Privacy notice
1. Controller
Markus Jaworek, 24/7 Automaten Harz, Radaustraße 8, 38667 Bad Harzburg; service@24-7-automaten-harz.de.
2. Website and hosting
Technical request data is processed to securely deliver the site, prevent misuse and diagnose faults. Storage is limited to what is necessary.
3. Customer account
Account identifiers, verified email or phone status, sessions and linked provider subjects are processed for registration, sign-in and account security. OAuth tokens are encrypted and implicit cross-account linking is disabled.
4. Age verification
After a specialist provider verifies identity and adult status, the account retains only provider, method, 18+ result, verification time, policy version and a pseudonymous name binding. No ID image or ID number is stored by the shop. The proof can be reused after secure sign-in until revoked, expired or superseded by a new policy.
5. OneGuard age verification
OneGuard is technically connected. Public checks are displayed only after written provider/privacy approval and an end-to-end test are documented; no identity data is sent outside that approved flow. Starting a check sends an internal reference, name, email address, saved German delivery address, language and return data to OneGuard. The date of birth entered in the shop is used only for a server-side adult pre-check and is not included in this start request; OneGuard reads it from the ID in its hosted flow. OneGuard collects ID images and, where required, a live photo for document, face-match and liveness checks. Its published privacy notice lists OpenAI, Supabase, Render, Netlify, Hetzner and Mailgun and possible US access or transfers. OneGuard states a regular image-retention period of up to 30 days, with longer retention in specifically justified or separately consented cases. The shop permanently stores no ID image, selfie, ID number or biometric raw data; it retains only the signed 18+ result and minimal proof data. Details: oneguard.app/de/privacy.
6. Orders and payments
Cart, order, delivery, a short-lived checkout proof, payment references and supplier status are processed to perform or prepare the contract. For card payments, Stripe receives the order amount, currency, reference, name, email, billing and delivery address, and technical connection data. Card and wallet credentials are processed only in Stripe-hosted Checkout and are not stored by the shop. Stripe provides the receipt and paid PDF invoice after successful payment. If PayPal is selected, the shop sends PayPal the order amount, currency and reference; PayPal processes the payer account and payment on its own pages and may offer eligible customers Pay Later or instalments. The supplier requires the recipient date of birth in its dropship order record.
7. Service email and AI assistance
Service messages may be classified by an AI assistant under fixed policies. Sensitive and financial cases are forwarded for manual review. The configured forwarding destination remains the operator address.
8. Newsletter
Newsletter delivery uses double opt-in. Consent evidence and unsubscribe status are stored until no longer required.
9. Google Maps and external providers
Google Maps loads only after consent. Google, Facebook, Apple and WhatsApp sign-in are displayed only after real configuration and callback or delivery testing.
10. Storage
Retention depends on statutory obligations, contract processing, security and consent. Data is deleted or anonymised when the purpose and legal duties end.
11. Rights
You may request access, correction, deletion, restriction, portability and object to processing. You may complain to a supervisory authority.
12. Contact
Privacy enquiries can be sent to service@24-7-automaten-harz.de.
Last updated: 4 August 2026