Privacy Policy

BISpicy Inventory Management - Cloud Software

Last Updated: January 2025
GDPR compliant

1. Data Controller

Data Controller within the meaning of the General Data Protection Regulation (GDPR):

BISpicy Co. Ltd.
88/3 M1 Chaiyaphon Withi 14
Bang Lamung, Nong Prue, Chonburi 20150, Thailand
Phone: +49 (0) 2151 4799433
Email: [email protected]
Managing Director: Bernhard Binder

2. General Information

(1) This Privacy Policy informs you about the type, scope, and purpose of the processing of personal data within our software "BISpicy Inventory Management" and the associated online services.

(2) Legal basis:

  • General Data Protection Regulation (GDPR)
  • German Federal Data Protection Act (BDSG)
  • German Telemedia Act (TMG)

3. Collection and Processing of Personal Data

3.1 During Registration and Account Creation

What data is collected?

  • Email address (required)
  • Password (stored encrypted)
  • Company name and address
  • Registration timestamp

Legal basis: Art. 6(1)(b) GDPR (contract performance)

Storage period: Until account deletion + 30 days

3.2 During Use of the Software

What data is processed?

  • Article data (products, prices, inventory)
  • Customer data (names, addresses, contact details)
  • Order data (orders, deliveries, invoices)
  • Usage data (login times, activities)

Note: This data is processed on behalf of the customer (data processing agreement pursuant to Art. 28 GDPR).

4. Data Transfer to Third Parties

(1) Principle: Your data will only be disclosed to third parties if:

  • You have given consent (Art. 6(1)(a) GDPR)
  • This is necessary for contract performance (Art. 6(1)(b) GDPR)
  • There is a legal obligation (Art. 6(1)(c) GDPR)

(2) Data recipients:

Recipient Purpose Legal Basis
Stripe Inc. Payment processing Art. 6(1)(b) GDPR
Shipping providers (DHL, DPD, etc.) Label creation Art. 6(1)(b) GDPR
DigitalOcean Hosting Art. 6(1)(b) GDPR

5. Your Rights as a Data Subject

Your Data Protection Rights
  • Right of access (Art. 15 GDPR): You have the right to obtain information about your data
  • Rectification (Art. 16 GDPR): You may request the correction of inaccurate data
  • Erasure (Art. 17 GDPR): You have the right to have your data deleted
  • Data portability (Art. 20 GDPR): Export your data in a machine-readable format
  • Objection (Art. 21 GDPR): You may object to data processing

6. Data Security

We have implemented extensive technical and organizational measures:

  • Encryption: TLS 1.3 for all data transfers
  • Access controls: Role-based permissions
  • Backups: Daily automatic backups
  • Hosting: EU data centers

7. Contact

For questions about data protection, please contact:

Email: [email protected]
Response time: Within 30 days (pursuant to Art. 12(3) GDPR)

Last Updated: January 2025