Privacy Policy

1. Name and address of the controller

The controller within the meaning of the GDPR and other data protection provisions is:

[tech]NEO GmbH
Kolonnenstr. 8
10827 Berlin
Germany

Represented by the managing director Mirko Lange
Phone: +49 30 555 70 70 - 0
Email: info@techneo.berlin
Website: www.techneo.berlin

Further details can be found in the legal notice.

2. Website and application: two roles

At allverto, we process personal data in two different roles:

• As controller for visitors to this website, for prospective customers who contact us and for the data we need for registration, the customer account, the contract and billing with our customers. This privacy policy applies to this processing.
• As processor for all data that our customers store and process in the allverto application – for example data of their own customers, orders, delivery addresses or bank transactions. The respective customer is the controller for this data. We process it only on the customer’s instructions on the basis of a data processing agreement pursuant to Art. 28 GDPR (see section 10).

If you are the end customer of a merchant and have questions about your data that this merchant processes with allverto, please contact the merchant directly. If we receive such a request, we forward it to the customer concerned.

3. Hosting and server location

We operate the website and the application in the Hetzner Cloud of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Servers, database and file storage are located in the Falkenstein data centre (Saxony). In addition, we store encrypted backup copies in the Nuremberg data centre (Bavaria) as a second location so that the data is preserved even if one site fails. All data centres are located in Germany and are ISO 27001 certified.

Hetzner processes the data as our sub-processor on the basis of a data processing agreement. We deliver the fonts, images and scripts of this website from our own servers; we do not embed content from third-party providers such as font services, map services or video platforms.

4. Collection of general data (server log files)

Each time the website or the application is accessed, our system automatically collects data and information transmitted by the accessing browser:

• browser type and version, operating system (user agent)
• the previously visited page (referrer), if the browser transmits it
• the requested address, date and time of access, status code and amount of data transferred
• the IP address

We need this data to deliver the content correctly, to ensure the permanent functionality of the systems and to detect and fend off attacks, such as automated login attempts. This includes our own firewall, which can temporarily block IP addresses in the event of suspicious requests. We additionally protect login, registration and “Forgot password” without cookies and without third-party services (no CAPTCHA): the form merely receives a signed timestamp that lets us recognise automated requests submitted too quickly. Logins to the application are logged with IP address, time and browser so that customers and we can detect unauthorised access.

This data is not combined with other data sources for advertising or analysis purposes. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure and stable operation. The logs are automatically deleted after a limited period unless they are needed to investigate a specific security incident.

5. Cookies and local storage

In the application, we only set technically necessary cookies:

• Login cookie (av_session): keeps you logged in after login, also in the POS and the warehouse app. It contains a random identifier, cannot be read by scripts and expires after 30 days at the latest or when you log out.
• Two-factor authentication cookies: remember the intermediate step after entering the password and – only if you choose “Trust this device” – that this device has already provided the second confirmation.

In addition, the application uses your browser’s local storage for view and printer settings, for unsaved changes in order windows after an automatic logout (for a maximum of 24 hours) and, in the POS, for the shopping cart and parked receipts so that they survive a reload or a brief network outage. This information is used solely for operating the application and is not evaluated for advertising or analysis purposes.

The legal basis for storing and reading this information is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), as it is strictly necessary for the service you have requested; the legal basis for the subsequent processing is Art. 6(1)(b) GDPR. You can delete or block cookies in your browser at any time; without the login cookie, however, it is not possible to log in to the application.

6. Reach measurement without cookies

To understand which content on our website is used and how visitors find us, we run our own visitor statistics on our servers. They work without cookies, without storing anything on your device and without third parties. When a page is opened, a small script on our website sends the following information to our own server:

• the page opened (without parameters; only campaign parameters such as utm_source, utm_medium and utm_campaign are kept) and the language of the page
• on entry, only the domain of the previously visited website (e.g. “google.com”), never its full address
• certain actions as goals: completed sign-up, click on “Try for free” and click on our email address or phone number

From the information your browser transmits with every request anyway, we also derive the device type (desktop, smartphone, tablet), the browser and operating system family without version number, and the country. To group repeated visits on the same day, we create an irreversible hash from the IP address and user agent together with a random value that is generated anew every day and deleted at the end of the day. The IP address is only used briefly in memory for this and is never stored. There is no recognition beyond the day, no usage profile and no combination with other data.

Nothing is stored on your device, and no device properties such as screen size, installed fonts or identifiers are read. Consent under Section 25 TDDDG (German Telecommunications Digital Services Data Protection Act) is therefore not required, which is why we do not show a cookie banner. The legal basis for processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in designing our website according to needs and assessing the effectiveness of our offers and campaigns. The data is processed exclusively on our servers in Germany and is not passed on to third parties.

We store individual visits for at most 30 days; after that, only aggregated daily figures (e.g. number of views per page) remain, without any personal reference.

Objection: If “Do Not Track” or “Global Privacy Control” is enabled in your browser, your visits are not counted. You can also object to the processing at any time under Art. 21 GDPR, for example by email to info@techneo.berlin, or disable JavaScript in your browser.

7. Contacting us

You can reach us by email or phone. We process the information you provide – usually name, company, email address, phone number and the content of your enquiry – exclusively to handle your request and for any follow-up questions.

The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or its initiation, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering business enquiries). The data is not passed on to third parties unless this is necessary for handling the request or required by law.

8. Registration and customer account

To use allverto, you register your company. In doing so, we process:

• company data: name, type of business, address and contact details
• data of the registering person and other users: name, business email address, password (stored only as a secure hash), roles and permissions
• proof of commercial activity or of the association (trade licence, extract from the commercial register or register of associations)
• if two-factor authentication is enabled, the keys and recovery codes required for it (encrypted or as a hash)

We check the proof before activating a company so that allverto is only used by businesses and associations and misuse is made more difficult. It is only visible for our review. The legal bases are Art. 6(1)(b) GDPR (contract and pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in preventing misuse).

9. Contract processing and billing

For the contract and billing, we process the billing address, the VAT identification number, the selected plan and term, the usage quantities relevant for billing (e.g. number of orders, users and POS terminals) as well as invoices and incoming payments. We send invoices by email; payment is made by bank transfer to our business account.

The legal bases are Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (obligations under commercial and tax law).

10. Data in the application (processing on behalf)

Everything that customers record in allverto or retrieve via integrations is processed by us as a processor on behalf of and on the instructions of the customer. Depending on the functions used, this includes in particular:

• master data of the customer’s customers and suppliers (names, addresses, contact details, bank details, VAT identification numbers)
• orders, quotes, invoices, delivery notes, returns and payments
• shipping data and tracking numbers
• transactions from connected bank accounts
• POS receipts and other POS data
• data of the customer’s users, their permissions and a change log
• uploaded files such as receipts, supporting documents, images and print templates

Each company’s data is technically separated from the data of other companies in the database. We only access customer data to the extent necessary for operation, security or troubleshooting. Support only sees a company’s data if the customer grants support access in the settings; this access is read-only, ends automatically and is recorded in the change log.

Customers can obtain the data processing agreement pursuant to Art. 28 GDPR, including the technical and organisational measures and the list of sub-processors, on request from info@techneo.berlin.

11. Merchants' customer data and marketplace data

Merchants use allverto to process orders from their own customers – including buyers who order via marketplaces such as Amazon, eBay, Kaufland or OTTO Market. The respective merchant is the controller of this data within the meaning of the GDPR. We process it exclusively as the merchant's processor under Art. 28 GDPR, only on the merchant's instructions and not for our own purposes. The following information explains to buyers and merchants how this is done; the privacy notices of the respective merchant and marketplace apply in addition.

Purposes

• Order processing: retrieving orders from the marketplace or online shop, processing, picking and packing
• Shipping: delivery notes and shipping labels, handover to the carrier, shipment tracking and shipping confirmation to the marketplace
• Invoicing: invoices, credit notes and cancellations, and – if the merchant wishes – transmission of the invoice to the marketplace
• Customer service: answering buyer messages, handling returns, refunds and complaints

Categories of data

Name, delivery and billing address, telephone number and email address (with Amazon usually an anonymised address assigned by the marketplace), for business customers the company and VAT identification number, order number and order date, ordered items, prices and taxes, payment and shipping method, tracking numbers, messages between buyer and merchant, and information on returns. We do not receive buyers' payment card or bank account data from the marketplaces; payment is handled by the marketplace.

Recipients

• Hetzner Online GmbH as our sub-processor for hosting, database and backups in data centres in Germany (Falkenstein and Nuremberg)
• Carriers chosen by the merchant (e.g. DHL, DPD, GLS, Hermes, UPS): recipient address and – where needed for delivery or delivery notifications – telephone number or email address
• the merchant's email provider, if the merchant sends invoices, shipping confirmations or replies to buyer messages via its own mailbox (SMTP, Microsoft 365 or Google)
• the marketplace itself for feedback such as shipping status, tracking number, invoice or replies to messages
• Anthropic PBC (USA) only if the merchant's users use the translation or AI features, such as “Translate with Claude” for buyer messages. Only the respective text is transmitted. The transfer to the USA is based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR); under its contractual terms, Anthropic does not use this content to train its models.

Storage period and deletion

The data remains stored for as long as the merchant needs it to process the order, for warranty, returns and legal obligations. Invoices and other accounting records are subject to a ten-year retention obligation for the merchant (Section 147 AO, Section 257 HGB) and are not changed during this period. The merchant can anonymise individual customers in allverto at any time and switch on automatic anonymisation of customers who have not ordered for a configurable number of years. This replaces name, address and contact details in the customer master data and in the orders; documents remain unchanged because of the retention obligation.

Some marketplaces require shorter periods – Amazon, for example, requires buyers' delivery and contact data to be deleted no later than 30 days after delivery unless it is needed for tax or other legal purposes. Complying with these periods is the merchant's responsibility. After the end of the contract with the merchant, we delete or hand over the data according to the merchant's instructions; it disappears from the encrypted backups after their retention period (currently 35 days).

Security

The data is transmitted in encrypted form (TLS), stored in Germany and separated per company in the database; only the merchant's users with a suitable role can see it. We store access credentials for the marketplaces in encrypted form (AES-256-GCM). Mandatory two-factor authentication and password rules with regular changes apply to all users; sign-ins and changes are logged. Further measures are described in section 16.

Your rights as a buyer

Please address your rights of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR) to the merchant from whom you ordered. If we receive such a request, we forward it without delay to the responsible merchant and support the merchant in responding; for this purpose, allverto offers the merchant a data access report and the anonymisation of customers. As a processor, we may not decide on the request ourselves.

12. Integrations activated by customers

On request, allverto connects to services of other providers. Each of these integrations is switched off until the customer sets it up and authorises it with their own credentials or by logging in to the provider. Data is only transferred on the customer’s instructions and only to the extent required by the respective function:

• Online shops and marketplaces (e.g. Shopify, Shopware, WooCommerce, JTL, Amazon, eBay, Kaufland, OTTO Market): retrieval of orders with customer and delivery data, transmission of product data, stock levels, shipping and return information.
• Shipping carriers (e.g. DHL, Deutsche Post, DHL Express, DPD, GLS, Hermes, UPS, FedEx): transmission of the recipient’s address, contact details and shipment details to create shipping labels and for shipment tracking.
• Banks and payment providers (bank access via FinTS/HBCI or EBICS, account information services, PayPal, Mollie, Amazon Pay): retrieval of bank transactions and payments for matching with open items. Credentials are stored in encrypted form.
• POS: signing of POS receipts via the technical security device (TSE) of fiskaly GmbH and card payment via card terminals (e.g. SumUp, Stripe Terminal or ZVT terminals), if the customer sets these up.
• Sending emails via the customer’s own mailbox (SMTP, Microsoft 365 or Google by logging in to the provider): sending documents and messages on behalf of the customer. allverto only requests the permissions needed for sending.
• Verification of VAT identification numbers via the European Commission’s VIES system when the customer triggers a check.

Processing by these providers is subject to their privacy policies and the contracts the customer has concluded with them. The choice of providers and the legal basis for the transfer are the responsibility of the customer.

13. Platform emails

We send system messages such as login confirmations, codes for two-factor authentication, invitations, notifications of security events and allverto invoices via the platform’s mail server. Customers without their own mailbox can also send their documents this way; the sender name and reply-to address are then those of the customer. The legal basis is Art. 6(1)(b) GDPR. We do not send promotional newsletters.

14. Recipients and transfers to third countries

We do not sell data and do not pass it on for advertising purposes. Recipients are only our hosting and operations service providers, who are contractually bound as processors, and bodies to which we must transfer data due to legal obligations, such as tax authorities or our tax advisers in the course of bookkeeping.

For AI replies and translations in the support chat and for the translation features in the application, we use Anthropic PBC, USA (see also section 11). Only the respective texts are transmitted, on the basis of the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). Beyond that, we ourselves do not transfer any data to countries outside the European Union or the European Economic Area. If a customer activates integrations with providers based outside the EU (e.g. marketplaces, payment or email providers), the transfer takes place on the customer’s instructions and under the customer’s responsibility.

15. Storage period and routine erasure

We store personal data only for as long as is necessary for the respective purpose or required by statutory retention periods. The data is then routinely erased or, as long as erasure is not possible due to retention obligations, restricted.

• We retain invoices, accounting records and other tax-relevant documents for ten years pursuant to Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB), and commercial and business letters for six years.
• We delete customer account data after the end of the contract unless it is still needed for processing the contract or due to retention obligations.
• We delete enquiries unrelated to a contract once they have been dealt with and no follow-up questions are expected.
• Encrypted backups are automatically removed after their retention period expires (currently 35 days).
• We delete individual visits recorded by the visitor statistics after at most 30 days; after that, only aggregated daily figures without personal reference remain.

We delete or hand over data that we process as a processor in accordance with the customer’s instructions and the rules of the data processing agreement. For this data, retaining the customer’s own records in accordance with GoBD (German principles for proper electronic bookkeeping) is the customer’s responsibility.

16. Data security

We use technical and organisational measures to protect your data against loss, manipulation and unauthorised access, and we adapt them to the state of the art. These include in particular:

• encrypted transmission of all pages and interfaces via HTTPS (TLS)
• separation of each company’s data at database level (row level security)
• encrypted storage of integration credentials (AES-256-GCM), passwords only as a hash
• mandatory two-factor authentication, password rules with special characters and regular changes, roles and permissions per user, protection against automated login attempts and an application firewall
• change log for important data
• regular, encrypted backups at a second location

Despite these measures, data transmission over the internet may have security gaps; absolute protection cannot be guaranteed.

17. Legal bases for processing

We base the processing of personal data on the following legal bases:

• Art. 6(1)(a) GDPR, insofar as you have consented to processing
• Art. 6(1)(b) GDPR for the performance of a contract and pre-contractual measures, such as registration, provision of the application and billing
• Art. 6(1)(c) GDPR for legal obligations, such as retention obligations under tax and commercial law
• Art. 6(1)(f) GDPR for our legitimate interests. These lie in conducting and improving our business, supporting our customers, the security of our systems and the prevention of misuse.

18. Obligation to provide data

The provision of personal data is partly required by law (e.g. information for invoices) or necessary for concluding a contract. Without the information requested during registration, we cannot set up a customer account or perform the contract.

19. No automated decision-making

There is no automated decision-making, including profiling within the meaning of Art. 22 GDPR, that produces legal effects concerning you or similarly significantly affects you. A human decides on the activation of new companies.

20. Rights of data subjects

You have the following rights vis-à-vis us with regard to the personal data concerning you:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to withdraw consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, a message to info@techneo.berlin or to our postal address is sufficient.

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany, www.datenschutz-berlin.de.

21. Changes to this privacy policy

We adapt this privacy policy when our services, the services we use or the legal situation change. The version published on this page at the time applies.