Privacy Policy

1) Data controller

The data controller responsible for the processing of personal data on this website is ACQUA REAPER GmbH, Rheingaustraße 27, 12161 Berlin, Germany, email: office@acquareaper.com, represented by the managing directors Fabio Perlungo and Jonas Lonsdorfer. Further details can be found in the legal notice.

2) Key points at a glance

This website only sets a cookie if you consent to partner tracking (section 4a). Furthermore, we do not use any analytics or retargeting tools, social media plugins or embedded videos or fonts from third-party providers — we host fonts, images and videos on our own server. Links to other services (e.g. Instagram, sources cited in our articles, Google Maps in the store finder) are simply references: data is only sent to these sites once you click on such a link. Exceptions where data is sent to another server when a page is accessed include the store finder (Section 6) and the submission of forms and orders (Sections 7 and 8). The connection to our website is encrypted using TLS.

3) Website visits and server log files

Our website is hosted on servers belonging to Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, at two locations within the EU: in Nuremberg (Germany) and — to ensure redundancy — in Helsinki (Finland). Hetzner processes the data on our behalf (Article 28 of the GDPR).

Each time you visit the site, the web server records the following in a log file: your device’s IP address, the date and time, the URL accessed, the HTTP status code, the amount of data transferred, the previously visited page (referrer) and your browser’s identifier (user agent). Error messages from the web server may also contain the IP address. We require this data to deliver the website, ensure its security and stability, and detect attacks (Article 6(1)(f) of the GDPR). The logs are rotated daily and automatically deleted after 14 days; they are not combined with any other data and are only analysed if there are specific indications of misuse.

4) Storage in your browser

To ensure that your shopping basket is retained when you switch between pages, your browser stores the following locally (‘localStorage’): the contents of the shopping basket, including any discount codes entered and subscription options selected, and, once an order has been placed, the order number and time. Your details from the checkout (so that you do not have to re-enter them if you try again) are only stored for the duration of the session (‘sessionStorage’); they are deleted as soon as you close the tab. This data remains on your device and is only transmitted when you submit an order. The storage of this data is strictly necessary for the shopping basket you have selected (Section 25(2)(2) of the TDDDG); further processing serves to initiate the contract (Article 6(1)(b) of the GDPR). You can delete the data at any time via your browser settings; once an order has been paid for, the website clears the shopping basket automatically.

4a) Affiliate tracking with Awin (only with your consent)

We work with partners who link to us on their websites and channels and receive a commission in return. This is managed by the partner network of Awin AG, Eichhornstraße 3, 10785 Berlin. If you visit us via a partner’s link, a click ID is transmitted. Only if you select ‘Allow’ in the banner at the bottom of the page will the website load the Awin script, which stores this identifier in a cookie, and, following a paid order, report the order number and the value of the goods to Awin so that the partner receives their commission. The legal basis for this is your consent (Section 25(1) of the German Telemedia Act (TDDDG), Article 6(1)(a) of the General Data Protection Regulation (GDPR)).

We will store your decision in your browser (localStorage, key “ar-consent”) and ask you again after 12 months. You can withdraw your consent at any time with future effect via “Cookie settings” at the bottom of every page. If you decline, the website will not load anything from Awin, and the page and the shop will function in exactly the same way.

5) Counting the steps in the ordering process without cookies

To identify at which stage visitors abandon their purchase, the website tracks four steps as simple counts: viewed the product page, added an item to the basket, opened the basket, and opened the checkout — along with whether a basket was filled via a campaign link. Upon entry, the source is also recorded (the campaign parameter ‘utm_source’ or the name of the website you came from). Only one number is stored per day, step and source — no IP address, no identifier, no cookie, nothing on your device. The browser identifier is read only to exclude automated requests (search engines, testing programmes) from the count, and is not stored. The log entry appears, like any page view, in the server log files (Section 3) and is forwarded to our shop application (Section 8.2). The legal basis is our legitimate interest in improving the ordering process (Article 6(1)(f) of the GDPR).

6) Store finder

The ‘Where can I buy it?’ page displays a map of our stockists. Your browser loads the list of stockists and the map tiles from our own server, ar-legacy.reaperdash.com (Hetzner, Nuremberg). This server is connected via Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, which acts as a network and security service provider to facilitate the connection; in doing so, Cloudflare receives your IP address and your browser’s technical details. The map tiles are provided by MapTiler AG (Switzerland) using map data from © OpenStreetMap contributors; our server retrieves them directly, and MapTiler does not receive your data. The legal basis for this is our legitimate interest in showing you a map of our stockists (Article 6(1)(f) of the GDPR).

If you tap ‘My Location’, your browser will ask for your permission. Your location will only be used once you have given your consent — and only within your browser, to show you the nearest stockists; it will not be shared with us or any third parties. The ‘Google Maps’ and ‘Website’ buttons at a stockist are simply links; only when you click on them will you be taken to Google or the stockist’s website, where their respective privacy policies then apply.

7) Contact and application forms, email

If you contact us via a form (e.g. the contact form or sponsorship application form), we will process the information provided in the form in order to respond to your enquiry. Your browser sends the form to our automation service n8n.reaperdash.com, which we operate ourselves on servers belonging to Hetzner Online GmbH in Germany and which is also connected via Cloudflare (section 6). From there, the enquiry is sent via our email service provider Brevo (Section 8.6) as an email to our inbox and is stored in our customer management system (Section 8.2). The automation service deletes its activity logs after seven days. The legal basis is Article 6(1)(b) of the GDPR if your enquiry relates to a contract; otherwise, it is our legitimate interest in responding (Article 6(1)(f) of the GDPR). We will delete the data once your enquiry has been dealt with and provided there are no statutory retention obligations to the contrary. The same applies if you contact us directly by email.

8) Orders placed via the online shop

8.1 What data we process and why

When you place an order, we process the details provided at checkout (first name and surname, delivery address, email address, and – if provided – company name and telephone number), the items ordered, prices, any discount codes redeemed, the time at which you accepted the Terms and Conditions, as well as the payment method and payment status. We use this information to conclude and fulfil the contract: payment, dispatch, order confirmation, dispatch and delivery notifications, and, in the case of a subscription, subsequent deliveries (Article 6(1)(b) of the GDPR). Without this information, we cannot accept the order. We retain orders and invoices in accordance with commercial and tax law regulations (Article 6(1)(c) of the GDPR, Section 257 of the German Commercial Code (HGB), Section 147 of the German Fiscal Code (AO)) — for six, eight or ten years, depending on the document.

8.2 Our online shop application

We manage orders, subscriptions, deliveries and reminders in our own application, ‘reaperdash’, which we operate ourselves on servers belonging to Hetzner Online GmbH in Nuremberg. Your browser sends your order to our website; our web server forwards it to this application. The connection to this application is routed via Cloudflare (Section 6); in the process, the order details and your IP address are transmitted. We use the IP address solely to limit an excessive number of requests; we do not store it in the order details.

8.3 Payment via Mollie

To complete the payment, we will redirect you to the payment page of Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. Mollie will receive the amount, order number and payment reference, as well as your name and email address in the case of a subscription; you will enter the details for your chosen payment method directly with Mollie. In the case of a subscription, Mollie will register you as a customer and store the direct debit authorisation provided at the time of the first payment so that subsequent payments can be debited. Depending on the payment method, the relevant providers may also receive data (e.g. PayPal (Europe) S.à r.l. et Cie, S.C.A., Klarna Bank AB, your card issuer or Apple); some of these carry out their own checks, such as Klarna’s credit check. This processing is subject to the privacy policy of the respective provider, which is displayed on the payment page. The legal basis is Article 6(1)(b) of the GDPR.

8.4 Delivery via GLS

For the purposes of delivery, we pass on your name, delivery address, email address and — if provided — telephone number to GLS General Logistics Systems Germany GmbH & Co. OHG, GLS-Germany-Straße 1–7, 36286 Neuenstein. GLS uses your email address and telephone number to inform you about the delivery and to arrange it with you. The legal basis is Article 6(1)(b) of the GDPR; for email and telephone, this is supplemented by our legitimate interest in ensuring smooth delivery (Article 6(1)(f) of the GDPR).

8.5 Stock Management

We enter every paid order into our stock management system, weclapp (weclapp SE, Frankfurt am Main) — including name, address, email address, telephone number and the order items — in order to issue invoices, process stock entries and carry out bookkeeping. weclapp processes the data on our behalf (Article 28 of the GDPR; Article 6(1)(b) and (c) of the GDPR).

8.6 Order-related emails — with open and click tracking

We send order confirmations, dispatch and delivery notifications, subscription emails and reminders via Sendinblue GmbH (Brevo), Köpenicker Straße 126, 10179 Berlin, which acts on our behalf (Article 28 of the GDPR). Brevo receives your email address, your name and the content of the email for this purpose.

In these emails, Brevo tracks whether and when an email has been delivered and opened, and which links within it have been clicked. To this end, each email contains an invisible tracking pixel, which is loaded from Brevo’s server when the email is displayed, and the links are routed via a Brevo redirect address. In doing so, the time, IP address and technical details of your email programme or browser are processed. We use this information to monitor the deliverability of our emails (for example, to check whether order confirmations end up in spam folders), to identify delivery errors and to detect misuse of our sender addresses. The legal basis for this is our legitimate interest (Article 6(1)(f) of the GDPR). We do not use this data for advertising analysis or to create profiles.

You may object to this tracking at any time by sending an informal email to office@acquareaper.com. You can also prevent it by disabling the automatic reloading of images in your email programme; however, this will not prevent you from being redirected when you click on a link.

8.7 Discount codes

When you redeem a discount code, we store the code, the order, your email address and the discount amount to ensure that a code is only redeemed as many times as permitted by its terms and conditions – for example, once per email address (Article 6(1)(b) and (f) of the GDPR). This information is retained alongside the order.

8.8 Subscription

For a subscription, we also store the product types, quantity, frequency, upcoming delivery dates, pauses and changes, as well as the customer and mandate IDs held with Mollie. We use this information to arrange deliveries, process payments and send you a reminder three days in advance (Article 6(1)(b) of the GDPR). You can manage and cancel your subscription without a customer account: via the personal link in every subscription email or on the ‘Cancel contracts here’ page, which asks for your email address and, optionally, your subscription number. After your subscription ends, we will retain the data for as long as required by the retention periods set out in Section 8.1.

8.9 Reminder regarding an uncompleted order

If you submit an order but do not complete the payment, we will send you up to two email reminders regarding that specific order — after approximately one hour and after approximately one day — including a link that allows you to complete the payment. The legal basis for this is the initiation of the contract, which you began by submitting the order (Article 6(1)(b) of the GDPR), or, alternatively, our legitimate interest in ensuring that an order you have started is not lost (Article 6(1)(f) of the GDPR). If you have since paid, placed a new order or your payment is still being processed (e.g. a bank transfer), we will not send a reminder. You can unsubscribe from further reminders at any time via the link in each reminder; your email programme can also do this with a single click using the unsubscribe function at the top of the email.

8.10 Offers by email only with consent

Only if you give your explicit consent at the checkout (“Yes, ACQUA REAPER may send me offers and news by email …”), will we send you offers — currently a third reminder regarding an outstanding order after approximately four days, including a discount code (Article 6(1)(a) of the GDPR, Section 7(2)(2) of the UWG). We record the date and wording of your consent as evidence. For the newsletter, see section 8.14. You may withdraw your consent at any time with future effect — via the link in every email or by emailing office@acquareaper.com; the lawfulness of emails sent up to that point remains unaffected.

8.11 Cancellation

If you unsubscribe from reminders or withdraw your consent, we will add your email address to a block list so that you no longer receive such emails. We will retain this block list for as long as it serves this purpose, even after your other data has been deleted (Article 6(1)(c) and (f) of the GDPR). You will continue to receive emails relating to a paid order or an active subscription.

8.12 Uncompleted orders

We anonymise data relating to orders that have never been paid for 30 days after they are placed: your name, address, email address, telephone number and the stored consent are removed; only the order number, items and amounts remain, without any reference to you personally. The same applies to a subscription for which the first payment was never received. This does not apply to orders for which payment is still pending or has already been received at that point; we will deal with these on a case-by-case basis.

8.13 Affiliate Programme

If you apply via the form on our partner page, your browser will send your name, email address, the type of your channel, the link or name of your channel, the reach, your company name (if provided) and message, as well as information on whether you are liable for VAT or a small business owner, directly to our shop application (Section 8.2). We store the application there with the date. You will receive a confirmation of receipt via Brevo (Section 8.6), and we will receive a notification. Before making a decision, we will review the specified, publicly accessible channel; the decision is made by a person, not a programme.

If we accept you, you will receive a personal discount code and a link containing this code. To process your monthly credit, we will also process your address, VAT registration number or tax reference, IBAN and account holder details, as well as the orders placed using your code. Your credit note will only show the order number, date and value of the goods — you will not be provided with the names, addresses or email addresses of our customers. The legal basis is Article 6(1)(b) of the GDPR (establishment and performance of the business relationship); for the credit notes, Article 6(1)(c) of the GDPR also applies. We retain credit notes for ten years to comply with tax and commercial law obligations (Section 147 of the German Fiscal Code (AO), Section 14b of the German Value Added Tax Act (UStG)). We automatically delete rejected applications six months after the rejection. If you have previously received a credit note from us, we will remove your details from our partner management system at the same time; the credit notes themselves will be retained for the duration of the retention period.

If you make a purchase yourself via the link or using a partner’s code, we will attribute your order to that partner via the code in order to calculate the commission. We do not set a cookie or a tracking pixel for this purpose; the code is contained in the link and is transferred to your shopping basket (section 4). The legal basis for this is our legitimate interest in the administration of our affiliate programme (Article 6(1)(f) of the GDPR). The affiliate does not receive any personal data about you.

8.14 Newsletter

If you sign up for the newsletter via the ‘Mystery Discount’ form on our website, your browser will send your email address to our shop application (section 8.2). There, we store the address, the time, the wording and the version of the consent you have given, the point of registration, and a rough indication of your browser and operating system. We do not store your IP address in plain text, but only as an encrypted checksum, which enables us to detect bulk registrations from a single source. The legal basis is your consent (Article 6(1)(a) of the GDPR, Section 7(2)(2) of the UWG); we store the details proving your consent due to our obligation to provide evidence (Article 7(1) of the GDPR).

Once you have registered, we will send you an email containing a confirmation link (double opt-in). Only once you have confirmed your registration via this link will you receive issues of the newsletter and a one-off email containing your discount code. When you redeem the code, we will cross-check the email address on the order against your registration details and record the redemption to ensure the code is only valid once per address. The link is valid for seven days and can be used once; to prevent anyone from flooding other people’s addresses with our emails, we send no more than one confirmation email to an address every ten minutes and no more than three in a single day. We do not store the link itself, only a verification value calculated from it. As proof of your consent, we record when you registered, when we sent the confirmation email (including the identifier from our email service provider Brevo, section 8.6, which is also used there to track opens and clicks), when you confirmed your subscription and, where applicable, when you unsubscribed, in each case along with the version of the consent text — without your IP address (Article 7(1), Article 6(1)(c) of the GDPR).

If you do not confirm your subscription, we will automatically delete your email address and all associated details 30 days after you subscribed or after the last confirmation email. You may withdraw your consent at any time with future effect — via the unsubscribe link in each issue or by emailing office@acquareaper.com. Once you have unsubscribed, you will no longer receive the newsletter; we will retain a record of your previous consent and your unsubscription for three years, after which we will automatically delete it (Article 6(1)(c) and (f) of the GDPR).

9) Recipients at a glance

• Hetzner Online GmbH, Gunzenhausen — Hosting of the website and our applications (Nuremberg, Helsinki)
• Cloudflare, Inc., San Francisco, USA — network and security service in front of our shop application, the store finder and the form submission
• Mollie B.V., Amsterdam — payment processing, as well as the providers of the selected payment method
• GLS General Logistics Systems Germany GmbH & Co. OHG, Neuenstein — Dispatch
• weclapp SE, Frankfurt am Main — Stock management and invoicing
• Sendinblue GmbH (Brevo), Berlin — Email marketing, with open and click tracking

Furthermore, we only disclose data if we are legally obliged to do so (for example, to tax authorities) or if it is necessary to enforce our claims.

10) Transfer to third countries

Cloudflare, Inc. is based in the USA; data may therefore be transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision (Article 45 of the GDPR). The other recipients mentioned are based in the EU. In the case of payment service providers, this is governed by their respective privacy policies.

11) Your rights

You have the right to access the data we process (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw any consent you have given at any time with effect for the future (Article 7(3) of the GDPR). To do so, please contact office@acquareaper.com or write to our postal address.

Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation; we will then no longer process the data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, or the processing is necessary for the establishment, exercise or defence of legal claims. You may object to the use of your data for marketing purposes at any time without giving reasons.

You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 of the GDPR). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin.

12) Automated decisions

We do not make any decisions based solely on automated processing within the meaning of Article 22 of the GDPR. Providers of individual payment methods are responsible for any checks they carry out themselves (Section 8.3).

As at 22 October 2026