Privacy Policy

We are pleased about your interest in our website. Protecting your personal data is important to us. Below we inform you, pursuant to Art. 13 GDPR, about the processing of personal data when using this website.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Loop24 Stores GmbH, Breite Gasse 7, 71032 Böblingen, Germany, Email: info@loop24-stores.de

2. Your Rights as a Data Subject

You generally have the following rights against us with regard to your personal data: the right to access (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to restriction of processing (Art. 18 GDPR), the right to data portability (Art. 20 GDPR) and the right to object to processing (Art. 21 GDPR). Please contact us at the email address given above to exercise these rights.

You also have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data (Art. 77 GDPR). The competent supervisory authority is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany, Phone: +49 711 615541-0, Email: poststelle@lfdi.bwl.de.

3. Hosting and Server Log Files

This website is hosted by the hosting provider Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you access our website, Vercel automatically collects technical access data (so-called server log files), including your IP address, the date and time of access, the page accessed, the amount of data transferred, and your browser type and version.

This processing takes place to ensure the trouble-free and secure operation of the website (e.g. error analysis, detection of misuse) on the basis of our legitimate interest pursuant to Art. 6 (1) lit. f GDPR. Storage takes place in accordance with the standard retention periods of our hosting provider.

As Vercel Inc. is based in the USA, personal data may be transferred to a third country as part of the hosting service. Any such transfer only takes place on the basis of appropriate safeguards within the meaning of Art. 46 GDPR (e.g. EU Standard Contractual Clauses or certification under the EU-U.S. Data Privacy Framework), to the extent provided by the provider.

4. Cookies

This website uses a single cookie ("NEXT_LOCALE") that stores your selected language setting (German/English) so that the page is displayed to you in your last selected language on your next visit. This cookie is technically necessary for the operation of the multilingual website.

Storage takes place on the basis of Sec. 25 (2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). As this is a technically necessary cookie, no consent is required for it.

Beyond this, this website does not use any cookies, tracking tools, or analytics tools (e.g. Google Analytics).

5. Contact Form

You can use the contact form in the "Contact" section to send us a message. The form opens your local email program and transmits your entries directly by email to info@loop24-stores.de; your data is not processed or stored on our server or in a database in the process.

Alternatively, you can contact us directly by email at info@loop24-stores.de at any time.

6. Partner Inquiries (Vending Machine Hosting and Location Suggestions)

Using the forms in the "Partners" section, you can submit an inquiry about hosting a vending machine at your location, or suggest a possible location to us. Depending on the form, we collect name, company, email address, phone number, and message, as well as – for location suggestions – details on the available space, indoor/outdoor location, power supply, and estimated customer footfall.

Your details are transmitted to our server in encrypted form and stored in our database (Supabase, server location Paris/EU) in order to process your inquiry and get in touch with you. The legal basis is Art. 6 (1) lit. b GDPR (pre-contractual measures taken at your request) or Art. 6 (1) lit. f GDPR (our legitimate interest in processing incoming business inquiries).

Your IP address is used exclusively temporarily in working memory when submitting the form to prevent misuse (rate limiting) and is not stored in our database.

If your inquiry does not lead to a contract and remains unanswered or without further follow-up, we delete your data no later than 6 months after receipt of the inquiry. If a contract is concluded, we process your data within the scope of the contractual and statutory (in particular commercial and tax law) retention obligations.

7. Location Map

The directions to our location are embedded on our website as a static image, without establishing a connection to Google's servers. The link "Open in Google Maps" will take you – if you click on it – to the external Google Maps website. From that point onward, Google's privacy policy (Google Ireland Limited or Google LLC) applies. Until you click this link, no data is transmitted to Google via the location map.

8. Product Vote ("Dein Produktwunsch")

On our website you can vote on product suggestions that we put up for selection. No registration is required.

Voting. When you vote, we process your IP address exclusively in the form of a salted hash value that cannot be reversed. We use it solely to prevent multiple votes and to protect the vote against misuse. The IP address itself is not stored. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the integrity of the vote and in preventing abusive use (cf. Recitals 47 and 49 GDPR). We delete the hash values no later than 14 days after the end of the respective voting round; after that, only the plain number of votes remains, without any personal reference. No profiling takes place. You may object to the processing under Art. 21 GDPR; however, participation in the vote is then technically not possible.

Storage on your device. For the vote we do not store any information on your device and do not access any information stored there.

Recipients. The information in Section 9 "Recipients and Processors" applies.

9. Recipients and Processors

To provide our services, we use the following service providers, who process your data exclusively on our instructions: Vercel Inc. (USA) for website hosting, Supabase Inc. (server location Paris/EU) for storing inquiry data, and checkdomain GmbH for email delivery. Your data is not otherwise disclosed to third parties unless we are legally obliged to do so.

10. No Automated Decision-Making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

11. Changes to this Privacy Policy

We reserve the right to amend this privacy policy as soon as the legal situation, the website, or the underlying data processing changes. The version current at the time of your visit shall apply.