Privacy Policy

3.1 Registration for the Karla Portal

To use the Karla Portal (the administration interface for retailers), you must create a user account. When registering, we process the following information ("account data"): first name, last name, email address.

Karla uses a so-called passwordless sign-in process: you receive an email with a sign-in link, and by following the link you confirm that you are the owner of the email address. Alternatively, you can sign in with an existing Google or Microsoft account; in that case we receive your name and email address from the respective provider.

The legal basis for this data processing is the necessity for the fulfillment of the contract, as it serves the effective provision and management of your user account and is necessary to provide you with our services.

3.2 Account management

To manage your Karla Portal account, we process the following personal data: first name, last name, email address. The legal basis for this data processing is the fulfillment of our contract with you. Processing is necessary to provide you with our services and features on Karla.

By accessing your account settings, you can view and edit your account information. You can request the deletion of your user account at any time via the contact option in section 2; we will then delete your account data, unless statutory retention obligations require otherwise.

3.3 Shipment tracking pages

When you open a Karla Tracking Page for an order you placed with a participating retailer (for example via a link in a shipping confirmation), we display the delivery status of your order. For this purpose we process the order and shipment data transferred to us by your retailer (see 3.4), such as your order number, the ordered items, your delivery address, tracking numbers and the delivery events reported by the carrier. If you report a delivery issue through a tracking page (e.g. a damaged or missing parcel), we additionally process the information you provide, such as descriptions and photos, to process the claim together with your retailer. This processing takes place on behalf of your retailer for the fulfillment of the contract between you and your retailer.

3.4 Transferring and processing of order data by online shops

When you place an order with an online shop that has partnered with Karla, your retailer transfers the order data required for shipment tracking to Karla: the ordered items, your contact details, your delivery address and the tracking data of your shipments. This data is used to provide you with shop-specific shipment tracking, delivery notifications and, where offered, return and claim services. This processing takes place on behalf of your retailer; the legal basis is the fulfillment of the contract between you and your retailer.

3.5 Product presentations/advertising

Through the Karla Tracking Pages, your retailer may present you with offers, discount codes, and product campaigns. Which campaigns are displayed is determined by your retailer, for example based on the order the tracking page belongs to. We do not create interest profiles about you for this purpose. For the purpose of conducting these marketing campaigns, we process personal data in accordance with Art. 6 para. 1 lit. f GDPR. Our legitimate interest is direct marketing.

3.6 Email notifications

We also process the personal data and contact data provided by you during registration to inform you about our other products and services. That is, we process your name, email address, and other information to send you information related to your registration and use of Karla.

The legal basis for this data processing is our legitimate interest in advertising related products and services.

You can object to the processing of your personal data for direct marketing purposes at any time. We will then refrain from any further processing for these purposes. You can submit your objection to us via the contact option mentioned under section 2 above.

3.7 Customer service

We offer you several support options within the scope of using Karla. You can reach us by email, as well as via the contact form.

The legal basis for this data processing is the necessity of using your personal data to fulfill our contract with you, as well as our legitimate interest in answering your inquiry.

When you contact us, such as via email, your personal data is stored and processed by us. This usually involves your name and email address, as well as any additional information you have provided to us. This personal data is stored and used solely to respond to your request or to contact you and for associated technical administration and is not disclosed to third parties without your consent (exception: to the extent necessary for providing support).

3.8 Web server data

If you only visit our Karla website for informational purposes without providing personal data through registration or in any other way, only the internet connection data that your browser transmits to our server is processed. This information only contains personal data to a limited extent. The data processed includes information on:

• Type and version of the browser used;
• the operating system used by the accessing system;
• the page from which the system accesses Karla (referrer);
• the subpages accessed on our website by an accessing system;
• the date and time of your requests;
• your IP address;
• the internet service provider of the accessing system;
• and other similar data and information that serve to prevent risks in the event of attacks on our IT systems.

The legal basis for this data processing is the performance of pre-contractual measures, as well as our legitimate interest, as we require the automatically collected data to provide our Karla website.

3.9 Usage Information

In addition, we collect and store the information generated by the following functionalities of Karla through your use:

• when you track shipments;
• all the information you provide through Karla;
• when you make changes to your shipment or delivery (e.g. address change or delivery preferences);
• when you report a delivery issue or request a return through a Karla Tracking Page.

The legal basis for this data processing is the fulfillment of the contract, as the processing is necessary for providing our services to you.

Furthermore, we analyze the above data to improve our services. The legal basis for this is our legitimate interest in the development of our products and services.

6.1 Sub-processors engaged by Karla

The following providers process personal data on our behalf as part of operating the Karla platform:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — cloud infrastructure and hosting, data warehousing (BigQuery), message queuing, secret management, and AI-assisted features (e.g. classification of free-text survey answers, chatbot conversations); processing in the EU (europe-west1, Belgium);
• Cloudflare Germany GmbH, Rosental 7, 80331 München, Germany — content delivery network, image hosting, and bot protection at login;
• Amazon Web Services EMEA S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg — transactional email delivery (Amazon SES) for portal account emails and for shipment and claim notifications sent on behalf of retailers; processing in the EU (eu-central-1, Frankfurt);
• AfterShip, Inc. 2711 Centerville Road Wilmington, Delaware 19808, County of New Castle, United States — parcel tracking / matching of shipment data and creation of return labels; transfers safeguarded by EU Standard Contractual Clauses;
• Functional Software, Inc. (d/b/a Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA — application error tracking and performance monitoring; may process personal data contained in error logs. Data processed and stored in the EU (Germany);
• Slack Technologies Limited, 4th Floor, One Park Place, Hatch Street Upper, Dublin 2, Ireland — shared communication channels for merchant support; may process end-customer personal data referenced in support conversations.

6.2 Parcel carriers

To display the delivery status of your shipment, we query the carrier delivering your order (e.g. DHL / Deutsche Post, DPD, GLS, Hermes, UPS) using the tracking number and the destination postal code and country. Carriers process your delivery data under their own responsibility as part of the shipping contract with your retailer. If you request a return label through Karla, we transmit the data required for creating the label (name, address, email address) to the carrier or label provider handling the return.

6.3 Integrations activated by your retailer

Your retailer may connect its own accounts with third-party marketing, messaging or customer-service platforms to Karla. In that case we transmit shipment and claim events (such as your email address, name, order and tracking information) to the platform chosen by your retailer, on your retailer's instruction. These providers act for your retailer, who remains responsible for its own contract with them. Data is only shared with a provider below if your retailer has activated that integration:

• Klaviyo, Inc., 125 Summer Street, 6th Floor, Boston, MA 02110, USA — email and SMS marketing automation for shipment and claims event campaigns; data processed in the USA, with transfers safeguarded by Klaviyo's EU-U.S. Data Privacy Framework certification and EU Standard Contractual Clauses;
• Braze, Inc., 330 West 34th Street, Floor 18, New York, NY 10001, USA — customer engagement platform for shipment and claims event campaigns; EU or US endpoint depending on the retailer's Braze instance, with US transfers under EU Standard Contractual Clauses / Data Privacy Framework;
• Brevo SAS, 17 rue Salneuve, 75017 Paris, France — marketing automation for shipment notification campaigns;
• Emarsys eMarketing Systems GmbH, Lassallestraße 7b, 1020 Vienna, Austria — marketing automation and customer engagement for shipment and claims event campaigns;
• Inxmail GmbH, Wentzingerstr. 17, 79106 Freiburg, Germany — email marketing automation for shipment notification campaigns;
• HubSpot Ireland Limited, HubSpot House, 1 Sir John Rogerson's Quay, Dublin, D02 CR67, Ireland — shipment event campaigns in your retailer's HubSpot account;
• Gorgias, Inc., San Francisco, CA, USA; Zendesk International Ltd, 55 Charlemont Place, Dublin 2, Ireland; Dixa ApS, Copenhagen, Denmark; FrontApp, Inc., San Francisco, CA, USA; Intercom R&D Unlimited Company, Dublin, Ireland — customer-service platforms receiving delivery-issue reports (claims) incl. your contact details and attachments, where your retailer uses the respective helpdesk; US transfers safeguarded by EU Standard Contractual Clauses;
• Shopify Inc., 151 O'Connor Street, Ground floor, Ottawa, ON, K2P 2L8 Canada — your retailer's shop system; order, customer and fulfillment data is exchanged where your retailer runs its shop on Shopify (Canada is subject to an EU adequacy decision).

6.4 Business operations tools

For our own business operations (website, sales, marketing and internal processes) we use the following providers:

• Zero Technologies Oy, PL 1188, 00101 Helsinki, Finland — customer relationship management (CRM);
• Dealcode GmbH, Am Sandtorkai 27, 20457 Hamburg, Germany — website and documentation usage analytics (tracking script hosted at slsnlytcs.com); see also Dealcode's privacy policy;
• TYPEFORM US LLC, Spaces 95, 3rd St. 2nd Floor - San Francisco, CA 94103 United States for customer surveys;
• Notion Labs, Inc. 2300 Harrison St, San Francisco, CA 94110, for product and process documentation;
• Figma, Inc. 760 Market Street Floor 10 San Francisco, California 94102 United States for design files, product designs/ customer feedback.