.png?ts=1782305185)
Privacy Policy
Alpha E-Commerce Institut
As of: 22 September 2026
1. Controller
BOW Solutions UG (haftungsbeschränkt)
Stetten 23a, 83104 Tuntenhausen, Germany
Phone: +49 89 62 82 4893
Email: info@alpha-ecommerce-institut.de
The Alpha E-Commerce Institut is a brand and business division of the controller.
2. General information
We process personal data only insofar as this is necessary to provide the website, to carry out bookings and educational events, to communicate, to comply with legal obligations or on the basis of consent. Personal data is any information relating to an identified or identifiable person.
The legal bases are in particular Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (b) GDPR (contract and pre-contractual measures), Art. 6 (1) (c) GDPR (legal obligation) and Art. 6 (1) (f) GDPR (legitimate interests).
3. Hosting and server log files
The website and the shop are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. When the website is accessed, technically required data is processed, in particular the IP address, date and time, the URL accessed, the referrer URL, browser and operating system information, the volume of data transferred and the status code.
Processing serves the secure, stable and efficient provision of the website on the basis of Art. 6 (1) (f) GDPR. Log data is generally stored only for as long as is necessary for operation and security, as a rule for no more than 14 days; in the event of security incidents it may be retained until the matter has been fully clarified. A data processing agreement is in place with the host.
4. Shopware, technically necessary cookies and consent management
The website uses a self-hosted Shopware system. Technically necessary cookies or comparable storage technologies are used for the shopping cart, login, language, currency, session, security and checkout. The legal basis for accessing the device is § 25 (2) TDDDG; the subsequent processing is carried out under Art. 6 (1) (b) or (f) GDPR.
Non-essential analytics, marketing or embedding services are activated only after consent. The legal bases are § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. Consent is voluntary and may be withdrawn at any time with effect for the future via the cookie settings. The selection is stored in order to be able to demonstrate it and to take it into account again until it is withdrawn or the technically intended storage period expires.
5. Customer account, shopping cart and orders
When you register, place an order and during performance of the contract, we process in particular master and contact data, login data, invoice data, company affiliation, order and payment information, communication content and technical log data. The processing serves the initiation and performance of the contract under Art. 6 (1) (b) GDPR as well as compliance with commercial and tax law obligations under Art. 6 (1) (c) GDPR.
A customer account is maintained until it is deleted or until statutory retention periods expire. Contract and accounting records are retained in accordance with statutory periods, as a rule for six to ten years.
6. Seminar, training and certificate data
For organisation and delivery we process participant data, booked events, attendance and progress status, communication, submitted work, examination or assessment results, certificate data and, where applicable, data of the employer making the booking. The legal basis is Art. 6 (1) (b) GDPR. Insofar as employers make bookings or provide data, processing also takes place on the basis of the respective contractual relationship and legitimate interests in proper delivery under Art. 6 (1) (f) GDPR.
Evidence of participation and performance is stored for the period necessary for contract performance, for evidence of issued certificates, for defending against claims or on the basis of statutory and accreditation-related requirements. Work and learning data that is no longer required is regularly deleted after three years; certificate and billing data may be retained for longer to the extent necessary.
7. Contact, advice and CRM
When you contact us by form, email or telephone, we process the contact data and content transmitted in order to handle the enquiry. The legal basis is Art. 6 (1) (b) GDPR for pre-contractual or contractual communication, otherwise Art. 6 (1) (f) GDPR. Enquiries are deleted once they have been dealt with, unless statutory retention periods or legitimate documentation interests conflict with this.
For structured customer and prospect management, data may be processed in a CRM system. Only data required for advice, quotations, contract processing and permissible communication with existing customers is used. Recipients are the internally responsible departments and the processors engaged.
8. Newsletter and direct advertising
For newsletters we process the email address, where applicable the name, the time of consent, confirmation data and usage data. Sending to prospects is based on consent under Art. 6 (1) (a) GDPR using the double opt-in procedure. Permissible advertising to existing customers may be based on Art. 6 (1) (f) GDPR in conjunction with § 7 (3) of the German Act Against Unfair Competition (UWG). You may object to receiving the newsletter at any time via the unsubscribe link or by email.
Brevo, Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, may be used for sending. Brevo processes sending, delivery and usage data as a processor. Data is processed until consent is withdrawn or an objection is raised and thereafter only to the extent necessary in a suppression list for evidentiary purposes.
9. Payment processing
Depending on the payment method selected, we transmit the data required for processing to the respective payment service provider. The legal basis is Art. 6 (1) (b) GDPR; statutory verification and retention obligations are based on Art. 6 (1) (c) GDPR.
- PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg;
- Mollie: Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands; depending on the payment method, other banks, card companies or payment providers may be involved;
- Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden;
- Billie: Billie GmbH, Charlottenstraße 4, 10969 Berlin, Germany.
Payment providers may process data under their own responsibility, in particular for identity, creditworthiness, fraud and payment checks. Details are set out in their privacy notices. For payment methods that depend on creditworthiness, an automated decision by the payment provider may be made; we ourselves do not make any exclusively automated decision with comparably significant effect.
10. Electronic withdrawal function
For the online withdrawal function provided for by law, we process information identifying the contract, the scope of the withdrawal and the communication channel chosen. The purpose is to receive, document and confirm the withdrawal. The legal bases are Art. 6 (1) (b) and (c) GDPR. The data is stored together with the contract documents in accordance with statutory retention and limitation periods.
11. Microsoft Teams
We use Microsoft Teams for live online seminars, consultations and meetings. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Depending on use, the data processed includes in particular name, contact details, meeting metadata, IP address, device information, chat contributions and audio and video data.
Processing takes place for the performance of the contract under Art. 6 (1) (b) GDPR or on the basis of legitimate interests in efficient communication under Art. 6 (1) (f) GDPR. Recordings are made only after prior information and, where necessary, consent. Microsoft may also process data in third countries; applicable safeguards such as adequacy decisions or standard contractual clauses are used for this.
12. Google services
Google Tag Manager, Google Analytics 4 and Google Ads
With consent we use Google Tag Manager for the controlled integration of further services, Google Analytics 4 for reach and usage analysis and, where applicable, Google Ads for measuring campaigns and conversions. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The data processed includes in particular online identifiers, cookie and device information, IP address, interactions, referrer, approximate location data and conversion events.
The legal bases are § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. The services are activated only after consent. Consent can be withdrawn via the cookie settings. Data may be transferred to Google LLC in the USA; the EU-US Data Privacy Framework and standard contractual clauses in particular come into consideration as transfer safeguards.
Google Maps and Google reCAPTCHA
Google Maps may be used to display maps and Google reCAPTCHA to protect forms against automated misuse. In this context, IP address, device, browser and interaction data may be transmitted to Google. Activation generally takes place only after consent in accordance with § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. Insofar as reCAPTCHA is exceptionally used as a technical necessity to defend against specific attacks, processing takes place on the basis of § 25 (2) TDDDG and Art. 6 (1) (f) GDPR.
13. Microsoft Clarity
With consent we use Microsoft Clarity to analyse the use of our website. This may involve processing pseudonymous usage profiles, clicks, scrolling movements, session flows, device and browser information and IP-based location information. The provider is Microsoft Ireland Operations Limited. The legal bases are § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. Consent can be withdrawn at any time via the cookie settings. A transfer to Microsoft Corporation in the USA may take place on the basis of the EU-US Data Privacy Framework or standard contractual clauses.
14. Meta Pixel
With consent, the Meta Pixel may be used to measure the effectiveness of advertising, build audiences and attribute conversions. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The data processed includes in particular cookie and device identifiers, IP address, browser data, pages visited and event data. The legal bases are § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. Insofar as joint controllership exists, Meta and we regulate the respective obligations under Art. 26 GDPR. Data transfers to the USA may be based on the EU-US Data Privacy Framework or standard contractual clauses.
15. YouTube and Vimeo
Videos may be embedded via YouTube, a service of Google Ireland Limited, or Vimeo, a service of Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA. A connection to the respective provider is established only after consent. This may involve processing the IP address, device information, content accessed, interactions and, for logged-in users, account information.
The legal bases are § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. Where possible, YouTube is embedded in extended privacy mode. Transfers to the USA may be based on an adequacy decision for certified recipients or on standard contractual clauses.
16. Social media pages and links
Our website may link to pages on social networks. In the case of a mere link, a connection to the respective network is generally established only after clicking. When you visit our pages, the respective platform operator and we process usage, communication and interaction data. The legal basis for our processing is Art. 6 (1) (f) GDPR; consent is required for any tracking or marketing processing going beyond this.
17. Recipients and processors
Access is granted only to departments that need the data to fulfil their tasks. Recipients may include in particular hosting, IT, shop, CRM, newsletter, payment, accounting, audit, certification, event and communication service providers, speakers and public authorities where there is a legal obligation. Processors are contractually obliged in accordance with Art. 28 GDPR.
18. Transfers to third countries
Where services from international providers are used, processing may take place outside the European Union or the European Economic Area. Depending on the recipient, we base transfers on an adequacy decision, in particular the EU-US Data Privacy Framework for certified US companies, on standard contractual clauses or on a statutory exception. Despite safeguards, state authorities in third countries may have different possibilities of access.
19. Storage period
Unless a specific period is stated, we store data only for as long as the respective purpose exists. After that, it is deleted or blocked insofar as statutory retention periods, the assertion or defence of claims, evidence of consent or other legitimate grounds require further storage. Civil law claims generally become time-barred after three years; commercial and tax law periods are generally six to ten years.
20. Rights of data subjects
Subject to the statutory conditions, you have the right to information (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Consents may be withdrawn at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority.
The supervisory authority responsible for us is generally the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, https://www.lda.bayern.de.
21. Objection to direct advertising
Where data is processed on the basis of legitimate interests, you may object on grounds relating to your particular situation. You may object to processing for the purpose of direct advertising at any time without giving reasons.
22. Security and updates
We take appropriate technical and organisational measures to protect personal data, in particular transport encryption, access restrictions, permission concepts, backups and logging. This privacy policy will be updated if processing activities, the services used or the legal situation change.