Privacy Policy

1. Data Controller

Digital Power Systems GmbH
Haid- und Neu Str. 7
76131 Karlsruhe, Germany
Email: shop@digitalpowersystems.eu

2. Overview of Data Processing

We process personal data only to the extent necessary and on the basis of applicable data protection laws, in particular the GDPR.

3. Data Collected

• Contact data: name, email address, phone number, company name
• Address data: billing and delivery addresses
• Payment data: payment method (processed by Mollie as payment service provider)
• Technical data: IP address, browser type, operating system (server log files)
• Usage data: page views, click behavior, scroll depth (only with your consent)

4. Legal Basis (Art. 6 GDPR)

• Contract performance (Art. 6(1)(b)): order processing, customer account, delivery
• Legitimate interests (Art. 6(1)(f)): website security, server log files, fraud prevention
• Consent (Art. 6(1)(a)): analytics cookies, marketing cookies
• Legal obligation (Art. 6(1)(c)): tax retention obligations

5. Cookies and Tracking

• Essential cookies: Required for core site functionality. Set without consent.
• Analytics cookies: Help us understand site usage. Only with your consent.
• Marketing cookies: Used for targeted advertising. Only with your consent.

Which cookies do we use?

6. Google Ads and Consent Mode v2

We use Google Ads with Advanced Consent Mode v2. Without your consent, no cookies are set and no personal data is transferred to Google.

7. Payment Service Provider

We use Mollie B.V. for payment processing. See Mollie's privacy policy.

8. Hosting and Server Log Files

Server log files (IP, date, page, browser) are stored for security and deleted after 30 days.

9. Contact Form and Registration

Data you enter is processed to handle your inquiry or manage your account. Not shared with third parties.

10. Fonts

All fonts are hosted locally. No connection to external servers (e.g. Google Fonts).

11. SSL/TLS Encryption

This website uses SSL/TLS encryption for secure data transmission.

12. Your Rights (Art. 15–21 GDPR)

Right of access, rectification, erasure, restriction, data portability, and objection. Contact: shop@digitalpowersystems.eu

13. Right to Lodge a Complaint

You may lodge a complaint with the State Commissioner for Data Protection of Baden-Württemberg.

14. Retention Periods

Data is deleted when no longer needed. Statutory retention: 6–10 years (German Commercial Code / Fiscal Code).

15. Private and business customers

Our online shop is open to both consumers and businesses within the meaning of § 14 BGB. When you register or place an order you tell us whether you are buying as a private or a business customer. We process that choice to display prices correctly (gross or net), to calculate VAT, and to determine whether you have a statutory right of withdrawal. Business customers may additionally provide a VAT ID, which we use to verify eligibility for VAT-exempt intra-community supplies.

16. AI-Assisted Application Review (Career Portal)

A recruiter may send your CV text, cover letter, name and profile headline to an AI service outside the EU/EEA to help assess your application. It produces a score and a rationale for a human recruiter — it never decides alone.

This only happens when a recruiter actively requests it; it is not automatic. We do not send the raw CV file, your email address or your phone number to the AI service. No automated decision-making within the meaning of Art. 22 GDPR takes place — the actual decision is always made by a person.

The legal basis for this processing is your consent (Art. 6(1)(a) GDPR), given when you submit your application. You may withdraw this consent at any time; withdrawal does not affect the lawfulness of processing carried out before the withdrawal, and does not affect the rest of your application.

The AI service we currently use is located outside the EU/EEA, in a country for which the European Commission has not adopted an adequacy decision under Art. 45 GDPR. In the absence of such a decision, the transfer takes place on the basis of your explicit consent to the transfer (Art. 49(1)(a) GDPR); Standard Contractual Clauses under Art. 46(2)(c) GDPR are put in place with the provider where concluded. Authorities in the destination country may have access to the data under their own laws, and the remedies available to you there may not be the same as under EU law.

For questions about which AI provider we currently use, or to exercise your rights regarding this processing, contact us at shop@digitalpowersystems.eu.

17. Google Ads Click Measurement and Conversion Reporting

When you reach our shop by clicking a Google advertisement, the web address you arrive at contains a click identifier generated by Google (gclid, or gbraid / wbraid for clicks that pass through an app). The identifier itself comes from that web address and not from a cookie. We read it and store it on our own servers together with the record of your visit. So that the individual pages you view can be recognised as one coherent visit, an entry is kept in your browser’s local storage; further details on this and on the other storage we use are set out in section 6.

The legal basis for this is our legitimate interest in knowing which advertisement brought a visitor to our shop (Art. 6(1)(f) GDPR). You may object to this processing at any time under Art. 21(1) GDPR using the contact details below. The identifier is deleted together with the visit record; the retention period we currently apply is 365 days.

If you then place an order and you have given marketing consent, we additionally store the click identifier with your order and transmit the following to Google so that the sale can be attributed to the advertisement: the click identifier, the time of the order, the currency, a fixed event label (“purchase”) and a value calculated from the order. That value is our contribution margin — the order total less our purchase and shipping costs — not the amount you paid. Where the “enhanced conversions” option is activated, a SHA-256 hash of your e-mail address is transmitted in addition; this option is currently switched off. We do not transmit your name, address, telephone number, IP address or order number. Without your marketing consent, no click identifier is stored with your order and nothing is transmitted to Google.

The legal basis for storing the identifier with your order and transmitting it is your consent (Art. 6(1)(a) GDPR). You may withdraw this consent at any time through the cookie and privacy settings on our website. Withdrawal stops any further transmission; it does not affect the lawfulness of processing carried out before the withdrawal, and data already transmitted to Google cannot be recalled by us.

The recipients are Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. On 10 July 2023 the European Commission adopted an adequacy decision for the EU–U.S. Data Privacy Framework; Google LLC is certified under that framework, so the transfer takes place on the basis of Art. 45 GDPR.

Please note that a click identifier stored with an order is retained for as long as the order itself, because orders are subject to statutory commercial and tax retention periods. This is longer than the 365 days that applies to identifiers stored with a visit record.

No automated decision-making within the meaning of Art. 22 GDPR takes place on the basis of this data. If you have questions about this processing, or wish to object to it or withdraw your consent, contact us at shop@digitalpowersystems.eu.

18. Technical Shop-Improvement Events

To find and fix problems in the shop and to understand how features are used, we record a small number of technical events as you browse and check out: when checkout fails, we log which step and which error code occurred — never any personal or payment data; when you request or enter an account verification code, we log that a code was sent, verified, or expired — never the code itself or your e-mail address; if a sign-in attempt fails, we log that a login failed, identified only by a one-way (irreversible) hash of the e-mail address used, never the e-mail address itself, so that we can spot problems with the login form without knowing who you are; when adding a product to your cart fails, we log the failure without any personal data; and we record, in aggregate and with a short delay, how visitors use search filters and sorting options on category and search pages.

None of this is tied to a cookie, and none of it is used for advertising or marketing. Where it involves you as an identifiable person at all (the hashed login identifier), it does not identify you directly and cannot be reversed back into your e-mail address.

The legal basis for this processing is our legitimate interest in operating a reliable, secure and user-friendly shop (Art. 6(1)(f) GDPR) — finding and fixing broken flows, detecting repeated failed sign-in attempts, and understanding which filters and sort options are actually used. You may object to this processing at any time under Art. 21(1) GDPR using the contact details below.

We keep these events for 730 days (24 months) from when they occur, after which they are automatically deleted. No automated decision-making within the meaning of Art. 22 GDPR takes place on the basis of this data.

If you have questions about this processing or wish to object to it, contact us at shop@digitalpowersystems.eu.

19. Guest Orders, Withdrawal and Google Merchant Center

You can order as a guest without creating an account. We process your name, delivery and billing address, e-mail address and order data to perform the contract (Art. 6(1)(b) GDPR) and retain them for the statutory retention periods (generally 10 years under Section 147 of the German Fiscal Code, AO). Using your order number and e-mail address, you can look up your order status without registering.

If you exercise your right of withdrawal (see our withdrawal page), we process the data you provide (order number, e-mail address, and any statement you make) to process the withdrawal and to meet our statutory record-keeping obligations (Art. 6(1)(b) and (c) GDPR), and retain it for the statutory retention periods.

We share product data (title, description, image, price, availability) with Google Merchant Center to display our products in Google Shopping search results. This product data does not contain any personal data. When you click through from a Google Shopping result, the landing page automatically shows the matching delivery country and price via a country parameter in the URL; no additional cookies are set for this (see item 18 on technical shop-improvement events).

20. Server-Side Search Query Log

When you use the search box on our website, we record, on our server, the search term you typed, the language of the page you searched from, how many results were found, and (if you clicked through) which result you opened — so that we can improve search results and close gaps in our product catalogue.

We do not store your IP address, any session or tracking identifier, or your user account together with a search term. A search log entry cannot be linked back to you as an individual, and it is not combined with your browsing history, your cart, or any order you place.

The legal basis for this processing is our legitimate interest in operating a reliable, findable shop (Art. 6(1)(f) GDPR) — understanding what customers are looking for and identifying searches that return nothing useful. You may object to this processing at any time under Art. 21(1) GDPR using the contact details below.

We keep search log entries for 365 days from when they occur (configurable by us; see our current retention setting on request), after which they are automatically deleted. No automated decision-making within the meaning of Art. 22 GDPR takes place on the basis of this data.

If you have questions about this processing or wish to object to it, contact us at shop@digitalpowersystems.eu.

21. Server-Side Shop Analytics Without a Cookie Decision

Some facts about your visit are recorded on our server regardless of whether you accept or decline the analytics cookie banner: when a product is added to, changed in, or removed from your shopping cart, and when an order is placed. We do this because these are records of what happened to our own shopping-cart and order objects — state changes you triggered by using the shop — not observations of your device, so no cookie or other information is stored on or read from your device in order to record them. Your shopping-cart identifier (a cookie that is already set for the shop to function, described in section 6) is used only to group these records under the same cart; no new cookie is created and its lifetime is not changed by this.

Where you have accepted the analytics cookie, the same events are additionally linked to your browsing session as they always were. Where you have not, the event is still recorded, but without a session or device identifier attached to it. Please note that if you are signed in to a customer account when this happens, the record is still linked to your account through your shopping cart, so it is not anonymous to us in that case — only the session/device identifier used for cross-visit tracking is absent.

The legal basis for this processing is our legitimate interest in understanding how our own shop is actually used — for example, how often items are removed from a cart, or how many visits lead to an order — regardless of a visitor's cookie choice (Art. 6(1)(f) GDPR). We do not build a cross-session profile of you from this data, we do not combine it with advertising or marketing data, and no automated decision-making within the meaning of Art. 22 GDPR takes place on the basis of it.

We keep these records for up to 730 days (24 months) from when they occur, after which the individual record is deleted; a non-personal statistical summary (e.g. a daily count of cart changes) may be kept permanently, and this can no longer be linked to you or your visit. If you have a customer account, you can object to this processing by setting the analytics objection option in your account, after which no further event of this kind is linked to your account or cart; existing records are not deleted retroactively but their link to your account is removed. If you do not have an account, you may object at any time under Art. 21(1) GDPR by contacting us using the details below; we cannot apply an anonymous visitor's objection to events already recorded, since we have no way to recognise you again without storing something on your device, which we deliberately avoid.

If you have questions about this processing or wish to object to it, contact us at shop@digitalpowersystems.eu.

Last updated: March 2026