Privacy policy
Thank you for your interest in our website trackcard.de (hereinafter the "Website") and our services (collectively, the "Services"). The protection of your privacy and personal data is very important to us. In this privacy policy, we inform you about the processing of your personal data and your rights under the applicable data protection laws (in particular the GDPR).
1. Controller and Contact
The controller responsible for data processing (Art. 4(7) GDPR) is:
Trackcard
Owner: Noah Aria Raissi
Eifflerstr. 43
22769 Hamburg
Germany
Email: shop@trackcard.de
If you have any questions regarding data protection, you can contact us at any time using the contact details provided above.
2. General Information on Data Processing
As a matter of principle, we collect and process personal data of our users only to the extent necessary to provide a functional website as well as our content and services. Processing is carried out either on the basis of consent (Art. 6(1)(a) GDPR), for the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), to comply with a legal obligation (Art. 6(1)(c) GDPR), or to safeguard our legitimate interests (Art. 6(1)(f) GDPR).
3. Collection and Storage of Personal Data as well as the Nature and Purpose of Its Use
3.1 When Visiting the Website
a) Server Log Files
Each time our Website is accessed, our system automatically collects information from the computer system of the accessing device. This may include, among other things:
• IP address (anonymized where technically possible)
• Date and time of access
• Name and URL of the file retrieved
• Website from which access is made (referrer URL)
• Browser type and version
• Operating system
The data is stored in the log files of our system. This data is not merged with other personal data of the user. The legal basis for this is Art. 6(1)(f) GDPR. Our legitimate interest follows from the technical necessity of ensuring the stable and secure operation of our Website.
Our Website is hosted on the Shopify platform (Shopify International Limited, Dublin, Ireland – see Section 3.9). The server log files are therefore processed by Shopify on our behalf; in doing so, data may be transferred to Shopify Inc. in Canada, for which an adequacy decision of the EU Commission exists (Art. 45 GDPR). The retention period of the log files is governed by Shopify's deletion routines; details can be found in the Shopify Consumer Privacy Policy linked in Section 3.9.
b) Cookies and Similar Technologies
We use cookies and similar technologies (e.g., pixels) to provide and analyze various functions of our Website. Details on the cookies we use, their retention periods, and your choices (e.g., cookie banner) can be found in our consent banner and in Section 7. Cookies and Tracking Technologies.
3.2 Contact by Email
If you contact us by email, the following data is processed:
• Your email address
• Where applicable, order number, name, and other voluntary information (e.g., the name of the recipient in the case of gifts)
• The content of your message
Processing is carried out for the purpose of handling your inquiry (Art. 6(1)(b) GDPR where it concerns the performance of a contract or pre-contractual measures, or Art. 6(1)(f) GDPR for other inquiries). We store your inquiry until its handling is complete and delete it thereafter, unless statutory retention obligations require otherwise.
For warranty registration as well as support requests via our service portal flow.trackcard.de, Section 3.10 of this privacy policy applies.
3.3 Newsletter (Brevo) and Double Opt-In
If you sign up for our email newsletter, we use the so-called double opt-in procedure. This means that after signing up, you will receive an email asking you to confirm your registration. Without this confirmation, you will not receive our newsletter.
• Purpose of processing: Sending the newsletter, providing information about news, offers, etc.
• Legal basis: Your consent pursuant to Art. 6(1)(a) GDPR.
• Service provider: We use the provider Brevo (formerly Sendinblue) for sending the newsletter. Brevo stores your email address as well as any additional information you voluntarily provide (e.g., name). A data processing agreement is in place between us and Brevo.
• Unsubscribing: You can unsubscribe from the newsletter at any time via the unsubscribe link in every newsletter email or by sending a message to shop@trackcard.de. Your email address will then be deleted from the newsletter mailing list.
3.4 WhatsApp Business API and Manychat
WhatsApp Business API
If you communicate with us via the WhatsApp Business API, we process your phone number, your profile picture (if visible), and the content you send us. Data processing is carried out for the purpose of customer communication (Art. 6(1)(b) or (f) GDPR). WhatsApp may receive metadata of the communication (e.g., date, time). We inform you of our data protection practices in the course of WhatsApp communication.
Manychat
For automated chat sequences on WhatsApp, we use the service Manychat (ManyChat, Inc., USA). A data processing agreement pursuant to Art. 28 GDPR is in place between us and Manychat. The legal basis for the processing is Art. 6(1)(f) GDPR (our legitimate interest in efficient customer communication). We have no influence on the nature, scope, and duration of data storage by Manychat or WhatsApp; for details, please refer to the providers' privacy notices: Manychat Privacy Policy and WhatsApp Privacy Policy.
3.5 Conversion Tracking: Facebook, TikTok, and Google Ads
We use the Facebook Pixel, TikTok Pixel, and Google Ads Conversion Tracking to analyze the behavior of users who have reached our Website via an advertisement. This allows us to evaluate the effectiveness of our advertisements and optimize our advertising measures.
• Legal basis: Your consent pursuant to Art. 6(1)(a) GDPR via our cookie consent tool. Without your consent, these pixels are not activated.
• Data: Data transmitted to Facebook, TikTok, or Google may include, among other things, IP address (truncated/anonymized where possible), browser information, referrer URL, and conversions (e.g., orders).
• Joint controllership with Meta: When using the Facebook Pixel, a partial joint controllership with Meta Platforms Ireland Limited exists pursuant to Art. 26 GDPR. You can view the corresponding supplementary agreement in the settings of your Meta account.
• Joint controllership with TikTok: The provider of the TikTok Pixel is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. For the collection of data on our Website and its transmission to TikTok, a partial joint controllership exists pursuant to Art. 26 GDPR on the basis of TikTok's joint controller agreement; the subsequent processing is carried out under TikTok's sole responsibility. In this context, data may also be transferred to third countries (including the USA and Singapore); EU Standard Contractual Clauses (Art. 46 GDPR) serve as appropriate safeguards. Further information can be found in the TikTok Privacy Policy.
• Objection: You can withdraw your consent at any time via our cookie banner and thereby deactivate tracking for the future.
3.6 Google Analytics
We use Google Analytics, provided by Google Ireland Ltd. ("Google"), to analyze and regularly improve the use of our Website. The statistics obtained enable us to improve our offering and make it more interesting for you as a user.
• IP anonymization: IP-AnonymizeIP is activated on this Website. As a result, your IP address is truncated by Google within the EU/EEA before being transferred to the USA.
• Legal basis: Your consent (Art. 6(1)(a) GDPR) via our cookie consent tool.
• Data retention: The data in Google Analytics is retained for 14 months, after which it is automatically deleted.
• Objection: You can withdraw your consent at any time via the cookie banner. In addition, Google provides a browser add-on that allows you to prevent tracking: https://tools.google.com/dlpage/gaoptout.
3.7 Order Processing, Payments, and Shipping
When you place orders in our online shop (via Shopify), we process the following data:
• Contact and address data (name, address, email address, phone number)
• Order data (products, order number, price, payment information)
• Shipping data (DHL, UPS where applicable)
The purpose is the performance of the contract (Art. 6(1)(b) GDPR), in particular processing the order, payment, and delivery as well as, where applicable, reversal of the transaction (withdrawal, returns). Depending on the payment method chosen, payment data is transmitted to the relevant payment service provider (Shopify Payments or PayPal). The data is deleted after expiry of the retention periods under tax and commercial law, unless you have expressly consented to longer use.
3.8 Storage of Warranty Data
The registration of your Trackcard and the associated processing of warranty data take place via our service portal flow.trackcard.de. Details on the data processed, the legal bases, and the retention period (24 months, i.e., for the duration of the warranty period) can be found in Section 3.10 of this privacy policy.
3.9 Shopify Platform and Shopify Network Intelligence
Our online shop is operated on the Shopify platform, a service of Shopify International Limited, 2nd Floor, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"). When you shop on or visit our Website, Shopify processes your personal data in order to enable the operation of the shop and provide certain functions.
Shopify Network Intelligence (SNI): Where this feature is activated, Shopify uses aggregated data from customer interactions with various Shopify shops to provide so-called "Enhanced Services". These include, for example, improved fraud protection, optimized shop performance, and data-based recommendations. In doing so, information from your visit to our Website is combined with data from other Shopify shops without Shopify identifying you personally.
The legal basis for this processing is Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient provision of our online services) as well as – where required – your consent pursuant to Art. 6(1)(a) GDPR (e.g., for marketing or analytics cookies).
Further information on data processing by Shopify can be found in the Shopify Consumer Privacy Policy and in the Shopify Privacy Portal, through which you can exercise your data protection rights or object to the processing of your data by Shopify for advertising purposes.
Shopify may also process data in countries outside the EU (e.g., Canada or the USA). In these cases, the transfer takes place on the basis of EU Standard Contractual Clauses pursuant to Art. 46 GDPR to ensure an adequate level of data protection.
3.10 Service Portal flow.trackcard.de (Warranty Registration, Setup, and Help)
At flow.trackcard.de, we operate our own service portal through which you can register your Trackcard and thereby activate the extended manufacturer's warranty, use a guided setup assistant, and go through a troubleshooting assistant ("Help").
a) Technical Data upon Access
As soon as you access the portal, we process technically necessary data: IP address, the approximate location derived from it (city, country), browser and device information (user agent), originating page (referrer URL), language, as well as date and time of access. The legal basis for this is Art. 6(1)(f) GDPR. Our legitimate interest follows from the need to provide a secure and functioning service and to limit abusive use (e.g., automated access).
b) Warranty Registration
Once you start the registration, we additionally process the information you provide during the process as well as your navigation behavior within the registration process:
• Purchase channel or retailer, country of purchase or delivery, device model
• Order number and – where provided – device serial number
• The steps accessed, the time spent on each, and any point of abandonment
Upon completion of the registration, we also process:
• Your email address (for the registration confirmation and warranty handling)
• Your confirmation that you have taken note of the warranty terms and this privacy policy
• Voluntary information on product use (e.g., condition of the packaging, course of the setup, place of use, product variant purchased)
Processing is carried out for the purpose of activating and managing your extended manufacturer's warranty, sending a registration confirmation by email, and improving our products and our registration process (evaluation in aggregated, statistical form, e.g., identifying points of abandonment). The legal basis for the registration and warranty handling is Art. 6(1)(b) GDPR; for the reach and abandonment analysis as well as the voluntary information on product use, the legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR. The information on product use is optional. If you consent in the form to receiving our newsletter, Section 3.3 of this privacy policy applies accordingly; the legal basis is your consent pursuant to Art. 6(1)(a) GDPR.
c) Setup and Help Assistant, Support Requests
In the setup and help assistants, we process the same technical data as described under a) as well as your information regarding the device and the problem and the steps completed. If you submit a support request at the end, we additionally process your first name, your email address, your problem description or comment, as well as the steps completed in the assistant, and transmit these to our support team in order to handle your request (Art. 6(1)(b) GDPR). You will also receive an automatic confirmation of receipt at the email address you provided.
d) Service Providers Used and Third-Country Transfers
For the operation of the portal, we use the following processors, with each of whom a data processing agreement pursuant to Art. 28 GDPR is in place:
• Vercel Inc. (USA) – provision and delivery of the application
• Supabase – database hosting on servers within the EU (Frankfurt am Main)
• Resend – sending of confirmation and support emails via a server location within the EU
Where personal data is transferred to the USA in this context (in particular by Vercel), this is done on the basis of the EU Standard Contractual Clauses or – where the provider is certified – the EU-U.S. Data Privacy Framework as appropriate safeguards within the meaning of Art. 44 et seq. GDPR. Upon your explicit click, we may redirect you to external platforms (e.g., Amazon); the privacy policies of the respective provider apply to the processing there.
e) Retention Period
We store the registration and warranty data (including email address, order or serial number, and model) for the duration of the warranty period, i.e., 24 months, and beyond that within the scope of statutory retention periods. The full IP address is automatically deleted no later than after 7 days; the approximate location derived from it (city/country) may remain stored longer in aggregated form. Data that we process for marketing purposes on the basis of your consent is stored until you withdraw your consent. Your rights as a data subject (Section 6 of this privacy policy) remain unaffected; to exercise them, a message to shop@trackcard.de is sufficient.
4. Disclosure of Data to Third Parties and International Transfers
We disclose your personal data to third parties only if
• this is necessary for the performance of the contract (e.g., shipping service providers) (Art. 6(1)(b) GDPR),
• you have given us your consent to do so (Art. 6(1)(a) GDPR),
• we are legally obliged to do so (Art. 6(1)(c) GDPR), or
• the disclosure is based on a legitimate interest (Art. 6(1)(f) GDPR) and no overriding interest of yours worthy of protection stands in the way.
International data transfers:
Some of the service providers we use (e.g., Google, Meta, TikTok) may transfer data to the USA or other third countries. We ensure that such transfers take place only on the basis of EU Standard Contractual Clauses (SCCs) or other appropriate safeguards (Art. 46 GDPR).
5. Storage Period / Deletion
We process and store your personal data only for the period necessary to achieve the respective purpose or as provided for by laws or regulations. Once the purpose no longer applies or the statutory retention periods expire (e.g., 6 years for business correspondence, 10 years for tax-relevant documents), the data is routinely deleted or blocked.
6. Your Rights as a Data Subject
Depending on the applicable law (in particular the GDPR), you have the following rights:
• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• in particular against processing based on legitimate interests or for direct marketing purposes
• Withdrawal of consent given (Art. 7(3) GDPR)
• Complaint to a supervisory authority (Art. 77 GDPR), if you believe that the processing of your data violates applicable law
If you wish to exercise any of these rights, you can contact us at any time using the contact details provided in Section 1. We will process your request in accordance with the statutory provisions and inform you of the outcome.
7. Cookies and Tracking Technologies
On our Website, we use a cookie consent tool (Shopify Consent) that informs you about the use of cookies on your first visit (and at regular intervals thereafter) and asks for your consent before cookies for marketing or analytics purposes are set. The following categories of cookies may be used:
• Necessary cookies: Required to technically provide the Website.
• Preference cookies: Store certain settings (e.g., language, login status).
• Statistics cookies: Used to analyze website usage (e.g., Google Analytics).
• Marketing cookies: Used for the personalization of advertising and conversion tracking (e.g., Facebook Pixel, TikTok Pixel).
You can view the retention periods and further details in the cookie consent banner. You can withdraw your consent at any time via the cookie settings on our Website.
8. Data Security
We employ appropriate technical and organizational security measures to protect your data against unauthorized access, loss, destruction, or manipulation. Nevertheless, no electronic data transmission or storage is 100% secure. Please note that you are also responsible for protecting your own access credentials.
9. Changes to This Privacy Policy
We reserve the right to amend this privacy policy as necessary, in particular in the event of changes to our data processing operations or new legal requirements. The current version can be found at any time on our website, indicated by the note "Last updated".
10. Contact
If you have any questions about this privacy policy or wish to exercise any of your statutory data protection rights, please send us an email at shop@trackcard.de or contact us at:
Trackcard
Noah Aria Raissi
Eifflerstr. 43
22769 Hamburg
Germany
Last updated: July 7, 2026