Effective date:
What This Policy Covers
DeviceBazar respects the confidentiality of personal data and takes appropriate measures to protect it.
This Privacy Policy explains:
- what personal data we collect;
- why and on what legal basis we process it;
- who may receive the data;
- how long we keep it;
- what rights users have;
- how to contact the data controller.
We may also use cookies and similar technologies. Where applicable, their use is described separately in our Cookie Policy.
This Privacy Policy is intended to provide the information required under the General Data Protection Regulation (GDPR), including the information obligations set out in Articles 13 and 14.
Who We Are
When this Policy refers to “DeviceBazar”, “we”, “our” or “us”, it means:
ZLS Services GmbH
Feuerbachstr. 17/19
60325 Frankfurt am Main
Germany
ZLS Services GmbH is the data controller responsible for the processing of personal data described in this Policy.
Commercial Register: HRB 50274, Amtsgericht Frankfurt am Main
VAT ID: DE314486818
Managing Director: Zigura Ievgeniia
Email: office@zls-services.de
Phone: +49 69 26947062
No separate Data Protection Officer or separate privacy email address is confirmed in the current DeviceBazar brief. Until such contact is formally designated, privacy-related requests should be sent to office@zls-services.de.
What We Collect
Depending on how you use the DeviceBazar website and services, we may process the following categories of personal data.
Information You Provide When Placing an Order
When you purchase products or otherwise request our services, we may collect information necessary to process and fulfil the order, including:
- name;
- email address;
- telephone number;
- billing address;
- delivery address;
- country;
- order details;
- product information;
- order and transaction identifiers.
Where relevant to the product or after-sales support, technical product identifiers such as a serial number or MAC address may also be processed.
The DeviceBazar brief confirms the use of serial numbers and MAC addresses in connection with products.
Account Information
If customer accounts are available on the website, information associated with the account may include contact and order information as well as login credentials.
The current brief does not confirm the exact set of information stored in customer accounts, so this section should be adjusted if the final website implementation differs.
Information You Provide Through Forms or Support Requests
When you contact DeviceBazar, submit a form, request assistance, make a return request, or contact customer support, we may process the information you provide, including:
- name;
- email address;
- telephone number;
- order number;
- message content;
- product information;
- photographs or other attachments where relevant.
For returns or damaged/incorrect products, the brief confirms that DeviceBazar may use the order number and photographs to investigate the request.
Payment Information
DeviceBazar accepts bank cards and PayPal.
Payment information required to complete a transaction is processed by the relevant payment service provider.
DeviceBazar may receive transaction-related information such as:
- payment status;
- transaction reference;
- amount paid;
- payment method.
Full payment-card credentials should be processed by the relevant payment provider rather than stored by DeviceBazar unless technically required and legally permitted.
Delivery Information
To arrange delivery, we process information necessary to fulfil the shipment, including:
- recipient name;
- delivery address;
- contact details;
- order information;
- shipment and tracking information.
This information may be shared with the delivery company handling the shipment.
DeviceBazar currently uses logistics providers including DHL, Hermes and FedEx, depending on the selected shipping option and destination.
Website and Technical Data
When you visit the website, certain technical information may be processed automatically, such as:
- IP address;
- browser type and version;
- operating system;
- device type;
- language settings;
- referring page;
- pages visited;
- date and time of access;
- technical logs;
- cookie or similar identifiers, where applicable.
Additional analytics or marketing data may be collected only where the relevant technology is actually enabled and the applicable consent or other legal requirements are satisfied.
The previous reference page mentions Google Analytics and Microsoft Clarity, but these tools are not confirmed as currently active for DeviceBazar in the new brief. They should therefore be named in the published Privacy Policy only after the current website configuration has been verified.
Newsletter Information
If you subscribe to the DeviceBazar newsletter, we may process:
- email address;
- subscription status;
- information required to document consent;
- unsubscribe status.
The current brief identifies Mailchimp as the newsletter/email marketing service.
Lawful Basis and Use of Collected Information
DeviceBazar processes personal data only where there is a valid legal basis under the GDPR.
The applicable legal basis depends on why the data is being processed. Article 6 GDPR includes, among others, processing based on consent, contractual necessity, legal obligations, and legitimate interests.
Performance of a Contract or Steps Before Entering Into a Contract
We process personal data where it is necessary to:
- process and fulfil your order;
- receive and confirm payment;
- arrange delivery;
- communicate with you about the order;
- process returns, refunds, or warranty requests;
- provide customer support;
- take steps requested by you before entering into a contract.
This processing is generally based on Article 6(1)(b) GDPR.
Compliance With Legal Obligations
We process and retain certain information where required to comply with legal obligations, including accounting, tax, commercial, and consumer-protection requirements.
This processing is generally based on Article 6(1)(c) GDPR.
Consent
Where processing requires your prior consent, we rely on Article 6(1)(a) GDPR.
This may include, for example:
- optional analytics or marketing cookies;
- newsletter subscriptions;
- certain direct marketing activities.
You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.
Legitimate Interests
Where permitted by law, we may process data where this is necessary for our legitimate interests or those of a third party and those interests are not overridden by your rights and freedoms.
Depending on the circumstances, such purposes may include:
- preventing fraud and misuse;
- securing the website and IT systems;
- handling and documenting legal claims;
- improving operational processes;
- protecting our legal rights.
Such processing is generally based on Article 6(1)(f) GDPR.
Direct Marketing
Where required, marketing communications are sent only on the basis of valid consent.
If you subscribe to the DeviceBazar newsletter, your information may be processed through Mailchimp for the purpose of sending marketing communications.
You may unsubscribe at any time by using the unsubscribe link included in the email or by contacting us.
How We Share Information We Collect
DeviceBazar does not sell personal data.
We may share personal data with third parties only where this is necessary for the purposes described in this Policy, required by law, or otherwise permitted under applicable data-protection rules.
Payment Providers
Information required to process a payment may be shared with the provider responsible for the selected payment method, including PayPal and the relevant bank-card payment provider.
Only information necessary to process, confirm, refund, or investigate the transaction should be shared.
Delivery Companies
We may share delivery-related personal data with logistics providers responsible for delivering your order.
Depending on the selected shipping service, these may include:
- DHL;
- Hermes;
- FedEx;
- local delivery or postal providers involved in the final delivery stage.
Newsletter Service Provider
Where you subscribe to marketing communications, your information may be processed by Mailchimp as the email marketing platform used by DeviceBazar.
The final Privacy Policy should also include any legally required information about international data transfers if the configured Mailchimp service results in personal data being transferred outside the EEA.
Website, Hosting and IT Providers
Personal data may be processed by service providers that support the technical operation of the website, hosting, security, maintenance, or other IT functions.
Only the information necessary for the relevant service should be made available to such providers.
Analytics and Marketing Providers
If analytics or marketing tools are enabled, relevant technical and usage data may be shared with their providers in accordance with the user's consent and the applicable cookie settings.
As noted above, Google Analytics and Microsoft Clarity should not be listed as confirmed active processors until this is verified for the new DeviceBazar website.
Authorities and Legal Requirements
We may disclose personal data where necessary to:
- comply with a legal obligation;
- respond to a lawful request from an authority or court;
- investigate or prevent fraud;
- establish, exercise, or defend legal claims;
- protect our rights or the rights of others.
Corporate Transactions
Personal data may be transferred where necessary as part of a merger, acquisition, restructuring, sale of assets, or similar corporate transaction, subject to applicable data-protection law.
International Data Transfers
Some service providers may process personal data outside Germany or the European Economic Area.
Where personal data is transferred to a country that is not covered by an adequacy decision of the European Commission, DeviceBazar will use an appropriate transfer mechanism required by the GDPR, such as applicable Standard Contractual Clauses, together with additional safeguards where required.
The exact international-transfer wording should be aligned with the providers actually used on the final website.
How Long We Keep Information
DeviceBazar keeps personal data only for as long as it is necessary for the purpose for which it was collected or for as long as applicable law requires.
GDPR requires storage periods to be limited to what is necessary for the processing purpose.
Order, Contract and Accounting Data
Information relating to orders, invoices, payments, and other business transactions may need to be retained after an order has been completed in order to comply with German commercial and tax law.
Under the current German Commercial Code, accounting vouchers must generally be retained for 8 years, commercial correspondence for 6 years, while certain accounting records are subject to a 10-year retention period.
Personal data contained in those records is therefore retained for the applicable statutory period where required by law.
This is more precise than the old reference wording stating that all contract-related information may simply be kept for “up to ten years.”
Customer Service, Returns and Warranty Information
Information relating to customer support, returns, warranty claims, or complaints is retained for as long as necessary to process the matter and, where appropriate, for an additional period necessary to establish, exercise, or defend legal claims or fulfil statutory record-keeping obligations.
No separate fixed internal retention period for DeviceBazar support or warranty data is confirmed in the brief.
Newsletter Data
Newsletter subscription data is retained for as long as the subscription remains active or for as long as necessary to document the legal basis for the marketing communication.
If you unsubscribe, DeviceBazar will stop sending marketing messages. Limited information may still be retained where necessary to document the unsubscribe request and ensure that further messages are not sent.
Website and Analytics Data
Retention periods for cookies, analytics identifiers, and similar website data depend on the individual technology used.
The specific periods should be listed in the Cookie Policy or the relevant consent settings once the final analytics and marketing services have been confirmed.
Legal Claims
Where personal data is necessary for an actual or potential legal claim, it may be retained until the relevant limitation period has expired or the matter has otherwise been finally resolved.
Once data is no longer required, it will be deleted or anonymised unless further storage is required by law.
Your Rights
Subject to the conditions and limitations provided by the GDPR, you have the following rights regarding your personal data.
Right of Access
You may ask whether DeviceBazar processes personal data concerning you and request information about that processing and a copy of your personal data.
Right to Rectification
You may ask us to correct inaccurate personal data or complete incomplete information.
Right to Erasure
You may request deletion of personal data where the requirements of the GDPR are met.
The right to deletion does not apply where continued storage is required by law or where another applicable legal exception applies.
Right to Restriction of Processing
In certain circumstances, you may request that the processing of your personal data be restricted.
Right to Object
Where processing is based on legitimate interests, you may object to the processing on grounds relating to your particular situation.
Where personal data is processed for direct marketing, you may object to that processing at any time.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw that consent at any time.
Withdrawal applies to future processing and does not affect processing that was lawful before consent was withdrawn.
Right to Data Portability
Where the statutory requirements are met, you may receive personal data you have provided to us in a structured, commonly used, machine-readable format and may request its transmission to another controller.
Right to Lodge a Complaint
You have the right to lodge a complaint with a competent data-protection supervisory authority if you believe that the processing of your personal data infringes applicable data-protection law.
You may in particular contact the supervisory authority responsible for ZLS Services GmbH in Germany or the competent supervisory authority in your place of residence or work.
Automated Decision-Making
You have the rights provided by GDPR in relation to decisions based solely on automated processing, including profiling, where such decisions produce legal or similarly significant effects.
The current DeviceBazar brief does not confirm that such automated decision-making is used, so the new policy should not imply that DeviceBazar currently operates this type of system.
How We Protect Personal Data
DeviceBazar uses appropriate technical and organisational measures designed to protect personal data against:
- unauthorised access;
- unlawful processing;
- accidental loss;
- destruction;
- alteration;
- unauthorised disclosure.
Security measures are reviewed as appropriate in light of the nature of the processing and the risks involved.
However, no method of transmission or electronic storage can guarantee absolute security.
DeviceBazar does not sell your personal data.
Our Policy Towards Minors
DeviceBazar's products and services are not specifically directed at children.
We do not knowingly seek to collect personal data from children where such processing would require consent that cannot validly be provided under applicable law.
If we become aware that personal data has been collected unlawfully from a minor, we will take appropriate steps to delete or otherwise lawfully process that information.
Cookies
DeviceBazar may use cookies and similar technologies for functions such as:
- essential website operation;
- remembering user preferences;
- analytics;
- marketing, where applicable.
Non-essential cookies or comparable technologies should only be used where the applicable legal requirements, including consent requirements, have been satisfied.
Detailed information about the technologies used, their providers, purposes, and storage periods should be provided in the separate Cookie Policy.
The current brief does not confirm whether the consent platform blocks analytics or marketing technologies until consent is obtained, so this technical behaviour should be verified before publication.
Changes to Our Privacy Policy
DeviceBazar may update this Privacy Policy from time to time, for example where:
- legal requirements change;
- website functionality changes;
- new service providers are introduced;
- the purposes or methods of processing change.
The current version and its effective date will be published on the website.
Where required by law, users will be informed of material changes.
Contact Information
If you have any questions about this Privacy Policy, wish to exercise your data-protection rights, or have a complaint concerning the processing of your personal data, please contact us.
Controller
ZLS Services GmbH
Feuerbachstr. 17/19
60325 Frankfurt am Main
Germany
Email: office@zls-services.de
Phone: +49 69 26947062
Managing Director: Zigura Ievgeniia