Privacy policy

English translation for convenience. The legally binding version is the German text at /datenschutz.

As of: September 2026

§ 1 Information on the collection of personal data

(1) Below we inform you about the collection of personal data when using our website, when creating and using a Kwickey account, when extending a Kwickey account with paid services (Lost And Found Function), when initiating, processing and, where applicable, reversing purchases in our online shop, and when using our website to reach the contact information of one of our customers after you have found a movable item with a Kwickey code and read it with your end device.

Personal data are all data relating to you personally, e.g. name, address, email addresses, user behaviour.

(2) The controller pursuant to Art. 4(7) of the EU General Data Protection Regulation (GDPR) is KWICKEY GmbH (see Imprint).

(3) When you contact us by email at the address provided, the data you communicate therein (your email address, and where applicable your name and telephone number) are stored by us in order to answer your questions. The legal basis for this processing is Art. 6(1) sentence 1 lit. b) or f) GDPR.

(4) We delete data collected in this context after storage is no longer required, or restrict processing if statutory retention obligations exist.

(5) If we use commissioned service providers for individual functions of our offering or wish to use your data for advertising purposes, we will inform you in detail below about the respective processes. We will also state the defined criteria for storage duration.

(6) In the course of developments in data protection law as well as technological or organisational changes, our privacy information is regularly reviewed for need of adaptation or supplementation. You will be informed of changes in particular on our German website at www.kwickey.com. This privacy information is dated April 2026.

§ 2 Your rights

(1) You have the right vis-à-vis us to access, rectification, erasure, restriction of processing, objection to processing and data portability regarding your personal data.

(2) You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data.

§ 3 Processing of personal data when visiting our website

(1) When using this website for information purposes only without registration or other further transmission of information, we collect exclusively the personal data that your browser transmits to our server. When you wish to view our website, we collect the following data that are technically necessary for us to display our website and to ensure stability and security: IP address, date and time of the request, time zone difference to Greenwich Mean Time (GMT), content of the request (specific page), access status/HTTP status code, amount of data transferred in each case, referring website, browser, operating system and its interface, language and version of the browser software. The legal basis for this processing is Art. 6(1) sentence 1 lit. f) GDPR.

(2) In addition to the data mentioned above, cookies are stored on your computer when you use our website. Cookies are small text files stored on your hard drive and assigned to the browser you use, through which certain information flows to the party that sets the cookie (here, us). Cookies cannot execute programmes or transmit viruses to your computer. They serve to make the internet offering as a whole more user-friendly and effective.

(3) We use cookies on our websites. Cookies are small text files stored on your hard drive and assigned to the browser you use by means of a characteristic character string, through which certain information flows to the party that sets the cookie. Cookies cannot execute programmes or transmit viruses to your computer and therefore cannot cause damage. They serve to make the internet offering as a whole more user-friendly and effective, and thus more pleasant for you.

Cookies may contain data that make it possible to recognise the device used. In part, cookies contain only information on certain settings that are not personal. Cookies cannot, however, identify a user directly.

A distinction is made between session cookies, which are deleted when you close your browser, and persistent cookies, which are stored beyond the individual session. With regard to their function, cookies are further distinguished as follows:

• Technical cookies: These are strictly necessary to navigate the website, use basic functions and ensure website security; they neither collect information about you for marketing purposes nor store which websites you have visited;
• Performance cookies: These collect information about how you use our website, which pages you visit and, for example, whether errors occur during use; they do not collect information that could identify you – all information collected is anonymous and is used only to improve our website and find out what interests our users;
• Advertising cookies, targeting cookies: These serve to offer the website user demand-oriented advertising on the website or offers from third parties and to measure the effectiveness of these offers; advertising and targeting cookies are stored for a maximum of 13 months;
• Sharing cookies: These serve to improve the interactivity of our website with other services (e.g. social networks); sharing cookies are stored for a maximum of 13 months.

The legal basis for cookies that are strictly necessary to provide you with the service you have expressly requested is Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). Any use of cookies that is not strictly technically necessary for this purpose constitutes processing that is permitted only with your express and active consent pursuant to Section 25(1) TDDDG in conjunction with Art. 6(1) sentence 1 lit. a GDPR.

We use technically necessary cookies without consent. In addition, we use the Meta Pixel for marketing purposes (see section Q); it is loaded only after your active consent via our cookie banner. Without your consent nothing is transmitted to Meta and no marketing cookie is set. You can change your decision at any time via the "Cookie settings" link in the footer. Further information on which cookies we use can be found in § 6 of this privacy policy.

§ 4 Further functions and offerings of the website

(1) In addition to purely informational use of the website, we offer various services that you may use if interested. For this you must generally provide further personal data, which we use to provide the respective service and to which the data processing principles mentioned above apply.

(2) In part we use external service providers to process your data. These have been carefully selected and commissioned by us, are bound by our instructions and are regularly monitored.

(3) We may also disclose your personal data to third parties where promotions, prize draws, contract conclusions or similar services are offered jointly with partners. You will receive further information when providing your personal data or below in the description of the offering.

(4) Where our service providers or partners are established in a state outside the European Economic Area (EEA), we inform you in the description of the offering about the consequences of this circumstance.

§ 5 Objection or revocation regarding processing of your data; disclosure of data

(1) If you have given consent to processing of your data, you may revoke this at any time. Such revocation affects the permissibility of processing of your personal data after you have declared it to us.

(2) Where we base processing of your personal data on a balancing of interests, you may object to the processing. This is the case where processing is in particular not necessary for fulfilment of a contract with you, as we explain in each case in the following description of functions. When exercising such an objection, we ask you to state the reasons why we should not process your personal data as we do. In the event of your substantiated objection, we will examine the situation and either cease or adjust data processing or show you our compelling legitimate grounds on the basis of which we continue processing.

(3) You may of course object at any time to processing of your personal data for advertising and data analysis purposes. You can inform us of your advertising objection using the following contact details: info@kwickey.com

(4) We may in certain cases be subject to a special statutory or legal obligation to provide lawfully processed personal data to third parties, in particular public bodies. The legal basis for this is Art. 6(1) sentence 1 lit. c GDPR.

§ 6 Further functions of this website and corresponding processing of personal data

A Use of our web shop

(1) If you wish to order in our web shop, it is necessary for conclusion of the contract that you provide your personal data, which we need to process your order. Mandatory information required for processing contracts is marked separately; further information is voluntary. For payment you must provide your payment data to our payment service provider, whereby these third parties are each independently responsible for payment processing (see § 6 B of this privacy information). The legal basis for this is Art. 6(1) sentence 1 lit. b) GDPR.

(2) You may create a Kwickey account through which we can store your data for later further purchases. When creating a Kwickey account via the corresponding function of our website, the data you provide are stored revocably. All further data, including your Kwickey account, can be deleted by you at any time in the customer area.

(3) We are obliged under commercial and tax law to store your address, payment and order data for a period of 10 years. However, after three years we restrict processing. This means that from that point your data are used only to comply with statutory obligations.

(4) To prevent unauthorised access by third parties to your personal data, in particular financial data, the connection is encrypted using SSL technology.

B Payment service providers

We offer you the possibility of processing payment via the payment service provider Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. This corresponds to our legitimate interest in providing an efficient and secure payment method. For performance of the contract we pass the following data to Stripe Ltd.: name of cardholder, email address, customer number, order number, bank details, credit card data, expiry date of credit card, card verification number (CVC), date and time of transaction, transaction amount, name of provider and location.

Legal bases for this processing are Art. 6(1) sentence 1 lit. b) and lit. f) GDPR.

Processing of the data stated in this section is neither legally nor contractually required. However, without transmission of your personal data we cannot process payment via Stripe.

Stripe assumes a dual role in data processing activities as controller and processor. As controller, Stripe uses your transmitted data to fulfil regulatory obligations. This corresponds to Stripe’s legitimate interest (pursuant to Art. 6(1) sentence 1 lit. f) GDPR) and serves performance of the contract (pursuant to Art. 6(1) sentence 1 lit. b) GDPR). We have no influence on this process.

As processor, Stripe acts to complete transactions within the payment networks. Within the processing relationship, Stripe acts exclusively on our instructions and has been contractually obliged pursuant to Art. 28 GDPR to comply with data protection provisions.

Stripe has implemented compliance measures for international data transfers. These apply to all worldwide activities in which Stripe processes personal data of natural persons in the EU. These measures are based on the EU Standard Contractual Clauses (SCCs).

Further information on objection and erasure options vis-à-vis Stripe can be found at: https://stripe.com/privacy-center/legal

Your data are stored by us until completion of payment processing. This also includes the period required for processing refunds, receivables management and fraud prevention. Otherwise the information in § 6 A (3) of this notice applies.

C Cookies and local storage

(1) On kwickey.com we use technically necessary cookies (login, language, operation of the site). Legal basis: Section 25(2) no. 2 TDDDG and Art. 6(1) lit. b or f GDPR. These cookies are required to operate the site and cannot be switched off.

(2) For aggregated, cookie-free web statistics we use Trackboxx (see section G). In Stripe test mode a technical flag may be stored in sessionStorage (kwickey_stripe_test) without personal data.

(3) We additionally use marketing cookies set by the Meta Pixel (section Q). These are set only after your active consent, which we obtain through the cookie banner shown on your first visit. Legal basis: Section 25(1) TDDDG in conjunction with Art. 6(1) lit. a GDPR. If you decline or make no choice, the Meta Pixel is not loaded; the website remains fully usable.

(4) We store your decision in your browser (localStorage, key kwickey_consent_v1) so we do not have to ask again on every visit. This storage is necessary in order to honour your choice and therefore does not itself require consent. You can withdraw your consent at any time with effect for the future via the "Cookie settings" link in the footer; withdrawing is just as easy as giving consent.

We currently use in particular the following cookies:

* Maximum storage duration. You can delete cookies at any time in your browser settings.

D Our newsletter

(1) With your consent you may subscribe to our newsletter, through which we inform you about our current interesting offers. The goods and services advertised are named in the consent declaration.

(2) For registration to our newsletter we use the so-called double opt-in procedure. This means that after your registration we send you an email to the address provided asking you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, your information is blocked and automatically deleted after one month. We also store your IP addresses used and the times of registration and confirmation. The purpose of the procedure is to prove your registration and, where applicable, to clarify possible misuse of your personal data.

(3) The only mandatory information for sending the newsletter is your email address. Provision of further, separately marked data is voluntary and is used to address you personally. After your confirmation we store your email address for the purpose of sending the newsletter. The legal basis is Art. 6(1) sentence 1 lit. a GDPR.

(4) You may revoke your consent to receiving the newsletter at any time and unsubscribe from the newsletter. You may declare revocation by email to info@kwickey.com.

(5) We point out that when sending the newsletter we evaluate your user behaviour. For this evaluation the emails sent contain so-called web beacons or tracking pixels, which are one-pixel image files stored on our website. For the evaluations we link the data mentioned in para. (3) and the web beacons with your email address and an individual ID. Links contained in the newsletter also contain this ID. With the data obtained in this way we create a user profile in order to tailor the newsletter to your individual interests. We record when you read our newsletters, which links you click in them and infer your personal interests from this. We link this data with actions you take on our website. You may object to this tracking at any time by unsubscribing from the newsletter pursuant to para. (4). The information is stored for as long as you are subscribed to the newsletter. After unsubscribing we store the data purely for statistical and anonymous purposes.

E Use of Meta tools (Facebook and Instagram)

For the services we offer we use the technical platform and services of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The services include “Facebook” and “Instagram” (hereinafter together “social media page”).

We point out that you use the social media page and its functions at your own responsibility. This applies in particular to interactive functions (for example commenting, sharing, rating). Meta processes personal data relating to your account, your IP address as well as your end devices used; cookies are used for data collection. Which information Meta receives and how it is used is described by Meta in general form in its data use policies. There you will also find information on contact options with Meta, objection options and settings for advertisements. The data use policies are available at the following links:

• Facebook: de-de.facebook.com/about/privacy
• Instagram: help.instagram.com/519522125107875

The information may be used by Meta to provide us as operator of the social media page with statistical information such as gender and age distribution regarding use of the social media page. Meta may also show you further information or advertisements according to your preferences. Meta provides further information on this at the following link: de-de.facebook.com/help/pages/insights.

Data collected in this context about you are processed by Meta and may be transferred to countries outside the European Union.

When you visit one of our social media presences (e.g. Instagram), such a visit triggers processing of your personal data. In this case we are jointly responsible with the operator of the respective social network for certain processing operations within the meaning of Art. 26 GDPR, provided we actually make a joint decision with the operator of the social network on data processing and also influence data processing.

Where possible, we have concluded agreements on joint responsibility pursuant to Art. 26 GDPR with the operators of social networks, in particular the Page Controller Addendum of Meta Ireland Limited. Your rights under § 2 can in principle be asserted both vis-à-vis us and vis-à-vis the operator of the respective social network.

We ask you to note that despite joint responsibility pursuant to Art. 26 GDPR with the operators of social networks we do not have comprehensive influence over the data processing of the individual social networks. The corporate policy of the respective provider has a decisive influence on our possibilities. In the event of assertion of data subject rights we can only forward these requests to the operator of the social network.

How Meta uses data from visits to social media pages for its own purposes, to what extent activities on the social media page are attributed to individual users, how long Meta stores this data and whether data from a visit to the social media page are disclosed to third parties is not conclusively and clearly stated by Meta and is not known to us in every respect.

When accessing a social media page, the IP address assigned to your end device is transmitted to Meta. According to Meta, this IP address is anonymised (for “German” IP addresses) and deleted after 90 days. Meta also stores information about the end devices of its users (for example within the “login notification” function); Meta may thereby be able to attribute IP addresses to individual users.

If you as a user are currently logged in to Facebook, a cookie with your Facebook identifier is on your end device. Meta is thereby able to trace that you visited this page and how you used it. This also applies to all other Facebook pages. Via Facebook buttons embedded in websites Meta can record your visits to these websites and attribute them to your Facebook profile / Instagram profile. On the basis of this data, content or advertising tailored to you can be offered.

If you wish to avoid this, you should log out of Facebook / Instagram or deactivate the “stay logged in” function, delete cookies present on your device and close and restart your browser. In this way Meta information by which you can be directly identified is deleted. You can then use our social media page without your Facebook / Instagram identifier being disclosed. If you access interactive functions of the page (Like, Comment, Share, Messages etc.), a Facebook or Instagram login screen appears. After any login you are again recognisable to Meta as a specific user. Alternatively, you can use a different browser than usual to visit our social media page.

The legal basis for use of the social media page is Art. 6(1) sentence 1 lit. f GDPR.

F Use of TikTok

We maintain a presence on TikTok and/or may embed TikTok content in our online offerings. According to current TikTok privacy information, providers for users in the EEA include in particular TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies UK Limited, One London Wall, London, EC2Y 5EB, United Kingdom.

When you visit our TikTok presence or interact with TikTok content, TikTok processes personal data on its own responsibility. This may in particular include profile data, usage data, device information, location data and interaction data. Further information can be found in TikTok’s privacy information and terms of use.

Where we embed TikTok content on our website, embedding should take place exclusively after your prior consent. The legal basis in this case is Art. 6(1) sentence 1 lit. a GDPR in conjunction with Section 25(1) TDDDG, where information is stored on or read from your end device in the course of embedding. Where we merely link to our TikTok presence, no data are transmitted to TikTok until you click the link.

Where TikTok provides us with aggregated statistics or insights for our presence, joint responsibility pursuant to Art. 26 GDPR may be considered. Data subject rights should in these cases preferably be asserted directly vis-à-vis TikTok, as TikTok regularly has more extensive access to the processed data. Further information can be found at: tiktok.com/legal/privacy-policy and tiktok.com/legal/terms-of-use.

In view of ongoing regulatory and technical developments at TikTok, TikTok-specific information should be reviewed regularly and adapted to actual use (mere linking, embedding of videos, advertisements, pixel etc.).

G Use of Trackboxx

We use the web analytics service Trackboxx on our site. The provider is Mr Christian Pust, Humboldtstraße 9, 38820 Halberstadt, Germany. We use it to statistically evaluate visitor access and analyse use of our website. The data are stored anonymised for the stated purpose on a server in Germany and are subject to GDPR requirements. We do not use any cookies or store personal data. Rather, your IP address is used to generate a code that is then assigned to an anonymous user ID for as long as you are on our website. This data cannot be attributed to a specific person and is encrypted with a code that changes daily. It is therefore also not possible to “recognise” you on a subsequent visit to our website. Cross-page tracking, linking of data with other sources or disclosure of information to third parties does not take place. The legal basis for processing is Art. 6(1) lit. f GDPR. Our legitimate interest lies in demand-oriented design and optimisation of our website. If you nevertheless do not wish to help us improve our site, you can control this at any time via the “Do Not Track” function in your browser.

H Use of Host Europe

We host our website with “Host Europe”. The provider is Host Europe GmbH, Hansestraße 111, 51149 Cologne. When you visit our website, Host Europe collects various log files including your IP addresses. Details can be found in Host Europe’s privacy policy: hosteurope.de/AGB/Datenschutzerklaerung.

Use of Host Europe is based on Art. 6(1) lit. f GDPR. We have a legitimate interest in the most reliable presentation of our website possible. Where corresponding consent was requested, processing takes place exclusively on the basis of Art. 6(1) lit. a GDPR and Section 25(1) TDDDG, where consent covers storage of cookies or access to information on the user’s end device (e.g. for device fingerprinting) within the meaning of TDDDG. Consent can be revoked at any time.

We have concluded a data processing agreement (DPA) for use of the above service. This is a contract required under data protection law that ensures that personal data of visitors to our website are processed only on our instructions and in compliance with the GDPR.

I Integration of Amazon CloudFront

We use the Amazon CloudFront CDN content delivery network. The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg (hereinafter AWS). Amazon CloudFront CDN is a globally distributed content delivery network. Technically, information transfer between your browser and our website is routed via the content delivery network. This enables us to increase the global availability and performance of our website.

Use of Amazon CloudFront CDN is based on our legitimate interest in providing our web offering as error-free and secure as possible (basis: Art. 6(1) lit. f GDPR). Data transfer to the USA is supported by the EU Commission’s Standard Contractual Clauses. Details can be found here: aws.amazon.com/de/blogs/security/aws-gdpr-data-processing-addendum.

AWS holds certification under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards in data processing in the USA. Each company certified under the DPF undertakes to comply with these data protection standards.

J Use of Cloudflare

We use the content delivery network (CDN) of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Via the CDN, content of our website such as scripts and stylesheets is delivered to you more quickly via a network of regionally distributed servers. For this purpose your browser must establish a connection to Cloudflare’s servers. Cloudflare thereby learns that our website was accessed via your IP address. The data arising in this process are used only for the aforementioned purpose and to maintain functionality and security of the CDN. This use takes place pursuant to Art. 6(1) lit. f GDPR on the basis of the website operator’s legitimate interest in fast and secure provision and optimisation of the online offering. Further information can be found in Cloudflare’s privacy policy: cloudflare.com/security-policy.

K Self-hosted web fonts

For uniform presentation of the website we use the typefaces DM Sans (body text) and Anybody (headings). The associated font files (woff2) are delivered exclusively from our own domain — there is no retrieval from Google Fonts, Adobe Fonts or other external font CDNs during normal page loading.

When loading the page your browser transmits only a request to our web server or our CDN (Netlify/Cloudflare) to load the font files. Your IP address is processed in this process; the legal basis is Art. 6(1) lit. f GDPR (legitimate interest in uniform, readable presentation of our offering). The fonts are licensed under the SIL Open Font License (OFL); details see fonts/README.md in the website directory.

L Use of MailerSend (transactional email)

For transactional emails (e.g. welcome mail, password reset, notifications about your KWICKEY code) we use MailerSend (MailerSend Inc., USA). Sending is via the domain kwickey.com on our behalf.

We process in particular your email address, name (if provided) and message content. Legal basis: Art. 6(1) lit. b or f GDPR. mailersend.com/legal/privacy-policy.

M Sign in with Google

You may optionally sign in with your Google account (“Continue with Google”). Provider: Google Ireland Limited, Dublin, Ireland. Legal basis: Art. 6(1) lit. b or a GDPR. policies.google.com/privacy.

N External links to Google Maps

We do not embed Google Maps on our website. When scanning a KWICKEY code an address may appear as an external link. Google is contacted only when you click (rel="noreferrer"). Legal basis: Art. 6(1) lit. f GDPR.

O Use of Xano (backend)

Account, codes, checkout and API logic run on Xano (USA; API e.g. api.pingbook.io).

Legal basis: Art. 6(1) lit. b or f GDPR. Login token: c.token (section C). legal.xano.com/privacy-policy.

P Website hosting (Netlify)

Static hosting: Netlify, Inc. (USA). Legal basis: Art. 6(1) lit. f GDPR. netlify.com/privacy.

Q Meta Pixel

(1) On kwickey.com we use the "Meta Pixel" provided by Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland. It lets us measure the success of our Facebook and Instagram advertising: we learn which ad led to a page view, a basket or an order, can optimise our ads accordingly and show you advertising matched to your interests (remarketing). Meta provides us with aggregated reports only; we cannot identify individual people from them.

(2) The pixel is loaded only after your active consent, obtained through our cookie banner. Legal basis: Section 25(1) TDDDG in conjunction with Art. 6(1) lit. a GDPR. Until you consent, no script is loaded, no cookie is set and no data is transmitted to Meta.

(3) After your consent, the following data is transmitted to Meta: your IP address, browser and device information, the page visited and the action triggered (page view, product view, add to cart, checkout started, purchase completed including order value, enquiry via our business contact form). The pixel sets the cookies _fbp and _fbc (see the table in section C). We have disabled Automatic Advanced Matching, so no data you enter into forms — name, email address or phone number — is transmitted to Meta. Finder reports about lost items are not reported to Meta.

(4) For the collection and transmission of data via the pixel we are a joint controller together with Meta within the meaning of Art. 26 GDPR. Meta provides a controller addendum for this purpose which governs in particular the information obligations. Meta is solely responsible for any subsequent processing it carries out on its own account. The addendum is available at: facebook.com/legal/controller_addendum.

(5) Personal data may also be transferred to Meta Platforms, Inc. in the USA. This transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023, under which Meta is certified. Despite that decision, access by US authorities cannot be entirely ruled out. If you are logged in to Facebook or Instagram, Meta may link your visit to this website to your account there.

(6) You can withdraw your consent at any time with effect for the future, without affecting the lawfulness of processing carried out until then — via the "Cookie settings" link in the footer of this website. You can also object to the use of your data for advertising in the ad settings of your Meta account. Further information can be found in Meta's data policy.

(7) Section E separately covers our social media presence on Meta (Facebook/Instagram) and is independent of this section.

R Finder reports (anonymous contact)

Owners of a KWICKEY code can choose not to display their contact details when the code is scanned (anonymous mode). In that case, finders can leave a finder report via a form. We process the data provided voluntarily: the chosen contact channel and contact detail (e.g. phone number, email address or username), plus an optional name, message and location description. The device location is only captured after the finder actively confirms it (consent, Art. 6 (1) (a) GDPR).

This data is transmitted exclusively to the owner of the respective code for the purpose of returning the item (by email and in the account area) and is not used for any other purpose — in particular not for advertising. The legal basis is Art. 6 (1) (b) and (f) GDPR. To prevent abuse, we additionally store a hashed value of the IP address (no plain-text IP).

Finder reports are deleted as soon as the owner marks them as done, and in any case automatically after 90 days at the latest.