where one of the following grounds applies:

Information to third parties

If we have made personal data concerning you public and are obligated to erase it pursuant to Article 17 (1) UK GDPR, we shall take appropriate measures, including those of a technical nature, taking into account the available technology and implementation costs, to inform those responsible for the data processing who process the personal data that you as the data subject have requested the erasure of all links to this personal data or of copies or replications of this personal data.

Exemptions

The right to be forgotten does not exist insofar as the processing is necessary

5 – Right to information

If you have exercised your right to rectification, erasure or restriction, we are obligated to inform all recipients to whom personal data concerning you has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or would give rise to disproportionate difficulties.

You have the right to be informed of these recipients.

6 – Right to data portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to which the personal data has been provided, where:

In exercising this right, you shall also have the right to request that the personal data concerning you be transferred directly from one data controller to another data controller, insofar as this is technically feasible. The freedoms and rights of other persons shall not be affected by this.

7 – Right to object

You shall have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on points (e) or (f) of Article 6 (1) or where your personal data is being processed for direct marketing purposes, including profiling based on these provisions.

We shall no longer process personal data relating to you unless we can provide compelling grounds for processing that outweigh your interests, rights and freedoms, or the processing is for the establishment, exercise or defense of legal claims.

Where the personal data concerning you is processed for direct marketing purposes, you shall have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding PECR, you may exercise your right to object by automated means using technical specifications.

You shall have the right to revoke your consent to the processing of your personal data at any time. The revocation of consent shall not affect the lawfulness of the processing carried out on the basis of the consent until revocation.

9 – Right of appeal to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you shall have the right of appeal to a supervisory authority, in particular in the part of the United Kingdom where you reside or work, or where the suspected infringement occurred, if you believe that the processing of personal data concerning you is contrary to the UK GDPR. The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy under Article 78 UK GDPR.

The supervisory authority responsible for us is:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
https://ico.org.uk/make-a-complaint/

Google

1 - Google Analytics

We use Google Analytics on our website, an analysis service of the US company Google Inc. ("Google"), 1600 Amphitheatre Parkway, Mountain View, CA 94043, U.S.A. Google Analytics uses "cookies", small text files that are stored on your computer. These cookies are used to analyze your use of our website. The corresponding data about your user behavior is forwarded to a Google server in the USA where it is evaluated and stored.

Where IP anonymisation is enabled for Google Analytics, Google may shorten or otherwise mask your IP address before further processing. Personal data may be processed by Google in the United Kingdom, the European Economic Area, the United States or other locations in accordance with Google's service configuration and applicable data-transfer safeguards.

Google shall use this information at the initiative of Digistore24 to evaluate how you use the website. In addition, Google shall use this information to produce reports on website activity and provide other services in connection with the use of the website and the internet for its operators. Google does not amalgamate the IP address transmitted by your browser through the use of Google Analytics with other Google data.

You can prevent the storage of cookies yourself by adjusting an appropriate setting in your browser. However, in this case you may not be able to fully use all the Website functions. You can prevent the collection of data generated by the cookie (including your IP address) about your use of the Website and the processing of this data by Google. All you need to do is to download and install an additional browser plugin. You can download this plugin using the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

2 - Google Maps

The Website uses Google Maps (API) provided by the software company Google Inc. The responsible party for the European area is Google Ireland Limited, Gordon House, Barrow Street Dublin 4, Ireland. Google Maps is an interactive map service that visualizes geographical data and identifies and processes location data. We use Google Maps to support our customers with filling in address fields. We use Google Maps based on your consent within the meaning of Article 6 (1) (a) UK GDPR. When you use Google Maps, your personal data is processed and stored. This includes:

The integration into our Website means that cookies are also set, which are used to collect data relating to your user behavior. Google does not clearly communicate whether, where, and for how long this data is stored by Google. However, since Google operates a large part of its servers in the USA, it is safe to assume that the above-mentioned data is also processed and stored there. A list of Google data centers can be found here https://www.google.com/about/datacenters/inside/locations/?hl=de. We have no influence on the storage location of the above-mentioned data. Where Google transfers personal data outside the United Kingdom, such transfers must be protected in accordance with Chapter V UK GDPR. Depending on the circumstances, Google may rely on applicable UK adequacy regulations, including the UK Extension to the EU-U.S. Data Privacy Framework where available, or appropriate safeguards such as the UK Addendum to the European Commission Standard Contractual Clauses. If you do not want cookies in general, you can set up your browser so that it always informs you when a cookie is to be set. You can then decide for each individual cookie whether to allow it or not. You can find further information at https://developers.google.com/fonts/faq/privacy and https://www.google.com/intl/de/policies/privacy/. To delete data stored by Google, please contact Google support at https://support.google.com/.

3 - DoubleClick

We use the Google Marketing Platform (formerly known as “Google DoubleClick”) provided by the software company Google Inc. The responsible party for the European area is Google Ireland Limited, Gordon House, Barrow Street Dublin 4, Ireland. This service sets cookies to display relevant ads and to optimize reports and analysis of campaign performance. Google records which ads have already been displayed in the user's browser, thereby preventing multiple displays. Google can also use these cookies to determine whether a user accesses the advertiser's website and purchases a product after an ad has been displayed. According to Google, the cookies used do not contain any personal data. However, your browser also establishes a direct connection with one or more Google servers. This involves the processing of your personal data. This includes:

Google may process the above-mentioned data outside the United Kingdom, including in the United States. Where personal data is transferred internationally, the transfer must be protected in accordance with Chapter V UK GDPR. Depending on the circumstances, Google may rely on applicable UK adequacy regulations, including the UK Extension to the EU-U.S. Data Privacy Framework where available, or appropriate safeguards such as the UK Addendum to the European Commission Standard Contractual Clauses. We have no control over Google's specific storage locations or retention periods. Further information is available in Google's privacy information and data-centre materials referenced below.

Hotjar

We use Hotjar to better understand the needs of our users and to optimize the offer on this website. With the help of Hotjar technology, we get a better understanding of our users' experiences (e.g. how much time users spend on which pages, which links they click on, what they like and what they do not like, etc.) and this helps us to tailor our offer to our users' feedback. Hotjar uses cookies and other technologies to collect information about the behavior of our users and their devices (in particular the IP address of the device (collected and stored in anonymous form only), screen size, device type (unique device identifiers), information about the browser used, location (country only), language preferred for displaying our website). Hotjar stores this information in a pseudonymized user profile. Neither we nor Hotjar use this information to identify individual users and it is not amalgamated with other data about individual users. You can object to the storage of a user profile and information about your visit to our Website by Hotjar and the setting of Hotjar tracking cookies on other websites by clicking on this opt-out link: https://www.hotjar.com/legal/compliance/opt-out

The Hotjar privacy policy provides information about the handling of personal data at Hotjar: https://www.hotjar.com/legal/policies/privacy

External Tracking

We allow our vendors to use their own tracking code on our order forms after prior verification by Digistore24. In doing so, personal data such as inventory data (e.g., name, address etc.), usage data (e.g., order ID, order time, etc.) and metadata (e.g., IP address, geodata, etc.) is collected. This data shall be used exclusively on the basis of your consent within the meaning of Article 6 (1) (a) UK GDPR and Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) Here is a list of approved external tracking providers and their respective privacy policies: https://www.digistore24.com/extern/cms/page/frontend/legal/privacy3rdparty/

Order form

The data requested on the order form shall be transmitted to the product manufacturer for the performance of the contract pursuant to point (b) of Article 6 (1) UK GDPR. In addition, the product manufacturer may operate various tracking tools on the order form at their own responsibility. We have no insight into or control over the data processed in this way. Digistore24 is a pure platform in this context, and is available to the customer for individual design. For further information on tracking, please contact the respective product manufacturer.

Order and contract processing - additional information

When you place an order, we process the personal data required to take pre-contractual steps, conclude and perform the contract, process payment, provide order information and customer service, prevent fraud, and maintain the security and functionality of the ordering process. Depending on the order, this may include your name, postal address, email address, IP address, technical log data, payment method and transaction identifiers, order and contract details, and any other information required for performance of the relevant contract.

Where you make repeated purchases from the same Vendor through Digistore24, orders may be associated with a customer identifier so that the relevant orders can be administered together. Where an order overview or similar self-service function is offered, access may be protected using a time-limited one-time password sent to the email address used for the order.

Information identified as mandatory during checkout is required to enter into and perform the contract. Optional information is voluntary. Processing necessary to perform the contract is based on Article 6(1)(b) UK GDPR. Processing that is necessary to secure and optimise the ordering process or prevent fraud, and which goes beyond what is strictly necessary to perform the contract, is based on our legitimate interests under Article 6(1)(f) UK GDPR.

Order and contract data is retained for as long as necessary to perform the contract and to comply with applicable legal, accounting, tax and record-keeping obligations. Where UK law requires a longer retention period, that period will apply.

Multi-Step Order Box and joint controllership

Where a Vendor integrates a Digistore24 multi-step order form or comparable embedded checkout into the Vendor's own website, Digistore24 Ltd and the relevant Vendor may act as joint controllers under Article 26 UK GDPR for certain processing operations, in particular the collection of personal data through the embedded order form and its transmission to Digistore24 for order processing.

The Vendor is responsible for the processing carried out on its sales page, including its content, advertising and other website functionality, and for meeting transparency and security obligations within its own area of responsibility. Digistore24 Ltd is responsible for the processing it carries out in connection with checkout, order administration and performance of the customer contract. The parties may allocate their respective responsibilities in an arrangement under Article 26 UK GDPR.

This allocation does not affect your rights under the UK GDPR. Where Article 26 UK GDPR applies, you may exercise your data protection rights in relation to the relevant joint processing against either Digistore24 Ltd or the relevant Vendor.

Disclosure of data to payment service providers

As part of contractual relationships, we offer data subjects efficient and secure payment options. In addition to banks and credit institutions, we also use other service providers for this purpose (collectively “payment service providers”) (Art. 6 (1) p.1 lit b UK GDPR).

The data processed by the payment service providers includes inventory data, e.g. name and address, bank data such as account numbers, credit card numbers, passwords, TANs and checksums as well as contractual, recipient or sum-related data. The data is required in order to carry out the transactions. However, the data entered is only processed by the payment service providers and stored by them. In other words, we don’t receive any account or credit card-related data, but rather only information with confirmation or denial of payment. Under certain circumstances, the payment service providers transmit data to credit agencies for the purpose of verifying identity and creditworthiness. In this regard, we would refer you to the terms and conditions and the privacy notice of the respective payment service providers that you have provided to Digistore24.

The terms and conditions and privacy notice of the respective payment service providers, which can be accessed on the respective websites or transaction applications, shall apply to the payment transactions.

The types of data processed by payment service providers include inventory data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contractual data (e.g. subject matter of contract, term, customer category); usage data (e.g. websites visited, interest in content, access times) and meta/communication data (e.g. device information, IP addresses).

Please refer to your nominated payment methods terms and conditions and privacy policies located on their websites.

Additional payment processing information

For payment processing, we may process master data such as your name and address, payment and billing information, contract and order information, technical usage data, device information and the IP address used at the time of payment. Full card details, security codes and online-banking credentials are generally processed directly by the relevant payment service provider; Digistore24 generally receives payment status information and transaction identifiers instead.

Where applicable, we may process limited card information, such as the first digits of a payment card number, to identify the issuing bank or country, analyse payment declines, improve payment acceptance, prevent fraud and support secure payment processing. Processing necessary to execute a payment and perform the contract is based on Article 6(1)(b) UK GDPR. Processing for fraud prevention, payment security and payment-process optimisation may also be based on our legitimate interests under Article 6(1)(f) UK GDPR.

Payment and billing records are retained for the period required by applicable UK tax, company, accounting and other legal record-keeping requirements, and otherwise only for as long as necessary for the relevant payment, dispute, fraud-prevention or legal purpose.

Credit checks and automated decisions

Where a payment method exposes Digistore24 to a material risk of non-payment, we may carry out a creditworthiness or payment-risk assessment before making that payment method available. This may involve processing identification and address data and obtaining creditworthiness information or a score from a credit-reference or fraud-prevention service provider.

The legal basis for such processing is our legitimate interest under Article 6(1)(f) UK GDPR in preventing payment defaults, protecting our business against fraud and assessing whether a particular payment method can be offered. Where a credit assessment is carried out solely by automated means and produces legal or similarly significant effects, you may request human intervention, express your point of view and contest the decision in accordance with Article 22 UK GDPR. A negative result may mean that a particular payment method is unavailable, but another available payment method may be selected.

We retain information relating to a credit or payment-risk assessment only for as long as necessary for the relevant decision and the administration or defence of the contractual relationship, subject to any applicable legal retention requirements. Any credit-reference provider acting as an independent controller will apply its own retention periods and privacy notice.

Receivables management and debt collection

If an amount owed to us becomes overdue, we may process and use your contact details, order and contract data, invoice and receivables information, payment history and relevant correspondence to administer and recover the outstanding amount. This may include reminders, allocation of payments, assessment of recovery measures and, where necessary, out-of-court or court enforcement.

We may disclose relevant information to professional advisers, debt collection agencies, payment service providers, courts or other service providers where necessary for the recovery or defence of a claim. We may also share limited information with the relevant Vendor where necessary to clarify an order or coordinate a receivables matter. The legal basis is Article 6(1)(f) UK GDPR based on our legitimate interests in enforcing lawful claims and protecting our business, and Article 6(1)(b) UK GDPR where the processing is also necessary to administer the underlying contract.

Receivables and related records are retained only for as long as necessary to recover or resolve the amount due and to comply with applicable UK legal, tax, accounting and record-keeping requirements, or for the establishment, exercise or defence of legal claims.

Sample texts for vendors & affiliates

You will then find explanations of how various Digistore24 tools function. As a vendor or affiliate, you can include these texts in your own privacy policy or place a link to them on this policy.

Digistore24 WordPress plugin

The WordPress plugin offers the possibility to embed various Digistore24 services on your own website e.g. the Social Proof Bubble, the affiliate advertising material generator or other tools.

Each time you embed something, non-personal data is reloaded from the Digistore24 server (e.g. a JavaScript file).

When reloading, your web browser retrieves the Website from Digistore24. Our server has no control over the extent to which your web browser transmits data to the Digistore24 server. In this context, our server does not transmit any data to the Digistore24 servers.

The data that Digistore24 stores and processes when you access this Website is set out by Digistore24 Ltd as the contractor in its own privacy policy. The Digistore24 privacy policy can be found here: https://www.digistore24.com/page/privacy/3/en

Affiliate advertising material generator

The affiliate advertising material generator allows advertising materials to be created automatically. It provides an input field in which you can enter your Digistore24 ID. This way, you receive advertising material with which you can advertise products and services in a quick and easy manner.

In addition to the above, depending on your entry, the system checks whether an affiliate partnership exists. For more details, please refer to the Digistore24 privacy policy: https://www.digistore24.com/page/privacy/3/en

Promo links / Content links

On our Website we use various links to Digistore24 offers. The purpose of the links is to draw your attention to products that may be of interest to you.

Some of these links are links to the domain digistore24.com of the company Digistore24 Ltd.

If you click on one of the links, you call up the Website on the Digistore24 server.

Our server does not transmit any data to Digistore24, but rather the data is transferred from your browser to Digistore24, as is the case with any visit to a website. We have no control over the extent to which your web browser transmits data to Digistore24.

For more information about the scope of Digistore24 with data from website visits, please read the Digistore24 privacy policy: https://www.digistore24.com/page/privacy/3/en

Conversion tools / Shopping cart

Digistore24 offers the possibility to embed different services on your own website via HTML and JavaScript codes e.g. the Social Proof Bubble or the Digistore24 shopping cart.

Each time you embed such a service, non-personal data is reloaded from the Digistore24 server (e.g. a JavaScript file).

When reloading, your web browser retrieves the Website from Digistore24. Our server has no control over the extent to which your web browser transmits data to the Digistore24 server. In this context, our server does not transmit any data to the Digistore24 servers.

The data that Digistore24 stores and processes when you access this Website is set out by Digistore24 Ltd as the contractor in its own privacy policy. The Digistore24 privacy policy can be found here: https://www.digistore24.com/page/privacy/3/en

Blog

The following data is transmitted to Digistore24 when the comment function is used on the Website:

In addition, other users of the blog can see the written comments and the poster’s name at the end of each post.

Your consent is obtained for the processing of personal data. The data shall not be passed on to third parties in this context. The data shall be used exclusively to process the comments and conversation on the blog.

Where you have granted your consent, the legal basis for processing the data is point (a) of Article 6 (1) UK GDPR.

You have the possibility to revoke your consent to the processing of personal data at any time. If you contact us via email, you can object to the storage of your personal data at any time. In such a case, the conversation cannot be continued. All personal data stored during the period of contact shall be deleted in this case.