Privacy
Policy

Effective Date: 1 January 2025 · Last Updated: March 2025

1. Data Controller

YS Global Trade Partners
Trauns Allee 15, 22043 Hamburg, Germany
Email: info@ystra.de
Phone: +49 159 0145 6329
VAT: DE453760205

2. What Data We Collect

Data Type	What We Collect	Why
Account Data	Name, email address, password (encrypted)	Account creation and authentication
Profile Data	Company name, phone, address, product categories, certifications, market information	Platform matching and introductions
Usage Data	Pages visited, actions taken, timestamps	Platform improvement and security
Communication Data	Messages sent through platform, email correspondence	Service delivery and support
Agreement Data	IP address at time of signing, timestamp	Legal record of commission agreement
Payment Data	Invoice records (payment processing via Stripe — card data never stored by us)	Commission collection

3. Legal Basis for Processing (GDPR Article 6)

• Contract performance (Art. 6(1)(b)): Processing necessary to deliver platform services, matching, and introductions
• Legal obligation (Art. 6(1)(c)): Tax records, invoicing, and compliance requirements under German law
• Legitimate interests (Art. 6(1)(f)): Platform security, fraud prevention, and service improvement
• Consent (Art. 6(1)(a)): Marketing communications (you may withdraw at any time)

4. How We Use Your Data

• Creating and managing your platform account
• Matching you with relevant Brands or Distributors
• Sending platform notifications, match alerts, and agreement emails
• Generating commission agreements and invoices
• Sending WhatsApp notifications if you have provided a phone number (opt-out available)
• Improving platform functionality and security
• Complying with German and EU legal obligations

5. Data Sharing

We do not sell your personal data. We share data only as follows:

• Matched parties: Your contact details are shared with your matched Brand or Distributor only after both parties have signed the Commission Agreement
• Supabase (database): Platform infrastructure and authentication — data hosted in EU region
• Stripe (payments): Payment processing — subject to Stripe's own privacy policy
• Twilio (notifications): WhatsApp message delivery if phone number provided
• Legal authorities: Only where required by German or EU law

6. Data Retention

Data Type	Retention Period
Active account data	Duration of account + 3 years
Commission agreements	10 years (German commercial law requirement)
Invoice and payment records	10 years (§ 147 AO German Tax Code)
Communication logs	3 years
Deleted account data	Anonymised within 30 days of deletion request

7. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15): Request a copy of all data we hold about you
• Right to rectification (Art. 16): Correct inaccurate or incomplete data
• Right to erasure (Art. 17): Request deletion of your data (subject to legal retention obligations)
• Right to restriction (Art. 18): Restrict processing in certain circumstances
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw consent for marketing at any time

To exercise any of these rights, contact us at: info@ystra.de

You also have the right to lodge a complaint with the Hamburg data protection authority: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (www.datenschutz.hamburg.de)

8. Cookies

We use essential cookies only — required for authentication and platform functionality. We do not use advertising or tracking cookies. You can manage cookie preferences in your browser settings.

9. Data Security

We implement appropriate technical and organisational security measures including:

• Encrypted data storage via Supabase (AES-256)
• HTTPS encryption for all data in transit
• Row-level security — users can only access their own data
• Passwords hashed and never stored in plain text
• Access controls limiting staff access to personal data

10. International Transfers

Your data is primarily processed within the EU. Where data is processed outside the EU (e.g. Twilio for WhatsApp delivery), we ensure adequate safeguards are in place through Standard Contractual Clauses (SCCs) or equivalent mechanisms.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated by email. The current version is always available at ystra.de/privacy.html.

12. Contact & DPO

For all privacy-related enquiries:
YS Global Trade Partners
Trauns Allee 15, 22043 Hamburg, Germany
Email: info@ystra.de
Phone: +49 159 0145 6329