Privacy Policy (Marketplace)
This policy supplements our general Privacy Policy. It describes what happens to your personal data when you create a customer account, buy a Subscription, and install our TYPO3 extensions through our Composer repository. Everything that concerns visiting b13.com in general—server logs, cookies and the cookie banner, Cloudflare, analytics, VG Wort, contacting us—is described in the general Privacy Policy, together with your rights and the contact details of our Data Protection Officer.
1. Controller
b13 GmbH, Hauptstätter Str. 59, 70178 Stuttgart, Germany
Phone: +49 (0) 711 460 589 70 · Email: [email protected]
Data Protection Officer: [email protected] (contact details in the general Privacy Policy).
2. Customer Account
What we store: your name and email address, a password (stored as a hash, never in plain text), and—if you provide them—company, address, a technical contact email address and your preferred language. For purchases, we also store the customer number Paddle assigns to you.
If you buy without having an account, we create one from the details of your purchase and send you a link to set a password.
Purpose and legal basis: to give you access to your Subscriptions, credentials and downloads, and to manage your projects (Art. 6(1)(b) GDPR).
Retention: as long as your account exists. You can ask us to delete your account at any time at [email protected]. Data that we must keep for tax or commercial law reasons is then restricted and deleted when the retention period ends.
3. Purchases Through Paddle
Purchases in our shop are processed by Paddle, our reseller and Merchant of Record: Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom (for customers in the United States Paddle.com Inc., for customers in Canada Paddle.com (Canada) Ltd.). Paddle is the seller and processes your payment and billing data as an independent controller under its own Privacy Policy. Payment card data never reaches us.
What we send to Paddle: if you are signed in, your email address, postal code and country to prefill the checkout, and the name and domain of the project the purchase is for, so the purchase can be assigned. For purchases on invoice, the details from the invoice form (name, email, company, billing address, VAT ID and purchase order number, if provided).
What we receive from Paddle: your customer number, the subscription and transaction numbers, status changes (paid, renewed, canceled, refunded), and links to your invoices. Paddle sends these as notifications to our server. We log the notifications, including the billing details they contain, for up to 90 days to be able to trace errors, then delete them.
Paddle’s checkout on our pages: product pages with a buy button load Paddle’s checkout script from Paddle’s servers (cdn.paddle.com). Paddle receives the technical data of that request, such as your IP address.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract); for the logs Art. 6(1)(f) GDPR (our legitimate interest in processing payments reliably).
4. Projects, Licenses and Delivery
What we store: your projects (name, domain, an API key per project), your Subscriptions with their status and term, and a history of status changes.
Composer repository and downloads: when you install or update a Product, our server checks your email address and the project’s API key and records which project fetched which version of which Product and how (Composer or download). We do not record IP addresses for this. We aggregate these records into daily figures and then delete the individual entries.
Purpose and legal basis: to deliver the Products and updates you are entitled to, and to understand which versions are in use so we can plan support and updates (Art. 6(1)(b) and (f) GDPR).
Retention: projects and Subscriptions as long as your account exists, plus the statutory retention periods for contract and billing records.
5. Emails
We send you the emails needed for your Subscription: welcome email with credentials, password links, notices about payments, expiry and renewals, and notices to the technical contact you may have named. The legal basis is Art. 6(1)(b) GDPR. We do not send marketing emails to customers without your consent.
6. Internal Notifications
When a Subscription is bought, renewed or becomes overdue, our team receives a short internal notification, which may also be posted in our team chat (Slack, provided by Slack Technologies; data may be processed in the United States under the EU–US Data Privacy Framework). It contains the price, the project domain and whether you are a new or existing customer—not your name or email address. The legal basis is Art. 6(1)(f) GDPR (our interest in handling orders promptly).
7. Error Monitoring
To find and fix errors, our servers report technical errors to an error monitoring service operated by b13 (Sentry). If you are signed in when an error occurs, the report contains your internal user number. The legal basis is Art. 6(1)(f) GDPR (our interest in a working service).
8. Withdrawal
If you declare a withdrawal to us—by email, by post or with a withdrawal function on our website—we process the details you give us (name, email address, identification of the contract) to process your withdrawal and to confirm its receipt (Art. 6(1)(c) GDPR). We keep them as long as needed to document the withdrawal and for the statutory retention periods.
9. Your Rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a supervisory authority. Details are in the general Privacy Policy. To exercise your rights, email [email protected].
Last updated: October 2026