Privacy Policy

EPR Pilot, a service of BaDuNi GmbH
Version 3.3 — Last updated: 26 August 2026
Applies to the marketing website epr-pilot.eu and the application app.epr-pilot.eu.

This is a translation for information purposes. In the event of any discrepancy, the German version prevails.

Preamble

With the following privacy policy we would like to inform you which types of your personal data we process for which purposes and to what extent. We take the protection of your personal data very seriously and treat it confidentially and in accordance with statutory data protection provisions, in particular the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

Controller

BaDuNi GmbH
Iberg 9
77876 Kappelrodeck
Germany

Email: info@epr-pilot.eu
Legal notice: epr-pilot.eu/impressum
Managing Director: Sebastian Baßler
Commercial register: Mannheim Local Court, HRB 751614

No data protection officer has been appointed. Please use the address above for all data protection matters.

Overview of Processing

• Contact data (e.g. name, email address)
• Account data (e.g. login credentials, subscription status)
• Usage data (e.g. functions accessed, access time)
• Meta and communication data (e.g. IP addresses, browser information)
• Product data uploaded by the customer (e.g. ASIN, EAN, product title, packaging weights, material types)
• Order and shipment report data, including order identifiers and, depending on the Amazon export, buyer contact aliases, shipping or recipient data and other personal fields
• Uploaded original files and complete raw rows from import files

Legal Bases

• Consent (Article 6 (1) (a) GDPR)
• Performance of a contract (Article 6 (1) (b) GDPR)
• Legal obligation (Article 6 (1) (c) GDPR)
• Legitimate interests (Article 6 (1) (f) GDPR)

Necessity of Provision

Providing your name, company and email address is necessary to set up an account and use EPR Pilot as part of the underlying Happy Arbitrage plan. Without this information we cannot provide access. Billing and payment data is processed during the order and billing process for the Happy Arbitrage plan booked, not under a separate EPR Pilot contract.

All further information, in particular uploaded product and order data, is voluntary. Without it, the relevant function cannot be used or can be used only to a limited extent; no further disadvantages arise for you.

No Automated Decision-Making

Automated decision-making including profiling within the meaning of Article 22 GDPR does not take place. Calculations in EPR Pilot do not evaluate individuals, even though uploaded Amazon reports may contain personal fields depending on the export. The calculations relate to product, packaging and quantity data and do not constitute a legal assessment.

Security Measures

• Encryption of data transmission via TLS/SSL (HTTPS)
• Storage of application data on servers in Germany (Hetzner Online GmbH)
• Access controls and authentication mechanisms

Recipients and Service Providers

Depending on the function used, we engage the following service providers or transmit the data required for the respective function to them:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: hosting of the application and storage of workspace, product, order, analysis and export data on servers in Germany.
• IONOS SE, Elgendorfer Strasse 57, 56410 Montabaur, Germany: operation of our mailbox and dispatch of outgoing email.
• Supabase, Inc.: server-side authentication and user management. The project instance is configured for the Frankfurt (EU) region.
• Stripe Payments Europe, Ltd. or Stripe Technology Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland: payment processing for the underlying Happy Arbitrage plan and transmission of subscription and payment status data for access control.
• Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA: hosting of the marketing website, receipt of contact form enquiries and forwarding to our mail server.
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: delivery of the Inter font within the application.
• Volentio JSD Limited, Suite 2a1, Northside House, Mount Pleasant, Barnet, England, EN4 9EB, United Kingdom, operator of jsDelivr: delivery of Bootstrap, Bootstrap Icons and Chart.js within the application.

Transfers to Third Countries

Workspace, product, order, analysis and export data from the application is stored on servers in Germany at Hetzner Online GmbH. Authentication and account data is additionally processed by Supabase in the configured EU project region.

During payment processing for the Happy Arbitrage plan, delivery of the marketing website, receipt of contact form enquiries and loading of external resources within the application, technical or contract-related data may also be processed in third countries by Stripe, Vercel, Google or CDN providers engaged by jsDelivr. Where required, such transfers are based on an adequacy decision, EU standard contractual clauses pursuant to Article 46 (2) (c) GDPR or other appropriate safeguards. You may request a copy of the applicable safeguards at info@epr-pilot.eu.

Email dispatch and storage of delivered messages take place on servers within the European Union. The form submission itself is received by the Vercel function, see the Contact Form section. No additional external form service is used.

Application Hosting and Server Log Files

The EPR Pilot application is hosted on servers of Hetzner Online GmbH. All application data, including your uploaded product data, order reports, analyses and export data, is stored exclusively on servers in Germany. The legal basis is Article 6 (1) (b) GDPR.

Each access generates server-side log data, in particular IP address, date and time, resource requested, referrer, HTTP status code, volume of data transferred and browser and operating system information. This data serves delivery, stability, error analysis, IT security and abuse prevention. It is deleted or anonymised once these purposes no longer apply, unless it remains necessary to investigate a specific security incident or comply with a legal obligation. The legal basis is Article 6 (1) (f) GDPR.

Website Hosting

The marketing website epr-pilot.eu is hosted by Vercel Inc. When you visit it, Vercel processes technical data such as your IP address, browser type and the time of the server request. The legal basis is Article 6 (1) (f) GDPR.

The website uses the system fonts of the respective device. No external Google Fonts are loaded.

Authentication

We use Supabase server-side for user authentication and account management. When an account is created, a user signs in or a magic link is verified, Supabase processes in particular your email address and the authentication data required for verification. After successful verification, EPR Pilot manages the signed-in state through its own Flask session cookie. A Supabase authentication token is not stored as a separate browser cookie. The legal basis is Article 6 (1) (b) GDPR.

Externally Embedded Resources in the Application

The application loads the Inter font from Google Fonts and Bootstrap, Bootstrap Icons and Chart.js through the jsDelivr CDN. When these resources are requested, technically required data, in particular IP address, time, requested file, referrer and browser information, is transmitted to the relevant provider and its CDN service providers. The legal basis is Article 6 (1) (f) GDPR. Our legitimate interest lies in a consistent and technically reliable presentation of the application.

Further information is available in the Google Privacy Policy, the jsDelivr Privacy Policy and the jsDelivr sub-processor list. The marketing website epr-pilot.eu does not load these external resources.

Contact Form

If you contact us via the contact form, your name, email address and message content are processed for the purpose of handling your enquiry. The legal basis is Article 6 (1) (b) GDPR for pre-contractual measures relating to the underlying Happy Arbitrage plan or Article 6 (1) (f) GDPR.

Processing path. When the form is submitted, the request is first received by a serverless function at Vercel Inc., which also hosts this website. Vercel processes the form content and the sender's IP address for the duration of handling the request and for abuse prevention. The function then hands the message over via an encrypted SMTP connection to our mailbox on the mail server of IONOS SE, Elgendorfer Strasse 57, 56410 Montabaur, Germany.

No additional external form service is used. The form data is stored in a database neither at Vercel nor with us; after delivery the message exists solely in our mailbox. Regarding a possible transfer to Vercel in the USA, see the section on transfers to third countries.

To protect against automated submissions we use an additional field that is invisible to humans, a time-window check and a limit on requests per IP address. No additional captcha or anti-bot service is used. The checks run within the Vercel function described above. The legal basis is Article 6 (1) (f) GDPR.

EPR Pilot Application, Data Processing

When using the Software you upload data from your Amazon seller account, for example Business Reports, Shipment Reports and EPR reports, as well as optional further product data. This may include Keepa export files that you have generated or obtained outside EPR Pilot. The following types of data are processed:

• Product identifiers (ASIN, EAN)
• Product characteristics (title, category, packaging weight, material type)
• Order, quantity and shipment data, including order identifiers stored in a separate field
• Depending on the Amazon export, buyer contact aliases, shipping or recipient data and other personal fields
• Uploaded original files and complete raw rows from import files
• Working values derived from customer data per EPR area (packaging, electrical equipment, batteries)

The uploaded files remain stored in the workspace. In addition, EPR Pilot stores the complete import rows as raw records; order identifiers are also stored in a separate field. This data is processed to provide the contractual service (Article 6 (1) (b) GDPR) and is stored on German servers.

Review your export files before uploading them and upload only the fields and records required for the analysis. Remove personal information that is not required before upload where possible.

EPR Pilot does not automatically call Keepa and does not transmit product identifiers or customer data to Keepa. When you voluntarily open the external Keepa link, you leave EPR Pilot; Keepa is responsible for the subsequent processing.

No transmission to registers and authorities. We prepare data so that you can use it yourself. We do not transmit data to the LUCID packaging register, the Stiftung Elektro-Altgeräte Register, scheme operators, appointed experts or any other bodies.

Important: EPR Pilot is independent software and has no connection, partnership or endorsement with Amazon. All Amazon data is uploaded voluntarily by you.

Payment Processing and Access Control

EPR Pilot is provided exclusively as part of certain Happy Arbitrage plans. Payment processing for the underlying plan is carried out through Stripe, in particular Stripe Payments, Stripe Checkout, Stripe Billing and Stripe Invoicing. Payment and billing data is transmitted directly to Stripe during the order process and processed there. Complete card data does not reach EPR Pilot.

For automated access control, EPR Pilot receives signed Stripe webhooks. In this context EPR Pilot processes in particular email address, Stripe customer and subscription identifiers, plan or price identifier, subscription status, payment status and billing period. The legal basis is Article 6 (1) (b) GDPR, and additionally Article 6 (1) (c) GDPR for accounting and invoice data.

Cookies and Storage Technologies

Our website and application use exclusively technically necessary cookies and storage mechanisms. We do not use analytics, tracking or marketing cookies. No consent is required for technically necessary storage (Section 25 (2) TDDDG in conjunction with Article 6 (1) (f) GDPR).

Marketing website (epr-pilot.eu)

Application (app.epr-pilot.eu)

Storage and Deletion

• Account data: for the duration of the underlying Happy Arbitrage contract and beyond where statutory retention obligations or the establishment, exercise or defence of legal claims require this.
• Product and order data (workspace data): deleted after EPR Pilot access ends as soon as it is no longer required to perform the contract, comply with legal obligations, or establish, exercise or defend legal claims. Earlier deletion may be requested where no conflicting grounds apply.
• Invoices and accounting vouchers: 8 years pursuant to Section 147 (3) of the German Fiscal Code. Books, annual financial statements and inventories: 10 years.
• Contact form enquiries: the message is delivered by email and retained until the enquiry has been conclusively handled. It is retained beyond that point only where necessary to perform a contract, comply with legal obligations, or establish, exercise or defend legal claims.
• Server log files: once the purposes described in the Application Hosting and Server Log Files section no longer apply, unless further retention is necessary for a security investigation or to comply with legal obligations.
• Records of consent: until the expiry of the limitation periods following withdrawal.

You may request deletion of your data at any time by contacting us at info@epr-pilot.eu.

Your Rights

• Right of access (Article 15 GDPR)
• Right to rectification (Article 16 GDPR)
• Right to erasure (Article 17 GDPR)
• Right to restriction of processing (Article 18 GDPR)
• Right to data portability (Article 20 GDPR)
• Right to object (Article 21 GDPR), see the two following sections
• Right to withdraw consent (Article 7 (3) GDPR)
• Right to lodge a complaint (Article 77 GDPR)
• Right not to be subject to a decision based solely on automated processing (Article 22 GDPR). No such decision takes place.

Objection to Processing Based on Legitimate Interests

Where we process data on the basis of Article 6 (1) (f) GDPR, you have the right to object at any time on grounds relating to your particular situation. We will then no longer process the data concerned unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Objection to Direct Marketing

You have the right to object at any time to the processing of your data for direct marketing purposes pursuant to Article 21 (2) GDPR. No reason is required for this objection, and no balancing of interests takes place. Following your objection we will no longer process your data for marketing purposes.

Competent Supervisory Authority

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart, Germany
Email: poststelle@lfdi.bwl.de

Changes to This Privacy Policy

We reserve the right to adapt this privacy policy to reflect changed legal requirements or changes to our services. The current version is always available at epr-pilot.eu/en/privacy and carries a version number and a date.