Privacy Policy
The German version is legally binding. This translation is for convenience.
1. Controller
acerasoft LLC
US Limited Liability Company (State of Delaware)
8 The Green, Suite B
Dover, Delaware 19901
USA
Represented by: Management
E-mail: support@vestrasales.com
Website: https://www.sarvesto.com
Registering authority: Delaware Division of Corporations
US tax ID (Employer Identification Number): 61-2070643
No data protection officer has been appointed, as the statutory requirements (Art. 37 GDPR, § 38 BDSG) are not met. For data protection enquiries please contact support@vestrasales.com.
2. What we do not do
We use no web analytics tool (no Google Analytics, no Matomo), no advertising or tracking pixels, no social media plugins and no profiling. There is no automated decision-making within the meaning of Art. 22 GDPR. Pricing in the Premium Outlet is not personalised either: prices follow a fixed, published schedule and are identical for all visitors.
All fonts, stylesheets, scripts and images are loaded from our own server. In particular, no Google Fonts are used — so your IP address is not transmitted to any third party when a page loads.
3. Visiting the website (server log files)
When you visit, our hosting provider processes technically necessary data: IP address, date and time, resource requested, referrer, user agent and the amount of data transferred. This data is required to deliver the page and to defend against attacks.
- Purpose: provision, stability, IT security
- Legal basis: Art. 6 (1) (f) GDPR (legitimate interest)
- Retention: usually 7–30 days, then automatic deletion
4. Cookies and local storage
We use only technically necessary cookies. Under § 25 (2) no. 2 TDDDG no consent is required for these — which is why you see no cookie banner here.
| Name | Purpose | Duration |
|---|---|---|
vestra_retail |
session: bag, seller login, CSRF protection | end of session |
vr_lang | chosen language | 180 days |
vr_member |
Vault early access after confirmed newsletter sign-up (signed value, no plain-text e-mail) | 1 year |
vr_wish | wishlist — item identifiers only | 180 days |
vr_seen | recently viewed items — item identifiers only | 30 days |
Further details: Cookies.
5. Wishlist and recently viewed items
We store the wishlist and "recently viewed" exclusively in a cookie on your device.
The cookie contains only item identifiers (e.g. blm-ah0eg000) — no name, no e-mail
address, no identifier that could identify you. No profile and no link to your person is created
on our servers.
- Purpose: the function you expressly requested
- Legal basis: § 25 (2) no. 2 TDDDG (technically required for the service requested by the user); where personal, Art. 6 (1) (f) GDPR
- Retention: wishlist 180 days, recently viewed 30 days — or until you delete the cookies
6. Contact form
If you use the contact form, we process your e-mail address, optionally your name and order number, and the content of your message. A copy is stored on our server so that no enquiry is lost if e-mail delivery fails.
- Purpose: answering your enquiry
- Legal basis: Art. 6 (1) (b) GDPR where related to an order, otherwise Art. 6 (1) (f) GDPR
- Retention: until the matter is closed, then no longer than six months; for order-related enquiries the commercial retention periods apply
To prevent spam we use an invisible form field and a timing check. No external captcha service is embedded — so no data is transferred to third parties.
7. Price alert in the Vault
If you set a price alert for a lot, we store your e-mail address, the lot, your target price, the time and a salted hash of your IP address as evidence.
- Purpose: the one notification you requested
- Legal basis: Art. 6 (1) (a) GDPR (consent)
- Retention: until the notification is sent, at most 90 days. The record is then deleted completely.
Exactly one e-mail is sent; the alert is then used up. No reminders or advertising follow. Every alert can be deleted immediately via the link in the e-mail.
8. Orders and contract processing
For an order we process: name, delivery and billing address, e-mail address, items ordered, prices, payment status, order number and evidence of your consent to the Terms and the withdrawal notice (time, version and a salted hash of your IP address — the IP itself is not stored).
- Purpose: performance of the contract, shipping, invoicing, reversal
- Legal basis: Art. 6 (1) (b) GDPR; for retention Art. 6 (1) (c) GDPR
- Retention: order and invoice data are subject to commercial and tax retention periods (§ 147 AO, § 257 HGB) and are kept accordingly, then deleted.
Disclosure to sellers: for items from third-party sellers we transmit to the respective seller the data required for shipping and invoicing (name, delivery address, items ordered, order number). The seller is an independent controller for this data. Payment data and details of items from other sellers are not transmitted.
9. Payment processing (Stripe)
Payments are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. You enter your payment details directly with Stripe; from Stripe we receive only status information (paid/open/failed), amount, payment method in general form, name, e-mail address and delivery address.
- Legal basis: Art. 6 (1) (b) GDPR (performance of the contract)
- Third-country transfer: Stripe may transfer data to Stripe, Inc. in the USA. This is based on the EU Commission's standard contractual clauses and certification under the EU-US Data Privacy Framework.
For payouts to sellers we use Stripe Connect. Sellers conclude their own agreement with Stripe for
this; the identity evidence collected there (KYC/anti-money-laundering) is processed by Stripe as
an independent controller. We receive only the status flags charges_enabled,
payouts_enabled and details_submitted.
Stripe's privacy notice: stripe.com/privacy
10. E-mail delivery
Transactional e-mails (order confirmation, shipping notice, seller notification) and newsletters are sent via Brevo (Sendinblue GmbH / Brevo SAS, Paris, France). E-mail address, name and the content of the message are transmitted.
- Legal basis: transactional e-mails Art. 6 (1) (b) GDPR; newsletter Art. 6 (1) (a) GDPR (consent)
- Processing on our behalf: a contract under Art. 28 GDPR is in place.
11. Newsletter / Vault membership
Sign-up uses double opt-in: after entering your address you receive a confirmation e-mail; the sign-up only takes effect when you click the link. As evidence we store the time of sign-up, the time of confirmation and a salted hash of the IP address.
Unconfirmed sign-ups are deleted automatically after 7 days. You can withdraw your consent at any time — via the unsubscribe link in every e-mail or by writing to us. Withdrawal does not affect the lawfulness of processing carried out before it.
12. Seller accounts
For a seller account we process: name, company name if applicable, e-mail address, country, VAT ID if applicable, seller type (commercial/private), password (only as a cryptographic hash, never in plain text), listings and sales and payout data.
- Legal basis: Art. 6 (1) (b) GDPR; for reviewing listings and the traceability of trader information additionally Art. 6 (1) (c) GDPR in conjunction with Art. 30 Digital Services Act.
- Publication: for commercial sellers we show name/company and country on the product page; this is required by law. For private sellers only the status "Private seller" is shown, not the full name.
13. Security measures and logs
We keep technical logs of failed login attempts, payment errors and webhook events. They contain time, event type and technical identifiers; e-mail addresses are truncated. The purpose is the prevention of abuse and fraud (Art. 6 (1) (f) GDPR); retention at most 90 days.
Transmission is encrypted (TLS). Passwords are stored using a modern one-way hashing method.
14. Your rights
You have the right at any time to:
- access to the data stored about you (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure (Art. 17 GDPR), unless a retention obligation stands in the way
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- object to processing based on legitimate interests (Art. 21 GDPR)
- withdraw consent given, with effect for the future (Art. 7 (3) GDPR)
A message to support@vestrasales.com is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority, for instance the authority of your habitual residence.
15. Changes
We update this policy when the actual processing changes — for example when a new service provider is used. The version published on this page applies.