Privacy Policy

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. Detailed information on data protection can be found in the privacy policy below this text.

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find its contact details in the section “Information on the controller” in this privacy policy.

How do we collect your data?

Some data is collected when you provide it to us. This may, for example, be data you enter into a contact form. Other data is collected automatically or with your consent by our IT systems when you visit the website. This is primarily technical data (e.g. internet browser, operating system or time of the page view).

What do we use your data for?

Part of the data is collected to ensure that the website is provided without errors. Other data may be used to analyse how the website is used, in aggregated form.

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can withdraw this consent at any time with effect for the future. You also have the right to request the restriction of the processing of your personal data under certain circumstances. Furthermore, you have the right to lodge a complaint with the competent supervisory authority. You can contact us at any time regarding this and any other questions about data protection.

2. Hosting

Hetzner

The provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (hereinafter Hetzner). The servers are located in Germany. For details, please see Hetzner’s privacy policy: https://www.hetzner.com/legal/privacy-policy/.

When you access this website, the server automatically records technical access data (server log files): the page accessed, date and time, volume of data transferred, browser type and version, operating system, referrer URL and IP address. This data is used solely for the secure and trouble-free operation of the website and is not merged with other data sources.

Hetzner is used on the basis of Art. 6 (1) (f) GDPR. We have a legitimate interest in the most reliable presentation of our website possible. We have concluded a data processing agreement with Hetzner in accordance with Art. 28 GDPR.

3. General Information and Mandatory Disclosures

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. Please note that data transmission over the internet (e.g. when communicating by e-mail) may have security gaps. Complete protection of data against access by third parties is not possible.

Information on the controller

The controller responsible for data processing on this website is:

Surply GmbH
Liefergasse 5
40213 Düsseldorf
Germany

Phone: +49 211 8694 2553
E-mail: info@surply.de

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, e-mail addresses or similar).

Storage period

Unless a more specific storage period is stated within this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a justified request for deletion or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, deletion takes place once those reasons no longer apply.

General information on the legal bases for data processing

If you have consented to data processing, we process your personal data on the basis of Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR, insofar as special categories of data are processed. In the case of express consent to the transfer of personal data to third countries, data processing is also based on Art. 49 (1) (a) GDPR. If you have consented to the storage of cookies or to access to information in your end device, data processing is additionally based on section 25 (1) TDDDG. Consent can be withdrawn at any time. If your data is required for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6 (1) (b) GDPR. Furthermore, we process your data if this is necessary to fulfil a legal obligation on the basis of Art. 6 (1) (c) GDPR. Data processing may also be carried out on the basis of our legitimate interest pursuant to Art. 6 (1) (f) GDPR.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of the data processing carried out before the withdrawal remains unaffected.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

If data processing is carried out on the basis of Art. 6 (1) (e) or (f) GDPR, you have the right at any time to object to the processing of your personal data on grounds relating to your particular situation; this also applies to profiling based on these provisions. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object, your personal data will subsequently no longer be used for the purpose of direct marketing.

Right to lodge a complaint with the competent supervisory authority

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged infringement. This right to lodge a complaint is without prejudice to any other administrative or judicial remedy.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only take place insofar as it is technically feasible.

Information, deletion and correction

Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing, and, if applicable, a right to correction or deletion of this data. You can contact us at any time regarding this and any other questions about personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time to do so. The right to restriction of processing exists in the following cases: if you dispute the accuracy of your personal data stored by us, we usually need time to verify this; if the processing of your personal data happened or is happening unlawfully and you request the restriction of processing instead of deletion; if we no longer need your personal data but you need it to exercise, defend or assert legal claims; or if you have lodged an objection pursuant to Art. 21 (1) GDPR and a balancing of our and your interests still has to be carried out.

If you have restricted the processing of your personal data, this data may — apart from being stored — only be processed with your consent or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content that you send to us as the site operator, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser line. When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

4. Data Collection on this Website

Forms on this website

This website offers two forms: registration as a buyer of surplus lots and the request for a non-binding price estimate for surplus goods. There is deliberately no general contact form — general enquiries are handled by telephone and e-mail.

We only collect the details you enter yourself — depending on the form, this includes company, contact person, e-mail address, telephone number, the product categories you are interested in as well as details of the goods offered (description, quantity, best-before date) and your message. We also store which page the enquiry came from. We do not pass this data on to third parties without your consent.

The details are forwarded by our web server to our internal operating system and stored there for the purpose of handling your enquiry. We operate this system ourselves and it runs on the same infrastructure in Germany (see section 2). For the price estimate you receive the result by e-mail to the address you provided; for this we use the dispatch service provider named under “Sending offers and information to business customers by e-mail”.

Processing is based on Art. 6 (1) (b) GDPR if your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR) if this was requested; consent can be withdrawn at any time.

The data you submit will remain with us until you ask us to delete it, withdraw your consent to storage or the purpose for storing the data no longer applies (e.g. after your enquiry has been processed). Mandatory statutory provisions — in particular retention periods — remain unaffected.

To prevent abuse, both forms are protected by a check using Cloudflare Turnstile (see section 5).

Enquiry by e-mail or telephone

If you contact us by e-mail or telephone, your enquiry including all resulting personal data (name, enquiry) will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent.

This data is processed on the basis of Art. 6 (1) (b) GDPR if your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR) if this was requested. The data will remain with us until you ask us to delete it, withdraw your consent to storage or the purpose for storing the data no longer applies. Mandatory statutory provisions — in particular statutory retention periods — remain unaffected.

Sending offers and information to business customers by e-mail

Purpose. We use the e-mail addresses of our existing business customers and partners to inform them about new offers of surplus food raw materials relevant to them as well as about important company information. This communication channel is a central element of our business relationship and serves the initiation and handling of trading transactions.

Legal basis. The processing of e-mail addresses for sending our offer information is based on our legitimate interest in maintaining the business relationship and in direct marketing for our products and services (Art. 6 (1) (f) GDPR). Where the dispatch takes place within the scope of a specific initiation or performance of a contract, the legal basis is Art. 6 (1) (b) GDPR. You may object to the use of your e-mail address for this purpose at any time.

Use of the dispatch service provider SendGrid. For sending and analysing our e-mails we use the service “SendGrid” provided by Twilio Inc., 101 Spear Street, Ste 500, San Francisco, CA 94105, USA. The data you enter for the purpose of receiving e-mails (e.g. e-mail address, name) is stored on SendGrid’s servers in the USA. We have concluded a data processing addendum (DPA) with SendGrid which ensures that SendGrid processes our customers’ data only in accordance with our instructions and in compliance with the GDPR. The transfer of data to the USA is based on the EU-U.S. Data Privacy Framework (DPF); Twilio Inc. (SendGrid) is certified under the DPF, which ensures an adequate level of data protection for the transfer.

Measuring success.The e-mails sent via SendGrid contain a so-called web beacon (tracking pixel). This is a pixel-sized file that is retrieved from the dispatch service provider’s server when the e-mail is opened. During this retrieval, technical information such as details about the browser and your system as well as your IP address and the time of retrieval are collected. This information is used for the technical improvement of the services and for statistical evaluations, including whether and when e-mails are opened and which links are clicked. This analysis is carried out on the basis of our legitimate interest (Art. 6 (1) (f) GDPR) in optimising our offering and measuring the effectiveness of our communication.

5. Plugins and Tools

Cloudflare Turnstile

Our forms are protected by “Turnstile” provided by Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich, Germany. Turnstile checks whether an entry originates from a human or from an automated program. For this purpose, your IP address as well as technical characteristics of your browser and device are transmitted to Cloudflare and evaluated. Turnstile does not set cookies for advertising or tracking purposes and does not create cross-device profiles.

The purpose is to protect our forms against abuse, spam and automated requests. The legal basis is our legitimate interest in operating this website securely (Art. 6 (1) (f) GDPR).

We have concluded a data processing agreement with Cloudflare in accordance with Art. 28 GDPR. Insofar as personal data is transferred to the USA, Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); in addition, the standard contractual clauses concluded by Cloudflare apply (Art. 46 GDPR). Further information can be found in Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/.

Plausible Analytics (self-hosted)

We use “Plausible Analytics” for the statistical evaluation of website usage. We operate Plausible on our own infrastructure in Germany (see section 2) — the data collected does not leave our systems and is not passed on to third parties.

Plausible works without cookies and without recognising you across multiple visits or devices. Your IP address is not stored; it is only used as input for a daily rotating, irreversible hash which allows repeated page views within the same visit and day to be grouped together. Apart from that, only aggregated information such as the page accessed, referrer, device type, browser and country of origin is recorded.

The legal basis is our legitimate interest in a statistical evaluation of website usage in order to improve our offering (Art. 6 (1) (f) GDPR). Since neither cookies are set nor information is read from your end device, consent under section 25 TDDDG is not required. Further information: https://plausible.io/data-policy.

Google Fonts (local hosting)

For a uniform presentation of fonts, this site uses so-called Google Fonts provided by Google. The Google Fonts are installed locally. No connection to Google’s servers takes place. Further information on Google Fonts can be found at https://developers.google.com/fonts/faq and in Google’s privacy policy: https://policies.google.com/privacy.

6. Call Summaries

For business telephone calls (incoming and outgoing) we create a written call summary to document business arrangements.

Procedure & data minimisation. We do not record audio. During the call, the spoken word is converted into text in real time (transcription); no audio file is created on our side. An AI system creates a short, business-related summary from this text. The verbatim transcript and all intermediate data are deleted automatically (raw fragments after the summary has been created; the full text no later than 72 hours after internal processing). Only the summary is stored permanently, assigned to the respective business contact.

Purpose & legal basis. The purpose is the reliable documentation of business telephone contacts, safeguarding service quality and the traceability of arrangements. The legal basis is our legitimate interest in efficient, accurate documentation within the business relationship (Art. 6 (1) (f) GDPR).

Recipients / processors. For telephony and real-time transcription we use Twilio (Twilio Inc.), which involves Deepgram as a sub-processor; for creating the summary we use Google (“Gemini” service). These providers process the data as processors bound by our instructions (Art. 28 GDPR).

Transfer to third countries. Insofar as personal data is transferred to the USA, Twilio Inc. and Google LLC are certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). The transcription by Deepgram as a sub-processor of Twilio is safeguarded by the standard contractual clauses concluded by Twilio (Art. 46 GDPR).

Storage period. Raw fragments and the full text are deleted at short notice as described above; the summary is retained for the duration of the associated business transaction within the periods required for business purposes and by law.

Your rights / objection. You have the right to information, correction, deletion and restriction. You also have a right to object (Art. 21 GDPR): at your request we will stop creating call summaries for your calls. An informal notification to info@surply.de is sufficient.