1. Controller
Wojciech Liber, trading as Libebox, Hevelingstr. 218, 47574 Goch, Germany, email info@libebox.com, privacy requests: support@libebox.com ("we"). We are the controller for the processing described here, except where Paddle acts as an independent controller (section 4).
2. What we process, why, and on what legal basis
- Provide the Passport builder: the answers you type stay in your browser (local storage) and are not sent to us. Legal basis: Art. 6(1)(b) GDPR; storage is strictly necessary for the service you request (§ 25(2) no. 2 TDDDG).
- Deliver the Starter Pack and updates: purchase email, transaction reference, selected plan, delivery status, signed link. Art. 6(1)(b) GDPR.
- Verify payments and subscription status: Paddle webhook data (event type, subscription and customer IDs, email, plan, status). Art. 6(1)(b) GDPR.
- Operate and secure the website: IP address, browser data, timestamp, requested route, error logs. Art. 6(1)(f) GDPR (security, abuse prevention).
- Support: email address, message, transaction reference. Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR.
- Tax and accounting records: transaction and invoice data. Art. 6(1)(c) GDPR (German commercial and tax law).
- Product emails and updates (Brevo list): your email address and email interaction data. For existing customers: Art. 6(1)(f) GDPR and § 7(3) UWG (similar products, with an opt-out link in every email). Any other marketing: consent, Art. 6(1)(a) GDPR and § 7(2) no. 3 UWG. Opens and clicks are measured only with your consent (§ 25 TDDDG).
Providing the data needed for purchase and delivery is required to conclude the contract. Without it we cannot deliver the Service.
3. Recipients and processors
Resend (Resend, Inc., USA) sends our transactional emails as our processor under a data processing agreement (Art. 28 GDPR). Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) manages the email list for product updates and Trust Notes as our processor (Art. 28 GDPR); you can unsubscribe in every email. The Passport application is hosted on a cloud hosting platform that processes technical request data on our behalf. The Libebox.com website and its email are hosted by Hostinger; see the Libebox Privacy Policy at https://libebox.com/privacy-policy/. We also share data with our tax adviser and with authorities where the law requires it. We do not sell personal data and we do not use it for advertising profiles.
4. Paddle
Paddle is the seller of record and independently decides how it processes your name, billing details, tax data and payment data to complete the transaction, prevent fraud and meet its legal duties. Paddle is an independent controller for that processing. Libebox never receives your full card details. See https://www.paddle.com/legal/privacy. We receive from Paddle only the data needed to confirm the transaction and deliver the Service.
5. Transfers outside the EEA
Resend and some of our other providers process data in the United States or other third countries. Where there is no adequacy decision, we rely on the EU-US Data Privacy Framework certification of the recipient or on standard contractual clauses (Art. 46 GDPR). You can request information about the safeguards at support@libebox.com.
6. Storage periods
Server logs: up to 30 days, longer only for security investigations. Delivery and subscription records: for the length of the subscription plus 3 years, then deleted. Tax and accounting records: up to 10 years under § 147 AO and § 257 HGB. Support emails: up to 12 months after the matter is closed, longer if a legal claim requires it. Email list data: until you withdraw your consent or unsubscribe; then only a suppression entry remains. Browser-local passports: on your device until you delete them.
7. Cookies and local storage
The builder uses your browser's local storage only to keep your passport on your device. We do not use advertising or analytics cookies on this website.
8. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20) and to object to processing based on Art. 6(1)(f) (Art. 21). Where we rely on consent, you can withdraw it at any time with effect for the future. Write to support@libebox.com. You may lodge a complaint with a supervisory authority. For us this is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2-4, 40213 Düsseldorf, Germany (ldi.nrw.de), or the authority in your country of residence.
9. No automated decision-making
We do not take decisions based solely on automated processing that produce legal effects for you (Art. 22 GDPR).
10. Security and changes
We use technical and organisational measures, including signed and time-limited download links and verification of payment webhooks. We update this policy when our processing changes.