Data privacy statement

Privacy Policy of frutra GbR

01.10.2026

1. Controller and Data Protection Contact

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

frutra GbR
Partners: Wolfgang Baumann and Samuel Fürle
Lindenmattenstraße 25
79117 Freiburg im Breisgau
Germany
Telephone: +49 761 429626-49
Fax: +49 761 429626-50
Email: info@frutra.de

For data protection enquiries, contact us at datenschutz@frutra.de.

2. Scope and Principles

This Privacy Policy applies to the websites at frutra.de and frutra.com and the platform at trade.frutra.de and trade.frutra.com. It explains which personal data we process when you visit, register and use the platform.

We process personal data to the extent required to provide our websites and platform, perform the company-level Platform Use Agreement, communicate, provide security, bill fees and meet statutory obligations. If you have given the relevant consent, we also carry out the personalised open and click tracking described in Clause 8. In addition, we name approved companies for advertising purposes on the public home page of the platform, on the website frutra.com, in trade media and to associations (Clause 6.5). Acknowledging this Privacy Policy is not consent.

2.1 Legal Bases

Depending on the processing operation, we rely in particular on:

  • Article 6(1)(b) GDPR where the data subject is personally a party to the contract, for example as a sole trader, or pre-contractual steps are taken at that person's request;
  • Article 6(1)(f) GDPR, in particular for performing the Platform Use Agreement with the represented company, business communications, operating and securing the platform, preventing misuse, preserving evidence and establishing, exercising or defending legal claims;
  • Article 6(1)(c) GDPR for obligations under commercial, tax and regulatory law;
  • Article 6(1)(a) GDPR where we request consent for a specifically identified purpose.

Our legitimate interests under Article 6(1)(f) GDPR include reliably performing the Platform Use Agreement with the registered company, documenting contacts and authority to represent it, processing legally relevant declarations with evidence, securing the platform and resolving justified claims.

2.2 Recipients and International Transfers

Within frutra GbR, access is limited to persons who need it for their responsibilities. Data is also disclosed to other user accounts in accordance with Clause 6 where this is required for the Marketplace, negotiation or contract conclusion and is apparent from the platform. Certain information is visible to anyone on the public home page of the platform and on the member page of the website frutra.com and may be named in trade media and to associations (Clause 6.5). We further use the providers described in this Policy for hosting, email delivery, mailboxes, maps and geocoding, monitoring and accounting. To verify VAT identification numbers, we transmit information to the European Commission and, if VIES cannot be reached, to the competent authority (Clause 5.2). The bank used by frutra GbR and bodies engaged for bookkeeping, annual accounts, tax advice or audits receive data where this is required for billing and payments under Clause 7. Otherwise, public authorities, courts, legal advisers or other bodies receive data only where required by law or necessary for the establishment, exercise or defence of legal claims.

Where a provider processes data outside the European Economic Area, we rely on a European Commission adequacy decision or appropriate safeguards under Article 46 GDPR, in particular Standard Contractual Clauses, where required together with supplementary measures. Details may be requested from datenschutz@frutra.de.

2.3 No Solely Automated Decisions

We do not make decisions producing legal or similarly significant effects based solely on automated processing within the meaning of Article 22 GDPR and do not carry out profiling for that purpose. The platform automatically applies contractually agreed conditions and dates, for example the conditions for using the trading functions under Clause 6.1 of the GTC and the dates on which a price plan begins or the Base Fee changes. Decisions on restrictions due to unpaid fees, on the termination of a price plan by frutra GbR and on measures against Members, user accounts or content are taken by the partners after reviewing the individual case.

3. Accessing the Websites and Platform

3.1 Server and Security Logs

When you access our services, we process technically required connection data, in particular IP address, date and time, requested address, volume transferred, referrer, browser and operating-system information, response status and technical error and security information. The platform's application log may also contain email addresses, names or postal addresses in messages about emails sent, account changes or errors. This is necessary to deliver content, detect attacks and disruptions, maintain security and correct errors. The legal basis is Article 6(1)(f) GDPR.

Technical logs are kept only for as long as required for operation, troubleshooting and security and are then erased or anonymised. We erase the platform's application log within 30 days. According to Upsun, the platform's log files are continuously truncated to a fixed size, and Upsun keeps its own system-level access and security logs for at least six months and at most two years. In a specific security or misuse incident, relevant extracts may be preserved until the incident is finally resolved and for as long as required for legal enforcement.

3.2 Hosting by Upsun

The platform, including the application and databases, is operated using the Upsun hosting service of the Platform.sh group. The contracting party is Platform.sh GmbH, Koblenzer Straße 11, 50968 Cologne, Germany, which under the Upsun terms of service is responsible for customers with a billing address in Germany. It processes data on our behalf under Article 28 GDPR. Data stored on the platform and technical connection, operational, backup and log data are processed. Project data and backups are stored in the selected hosting region. Upsun automatically creates a backup of the platform every day. Before technical changes, we also create manual backups. The retention periods for backups are set out in Clause 12.

3.3 Hosting of the Website and Mailboxes (United Domains)

The website at frutra.com, the redirects from frutra.de and our mailboxes under frutra.de, such as info@frutra.de and datenschutz@frutra.de, are operated by United Domains. United Domains processes on our behalf the connection data described in Clause 3.1 when the website is accessed and the emails addressed to or sent from these mailboxes. The legal basis depends on the respective processing. For accessing the website, it is Article 6(1)(f) GDPR. Our legitimate interest is to provide the website securely and without errors.

4. Cookies and Similar Technologies

We do not use analytics, advertising or marketing cookies on our websites or platform. On the platform we use only one technically necessary cookie, the login cookie. It links your browser to your session on the server, which keeps you logged in and through which we protect forms against cross-site request forgery. We determine the language from the page address and the setting in the user account, not from a cookie.

Storing the login cookie is permitted without consent under § 25(2) no. 2 TDDDG because it is strictly necessary to provide the access to the platform that you have expressly requested. Subsequent personal-data processing is based on Article 6(1)(b) GDPR where the data subject is personally a party to the contract and otherwise on Article 6(1)(f) GDPR. The login cookie remains stored in your browser for up to around twelve days unless you log out earlier. The session on the server contains your user ID, IP address and the time of your last access. It ends when you log out. The server erases sessions that have not been used for around 55 hours at its next regular clean-up. After that, you must log in again. Consent management for non-essential technologies is unnecessary for as long as such technologies are not used.

5. Registration, Companies and User Accounts

5.1 Data Categories and Purposes

During registration and account management, we process in particular:

  • the user's name, business email address, telephone number, position and language;
  • company name, legal form, address, country, register and tax information, VAT identification number, company type (Producer or Trader), names of the authorised representatives and logo;
  • user ID, password hash, roles, permissions, login and security data;
  • information on entrepreneur status, the approval of the company, its classification as a Producer or Trader and as an existing Trader, including the sources used for that classification, and authority to represent the company;
  • consents to the GTC and the Schedule of Fees, the Business-Only Use Confirmation and the acknowledgement of this Privacy Policy, each per user account, including document, version, checksum, language and time and, where a company is assigned to the user account at that time, that company;
  • the acceptance of the price plan per company, including the accepted price plan (for existing Traders with both phases), the version and checksum of the GTC and the Schedule of Fees, language, time, accepting user account, name of the accepting person and their confirmation of authority;
  • for requests to join an existing company, the requesting person's name, email address, telephone number, position and message and the decision on the request.

For consents, confirmations and acknowledgements given before this recording was introduced, only the user account, version and time are stored.

Members may voluntarily upload a photo. It is shown only to other signed-in members and can be removed in the profile at any time.

We need this data to verify companies and contacts, provide accounts, control permissions, perform the Platform Use Agreement and prove incorporation of the contractual documents. For joining, any logged-in user account can search approved companies by name, town, postcode or country and is shown the company's name, postcode and town in the results, and for companies outside Germany also the country. We forward requests to join to the owner account of the company, which decides on the request. The acknowledgement sent to the requesting person and the notice of the decision may state the name of the person to whom the owner account belongs. Consent to the GTC and the Schedule of Fees is a contractual declaration and not consent within the meaning of the GDPR. The Privacy Policy tick box is recorded as acknowledgement, not consent. The legal basis is Article 6(1)(b) GDPR where the data subject is personally a party to the contract and otherwise Article 6(1)(f) GDPR. Our legitimate interest is performing the Platform Use Agreement with the company on whose behalf the person acts and proving the declarations made.

We generally obtain this information from the data subject. Some information comes from other persons at the same company, for example the names of the authorised representatives entered by the registering person. The company's name and address may come from the VIES system (Clause 5.2). For the classification as a Producer or Trader, we use publicly available sources such as the company's website.

5.2 Verification of VAT Identification Numbers

When creating a company, you can have the VAT identification number entered verified through the European Commission's EU VAT Information Exchange System (VIES). We transmit only the country code and the number. VIES reports whether the number is valid and, where the Member State provides them, the company's name and address. We insert these details as suggestions into empty fields of the form, where you can change them. We keep the result in a cache for up to seven days so that the same number is not queried repeatedly. If VIES cannot be reached, frutra GbR may verify the number in another way, for example with the competent authority. The legal basis is Article 6(1)(f) GDPR. Where frutra GbR is legally obliged under Clause 11 to record or verify this information, Article 6(1)(c) GDPR is an additional legal basis. Our legitimate interest is to verify the company's details reliably.

5.3 Mandatory Information and Blocking of User Accounts

Without information marked as required, we cannot verify the company or properly perform the Platform Use Agreement. Blocking a personal user account is distinct from erasure under data protection law and does not terminate the company's Platform Use Agreement (Clause 4.7 of the GTC). Erasure requests are reviewed separately under Article 17 GDPR.

5.4 Product Interests and Marketplace Alerts

In your profile you can switch on Marketplace alerts and select product interests. We store the setting and the selected products in your user account. While alerts are switched on and your user account is active, we notify you by email, including before your company has been approved, when another company publishes an Offer or Request for a selected product. The alert states the product and quantity, for Offers also the price and total value, and the publishing company. For Requests published without naming the company, it does not contain a company name. Alerts are a platform function requested by you and are not advertising. You can switch them off or change the product selection in your profile at any time. The legal basis is Article 6(1)(b) GDPR where the data subject is personally a party to the contract and otherwise Article 6(1)(f) GDPR. Our legitimate interest is providing the requested function.

6. Use of the Marketplace, Negotiations and Contract Conclusions

6.1 Offers and Requests

We process product, quantity, price, delivery, location and company information posted by Members, status and time data and technical identifiers in order to display and search Offers and Requests and make them accessible to registered users who are logged in. Read access is also available before the company has been approved. For Requests published without naming the company, we show the company and its location only to the user accounts of the company that published the Request, to the user accounts of companies that are negotiating on the Request or have concluded a purchase contract on it and, in the preview before the first offer is submitted, to the user accounts of companies that wish to submit an offer on the Request (Clause 11.2 of the GTC). Clause 5.4 applies to Marketplace alerts. The participants in a negotiation receive the information required for initiation and contract conclusion. The legal basis is Article 6(1)(b) GDPR where the data subject is personally a party to the contract and otherwise Article 6(1)(f) GDPR. Our legitimate interest is performing the Platform Use Agreement with the company on whose behalf the person acts.

6.2 Negotiations and Evidence Record

In negotiations we process participants, the contents and versions of offers and counteroffers, prices, quantities, terms, validity periods, status changes, declaration and receipt times and technical events. This serves to provide the platform function, reliably attribute legally relevant declarations, prevent misuse and preserve evidence. The legal basis is Article 6(1)(b) GDPR where the data subject is personally a party to the contract and otherwise Article 6(1)(f) GDPR. Our legitimate interests are performing the Platform Use Agreement and preserving evidence of legally relevant declarations.

6.3 Purchase Contracts and Documents

When a purchase contract is concluded, we create and store a record protected against subsequent alteration and the related documents. They contain in particular the parties and their company details, the accepted negotiation state, product, quantity, price, delivery terms, times and technical evidence. The parties have access to the documents required for performance and evidence. frutra GbR does not become a party to the purchase contract. The legal basis is Article 6(1)(b) GDPR where the data subject is personally a party to the contract and otherwise Article 6(1)(f) GDPR. Our legitimate interests are performing the Platform Use Agreement and preserving evidence of legally relevant declarations.

6.4 Communications

When Members communicate through the platform or we provide support, we process sender, recipient, time, subject, content, attachments and technical delivery information. The data is used for pre-contractual and contractual communications, support and, where necessary, investigation of misuse or legal infringements. Using the platform's feedback form, you can send us a subject, a description and a screenshot. We forward the feedback with your name, email address and company by email via Brevo to a mailbox of frutra GbR and store the screenshot in a non-public area of the platform. The legal basis is Article 6(1)(b) GDPR where the data subject is personally a party to the contract and otherwise Article 6(1)(f) GDPR. Our legitimate interest is communicating with Members and improving the platform.

6.5 Public Home Page and Reference Advertising

The home page of the platform can be accessed without logging in. It shows aggregated figures on the Marketplace and the most recently published Offers and Requests with product and quantity, without naming the company. It also shows on a map the name, logo and business address of approved companies. The position of the map marker is rounded to approximately 100 metres. The member page of the website frutra.com shows the companies’ names, logos and towns on a map and in an overview of logos linking to the companies’ websites. This naming is reference advertising under Clause 2.11 of the GTC. Under the same Clause, we may also name the membership in trade media and to associations. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to show interested parties which companies participate in the platform. The company may object to reference advertising at any time in text form, for example by email to info@frutra.de. We implement the objection within one week. Data subjects may also object under Clause 13. When the home page or the member page is opened, your browser requests map tiles from MapTiler (Clause 9).

7. Fees, Invoices and Payments

For billing and payment monitoring, we process company type and price plan, service periods, purchase contracts concluded through the platform and assessment bases, invoice and credit-note data, invoice recipient, bank details, payment status, incoming payments, objections and reminder status. Payment reconciliation and decisions on restrictions are manual.

The legal bases are Article 6(1)(b) GDPR where the data subject is personally a party to the contract, otherwise Article 6(1)(f) GDPR, and Article 6(1)(c) GDPR for invoicing and retention obligations. Recipients may include the bank used and bodies engaged for bookkeeping, annual accounts, tax advice, legal enforcement or audits where required. We create and book invoices outside the platform using accounting software. Where its provider operates the software for us as an online service, it processes the invoice data on our behalf.

8. Email Delivery and Brevo Contact Management

We use Brevo to send necessary registration, security, platform, negotiation, contract and service messages and the Marketplace alerts under Clause 5.4. Brevo processes the recipient's name and email address and the content of the message, for example information on Offers, negotiations and purchase contracts and links for logging in or resetting the password. We also use Brevo to deliver feedback from the feedback form and technical error messages to mailboxes of frutra GbR (Clauses 6.4 and 10).

When a user account is registered, we create a contact in our Brevo account. We transmit the business email address and internal user ID and, where available, the first and last name and the name of the associated company. Contacts are used for customer and delivery management. Changes to the user account are synchronised. When a user account is deleted, we assign the contact to the list of contacts who are not existing customers and remove it from the existing-customer list, if it is on that list. A contact not yet held by Brevo may be created in this process. The list change constitutes neither consent to advertising nor an independent basis for continued storage or sending advertising. Personal contact data is retained only where there is a continuing lawful purpose. We handle valid erasure requests and objections to direct marketing separately, including in relation to data held by Brevo. Where necessary to comply with an objection to direct marketing, we retain a suppression entry for the email address solely for that purpose. The legal basis for this entry is Article 6(1)(f) GDPR. Our legitimate interest is to ensure compliance with the objection. A temporary Brevo outage does not prevent platform registration.

Under the contractual terms available to us, the provider for customers established in Germany is Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany. The data processing agreement forms part of Brevo's contractual terms. Brevo uses subprocessors inside and outside the European Economic Area. The applicable safeguards for international transfers include adequacy decisions, the EU-US Data Privacy Framework or Standard Contractual Clauses.

If you have given separate consent, we use Brevo to record whether you open our newsletters and promotional emails and which links in them you click. The data processed includes, in particular, your email address, the links accessed, the times of the recorded events and technical connection data, including the IP address. Brevo tracking pixels and individual redirect links may be used to record these events. We associate this information with your contact record to better understand your interests and tailor our content and customer communications accordingly. The legal basis is Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, for example by emailing datenschutz@frutra.de. Use of the platform does not depend on this consent. Acknowledging this Privacy Policy and agreeing to the GTC or Schedule of Fees do not replace this consent. The principles in Clause 12 apply to retention.

When an email is displayed, your email program loads the frutra logo from a Brevo image server. The logo is delivered via Cloudflare, a subprocessor of Brevo. Brevo thereby receives the IP address, time and technical information about the email program. We use delivery, bounce, complaint and error events for operation, security and deliverability.

For necessary email delivery and the associated customer and delivery management, the legal bases are Article 6(1)(b) GDPR where the data subject is personally a party to the contract and otherwise Article 6(1)(f) GDPR. Our legitimate interests are necessary business communications and reliable message delivery. We send advertising emails only where a separate legal basis is available. Being created as a contact at Brevo is not consent to advertising. Personalised open and click tracking is subject to the consent described above.

9. Maps and Geodata (MapTiler)

We use MapTiler AG, Zugerstrasse 22, 6314 Unterägeri, Switzerland, for maps, geocoding and address suggestions. The map is loaded on the public home page of the platform, on the member page of the website frutra.com and on platform pages that display locations. When a map is loaded, your browser requests map tiles directly from MapTiler. MapTiler receives in particular the IP address, time, tile requested, browser data and parameters technically required for delivery.

Address entries for address suggestions and the addresses for which we determine coordinates are transmitted to MapTiler by our server. When we determine an address for a selected point on the map, we transmit its coordinates to MapTiler. The browser receives only the result standardised by frutra. We store the selected address and, where required for location, mapping or logistics functions, the coordinates derived from it. The legal basis is Article 6(1)(b) GDPR where the data subject is personally a party to the contract and otherwise Article 6(1)(f) GDPR. Our legitimate interest is to display locations on maps and to record addresses reliably.

The European Commission has adopted an adequacy decision for Switzerland. MapTiler may use subprocessors in the EEA and other countries. The DPA provides for adequacy decisions, Standard Contractual Clauses or other appropriate safeguards. A DPA including a supplementary Article 28 GDPR side letter has been incorporated with MapTiler.

10. Monitoring and Security (FoundersDeck)

We use FoundersDeck, Engin Yildirim, Jägerstraße 20, 78054 Villingen-Schwenningen, Germany, to monitor availability, response times and technical errors. Status, time, connection and error data is processed. Error messages may exceptionally contain personal information. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and uninterrupted operation of the platform. FoundersDeck processes data as a processor and uses Netcup GmbH in Germany as a hosting subprocessor.

For critical platform errors, for example during contract conclusion or when generating a contract document, we send an alert by email via Brevo to a mailbox of frutra GbR. It contains technical information on the error and identifiers of the affected operations, for example the number of a contract, a negotiation or a user account. A short alert containing one such identifier, without names or content, is also sent to a notification service we use for operational alerts. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and uninterrupted operation of the platform.

11. Statutory Recording and Reporting Obligations

Where frutra GbR is a reporting platform operator under the German Platform Tax Transparency Act (PStTG/DAC7), we collect, verify and report the legally required seller and activity data to the German Federal Central Tax Office. This may include company or personal name, address, tax and VAT identification numbers, register details, tax residence, date of birth for natural persons, payment account, consideration and number of relevant activities. The legal basis is Article 6(1)(c) GDPR in conjunction with the PStTG. In that case, providing this information is required by law. If it is not provided despite a request and two reminders, we suspend the Member from further use of the platform under § 23 PStTG and Clause 9.4 of the GTC.

Where §§ 22f and 25e of the German VAT Act apply, we record the required company and transaction information and disclose it when legally requested. Further disclosures are made where required under mandatory tax, commercial, criminal-procedure or other law.

12. Retention Periods

We erase personal data once it is no longer required for the relevant purpose and no retention obligation or overriding entitlement to continued storage applies. The following rules apply to the main platform data:

  • Drafts of offers and counteroffers are kept while being edited. A draft that is sent becomes part of the negotiation history. A draft that is discarded is erased. When the negotiation ends, a draft still stored remains with the negotiation history and follows its retention period.
  • Expired or deactivated Offers and Requests without a negotiation are removed from display in the Marketplace. Once 24 months have passed since their expiry or deactivation, they are erased in the next annual erasure run. Offers and Requests on which negotiations took place are erased in the next annual erasure run after the retention periods of all related negotiations and purchase contracts have expired.
  • Ended negotiations without a purchase contract are kept until 31 December of the third calendar year following the year in which they ended and then erased in the next annual erasure run.
  • Following a successful purchase contract, the complete record protected against subsequent alteration, the contract documents and the related negotiation are retained for ten years after the end of the calendar year in which the contract was concluded and then erased in a controlled procedure.
  • Invoices of frutra GbR and accounting records are retained for eight years, records under § 22f German VAT Act for ten years and PStTG records for ten years, in each case as provided by the applicable statutory period. PStTG records are then erased where § 24(3) PStTG so requires.
  • Evidence of consents, price plan acceptances, confirmations, acknowledgements and versions is kept for the duration of the Platform Use Agreement and subsequently for three years from the end of the calendar year in which the Platform Use Agreement ends (regular limitation period). In a specific dispute, it is kept until the dispute has been finally resolved. It is retained even if the user account that made the declaration is blocked and pseudonymised.
  • Business correspondence is generally kept for six years depending on its legal classification. Pure support enquiries with no continuing relevance are erased after resolution and no later than twelve months after receipt.
  • In response to a valid erasure request, we erase the personal data concerned unless a statutory retention obligation or another lawful basis for continued storage applies. Where the user account is needed to attribute evidence, negotiations or purchase contracts that must continue to be retained, we block the account and replace personal details that are no longer required with placeholders. The account identifier is retained for that attribution. The data that continues to be stored is subject to the retention periods in this list. Pseudonymisation does not replace any further erasure that is required.
  • Requests to join a company are erased six months after the decision on the request. Requests on which no decision has been made are erased six months after receipt.
  • Notifications in the platform are erased after twelve months and the delivery log of email notifications after 90 days.
  • Feedback submitted through the feedback form is erased together with any screenshot twelve months after receipt.
  • Upsun keeps automatic backups of the platform for two days. We erase manual backups that we create before technical changes no later than 30 days after their creation.

The annual erasure run takes place in the first quarter of each calendar year. All data whose retention period has expired by then is erased in the run.

Where a specific legal dispute, official order or other statutory retention obligation applies, erasure of the affected data is suspended until that ground ceases to apply. The data is then erased or anonymised.

13. Data-Subject Rights

Subject to the statutory requirements, you have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and the right to object to processing based on Article 6(1)(e) or (f) GDPR (Article 21). You may withdraw consent at any time with effect for the future (Article 7(3)).

Objection: Where processing is based on legitimate interests, you may object at any time on grounds relating to your particular situation. We will then cease processing unless we demonstrate compelling legitimate grounds or the processing is required for the establishment, exercise or defence of legal claims. You may object to direct marketing at any time without giving reasons.

Send your request to datenschutz@frutra.de or to the postal address in Clause 1. We may request additional information where necessary to verify your identity. The statutory response periods apply.

14. Right to Lodge a Complaint

You may lodge a complaint with a data protection supervisory authority, in particular at your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is:

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg
Heilbronner Straße 35
70191 Stuttgart
Postal address: Postfach 10 29 32, 70025 Stuttgart, Germany
Telephone: +49 711 615541-0
Email: poststelle@lfdi.bwl.de
www.baden-wuerttemberg.datenschutz.de

15. Amendments

We amend this Privacy Policy when the law, processing activities or services used change. The current version is available on our websites and platform. We inform persons with a registered user account of material changes in an appropriate manner, in particular by presenting the new version to them for acknowledgement the next time they use the platform. Previous versions remain archived for evidentiary purposes.