Privacy Policy for PriceVigil
Version: 3 September 2026
This privacy policy describes the processing of personal data when using the PriceVigil software, the license service, the update and information services and — insofar as used — the online ordering and payment process.
Note: This is a convenience translation. The legally binding version of this privacy policy is the German original ("Datenschutzerklärung"). In the event of any discrepancy, the German version prevails. This version describes an exclusively B2B offering by a sole proprietorship using Cloudflare, Stripe and Resend, and should be reviewed by a lawyer before the first sale.
1. Controller
Erdi Karasungur, trading under the business name "Karasungur Systems"
Bieberer Straße 52
63065 Offenbach am Main
Germany
E-mail: service@karasungursystems.com
No data protection officer has been appointed. Data protection inquiries may be directed to the above e-mail address.
2. Principle: Business Data Stays Local
PriceVigil is executed locally on the customer's computer. In particular, the following data is stored locally as a matter of principle and is not transmitted to Karasungur Systems:
- item numbers, product designations, EANs, brands and categories,
- retailer and product addresses as well as retrieved prices,
- price histories, evaluations, images, records and exports,
- shop logins, cookies, browser profiles and market selections,
- SMTP access data and recipients of local e-mail reports,
- own sales prices, notes and internal settings.
When the retailer pages selected by the customer are accessed, the customer's computer communicates directly with the respective retailer. Karasungur Systems does not receive these retrievals and contents. The data protection provisions of the respective retailer apply to the processing there.
The customer decides, as its own controller, which data it processes with PriceVigil and who in its company may access it.
3. Contract, Customer and License Administration
Upon inquiry, order, conclusion of contract and performance of the contract, the following data may be processed:
- name and company,
- business address and contact data,
- e-mail address,
- invoicing and tax details,
- selected plan, term and agreed usage limits,
- license key, license status and times of change,
- payment and transaction status as well as reference numbers of payment services,
- contents of business communication and support inquiries.
Processing takes place to carry out pre-contractual measures and to perform the contract pursuant to Art. 6(1)(b) GDPR. Data required under tax and commercial law is stored pursuant to Art. 6(1)(c) GDPR. Securing the license system, preventing abuse and handling business inquiries are additionally based on Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and economically reliable operation of PriceVigil.
4. Online Activation and Regular License Confirmation
During activation and later license confirmation, PriceVigil transmits to the license service:
- License key: allocation and verification of the booked license,
- pseudonymous device identifier: limitation to the agreed number of devices,
- computer name at first activation: comprehensible device management and support,
- time of activation and check: license status, security and error analysis,
- plan, validity and usage limits: creation of the signed local license certificate,
- technical connection data, in particular IP address and user agent: transmission, protection and operation of the server.
The device identifier is a shortened cryptographic check value that is formed from technical characteristics of the computer and stored locally. It is not created as a plaintext copy of these characteristics, but does enable recognition of the same device and must therefore be treated as personal or at least capable of being related to a person.
The legal basis is Art. 6(1)(b) GDPR. Protection against unauthorized multiple use and attacks is additionally based on Art. 6(1)(f) GDPR.
5. Updates, Notices, Plans and Shop Base Rules
PriceVigil may check with the server whether updates, manufacturer notices, plan information or signed base rules for retailer searches are available. No items, prices, shop logins or SMTP data are transmitted in this process. Technically, however, the IP address, time, requested path and user agent arise during server and security operation.
The legal basis is Art. 6(1)(b) GDPR insofar as the request serves the provision of the contractual software, as well as Art. 6(1)(f) GDPR for secure and up-to-date operation.
6. Payment Processing via Stripe
If the customer orders or pays online via Stripe, the payment is processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, and affiliated Stripe companies.
In particular, Stripe may process name, e-mail address, invoicing address, payment method data, amount, product and order details, IP address, device information and verification characteristics for fraud prevention. Karasungur Systems regularly only receives the customer, transaction, subscription and payment status data required for contract allocation, not the complete card data.
The processing is necessary for the performance of the contract pursuant to Art. 6(1)(b) GDPR and to comply with legal obligations pursuant to Art. 6(1)(c) GDPR. Stripe processes certain data, for example for fraud prevention and compliance with regulatory obligations, on its own responsibility. Stripe provides further information in its privacy information and its Data Processing Agreement.
Stripe may process data worldwide, including in the USA. For this, Stripe cites in particular the EU-US Data Privacy Framework and, additionally, the European Commission's standard contractual clauses as transfer mechanisms.
If Stripe is not used as a payment method, this section has no practical significance for the contract concerned.
7. Hosting and License Infrastructure via Cloudflare
The license, update and information service is operated via services of Cloudflare. Depending on the service booked, the contractual partner is in particular Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Connection data as well as the data mentioned in sections 3 to 5 may be processed to the extent necessary.
Insofar as Cloudflare processes data on behalf, it is engaged on the basis of a Data Processing Addendum. Cloudflare points out that processing may also take place outside the European Economic Area. For necessary third-country transfers, the Cloudflare DPA provides, among other things, the European Commission's standard contractual clauses and — where applicable — the EU-US Data Privacy Framework.
The legal bases for the engagement are Art. 6(1)(b) and (f) GDPR. The legitimate interest lies in a secure, resilient license and delivery service protected against attacks.
8. Incoming and Outgoing E-mail Communication via Resend
Resend is used for the receipt of messages to service@karasungursystems.com and for outgoing transactional e-mails. Outgoing messages include in particular the automatic sending of a license key after purchase. The provider is Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. In doing so, Resend processes in particular the sender and recipient address, subject, message content, attachments where applicable, and sending, receipt, delivery and error data.
According to its own information, Resend stores account data, e-mail metadata, logs and API data in the USA. For these transfers, Resend cites the European Commission's standard contractual clauses incorporated in its Data Processing Addendum as well as its participation in the EU-US Data Privacy Framework. According to Resend, e-mail data is retained for 30 days in the regular plans. A Data Processing Addendum pursuant to Art. 28 GDPR exists with Resend.
The PriceVigil license system passes only plaintext e-mails to Resend and does not request open or click tracking. Such tracking functions are disabled by default at Resend and must not be activated for these transactional e-mails.
If interested parties or customers contact Karasungur Systems at service@karasungursystems.com, this data is processed to handle the message. The legal basis is Art. 6(1)(b) GDPR for pre-contractual or contract-related communication and otherwise Art. 6(1)(f) GDPR for handling business inquiries.
Automatic price reports from PriceVigil are sent via the SMTP server set up by the customer itself. Access data, report contents and recipients remain with the customer and its e-mail provider; Karasungur Systems does not receive them.
9. Support and Support Packages
In the case of a support inquiry, Karasungur Systems processes the information and files voluntarily submitted by the customer to handle the inquiry. The low-data-protection-impact `.pvsupport` package that can be generated in PriceVigil contains, by its technical design, only system information, counters, summarized states and shop domains, but no item designations, prices, complete product addresses, logins, e-mail access data or license keys. Shop domains may nevertheless allow conclusions to be drawn about business relationships.
A support package is not uploaded automatically. Only the customer decides whether and by which means it transmits it to Karasungur Systems. The legal basis is Art. 6(1)(b) GDPR and, outside a contract, Art. 6(1)(f) GDPR.
10. Website, Cookies and Local Storage
This policy assumes that a public PriceVigil website does not use analytics, advertising or profiling services. Technically necessary storage may be used insofar as it is required for a service expressly requested. For non-essential cookies or comparable access to a terminal device, consent would have to be obtained in advance.
In the local PriceVigil program, settings, license certificates, browser profiles and business data are stored on the device because this is necessary for the local function requested by the customer. These contents are not read for advertising purposes.
Stripe or accessed retailer pages may use their own technically necessary or consent-requiring storage mechanisms. Their respective information and consent interfaces apply here.
11. Further Recipients
Personal data is only transmitted insofar as this is necessary and legally permissible. In addition to Cloudflare, Resend and Stripe, recipients may be:
- the e-mail and hosting provider actually used,
- banks and payment service providers,
- tax advisory, accounting and auditing,
- legal advice and IT service providers with the required confidentiality,
- authorities and courts in the case of a legal obligation.
There is no sale of personal data and no use of the local PriceVigil business data for advertising purposes.
12. Storage Period
Personal data is only stored for as long as it is necessary for the respective purpose:
- contract, invoice and accounting documents are retained in accordance with the retention obligations under commercial and tax law,
- business correspondence is stored in accordance with its legal significance and existing retention or limitation periods,
- support data is deleted after the inquiry has been completed, unless further contractual or legal retention is required,
- security and connection logs are retained only for as long as this is necessary to prevent and clarify technical disruptions.
License and device activation data is deleted twelve months after the end of the contract, insofar as it is not still required to prevent abuse, to handle open claims or due to statutory retention obligations. Data that is still needed is deleted after the respective reason ceases to apply.
The customer deletes local business data itself via the functions of the software or the operating system. Karasungur Systems has no access to it.
13. Legal Basis of Legitimate Interests and Objection
Insofar as processing is based on Art. 6(1)(f) GDPR, the data subject may object for reasons arising from its particular situation. Karasungur Systems then no longer processes the data concerned, unless there are compelling legitimate grounds for protection or the establishment, exercise or defense of legal claims conflicts with this.
14. Rights of Data Subjects
Data subjects have the following rights, subject to the statutory requirements:
- access pursuant to Art. 15 GDPR,
- rectification pursuant to Art. 16 GDPR,
- erasure pursuant to Art. 17 GDPR,
- restriction of processing pursuant to Art. 18 GDPR,
- data portability pursuant to Art. 20 GDPR,
- objection pursuant to Art. 21 GDPR,
- withdrawal of consent with effect for the future.
Inquiries may be directed to the e-mail address named under section 1. To avoid disclosure to unauthorized persons, reasonable proof of identity may be required.
15. Right to Lodge a Complaint
Data subjects may lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR. For a company based in Hesse, the following is responsible in particular:
The Hessian Commissioner for Data Protection and Freedom of Information
Wilhelmstraße 7
65185 Wiesbaden
Germany
E-mail: poststelle@datenschutz.hessen.de
Telephone: +49 611 1408-0
16. Security
Karasungur Systems uses appropriate technical and organizational measures to protect personal data. These include in particular encrypted transmission, signed license certificates and update information, access restrictions, separated private signing keys and data-minimizing admin logs. Absolute protection cannot be guaranteed for data transmissions and IT systems.
17. Automated Decisions
There is no exclusively automated decision within the meaning of Art. 22 GDPR with legal or similarly significant effect. The automatic license check merely implements, in technical terms, the license characteristics previously agreed by contract. Decisions on the conclusion of a contract, blocking in the event of disputes or other legal measures can be reviewed by a human.
18. Changes to This Privacy Policy
This privacy policy may be adapted if functions, service providers or the legal situation change. The version respectively provided is authoritative. Changes to the privacy policy do not extend the purposes of processing already taking place without a separate legal basis.
← Back to home