Privacy Policy
1. Controller
ledge UG (haftungsbeschränkt), Karolinenstr. 4, 80538 Munich, Germany. Email: servus@ledge.eu. Managing director: Zacharias Haeusgen.
We have not appointed a data protection officer; the conditions of § 38 BDSG are not currently met.
2. Visiting the website
Data: IP address, date and time, page accessed, volume of data transferred, referrer, browser and operating system type.
Purpose: Delivering the website, stability and security, investigating misuse and technical faults. We also derive a two-letter country code from your IP address (not a street address) so we can remember which country you are browsing from. We store only that country code in the "ledge-country" cookie. You can change the country in the store footer.
Legal basis: Art. 6 (1) (f) GDPR (secure and functional operation of our service, including remembering your country).
Processor: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. Processing takes place in the Frankfurt am Main region. A data processing agreement under Art. 28 GDPR is in place.
Retention: We automatically delete log data in the log groups we manage after 14 days. The hosting platform's own access logs are retained by design for the lifetime of the application. We do not analyse these logs routinely and access them only for a specific reason, such as investigating a security incident or technical fault.
3. Access to the gated area
To enter the gated area you enter an access password. For this purpose we store on your device the information that valid access exists (cookie and localStorage entry "ledge-access", 30 days each).
Legal basis: Art. 6 (1) (f) GDPR (protection of the gated area). Storage on your device takes place without consent under § 25 (2) no. 2 TDDDG, as it is strictly necessary for the service you have requested.
4. Storage on your device
(1) Strictly necessary storage — your language preference, your country preference, your cookie choice, your access status, your login, your display settings and saved lists held before login — takes place without consent under § 25 (2) no. 2 TDDDG.
(2) The Meta pixel (section 11) and analytics with PostHog (section 10) require storage on your device that is not strictly necessary. Both are activated only after you have consented (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR).
(3) You can change or withdraw your consent at any time via "Cookie settings" in the footer. The lawfulness of processing carried out before withdrawal remains unaffected.
(4) Cookies used:
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| ledge_consent | ledge | Stores your cookie choice | 12 months |
| ledge_c15t_v1 | ledge | Stores your cookie choice | 12 months |
| ledge-locale | ledge | Stores your language preference | 12 months |
| ledge-country | ledge | Stores your country (destination, not language) | 12 months |
| ledge-access | ledge | Stores access to the gated area | 30 days |
__session |
ledge | Keeps you logged in | 3 days |
_fbp |
Meta | Ad attribution (only after consent) | 90 days |
_fbc |
Meta | Ad-click attribution (only after consent) | 90 days |
For technical reasons the "__session" cookie may appear as "__session_0" and "__session_1"; this is the same session with the same duration.
(5) Further storage in your browser's local storage (localStorage):
| Name | Purpose | Duration |
|---|---|---|
| ledge-access | Access to the gated area | 30 days |
| ledge-wl | Status of your waitlist registration, where applicable including your email address | until you clear site data |
| ledge-phase | Which stage of the site is shown to you | until you clear site data |
| ledge-view | List or grid layout | until you clear site data |
| ledge-home-assigned-view | First home view (field or catalogue) for the A/B test | until you clear site data |
| ledge-welcome | Home welcome already seen | until you clear site data |
| ledge-web-guest-session-v1 | Session before login | until login or until you clear site data (server-side token up to 180 days) |
| ledge-web-saves-v2 | Saved products while logged out | until merged into your account or until you clear site data |
| ledge-gift-claimed | Gift already claimed | until you clear site data |
| ledge-attribution-ft | Source of your first visit (campaign or ad click) | until you clear site data |
| PostHog identifier (ph_…) | Measurement of recurring visits (only after consent) | until you clear site data |
| lastExternalReferrer, lastExternalReferrerTime | Set by Meta (only after consent) | until you clear site data |
(6) We also use storage that exists only for the duration of the session and is deleted when the browser tab is closed (home page layout, overlays already shown, resuming after login).
5. User account
Data: email address, name, login details or login provider, account settings.
Purpose: Providing and administering your user account.
Legal basis: Art. 6 (1) (b) GDPR (performance of the user contract).
Processor: Auth0, Inc. (Auth0 by Okta), 10800 NE 8th Street, Suite 600, Bellevue, WA 98004, USA, under a data processing agreement pursuant to Art. 28 GDPR. Processing takes place in the EU region (EU-2, Frankfurt am Main).
Sign-in with Google or Apple: Alternatively you can sign in with your Google or Apple account. The sign-in is then carried out by the respective provider, which processes your data as an independent controller in that respect; that provider's privacy terms apply. We receive your email address and name from there to the extent you release them.
Retention: until you delete your account; thereafter deletion within 30 days, unless statutory retention obligations apply.
6. Feedback answers and insider prices
Data: your answers to brands' questions, linked to your user account.
Purpose: Unlocking insider prices and creating aggregated, anonymised analyses for the brands.
Legal basis: Art. 6 (1) (b) GDPR.
Recipients: Brands receive exclusively aggregated, anonymised analyses. Your email address, your name and individual attributable answers are not transmitted to brands.
Retention: until you delete your account.
7. Saved products
Data: the products you have saved, linked to your user account.
Purpose: Providing your private saved list.
Legal basis: Art. 6 (1) (b) GDPR.
Recipients: none. The list is not visible to other users or to brands.
Retention: until you delete your account.
8. Redirection to brands' shops and purchase confirmation
(1) Redirection. If you wish to buy a product, we redirect you to the respective brand's online shop. From that point the brand is an independent controller for the processing of your data; that brand's privacy policy applies. In doing so we transmit an attribution identifier which serves to settle our commission and to attribute a gift.
(2) Purchase confirmation. If a purchase is concluded, the brand transmits to us via a technical integration of its shop system the order number, the order value and the products ordered, linked to the attribution identifier. We do not receive your name, your address, your payment data or the contact details you provided to the brand.
(3) Purpose: Settling our commission with the brand and determining whether you can receive a gift.
(4) Legal basis: Art. 6 (1) (b) GDPR for the attribution of the gift; Art. 6 (1) (f) GDPR for commission settlement (legitimate interest in settling our remuneration).
(5) Retention: until expiry of the statutory retention periods for accounting records.
9. Gift following a purchase
Data: name, delivery address, linked order number, dispatch status.
Purpose: Sending the gift and checking that the gift is granted only once per person.
Legal basis: Art. 6 (1) (b) GDPR for dispatch; Art. 6 (1) (f) GDPR for the single-claim check (legitimate interest in preventing multiple claims).
Recipients: We pick and pack the gifts ourselves. For delivery we transmit your name and address to the transport company engaged for the respective shipment — currently DHL Paket GmbH, Charles-de-Gaulle-Str. 20, 53113 Bonn, Germany, and for shipments to other EU countries Deutsche Post AG, Charles-de-Gaulle-Str. 20, 53113 Bonn, Germany. The transport company processes the data as an independent controller in order to carry out the transport. No further disclosure takes place.
Retention: We store your address until the end of the promotional period in order to check the single-claim rule, but no longer than 6 months after dispatch of the gift.
Voluntary nature: Providing your address is voluntary. Without an address we cannot send the gift; you suffer no other disadvantages.
10. Analytics with PostHog
Provider: PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. Processing takes place on servers in the European Union. Where support access results in a transfer to the USA, we base this on Standard Contractual Clauses under Art. 46 (2) (c) GDPR.
Data: pages accessed, clicks and interactions, referrer, campaign parameters (UTM), browser and device type, truncated IP address.
Storage on your device: PostHog stores a technical identifier in your browser's local storage (localStorage). No cookies are set. This storage is not strictly necessary and therefore takes place only after you have consented.
User account: If you create a user account, we link this identifier to an internal identifier for your account. This allows us to analyse recurring use across multiple sessions. We do not transmit your name or your email address to PostHog.
Purpose: Statistical analysis of usage in order to improve ledge.
Legal basis: Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG.
Processing agreement: A contract under Art. 28 GDPR is in place.
Withdrawal: At any time via "Cookie settings" in the footer.
11. Meta pixel
Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.
Data: IP address, browser and device information, cookie identifiers, pages accessed and events triggered.
Purpose: Measuring the performance of our ads on Facebook and Instagram and delivering them to relevant audiences.
Legal basis: Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. The pixel only loads after you consent via the banner.
Joint controllership: For the collection of data on our website and its transmission to Meta, we and Meta are joint controllers under Art. 26 GDPR, on the basis of the Controller Addendum provided by Meta. Meta is solely responsible for any subsequent processing. You may exercise your rights against both us and Meta.
Transfer to third countries: Data may be transferred to Meta Platforms, Inc. in the USA. This is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework; additionally we base the transfer on your explicit consent under Art. 49 (1) (a) GDPR. An equivalent level of protection cannot be guaranteed in the USA, and access by US authorities cannot be ruled out.
Withdrawal: At any time via "Cookie settings" in the footer.
12. Email communication
Data: email address, and the time and wording of any consent given.
Purpose: Sending messages relating to your user account and — only with separate consent — sending editorial emails.
Legal basis: Art. 6 (1) (b) GDPR for account-related messages; Art. 6 (1) (a) GDPR and § 7 (2) no. 2 UWG for editorial emails.
Processor: Amazon Simple Email Service (SES) via Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. Processing takes place in the Frankfurt am Main region. A data processing agreement under Art. 28 GDPR is in place.
Retention: We store the record of your consent (email address, time, IP address, wording) for three years in order to demonstrate consent under Art. 7 (1) GDPR.
Withdrawal: At any time via the unsubscribe link in any email or at servus@ledge.eu. We then store your address on a suppression list to prevent further mailings (Art. 6 (1) (f) GDPR).
13. Contacting us
If you write to servus@ledge.eu, we process your details in order to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR for contract-related enquiries, otherwise Art. 6 (1) (f) GDPR. We delete messages once they are no longer required and no statutory retention obligations apply.
14. Our profiles on social networks
We maintain profiles on Instagram (Meta Platforms Ireland Limited) and TikTok (TikTok Technology Limited, Ireland). For the creation of page statistics we are joint controllers with the respective provider (Art. 26 GDPR); we receive exclusively aggregated analyses. We have no influence over the providers' further processing.
15. Recipients and transfers to third countries
We pass on your data only to the recipients named in this policy. Where data is processed outside the EU/EEA, this takes place on the basis of an adequacy decision, Standard Contractual Clauses under Art. 46 (2) (c) GDPR, or your explicit consent under Art. 49 (1) (a) GDPR.
16. Retention
We store personal data only for as long as necessary for the stated purposes or as required by statutory retention periods. Thereafter we delete or anonymise it.
17. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR). You may withdraw consent at any time with effect for the future (Art. 7 (3) GDPR). Contact us at servus@ledge.eu.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.
18. Obligation to provide data
You are under no legal or contractual obligation to provide your data. However, without an email address we cannot provide you with a user account, and without a delivery address we cannot send a gift.
19. Changes
We will update this policy if our service or the legal situation changes. The version published on ledge.eu at the time applies.
This is a translation. In case of discrepancies, the German version prevails.