Privacy policy

As of: 25 October 2026

1. Controller and scope

Cronema UG (haftungsbeschränkt)
Isabellastrasse 9, 80798 München, Deutschland
Represented by the Managing Director Manfred Sandner
Phone: 0163 4517633
Email: support@cronema.com

This privacy policy applies to the website cronema.de (hereinafter “Website”, Sections 3 to 8) and to our apps (Sections 9 to 12).

2. Overview

• We do not use advertising cookies. We use Google Analytics only with your consent to improve the Website (Section 5).
• You can change or withdraw your consent at any time via the shield icon at the bottom left or the “Cookie settings” link at the bottom of every page.
• Fonts are loaded from our own web server, not from Google.
• We store enquiries submitted via the contact form in our customer relationship management (CRM) system HighLevel in order to process them (Section 7).
• Our apps run on servers in Germany. The Shopify apps GARAN-Label and ElektroPflicht do not read or store any data of a shop’s customers (Sections 9 to 12).

3. Provision of the Website and server logs

When you access the Website, our hosting provider processes technically necessary data transmitted by your browser: IP address, date and time of access, page requested, referrer URL, browser type and version, operating system. This data is required to deliver the Website and to ensure its security and stability (e.g., defense against attacks). No merging with other data sources takes place.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and error-free provision of the Website. Server logs are deleted by the hosting provider after a short period, generally after no more than 30 days, unless they are required to investigate a security incident.

Hosting provider: Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA. A data processing agreement exists with the provider (Art. 28 GDPR). For transfers to the USA, the European Commission’s adequacy decision for the EU-US Data Privacy Framework applies insofar as the provider is certified; otherwise, the European Commission’s Standard Contractual Clauses apply (Art. 46(2)(c) GDPR). The Website is delivered via a worldwide network of servers.

4. Storage in the browser, cookies and consent

Pursuant to § 25(1) TDDDG, your consent is generally required to store information on your device or to access information already stored there, unless it is strictly necessary for a service explicitly requested by you (§ 25(2) No. 2 TDDDG). Without your consent, we do not set any cookies. For technical necessity we store only one entry in your browser’s local storage (localStorage):

• “cronema-consent”: your selection in the consent banner and the time of your decision so that the banner does not appear on every page view. Valid for 12 months; after that we ask again.

This entry does not leave your browser. You can delete it at any time via your browser’s settings.

For web analytics with Google Analytics (Section 5) we ask for your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without consent, Google Analytics is not loaded; all Website content remains fully usable. You can withdraw your consent at any time with effect for the future by opening the settings via the shield icon at the bottom left, the “Cookie settings” link at the bottom of every page, or the button at the top of this page and changing your selection. The lawfulness of processing carried out until withdrawal remains unaffected (Art. 7(3) GDPR).

5. Web analytics with Google Analytics (only with consent)

If you consent to the “Statistics” category, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA). Google Analytics records which pages you visit, how long you stay, which website you come from, as well as information about browser, operating system, device, screen size and approximate location (country, region, city). For this purpose, cookies (_ga, _ga_<ID>) are stored on your device that are valid for up to two years. Your IP address is not stored by Google Analytics 4; it is only used briefly to determine the approximate location. We use the evaluations solely in aggregated form to improve the Website and our offering. Google Signals and personalized advertising are not enabled.

Google processes the data on our behalf; we have a data processing agreement with Google (Art. 28 GDPR). Data may also be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the transfer therefore takes place on the basis of the European Commission’s adequacy decision (Art. 45 GDPR), with the Standard Contractual Clauses applying in addition. The retention period for analytics data at Google is set to 14 months.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). If you withdraw consent in the cookie settings, we stop measurement and delete the Google Analytics cookies in your browser. Further information: policies.google.com/privacy.

6. Fonts

The fonts used on the Website (Inter, Inter Tight) are stored on our web server and loaded from there. No connection is made to servers of Google or other font providers.

7. Contact form, email and phone

If you contact us via the contact form, email or phone, we process your details (first and last name, email address, optional phone number and company, selected topic, your message, and the time of the enquiry) to answer your enquiry and to advise you on our offering. The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry relates to a contract or the initiation of a contract; otherwise, Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

The contact form transmits your details in encrypted form to a server function of our hosting provider Netlify (Section 3), which forwards them to our customer relationship management (CRM) system. There they are stored as a contact with a note on your enquiry. To protect against spam, we check how quickly the form was completed and temporarily limit the number of enquiries per IP address; the IP address is not stored permanently for this purpose.

The CRM provider is HighLevel, Inc. (together with LeadConnector LLC), 1801 N. Lamar St., Suite 600, Dallas, Texas 75202, USA; data is processed in data centers of Google Cloud and Amazon Web Services. We have a data processing agreement with HighLevel (Art. 28 GDPR, Data Processing Addendum with the European Commission’s Standard Contractual Clauses). HighLevel is certified under the EU-US Data Privacy Framework; transfers to the USA therefore take place on the basis of the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR), with the Standard Contractual Clauses applying in addition (Art. 46(2)(c) GDPR).

We delete your details when the enquiry has been resolved and no further business relationship arises, at the latest after two years without further contact, unless statutory retention obligations prevent this. If a contract is concluded, the commercial and tax retention periods apply.

8. Links to other websites

The Website links to websites of our products (e.g., work247.app, bookique.app) and to third-party websites. Data is transmitted to the respective operator only when you click such a link; their privacy policy then applies.

9. Our apps

We develop and operate our own apps. For the data of merchants and users who install an app, we are the controller. If an app processes a merchant’s customer data on behalf of the merchant (e.g., bookings in Bookique), we act as the merchant’s processor (Art. 28 GDPR).

• work247 (app for GoHighLevel, real estate): Detailed information is provided in the privacy policy at work247.app/en/privacy/ in the section “Use of the Work247 app”.
• Bookique (booking app for Shopify): Detailed information is provided in the privacy policy at bookique.app/privacy/.
• GARAN-Label (Shopify app for the warranty notice and the EU label for durability guarantee): Sections 10 and 11.
• ElektroPflicht: Batterie+WEEE (Shopify app for mandatory information on batteries, electrical equipment, chargers and the Data Act): Sections 10 and 12.

10. Shopify apps GARAN-Label and ElektroPflicht

The following applies to both apps:

• Shop data: Upon installation we receive from Shopify the shop domain, shop name, the shop’s email address, the shop languages and an access token for the app. The app reads shop and product data only to the extent of the permissions granted by the merchant during installation.
• No customer data: The apps do not read or store any data of the shop’s customers (e.g., names, addresses, orders).
• Hosting: The apps and their databases are operated on servers in Germany (Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen). A data processing agreement exists with the provider (Art. 28 GDPR).
• Billing: Plans are billed via Shopify; we do not receive payment data.
• Shop visitors: Content that is loaded directly from our server (see Sections 11 and 12) technically requires processing the IP address, time and the requested address. These logs serve only secure operation and are deleted after no more than ten days. The apps do not set cookies in the shop and do not use analytics or advertising services.
• Retention period: We store the data for as long as the app is installed. When uninstalled, we delete the access token immediately. 48 hours later, Shopify requests deletion of all shop data; we then delete all shop data we hold. Information that the app has stored as metafields in the shop remains in the shop until the merchant deletes it. We respond to Shopify requests for access to or deletion of customer data; the apps do not store such data.

The legal basis is the performance of the contract for the use of the app (Art. 6(1)(b) GDPR); for the server logs and the evidence in Section 12, our legitimate interest in secure operation and documentation (Art. 6(1)(f) GDPR).

11. GARAN-Label

GARAN-Label displays the statutory warranty notice in the shop and, on product pages, at checkout and in the order confirmation, the EU label for durability guarantee. The app processes:

• Product data: Titles of products as well as duration of the durability guarantee, guarantor and model identifier, which the app stores as metafields in the shop. Shopify notifies the app about changes to products.
• Settings: Language of the notice, guarantors created, hidden notices and the setup status.
• Contact with the merchant: Upon installation and when changing plans, we transfer the contact details of the shop owner (email address, name, shop name, website, phone number, country) together with the selected plan into our CRM HighLevel (provider and transfer to the USA as in Section 7) in order to support merchants with the app and inform them about important changes. The legal basis is Art. 6(1)(b) and (f) GDPR. An uninstall is noted on the contact. You can object to the storage at any time.
• Shop visitors: The label at checkout and in the order confirmation is loaded as an image from our server (garan-app.work247.app). The image URL contains only guarantee duration, guarantor and model identifier; for server logs see Section 10.

12. ElektroPflicht: Batterie+WEEE

ElektroPflicht displays the mandatory information on batteries, electrical equipment, chargers and the Data Act in Shopify shops. The app processes:

• Shop data in addition to Section 10: the shop’s delivery countries and the selected plan.
• Product data: title, manufacturer, product type, tags, description, SKU, barcode and collections in order to assign products to the mandatory information and to suggest suitable products. The app stores the assignments as metafields in the shop; it creates the disposal page as a page in the shop.
• Information entered by the merchant: return address and return options, contact details, registration numbers, own texts and Data Act templates.
• Evidence: time of confirmation of own responsibility, adopted AI suggestions with timestamps, and the number of AI lookups per month.
• Weekly email (Business plan): the recipient address specified by the merchant and the dispatch time.

AI research (OpenAI)

If the merchant clicks “Suggest with AI” or uses the AI bulk check, we transmit the title, manufacturer, description, SKU and barcode of the respective product to OpenAI to research battery type, category and charger information with sources. Personal data of customers is not transmitted. The merchant reviews each suggestion and decides independently whether to accept it.

Provider is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland; processing may also be carried out by OpenAI, L.L.C. in the USA. For transfers to the USA, the adequacy decision for the EU-US Data Privacy Framework applies insofar as the provider is certified; otherwise, the European Commission’s Standard Contractual Clauses apply. Under OpenAI’s terms for the application programming interface (API), the content transmitted is not used to train the models; OpenAI may retain it for up to 30 days for abuse detection.

Email delivery (Postmark)

We send the weekly email with open items and test emails via the Postmark service of ActiveCampaign, LLC, 1 N Dearborn St, Suite 500, Chicago, IL 60602, USA. The recipient address and the content of the email (shop name and open items) are transmitted. For transfers to the USA, the adequacy decision for the EU-US Data Privacy Framework applies insofar as the provider is certified; otherwise, the European Commission’s Standard Contractual Clauses apply. The merchant can disable the email at any time in the app.

Shop visitors

The notices in the shop are delivered via Shopify. Only the icons on the disposal page and the Data Act PDF (on click) load directly from our server; for server logs see Section 10.

13. Your rights

You have the following rights against us regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent given with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR)

Where we process data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you have the right to object to such processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.

To exercise your rights, a simple informal message to support@cronema.com is sufficient.

14. Data security

The Website and our apps are transmitted exclusively in encrypted form via HTTPS (TLS). We take technical and organizational measures to protect your data against loss, manipulation and unauthorized access.

15. Changes to this privacy policy

We update this privacy policy when the Website, our apps, our services or the legal situation change. The version published here at any given time applies.