When using API, you, as a data controller under joint controllership (Art. 26 GDPR), are required to:
- keep information in your records of processing activities up-to-date;
- ensure the balancing of interests in accordance with Article 6 (1) (f) GDPR (if this legal basis is chosen); and
- adjust your Privacy Policy
Information for the register of processing activities
The following information shall be added to the register of processing activities:
Provision of the order data required for the use of Trusted Shops services for the generation of a one-time rating invitation link when using the API
The dispatch of rating invitations when using the API is carried out by the member using a unique link created by Trusted Shops using the order data submitted by the member.
Detailed description of the processing
To generate a one-time rating link for the submission of an authentic customer rating after an order, the customer's order data is transmitted to Trusted Shops SE.
Legal grounds
Consent must always be obtained for sending rating invitations to customers who are not registered for the Trusted Shops Services. We expressly recommend that you always obtain consent pursuant to Art. 6 I lit. a DSGVO for the transmission of order data to Trusted Shops. This means that the consent must cover the transmission of the data to Trusted Shops and the dispatch of the rating invitation.
If, however, a transfer without prior consent is planned, the transfer is possible on the basis of the overriding legitimate interest pursuant to Art. 6 I lit. f DSGVO. However, this is associated with risks under data protection law. Consent is still required for the dispatch of the evaluation invitation itself due to the special requirements of Section 7 UWG. However, it would then only cover the dispatch itself, but not the transmission of the data to Trusted Shops. Irrespective of this, Trusted Shops must be specified as the recipient of the data in your data protection information!
Processing purposes
- Product offering optimization
- Optimal marketing of the controller’s products by providing a safe purchasing experience thanks to authentic customer reviews
- Abuse and fraud prevention: only actual transactions are to be valued / hedged
Data subjects
Customers and prospects
Processed data
- Date of order
- Order number
- E-mail address
- Product details (Only for product reviews)
Recipient
Trusted Shops SE
Subbelrather Str. 15c
50823 Cologne
Germany
Storage period
The data processed for the dispatch of the evaluation invitations are stored as long as an evaluation can still be submitted (usually 185 days).
Technical and organizational measures
Encrypted transmission via TLS and further technical and organizational measures of Trusted Shops SE according to separate agreement.
Balancing of interests
Interests of the controller
|
Controller's own interests: The controller's interest is the optimal marketing of its offers by enabling product and store reviews by means of authentic customer reviews. |
|
Third-party interests: Trusted Shops SE also has an interest in the provision of its Services. |
|
| The controller’s right of freedom to exercise a trade or profession is affected as its fundamental right. This indicates that the said interests are legitimate. | |
| There is no milder means, because it is only through the coupling to the respective transaction and the provision by means of the relevant transaction data that an error-free security of the respective purchase and the submission and verification of a "real" customer rating becomes possible. |
Interim result:
The controller has a legitimate interest in the processing.
Interests: Fundamental rights / freedoms of the data subject
|
No other fundamental rights besides the right to the protection of the processed personal data of the data subject are affected. |
|
|
Not all visitors of the respective online store are affected. Only visitors who have previously agreed to receive a rating invitation are affected. |
|
|
The processing includes several data of the data subject. |
|
|
Interest of the person reviewing: Generating a unique rating link ensures that each order is rated only once and reflects an authentic buying experience.
|
|
|
Interest of the general public: The procedure ensures that only the generated link can be used for the rating and that it is therefore an authentic rating. |
|
|
The personal reference arises directly from the data, they are not pseudonyms. |
|
|
The data are not public. However, the data are collected from the data subject directly, and they are clearly informed of this. The data are not published. |
|
| Website visitors expect this processing, since the privacy policy transparently informs them about it.
|
|
|
There is no contractual relationship between the data subject and Trusted Shops SE.
|
Balancing of interests in the narrow sense
The data subjects all have a contractual relationship with the controller or enter into such a relationship within the scope of this processing. Consequently, the processing of the data also serves the interests of the data subject and is to be expected from him. Within the framework of the conclusion of the contract and also via the Privacy Policy, the data subject is informed transparently about this data processing.
The collection of the data is neither contrary to expectation nor excessively burdensome for the data subject, and there is a vested interest in being able to rely on genuine customer ratings, which are only made possible by an automatic link to verifiably authentic transactions. The general public also benefits from the procedure and can trust authentic customer reviews.
Overall, the interests, fundamental rights and freedoms of the data subject are not unduly burdened by the processing. Through transparent information, data subjects are not surprised by the processing. Data subjects derive a benefit from the service offered. The processing of data is also legitimized by overriding legitimate interests of the controller and named third parties.
This guideline was created with the utmost care, but does not claim to be complete or correct. It is intended as a checklist with text templates and as a suggestion as to how the aforementioned points should be dealt with.
For detailed questions in individual cases, always seek professional legal advice.