Privacy Policy

Last updated: 26 October 2026

1. Controller

The controller for the processing of personal data within the meaning of Art. 4 (7) GDPR is:

Attivita GmbH von-Galen-Str. 75 33378 Rheda-Wiedenbrück Germany Phone: +49 176 27585221 Email: info@attivita.de

Represented by its Managing Director, Andreas Zurlo. For all questions regarding data protection and to exercise your rights, please contact us using the details above.

2. Scope and the particularities of business-to-business trade

This privacy policy applies to our website attivita.de and to our application programming interface at api.attivita.de.

We trade exclusively with businesses. Nevertheless, we process personal data, because the contact persons of our customers are natural persons. Information relating exclusively to a company, such as the name of a corporation or its VAT identification number, does not constitute personal data; in the case of sole traders and partnerships the distinction may differ, which is why we treat such data in accordance with the GDPR as a precaution.

3. Website access and server logs

Each time our website is accessed and each time our interface is called, technical access data is processed: IP address, date and time of access, the address requested, the volume of data transferred, the delivery status, the referring page and information about the browser and operating system.

This processing is technically necessary in order to deliver the content and serves operational security, troubleshooting and the prevention of attacks. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the secure and uninterrupted operation of our systems.

Our application logs are deleted automatically after 180 days. Logs relating to security-relevant events, such as login attempts, account blocks or changes to access credentials, are retained for 365 days and then deleted automatically. Longer retention occurs only where a specific incident requires it.

4. Customer account and registration

A customer account is required in order to use our services. During registration we process the name of the contact person, the business email address, the company name, the VAT identification number or tax number, a telephone number, the billing and, where applicable, delivery address, the selected language and a password chosen by you. We store the password exclusively as a cryptographic hash and cannot view it.

You may optionally submit proof of business or commercial register registration. This document is stored in a separate, non-publicly accessible storage area (see section 11).

The legal basis is Art. 6 (1) (b) GDPR, as the processing is necessary for the establishment and performance of the contractual relationship, and Art. 6 (1) (c) GDPR insofar as we are required to verify business status and to comply with tax obligations.

Newly registered accounts are reviewed by us before activation. If an account is not activated, we delete the registration data once the review has been completed, provided no retention obligation applies.

If you activate two-factor authentication, we additionally process the associated secret used to generate one-time passwords. The legal basis is Art. 6 (1) (f) GDPR, with the legitimate interest of securing the account.

5. Orders, delivery of licence keys and invoicing

In order to process your orders we process the order data, the allocated licence keys, the billing address, the order and payment status and the assignment to your customer account. We make the licence keys available in your customer account, send them by email and, for orders placed via the interface, return them directly in the response.

The legal basis is Art. 6 (1) (b) GDPR. For invoicing, the issuing of credit notes and tax documentation, Art. 6 (1) (c) GDPR additionally applies.

Invoices, credit notes, delivery notes and the associated accounting records are subject to commercial and tax retention periods and are retained for ten years in accordance with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB). The period begins at the end of the calendar year in which the record was created. Within this period, processing is limited to retention.

If an order is cancelled in whole or in part, the original records remain unchanged for reasons of traceability; corrections are made by way of separate documents.

6. Payment processing, credit limit and dunning

Billing is by invoice. We do not collect payment data in the sense of card or bank account details; you pay by bank transfer through your own credit institution. We process only the receipt of payment, outstanding balances and the payment status.

To manage default risk we operate a credit limit and check automatically for each order whether the order value together with the outstanding balance exceeds that limit. If it does, the order is rejected and you are informed of the remaining headroom. This check is based exclusively on the order and payment data held by us; no assessment of personality traits and no profiling takes place. The legal basis is Art. 6 (1) (b) GDPR and Art. 6 (1) (f) GDPR, with our legitimate interest in securing our receivables.

In the event of late payment we send staged payment reminders and dunning notices to the email address on file and may block the customer account. The legal basis is Art. 6 (1) (b) and (f) GDPR. In order to enforce outstanding claims we may transfer data to lawyers, debt collection service providers or courts; the legal basis in this respect is Art. 6 (1) (f) GDPR.

7. Verification of the VAT identification number

For customers established in another Member State of the European Union we are required to verify the VAT identification number in order to assess whether the supply is exempt from tax. For this purpose we transmit the VAT identification number and the company name via the interface of the German Federal Central Tax Office to the confirmation procedure operated there. We repeat this verification at regular intervals.

The legal basis is Art. 6 (1) (c) GDPR in conjunction with the evidentiary requirements under VAT law. The result of the verification and the time of the enquiry are stored for evidentiary purposes and are subject to the tax retention period.

If the number cannot be confirmed, we will inform you and may block the customer account until the matter has been clarified.

8. Accounting and tax advice

In order to comply with our tax obligations we transmit accounting data, including debtor numbers, invoice and credit note data and the associated company and address details, to our tax adviser and to the accounting platform used by them. The legal basis is Art. 6 (1) (c) GDPR. The tax adviser is in turn bound by professional confidentiality.

9. Contacting us

If you contact us via the contact form, by email or by telephone, we process the information you provide in order to respond to your enquiry. The legal basis is Art. 6 (1) (b) GDPR where the enquiry is directed at concluding a contract, and otherwise Art. 6 (1) (f) GDPR, with our legitimate interest in responding to enquiries.

To protect against automated submissions we use technical protective measures and log suspicious submissions. The legal basis is Art. 6 (1) (f) GDPR.

Enquiries that do not lead to a contractual relationship are deleted once they have been dealt with conclusively and no retention obligation applies, as a rule after six months. Business correspondence qualifying as a commercial letter is retained for six years in accordance with Section 257 HGB.

10. Newsletter and product information

You may subscribe to a newsletter. For this purpose we process your email address, the time of registration and your language setting. The legal basis is your consent under Art. 6 (1) (a) GDPR in conjunction with Section 7 (2) no. 3 of the German Act against Unfair Competition (UWG).

You may withdraw your consent at any time without affecting the lawfulness of processing carried out up to the point of withdrawal. Every message contains an unsubscribe link; alternatively, a message to info@attivita.de is sufficient. Following withdrawal we store your email address on a suppression list in order to ensure that you receive no further messages; the legal basis for this is Art. 6 (1) (c) GDPR.

We retain evidence of your consent for the duration of the subscription and for three years thereafter in order to be able to defend ourselves against complaints.

11. Document storage

Documents you submit, in particular proof of business registration, as well as the invoices, credit notes, delivery notes and export files we generate, are stored with Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, using the Amazon S3 service. Storage takes place in a data centre in the Frankfurt am Main region (eu-central-1) and therefore within the European Union.

Amazon acts for us as a processor pursuant to Art. 28 GDPR; we have concluded a corresponding agreement. The document areas are not publicly accessible; access is exclusively by means of time-limited, signed references.

12. Database and operation of the application

Application data is stored in a database operated by MongoDB, Inc. using the MongoDB Atlas service, which acts for us as a processor pursuant to Art. 28 GDPR. Our application runs on a server managed by us at our infrastructure service provider within the European Union, which is likewise bound as a processor.

The legal basis for engaging these service providers is Art. 6 (1) (b) and (f) GDPR; they are necessary for the operation of our services.

13. Email dispatch

For sending order confirmations, licence keys, invoices, dunning notices, system messages and newsletters we use the Brevo dispatch service operated by Sendinblue SAS, 106 Boulevard Haussmann, 75008 Paris, France. The recipient address and the content of the message are processed in this context.

Brevo acts for us as a processor pursuant to Art. 28 GDPR. The legal basis is Art. 6 (1) (b) GDPR for contract-related messages, Art. 6 (1) (c) GDPR for invoices and dunning notices and Art. 6 (1) (a) GDPR for newsletters.

14. Notifications via Telegram

Customers with access to our interface may voluntarily use a notification service via the Telegram messenger, which provides information about changes to stock levels and prices. Registration takes place exclusively on your initiative by using your access token in a dialogue with our Telegram service.

In this context we process the identifier of your Telegram account and your notification settings and assign these to your customer account. Messages are transmitted via Telegram FZ-LLC or Telegram Group Inc., established in the United Arab Emirates and therefore in a third country for which no adequacy decision of the European Commission exists. A level of data protection equivalent to European law cannot be guaranteed there; in particular, there may be more extensive access possibilities for state authorities and limited legal remedies.

The legal basis is your explicit consent under Art. 6 (1) (a) GDPR in conjunction with Art. 49 (1) (a) GDPR. You may discontinue use at any time by unsubscribing in the Telegram dialogue; we will then delete the associated data. The service is not necessary in order to use our offering; we make the same information available via our interface.

15. Audience measurement using Google Analytics

On our website we use Google Analytics, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in order to evaluate the use of our offering statistically and to improve our content.

Google Analytics uses cookies and similar technologies and processes in particular a truncated identifier of your device, the pages accessed, dwell times, the country of origin and information about the browser and operating system.

Use takes place exclusively on the basis of your consent. The legal basis for setting the cookies is Section 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG), and for the subsequent processing Art. 6 (1) (a) GDPR. Without your consent, no analytics cookies are set and no data is transmitted to Google. You may withdraw your consent at any time via the cookie settings on our website; the lawfulness of processing carried out up to that point remains unaffected.

Transmission to Google LLC in the United States cannot be ruled out. For this transfer we rely on the adequacy decision of the European Commission concerning the EU-US Data Privacy Framework, to which Google LLC has adhered, and additionally on the standard contractual clauses of the European Commission. Further information on data processing by Google is available at policies.google.com/privacy.

The data collected by Google Analytics is deleted automatically upon expiry of the retention period configured there.

16. Cookies and consent management

We use technically necessary cookies and comparable storage technologies that are required for the operation of the website, for example to manage your login, to store the shopping cart, for language selection and for protection against attacks. The legal basis for this storage is Section 25 (2) no. 2 TDDDG; the subsequent processing is based on Art. 6 (1) (b) and (f) GDPR.

All non-essential technologies, in particular audience measurement, are used only after you have given your consent. We store your selection locally in your browser so that we do not have to ask you again on each visit. You may change or withdraw your selection at any time via the cookie settings.

17. Creation of product texts with the assistance of artificial intelligence

For the creation and translation of product descriptions and marketing texts we use, internally, a service provided by OpenAI Ireland Limited. Only product and text information is processed in this context. Personal data of our customers, in particular names, contact details, order data or licence keys, is not transmitted. No automated decision-making with legal effect in relation to data subjects takes place.

18. Recipients and categories of recipients

We disclose personal data only where this is necessary for the performance of the contract, where we are legally obliged to do so or where you have given your consent. Recipients are:

• our infrastructure and hosting service provider and the provider of our database, each acting as a processor,
• the provider of our document storage (Amazon Web Services EMEA SARL) as a processor,
• the provider of our email dispatch service (Sendinblue SAS, Brevo) as a processor,
• the provider of audience measurement (Google Ireland Limited) on the basis of your consent,
• the provider of the notification service (Telegram) on the basis of your consent,
• our tax adviser and the accounting platform used by them,
• the German Federal Central Tax Office within the scope of the VAT identification number confirmation procedure,
• tax authorities, courts and public authorities insofar as we are legally obliged to provide information,
• lawyers and debt collection service providers for the enforcement of outstanding claims.

We do not disclose your data to third parties for advertising purposes. We do not sell data.

19. Transfers to third countries

Insofar as data is transferred to countries outside the European Union and the European Economic Area, this takes place only on the basis of an adequacy decision of the European Commission, on the basis of the standard contractual clauses pursuant to Art. 46 (2) (c) GDPR or on the basis of your explicit consent pursuant to Art. 49 (1) (a) GDPR. The services concerned and the respective basis are set out in sections 14 and 15.

20. Retention periods

We store personal data only for as long as is necessary for the purposes described or for as long as statutory retention obligations apply. In detail:

• Customer accounts and master data: for the duration of the business relationship; after it ends we delete the data unless a retention obligation applies.
• Order, invoice, credit note and accounting data: ten years pursuant to Section 147 AO and Section 257 HGB, calculated from the end of the calendar year in which they arose.
• Commercial letters and business correspondence: six years pursuant to Section 257 HGB.
• Application logs: 180 days.
• Security logs: 365 days.
• Newsletter data: until withdrawal; evidence of consent for three years thereafter.
• Evidence of VAT identification number verification: within the tax retention period.

Upon expiry of the respective period the data is deleted or, where deletion is not technically possible without disproportionate effort, blocked from further processing.

21. Your rights

Under the GDPR you have the following rights:

• Access to the data processed about you pursuant to Art. 15 GDPR,
• Rectification of inaccurate or incomplete data pursuant to Art. 16 GDPR,
• Erasure pursuant to Art. 17 GDPR, insofar as no retention obligation prevents it,
• Restriction of processing pursuant to Art. 18 GDPR,
• Data portability pursuant to Art. 20 GDPR,
• Objection to processing based on Art. 6 (1) (f) GDPR, pursuant to Art. 21 GDPR,
• Withdrawal of consent given, pursuant to Art. 7 (3) GDPR, with effect for the future.

A message to info@attivita.de is sufficient to exercise these rights. For access and portability requests we provide a structured compilation of the data stored in relation to your account.

22. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. The authority responsible for us is:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia Kavalleriestraße 2–4 40213 Düsseldorf Germany ldi.nrw.de

You may also contact the supervisory authority of your habitual residence or place of work.

23. Obligation to provide data

The information we collect during registration and order processing is necessary for the conclusion and performance of the contract. Without this information we cannot maintain a customer account or process orders. Providing the VAT identification number is additionally necessary for the correct tax treatment. All other information is provided voluntarily.

24. Data security

We take technical and organisational measures to protect your data against loss, alteration and unauthorised access. Transmission takes place exclusively in encrypted form via TLS. Passwords are stored exclusively as cryptographic hashes. Access to customer data is limited to those employees who require it for their duties and is logged. Two-factor authentication is available for customer accounts. Our measures are reviewed regularly and adapted to the state of the art.

25. Responsibility of our customers

If, as a customer, you transmit to us personal data of your employees or contact persons, you are responsible for informing those persons about the processing by us and for ensuring that the necessary legal bases are in place.

26. Changes to this privacy policy

We adapt this privacy policy where our processing activities or the legal framework change. The version published on this page applies in each case. The date of the most recent change can be found at the beginning of this document.