Tailored solutions for B2C companies
If you sell to consumers, you process a lot of personal data: orders, accounts, payments, newsletters. Questions from customers, supervisory authorities and the press often come without warning. Sightadel helps you evidence your GDPR obligations, meet deadlines and show openly in the Trust Center how you handle data.
Starting point
In consumer business, trust decides the purchase. Customers share their address, payment details and sometimes very personal information. They expect the company to handle it carefully, and they have rights they use more and more: access, erasure, objection to advertising.
Behind a shop or an app there is usually a whole range of service providers. Hosting, payment provider, shipping, newsletter, analytics, customer service. Each of them processes data on your behalf and needs a contract and an assessment. An incident at one of these providers is legally your incident too.
A data breach hits B2C companies especially hard. Besides notifying the supervisory authority, you may have to inform many customers, and the topic quickly reaches the media. If you have practised beforehand who decides what and how reports are made, you lose no time at that moment.
Why now
Access requests generally have a deadline of one month. Without a fixed process, every request turns into a search across several systems.
Reportable breaches go to the supervisory authority within 72 hours where possible. If the risk is high, the data subjects must be informed as well.
A new newsletter tool, a chat in customer service, an AI service. Each needs a data processing agreement and a check of where the data is stored.
After a complaint, the data protection authority requests documents, such as the record of processing activities or proof of consent.
Payment providers, marketplaces and large retail partners ask about security measures and certificates before working with you.
New markets bring more service providers, languages and sometimes data transfers to third countries. The documentation has to grow with them.
Relevant frameworks
Summarised in our own words, not legal advice. The original text in its current version is authoritative.
The most important framework in consumer business. It includes information under Art. 13 GDPR, a legal basis for each processing activity, contracts with processors, deadlines for data subject rights and reporting data breaches. For cookies and similar technologies, section 25 of the German TDDDG also applies.
View framework →Gives the technical and organisational measures under Art. 32 GDPR a tested structure. A certificate shows partners and customers that an independent body has reviewed the measures.
View framework →Online marketplaces are listed as digital providers in Annex 2 of the BSIG, as are postal and courier services, for example. From medium size, registration, risk management and reporting obligations then apply. A classic online shop is not a marketplace within the meaning of the law.
View framework →If you use AI in contact with customers, such as a chatbot, transparency obligations apply: people must be able to tell that they are talking to an AI system. The obligations depend on role and use.
View framework →Recommended order
Which data do you collect where, for what purpose and on which legal basis? The record of processing activities is the basis for everything else.
For every provider that processes customer data: a contract under Art. 28 GDPR, the location of the data, subcontractors and a risk assessment.
Who receives access and erasure requests, who decides on reporting to the supervisory authority? Deadlines and responsibilities are fixed before anything happens.
Access, encryption, backups and training get dated evidence. With ISO 27001 as the framework, this becomes an auditable system.
In the Trust Center, customers and partners see which measures you have taken and which service providers are involved. The privacy policy remains mandatory; the Trust Center adds to it.
Focus
Consumers rarely read policies. But they notice whether a company answers questions quickly and clearly.
Access and erasure requests are recorded with receipt, handling and response. Tasks with deadlines make sure nothing is left lying.
Who decides, who reports, who informs the customers? If the process is defined and practised beforehand, the first hours are spent on the matter itself.
All processors are listed with contract, location and risk. Missing contracts and expired evidence stand out.
The Trust Center shows measures, certificates and service providers on a dedicated page. Partners, the press and interested customers find answers there.
How Sightadel helps
The GDPR obligations are set out as guided questions, from the principles through data subject rights to the reporting obligation. Each question comes with an explanation, answer and evidence.
Learn more →Hosting, payment, shipping, newsletter and analytics are listed with country, contract, subcontractors and evidence. The risk assessment follows from the data processed.
Learn more →Templates for the record of processing, privacy notices, deletion concept and replies to data subject requests. The AI helps with wording; the legal assessment stays with you.
Learn more →Open requests, missing contracts and measures after a data breach become tasks with a deadline and a responsible person.
Learn more →A public page with security measures, certificates, approved documents and subcontractors. The Sightadel seal links to your scorecard.
Learn more →Sightadel checks how your shop, website and mail server look from the outside and shows each problem with instructions for fixing it.
Learn more →Effort and duration
The ranges are based on experience, not a commitment. The biggest factors are the number of service providers, the number of countries and how many systems contain customer data.
What you license · typically Professional
A typical B2C company with a shop or app manages the GDPR in the Professional edition, because many service providers stand behind the business. It includes ten users and 25 vendors. Licence for the GDPR: from €200 per month. If you add ISO 27001, there is a permanent discount on the GDPR. With few service providers, Basic is often enough.
Licence per framework, minimum term one year, payable monthly or annually. You will find all prices, discounts and a calculator on the pricing page. Fees of a certification or audit body are charged separately.
In Germany, under § 38 of the Federal Data Protection Act (BDSG), generally when at least 20 people are constantly involved in the automated processing of personal data. Regardless of headcount, the obligation can apply, for example when a data protection impact assessment is required. Clarify the classification of your case with your legal advisers.
Generally one month from receipt. For complex or numerous requests, the deadline can be extended by two further months. The data subject must be informed of this within the first month.
Reportable breaches go to the supervisory authority without undue delay and within 72 hours of becoming aware of them where possible. If there is a high risk to the data subjects, they are notified as well. Every breach is documented, even without a report.
No. The information under Art. 13 GDPR remains mandatory. The Trust Center adds security measures, certificates and the list of service providers.
A shop that sells its own goods is usually not an online marketplace within the meaning of the BSIG. If you run a platform on which third parties sell, that can be different. Clarify the classification with your advisers.
Sightadel does not provide cookie banners. You record which technologies you use, on which basis and with which service provider, and link the documentation as evidence.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
