Privacy notice

1. Controller

Kapcura UG (haftungsbeschränkt) i. G., Brehmestraße 59, 13187 Berlin, Germany. Email: pharmacy@kapcura.com, phone: +49 170 471 0257.

2. Hosting, visiting this website and logs

The website, the pharmacy portal and our ordering and administration systems run on our own virtual server at Google Cloud in the Frankfurt am Main region. We store data in a database (Cloud SQL) and documents such as operating licences and certificates of analysis in non-public storage (Cloud Storage), both in the same region. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, which processes the data as our processor (Art. 28 GDPR).

Name resolution for our domains (DNS) is run by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare only tells your device the address of our server; traffic to our pages does not pass through Cloudflare. Only during an attack on our systems do we temporarily route it through Cloudflare’s network; for that time Cloudflare also processes your IP address and the content of your requests.

When you open a page, our server processes the data technically needed for this: your IP address, the time, the address requested and details of your browser. We do not keep access logs. Our applications log operational events and errors without names, IP or email addresses; entries that might still contain an email address stay on the server and are not sent to Google Cloud Logging. Error messages from our database may in individual cases contain an email address; they reach Google Cloud Logging and are likewise deleted there after at most 30 days. We keep logs for at most 14 days on the server and 30 days in Google Cloud Logging in the Frankfurt region, to detect and fix faults and attacks.

Backups of the database and the server are also kept in the Frankfurt region and deleted after 14 days; deleted documents can be restored for up to 37 days. Data we delete therefore only disappears from the backups once these periods have passed. The legal basis for hosting, logs and backups is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

3. Cookies

We do not use cookies or similar technologies for analytics, tracking or advertising, and we do not measure audiences. We do not embed fonts, scripts or content from third parties, except Cloudflare Turnstile on the forms (section 4).

We use only cookies that are strictly necessary for the function you request (section 25(2) no. 2 TDDDG): “kc_lang” stores your language choice for one year, on the website only when you explicitly choose a language; “__Host-kc_session” keeps you signed in to the pharmacy portal, is deleted when you sign out and expires after 24 hours at the latest. The internal applications for Kapcura staff also set sign-in cookies only.

4. Protection against automated requests (Cloudflare Turnstile)

The contact form and the portal’s sign-in, registration, invitations and password reset are protected against automated requests by Cloudflare Turnstile (Cloudflare, Inc., address in section 2). For this, Turnstile evaluates technical characteristics of your browser and connection, such as IP address, browser identifier and encryption characteristics; to check the result, our server also sends your IP address to Cloudflare. Turnstile sets no advertising or tracking cookies, but may set its own technically necessary cookies for the check.

Cloudflare processes this data for us as our processor. According to Cloudflare, it also uses the data under its own responsibility to improve the detection of automated requests; Cloudflare’s privacy policy applies to that use.

The legal basis for reading information from your browser is section 25(2) no. 2 TDDDG, because it is strictly necessary to protect the forms, and for the further processing our legitimate interest in protection against abuse (Art. 6(1)(f) GDPR). On the transfer to the USA, see section 10.

5. Contact form, email and invitations

When you write to us through the form or by email, we process your name, your organisation (optional), your email address, your message and the language of the page to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry concerns a business relationship, otherwise our legitimate interest in answering it (Art. 6(1)(f) GDPR).

The form does not store your details on our servers: after the Turnstile check, our server sends the message through Google Workspace’s email delivery (SMTP relay) as an email to our mailbox pharmacy@kapcura.com; we set your email address as the reply-to address. Google processes the message as our processor, like our other emails (next paragraph).

Our mailboxes are hosted by Google Workspace (Google Cloud EMEA Limited, address in section 2), which runs them as our processor (Art. 28 GDPR) and also sends our emails; storage location: Google’s data centres; no data region is set, so the data may also be stored outside the EU (section 10). For each email sent, Google keeps a delivery log entry (sender, recipient, subject, time, delivery status) for 30 days. Bounce messages for our emails go to a mailbox of their own, not to pharmacy@kapcura.com; we delete them after 30 days.

If you request an invitation and we have checked your pharmacy, we send you a personal invitation link that is valid for 14 days. For this we store your email address, the pharmacy’s name, the language, the expiry date and who at Kapcura created the invitation; of the link itself we store only a hash. We delete invitations that were not accepted 30 days after they expire.

We delete enquiries once they are dealt with, unless we are required to keep them, for example as commercial or business letters (section 257 HGB, section 147 AO).

6. Registering for the pharmacy portal

To register, we process details about your pharmacy (name, address, operating licence number, VAT ID if given, and the name of the pharmacist in charge) and about you (first and last name, business email address, phone number if given, preferred language and your password, which we store only as a hash), and the copy of the operating licence you upload.

We use them to check that your pharmacy belongs to the healthcare professionals with whom we may share information about prescription-only medicines (section 10 HWG) and that we may supply it. Kapcura staff compare your details with the operating licence and the pharmacy register of the competent chamber of pharmacists. The legal bases are Art. 6(1)(b) GDPR (steps towards a business relationship), Art. 6(1)(c) GDPR (obligations under the law on advertising for medicines and medicines law) and Art. 6(1)(f) GDPR (our interest in admitting only authorised pharmacies).

Without these details we cannot check or activate your pharmacy. Only Kapcura staff who review registrations see the copy of the operating licence. If we reject a registration, we delete the details after 30 days, unless we need them to meet legal obligations or to defend against claims.

7. Using the pharmacy portal and orders

Each pharmacy has one portal login. Pre-orders, order requests and orders belong to your pharmacy’s account and are visible through this login. We process them to review, confirm and fulfil them (Art. 6(1)(b) GDPR). Order requests you have not yet sent to us (drafts) are stored in your pharmacy’s account so that you can continue them later; you can remove items at any time. We do not delete drafts after a fixed period; they are kept as long as your pharmacy’s account exists.

For delivery and invoicing, we pass the necessary order data to our distribution partner, a pharmaceutical wholesaler in Germany: order number and date, the pharmacy’s name, address, operating licence number and VAT ID, the email address of the portal login and the items ordered. The distribution partner processes this data under its own responsibility, as an independent controller under the GDPR.

We keep order and invoice data for as long as commercial and tax law requires (up to ten years, section 257 HGB, section 147 AO), and records required by medicines law for at least five years (section 7 of the German Ordinance on Trade in Medicinal Products). We keep other account data for as long as the business relationship lasts. You can ask us to delete the account at any time; data we are required to keep is blocked until the retention period ends.

8. Protecting your portal login

To protect your portal login, we count sign-in attempts, checks of the current password when it is changed, and requests to reset the password. For this we store keyed hashes of the email address and, separately, of the email address together with the IP address the attempt comes from (for IPv6, its /64 network), and the number of attempts and their time; we do not store the email or IP addresses themselves for this. After five failed attempts within 15 minutes we lock sign-in to this login from that IP address for 15 minutes, and from all IP addresses after 30 failed attempts in total. We handle at most five password reset requests per IP address and ten in total within 15 minutes.

When you sign out, change your password, or portal access is suspended or ended, we store the time in order to end existing sessions on all devices. An hourly clean-up deletes the counters after two hours at most, these times after two days at most, and unused password reset links no later than two hours after they expire; if the portal is idle for lack of requests, the next run catches up. The legal basis is our legitimate interest in the security of the logins (Art. 6(1)(f) GDPR).

9. Emails from the portal

We send portal emails, such as acknowledgements, invitations, the result of the review, messages about pre-orders, order requests and batches, password reset links and notices of a suspension, through Google Workspace’s email delivery (section 5) to the email address of the portal login (Art. 6(1)(b) GDPR). We do not track whether you open our emails or click links in them: the emails contain no tracking pixels, and their links lead straight to the portal.

Records of sent emails (recipient, type and content of the email) are deleted after 90 days; password reset and invitation links are removed from them right after sending (Art. 6(1)(f) GDPR).

10. Recipients and transfers to third countries

Only these recipients receive personal data: the service providers named above, who process it on our behalf (Art. 28 GDPR), namely Google Cloud EMEA Limited (hosting, Google Workspace including email delivery) and Cloudflare, Inc. (DNS, Turnstile, routing of web traffic during an attack only); our distribution partner, which processes the data needed to fulfil orders under its own responsibility (section 7); and authorities, where we are legally required to provide data. Cloudflare also uses Turnstile data under its own responsibility (section 4). We do not sell data.

Cloudflare, Inc. is based in the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR); in addition, Cloudflare has agreed the European Commission’s standard contractual clauses with us (Art. 46(2)(c) GDPR).

Our servers and backups are in Frankfurt am Main. Where Google processes data outside the EU or uses sub-processors outside the EU, the following applies: Google is certified under the EU-U.S. Data Privacy Framework; in addition, Google’s data processing terms include the European Commission’s standard contractual clauses.

11. No automated decisions, no AI processing

We do not make solely automated decisions within the meaning of Art. 22 GDPR and do not create profiles. Kapcura staff decide on registrations, pre-orders and order requests. We do not process personal data from the website, the portal or enquiries with AI services.

12. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). You may object to processing based on legitimate interests on grounds relating to your particular situation (Art. 21 GDPR). To do so, email us at pharmacy@kapcura.com.

You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us: the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin.

13. Security

All connections to the website and the portal are TLS-encrypted. Only authorised Kapcura staff can access data in the portal, signing in with their Google Workspace account and a second factor.

14. Changes

We update this notice when our processing or the law changes. The version published here, with the date shown above, applies.