This is a translation of the German privacy policy. In case of any discrepancy, the German version prevails.
This privacy policy applies to the website www.suplify.net. It also applies to all platform services offered via the website, e.g. user accounts, inquiries, chat and the commission dashboard.
Controller
Schloßmann, Luca & Flöder, Maximilian GbR
represented by the partners Luca Schloßmann and Maximilian Flöder
Paul-Brandi-Straße 6
45149 Essen
Germany
Email: luca.schlossmann@web.de
We have not appointed a data protection officer as we are not legally obliged to do so. If you have any questions about data protection, please contact the email address above.
1. Processing of personal data
We process your personal data within the scope of the website, among other things, as follows (for further data processing on the website, please refer to the following sections of this privacy policy):
Hosting and delivery of the website
Our website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus ("Hostinger"). Hostinger provides the servers, the databases and a content delivery network (CDN) through which pages are delivered faster. Hostinger processes all data generated when visiting the website and using the platform exclusively on our behalf; we have concluded a data processing agreement pursuant to Art. 28 GDPR for this purpose. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in providing our services securely, quickly and reliably.
Log files when visiting the website
When you use our website, our hosting provider logs so-called "log file" data with every access to the servers, such as the name of the website accessed, the previously visited page ("referrer" URL), product and version information of the browser and operating system used, requesting provider, date and time of access, search engines used, country of access, amount of data transferred, names of downloaded files and IP address.
The legal basis for the processing is Article 6 (1) (f) GDPR. Our legitimate interest in storing the log file data lies in ensuring system security, including the investigation of misuse. The log file data is deleted or anonymized after 30 days at the latest, unless it is needed for longer due to a security-relevant incident, e.g. for investigation or evidence purposes.
Security and protection against misuse
To protect the platform against attacks and misuse, we process your IP address, the requested address and the time with every request. We use this to limit the number of requests per IP address, to check uploaded files for malicious code and to limit failed login attempts as well as the sending of password and confirmation emails. Uploaded images are saved again in the process, which removes embedded metadata such as location data (GPS). We log security-relevant events, e.g. blocked uploads.
The counters for requests and login attempts expire after 24 hours at the latest and are then deleted automatically. The security log is limited in size; older entries are overwritten automatically unless they are needed to investigate a specific incident. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the security of our systems and your data.
Contacting us
When you contact us, we process your personal data such as name, address, email address, telephone number or similar that we need to respond to your request.
The legal basis for processing your personal data in the context of contact requests is Art. 6 (1) (b) GDPR if your request is aimed at concluding a contract, otherwise Art. 6 (1) (f) GDPR, whereby our legitimate interest lies in responding to requests.
In the context of contact requests, we store your personal data for as long as is necessary to process your request or with regard to statutory retention obligations.
Registration / orders by providers and users
When you register or place orders, we process your personal data such as name, address, email address, telephone number, date of birth, self-chosen user name, payment data or similar that we need to fulfil the contractual relationship with you or to carry out pre-contractual measures taken at your request.
Registered users can save individual provider profiles in the registered area and/or compare them there.
We store your personal data collected in the context of registration or orders for as long as is necessary to fulfil the contractual relationship (including, where applicable, the provision of the customer account) and/or to carry out pre-contractual measures taken at your request and/or with regard to warranty, guarantee or comparable obligations and/or with regard to statutory retention periods.
The legal basis for processing your personal data collected in the context of registration or orders is Art. 6 (1) (b) GDPR ("performance of a contract").
The provision of this personal data is not required by law or contract. However, it is necessary for the conclusion of the contract, i.e. for carrying out the registration or order, insofar as the relevant information is mandatory (rather than voluntary) in our registration/order process.
Depending on the type of account, we process in particular: for fashion brands, name, company name, email address, telephone number, address, profile picture and the manufacturers you have saved; for manufacturers, designers and other providers, additionally company data, locations, product categories, minimum order quantities, lead times, logo, photos, catalogues and the billing address.
Each time you log in, we store the IP address and the time of login in your account in order to detect misuse and unauthorized access (Art. 6 (1) (f) GDPR). The stored IP address is overwritten at the next login. For logging in, we set a technically necessary cookie (see section 2).
Public profiles, products and reviews
The information in the profiles of manufacturers, designers and other providers (e.g. company name, location, description, product categories, minimum order quantities, lead times, logo, photos and catalogues) as well as published private label products is publicly visible on the platform and may be indexed by search engines. Reviews are published with the name provided, the rating and any uploaded images. The legal basis is Art. 6 (1) (b) GDPR; publication is the purpose of the listing. The information remains visible until you change or delete it or close your account.
Inquiries, requests for quotation (RFQs) and product inquiries
When you send an inquiry to a provider via the platform, publish a request for quotation (RFQ) or inquire about a product, we process the details of your project (e.g. product, quantity, materials, target price, delivery date), uploaded files such as tech packs, sketches or images, and your contact details. We forward this information to the providers you have selected; we make RFQs accessible to eligible providers on the platform. In this respect, the providers are recipients of your data. The legal basis is Art. 6 (1) (b) GDPR. We store the information for as long as your account exists or as long as it is required to process your request and then delete it unless there are statutory retention obligations.
Chat and file exchange
We store messages and files that you exchange with other users in the chat on our servers in order to deliver them and display the conversation history. They are visible to the respective conversation partner. We only access the content insofar as this is technically necessary, to investigate misuse or if you ask us to. We inform you about new messages by email. If you click on a provider's WhatsApp contact in their profile, we note this in the chat history with this provider. The legal basis is Art. 6 (1) (b) GDPR. The content remains stored as long as the chat or your account exists.
User contributions and comments / blog
When publishing user contributions/comments, we process your personal data such as user name, your contribution etc. that we need to fulfil the contractual relationship with you regarding the use of the platform.
We store your personal data collected in this context for as long as is necessary to fulfil the contractual relationship with you regarding the publication of the contributions or comments.
The legal basis for processing your personal data collected in the context of publishing user contributions is Art. 6 (1) (b) General Data Protection Regulation.
Commission billing (commission dashboard)
Manufacturers participating in the commission model report orders to us that they conclude with customers acquired via Suplify. We process the manufacturer's information (company data, billing address) and the order details: name of the customer or fashion brand, optionally their email address, project description, order type, order value, expected delivery date and uploaded order or invoice documents. On this basis, we calculate the commission and issue the commission invoice.
The legal basis towards the manufacturer is Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (c) GDPR (tax and commercial law obligations). Insofar as data of the manufacturer's customers is processed, this is based on Art. 6 (1) (f) GDPR; our legitimate interest lies in the correct billing of brokered orders. We do not receive this data from the customers themselves but from the respective manufacturer (Art. 14 GDPR). We retain invoices and accounting records in accordance with the statutory periods (§ 147 AO, § 257 HGB) for up to ten years; we delete the other information as soon as it is no longer required for billing.
Sending emails
We send system emails, e.g. to confirm your email address, to reset your password and notifications about new messages or inquiries, via the MailerSend service (MailerSend Inc., a company of the MailerLite group). Your email address, your name and the content of the email are processed; MailerSend also logs delivery. We have concluded a data processing agreement with MailerSend pursuant to Art. 28 GDPR. The legal basis is Art. 6 (1) (b) GDPR, otherwise Art. 6 (1) (f) GDPR; our legitimate interest lies in reliable delivery. For transfers to the USA, see section 7.
Newsletter
If you subscribe to our newsletter, we process the data collected in the process, such as your email address, form of address etc., for the purpose of sending the newsletter.
Insofar as the data processing for the purposes described above is based on your consent, the legal basis is Article 6 (1) (a) GDPR (consent). Otherwise, the data processing is based on Article 6 (1) (f) GDPR ("legitimate interests"), whereby the legitimate interests lie in the purposes stated above.
We store the personal data we need to send the newsletter for as long as we need it for this purpose or until you withdraw your consent to receive the newsletter. Any legitimate continued storage for other purposes (e.g. customer communication) remains unaffected.
We use Mailchimp, a service of The Rocket Science Group LLC d/b/a Intuit Mailchimp, 405 N Angier Ave. NE, Atlanta, GA 30308, USA, to send the newsletter. Mailchimp stores your email address and your subscription data and allows us to evaluate whether a newsletter was opened and which links were clicked. Subscription takes place via the double opt-in procedure; you can unsubscribe at any time via the link in every newsletter. We only load the Mailchimp script for subscription forms on our website after you have given your consent in the cookie banner. Mailchimp is certified under the EU-US Data Privacy Framework (see section 7).
Own visitor statistics
In order to understand how our platform is used and to improve it, we store the following in our own database when our pages are accessed: the page accessed, search queries (country, product, minimum quantity), the path to the home page, the time, a shortened IP address (the last segment is removed so that no personal reference is possible via the IP address) and – if you are logged in – the email address of your account. The data is not passed on to third parties and is deleted automatically after 90 days. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in improving our services. You can object to the processing at any time (see section 10).
External services via links (WhatsApp, Calendly)
On the platform, we link to WhatsApp chats with providers and to Calendly for booking a consultation. Data is only transferred to these services when you click on the respective link; their privacy policies then apply. The providers are WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, and Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA.
3. Google Analytics
This website uses Google Analytics, a web analysis service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses so-called "cookies", text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. Google bases this data transfer on the EU standard contractual clauses.
If IP anonymisation is activated on this website, however, your IP address will be shortened by Google beforehand within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activities and to provide the website operator with further services related to website and internet use. The IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. Insofar as cookies are not only set on the website when appropriate consent has been given, you can prevent the storage of cookies by setting your browser software accordingly; however, please note that in this case you may not be able to use all functions of this website to their full extent.
The data processed in the context of the use of Google Analytics is automatically deleted after 26 months.
Insofar as the data processing is based on your consent, the legal basis is Article 6 (1) (a) GDPR (consent). Otherwise, the data processing is based on Article 6 (1) (f) GDPR ("legitimate interests"), whereby the legitimate interests lie in the purposes stated below.
You can prevent the collection of the data generated by the cookie and related to your use of the website (including your IP address) by Google and the processing of this data by Google by downloading and installing the browser plug-in available at the following link:
https://tools.google.com/dlpage/gaoptout?hl=en
Google Analytics is only loaded if you allow all cookies in the cookie banner. Google LLC is certified under the EU-US Data Privacy Framework (see section 7).
4. Google Ads conversion tracking
With your consent, we use Google Ads conversion tracking, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A cookie (_gcl_au) is set that allows us to recognise whether visitors who came to us via one of our ads perform certain actions, e.g. create a request for quotation or search for manufacturers. We only receive aggregated statistics, no information with which we can identify you personally. Google may link the data to your Google account if you are logged in there.
The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which you can withdraw at any time via the cookie settings. Data may be transferred to Google LLC in the USA (see section 7). Further information: policies.google.com/privacy.
5. Meta Pixel
With your consent, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). This allows us to measure the effectiveness of our ads on Facebook and Instagram and to show ads to people who are interested in our services. Among other things, your IP address, browser information, the pages visited and a cookie (_fbp) are processed. Meta may link the data to your Facebook or Instagram account.
We are jointly responsible with Meta for the collection and transmission of the data to Meta (Art. 26 GDPR); further processing is the sole responsibility of Meta. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which you can withdraw at any time via the cookie settings. Data may be transferred to Meta Platforms, Inc. in the USA (see section 7). Further information: facebook.com/privacy/policy.
6. External scripts and fonts
We load some technical program libraries from public servers (content delivery networks): jQuery from code.jquery.com (OpenJS Foundation), program libraries via cdnjs (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) and jsDelivr (ProspectOne Sp. z o.o., Poland). Your IP address is transmitted to the respective server so that the file can be delivered. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in a fast and reliable display of the website.
We do not load fonts from Google but from our own server. No data is transferred to third parties in the process.
7. Transfers to third countries
Some of the service providers mentioned are based in the USA or may transfer data there. The EU Commission has adopted an adequacy decision for the USA (EU-US Data Privacy Framework); it applies to companies certified under this framework, e.g. Google LLC, Meta Platforms, Inc. and The Rocket Science Group LLC (Mailchimp). If a service provider is not certified, the transfer is based on the EU standard contractual clauses (Art. 46 (2) (c) GDPR).
8. Rights of data subjects
Pursuant to Art. 15 General Data Protection Regulation, you have the right to request information about the processing of your personal data ("right of access by the data subject").
Pursuant to Art. 16 General Data Protection Regulation, you have the right to request the rectification and erasure of inaccurate personal data concerning you ("right to rectification").
Pursuant to Art. 17 General Data Protection Regulation, you can request the erasure of personal data concerning you if one of the grounds listed there applies ("right to be forgotten").
Likewise, pursuant to Art. 18 General Data Protection Regulation, you have the right to request the restriction of the processing of personal data concerning you if one of the conditions listed there applies ("right to restriction of processing").
Pursuant to Art. 20 General Data Protection Regulation, you have the right to receive personal data concerning you and to have this data transmitted to another controller ("right to data portability").
Withdrawal of consent: see section "Right of withdrawal" in this privacy policy.
Right to object: see section "Right to object" in this privacy policy.
You have the right to lodge a complaint with the competent supervisory authority.
The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de. You can also contact the supervisory authority at your place of residence or work.
9. Right of withdrawal
You can withdraw any consent you have given to the processing of your personal data at any time, e.g. by email to the email address stated at the beginning. This does not affect the lawfulness of the processing carried out on the basis of the consent until the withdrawal.
You can also withdraw your consent to cookies and advertising services at any time via the "Cookie Settings" link in the page footer.
10. Right to object
Insofar as our data processing is based on Article 6 (1) (f) GDPR ("legitimate interests"), you have the right to object to the processing of your personal data in accordance with Article 21 GDPR.
11. Disclosure of your data
Unless already stated elsewhere in this privacy policy, we pass on your personal data to the following further recipients or categories of recipients:
- Hostinger International Ltd. (hosting, databases, content delivery network), see section 1
- MailerSend (sending system emails), see section 1
- Intuit Mailchimp (newsletter), see section 1
- other users of the platform, insofar as you send them content (e.g. inquiries, RFQs, chat messages) or publish content (profiles, reviews)
- Google Ireland Limited and Meta Platforms Ireland Limited, only with your consent, see sections 3 to 5
- tax advisors and authorities, insofar as we are legally obliged to do so (e.g. tax office)
Unless already stated elsewhere in this privacy policy, we intend to transfer your personal data to the following third country or international organisation:
- USA: Google LLC (Google Analytics, Google Ads), Meta Platforms, Inc. (Meta Pixel), The Rocket Science Group LLC (Mailchimp), MailerSend Inc. (email delivery), Cloudflare, Inc. and Calendly LLC – each on the basis of the EU-US Data Privacy Framework or EU standard contractual clauses, see section 7
Your data is not passed on for other purposes, and in particular is not sold.
12. Storage period, obligation to provide data and automated decisions
Unless a more specific storage period is stated in this privacy policy, we process your data until the respective purpose no longer applies or you withdraw your consent or delete your account. Statutory retention obligations, in particular under commercial and tax law (up to ten years), remain unaffected; in this case we block the data for other purposes.
Without the data marked as mandatory, we cannot process your account, your inquiries or an order. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
13. Changes to this privacy policy
We adapt this privacy policy when our services or the legal situation change. The version published on this page applies.
Last updated: October 2026