Fakeshop TakeDown A service of Cloudkasten GmbH

Privacy notice

This notice explains which personal data is processed when you visit this website and instruct us with the technical investigation, documentation and fact-based abuse reporting of suspicious shops. We set no cookies and use no advertising or tracking services.

1. Controller

The controller for this website, the order form and the performance of your order is:

Cloudkasten GmbH
Seestr. 20 G
50374 Erftstadt, Germany
Represented by: Alexander Hagemann, Managing Director
Email: info@cloudkasten.net

2. Hosting and visiting the website

This website is delivered as a static site through Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Pages). Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA rely on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). We have a data processing agreement with Cloudflare.

When you visit, the hosting provider processes technically necessary data sent by your browser: IP address, date and time of the request, the page requested, referrer URL, browser type and version and operating system (server log files). This is necessary to deliver the website, keep it stable and fend off attacks. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). We do not store or analyse access logs ourselves. Cloudflare processes connection data to deliver the site and fend off attacks and deletes it according to its own retention periods.

Fonts are loaded from our own server. No content from Google Fonts or other third parties is embedded.

3. No cookies, no advertising trackers

We set no cookies. The only thing stored on your device is your currency, so that prices are shown in it (local storage, no tracking). There are no advertising pixels, no social media plugins and no cross-device profiles.

4. No audience measurement

We currently use no audience measurement or web analytics services.

5. Orders through the form

The form is filled in in your browser only. Only when you click the button to place the order with an obligation to pay are your details transmitted, encrypted (TLS):

  • the suspicious addresses, the affected company or brand, and your actual website and register details, if given,
  • your details on the facts pointing to deception or technical abuse, on the content or details used, on business relationships with the shop that you know of and on customer enquiries or indications, and your answers to the further questions,
  • the uploaded files,
  • your company, the name of the person placing the order, your email address and optionally your phone number,
  • your confirmations of authorisation and scope, the order summary (shops, addresses, price, currency) and the version of the terms of the order that applied to your order, with its text,
  • the address of the page you sent the form from including any campaign parameters (utm parameters), and technical data of the transmission such as IP address and time.

Please only give the details needed for the order, and redact unnecessary personal details, in particular of third parties, for example in customer enquiries.

The details pass through a function on Cloudflare’s infrastructure (section 2) to our order system (section 8); they are not stored at Cloudflare. Your IP address is passed on to fend off too many orders in a short time.

Purposes and legal bases: we process your details to check your order and decide on its acceptance, handle the payment, send you the order confirmation and carry out the order (Art. 6(1)(b) GDPR). We process technical data of the transmission to prevent abuse (Art. 6(1)(f) GDPR). Providing your data is voluntary; without the fields marked as required, however, we cannot process your order.

6. Payment through Stripe

After you send the form, you are taken to Stripe. We process payments through Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe receives your order number, the number of shops, the currency, your email address and what you enter on the payment page (company, billing address, VAT number if any, payment details). Stripe creates the invoice and calculates any VAT. The legal basis is the performance of the order (Art. 6(1)(b) GDPR) and our legal obligation to issue invoices (Art. 6(1)(c) GDPR). Stripe may transfer data to the USA; Stripe, Inc. is certified under the EU-US Data Privacy Framework. To prevent fraud, Stripe also processes payment data as a controller in its own right (stripe.com/privacy).

7. Technical investigation and fact-based abuse reports

Our work consists of technical investigation, the documentation of publicly accessible content and fact-based abuse reports to the responsible providers. It does not include the legal enforcement of claims.

Capture on receipt of the order: the technical capture of the pages named starts when your order is received, that is before we have decided on accepting it, because suspicious pages change quickly. As far as technically possible, we store screenshots and retrieved source code as well as URL, retrieval time, retrieval status and SHA-256 checksums. We also query publicly available infrastructure data, such as DNS records and domain registration data (RDAP), to identify the registrar, hosting and upstream services. Technical capture, checks and order records run on our servers at Microsoft Azure (Microsoft Ireland Operations Ltd. as processor) in the Germany West Central region in Frankfurt am Main.

If we do not accept the order: we refund any amounts already paid in full. We then generally delete your details, documents and the captured pages at the latest 6 months after our last message to you (section 10).

Checks: during the review period, we regularly retrieve the ordered addresses to check whether the reported content is still accessible. We also search publicly available sources for further shops using your name, such as new domains with your brand name; we first tell you about such finds as indications.

This data may include personal data of the operators or of third parties, for example when a shop uses another company’s imprint. The legal basis is our clients’ legitimate interest in having deception and technical abuse under their name documented and reported, and our interest in carrying out the order (Art. 6(1)(f) GDPR).

Reports: we send reports to registrars, hosting providers, upstream services (CDN) and Google (Safe Browsing) on your behalf, by email or through the recipients’ report forms. We only submit the details and documents required for the report concerned; the reports name your company as the client. The legal basis is the performance of the order (Art. 6(1)(b) GDPR). The recipients process these details as controllers in their own right. Some recipients are based outside the EU, such as Google in the USA or registrars and hosts in third countries. Where there is no adequacy decision for the country concerned, the transfer takes place because it is necessary to establish and exercise your legal claims (Art. 49(1)(e) GDPR).

Sending emails: we send reports, reminders and the weekly status reports through Twilio SendGrid (Twilio Inc., San Francisco, USA) as our processor. Twilio is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); we have a data processing agreement with Twilio.

8. Order system and storage

Orders, uploaded files, captured pages, reports and final reports are stored in our own order system. Only the people at Cloudkasten GmbH working on your order have access.

9. Contact by email

If you contact us directly by email, we process your details to answer your request (Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR).

10. How long we keep data

If no contract is concluded, for example because we do not accept the order, we generally delete your details, your documents and the captured pages at the latest 6 months after our last message to you. We generally keep the records of completed orders with captured pages, reports and final reports for three years, so that you and we can trace the course of events later. Invoices, order confirmations and business letters are kept for the statutory retention periods (§ 257 German Commercial Code, § 147 German Fiscal Code). A longer storage that is necessary and justified in an individual case remains unaffected.

11. Recipients

Your data is received only by the people at Cloudkasten GmbH working on your order, Stripe (section 6), the recipients of reports named in section 7 and the service providers named in sections 2 and 7. We pass data to courts or authorities only if we are legally obliged to or you ask us to.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). Where data is processed on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (ldi.nrw.de).

The German version of this notice is the legally binding one.

Datenschutzhinweise (Deutsch)