Privacy Policy

This website does not use cookies, analytics or advertising trackers. Personal data is processed only to deliver the site and to answer your enquiries.

Last updated: 8 October 2026

1. Controller

shopbox GmbH
Friedrich-List-Platz 1
04103 Leipzig, Germany
Managing Director: Paul Komoszki

You can reach us at info@shopbox.de or via the contact form. Further details are in the legal notice.

2. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (“Vercel”). When you visit the site, Vercel’s servers automatically process the data your browser transmits: IP address, date and time of the request, requested URL, referrer, browser type and version, and operating system. This data is needed to deliver the pages, to keep the service secure and to diagnose faults; it is not merged with other data sources.

Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in a secure and reliable website. Log data is deleted by Vercel after a short period. We have concluded a data processing agreement with Vercel. Vercel is certified under the EU-U.S. Data Privacy Framework; in addition, the EU Standard Contractual Clauses apply to any transfer to the USA.

3. Contact form

When you use the contact form, we process the data you enter (name, e-mail address, subject, message) in order to handle your enquiry. The message is delivered to our mailbox via the e-mail service Resend Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, with which we have concluded a data processing agreement; sending is routed through Resend’s EU region.

Legal basis: Art. 6 (1) (b) GDPR where the enquiry relates to a contract or pre-contractual steps, otherwise Art. 6 (1) (f) GDPR, our legitimate interest in answering enquiries. We keep your enquiry for as long as needed to process it and for any follow-up questions, and delete it afterwards unless statutory retention periods apply.

4. Cookies, analytics and third-party content

This website sets no cookies and uses no web analytics or advertising services. Fonts are served from our own hosting; no connection to Google Fonts or other external content providers is established when you load a page.

5. Your rights

  • Access to your personal data (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR)
  • Lodging a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Saxon Data Protection and Transparency Commissioner (Sächsischer Datenschutz- und Transparenzbeauftragter), Dresden.

To exercise your rights, contact us using the details above.

6. Security

All pages are delivered via TLS (HTTPS), so data you send through the contact form is encrypted in transit.