Data Protection & Privacy

1. Controller

The controller responsible for the processing described in this Privacy Notice is:

2. Legal Bases for Processing

We process personal data only where a legal basis permits us to do so.

Depending on the circumstances, processing is based in particular on:

• Article 6(1)(b) GDPR, where processing is necessary to take steps at your request before entering into a contract or to perform a contract
• Article 6(1)(c) GDPR, where processing is necessary for us to comply with a legal obligation
• Article 6(1)(f) GDPR, where processing is necessary for our legitimate interests or those of a third party and your interests or fundamental rights do not override them
• Article 6(1)(a) GDPR, where we expressly ask for your consent and you provide it

Our legitimate interests include operating the website securely and reliably, responding to genuine business enquiries, measuring the reach and use of our content, developing our advisory services and protecting our technical systems against misuse.

3. Website Hosting and Technical Delivery

The website is delivered through technical infrastructure provided by Lovable.

The website's own server environment, provided through Lovable, is used for server-side functions, notably the contact form.

Technical information must be processed when you request a page so that the website can be delivered and operated securely. This may include:

• IP address
• date and time of the request
• requested URL
• referrer, where supplied by the browser
• browser and device information
• user agent
• HTTP status information
• technical error and security information

This processing serves to deliver the website securely, reliably and efficiently, diagnose faults and protect the service against misuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and technically reliable operation of our website and infrastructure.

The precise retention period for hosting, edge and function logs depends on the settings and contractual arrangements of the relevant infrastructure.

Where infrastructure providers process personal data on our behalf, they do so within the applicable contractual and data-protection framework.

Lovable Privacy Policy · Lovable Data Processing Agreement

4. Contact Form

The website provides contact forms in German and English. When you contact us through either form, we process the information you submit so that we can deal with your enquiry.

The current form processes:

• name
• email address
• company, where provided
• the content of your message

Technical safeguards are also used to deter automated or abusive submissions. These include:

• an invisible honeypot field
• a temporary IP-based limit on the number of form submissions

The IP address is used only technically and temporarily within this server-side protection measure. The current mechanism does not create a permanent visitor or customer record from it.

The form is processed server-side in the website's own server environment, provided through Lovable. The current implementation does not store contact-form messages in a website database of our own.

Where your enquiry concerns a possible engagement or an existing contract, the legal basis is Article 6(1)(b) GDPR. Other legitimate business enquiries are processed under Article 6(1)(f) GDPR.

Our legitimate interest is to receive, protect against misuse and respond to communications addressed to our business.

5. Email Delivery through Resend

Messages submitted through the contact form are delivered using Resend, a transactional email service provided by Plus Five Five, Inc. The form information is transmitted to Resend server-side for this purpose.

This includes in particular:

• name
• email address
• company, where provided
• message

The sender's email address is used so that we can reply to the enquiry. Merely opening our website does not cause your browser to connect directly to Resend.

Resend states that it stores customer data, including message content and delivery logs, in the United States.

According to Resend's current information, transfers from the European Economic Area are safeguarded through measures including the European Commission's Standard Contractual Clauses and participation in the EU-US Data Privacy Framework.

Depending on the nature of the enquiry, the underlying communication is processed under Article 6(1)(b) or Article 6(1)(f) GDPR.

Resend GDPR information · Resend Data Processing Addendum

6. Direct Contact and Social Networks

You may also contact us directly by email or through communication services linked from the website. In direct business correspondence, we process the information you choose to send us.

Where the communication concerns a potential or existing engagement, the legal basis is Article 6(1)(b) GDPR. Other legitimate business correspondence is processed under Article 6(1)(f) GDPR.

The website contains ordinary external links, including links to:

• LinkedIn
• X
• WhatsApp
• email functions
• partner and supplier websites

These are ordinary links, not embedded social-media plug-ins. Simply visiting our website does not establish a connection to LinkedIn, X, Meta or WhatsApp.

A connection to the relevant provider is established only when you deliberately select the link. The provider's own privacy terms then apply to any subsequent processing.

7. Plausible Analytics

We use Plausible Analytics to understand, in a privacy-conscious manner, how our website and its content are used. The provider is Plausible Insights OÜ, Estonia.

The current technical implementation uses:

• no analytics cookies
• no Local Storage
• no Session Storage
• no persistent visitor identifiers

We do not use Plausible to create persistent individual profiles or to recognise visitors across websites.

As with any direct browser request to an external service, technical connection data such as the IP address, user agent, requested URL and, where available, referrer is necessarily transmitted when the request is made.

Plausible states that the raw IP address and complete user-agent data are not stored. According to its documentation, Plausible uses short-lived technical information to calculate aggregated website statistics without creating persistent visitor identifiers.

Plausible states that website visitor data is processed and stored exclusively within the European Union on European infrastructure.

The statistics may include:

• page views
• pages visited
• referrer or source
• general browser or device information
• approximate geographical statistics
• aggregated usage information

The current website code does not deliberately send Plausible names, email addresses or individual customer identifiers.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to understand the reach and usefulness of our content, improve the website and make informed decisions about relevant material without invasive advertising or cross-site tracking.

Plausible Data Policy · Plausible Data Processing Agreement

8. Google Search Console

We use Google Search Console to monitor the visibility, indexing and technical performance of our website in Google Search.

Search Console may provide us with information about:

• search queries
• impressions
• clicks
• click-through rates
• average search positions
• indexing
• technical search and crawling information

Website ownership is currently verified using a technical google-site-verification meta tag. This tag is inert HTML markup.

It executes no Google JavaScript, does not itself establish a browser connection to Google and sets neither cookies nor browser storage.

Google Analytics, Google Tag Manager and Google Ads are not currently active tracking integrations on commerce-guru.com.

Search Console data arises through the operation of Google Search and is made available to us for the verified website property.

We use this information under Article 6(1)(f) GDPR. Our legitimate interest is to monitor the website's technical discoverability and search performance and to improve the relevance and accessibility of our content.

Google's own processing in connection with Google Search is governed by Google's privacy information.

Google Privacy Policy

9. YouTube Videos

Selected partner and content pages include videos provided through YouTube, a Google service.

YouTube videos are blocked by default on commerce-guru.com. On the first visit to an affected page, only a locally hosted placeholder is displayed.

Before you actively enable the video:

• no YouTube iframe is loaded
• no video-related request is made to Google or YouTube
• no YouTube cookies are set by the video player

The external YouTube player is activated only when you deliberately select “Load video”. Where technically available, we use YouTube's privacy-enhanced mode through youtube-nocookie.com.

Once activated, information may be transmitted to Google or YouTube, including:

• IP address
• browser and device information
• the page from which the video is opened
• interactions with the video player

After activation, Google or YouTube may use cookies or similar technologies. The content is loaded following your informed affirmative action.

Where consent is required, the legal basis is Article 6(1)(a) GDPR. Any storage of or access to information on your device is also subject to the relevant statutory consent requirements.

commerce guru does not store your decision to load a video persistently. When the page is revisited or reloaded, the video is blocked again until you activate it.

Google's privacy information applies to subsequent processing by Google and YouTube.

Google Privacy Policy · YouTube documentation on privacy-enhanced mode

10. Cookies and Similar Browser Technologies

In its current technical configuration, commerce-guru.com does not use non-essential cookies or comparable persistent browser storage for analytics, advertising or marketing during an ordinary page visit.

In particular:

• Plausible Analytics operates without analytics cookies
• Google Search Console sets no cookies through this website
• YouTube is not loaded without prior deliberate activation
• Google Analytics is not used
• no advertising or remarketing pixels are deployed
• no embedded social-media widgets load automatically

For that reason, commerce-guru.com does not currently use a general cookie consent banner.

If technologies requiring prior consent are introduced in future, an appropriate consent mechanism will be put in place before activation and this Privacy Notice will be updated.

11. No Password-Protected Areas

The website currently has no password-protected areas and no user accounts, so no password checks take place and no unlocked content is cached.

12. Locally Hosted Fonts and Assets

Fonts used by commerce-guru.com are served locally from the website itself. In particular, neither Google Fonts nor other external font CDNs are loaded during an ordinary page visit.

Images, logos and the principal design assets are also provided locally. These resources therefore create no additional connection to external font or image CDN providers.

13. No Payment Processing, User Accounts or Newsletter

No payment processing is currently integrated into commerce-guru.com. The website currently provides no:

• online payment processing
• checkout function
• user accounts
• login function
• newsletter subscription
• marketing email registration
• embedded appointment booking

Mollie is not integrated as a payment provider on this website. The Mollie partner page is editorial content only and does not constitute a technical payment integration.

Stripe, PayPal, Klarna, Apple Pay and Google Pay are likewise not integrated as payment services for this website. Editorial pages about Mollie or other payment providers do not constitute payment processing.

14. No AI-Based Processing of Website Visitors

commerce guru advises and publishes on AI in e-commerce. The publicly accessible website does not, however, currently transmit visitor data to OpenAI, Anthropic, Google Gemini or other AI APIs.

No AI-based assessment or profiling of website visitors takes place. Technical development elements that exist but are neither publicly available nor active do not constitute current processing of visitor data.

15. Service Providers and Recipients

Depending on how you use the website, personal data may be processed by providers required for its operation and for communication. These include in particular:

• Lovable for hosting and deployment infrastructure
• the website's own server environment for server-side functions
• Plausible Analytics for website statistics
• Resend for delivery of contact-form messages
• the provider of our business email infrastructure
• Google / YouTube when you deliberately activate a video
• professional advisers, accountants or other recipients where required for business administration or legal obligations

Providers acting as processors should process personal data only within the applicable contractual and legal requirements.

We do not sell personal data.

16. International Data Transfers

Some providers or their subprocessors may process data outside the European Economic Area.

Where the European Commission has adopted an adequacy decision for the relevant destination, a transfer may rely on that decision. Where necessary and no adequacy decision applies, appropriate safeguards may include the European Commission's Standard Contractual Clauses and supplementary measures.

Resend: Resend is a United States provider. It states that customer data is processed in the United States. For transfers from the EEA, Resend refers in particular to the European Commission's Standard Contractual Clauses and its participation in the EU-US Data Privacy Framework.

Google / YouTube: if you deliberately activate a YouTube video, data may be transferred to Google or its infrastructure outside the EEA. This processing begins only after your active decision to load the external content.

Lovable: the specific hosting region and possible subprocessors of the Lovable infrastructure used for this project may vary with the technical and contractual configuration. We therefore do not claim that processing occurs exclusively in Europe where this has not been conclusively verified for the present configuration.

Plausible: Plausible states that website visitor data is processed and stored exclusively within the European Union using European infrastructure.

17. Retention

We retain personal data only for as long as required for the relevant purpose and to meet legal, contractual, accounting or other compliance obligations.

When determining the appropriate period, we consider in particular:

• whether an enquiry remains active
• whether it develops into a client relationship
• whether correspondence forms part of an engagement or business record
• statutory retention requirements
• limitation and legal-defence periods
• technical security and error-analysis requirements

Contact-form enquiries are not currently stored in a website database of our own. They may remain in Resend's delivery systems and our business email inbox in accordance with the relevant retention periods.

Technical hosting, server and function logs are processed according to the settings and contractual retention rules of the infrastructure used.

Where personal data is no longer required, it is deleted or anonymised where reasonably possible.

18. Data Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

No online system can guarantee absolute security. Measures are therefore reviewed and, where necessary, adapted with regard to the nature of the processing, the state of the art and the relevant risks.

19. Your Rights

Subject to the conditions of the GDPR, you may in particular have the following rights:

• information about the processing of your personal data
• access to your personal data
• rectification of inaccurate or incomplete data
• erasure of personal data
• restriction of processing
• data portability where the statutory conditions are met
• objection to processing based on legitimate interests
• withdrawal of consent with effect for the future
• a complaint to a competent data-protection supervisory authority

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

20. Right to Object

Where we process personal data under Article 6(1)(f) GDPR, you have the right to object on grounds relating to your particular situation.

Following an objection, we will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.

Please send your objection to: hello@commerce-guru.com

21. Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data-protection supervisory authority. As AR Commerce Guru LTD is established in Cyprus, the following authority is particularly relevant:

You may also contact another competent supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the location of an alleged infringement.

Office of the Commissioner for Personal Data Protection

22. Automated Decision-Making

The website does not currently use automated decision-making or profiling that produces legal effects concerning visitors or similarly affects them to a significant degree.

23. Changes to this Privacy Notice

We may amend this Privacy Notice where our website, technical infrastructure, services, legal requirements or processing activities change. The current version and its date will be published on this page.

If technologies requiring prior consent are introduced in future, an appropriate consent mechanism will be put in place before they are activated.

24. Contact

For questions about this Privacy Notice, our processing of your personal data or the exercise of your data-protection rights, please contact: