Privacy Policy.

1. Who we are.

Drip Trading GmbH, Kolpingstraße 32, 83278 Traunstein, Germany, is represented by its managing directors Samuel Hess and Fabian Gmeindl. Commercial register: HRB 27857, Amtsgericht Traunstein. VAT ID: DE323682003.

Privacy enquiries and data-subject requests may be sent to privacy@drip-apex.com or by post to the company address above. Security reports should be sent to security@drip-apex.com.

2. Datenschutzbeauftragter (Data Protection Officer).

Drip Trading GmbH has appointed an external data protection officer, effective 1 September 2026.

PROLIANCE GmbH
Leopoldstr. 21
80802 München
Germany
www.proliance.ai
datenschutzbeauftragter@proliance.ai

• When contacting the data protection officer, state the company your inquiry relates to (Drip Trading GmbH / Apex).
• Do not attach sensitive documents such as ID copies to your inquiry.

3. Our two data-processing roles.

Dashboard and customer relationship. DRIP is controller for merchant account, team-seat, authentication, service, support, security and commercial data used to provide and administer Apex.

Merchant storefront events. When a merchant places the Apex JavaScript snippet or SDK on its storefront, the merchant determines the purposes and lawful basis for that processing. DRIP processes the resulting end-user event data on the merchant's instructions as its processor. The Data Processing Agreement governs that data plane.

4. Data we process.

• merchant identity, business contact, account, authentication, organisation, shop and dashboard-seat data;
• experiment, goal, targeting and storefront configuration, audit history, support communications and service records;
• technical request, device, browser, security, error and diagnostic data;
• pseudonymous storefront visitor and session identifiers, page URLs, experiment and variation assignments, pageviews, clicks, custom events, device type, country and timestamps, heatmap interactions and page performance data;
• where a merchant enables them, session replay recordings of storefront visits (with form inputs masked) and, only with the visitor's marketing consent, advertising click identifiers and advertising cookie values used to attribute visits to traffic channels;
• where configured by a merchant, optional user identifiers, order identifiers, revenue amounts, currency and custom event properties;
• merchant prompts and merchant storefront content supplied to Apex Operator, which may incidentally include personal data published on the storefront; and
• for measuring our own advertising, only with your consent given in the consent tool on our website: advertising click identifiers and cookies (gclid, gbraid, wbraid, fbclid, _fbp, _fbc), your IP address and your browser's user agent, captured when you sign up for Apex.

Apex is not intended for special-category data under Article 9 GDPR. Merchants must not configure Apex to collect data that is unnecessary for their experiments.

5. Purposes and lawful bases.

For data for which DRIP is controller, we process data to enter into and perform the Apex contract (Article 6(1)(b) GDPR), comply with legal obligations (Article 6(1)(c)), and pursue legitimate interests in securing, operating, improving and supporting a reliable B2B service (Article 6(1)(f)). Where a feature or communication requires consent, we rely on Article 6(1)(a); consent may be withdrawn at any time.

For storefront event data, the merchant selects and documents the applicable lawful basis and provides required notices or consent controls. DRIP does not decide that basis on the merchant's behalf.

Measuring our own advertising. If you consented to advertising measurement on our website, we send a conversion record to Meta (Conversions API) and Google (Google Ads Data Manager API) when you start a trial and when you start your first experiment. The record contains your e-mail address hashed with SHA-256 (for Meta also your hashed first and last name and a hashed internal account identifier), the advertising click identifiers and cookies captured at signup (Section 4), your IP address, your browser's user agent and your consent signals. The lawful basis is your consent (Article 6(1)(a) GDPR). Without that consent nothing is sent, and you can withdraw it at any time with effect for the future.

Apex does not make automated decisions about individuals that produce legal or similarly significant effects within the meaning of Article 22 GDPR.

6. Retention.

We keep controller-side account, contract, audit, security and support data only as long as needed for the stated purposes and applicable statutory obligations. Runtime logs and caches use shorter operational periods appropriate to their purpose. We determine retention periods based on the contract duration, statutory retention duties, including commercial and tax-law duties under § 257 HGB and § 147 AO, and security needs.

Merchant storefront data is deleted automatically after the fixed periods stated in Annex 2 of the Data Processing Agreement and otherwise follows the merchant's documented instructions. Advertising identifiers, IP address and user agent captured at signup are cleared after 90 days; the remaining signup attribution and conversion records are deleted after 13 months. Consistent with Section 11 of the DPA, after the service closes we return or delete processor data at the merchant's choice; if no choice is made within 30 days after termination, we delete it unless law requires continued storage.

7. Recipients, subprocessors and transfers.

We disclose data only to personnel and service providers who need it to operate Apex, to professional advisers where necessary, or where law requires. The complete current list of processors used for merchant data, including purpose, data class, region and transfer mechanism, appears in Annex 1 of the DPA. With your consent, signup conversion records also go to Meta and Google as described in Section 5.

Where personal data leaves the European Economic Area, the transfer mechanism relied on for each recipient is stated per vendor in Annex 1 of the DPA. Where a mechanism is still being put in place, Annex 1 discloses that status.

8. Your rights.

Subject to the GDPR's conditions, individuals may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. They may withdraw consent without affecting earlier processing and lodge a complaint with a competent supervisory authority. The competent supervisory authority for Drip Trading GmbH is the Bavarian State Office for Data Protection Supervision (BayLDA). We answer data-subject requests without undue delay and within one month as required by Article 12(3) GDPR.

For storefront activity, contact the merchant whose storefront you visited first because that merchant is the controller. We assist merchants with verified requests. For an Apex merchant account, contact us directly at the postal address above. We may need information to verify identity and scope before acting.

9. Security and changes.

We use technical and organisational measures appropriate to the processing risk, including access controls, encryption in transit, tenant separation, monitoring and incident response. No system is completely secure. Material changes to this policy will be published here with an updated date.