Privacy Policy

This privacy policy informs partners and affiliates about how Highcovery processes personal data when using our Dashboard at dashboard.highcovery.com to manage businesses, products and affiliate activities. It applies exclusively to Dashboard users, including the set-up of affiliate tracking for Shopify shops. A separate privacy policy applies to the website and app.

I. Data Controller

The controller within the meaning of the GDPR is:
Leonardo Antonio Carta (Highcovery)
c/o Emperon Studio GmbH
Sachsenring 51a, 50677 Cologne, Germany
Email: leonardo@highcovery.com
Phone: +49 221 27645575

II. Purposes and Legal Bases for Processing

Registration and Partner Account

• Name
• Email address
• Password (stored only as a hash)
• Company name
• Business address (street, postcode, city, country mandatory; house number and state optional)
• Account language and time zone, notification settings
• Time, IP address and browser identifier (user agent) with which you confirm at registration that you have taken note of this privacy policy
• Optionally, a document verifying your business (e.g. business registration or commercial register extract as PDF), insofar as you upload it during registration or we request evidence later

Legal basis: Art. 6(1)(b) GDPR (contract performance or pre-contractual measures); for the proof of having taken note, Art. 6(1)(f) GDPR (legitimate interest in proof).

Login and Account Security

• Session cookie ("hc_session") for the duration of the session
• Optional "Stay signed in" cookie ("REMEMBERME", valid for 7 days), only if you select this option when signing in
• Optional two-factor sign-in via an authenticator app (TOTP); for this we store the TOTP secret in our database; in addition, you receive ten backup codes for emergencies, which we store only as a hash and which are each valid only once
• Optional sign-in with passkeys; for each passkey we store the credential ID, the public key, the AAGUID (identifier of the device model or password manager), the transports, the user handle, the signature counter, backup eligibility and backup status, the attestation type and trust path, the user verification status, a checksum of the credential ID, a name you choose and the time of creation and of last use; the private key never leaves your device and is not transmitted to us
• Tokens for password reset and email change

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (legitimate interest in account security).

Business Data Verification

Manual verification of your details at registration, in particular the business address, where necessary using commercial register extracts or similar documents, to prevent misuse. Access to the Dashboard is granted only after successful verification. Later changes to a business's address are checked automatically by geocoding and applied as soon as the address is found; no manual review takes place in this case.

Legal basis: Art. 6(1)(b) GDPR.

Processing of Business-Related Data in the Dashboard and Public Display

Businesses:

• Type, name, display name, company name, URL, address, opening hours, time zone
• Geographic coordinates of the address, determined via the geocoding service Nominatim (OpenStreetMap Foundation), to which only the address is transmitted; the time zone is calculated from the coordinates on our own servers
• Images, brand colour, active/inactive status, delivery areas, vouchers and discount codes
• Address changes, which are checked automatically by geocoding and applied as soon as the address is found

Products:

• Name, type, price, discounts and their duration, THC and CBD content, genetics, article number
• Product images, variants, attributes, status

Active businesses and products are displayed publicly on the Highcovery website, in the Highcovery app and via our interfaces. For search purposes they are stored in a search index (OpenSearch) on our own servers. Where this information relates to a natural person (e.g. sole traders), it constitutes personal data.

Legal basis: Art. 6(1)(b) GDPR.

Setting Up Affiliate Tracking (Shopify)

If you take part in the affiliate programme, you embed the tracking scripts we provide in your Shopify shop yourself and create the order webhooks (order created, paid, cancelled, refund) yourself in the Shopify admin. For this we process:

• your shop's address and its Shopify domain (myshopify.com)
• the signing secret of your webhooks, which we use to verify every incoming notification via HMAC-SHA256; notifications without a valid signature are rejected
• the voucher codes you store for attribution
• the receipt of each webhook type, so that we can show you the status of the set-up in the Dashboard

Legal basis: Art. 6(1)(b) GDPR.

Automatic Check of the Tracking Integration

For online shops whose address you have stored in the affiliate area, our server retrieves the public home page once a day (identifier "Highcovery-Tracking-Check/1.0") and checks whether the tracking scripts are installed in their current version. Only the result, the version status of the scripts and the time the core script was last found are stored. If a script is missing or outdated, or the home page is blocked by password protection, we notify you by email (at most once a week). If the home page is temporarily unreachable, the last check result remains valid and no email is sent. We also inform you by email about updates to the scripts.

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (legitimate interest in functioning commission tracking).

Affiliate Tracking and Commission Billing

To bill referred orders, we store for each conversion: order number, net goods value, currency, for orders in another currency the original amount and currency and the conversion rate used, country of the billing address, status (pending, confirmed, cancelled, invoiced), commission amount, the times of order, confirmation and cancellation, and the link to the originating click or the flag that attribution was made via a voucher code. In the Dashboard you can see for clicks and conversions the time (in your time zone), platform, country, language, referring page, origin of the click (article, variant, business or ad link) and the click identifier.

Legal bases: Art. 6(1)(b) GDPR (performance of the affiliate agreement), Art. 6(1)(c) GDPR (commercial and tax retention obligations).

Details are governed by the Affiliate Terms.

Data of Your Shop's End Customers

The webhooks you create in the Shopify admin send the complete order record to our webhook endpoint for each order; manually created webhooks cannot be restricted to individual fields in Shopify. The record may also include names, contact and address details of your customers. From it we store only order number, net goods value, commission, currency (for foreign currencies also the original amount and the conversion rate), status and country of the billing address, together with the link to the click or voucher. In our logs we record from order notifications, for 30 days, the order number, click identifier, amounts, currency, voucher code used and refund identifier. Names, addresses, contact and payment details of end customers are neither stored nor logged.

Highcovery processes this data for its own purposes (calculating commission) as an independent controller; to this extent, no processing on your behalf takes place. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in correctly attributing and billing referred orders). Obtaining consent from your shop visitors for cookies and similar technologies is your responsibility (see the Affiliate Terms).

Payment Processing (Stripe)

For paid add-ons and subscriptions in the Dashboard and for collecting affiliate commissions, we use the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland ("Stripe").

In this context, the following data may be processed:

• Identification and contact data (name, email address, company name, billing address, preferred language)
• VAT identification number, which we transmit to Stripe as a tax ID; tax on invoices is calculated by Stripe Tax
• Credit or debit cards you add for the collection of affiliate commissions via Stripe's embedded payment form; full card details are entered into and stored by Stripe directly, we only receive references (customer and payment method IDs) and information such as card brand, expiry date or last digits
• Details provided when booking add-ons and subscriptions via the checkout page hosted by Stripe; there Stripe collects the payment details, the billing address and, where applicable, your tax ID
• Invoice, commission and transaction data, including failed collection attempts
• Technical data collected by Stripe when loading the payment form or the checkout page (e.g. IP address, device information for fraud prevention)

Legal bases: Art. 6(1)(b) GDPR (fulfilment of the partner/affiliate contract), Art. 6(1)(f) GDPR (legitimate interest in secure payment processing), Art. 6(1)(c) GDPR (legal obligations).

Further information is available in Stripe's privacy policy: https://stripe.com/privacy

Legal Texts and Proof of Acceptance

When you accept terms of use, Affiliate Terms, contracts or new versions of them in the Dashboard, we store the accepted version, the time, the method of acceptance, your IP address and your browser identifier (user agent).

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (legitimate interest in proving the conclusion of the contract).

Email Communication

We send you emails that are required for using the Dashboard, e.g. on registration, password and email changes, new versions of legal texts and their acceptance deadlines, contracts and their renewal, invoices and payments and the status of the tracking integration. We send notices of new versions of the legal texts and of acceptance deadlines regardless of your notification settings. In addition, we send you the monthly report, notices of expiring discounts and reminders of contract renewals; these are enabled by default and are the only emails you can unsubscribe from at any time in your notification settings. External accounts managed by Highcovery receive none of these emails. Emails are sent via our own mail server (see section VI).

Legal basis: Art. 6(1)(b) GDPR for communications required by the contract (e.g. invoices, deadlines); for the notifications you can unsubscribe from, Art. 6(1)(f) GDPR (legitimate interest in informing you about your presence and your contracts).

Support, Access by Highcovery and Logging

Highcovery staff may access your Dashboard data for support, verification and moderation and, for this purpose, may also sign in to your view of the Dashboard. Page views by staff and sign-ins to your view are recorded in an access log file with staff identifier, time and IP address (90 days); this also applies to page views during a sign-in to your view. A sign-in to your view is additionally recorded in the audit log (12 months). Changes that Highcovery staff make to data (including in your view of the Dashboard) are recorded in an audit log with the identifier of the person acting, time, affected record, change, function called and IP address.

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (legitimate interest in traceability and protection against misuse).

Usage Data in the Dashboard

• IP address
• Device and browser information
• Pages accessed and times in server log files
• Error messages and technical diagnostic data. For error detection we use Sentry by Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA, with data stored in the EU (Frankfurt am Main) on the basis of a data processing agreement under Art. 28 GDPR. We transmit the error message, the address called without parameters, the host called, the referring page (referrer), time and browser identifier, without IP address, cookies or form input; personal data is not transmitted by default and is filtered out before sending. Performance measurements cover only a sample of ten per cent of requests. The data is deleted after 30 days. Any access from the US is covered by the EU-US Data Privacy Framework or standard contractual clauses.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest: platform security, functionality and error-free operation).

Maps (Apple MapKit JS)

On pages with maps (start page and statistics) we load the MapKit JS library from Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland). When it is loaded, your IP address is transmitted to Apple; when maps are displayed, map tiles are retrieved from Apple.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in functional map display).

Further information: https://www.apple.com/legal/privacy/

Cookies

• Essential cookies required for login sessions and Dashboard functionality ("hc_session", "REMEMBERME" for "Stay signed in", cookie settings "hc_*" with a lifetime of up to one year)
• Cookies and technologies required by Stripe for secure payment processing

Legal basis: Art. 6(1)(f) GDPR in conjunction with Section 25(2) TDDDG (essential cookies).

Data Export and Deletion of Your Account

Under Settings › Account you can request an export of your essential account, business and product data at any time (ZIP file with JSON and HTML): profile and settings, businesses, products, contracts, invoices, subscriptions, add-ons, memberships, delivery areas, attributes, categories, tags, documents and passkeys; you can obtain full access under Art. 15 GDPR on request. The download link is valid for seven days, after which the export file is deleted. You can also delete your account there.

Deletion is not yet possible while contracts are running, subscriptions are active, invoices are open, confirmed commissions have not yet been invoiced, orders from the last 120 days have not yet been confirmed or cancelled, or the 30-day run-off period after the end of an affiliate agreement is ongoing; we show you the reason and, where foreseeable, the date.

Upon deletion we block access immediately and delete your businesses, products, delivery areas, attributes, categories, tags, memberships, subscriptions, add-ons, passkeys, documents not related to contracts and data exports. Name, company, email address, address, password, two-factor sign-in data and settings are removed from the account. At Stripe we detach stored payment methods and remove the email address, phone number, address and tax ID from your customer account; invoices already issued remain there as accounting records.

Your account remains as a placeholder without contact details so that invoices, contracts, proofs of acceptance, clicks, orders and views can still be attributed and used for billing, corrections and statistics. Section IV sets out how long this data is retained.

Legal basis: Art. 6(1)(b), (c) and (f) GDPR, Art. 15, 17 and 20 GDPR.

III. Transfers to Third Countries

Transfers to third countries occur only where necessary for contract performance or based on your consent. Stripe and Apple may transfer data to the United States or other third countries. Sentry stores error reports in the EU (Frankfurt am Main); access by Functional Software, Inc. from the United States is possible. Such transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified, and otherwise on appropriate safeguards, in particular the EU Standard Contractual Clauses under Art. 46 GDPR. The OpenStreetMap Foundation is based in the United Kingdom, for which an adequacy decision of the European Commission exists. Shopify's privacy policy applies to processing by Shopify in your shop.

IV. Retention

Data is stored only for as long as necessary for the respective purpose and is then deleted. In detail:

• Account, business and product data: for the duration of use; after account deletion as described in section II
• Invoices and settled commission and payment data: for as long as the account exists, but at least eight years from the end of the invoice year (commercial and tax retention obligations)
• Contracts and contract documents: for as long as the account exists, but at least ten years from the end of the year in which the contract, including any renewals, ends
• Click data from affiliate tracking (hashed IP address, browser identifier, referrer, Click ID): anonymised 13 months after the click
• Orders (order number, notes): for invoiced orders, eight years from the end of the invoice year; confirmed commissions not yet invoiced, until invoicing; orders not invoiced or never paid are anonymised 24 months after the order; anonymisation does not take place while invoices, objection, cancellation or chargeback periods or reviews are open
• Proof of acceptance of legal texts (time, IP address, browser identifier): for as long as the account exists and then three years from the end of the year in which the account was deleted or, if later, your last contract ended; proof of acceptance of individual contracts three years from the end of the year in which the respective contract, including any renewals, ends (limitation period in each case)
• Application log files: 30 days
• Logs of the web server (Apache; without IP address, but with the address called, referrer and browser identifier), of the upstream proxy (with IP address) and other container logs: rotated by size and usually overwritten after a few days, after 30 days at the latest
• Access log of internal staff (page views, sign-in to the Partner's view, with IP address): 90 days
• Audit log (changes and sign-ins to the Partner's view, with IP address): 12 months
• Data exports: 7 days
• Deletion log (last email address, name, company name, reason for deletion, time): three years from the end of the year of deletion; afterwards only a record without personal reference that the deletion took place remains

Where legal reasons prevent deletion (e.g. pending claims or disputes), the data concerned is blocked until these are resolved and only deleted thereafter.

V. Your Rights

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, simply send a message to the email address above.

You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestr. 2-4, 40213 Düsseldorf, Germany.

Automated decisions: No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. We review the activation of your account manually. The automatic check of the tracking integration only determines technically whether the tracking scripts are embedded; if they are not, the shop's Deep Links temporarily do not redirect. This is not a decision with legal effect: your contract remains unaffected, and once the scripts are embedded you can trigger the check again in the Dashboard at any time.

Obligation to provide data: The data marked as mandatory at registration (name, email address, password, company name and business address with street, postcode, city and country) is required to conclude and perform the usage agreement; without it we cannot set up a Partner Account. Participation in the affiliate programme additionally requires a stored payment card and the VAT identification number (see the Affiliate Terms). There is no statutory obligation to provide data; all other information is voluntary.

VI. Recipients and Processors

We disclose data only where necessary to provide our services or where required by law. We have concluded data processing agreements under Art. 28 GDPR with service providers that process data on our behalf.

• **Hosting and email delivery:** Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, as processor on the basis of a data processing agreement under Art. 28 GDPR. The servers are located in Finland (Helsinki); backups are stored at Hetzner in the EU. On our own servers at this provider we operate the Dashboard, databases, search index, backups and log files as well as our own mail server, through which we send all emails; we do not use any further email delivery service. Backups are created daily, additionally stored in storage at Hetzner in the EU and deleted after six months at the latest.
• **Payment processing:** Stripe Payments Europe, Ltd., Dublin, Ireland (see section II).
• **Error detection:** Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA, as processor with data stored in the EU (Frankfurt am Main); error reports without default personal data are transmitted, as well as performance data for a sample of ten per cent of requests (see section II).
• **Geocoding:** OpenStreetMap Foundation (Nominatim), St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom; only the business address is transmitted.
• **Maps:** Apple Distribution International Ltd., Cork, Ireland (see section II).
• **Shopify as data source:** Shopify is not a recipient of data we disclose. Where you create order webhooks for affiliate tracking, we receive order data from your shop via Shopify at your instruction (see section II, Data of Your Shop's End Customers).
• **The public:** active business and product data can be accessed by anyone via Highcovery's website, app and interfaces.

VII. Changes to This Privacy Policy

We update this privacy policy when the legal situation or our offering changes. The version available in the Dashboard applies. We inform you about new versions in the Dashboard and by email.