Privacy Policy

Last updated: 4 August 2026
This translation is provided for your convenience. The German version of this privacy policy shall prevail.

Thank you for your interest in GLOBALBACK. Protecting your personal data is important to us. Below we inform you, in accordance with the General Data Protection Regulation (GDPR), which data we process and for what purpose.

1. Controller

The controller responsible for data processing on this website is:

We are not legally required to appoint a data protection officer. For any questions regarding data protection, please contact us using the details above.

2. General Principles and Legal Bases

We only process personal data to the extent necessary to provide a functioning website and our services. The legal bases are in particular:

• Art. 6(1)(b) GDPR – for the performance of a contract or pre-contractual measures,
• Art. 6(1)(c) GDPR – for compliance with legal obligations,
• Art. 6(1)(f) GDPR – to safeguard legitimate interests (e.g. the secure and stable operation of the website).

3. Hosting

Our website is hosted by an external service provider:

STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany.

The servers are located in Germany. We have entered into a data processing agreement with the provider in accordance with Art. 28 GDPR. The legal basis is Art. 6(1)(f) GDPR (interest in a secure and efficient provision of our services).

4. Server Log Files

When you access the website, information transmitted by your browser is automatically collected by the hosting provider in so-called server log files. This includes in particular browser type and version, operating system used, referrer URL, hostname of the accessing device, time of the server request and the IP address.

This data is not merged with other data sources. Processing takes place on the basis of Art. 6(1)(f) GDPR to ensure the technically error-free presentation of the site and for security purposes. Storage takes place within the standard framework of our hosting provider.

5. Cookies

Our website uses exclusively one technically necessary session cookie. It serves to maintain your session – for example when logging into your account – and is automatically deleted at the latest when you close your browser.

This cookie is strictly necessary for the operation of the functions you have expressly requested. No consent is required for this (Section 25(2) No. 2 TDDDG – German Telecommunications-Digital-Services-Data-Protection Act; Art. 6(1)(f) GDPR).

We use no analytics, tracking, statistics or marketing cookies and do not embed any corresponding third-party services.

6. QR Code Generation

If you generate QR codes on our website, this happens entirely within your browser (locally). No data is transmitted to third parties or external services for this purpose.

7. Orders and Contract Processing

As part of an order, we process the data you provide in order to establish, carry out and process the contract. This includes in particular your email address, optionally your phone number, and the order details.

Providing an email address is required for order processing and for the delivery of your GLOBALBACK-ID. The legal basis is Art. 6(1)(b) GDPR.

8. GLOBALBACK Cloud (Registration and Entries)

If you create an entry in the GLOBALBACK Cloud, we process the data you provide, in particular your name, email address, phone number, and details of the items you register (e.g. serial numbers, components).

Providing an email address is required for a Cloud entry, as it serves to assign and verify authenticity. The legal basis is Art. 6(1)(b) GDPR.

For an account linked to a GLOBALBACK ID, providing a phone number is voluntary. For a guest account without a GLOBALBACK ID, however, providing a phone number is required; the legal basis in this respect is Art. 6(1)(b) GDPR. Irrespective of this, when entering it you decide yourself whether this number should be displayed publicly: if you activate this option, the number will be visible to anyone who looks up the corresponding GBID on globalback.de or on a connected verification portal. This publication takes place exclusively on the basis of your explicit consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future by removing the number or deactivating the public display in your account. If you do not provide a phone number, or deactivate the public display, the number will not be shown to finders; contact will then take place exclusively via our anonymised messaging function.

You log into your account via an email-based login procedure (magic link). Access tokens are stored exclusively in encrypted form (as a hash value).

9. Status Lookup via Connected Verification Portals and Public Status Pages

Entries stored in the GLOBALBACK Cloud can be looked up not only via globalback.de, but also via other verification portals we operate, currently: seriennummern-check.de, ebike-check.online, checkmich.online, checkme.website and gbid.info. These portals are operated by the same controller (see item 1).

A lookup will only display the identification number, the status of the item, and – if you have activated the public display of your phone number (see item 8) – the phone number. Other personal data of the owner (in particular name and email address) is not disclosed.

We reserve the right to make the pure status lookup available in future, via a technical interface (API), also to connected or cooperating verification portals of external operators. In this case, only the aforementioned, already publicly accessible details (identification number, status and, where applicable, the phone number you have released) will be provided. Where such an external operator is independently responsible under data protection law, it is itself responsible for processing on its own portal.

The legal basis for providing the status is Art. 6(1)(b) and (f) GDPR (enabling verification of authenticity and status, as well as the return of lost items); the display of a phone number is based on your consent under Art. 6(1)(a) GDPR and can be withdrawn at any time.

Public status pages and findability via search engines

For every assigned GLOBALBACK ID and every identification number registered in the GLOBALBACK Cloud, we additionally provide a publicly accessible status page at www.globalback.de/pruef/. These pages may be included in the results of search engines (e.g. Google). The purpose is to allow finders and prospective buyers to enter a number directly into a search engine and immediately see its reported status – increasing the chance that lost or stolen items are returned to their owners.

The status pages show the same details as a lookup via the verification portals (see above): category, manufacturer, model and status of the item, for items reported as stolen additionally a police reference number you have provided, and your phone number if you have entered it for display. For Cloud entries, the phone number only appears if you have expressly activated its public display in your account (see item 8); for GLOBALBACK IDs, the phone number entered in your GBID account appears for as long as it is entered there – remove it from your account and it will no longer be shown on the status page. Your name and email address are never displayed.

The status pages carry the search engine directive “noarchive”: search engines may display the page but must not keep a cached copy. If you delete an entry or your account, the corresponding address no longer returns any content and is removed from search results at the next update. The legal basis for publication is Art. 6(1)(b) GDPR (the findability of registered numbers is the core of the service you use); the display of your phone number is based on your consent under Art. 6(1)(a) GDPR, which you may withdraw at any time with effect for the future.

10. Anonymous Contact by Finders

If a person finds an item marked with a GBID, they can send a message to the owner via our platform. In doing so, we process the details entered by the finder (e.g. message and voluntarily provided contact details) and forward these to the owner. The owner’s contact details are not disclosed to the finder. The legal basis is Art. 6(1)(f) GDPR (enabling the return of lost items).

The operator receives a silent copy (blind carbon copy) of every such message. It serves exclusively to detect and prevent misuse of the messaging function – such as harassment, advertising or attempted fraud – and to provide evidence of delivery in the event of a dispute. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in preventing misuse and ensuring secure operation). The copies are not evaluated for advertising purposes; they are deleted in accordance with the periods stated in section 13.

11. Email Dispatch

We handle the dispatch of emails (e.g. confirmations, login links, finder messages) via the email server of our hosting provider STRATO. In doing so, the data required for delivery (in particular the email address and message content) is processed.

12. Payment Service Providers (Stripe and PayPal)

Stripe

For the processing of payments (including credit card and PayPal via Stripe), we use the payment service provider Stripe. The provider for customers within the EU is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (hereinafter “Stripe”).

If you initiate a payment via Stripe, we pass on the data required for this to Stripe, to the extent necessary for the performance of the contract. This includes in particular name, email address, order number, payment method and payment data (e.g. credit card or bank details), invoice amount, currency, as well as date, time and transaction number.

The legal basis for the processing is Art. 6(1)(b) GDPR (performance of the contract concluded with you) as well as Art. 6(1)(f) GDPR (our legitimate interest in secure and efficient payment processing as well as fraud prevention). Providing this data is required for a payment via Stripe; without it, we cannot carry out such a payment.

We have entered into a data processing agreement with Stripe in accordance with Art. 28 GDPR. As part of payment processing, data may be transferred to Stripe, Inc. in the USA. Stripe has implemented measures for international data transfers, based in particular on the EU Standard Contractual Clauses (SCCs).

Your data is stored until payment processing is complete; this also includes the period required for processing refunds, debt collection and fraud prevention. Further information on data protection at Stripe can be found at stripe.com/en/privacy.

PayPal

For payments in the reseller area (see item 18), we additionally use the payment service PayPal. The provider for users within the EU is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”).

If you initiate a payment via PayPal, you will be redirected to PayPal’s pages. In doing so, we transmit the details required for the payment, in particular the order number, the invoice amount and the currency. You enter your payment data (e.g. bank details or card details) exclusively at PayPal; we do not receive them. From PayPal we receive confirmation of the payment status, the amount collected and a transaction number.

The legal basis is Art. 6(1)(b) GDPR (performance of the contract concluded with you) and Art. 6(1)(f) GDPR (legitimate interest in secure and efficient payment processing). PayPal is independently responsible under data protection law for the processing of your data on its own pages and systems; for details please refer to PayPal’s privacy notices at paypal.com.

13. Storage Period

We store personal data only for as long as necessary for the respective purposes:

• Contract and Cloud data is stored for the duration of the contract (term of the GBID or the Cloud entry) and removed after expiry or after the entry has been deleted.
• Invoice and accounting data is subject to statutory retention obligations (under commercial and tax law, up to ten years). Processing is restricted for the duration of this retention period; the data is deleted afterwards.

14. Your Rights as a Data Subject

Under the GDPR, you have in particular the following rights:

• Right of access (Art. 15 GDPR),
• Right to rectification (Art. 16 GDPR),
• Right to erasure (Art. 17 GDPR),
• Right to restriction of processing (Art. 18 GDPR),
• Right to data portability (Art. 20 GDPR),
• Right to object to processing (Art. 21 GDPR).

To exercise your rights, simply send a message to the contact details given above.

15. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

16. Data Security

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the “https://” in your browser’s address bar. This ensures that the data you transmit to us cannot be read by third parties.

17. Access Logs to Prevent Misuse

In addition to the server log files created by our hosting provider (see item 4), we log – in order to prevent automated fraudulent orders and other misuse – access to our homepage and order pages as well as to the home pages of the verification portals we operate (see item 9). In doing so, we process: IP address; date and time of access; the page accessed (domain and path) and the selected language; the address of the previously visited page (referrer), if transmitted; as well as the browser/device identifier (user agent).

In the case of an order, we additionally store the IP address, browser identifier and referrer together with the order, in order to detect and prevent fraudulent or automated orders.

The IP address, browser identifier and referrer stored together with an order are automatically deleted no later than 30 days after the order. The order itself remains unaffected.

The purpose is the detection and prevention of spam, fraud and misuse attempts, as well as the secure and trouble-free operation of the service. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in IT security and the prevention of misuse). No cookies are set for this purpose.

Access logs are automatically deleted after 30 days at the latest; order-related data after the periods stated in item 13. Data is not passed on to third parties; processing takes place exclusively on our server at STRATO (data processing agreement, see item 3). Your access data is not evaluated for advertising or analytics purposes and is not merged into user profiles.

Our language pages at globalback.com and the home pages of the verification portals listed in item 9 transmit this technical access data to our server at globalback.de; all of these domains are operated by the same controller (see item 1), so no disclosure to third parties is involved. You may object to this processing at any time, on grounds relating to your particular situation, in accordance with Art. 21 GDPR.

18. Reseller Area (Partner Accounts)

If you register as a reseller (sales partner), we process the master data you provide, in particular name, company name, address, email address and telephone number, as well as your consent to our terms and conditions and to this privacy policy. You log in to your partner account – as with customer accounts – by means of an email-based login procedure (magic link); access tokens are stored exclusively as hash values. The legal basis is Art. 6(1)(b) GDPR.

If you order GLOBALBACK IDs for your own end customers, we additionally process the email address of the respective end customer that you provide, in order to send them the GLOBALBACK ID purchased and the associated login information. You as the reseller are responsible for ensuring that you are permitted to transmit these data to us.

Invoices issued to resellers are created and stored permanently; the statutory retention obligations and the periods set out in item 13 apply. The legal basis for this is Art. 6(1)(c) GDPR.

This privacy policy will be updated in the event of changes to our processing activities or the legal situation.