Privacy Policy

M-board is software for retailers who manage their orders, inventory and prices across online marketplaces and shop systems (e.g. Shopify, Zalando, Amazon, OTTO). In doing so, we process personal data of our merchants' end customers on behalf of the respective merchant (processing pursuant to Art. 28 GDPR). The merchant is the controller for this data; a data processing agreement is in place with every merchant, which also sets out the security measures and sub-processors.

Data processed: order data including the buyer's name, delivery and billing address, email address and telephone number, and the items ordered. We receive this data via the interfaces of the connected marketplaces and shop systems (for Shopify via the “M-board” app installed by merchants).

Purpose: fulfilling the order – assignment to a store, picking, creation of shipping labels and customs documents, returns and refunds. The data is not used for advertising, analytics or profiling, and it is not sold.

Recipients: shipping carriers engaged by the merchant (e.g. DHL, DPD) for delivering the shipment, the merchant's ERP system where connected, and technical service providers we use to operate the platform and retrieve order data.

Amazon data (Selling Partner API): For merchants who have connected Amazon, M-board retrieves order, listing and inventory data via the Amazon Selling Partner API – exclusively with the merchant's authorisation and only for that merchant's own seller account. We use personal data of Amazon buyers (name, delivery address, contact details) solely to fulfil the respective order, i.e. for the shipping label, delivery and returns. We disclose it to the shipping carrier engaged by the merchant and to technical service providers we use to retrieve and process order data. We do not combine it with data of other merchants, and use it neither for advertising nor for analytics or the training of AI models. 30 days after an Amazon order is completed (shipment, cancellation or return), the buyer's name, address and contact details and the associated shipping labels are deleted automatically. Deletion requests that reach us from Amazon are carried out separately for the orders concerned.

AI features: AI-supported features of M-board (e.g. product data enrichment, price recommendations) work with item, inventory and sales data. Personal data of buyers is not transmitted to external AI providers.

Hosting and security: Processing takes place on Amazon Web Services servers in Frankfurt (region eu-central-1). Data is encrypted in transit (TLS) and encrypted at rest; access is restricted to employees who need it to operate the service, and is logged.

Retention and deletion: Order data is stored for as long as the merchant uses M-board and retention obligations under commercial or tax law apply; for buyer data from Amazon orders, the 30-day period stated above applies. We handle access and deletion requests from end customers in coordination with the merchant; deletion and access requests that reach us via Shopify (compliance webhooks) are carried out within 30 days. After the business relationship ends, the merchant can export its data for 30 days; it is then deleted within a further 30 days.

Data breaches: In the event of a personal data breach, we inform the merchants affected without delay, at the latest within 24 hours of becoming aware of it. Contact: Patrick Michelberger, info@michelberger.digital.

Google Analytics: We use Google Analytics to analyse use of the website. In doing so, data is transmitted to Google. Further information can be found in Google's privacy policy.

PostHog: We use PostHog to analyse use of our website and application. The data is processed on servers in the European Union. PostHog is activated only once you have agreed in the cookie banner; you can withdraw your consent at any time.

LinkedIn Insight Tag: Our website includes the Insight Tag of LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland). It measures which of our LinkedIn ads lead to a visit or a demo request and enables relevant ads to be shown on LinkedIn. Your IP address, device and browser data and the pages visited are transmitted to LinkedIn; transfer to LinkedIn Corporation in the USA is possible. The sole legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG) – the tag is loaded only once you have agreed to the “Marketing” purpose in the cookie banner. You can withdraw your consent at any time via the privacy settings.

Microsoft Teams: We use Microsoft Teams for video calls and online meetings. Microsoft's privacy terms can be found on its website.