Legal

Privacy policy

Last updated: October 2026

Contents

Controller and contact
Overview and legal bases
Hosting, server logs and security
Cookies, consent and cookie settings
Customer account, login and guest orders
Orders, delivery, downloads and licence transfers
Payment and credit checks
Business customers and purchase on invoice
Contact, forms and customer service
Emails and newsletter
Protection against abuse (reCAPTCHA)
Analytics and marketing (only with consent)
Trusted Shops and customer reviews
Links to social networks
Transfers to third countries
Storage periods
Your rights

1. Controller and contact

The controller responsible for processing your personal data in this online shop is:

Allwarehouse24 GmbH
Papenreye 63
22453 Hamburg
Germany
Telephone: 040 524797313 (Mon–Fri 10–19 hrs)
Email: support@software-dealz.de

If you have questions about data protection, you can reach us using these contact details. We have not appointed a data protection officer because the statutory requirements for doing so are not met.

2. Overview and legal bases

We process personal data only to the extent that this is permitted. The legal bases are in particular:

Art. 6(1)(a) GDPR (consent), e.g. for analytics and marketing, newsletter;
Art. 6(1)(b) GDPR (contract and pre-contractual measures), e.g. order, delivery, customer account, enquiries;
Art. 6(1)(c) GDPR (legal obligations), e.g. retention under tax and commercial law, handling of a withdrawal;
Art. 6(1)(f) GDPR (legitimate interests), e.g. secure operation of the shop, protection against abuse, enforcement of claims.

We store or read information on your device (e.g. cookies) under § 25(1) TDDDG only with your consent, unless it is strictly necessary for the service you have requested (§ 25(2) no. 2 TDDDG).

We need the details that we mark as mandatory in the ordering process for the contract; without them we cannot fulfil the order. We do not take any decision based solely on automated processing within the meaning of Art. 22 GDPR; for credit checks by payment providers see section 7.

3. Hosting, server logs and security

Our shop runs at Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, in a data centre in Germany. A data processing agreement exists with AWS (Art. 28 GDPR). Access by the US parent company cannot be ruled out (see section 15).

Until the switch in November 2026, our shop ran at Shopify (Shopify International Limited, Dublin, Ireland). We transferred customer accounts and orders from there to the new shop (Art. 6(1)(b) and (f) GDPR). We will delete the Shopify account as soon as the switch is complete.

Each time you visit, our servers automatically store access data: IP address, date and time, page accessed, amount of data transferred, browser and operating system, and the page visited previously. This serves the secure and stable operation of the shop and the defence against attacks (Art. 6(1)(f) GDPR). The connection to the shop is encrypted with TLS.

Audience measurement without cookies: We measure how our shop is used with our own statistics on our own servers. What is recorded: pages accessed, the page visited previously, details of browser, operating system and device, and shop events such as shopping basket, search and purchase (for a purchase only the order value, the number of items and whether you have ordered from us before). No cookies are set and nothing is stored on your device. Your IP address is processed only briefly, in order to form a hash value from it together with details of your browser and a random value that changes monthly, and to determine country, region and city; it is not stored in the statistics. We do not pass the data on. The legal basis is our legitimate interest in a data-minimising evaluation of our offering (Art. 6(1)(f) GDPR).

4. Cookies, consent and cookie settings

We set technically necessary cookies so that the shop works, for example for the shopping basket, login and your cookie selection (§ 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR).

We set all other cookies and comparable technologies only with your consent. We manage your selection with Usercentrics (Usercentrics GmbH, Munich). What is stored: your selection, a consent ID, date and time and browser information, so that we can prove consent (Art. 6(1)(c) GDPR).

Withdrawal: You can change or withdraw your consent at any time with effect for the future, via the fingerprint icon at the bottom left or by email to us.

If you decline analytics and marketing, Google services receive only cookieless signals without identifiers (e.g. that a page view took place), which are not attributed to any user (advanced Consent Mode).

5. Customer account, login and guest orders

For a customer account we store your salutation, your name, your email address, your addresses, for businesses the company name and the VAT identification number, and your orders (Art. 6(1)(b) GDPR). In the account you will find orders, invoices, product keys and downloads.

You log in with a code that we send you by email. If you wish, you can additionally secure your login with an authenticator app. For this we process your email address, the code and details of the login attempt such as time and browser (Art. 6(1)(b) and (f) GDPR).

Stay logged in: If you tick “Stay logged in for 30 days”, you stay logged in on your device for 30 days, even after closing the browser. For this we store the technically necessary cookie “__Host-remember-login” with a random key on the device and a verification value for it in your customer account. The cookie contains no personal data and is not passed on to third parties. It is valid for 30 days from login with the code; after that you log in again once with a code. After each automatic login, we set the auxiliary cookie “remember-login-bounce” for 15 seconds (§ 25(2) no. 2 TDDDG, Art. 6(1)(b) GDPR). We delete the cookie and the verification value after these 30 days, or earlier if you log out, select “Log out on all devices” in the account or delete your account.

You can also order without a customer account and later transfer earlier guest orders to a customer account using an email code.

We delete your customer account on request; a message to us is enough. Data that we must retain for legal reasons we block until the deadlines have expired.

6. Orders, delivery, downloads and licence transfers

To process an order, we process your order, address, contact and payment data (Art. 6(1)(b) GDPR).

Digital delivery: We send product keys and download links by email and make them available in your customer account.
Licence transfers (e.g. client access licences): For the transfer document we process name, company, address, order number and the licences transferred. Service providers in the EU who work on our behalf support us in this.
Data carriers (USB stick, DVD): For packaging and dispatch we pass on your name, where applicable the company, the delivery address, your email address and the product and quantity to our shipping service provider. Deutsche Post receives name and delivery address.

7. Payment and credit checks

We process online payments via Stripe Payments Europe, Ltd., Dublin, Ireland. Stripe processes the data needed for the payment (name, email address, billing address, amount, payment data) and checks payments for fraud (Art. 6(1)(b) and (f) GDPR). The Stripe app that connects our shop with Stripe receives the complete order data for payments, refunds and cancellations (details as in section 13). Depending on the payment method, the respective provider additionally receives the necessary data and acts as an independent controller for it, e.g. Klarna, Billie (invoice purchase for businesses), Apple Pay, Google Pay or Amazon Pay.

Credit check: If you choose Klarna or Billie, the provider checks your identity and creditworthiness and decides on the payment method. Its privacy notices, which are displayed during the payment process, apply.

For prepayment, our bank processes your transfer data.

8. Business customers and purchase on invoice

For the business customer programme we process the details from your application (company, legal form, address, contact person, contact details, VAT identification number, sector) and the uploaded proof, such as a trade licence or commercial register extract (Art. 6(1)(b) GDPR). We delete the proof 30 days after our decision on the application.

From the Business Pro tier, we approve orders on invoice automatically if the invoice limit, open invoices and order quantity allow it. All other invoice orders are reviewed by an employee; there is no rejection based solely on automated processing (Art. 6(1)(b) and (f) GDPR). For the tier of your account, we evaluate your paid turnover of the last 365 days.

9. Contact, forms and customer service

If you contact us by email, telephone or via a form (contact, complaint, quote request, withdrawal, business customer application), we process your details in order to handle your request (Art. 6(1)(b) GDPR; for a withdrawal Art. 6(1)(c) GDPR). With the complaints form you can upload a screenshot of the error message; please redact any data on it that we do not need.

10. Emails and newsletter

We send order, delivery and service emails via our hosting provider (section 3). We keep copies of these emails for 90 days in order to trace delivery problems and answer your enquiries (Art. 6(1)(b) and (f) GDPR).

Newsletter: With your consent (Art. 6(1)(a) GDPR), we send you offers and news about software. You confirm your subscription via a link in an email (double opt-in); we store the time as proof. You can unsubscribe at any time via the link in every email or by message to us.

Omnisend: We send newsletters and promotional emails with Omnisend (UAB Omnisend, Vilnius, Lithuania), which works on our behalf. Omnisend receives your email address, your name and your newsletter status. For every order, even without a subscription, Omnisend also receives the products bought, the amount and the date (Art. 6(1)(f) GDPR). You receive promotional emails only with a subscription.

11. Protection against abuse (reCAPTCHA)

We protect our forms against spam and automated attacks with Google reCAPTCHA v3 (Google Ireland Ltd., Dublin, Ireland). reCAPTCHA is only loaded when you use a form and checks, on the basis of IP address, browser information and interactions, whether the input comes from a human (Art. 6(1)(f) GDPR; § 25(2) no. 2 TDDDG). If a form does not work because of this, you can reach us by email or telephone.

12. Analytics and marketing (only with consent)

We use the following services only if you have consented in the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). We manage them via Google Tag Manager (Google Ireland Ltd.) and a service from Stape (Stape Inc., USA), which runs for us in Germany as a processor. Access from the USA cannot be ruled out (see section 15). Stape forwards data only to the services to which you have consented.

Google Analytics 4 (Google Ireland Ltd.): audience measurement and analysis of shopping behaviour, e.g. pages accessed, products viewed, shopping basket and purchases. Cookies: “_ga”, “_ga_L1VYNQSSGK”, “FPID”, “FPLC” and “FPGSID”.
Google Ads (Google Ireland Ltd.): measurement of advertising success and remarketing. For a purchase, we additionally transmit email address, telephone number (where available), name and address so that Google can attribute the purchase to an ad (enhanced conversions); according to its own information, Google converts this data into hash values before storing it. Cookies: “FPAU”, after a click on an ad “FPGCLAW”, from doubleclick.net “IDE”.
Microsoft Advertising (Microsoft Ireland Operations Ltd., Dublin): measurement of advertising success and remarketing via the UET tag and server-side. For a purchase we transmit email address and, where available, telephone number only as a hash value (enhanced conversions). Cookies: “_uetsid”, “_uetvid” and “uet_vid”, after a click on an ad “_uetmsclkid” and “uet_msclkid”, from bing.com “MUID”, “MR” and “SRM_B”.
Microsoft Clarity (Microsoft Ireland Operations Ltd.): heatmaps and session recordings from mouse movements, clicks and scrolling, in order to improve usability. Texts and inputs are not recorded. Cookies: “_clck” and “_clsk”, from clarity.ms “CLID”, “MUID”, “MR”, “SM” and “ANONCHK”.
ThoughtMetric (ThoughtMetric Inc., Boston, USA): evaluation of which marketing channels lead to purchases. For a purchase we transmit customer number and email address for this purpose. The basis for the transfer to the USA is standard contractual clauses of the EU Commission. Cookie: “__thoughtmetric_uid”.
Awin (AWIN AG, Berlin): affiliate network. We only use Awin if you have consented to the service “AWIN” (category Marketing) in the cookie banner. If you come to us via a partner, the click is stored so that the partner receives a commission on a purchase. The cookies are set by our own server on our domain: “awin_awc” and “awin_source” (1 year each) and “channel_flow”, “channel_flow_first” and “channel_flow_last” (2 years each).

13. Trusted Shops and customer reviews

We embed the Trustbadge of Trusted Shops SE, Cologne. It displays our seal of quality and our reviews and offers buyer protection. When it loads, Trusted Shops processes your IP address and access data (Art. 6(1)(f) GDPR). After an order and with every change of its status, we transmit the complete order data to Trusted Shops, including order number, date, status, amounts, payment and shipping method, the products bought, your salutation, your name, your customer number and email address, billing and delivery address (for businesses with company name and VAT identification number), your telephone number if provided, and a technical access code to your order. This enables you to use buyer protection and to submit a review (Art. 6(1)(b) and (f) GDPR).

Logged-in customers can submit product reviews in our shop. We publish the name given or an abbreviation, the review and the date. We continue to show reviews from our former review service Judge.me with name, review and date, but without email address and images.

14. Links to social networks

Our pages contain simple links to our profiles on Instagram, YouTube, X, Threads and Trustpilot. No plugins are loaded; data is transmitted only when you click a link and open the network's page.

15. Transfers to third countries

Some service providers are based in the USA or access data from there (e.g. Google, Microsoft, Amazon, Stripe, Stape and ThoughtMetric). We base the transfer on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR).

16. Storage periods

Order and invoice data: 8 years for accounting records and invoices, 6 years for commercial letters (§ 147 AO, § 257 HGB), in each case from the end of the calendar year.
Customer account: until deletion; after that as order data.
“Stay logged in” cookie: 30 days from login with the code.
Proof from business customer applications: 30 days after our decision.
Shipping data at the shipping service provider: 90 days.
Enquiries and tickets: 2 years after completion, unless a retention obligation applies.
Copies of sent emails: 90 days.
Server and security logs: up to 90 days, unless we need them to investigate a security incident.
Google Analytics: 14 months.
Audience statistics: 26 months.
Clarity recordings: 30 days, a sample up to 9 months.
Consents: for the duration of the consent and up to 3 years afterwards.
Newsletter: until unsubscription; proof of consent up to 3 years afterwards.

17. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): If we process your data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims. You can object to processing for direct marketing purposes at any time without giving reasons.

You can lodge a complaint with a data protection supervisory authority, in particular with the authority responsible for us: the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Straße 22, 20459 Hamburg.