Privacy policy

This is a convenience translation. Only the German version is legally binding.

Last updated: [privacy.effectiveDate.en]

In this privacy policy we inform you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), which personal data we process when you use our website, our portals, our apps or our interface (API), for which purposes and on which legal basis we do so, and which rights you have.

1. Controller

The controller responsible for data processing is:

[company.name] [company.legalForm]
[company.street]
[company.zip] [company.city]
[company.country.en]
Email: [company.email]
Phone: [company.phone]

For any questions about data protection, please contact us at [privacy.contactEmail].

2. Overview: what Handl is and whom this policy concerns

Handl is a marketplace for goods and services from local providers ("providers"). Customers ("customers") order through the "Handl" app or through apps of our partner companies that are connected to our interface ("partner apps"). Providers handle orders in the provider portal and in the "Handl Orders" app. Partners manage their integration in the partner console.

This policy therefore concerns:

• visitors to our website,
• persons applying to become a provider or a partner,
• users of the provider portal, the "Handl Orders" app and the partner console,
• customers who create a customer account, request quotes or place orders through the "Handl" app or a partner app.

If you use a partner app, the respective partner company is responsible for processing within that app (for example its own accounts, analytics or advertising); please refer to its privacy notice. This policy describes processing by Handl.

3. Visiting our website

3.1 Server logs

When you access our website and portals, our hosting provider necessarily processes the following data: IP address, date and time of access, requested address, amount of data transferred, HTTP status code, browser type and version, operating system (user agent) and, where applicable, the previously visited page (referrer).

The purpose is to deliver the website, ensure its stability and security, and prevent and investigate attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure and functional operation. The logs are deleted after 30 days at the latest, unless they are needed longer in an individual case to investigate a security incident.

3.2 Cookies and similar storage technologies

We do not use analytics, tracking or advertising cookies or any similar technologies for these purposes. We only use cookies and storage on your device (for example the browser's local or session storage) that are strictly necessary to provide the functions you have expressly requested — for instance, to keep you signed in, or to remember your language or the view you last selected. The legal basis for accessing your device is Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), and for subsequent processing Art. 6(1)(b) or (f) GDPR. No consent is required for this.

3.3 Fonts

The fonts used on our website are served from our own server. No connection to font providers' servers is made when a page is loaded.

4. Applying as a provider or a partner

You can apply to become a provider or a partner through the forms on our website.

• Provider application: name of the business, legal name (company), email address, optionally a phone number and a description of your offering.
• Partner application: name of the company or app, contact email address, a description of the intended use and the access rights requested.

We use this information to review your application, contact you and — if accepted — set up your account. When a provider application is accepted, we send a link to the email address provided so that you can set up your access. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). If an application is rejected, we delete the information six months after the rejection, unless a statutory retention obligation applies.

5. Signing in to the provider portal, "Handl Orders", the partner console and the administration console

To sign in providers, partners and our own staff, we use an authentication service of a cloud provider. This involves processing your email address, a password hash, sign-in times, technical identifiers of your account and session, and your IP address. Your account's role (for example provider or partner) is assigned to the account so that you only see the areas intended for you.

Before particularly consequential actions, such as closing an account, we ask for your password again; our server checks that you signed in no more than five minutes ago.

The purpose is secure identification and access control. The legal basis is Art. 6(1)(b) GDPR (performance of the contract with providers and partners) or Art. 6(1)(f) GDPR (protection of our systems). Sign-in data is deleted when the associated account is finally deleted (see section 15).

6. Provider portal and "Handl Orders" app

In the provider portal, providers maintain their business (name, address, contact details, logo, opening hours, delivery and service areas, appointment calendar, offers and prices) and handle orders and quote requests. With "Handl Orders", providers respond to orders on their smartphone. We process the business's information, the accounts of linked staff (name, email address) and records of who accepted, changed, declined or refunded an order.

For payouts, providers set up a payout account with our payment service provider; the payment service provider itself collects the identity verification and bank details required for this (see section 9).

Providers can subscribe to external calendars (iCal addresses) and block times so that Handl does not offer appointments in busy times. The entries may have titles containing personal data of third parties. We process this data on behalf of the provider under Art. 28 GDPR; the provider is the controller (data processing agreement for businesses).

For orders where the provider travels to the customer, the portal shows a map with the route. For this, addresses or coordinates are sent to a geocoding service and a routing service, and your browser loads map tiles from a map service (see section 12).

The legal basis is Art. 6(1)(b) GDPR (contract with the provider); where data of the provider's staff is concerned, Art. 6(1)(f) GDPR (legitimate interest in organising the business and keeping orders traceable).

7. Customer account

7.1 Sign-in by email code

In the "Handl" app and in partner apps that use our sign-in, you sign in with your email address. We send you a one-time code that is valid for ten minutes. After successful sign-in your device receives an access key; you stay signed in for up to 60 days after last use. You can see in the app which devices you are signed in on and end individual or all sessions.

We process your email address, whether you have verified it, optionally your name, phone number and preferred language, saved addresses, your sessions (time of creation and last use, and a device label where applicable) and, to prevent abuse, the IP address used to request a code.

7.2 Sign-in through a partner app

Some partner apps have their own customer accounts. In that case the partner company confirms your identity to us and sends us the identifier under which you are registered there, your email address and, where applicable, your name. We therefore receive this data not from you but from the partner company (Art. 14 GDPR).

7.3 Purpose and legal basis

We process this data to provide you with a customer account, to assign orders and quote requests to you and to show you your order history and receipts. The legal basis is Art. 6(1)(b) GDPR; we process the IP address to prevent abusive code requests on the basis of Art. 6(1)(f) GDPR.

Your customer account belongs to the app through which you created it. An account in the "Handl" app and an account in a partner app are separate accounts.

8. Orders, appointments and quote requests

8.1 What data we process

When you order, we process: the goods or services ordered, quantities and prices, the chosen method of fulfilment (pickup, delivery, service at your place or at the provider's), delivery or service address, billing address, name, email address, optionally phone number, the chosen appointment, the order status and its history, and changes to the address or appointment (who made them and when).

For a quote request we additionally process your description of the job and the quote the provider then makes you.

8.2 Disclosure to the provider

The provider fulfilling your order receives the information it needs for this: order contents, appointment, name, address(es), email address and — if provided — phone number. The provider uses this data under its own responsibility to fulfil the order.

8.3 Disclosure to the partner app

If you ordered through a partner app, the partner company receives the order data (including status, changes and appointment) so that it can show you the order in its app and keep you informed of its progress.

8.4 Purpose and legal basis

The purpose is to process your order, schedule appointments, issue invoices and handle cancellations, refunds and complaints. The legal basis is Art. 6(1)(b) GDPR; for invoicing and retention, Art. 6(1)(c) GDPR in conjunction with commercial and tax law.

9. Payment processing

We process payments through a payment service provider. You enter your payment details (for example your card number) directly in the payment service provider's payment form; we do not receive them. We send the payment service provider the invoice amount, invoice items, your name, your email address and the address relevant for VAT. On our behalf, the payment service provider issues the invoice, calculates VAT and carries out refunds.

The payment service provider also processes data under its own responsibility, in particular for fraud prevention and to comply with anti-money-laundering obligations. This also applies to identity verification of providers and partners when they set up their payout account.

The legal basis is Art. 6(1)(b) and (c) GDPR.

10. Emails

We send emails through an email delivery service provider, for example sign-in codes, access links for providers, notifications to providers about new orders and quote requests, and notices about your account. If you ordered through a partner app, emails may appear under that app's name. The legal basis is Art. 6(1)(b) GDPR. We do not send marketing emails.

11. Push notifications

If you allow it on your device or in your browser, we send you push notifications — to providers for example when a new order arrives, to customers for example when an order's status changes. For this we store a device identifier (push token) assigned by the operating system or browser and the device's platform; delivery takes place via Firebase Cloud Messaging (provider portal, "Handl Orders"), Expo's push service (the "Handl" app) and the push service of the operating system vendor.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you give through your device's permission prompt. You can withdraw it at any time in your device or browser settings. Device identifiers that have become invalid are deleted automatically; they are removed when you sign out or the account is closed.

12. Location, maps and address resolution

12.1 Location in the "Handl" app

The "Handl" app only asks for your location when you tap "Use location", and only while the app is open (no background access). An approximate location is determined and sent to our server, which derives the postcode and town from it. We do not store the location itself on our servers; the postcode or town determined is stored on your device so that we can show you suitable offers. You can also enter the postcode manually.

The legal basis is your consent through your device's permission prompt (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time in your device settings.

12.2 Address resolution and routes

To check whether an address lies within a provider's delivery or service area, and to show providers a route, we send addresses or postcodes and coordinates to geocoding and routing services based on OpenStreetMap. The legal basis is Art. 6(1)(b) GDPR.

12.3 Map display

Maps in the provider portal and in the administration console are assembled from map tiles of an OpenStreetMap map service, which your browser loads directly from its servers. This service thereby receives your IP address and the information which map section was loaded. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in presenting service areas and routes to providers in an understandable way.

13. Interface (API): request and webhook logs

Partners access Handl through our interface. We log each request with its time, endpoint, method, response code, response time and environment (test or live) and assign it to the respective partner. To limit the request rate we also briefly process the IP address of the requesting device.

We inform partners and — on request — providers of events such as new or changed orders by webhook. We store each delivery with its content (which may contain order data), its delivery status and the recipient's response.

The purpose is secure operation of the interface, billing, proof of delivery and troubleshooting. The legal basis is Art. 6(1)(b) and (f) GDPR. Request and webhook logs are deleted after 400 days, so that a full billing year remains traceable.

14. Hosting and recipients

We operate our servers and databases with a cloud provider in the European Union. Images uploaded by providers are also stored there.

We use the following categories of processors, with whom we have concluded contracts under Art. 28 GDPR: cloud hosting and databases, authentication service, file storage, push service, payment service provider (insofar as it acts on our behalf), and email delivery service provider. We calculate driving routes with a self-operated routing service on our servers at Google Cloud; for geocoding and map tiles see section 12.

In addition, data is received by: the provider fulfilling your order (section 8.2), the partner company through whose app you ordered (section 8.3), the payment service provider under its own responsibility (section 9), and tax advisors, auditors and authorities where we are legally obliged.

Some of these service providers are based outside the European Union or the European Economic Area or may transfer data there, in particular to the USA. In these cases the transfer is based on an adequacy decision of the European Commission (for the USA: the EU-U.S. Data Privacy Framework, insofar as the recipient is certified) or on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). You can obtain a copy of the safeguards on request at [privacy.contactEmail].

The individual service providers, with their seat and the basis for any transfer, are listed under recipients and subprocessors. How we protect your data is described in the technical and organisational measures.

15. Retention periods

We store personal data only as long as necessary for the respective purpose. In detail:

• Sign-in codes expire after ten minutes; sessions end at the latest 60 days after last use or when you sign out.
• Server logs are deleted after 30 days, request and webhook logs after 400 days.
• Backups are overwritten after seven days; deleted data disappears from backups at the latest by then.
• Customer accounts are deleted at your request. Your account data, saved addresses and sessions are deleted and the account is anonymised so that it can no longer be used to sign in.
• Provider and partner accounts: When an account is closed, it can no longer be used immediately, but it can be restored on request within 30 days. After these 30 days the business's details are anonymised, content no longer needed (for example images, calendars, service areas) is deleted, the accesses of linked users are deleted and — for partners — the customer accounts created through the partner app are deleted.
• Orders, invoices, credit notes, refunds, statements and payout records are kept — even after an account is deleted — for as long as statutory retention periods require, in particular under Section 257 HGB (German Commercial Code) and Section 147 AO (German Fiscal Code) (currently up to ten years). The recipient's name and address on invoices remain unchanged, because an invoice may not be altered afterwards. During this time this data is blocked for other purposes.
• Applications that are not accepted are deleted six months after the rejection.

16. Your rights

Subject to the statutory requirements, you have the right to:

• access the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw consent you have given, with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, a message to [privacy.contactEmail] is sufficient. If you ordered through a partner app, you can also contact the partner company; it will forward your request to us.

17. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The supervisory authority responsible for us is:

[privacy.supervisoryAuthority]
[privacy.supervisoryAuthorityAddress]

18. Obligation to provide data and automated decisions

We need the information marked as required for an order, a customer account or an application in order to conclude and perform the contract. Without it we cannot process the order or application. There is no solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

19. Changes

We adapt this privacy policy when our processing or the legal situation changes. The version published here applies.