Legal

Privacy policy

We take privacy seriously and only process your data as far as is necessary to buy your device. Here’s what we store, why and for how long.

1. Controller

DIS-CONNECT GmbH, Gerwigstraße 29, 76131 Karlsruhe, Germany.
Represented by: Georg Dis.
Email: hello@flipback.de · Phone: 0721 18126789.

We have not appointed a data protection officer, as we are not legally required to. For any privacy matters, you can reach us at the address above.

2. Your sale data

When you sell a device, we process the data you enter in the sales form:

• Contact details: first and last name, email address.
• Address: street, house number, postcode, town — for the invoice, the shipping label and any return shipment.
• Device details: model, storage, colour, condition and the calculated purchase price.
• Payout details: depending on your choice, your IBAN and the account holder or your PayPal email address. These details are stored encrypted (AES-256-GCM).

Purpose: processing the buy-back (offer, shipping, inspection, payout). Legal basis: Art. 6(1)(b) GDPR (performance of a contract or pre-contractual steps). We additionally process tax and commercial records under Art. 6(1)(c) GDPR.

3. Server logs

When you submit an order, for security reasons – for example to prevent abuse – we store your IP address and browser identifier (user agent) together with the order. The legal basis is our legitimate interest in secure, abuse-free operation (Art. 6(1)(f) GDPR).

4. Cookies and local storage

flipBack does not set any advertising or tracking cookies. We use only technically necessary storage in the browser so that the sales process works:

• flipback_consent – stores your cookie choice.
• flipback_order – remembers your selection between the steps (only for the duration of your visit).
• flipback_utm – records which link brought you to us.

You’ll find the full overview with retention periods in the cookie details. Legal basis for necessary storage: § 25(2) TDDDG (German law) in conjunction with Art. 6(1)(f) GDPR.

5. Analytics (Plausible)

Only if you consent do we load Plausible Analytics (Plausible Insights OÜ, EU) for anonymous audience measurement. Plausible works without cookies, stores no personal profiles and does not process full IP addresses. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time via the cookie icon in the bottom left.

6. Recipients of your data

For processing, we only pass on data where necessary: to the shipping provider for the return label and to our payment or banking provider for the payout. For our live chat we use Intercom (Intercom Inc., USA); in doing so, personal data (e.g. chat content as well as device and usage data) may be transferred to the USA. This transfer is safeguarded by the EU-US Data Privacy Framework or the EU standard contractual clauses. The legal basis for the chat is our legitimate interest in fast customer support (Art. 6(1)(f) GDPR). No other transfers to third countries take place.

7. Retention period

We keep sale and payout data for the duration of processing and thereafter within the statutory retention periods (up to 10 years under commercial and tax law). After that, it is deleted. Data for which there is no retention obligation is deleted as soon as the purpose no longer applies.

8. Your rights

Under the GDPR you have the following rights:

• access to the data we hold about you (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure (Art. 17) and restriction (Art. 18)
• data portability (Art. 20)
• objection to processing based on legitimate interests (Art. 21)
• withdrawal of consent given, with effect for the future

A message to hello@flipback.de is enough to exercise them. You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW), Lautenschlagerstraße 20, 70173 Stuttgart.

9. Hosting

This website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. A data processing agreement under Art. 28 GDPR is in place with this provider; the servers are located within the EU (Germany). The legal basis is our legitimate interest in secure provision of the site (Art. 6(1)(f) GDPR).