Data Processing (DPA Overview)
1. Data Controller
Elektronikhandel Michael Gräf
Breitscheidstraße 84, 70176 Stuttgart
Germany
E-Mail: info@ampario.de
2. Purpose of Data Processing
Ampario processes personal data for the following purposes:
- Account management and authentication
- Order processing and payment handling
- Messaging between buyers and sellers
- Shipping label generation and tracking
- Email notifications (order updates, security alerts) including link-click tracking on transactional emails (excluded for security/authentication emails, see Privacy Policy section 7)
- Platform security and fraud prevention
3. Sub-Processors
The following service providers are used as sub-processors:
| Provider | Location | Purpose | Legal Basis |
|---|---|---|---|
| Stripe Inc. | San Francisco, USA | Payment processing & seller payouts | EU-US Data Privacy Framework |
| Resend Inc. | San Francisco, USA | Transactional emails | EU-US Data Privacy Framework |
| Vercel Inc. | San Francisco, USA | Application hosting & CDN | EU-US Data Privacy Framework |
| Neon Inc. | San Francisco, USA | PostgreSQL database hosting (EU-Central-1) | EU-US Data Privacy Framework, data stored in EU |
| Hetzner Online GmbH | Gunzenhausen, Germany | Object storage (S3) for listing images | GDPR (EU processor) |
4. Technical & Organizational Measures (TOM)
- Encryption in transit (TLS 1.2+)
- Encryption at rest (database, file storage)
- Access control (role-based, principle of least privilege)
- Authentication security (2FA/TOTP, Passkeys/WebAuthn, rate limiting)
- Regular security updates and dependency monitoring (Dependabot)
- Automated error tracking and incident response
- Data minimization (only necessary data collected)
- Data deletion (account deletion removes personal data within 30 days)
5. Data Subject Rights
A complete overview of your rights under Art. 15–21 GDPR can be found in our privacy policy:
6. Contact
For inquiries regarding data processing, please contact:
7. Date
March 11, 2026