Privacy policy

Controller for this website is 8returns GmbH, Pappelallee 78/79, 10437 Berlin, Germany.

For privacy questions or requests, contact us at privacy@8returns.com. For general inquiries, contact hello@8returns.com.

When you access our website, technical data is processed automatically to deliver the website, maintain stability, and protect against misuse. This may include IP address, date and time of access, requested URL, referrer, browser type and version, operating system, and status codes.

We process this data based on our legitimate interest in operating a secure, reliable, and performant website. Log data is retained only as long as necessary for security, troubleshooting, and operational purposes, unless longer retention is required in a specific case.

We use cookies and similar technologies to provide core website functions, remember consent settings, measure website usage, and support marketing activities. Some cookies are technically necessary. Analytics and marketing technologies are controlled through the cookie banner and consent settings where required.

You can change or withdraw your consent at any time through the cookie settings link in the website footer. Withdrawing consent does not affect processing that took place before withdrawal.

If you submit a form, request a demo, subscribe to content, or download a resource, we process the information you provide to respond to your request, deliver the requested content, qualify business inquiries, and communicate with you about relevant 8returns products or content.

We use HubSpot forms and related HubSpot services for form handling, customer relationship management, and communication workflows. If lead tracking is enabled after a form submission, we may also process technical conversion data for campaign attribution, including through Reddit Pixel and Reddit Conversions API. Email identifiers sent to Reddit Conversions API are hashed before being forwarded.

We use analytics and marketing tools to understand how visitors use our website, improve content, measure campaign performance, and identify business interest in 8returns. These tools may process technical and usage data such as page URLs, referrers, device information, IP address, cookie identifiers, events, and form interactions.

Our current website setup includes Google Analytics with Consent Mode, HubSpot, Reddit Pixel/Conversions API, and Apollo website tracking. Where consent is required, these services are only activated according to your consent choice. Individual providers may process data as independent controllers or processors depending on the service and configuration.

Customers use the 8returns platform to manage return workflows for their own shoppers and teams. In that context, the customer determines the purposes and means of processing and is responsible for its own privacy notices to shoppers, employees, and other users. 8returns processes such data as a processor under the customer agreement and the applicable Data Processing Agreement.

You can find the Data Processing Agreement here: Data Processing Agreement.

8returns may provide AI-assisted features in the platform to support return workflows. These features may include product recommendations for exchange suggestions, suggested return reasons, quality feedback on uploaded product or claim images, anomaly detection, and analysis of return patterns in the merchant dashboard.

Customer data is not used to train AI models. Where AI model providers are technically used for inference, 8returns avoids sending direct customer identifiers to those providers, such as names, email addresses, postal addresses, or direct customer IDs, and removes or minimizes such data where the feature supports it. AI-relevant customer data is minimized and pseudonymized where reasonably possible before processing. Uploaded image content is processed only for the requested image quality or claim-support function and may contain personal data if a user includes it. Because pseudonymized data and uploaded image content may still qualify as personal data under the GDPR, they are protected accordingly.

AI-assisted features do not make automated decisions about claims, refunds, account blocking, fraud cases, or other matters with legal or similarly significant effect. AI outputs are suggestions, notices, or quality feedback for review by the merchant or user.

Customers and users should upload only relevant product or damage images. They must not upload identity documents, payment data, health data, faces, shipping labels containing addresses, or other unnecessary personal or sensitive information.

We may share personal data with service providers that help us operate the website, host systems, provide forms and CRM functionality, send emails, measure analytics, run marketing campaigns, provide support, and secure our services. These providers process data only as needed for the relevant service and subject to applicable contractual safeguards.

We may also disclose data if required by law, to enforce our rights, to protect our systems and users, or in connection with corporate transactions such as reorganisations, mergers, or asset transfers.

Some service providers may process personal data outside the European Economic Area. Where this happens, we rely on appropriate safeguards, such as adequacy decisions, EU Standard Contractual Clauses, supplementary measures where required, or another lawful transfer mechanism under Chapter V GDPR.

We retain personal data only for as long as necessary for the purposes described in this policy, unless we are legally required or permitted to keep it for longer. Retention periods depend on the type of data and the context in which it was collected.

Business communications and contract-related records may be retained for statutory limitation, accounting, and tax periods. Marketing consent and unsubscribe records may be retained to document compliance and respect your preferences. Technical logs are generally retained for shorter operational and security periods unless needed to investigate an incident.

To exercise your rights, contact privacy@8returns.com. We may need to verify your identity before responding.

Where regional privacy laws apply, you may have additional rights, such as the right to know, delete, correct, opt out of certain sharing or targeted advertising, and not be discriminated against for exercising privacy rights. 8returns does not sell personal information in the traditional sense. Some advertising or analytics activities may be considered "sharing" or targeted advertising under certain regional laws.

You can opt out of non-essential cookies through the cookie settings and contact us at privacy@8returns.com for regional privacy requests.

We may update this Privacy Policy from time to time to reflect changes in our website, services, providers, or legal requirements. The version published on this page is the current version.