This is a convenience translation. Only the German version is legally binding.
for the SaaS platform “MarketplAIce”
available at https://marketplaice.io/ and https://app.marketplaice.io/
Version: November 2026
The controller within the meaning of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and other data protection provisions is:
AMZ+ Consulting GmbH
Salinenstraße 3
49214 Bad Rothenfelde
Germany
Managing Director: Jorginho Engelmeyer
Commercial register: HRB 212694
VAT ID: DE 815770366
Phone: +49 1556 1267682
Email: info@marketplaice.io
Data protection inquiries: privacy@marketplaice.io
The controller has not appointed a data protection officer, as the requirements under Art. 37 GDPR in conjunction with § 38 BDSG are currently not met. If you have any questions about data protection, please contact the email address above.
(1) The platform “MarketplAIce” (available at https://marketplaice.io/ and https://app.marketplaice.io/) is a SaaS platform directed exclusively at entrepreneurs within the meaning of § 14 of the German Civil Code (BGB). Personal data is always processed in accordance with the GDPR, the BDSG and the German Telecommunications Digital Services Data Protection Act (TDDDG).
(2) Personal data is only collected if you provide it to us voluntarily in the course of registration, use of the Platform or contacting us, or if its collection is necessary for the performance of the contract or on the basis of another legal basis.
(3) We take appropriate technical and organizational measures in accordance with Art. 32 GDPR to protect your personal data against accidental or intentional manipulation, loss, destruction or access by unauthorized persons (cf. § 8 of this Privacy Policy).
In the course of the use of our Platform, we process the following categories of personal data:
Consent can be withdrawn at any time with effect for the future.
Our Platform uses the Amazon Selling Partner API (SP-API) and the Amazon Advertising API exclusively on behalf of and with the OAuth authorization of the respective seller.
MarketplAIce processes Amazon seller data exclusively via Amazon’s official Selling Partner API (SP-API). Processing is carried out exclusively on behalf of the respective authorized seller. Data is not passed on to third parties, not aggregated between different seller accounts and not used for our own analysis purposes. We comply with Amazon’s Data Protection Policy (DPP) and the associated Acceptable Use Policies (AUP).
(1) Our Platform consists of two technical components:
(2)Users’ personal data is stored exclusively in the EU (Frankfurt, eu-central-1). Data is transferred to third countries outside the EU/EEA only insofar as this is necessary for the processors named in § 7 and § 9 and is secured by appropriate safeguards pursuant to Art. 46 GDPR.
(3) When the website is accessed, the hosting infrastructure creates server log files (IP address, browser, date/time, file accessed, referrer). This data serves security and availability purposes and is deleted after 90 days at the latest. Legal basis: Art. 6(1)(f) GDPR.
(1) In accordance with Art. 28(1) GDPR, we only work with processors that provide sufficient guarantees that appropriate technical and organizational measures are implemented in such a manner that the processing complies with the GDPR and ensures the protection of the rights of the data subjects.
(2) Data processing agreements (German: AVV) or Data Processing Agreements (DPA) pursuant to Art. 28(3) GDPR are in place with all processors named below.
Level 1 – Controller ↔ processor: AMZ+ Consulting GmbH (controller) has concluded a Data Processing Agreement (DPA) pursuant to Art. 28(3) GDPR with each of the processors listed below in § 7.4 (in particular Vercel Inc., Supabase Inc., Stripe Payments Europe Ltd., Resend Inc., Anthropic PBC, Google LLC, Calendly LLC, Rewardful Inc.). These processors process personal customer data exclusively on behalf of and on the documented instructions of the controller.
Level 2 – Processor ↔ sub-processor: To provide the database and storage infrastructure, Supabase Inc. uses Amazon Web Services (AWS) in the Frankfurt region (eu-central-1) as a sub-processor. Vercel Inc. likewise uses AWS as well as Cloudflare as sub-processors for CDN and edge services. DPAs pursuant to Art. 28 GDPR are in place with all sub-processors.
The current list of sub-processors is publicly available here:
We inform affected users about changes to sub-processors and grant a right to object within ten (10) business days.
The DPAs include in particular the following assurances:
| Service provider | Purpose | Role | Server location | Third country | Safeguard |
|---|---|---|---|---|---|
| Vercel Inc. (USA) | Frontend hosting (Next.js), CDN, edge functions | Processor | EU + global edge | Yes* | DPA, SCCs, EU-US DPF, SOC 2 Type II |
| Supabase Inc. (Singapore/USA) | Database, authentication, file storage | Processor | EU (Frankfurt, eu-central-1) | No* | DPA, SOC 2 Type II, SCCs |
| Amazon Web Services EMEA SARL | Cloud infrastructure (sub-processor of Supabase and Vercel) | Sub-processor | EU (Frankfurt, eu-central-1) | No | DPA, SOC 2, ISO 27001 |
| Stripe Payments Europe Ltd. (Ireland) | Payment processing, subscription management | Processor | EU + USA | Yes* | DPA, PCI DSS Level 1, SCCs, EU-US DPF |
| Resend Inc. (USA) | Transactional and marketing email delivery | Processor | EU + USA | Yes* | DPA, SCCs, EU-US DPF |
| Anthropic PBC (USA) | AI analyses via the Claude API (text and data analysis) | Processor | USA | Yes | DPA, SCCs |
| Google LLC (Gemini API) | AI analyses, text generation, image analysis | Processor | EU / USA | Yes | DPA, SCCs, EU-US DPF |
| Rewardful Inc. (USA) | Creator partner program, referral tracking | Processor | USA | Yes | DPA, SCCs |
| Calendly LLC (USA) | Appointment scheduling | Processor | USA | Yes | DPA, SCCs, EU-US DPF |
| Meta Platforms Ireland Ltd. | Advertising (Meta Pixel, Conversions API) | Joint controller / processor | EU + USA | Yes | Joint Controller Addendum, SCCs, EU-US DPF |
| LinkedIn Ireland Unlimited Company | Advertising (LinkedIn Insight Tag) | Processor | EU + USA | Yes | DPA, SCCs, EU-US DPF |
| OpenAI Ireland Ltd. | Advertising (ChatGPT Ads Pixel, conversion measurement) | Recipient on the basis of your consent | EU + USA | Yes | SCCs |
| Microsoft Ireland Operations Ltd. | Microsoft Clarity (heatmaps, session recording) | Processor | EU + USA | Yes | DPA, SCCs, EU-US DPF |
| Google Ireland Limited | Google Analytics, Tag Manager, Search Console, Fonts, Ads | Processor | EU + USA | Yes | DPA, SCCs, EU-US DPF |
| Instantly.ai Inc. (USA) | B2B cold outreach to business contacts | Processor | USA | Yes | DPA, SCCs |
| Apollo.io Inc. (USA) | B2B lead research and contact enrichment | Processor | USA | Yes | DPA, SCCs |
*Vercel and Stripe are US companies, but process user data primarily on EU servers. Supabase is registered in Singapore/USA, but operates the database instances used for MarketplAIce exclusively on AWS servers in Frankfurt (eu-central-1). A transfer to the USA for support and maintenance purposes cannot be ruled out and is secured by SCCs and/or the EU-US Data Privacy Framework.
We take the following technical and organizational measures to protect personal data:
(1) Personal data is transferred to third countries outside the EU/EEA only insofar as this is necessary for the performance of the contract or you have given your consent, and only in compliance with Art. 44–49 GDPR.
(2) For transfers to service providers in the USA, we rely on the following safeguards:
(3) For AI processing (Google Gemini API, OpenAI), personal data is transmitted in anonymized or pseudonymized form as far as technically possible.
(4) The DPF certifications of the service providers used can be verified at https://www.dataprivacyframework.gov/ (including Google LLC, Meta Platforms, LinkedIn, Microsoft, Vercel, Stripe, Calendly).
(1) On our Platform, we use technically necessary cookies for session management and for storing your settings (e.g. authentication, sidebar state, language selection). These cookies are strictly necessary for the operation of the Platform and do not require consent (§ 25(2) No. 2 TDDDG).
(2) In addition, cookies and similar technologies are set by integrated analytics and advertising tools, insofar as you have given your express consent to this via our cookie banner (§ 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR).
(3) You can withdraw your consent at any time with effect for the future by reopening the cookie settings via the cookie banner or by deleting the corresponding cookies in your browser.
If you contact us by email, phone or contact form, your inquiry including all personal data arising from it (name, email, inquiry) will be stored and processed by us for the purpose of handling your request.
The processing is based on Art. 6(1)(b) GDPR if your inquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of the inquiries addressed to us (Art. 6(1)(f) GDPR).
The data remains with us until you ask us to delete it, withdraw your consent or the purpose for storing the data no longer applies. Statutory retention periods remain unaffected.
On our website, you have the option of scheduling appointments with us. We use the tool “Calendly” for this purpose. The provider is Calendly LLC, 271 17th St NW, 10th Floor, Atlanta, Georgia 30363, USA.
The data entered (name, email, appointment, optionally phone) is used for planning, conducting and following up on the appointment. Calendly’s privacy policy: https://calendly.com/privacy
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in efficient appointment organization). If consent was requested: Art. 6(1)(a) GDPR and § 25(1) TDDDG. Third-country transfer: SCCs and EU-US DPF (https://calendly.com/pages/dpa). We have concluded a DPA.
Provider: Google Ireland Limited, Dublin, Ireland. Google Tag Manager does not create user profiles, does not store cookies and does not carry out any analyses of its own. It does, however, record IP addresses, which may be transferred to Google in the USA. Legal basis: Art. 6(1)(f) GDPR; if consent was requested: Art. 6(1)(a) GDPR and § 25(1) TDDDG.
Provider: Google Ireland Limited. Uses cookies and device fingerprinting to analyze usage behavior (anonymized IP, session duration, page views, conversion paths). IP anonymization is enabled. Legal basis: consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Third-country transfer: SCCs and EU-US DPF. Opt-out: browser add-on (https://tools.google.com/dlpage/gaoptout). DPA concluded with Google.
Provider: Google Ireland Limited. We use Google Search Console to monitor the organic visibility of our website in Google Search. Search Console processes aggregated and anonymized data on search queries, clicks and impressions. No personal data of website visitors is processed directly by us. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring SEO performance).
Provider: Hotjar Ltd., St Julians, Malta (EU). Creates heatmaps, session recordings and click analyses to optimize user guidance. Personal entries (passwords, payment data) are masked automatically. Legal basis: consent (Art. 6(1)(a) GDPR, § 25 TDDDG). Opt-out: Do Not Track header or https://www.hotjar.com/legal/compliance/opt-out. DPA concluded.
Provider: Microsoft Ireland Operations Limited, Dublin, Ireland. Heatmaps and session recordings to analyze user behavior. Personal entries are masked automatically. Data is processed on Microsoft Azure (also in the USA). Legal basis: consent (Art. 6(1)(a) GDPR, § 25 TDDDG). DPF: listing available. DPA concluded. Privacy statement: https://privacy.microsoft.com/en-us/privacystatement
Provider: Google Ireland Limited. Legal basis: consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Third-country transfer: SCCs and EU-US DPF.
Interest-based advertising in the Google advertising network on the basis of cookies and conversion data. Objection via the ad settings (https://myadcenter.google.com). Legal basis: consent.
Conversion data without personal identification. Legal basis: consent. DPF certification available.
Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Data is also transferred to Meta Platforms Inc. in the USA. “Advanced Matching” is enabled (hashed email/phone number). Legal basis: consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). For the collection and transmission, there is joint controllership pursuant to Art. 26 GDPR (Joint Controller Addendum: https://www.facebook.com/legal/controller_addendum). Third-country transfer: SCCs and EU-US DPF.
Provider: Meta Platforms Ireland Limited. Server-to-server transmission of conversion events to improve measurement. The same rules on joint controllership pursuant to Art. 26 GDPR apply as for the Meta Pixel. Legal basis: consent. DPA concluded.
Provider: Meta Platforms Ireland Limited. Audience-based advertising on the basis of hashed data. Legal basis: consent. Deactivation via the Facebook settings or Your Online Choices (https://www.youronlinechoices.eu).
Provider: LinkedIn Ireland Unlimited Company, Dublin, Ireland. Records professional key data (industry, job function) and conversion data. IP addresses are truncated/hashed. Direct identifiers are deleted after 7 days, pseudonymized data within 180 days. Legal basis: consent (Art. 6(1)(a) GDPR, § 25 TDDDG). Objection: LinkedIn ad settings. Third-country transfer: SCCs and EU-US DPF. DPA concluded.
Provider: OpenAI Ireland Limited, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. We use OpenAI’s measurement pixel (“oaiq”) to measure whether a visit to our website originates from an ad in ChatGPT. If a person clicks on our ad in ChatGPT, OpenAI appends a click reference (“oppref”) to the destination URL. The pixel reads this value and stores it in the first-party cookie __oppref on our domain so that a later action on our website can be attributed to the ad.
The following is transmitted in the process: the click reference, a browser identifier assigned by the provider, the type of event triggered (e.g. page view, content view, completed registration), the time as well as the address of the page accessed and the referring page. For this purpose, the pixel sets the first-party cookies __oppref (click reference), __obref (browser identifier) and __oaiq_consent (consent status). The “automatic advanced matching” preset by the provider can additionally detect supported contact data (e.g. email address) and transmit it already hashed in the browser; plain-text data is not transmitted to OpenAI in this process.
Conversions API (server-side transmission): In addition to the pixel, we report the same events to OpenAI from our server. Both reports carry the same event ID, so that OpenAI merges them into one event. The same event data as well as your IP address and your browser identifier (user agent) are transmitted; these improve the attribution to the ad click. The server-side transmission takes place exclusively if you have previously consented to marketing via the cookie banner, and ends with your withdrawal. Legal basis: consent (Art. 6(1)(a) GDPR).
Legal basis: consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). The pixel is loaded only after your consent via the cookie banner; without consent, neither is the script loaded nor is a cookie set. We implement your withdrawal immediately: the measurement is deactivated at once and the cookies __oppref, __obref and __oaiq_consent are deleted — you can declare your withdrawal at any time via the cookie settings in the page footer. Third-country transfer: processing in the USA by affiliated companies of OpenAI cannot be ruled out; the transfer is based on standard contractual clauses (Art. 46(2)(c) GDPR) as well as your express consent. Further information: https://openai.com/policies/privacy-policy/.
Provider: Leadinfo B.V., Netherlands. Based on the IP address, Leadinfo determines which company visits our website and shows us the company name, industry and company size. Only company data is processed; personal data is not stored. In the process, the cookies _li_id and _li_ses are set on our domain. Legal basis: legitimate interest in addressing business customers (Art. 6(1)(f) GDPR). Processing on behalf: data processing agreement with Leadinfo. Further information: https://www.leadinfo.com/de/datenschutz.
When registering for a MarketplAIce account or a free trial period, you have the option of consenting to receive marketing emails. For this purpose, a checkbox that must be activated separately is displayed to you during registration:
☐ “Yes, I would like to receive the MarketplAIce newsletter with product updates, tips on Amazon optimization, special offers and webinar invitations by email. Unsubscribing is possible free of charge at any time via the unsubscribe link in every email or via privacy@marketplaice.io. I can withdraw my consent at any time with effect for the future without affecting the lawfulness of the processing carried out up to that point.”
By default, the checkbox is not pre-selected(no pre-ticking, in accordance with CJEU C-673/17 “Planet49”). Consent is given voluntarily and is not a prerequisite for using the Platform (prohibition of tying, Art. 7(4) GDPR).
After the checkbox has been activated, we send a confirmation email with a personal confirmation link to the email address provided. Only after you click this link is consent deemed validly given and you are added to the email distribution list.
To fulfill the burden of proof under Art. 7(1) GDPR, we log:
This evidence is stored until consent is withdrawn and for a further three years after withdrawal (limitation periods under UWG/GDPR).
Within the scope of the consent given, you will receive emails with the following content:
Legal basis: Art. 6(1)(a) GDPR, § 7(2) No. 3 UWG.
If you have concluded a paid subscription with us (existing customer), we may contact you by email on the basis of § 7(3) UWG even without separate marketing consent, within the following narrow scope:
Legal basis: Art. 6(1)(f) GDPR in conjunction with § 7(3) UWG (legitimate interest).
You can withdraw your consent at any time with effect for the future. Options:
After withdrawal, your email address is stored in a technical suppression list (blacklist) to prevent further mailings. The processing in the suppression list is based on our legitimate interest in implementing your withdrawal (Art. 6(1)(f) GDPR in conjunction with Art. 21(3) GDPR). This data is not used for other purposes and is not combined with other data.
We use the following processors to send the marketing emails:
We occasionally send companies and their management advertising by postal mail – for example after a registration for a free trial, after a visit to our website (company identification via Leadinfo, § 14) or if we assume a presumed interest in our services.
For the address and contact person, we use your details provided at registration as well as publicly available company data, in particular the legal notice (imprint) of your website. In doing so, we collect the company name, address, telephone number and the names of the management. To retrieve public web pages, we use Bright Data Ltd., Israel (adequacy decision of the EU Commission).
The legal basis is our legitimate interest in direct marketing to business customers (Art. 6(1)(f) GDPR, Recital 47). Consent is not required for advertising by letter.
You may object to advertising by letter at any time without giving reasons (Art. 21(2) GDPR), by email to privacy@marketplaice.io. We will then no longer send you advertising letters and will record your objection in a block list. The data will be deleted as soon as it is no longer needed for contacting you, at the latest 24 months after the last contact.
Provider: Google Ireland Limited. When a page is accessed, your browser loads fonts from Google servers (the IP address is transmitted). Legal basis: Art. 6(1)(f) GDPR; if consent was requested: Art. 6(1)(a) GDPR and § 25(1) TDDDG. DPF listing available.
In the case of integrated review widgets, technical data (IP address, browser) is transmitted to the respective provider. Legal basis: Art. 6(1)(f) GDPR or consent via the cookie banner.
You have the following rights vis-à-vis the controller:
We process and store personal data only for as long as this is necessary for the respective processing purpose or a statutory retention obligation exists:
| Data category | Retention | Legal basis | Deletion |
|---|---|---|---|
| Account data (email, profile) | Duration of the contract | Art. 6(1)(b) GDPR | 30 days after account deletion |
| Usage data (platform) | Duration of the contract | Art. 6(1)(b) GDPR | 30 days after account deletion |
| Order data with PII | 10 years | Art. 6(1)(c) GDPR, § 147 AO, § 257 HGB | After the period expires |
| Invoice data / Stripe | 10 years | Art. 6(1)(c) GDPR, § 147 AO, § 257 HGB | After the period expires |
| Buyer messages / PII from APIs | No permanent storage | Art. 6(1)(b) GDPR | Displayed at runtime only |
| Server log files (Vercel) | 90 days | Art. 6(1)(f) GDPR | Automatic |
| Cookie consents | Session / cookie lifetime | § 25 TDDDG | Upon withdrawal |
| Marketing consent (double opt-in evidence) | Until withdrawal + 3 years | Art. 7(1) GDPR, limitation periods under UWG | After the period expires |
| Suppression list / blacklist after unsubscribing | Indefinite | Art. 6(1)(f) GDPR in conjunction with Art. 21(3) GDPR | Hash storage only |
| Backups | Up to 90 days after the contract | Art. 6(1)(b), (f) GDPR | Automatic |
| Partner tracking (Rewardful) | Duration of the partner program | Art. 6(1)(f) GDPR | After the end of the contract |
In accordance with Art. 20 GDPR, you can download all of your personal data in a structured, commonly used and machine-readable format (JSON) under Settings → Privacy.
You can revoke the OAuth access authorization at any time in your Amazon Seller Central under Apps & Services → Manage Your Apps. After revocation, all Amazon-related data is deleted within 30 days.
If you have any questions about data protection or about exercising your rights, please contact:
AMZ+ Consulting GmbH
Salinenstraße 3, 49214 Bad Rothenfelde, Germany
Phone: +49 1556 1267682
Email: privacy@marketplaice.io
Competent data protection supervisory authority:
The State Commissioner for Data Protection of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen)
Prinzenstraße 5, 30159 Hannover, Germany
Email: poststelle@lfd.niedersachsen.de
Website: www.lfd.niedersachsen.de
(1) MarketplAIce uses AI models and automated algorithms for the following purposes:
(2) These processing operations relate exclusively to marketplace and product data, not to personal data of the users of the Platform. A decision based solely on automated processing that produces legal effects concerning you as a natural person or similarly significantly affects you within the meaning of Art. 22(1) GDPR does not take place.
(3) The automatic plan assignment based on the marketplace revenue (e.g. a change from Essential to Growth) is contractually agreed (Art. 22(2)(a) GDPR) and is combined with advance notice by email. You have the right to request a manual review (privacy@marketplaice.io).
We collect all personal data directly from you (Art. 13 GDPR). We receive data from the connected marketplace APIs (Amazon, eBay, Otto, Kaufland) on the basis of your express OAuth authorization. Personal data is collected from publicly accessible sources or enriched via third-party sources (e.g. Apollo) exclusively for business contacts (B2B) in the context of initiating business relationships on the basis of Art. 6(1)(f) GDPR. Data subjects have a right to object at any time (Art. 21 GDPR) and are informed upon first contact in accordance with Art. 14 GDPR.
We reserve the right to adapt this Privacy Policy so that it always complies with the current legal requirements or reflects changes to our services. The respective current version will then apply to your next visit. In the event of material changes affecting your consent, we will inform you separately by email and, if necessary, obtain renewed consent.
Version: November 2026 • AMZ+ Consulting GmbH • Salinenstraße 3, 49214 Bad Rothenfelde • privacy@marketplaice.io
Convenience translation – only the German version is legally binding.