GDPR / DSGVO Compliant

Privacy Policy

Information on the collection, processing, and use of your personal data in accordance with the European General Data Protection Regulation (GDPR) and German Federal Data Protection Act (BDSG).

Effective: October 2026

Table of Contents

1. Name and Contact Details of the Data Controller 2. Overview of Data Processing & Data Subjects 3. Legal Bases for Processing (Art 4. Technical Security & SSL/TLS Encryption 5. Cloud Infrastructure & Hosting (Google Firebase / GCP)6. Merchant Account Registration 7. Contact Form & Merchant Support 8. Newsletter Subscriptions 9. Essential Cookies & Local Storage 10. Your Rights as a Data Subject

1. Name and Contact Details of the Data Controller

The data controller responsible for data processing on this website within the meaning of Art. 4 No. 7 GDPR is:

ShopLokalo Technologies

Berlin, Germany

info@shoplokalo.com

+49 152 1234 5678

For any questions regarding data protection or the assertion of your data subject rights, you may contact us at any time using the contact details above.

2. Overview of Data Processing & Data Subjects

The use of our services involves the processing of the following categories of personal data:

Inventory and Master Data: First and last name, business/kiosk name, address, retail industry.
Contact Details: Email address, phone number, WhatsApp contact.
Content Data: Store catalog items, descriptions, prices, opening hours, store photos uploaded by merchants.
Usage and Metadata: Access timestamps, pages viewed, QR code scans, browser specifications, operating system, pseudonymized IP addresses.

Categories of Data Subjects: Registered merchants (kiosk owners, store managers), website visitors, and shoppers scanning in-store QR codes.

3. Legal Bases for Processing (Art. 6 GDPR)

We process personal data strictly in compliance with the legal provisions of the GDPR:

Art. 6(1)(b) GDPRPerformance of a contract and pre-contractual requests (e.g. merchant onboarding, digital storefront hosting).

Art. 6(1)(a) GDPRConsent (e.g. voluntary newsletter subscription).

Art. 6(1)(f) GDPRLegitimate interests (e.g. IT system integrity, fraud prevention, technical diagnostics).

Art. 6(1)(c) GDPRLegal obligations (e.g. commercial and fiscal statutory retention periods).

4. Technical Security & SSL/TLS Encryption

To protect the transmission of confidential data across all devices, ShopLokalo employs end-to-end SSL/TLS encryption (minimum 256-bit). You can identify an encrypted connection by the https:// prefix and the padlock icon in your browser address bar.

Passwords are never stored in clear text and are securely salted and hashed via the Google Firebase Authentication suite.

5. Cloud Infrastructure & Hosting (Google Firebase / GCP)

We host our platform, authentication systems, and cloud databases (Firestore) using Google Firebase / Google Cloud Platform (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

Our database instances are located in Frankfurt, Germany (EU region: europe-west3), ensuring strict European data residency. We have entered into an Article 28 GDPR Data Processing Agreement (DPA) incorporating standard contractual clauses (SCC).

6. Merchant Account Registration

When creating a merchant account on ShopLokalo, we collect your name, email address, and store business name. This data is strictly used to authenticate and administer your store dashboard.

Google Sign-In: You may optionally register using Google OAuth 2.0. Google transmits your name, email, and avatar. We never receive or store your Google account password.

7. Contact Form & Merchant Support

If you submit an inquiry via our contact form or support email, your provided details (name, email, phone, topic, and message) are stored to process your inquiry and attend to subsequent questions (Art. 6(1)(b) & (f) GDPR).

We do not share your inquiry data with unauthorized third parties without your explicit permission.

9. Essential Cookies & Local Storage

Our website uses strictly technically necessary cookies and local storage tokens (e.g. NEXT_LOCALE to store your language preference and session tokens for logged-in merchants).

We do not deploy invasive third-party advertising or cross-site tracking cookies. You can manage or disable cookie storage at any time through your browser settings.

10. Your Rights as a Data Subject

Under GDPR regulations, you have the following enforceable rights at any time:

Right of Access (Art. 15 GDPR): Request complete information regarding your personal data stored with us.

Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete data.

Right to Erasure (Art. 17 GDPR): Request deletion of your data unless statutory retention obligations apply.

Restriction of Processing (Art. 18 GDPR): Demand limitation of data processing under certain conditions.

Data Portability (Art. 20 GDPR): Receive your personal data in a structured, machine-readable format.

Right to Object (Art. 21 GDPR): Object at any time to processing based on legitimate interests.

Right to Lodge a Complaint (Art. 77 GDPR): You have the right to lodge a complaint with a competent supervisory authority in the EU.

Have Questions About Privacy?

Our data privacy team will gladly address any questions or data requests.

Contact Privacy Team