Your checkout remains open in the other tab or window.
Privacy notice for ordering and payment
Version: 29 September 2026. This notice supplements the privacy notice for dargel-solutions.de with information about our direct shop. It does not replace that notice.
1. Controller
Dargel Solutions – Gottlieb Dargel Business address and address for service: Koselstr. 14, 60318 Frankfurt am Main, Germany Additional postal and complaints address: c/o Online-Impressum #8963, Europaring 90, 53757 Sankt Augustin, Germany Telephone: +49 15679 077516 · Email: [email protected]
Telephone service. An AI-assisted service answers calls to this number and automatically transcribes the conversation. You are speaking to an AI assistant, not a person. We then respond by email or call you back, usually within one working day. Processing V9 below and section 3 explain how your data is handled.
We have not appointed a data protection officer. The conditions in section 38 of the German Federal Data Protection Act (BDSG) are not met: this is a sole proprietorship without other people employed in processing personal data.
2. Processing associated with an order
V1 — Conclusion and performance of the contract
We process your order, confirm the contract and provide the files. The data comprises your email address, country of habitual residence, postcode only where required to distinguish VAT territories, territorial information for Cyprus, contract language, product, order number, timestamps and price. We do not request a street address or town in checkout. The legal basis is Article 6(1)(b) GDPR. We retain the information until the order has been fully processed and thereafter only as required for V3 and V4.
V1a — Evidence of the applicable tax territory
We use the country you confirm, the postcode or Cyprus territory where required, the country indicated by the network location where available, and country evidence supplied by the payment provider to establish the applicable tax territory and identify inconsistencies. An automatically suggested country based on your network location may be corrected in checkout; it does not establish your habitual residence. We retain the country evidence, verification results and references or hashes linking it to the order and payment. We do not retain your full IP address as part of this location evidence or store the payment provider's full postal address for this purpose.
The legal basis is Article 6(1)(c) GDPR in conjunction with the tax-location and record-keeping requirements, including section 3a(5) UStG. Additional proportionate consistency checks serve our legitimate interest in correct tax treatment and preventing misuse under Article 6(1)(f) GDPR. The evidence is retained with the tax records for the period in V4.
V2 — Payment through PayPal
We process the payment amount, order reference and PayPal transaction identifier. We do not collect your card, bank account or wallet credentials: these are entered only with PayPal. The legal basis is Article 6(1)(b) GDPR. The transaction identifier is retained as part of the records described in V4.
V3 — Evidence of withdrawal rights and early expiry
We record whether you expressly consented to supply before the withdrawal period ends and whether you acknowledged the resulting loss of your withdrawal right. We retain the wording and timestamps of these choices, a hash and copy of the contract confirmation, and the time at which supply began. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in proving whether the right of withdrawal expired, for which the trader bears the burden of proof. The retention period is three years from the end of the year in which the contract was concluded, based on sections 195 and 199 BGB, followed by deletion. This retention policy does not limit your statutory rights or the time available to enforce them.
V4 — Accounting and tax records
We retain the contract confirmation, payment record and any invoice issued. The legal basis is Article 6(1)(c) GDPR in conjunction with section 147 of the German Fiscal Code (AO) and section 14b UStG. The retention period is eight years from the end of the relevant calendar year.
V5 — Withdrawal
When you submit a withdrawal online, by email, by post or by telephone, we process the details you provide, such as your name, contract identification, email address and any optional statement, together with the timestamps and acknowledgement. The legal bases are Article 6(1)(c) GDPR for receiving the withdrawal and issuing the required acknowledgement under sections 355(1), 356(1), sentence 2, and 356a(4) BGB; Article 6(1)(b) for processing the withdrawal and reimbursement; and Article 6(1)(f) for proving that the deadline was met. The retention period is the same as V3.
V6 — Prevention of misuse
We process limited technical access information, timestamps and error categories for the checkout. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in maintaining a working checkout and preventing misuse. These records are retained for seven days.
V7 — One-off information about our other guides, for eligible purchases in Germany only
For eligible purchases by customers habitually resident in Germany, the first download email may contain one short reference to our own similar digital guides. Customers habitually resident outside Germany receive transactional emails without this product promotion. We use the same email address as in V1, with no additional data, open tracking, click tracking or profiling. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in direct marketing of our own similar products to our customers, subject to section 7(3) of the German Act Against Unfair Competition (UWG). You have an unconditional right to object under Article 21(2) GDPR, explained in section 6. No separate marketing record is created: the reference is generated from the order and product catalogue when the email is sent and is not separately retained.
V8 — Ensuring the product reference is sent only once
Where V7 applies, the product reference is sent at most once per email address, with the first paid purchase. Later purchases with that address do not receive it. A cryptographic hash of your contact details is used to verify eligibility without creating a separate mailing list. The legal basis is Article 6(1)(f) GDPR in connection with V7 and ensuring compliance with objections under section 7(3), no.3 UWG and Article 21(3) GDPR. The verification value is retained only with the related order records for the periods described in V1 and, where applicable, V4. This does not create an additional retention period or a separate mailing list. An objection is taken into account for later purchases as well.
V9 — Telephone contact
When you call, an AI-assisted service answers and transcribes the conversation into a written call note, without an automatic AI summary, so that we can deal with your enquiry and respond. At the start of each call, an announcement explains that an AI assistant answers and transcribes the call and that no audio recording is stored.
The data includes your telephone number, the time and duration of the call, your enquiry and anything you choose to tell us. According to the provider, audio is held temporarily for technical processing and deleted without delay once the transcript has been created; it is not retained as an audio recording.
Article 6(1)(b) GDPR applies where the call concerns a contract or steps towards a contract. Otherwise Article 6(1)(f) applies: our legitimate interest in being reachable by telephone and recording enquiries reliably. Providing a telephone contact number is also a statutory requirement under Article 246a section 1(1), sentence 1, no.3 EGBGB.
We delete the call note and telephone number once the enquiry has been dealt with, and in any event no later than 90 days after the call, unless statutory retention obligations apply. If the call concerns a contract, withdrawal or accounting record, the relevant period under V3, V4 or V5 applies.
We do not carry out automated individual decision-making within Article 22 GDPR, profiling, credit checks or scoring. Checkout checks formal eligibility of the order. The telephone assistant does not decide your enquiry; it records what you say for a person to handle.
We use your checkout email for the contract confirmation, download access, withdrawal acknowledgement and related administration. Only where V7 applies may the first download email contain the one-off product reference. It is never sent after withdrawal, in the contract confirmation or in a replacement download email. It has no tracking pixels, click counting or recommendations based on your behaviour.
You may object at any time by emailing [email protected], at no cost other than transmission costs at basic rates. We record your objection as a checksum of your email address on our marketing suppression list so that it also applies to later purchases (Article 6(1)(f) in conjunction with Article 21(3) GDPR); we keep that entry for as long as we send marketing by email. We do not disclose your email address to third parties for marketing. We do not use your telephone number for advertising or disclose it for that purpose.
Where the product reference applies, its one-off nature, your right to object and the basic-rate cost statement are displayed beside the email field when your address is collected, not only in this notice. Objecting does not affect your purchase or download.
3. Recipients
| Recipient | Role and purpose | Basis for disclosure |
|---|---|---|
| PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg | Independent controller in the EEA; payment processing | Article 6(1)(b) GDPR. PayPal's privacy notice applies: https://www.paypal.com/de/legalhub/privacy-full?locale.x=en_DE |
| Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA | Processor under Article 28 GDPR and the Cloudflare Customer DPA; website delivery, execution of checkout requests, storage of orders and records | Article 6(1)(b) GDPR; international transfers are explained in section 4 |
| Purelymail, Add Rabbit LLC, USA | Processor; sends contract confirmations, download links and withdrawal acknowledgements | Article 6(1)(b) GDPR. International transfers are explained in section 4 |
| Clear-Media UG (haftungsbeschränkt), Europaring 90, 53757 Sankt Augustin, Germany; HRB 18610, Amtsgericht Siegburg | Processor with access to content; accepts and scans incoming post at the postal and complaints address | Article 6(1)(f) GDPR. No transfer to a third country |
| sipgate GmbH, Gladbacher Str. 74, 40219 Düsseldorf, Germany, service “satellite” | Processor under Article 28 GDPR; supplies the telephone number, answers calls and transcribes them into call notes without an automatic AI summary. This involves conversation content, not just connection data | Article 6(1)(b) or (f) GDPR, as explained in V9. A data processing agreement is in place. Its subject matter is processing on servers in the EU under Annex 1, no.4. Subprocessors and transfer information appear in section 4 |
4. Transfers to third countries
Cloudflare, Inc., USA. Cloudflare has committed to the EU–US Data Privacy Framework, covered by the European Commission's adequacy decision of 10 July 2023 under Article 45 GDPR. The European Commission's standard contractual clauses under Article 46(2)(c) GDPR also form part of the Cloudflare Customer DPA. The safeguards are available at https://www.cloudflare.com/cloudflare-customer-dpa/ and the subprocessor list at https://www.cloudflare.com/gdpr/subprocessors/. Cloudflare states that it is certified under the EU–US Data Privacy Framework; its entry can be checked in the public participant list at dataprivacyframework.gov.
PayPal (Europe) S.à r.l. et Cie, S.C.A. Our recipient is in Luxembourg, within the EEA, so our disclosure to it is not a transfer to a third country. PayPal states that its own international transfers rely on binding corporate rules or standard contractual clauses. Its privacy notice governs those transfers.
Email delivery: Purelymail, Add Rabbit LLC, USA. The provider processes data in the USA. No applicable adequacy basis or standard contractual clauses are in place for this provider. For the email address and message content required to deliver your contract confirmation, download link and withdrawal acknowledgement, we rely on Article 49(1)(b) GDPR, necessity for performance of the contract with you. Without safeguards under Article 46 GDPR, there is a risk that US authorities may access the data without equivalent legal remedies being available to you.
Clear-Media UG. No transfer to a third country takes place.
Telephone service and AI transcription: sipgate GmbH, Düsseldorf. Our recipient is established in Germany, and our disclosure to it is not a transfer to a third country. An Article 28 GDPR data processing agreement is in place. Its subject matter is processing on servers in the EU under Annex 1, no.4. Under clause 4(2), processing outside the EU and EEA requires our express consent as sipgate's customer. The data centres are operated by Myloc managed IT AG, Düsseldorf, and Interxion Deutschland GmbH, Frankfurt am Main. Telecommunications services are provided by argon networks UG (haftungsbeschränkt), netzquadrat GmbH and sipgate Wireless GmbH, all in Düsseldorf. The provider's customer service is supported by impacx services GmbH, Kleve. These companies are established in Germany.
The agreement's subprocessor annex identifies Google Ireland Limited, Dublin, Ireland, as the provider of automatic speech-to-text transcription. It also lists OpenAI OpCo LLC, USA, for an additional automated call-summary feature. That feature is not enabled in our account settings, so call data is not transferred to OpenAI OpCo LLC in the USA for it. We will update this notice before enabling it. Clause 9(1) requires an adequate level of protection for subprocessors in third countries, for example through the European Commission's standard contractual clauses.
At the start of each call, an announcement explains the AI-assisted answering and transcription and that no audio recording is stored. If you prefer not to use this channel, email [email protected] or write to the address in section 1.
5. Payment route and access to your device
After you place your binding order, we redirect you to PayPal to authorise payment. You are then redirected back to our website. Our shop pages do not load PayPal code or connect your browser to PayPal before that redirect. Checkout also works without browser JavaScript.
PayPal does not access your device through our shop pages for this payment route. PayPal is responsible for what happens on its own pages. International personal-data transfers are a separate issue and are addressed in section 4.
We use no analytics, tracking or marketing scripts in checkout. Website audience measurement takes place on the server without accessing your device.
6. Your rights
You have the rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20) and objection to processing based on legitimate interests (Article 21 GDPR). The latter includes V1a to the extent based on legitimate interests, V3, V6, V9 where applicable, and the marketing suppression list. Contact [email protected].
Objection to marketing. You may object at any time, without giving reasons, to the use of your email for V7. We will not weigh competing interests against such an objection, and will cease using your address for direct marketing under Article 21(2)–(3) GDPR. Independently of this right, V7 is limited to one product reference per address on the first eligible purchase. An email to [email protected] is sufficient, at no cost other than transmission costs at basic rates. Your objection does not affect contract confirmations, downloads or withdrawal acknowledgements, which are contractual communications rather than advertising.
You may lodge a complaint with a supervisory authority under Article 77 GDPR, in particular in the Member State of your habitual residence, place of work or the alleged infringement. You may also contact the authority responsible for the place where our business is established.
Where records must be retained under V4, or are necessary for establishing, exercising or defending legal claims under V3, erasure may be restricted under Article 17(3)(b) and (e) GDPR and processing limited where the conditions of Article 18 apply. This does not remove your other rights.
For V8, we check prior purchases using a verification value derived from order contacts; we do not create a separate list for this check. You may request deletion of a call note under V9; it is deleted once your enquiry is resolved, and in any event no later than 90 days after the call, unless a retention period under V3, V4 or V5 applies. You never have to call: email and post are equally available and avoid the telephone AI service.
7. Information needed to place an order
We need your email address to deliver the contract confirmation and download link, and your country of habitual residence to check whether we can sell to you and apply the correct tax treatment. A postcode is required only for countries with relevant VAT-territory exceptions; for Cyprus, territorial confirmation is required. You can correct a suggested country. We cannot complete checkout without the information needed for these purposes.
We do not require a street address or town for an ordinary consumer purchase. If a VAT invoice is requested and issued, further information such as your name and address may be needed for the applicable invoicing requirements. We do not ask for unrelated additional information.
V7 requires no additional personal information and is not a condition of purchase. You may object without affecting the contract, download or withdrawal rights. A telephone call is never required: ordering, enquiries, complaints and withdrawal can all be handled in writing.