Privacy policy

Controller

Retailyze is a brand of bdg. The controller within the meaning of Art. 4(7) GDPR is better decisions group GmbH, Mittelstraße 3 B, 12529 Schönefeld, Germany, email info@bdg.io, legally represented by Lukas Schomberg, Ina Schwarzenberg and Sabrina Wolter.

Our data protection officer can be reached via heyData GmbH, Schützenstraße 5, 10117 Berlin, Germany, www.heydata.eu, email datenschutz@heydata.eu.

Scope

This policy covers the website research.retailyze.com. What happens with your answers to the survey "The Future of Merchandising" and with an optional follow-up request is described in detail in the separate survey privacy notice.

Hosting

This website runs on a server of Hostinger International Ltd. Server location: [X]. Hostinger processes, on our behalf, the technical data needed to operate the website. The basis is a data processing agreement under Art. 28 GDPR [X – to be confirmed by the DPO] and our legitimate interest in operating the website securely (Art. 6(1)(f) GDPR).

Server logs

Our web server logs requests without IP addresses: only the time, the request method, the requested page without parameters, the result, the size of the response and the processing time. Requests via a personal invitation link are not logged at all.

A separate error log only records critical server errors and may then contain an IP address. Both logs are deleted after two days. Legal basis: our legitimate interest in operating the website securely (Art. 6(1)(f) GDPR).

No tracking, no analytics

This website uses no tracking, no analytics, no advertising and no consent banner. Fonts are hosted on our own server; no content is loaded from third parties.

Cookies and browser storage

We only use technically necessary cookies, and only in the survey: if you were invited, a cookie holds your invitation until you submit your answers (at most 14 days); after you submit, a second cookie remembers for one hour whether to show you the follow-up form. While you fill in the survey, your answers are kept in your browser's session storage and deleted when you submit or close the tab. We do not use local storage. Legal basis: Section 25(2) no. 2 TDDDG and our legitimate interest in providing the survey (Art. 6(1)(f) GDPR).

Survey database

Survey answers and follow-up requests are stored in a database operated by Supabase, hosted in the EU (Frankfurt), on our behalf under a data processing agreement. Answers are stored without any link to your person; details are in the survey privacy notice.

Contact request and bdgSignal

If you ask to be contacted after the survey, we pass your email address, your language and your consent to bdgSignal, the contact management system operated by bdg on its own infrastructure in the EU. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. If you opted in to news, bdgSignal sends you a confirmation email first. We delete your address from the survey database thirty days after this hand-over.

Email delivery

Internal notification emails from the survey (see below) are sent via Mailgun in its EU region, on our behalf under a data processing agreement. [X – provider details and basis for any transfer outside the EEA to be confirmed by the DPO.]

Internal emails, including to the United Kingdom

The Retailyze team receives internal emails: one per contact request (email address, interest, language and news preference – never survey answers) and a regular spreadsheet of the anonymous survey answers. Recipients include employees of the bdg group in the United Kingdom who look after Retailyze. The transfer to the United Kingdom is based on the European Commission's adequacy decision (Art. 45(3) GDPR).

Legal bases

Depending on the processing: your consent (Art. 6(1)(a) GDPR), a legal obligation (Art. 6(1)(c) GDPR) or our legitimate interests (Art. 6(1)(f) GDPR), as stated for each purpose above.

Storage period

Data is deleted as soon as it is no longer needed for its purpose and no statutory retention obligations prevent deletion. Where data has to be kept for other permitted purposes, its processing is restricted and it is not used for other purposes.

No automated decision-making

We do not use automated decision-making within the meaning of Art. 22 GDPR.

Your rights

You have the right to access, rectification or erasure, restriction of processing, objection to processing and data portability, and the right to withdraw consent at any time with effect for the future.

You can complain to a data protection supervisory authority, for example the one in your country of residence or the authority responsible for us: Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.