Legal

Privacy Policy

Last updated: June 2026 · Blumental Bayern GmbH (trading as StartFill)

1 Data Controller

The data controller responsible for processing personal data through the StartFill platform and website is:

Blumental Bayern GmbH
Melanchthonplatz 4–6, 90443 Nuremberg, Germany
Managing Director: Dr. Jalal Solati
Commercial Register: HRB 36602 · VAT-ID: DE325297396
E-Mail: info@startfill.com · Phone: +49 911 47711390

2 Scope of This Privacy Policy

This policy addresses personal data processed through the StartFill platform and website, including data of:

Merchant clients managing fulfillment accounts
End-customers whose shipping data is processed on behalf of merchants
Prospective clients submitting inquiries
Website visitors
Warehouse staff whose activities are logged in the WMS

When processing end-customer data on behalf of merchants, StartFill acts as a data processor (Art. 28 GDPR) and the merchant acts as the data controller. A mandatory Data Processing Agreement (AVV) must be concluded before any order processing begins.

3 Categories of Personal Data Processed

3.1 Merchant Client Data (B2B Account Data)

Registration information including company name, legal form, address, VAT-ID, commercial register details, contact person name and title, email address and telephone, bank details for invoicing, API credentials, and contract documents.

⚖ Legal basis: Art. 6(1)(b) GDPR — contract performance; Art. 6(1)(c) — legal retention obligations

3.2 End-Customer Order & Shipping Data

Processed on behalf of merchants: recipient name and delivery address, email address and phone number, order reference numbers, item contents, tracking numbers, and return reasons.

⚖ Legal basis: Art. 6(1)(b) GDPR — processed under Art. 28 GDPR with StartFill as processor only

3.3 Prospect Data (Website Inquiry Forms)

Company name, contact information, business details, IP address, and submission timestamp submitted through website contact forms. Data deleted after 12 months if no contract is concluded.

⚖ Legal basis: Art. 6(1)(b) — pre-contractual measures; Art. 6(1)(f) — legitimate business interest

3.4 Selling Platform API Credentials

StartFill requires API access to merchant selling platforms, including Amazon SP-API tokens, Shopify credentials, WooCommerce consumer keys, eBay OAuth tokens, and Kaufland/Otto platform tokens. All credentials are stored in an AES-256 encrypted Bitwarden Teams vault protected by hardware-key two-factor authentication. Deleted immediately upon contract termination.

⚖ Legal basis: Art. 6(1)(b) GDPR — contract performance

3.5 Warehouse and Inventory Records

Operational data including SKU codes, EAN barcodes, product descriptions, bin locations, stock levels, inbound/dispatch/returns records, temperature and humidity logs, and incident records. Primarily non-personal data; operator IDs logged under Art. 6(1)(b) (employment contract).

3.6 Staff and Operator Activity Data

JTL-Wawi and JTL-WMS Mobile generate login IDs, session timestamps, pick/pack/putaway actions, and mobile device identifiers.

⚖ Legal basis: Art. 6(1)(b) — employment contract; Art. 6(1)(f) — warehouse accuracy and incident investigation

3.7 Website and Platform Technical Data

IP addresses (anonymized after session), browser/OS/device type, pages visited, session duration, referrer URLs, and 30-day server logs.

⚖ Legal basis: Art. 6(1)(f) GDPR — security and error diagnosis

4 Purposes of Processing

Operating the 3PL platform and fulfillment services
Retrieving orders and processing them through the warehouse
Generating shipping labels and transmitting data to carriers
Updating stock levels and tracking information via API
Providing merchant dashboards (monday.com guest access)
Sending operational alerts via WhatsApp Business
Invoicing and accounting
Responding to prospective client inquiries
Ensuring warehouse quality and temperature SLA compliance
Complying with German commercial, tax, and packaging law

5 Data Sharing and Third-Party Recipients

5.1 Shipping Carriers (independent controllers)

End-customer names and delivery addresses are transmitted to carriers who act as independent data controllers:

DHL Paket GmbH
DPD Deutschland GmbH
GLS Germany GmbH & Co. OHG

Sendcloud B.V. acts as processor under a signed data processing agreement.

5.2 Software Sub-Processors (Art. 28 GDPR)

Provider	Purpose
JTL-Software GmbH (Hagen, DE)	Warehouse management system
Sendcloud B.V. (Eindhoven, NL)	Carrier integration
Haufe-Lexware GmbH (Freiburg, DE)	Invoicing
monday.com Ltd. (Tel Aviv, IL)	CRM and merchant dashboards
n8n GmbH (Berlin, DE)	Workflow automation
Bitwarden Inc. (Santa Barbara, US)	Credential vault
Google LLC (Mountain View, US)	Google Workspace
Meta Platforms Ireland Ltd.	WhatsApp Business API
Automattic Inc.	WordPress platform
Lascar Electronics / Thermco	Temperature sensor logging

Third-country transfers are covered by EU Standard Contractual Clauses or adequacy decisions.

5.3 Merchant Dashboard Access

Merchants receive read-only guest access to monday.com dashboards displaying their own order summaries, stock levels, and KPIs. No cross-client data visibility.

5.4 Legal and Tax Authorities

Data is disclosed to public authorities where required by applicable law (Art. 6(1)(c) GDPR).

5.5 No Sale of Data

StartFill does not sell, license, or commercially exploit personal data in any form.

6 International Data Transfers

Primary processing occurs within the European Union. Where data is transferred outside the EU/EEA (e.g., to Bitwarden Inc. or Google LLC), StartFill relies on the EU–US Data Privacy Framework or EU Standard Contractual Clauses (SCCs) as the legal transfer mechanism. Details of the applicable safeguards are available upon request at info@startfill.com.

7 Data Retention Periods

Data Category	Retention Period
Merchant client & contract data	Contract duration + 10 years (§257 HGB, §147 AO)
End-customer order, shipping, returns	10 years for compliance; access removed after contract termination
API credentials	Deleted immediately on contract termination; merchants must revoke tokens
Prospect inquiries (no contract)	12 months
Warehouse / inventory records (GoBD)	10 years
Staff activity logs (JTL)	3 years (employment dispute statute of limitations)
Temperature sensor logs	5 years (regulated goods compliance)
Server / access logs	30 days
Website analytics	14 months, then anonymized

8 Your Rights Under the GDPR

To exercise any of the following rights, contact us at info@startfill.com. We will respond within one month (Art. 12(3) GDPR). Identity verification may be required.

Right of access (Art. 15) Confirmation and a copy of personal data we hold about you.

Right to rectification (Art. 16) Correction of inaccurate or incomplete personal data.

Right to erasure (Art. 17) Deletion where no legal retention obligation applies.

Right to restriction (Art. 18) Restriction of processing in certain circumstances.

Right to portability (Art. 20) Your data in a structured, machine-readable format.

Right to object (Art. 21) Object to processing based on legitimate interests.

Right to withdraw consent (Art. 7(3)) Withdrawal does not affect prior lawful processing.

Right to lodge a complaint File a complaint with the supervisory authority below.

Supervisory Authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany · www.lda.bayern.de

9 Cookies and Website Tracking

Category	Purpose	Consent required?
Strictly necessary	Session management, security, login	No
Functional	Language and display preferences	No
Analytics	Anonymized usage statistics	Yes
Marketing	User profiling and targeted advertising	Yes

Non-essential cookies are only set with explicit consent via the cookie banner. You can withdraw or adjust your consent at any time through the settings in our website footer.

10 Technical and Organisational Security Measures

TLS 1.2+ encryption for all data in transit
AES-256 encrypted password vault (Bitwarden Teams) with YubiKey hardware two-factor authentication
Role-based access controls in JTL-Wawi
Nightly automated SQL backups in two geographically separate encrypted locations
Warehouse systems on static internal IP behind firewall
Data breach detection with 72-hour supervisory authority notification (Art. 33 GDPR)
Regular sub-processor security and DPA compliance review

11 Merchant Data Processing Agreement (AVV)

A mandatory Art. 28 GDPR Data Processing Agreement is a pre-condition for onboarding. No orders are processed and no API connections are activated until a fully executed AVV is on file. The AVV defines: processing scope, data categories, technical and organisational measures, sub-processor authorization, audit rights, and deletion/return obligations.

📄 Data Processing Agreement (AVV) Download PDF — Art. 28 GDPR template ↓ PDF

12 Children's Data

The StartFill platform targets exclusively B2B customers. StartFill does not knowingly collect personal data of children under the age of 16. Should such data arrive as part of end-customer order processing, it is handled solely for the purpose of fulfillment and deleted in accordance with the retention periods in § 7.

13 Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to the platform, services offered, or applicable legal requirements. The current version with its effective date is always published on this page. Material changes will be communicated to merchant clients by email.

Last updated: June 2026