Who Is Responsible
The controller for Round’s website, sales, accounts and support is the operator named in the Legal Notice.
For privacy requests, email hello@round.page or use our contact form.
Businesses are responsible for the purposes and legal basis of processing for their own pages and loyalty programmes. Round provides the hosting and management tools.
Data We Use & Why
- Contact enquiries: your name, email, optional phone number and message, to respond and follow up. The basis is taking steps toward a contract or performing it (GDPR Article 6(1)(b)), or our legitimate interest in answering other enquiries (Article 6(1)(f)).
- Newsletter: your email address and signup time, to record your subscription to Round updates, based on consent (GDPR Article 6(1)(a)). Withdraw consent through our contact form or by email.
- Purchases and contract notices: contact, delivery, order, artwork, payment, withdrawal, and cancellation data, to fulfil and document your contract (Article 6(1)(b)) and meet statutory recordkeeping duties (Article 6(1)(c)).
- Accounts: contact, login, and account data to provide Round Pages (Article 6(1)(b)), and administer business accounts and protect access (Article 6(1)(f), our interest in reliable, secure account administration).
- Service operation: IP addresses, connection, and diagnostic data to deliver, secure, and troubleshoot the service (Article 6(1)(f), our interest in reliable operation and preventing misuse).
- Business pages and loyalty: page views, action clicks, card and device identifiers, optional names, and stamp/reward history, including actions recorded by the business’s staff, to provide pages, activity reports, and loyalty programmes for that business.
- Website statistics: Cloudflare Web Analytics processes page views, referrers, device information, and loading performance without analytics cookies. We use this to understand and improve our website (Article 6(1)(f), our interest in assessing website use and performance).
Required order and account details are necessary to process your request; without them we cannot provide the corresponding service. Browsing and newsletter signup do not require an account.
Service Providers & Recipients
We share data only as needed with authorized staff and these providers:
- Hosting and data storage: AWS and Supabase.
- Payments: Stripe (checkout and payment data). Delivery: DHL (delivery details).
- Email delivery: Resend (recipient addresses and message content; US).
- Service operation and security: Grafana Cloud (diagnostic data).
- Website delivery, security and statistics: Cloudflare (request and usage data).
- Optional loyalty wallets: Apple Wallet or Google Wallet (loyalty-card and device data when saving or updating cards).
- Optional business search: Google Maps (privacy policy) receives your search text and language to suggest businesses. You can paste a review link instead. We save the selected review URL with your order.
- Optional contact: WhatsApp (communications). Email and our contact form are alternatives.
Processing also takes place outside the EEA, including in the US and Singapore. Safeguards include EU Standard Contractual Clauses and, for covered US recipients, the EU–US Data Privacy Framework adequacy decision, as described in the linked provider terms. Request information or copies of the applicable safeguards at hello@round.page.
How Long Data Is Kept
We regularly review enquiry data after resolution and account, page, and loyalty data when the relevant service ends. We delete or anonymise data when it is no longer needed for the request, service, or applicable legal claims. Newsletter data is retained until consent is withdrawn, except necessary evidence for legal claims.
Statutory retention generally covers invoices/accounting vouchers for eight years, business correspondence for six years, and accounting books for ten years (§ 147 AO), counted from the relevant year-end. Records necessary for legal claims may be retained through the applicable limitation periods (Article 6(1)(f), our interest in establishing or defending claims).
Unlinked uploads become eligible for deletion after 24 hours. Linked artwork follows the retention of its related order or content. Request erasure at hello@round.page; ending a subscription alone does not delete your account or all records.
Backups and technical monitoring records follow the configured provider retention windows. Deleted live data may remain in older backups until those backups expire.
Your Privacy Rights
Subject to the GDPR’s conditions, you may request access, correction, erasure, restriction, and data portability. Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. You may object to direct marketing at any time.
You may withdraw consent without affecting earlier lawful processing and complain to a data protection authority, especially where you live, work, or believe an infringement occurred. The Berlin Commissioner for Data Protection and Freedom of Information provides a complaint route.
External Destinations & Updates
Opening an external link takes you to another provider, whose own privacy information applies.