Privacy policy
This English text is a courtesy translation. Only the German version is legally binding.
Status: 10 October 2026
In this privacy policy we inform you about the processing of your personal data in the froxlor Marketplace at packages.froxlor.org (the "Marketplace"). It applies to visitors, customers (users of packages) and maintainers.
1. Controller
froxlor GmbH, Wilhelm-Busch-Str. 54, 60431 Frankfurt am Main, Germany
Email: team@froxlor.com · Phone: +49 69 348688970
2. Server log files
For the purpose of monitoring technical operation and increasing operational security, connection data (in particular IP address, time, requested address, status code and browser identifier) is processed with every request. The processing period is limited to 4 days.
The legal basis is our legitimate interest (strict technical necessity of a server log file as a data basis for error analysis and security measures) pursuant to Art. 6 (1) (f) GDPR.
3. User account and registration
For registration we process your name, email address and a hashed password as well as the time of email verification. We use this data to provide your account, authenticate you and send you messages regarding your account.
The legal basis is the performance of the usage relationship (Art. 6 (1) (b) GDPR). The data is deleted when you delete your account, unless statutory retention obligations apply.
4. Access tokens and usage via Composer
To access protected packages you create access tokens. We only store a hash of the token, its name, its last characters, its expiry date and the time of last use. The legal basis is Art. 6 (1) (b) GDPR.
5. Purchases, licences and payment processing
When you purchase a package we process order and licence data (package, plan, amount, payment status, licence term) and your account data. The purchase agreement is concluded with the respective maintainer; we pass on to them the data required for performing the contract (in particular name, email address and licence status).
Payment is processed by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). You enter payment data (e.g. card data) directly with Stripe; we do not receive it. Stripe processes this data under its own responsibility in accordance with its privacy policy (https://stripe.com/privacy).
The legal basis is Art. 6 (1) (b) GDPR. We retain order and invoice data in accordance with commercial and tax retention periods (up to ten years) (Art. 6 (1) (c) GDPR).
5a. Ratings
Logged-in users can rate packages and vendors (teams) with 1 to 5 stars (no free text). We store the rating, the target, the time and your account identifier so that only one rating per user is possible and abuse can be detected. Only the average and the number of ratings are published. The legal basis is our legitimate interest in a trustworthy rating function (Art. 6 (1) (f) GDPR). Your ratings are deleted when you delete your account or remove the rating yourself.
6. Teams and maintainers
For teams we process the team name, website, members and their roles as well as the result of the review by our administrators (approval, rejection, suspension, "verified by froxlor" mark). The name and website of a team and the information about the offered packages are published in the Marketplace and in the publicly accessible package list. For paid packages, the team's name or company name, address, contact email address and VAT ID are additionally published as seller information on the product page (seller identification).
The legal basis is the performance of the marketplace agreement (Art. 6 (1) (b) GDPR) and our legitimate interest in preventing abuse and ensuring quality (Art. 6 (1) (f) GDPR). Acceptance of the marketplace agreement is documented with version, time, IP address and browser identifier in order to be able to prove it.
7. Tax information and VAT ID verification
Maintainers provide legal form, company or full name, address, billing email, VAT ID and/or tax number. We verify this information where necessary, in particular via the EU VAT Information Exchange System (VIES) and the German Federal Central Tax Office.
The legal bases are tax and other legal obligations (Art. 6 (1) (c) GDPR), the performance of the marketplace agreement (Art. 6 (1) (b) GDPR) and your consent to the verification (Art. 6 (1) (a) GDPR). Where we are legally obliged to make reports (e.g. under the German Platform Tax Transparency Act), we transmit the required data to the competent authorities.
8. Supplement: identity verification (KYC) for maintainers
Before a team can sell paid packages and receive payouts, an identity verification (Know Your Customer, KYC) is carried out. The following additionally applies:
Purpose. The verification serves to establish your identity or the identity and the beneficial owners of your company, to prevent fraud and money laundering, to comply with legal and regulatory requirements of payment processing and to carry out payouts securely.
Data processed. Depending on legal form and country, in particular first and last name, date and place of birth, nationality, address, identity documents (including photo), commercial register extracts, information on authorised representatives and beneficial owners, tax and identification numbers and bank details.
Who processes the data. The collection and verification of identity documents and bank data is in principle carried out directly by our payment service provider Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland) as part of "Stripe Connect". Stripe processes this data under its own data protection responsibility in accordance with its privacy policy (https://stripe.com/privacy); according to Stripe's information and, where applicable, based on an explicit consent given to Stripe, this may also include the comparison of biometric features (e.g. ID photo and selfie). We ourselves only receive and store from Stripe the result and status of the verification (e.g. "verified", "in review", "action required"), the account identifier, the approval for payments and payouts and, where applicable, the reason for restriction communicated by Stripe. Where we request evidence ourselves in individual cases (e.g. VAT ID, tax number or commercial register extract), we process this data ourselves.
Legal bases. Your consent to the verification given when creating the team (Art. 6 (1) (a) GDPR), the performance of the marketplace agreement and of payouts (Art. 6 (1) (b) GDPR), legal obligations, in particular for the prevention of fraud and money laundering and for tax reports (Art. 6 (1) (c) GDPR), and our legitimate interest in preventing abuse and fraud (Art. 6 (1) (f) GDPR).
Voluntariness and consequences. Participation in the identity verification is voluntary. Without a successful verification, however, no paid packages can be sold and no payouts can be made. You may withdraw a given consent at any time with effect for the future; the lawfulness of the processing carried out until then remains unaffected. A withdrawal may result in payouts no longer being possible.
Storage period. We store the verification status and related identifiers for the duration of the contractual relationship and beyond where statutory retention obligations exist (up to ten years). For data stored by Stripe, Stripe's retention periods apply.
9. Recipients and transfers to third countries
Recipients of your data are – where necessary for performing the contract – the respective maintainer (for purchases), Stripe as payment service provider and our technical service providers who support us in operation and email delivery and are bound by our instructions as processors. Stripe may transfer data to third countries, in particular the USA. According to Stripe, the transfer is based on the adequacy decision on the EU-US Data Privacy Framework or on EU standard contractual clauses.
10. Cookies and local storage
The Marketplace only uses technically necessary cookies (session and security cookie) for login and form protection (§ 25 (2) No. 2 TDDDG). In addition, your browser stores the chosen appearance (light/dark) locally. There is no tracking, no advertising or third-party cookies, and fonts are loaded from our own servers.
11. Usage statistics
To improve the Marketplace and to allow maintainers and administrators to understand how their packages are used, we record anonymised usage events: views of package pages (excluding views by search engine bots), the start of a purchase, downloads of package files and successful installations reported by Composer. We store the time, package and version, the type of client (e.g. Composer or browser), the Composer and PHP version (major and minor version only), the operating system, – where provided by our infrastructure – the country and, for requests using an access token, the link to the account and token.
The IP address and the full browser identifier are not stored for this purpose. To count unique clients, the IP address is converted into an irreversible hash value using a key that changes daily, which does not allow recognition across days. Maintainers only see aggregated figures about their own packages, administrators aggregated figures for the entire platform. Raw events are deleted after 24 months.
The legal basis is our legitimate interest in operating and improving the Marketplace, in detecting abuse and in demonstrating usage to maintainers (Art. 6 (1) (f) GDPR). For requests using an access token, the assignment to the account is necessary for performing the contract (Art. 6 (1) (b) GDPR). You may object to the processing as described in the section "Right to object".
12. Right to object
Where the processing of your personal data is based on legitimate interests, you have the right to object to this processing. Unless there are compelling legitimate grounds for the processing on our side, the processing of your data on the basis of this legal basis will be stopped.
You also have the right to object to the processing of your personal data for direct marketing purposes. In case of an objection your personal data will no longer be processed for direct marketing purposes. The lawfulness of the data processed until the objection remains unaffected.
13. Right of withdrawal
You have the right to withdraw a consent already given at any time with effect for the future, e.g. by email to team@froxlor.com. The lawfulness of the data processed until the withdrawal remains unaffected.
14. Data subject rights
You have the right of access, rectification, erasure and restriction of processing of your personal data. Where the legal basis of the processing is your consent or a contract concluded with you, you also have the right to data portability.
You also have the right to lodge a complaint with a supervisory authority. The competent authority for us is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit), Postfach 3163, 65021 Wiesbaden, Germany (https://datenschutz.hessen.de). Information on the supervisory authorities in the European Union can be found on the website of the European Data Protection Board.
15. Changes to this privacy policy
To ensure that our privacy policy always complies with current legal requirements, we reserve the right to make changes at any time. This also applies if the privacy policy needs to be adapted due to new or revised services. The new privacy policy applies from your next visit.
16. Language
This privacy policy is also available in German. Only the German version is legally binding.