Last updated: 7 October 2026. This policy covers the website dropshipagent.com and the customer portal app.dropshipagent.com. It lists only the services we actually use.
1. Controller and data protection officer
TT-ECOM Global GmbH
c/o Voltairestr. 11
10179 Berlin
Germany
Phone: +49 (0) 176 2173 4407
E-mail: support@dropshipagent.com
Data protection officer: Francis Kleint, Voltairestr. 11, 10179 Berlin, Germany, e-mail: support@dropshipagent.com.
2. Hosting and server log files
The website, the customer portal, its database and our automation server (n8n) run on servers we operate at Hostinger International Ltd. in a data centre in Frankfurt am Main, Germany. Hostinger provides the server infrastructure; the software and the data on it are operated by us.
When you open a page, our web server records the IP address, date and time, the requested address, the referring page and the browser identification in a log file. This is needed to operate the site securely and to find errors (Art. 6(1)(f) GDPR). The log files are rotated daily and deleted after 14 days.
3. Own usage measurement (no cookies)
To see how our website and our customer portal are used and to improve them, we measure their use with our own measurement service. It runs exclusively on our own server; no third party is involved and no data is passed on to third parties.
What is recorded: pages viewed, clicks on buttons and links, scroll depth, and form submissions – which form was sent, not what you entered into it. In the customer portal, only two address parameters are recorded with a page view: whether the sign-in or the sign-up view is open, and whether the quote form was opened.
No cookies: the website sets no cookies. For the duration of one visit, a random session ID is kept in your browser’s session storage; it applies to that browser tab only and is discarded when you close it. When you follow a link from this website to the customer portal, this session ID is passed along in the link (parameter “sid”) so that both parts count as one visit.
Campaign parameters: if you arrive through a link with campaign parameters (utm_* or a click ID such as gclid or fbclid), these are kept in the session storage of that tab as well and added to links into the customer portal. If you then create an account, they are stored with your account so that we know which campaign it came from. Nothing of this is passed to an advertising network; we use no advertising or analytics services of third parties.
No IP addresses stored: your IP address is not stored by the measurement. It is used only transiently, shortened and together with your browser type, to compute a pseudonym that changes daily and cannot be reversed; it does not allow you to be recognised across days.
When the visit becomes attributable to you: if you create an account or request a quote in the customer portal, or send one of the forms on this website (section 4), the session ID of that visit is stored with your account, your request or your form submission. The events of that one visit – including the website visit it came from via the link described above – can then be attributed to you. We do this to check that sign-ups, quote requests and form submissions arrive reliably and which pages lead to them. Earlier or later visits are not attributed to you.
Legal basis, retention, objection: Art. 6(1)(f) GDPR; our legitimate interest is a reliable, demand-oriented website and portal and their statistical evaluation. Storing the session ID and campaign parameters in your browser’s session storage is based on § 25(2) No. 2 TDDDG (needed for the service you use: continuing your visit across our two domains). The measurement data is deleted automatically after 90 days. If “Do Not Track” is enabled in your browser, no measurement takes place. You may object at any time (support@dropshipagent.com).
4. Website forms and newsletter
Forms: when you send the product check form, request the cost calculator report or apply for the Brand Sprint, we receive the data you enter (e-mail address; depending on the form: product link, your calculator inputs and results, name, store URL, shop platform and revenue range) together with the page, the language, campaign parameters (see section 3) and the session ID of our usage measurement.
Newsletter: if you sign up for the newsletter, we store your e-mail address, your consent, the wording you agreed to and the time. We do not send a newsletter at present: there is no sending system yet. Your consent is kept for a future newsletter; before the first sending we will ask you to confirm your address (double opt-in). You can withdraw your consent at any time (support@dropshipagent.com); the withdrawal does not affect the lawfulness of the processing up to that point.
Where the data go: the data are stored in our own database (section 2). To follow up on your request they are passed to our sales CRM Close (Elastic Inc., dba Close, PO Box 1145, Jackson, WY 83001, USA), where a lead with your e-mail address and the form data is created (for the newsletter: your consent and its time). Close processes the data on our behalf under its Data Processing Addendum; the transfer to the USA is based on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) that are part of it. Details: https://www.close.com/privacy.
Legal basis: forms: Art. 6(1)(b) GDPR (you request a check, a report or a programme place – pre-contractual measures), otherwise Art. 6(1)(f) GDPR (answering your request). Newsletter: your consent, Art. 6(1)(a) GDPR. The data remain with us until the purpose has been fulfilled, you withdraw your consent or you ask us to delete them, unless statutory retention periods apply.
5. Customer portal (app.dropshipagent.com)
Account and sign-in: to create an account we check your store URL and store your e-mail address, the store URL, the time and, if you tick it, your newsletter consent (with wording, time, IP address and browser identification as proof). You sign in with a one-time link that we send by e-mail. The portal stores your profile and billing details (store name and URL, company, contact name, e-mail and phone, address, country, VAT ID), your acceptance of our terms and data processing agreement, and the sessions you are signed in with, in our own database (section 2). An EU VAT ID is checked against the European Commission’s VIES register (only the country code and the VAT ID are sent). Legal basis: Art. 6(1)(b) GDPR (contract and pre-contractual measures), for the VAT check Art. 6(1)(c) GDPR, for the consent proof Art. 6(1)(c) and (f) GDPR.
Cookies in the portal: the portal uses only cookies that are technically necessary to sign you in and keep you signed in: dsa_session (your sign-in, 7 days), dsa_register (the store check of a sign-up in progress, 30 minutes) and dsa_oauth_state (protection of a sign-in in progress, 10 minutes). They are not used for analysis or advertising (§ 25(2) No. 2 TDDDG).
E-mails: sign-in links, confirmations, quote e-mails and internal notifications to our team are sent through the Gmail service of Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, USA). Google LLC is certified under the EU-U.S. Data Privacy Framework; details: https://policies.google.com/privacy/frameworks.
Quotes, orders and fulfilment: quote requests, supplier offers, shop, order, invoice and payment records of the portal (including proof-of-payment files you upload) are kept in Airtable, the database service of Formagrid Inc. (Airtable), USA, which our team uses to work on them. Airtable processes the data on our behalf; its Data Processing Addendum contains the EU Standard Contractual Clauses for the transfer to the USA. Details: https://www.airtable.com/company/dpa.
Sales CRM: quote requests can be passed to our sales CRM Close (see section 4) so that our team can follow up.
Legal basis for these steps is Art. 6(1)(b) GDPR. No payment service provider is integrated into the portal.
6. Links to other services
Our pages contain links to Calendly (to book a call) and to our profiles on social networks. These are plain links: no data are transferred to these services until you click such a link. After that, the privacy policy of the respective provider applies.
7. Storage duration
Unless a more specific storage period is given above, your personal data remain with us until the purpose for which they were collected no longer applies. If you ask us to delete them or withdraw your consent, they are deleted unless we have other legally permissible reasons for storing them (e.g. tax or commercial law retention periods); in that case they are deleted once these reasons cease to apply.
8. Your rights
Within the limits of the GDPR you have the right to access your personal data (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). You can withdraw a consent at any time with effect for the future (Art. 7(3)).
Right to object (Art. 21 GDPR): if we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. If your data are processed for direct marketing, you can object at any time; they will then no longer be used for that purpose.
Right to lodge a complaint: you can complain to a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or of the alleged infringement. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin).
To exercise your rights, contact us at support@dropshipagent.com.
9. Encryption
All pages of the website and the portal are delivered over an encrypted connection (TLS, recognisable by “https://” in the address bar).