Privacy notice
Ermelle is in development. This notice covers the founding-furrier waitlist and application form on this site, and the accounts of furriers whom Ermelle has invited to its vendor area (see Furrier accounts).
Who is responsible
Ermelle is a brand operated by Timo Loeper, trading as develoeper.com Consulting, Im Hackert 15, 42279 Wuppertal, Germany (VAT ID DE314840812). He is the controller for the personal data collected here and is contactable directly at privacy@ermelle.com. Because the controller is established in Germany, the EU GDPR applies directly (Art. 3(1)) alongside the German BDSG and TDDDG. No Art. 27 representative is required. Full provider details are in our legal notice.
What we collect and why
- Step 1 (waitlist): your email and name, and your consent choices. Purpose: to contact you about your founding-furrier application (legal basis: Art. 6(1)(b)/(f) — pre-contractual steps / legitimate interest) and, only if you opt in, to send you updates (legal basis: consent, Art. 6(1)(a) with ePrivacy).
- Where your sign-up came from: if you open the form through a link that carries campaign tags (for example from one of our posts, emails or ads), we store those tags with your waitlist entry: utm_source, utm_medium, utm_campaign and utm_content. If your browser holds a Google Analytics cookie (_ga), which is only set after you accept analytics cookies, we also store its client ID. Purpose: to count which channels bring furriers to Ermelle. We use these values only in our protected admin area and do not pass them on (legal basis: Art. 6(1)(f) — legitimate interest in measuring our own outreach). They are deleted together with your waitlist entry.
- Step 2 (application): business details you choose to share — trading name, country, existing shop links, species/materials, product types, years active, role and free-text notes. These are self-declared and used to understand and pre-screen your craft. We do not collect identity documents, tax IDs, or beneficial-ownership data here — regulated verification (KYC/KYB) only happens later, in a separate onboarding process, if you join.
- Business outreach (pre-launch): for a limited number of fur-trade businesses we process publicly listed business contact details (trading name, public email or contact-form address, country, product category, shop link) to send a one-time, personal note about Etsy's 11 August fur delisting and our founding-furrier waitlist (legal basis: Art. 6(1)(f) — legitimate interest; assessment on file). Source: your own shop or website. You can object at any time via privacy@ermelle.com or by replying "no thanks" — we then permanently suppress your contact (we keep a hashed copy solely to honour the suppression). Retention: outreach records are deleted no later than 6 months after last contact or upon objection; suppression hashes are kept permanently.
- Technical: we store the time, IP address and browser of your submission and consent as proof of consent and to prevent abuse.
Furrier accounts
If Ermelle invites your workshop to its vendor area, we open an account for your business. For this account we process the data below about your business and about the people who act for it. The controller is the same as named above.
- Account details: company name, legal form, register number, business address, contact email and phone, VAT ID, the person responsible for product safety in the EU, your answers on tax and trade questions (small-business status, OSS registration, seat of the business, dropshipping from outside the EU, own online shop), the countries you ship to and the residence certificate we hand to your business for tax purposes (date, recipient and version). Purpose: running your account and the contract with you (legal basis: Art. 6(1)(b)).
- Public profile: once Ermelle has published one of your pieces, anyone can see your company name, legal form, register number, business address, the countries you ship to and your workshop introduction on your public profile page while your account is active, and your company name and business address next to each of your published pieces. Purpose: naming you to buyers as the seller and presenting your workshop (legal basis: Art. 6(1)(b) and (c)). Your contact email and phone, your VAT ID and your tax reporting data are not shown.
- Tax reporting data: the tax identification number and the financial account identifier of your business, which we collect for reporting duties under the German Platform Tax Transparency Act (PStTG). The values themselves are shown nowhere on the site (Art. 6(1)(c)).
- Sign-in links: you sign in with a one-time link sent to the contact email on file. A sign-in link is valid for at most 24 hours (30 minutes for a link you request on the vendor login page). In our database we keep only a one-way hash of each link (Art. 6(1)(b)).
- Decisions and suspensions: we email you our decisions on the listings you submit, and if we suspend your account we email you the reasons, as Regulation (EU) 2019/1150 (Art. 4) requires (Art. 6(1)(b) and (c)).
- Sanctions screening: before we activate an account and again at regular intervals, we check the names of your business and of the people named for it against the EU consolidated sanctions list, and we record the result, the list version and the names searched and our notes on any possible match (Art. 6(1)(c) and (f), with EU sanctions law and § 18 AWG).
- VAT ID check: an Ermelle administrator looks up your VAT ID in the EU VIES system or with the German Federal Central Tax Office and records the result by hand (§ 18e UStG; Art. 6(1)(c) and (f)).
- Security: to limit repeated attempts, the sign-in link and the sign-in form count attempts per IP address, and the form also per hashed email address; these counters expire after two hours at most. Signing in and sending the form set a session cookie that is strictly necessary for this service (§ 25(2) no. 2 TDDDG; Art. 6(1)(f)).
- Record of actions: each account decision, each recorded check, each change to your account details, and each sign-in link and notice we send is logged with its time. For a change to your details, the log names only the fields that changed, not their values (Art. 6(1)(c) and (f)).
Sign-in links and notices are sent through the email delivery provider described below, acting as a processor. We keep account data while the contract runs and afterwards only as long as a retention duty requires: company and tax details, tax reporting data and the residence certificate for up to ten years (§ 147 AO; PStTG). The record of actions and the records of our sanctions and VAT checks are kept for up to ten years as evidence of these checks (Art. 6(1)(c) and (f)). The rights listed below apply to this data as well.
Consent and how to withdraw it
Marketing consent is optional and confirmed by a link we email you (double opt-in). You can withdraw it at any time via the unsubscribe link in any marketing email, or by emailing privacy@ermelle.com. Withdrawing consent does not affect processing carried out before withdrawal.
Who we share it with, and international transfers
Your data is stored on our infrastructure hosted in the EU (Frankfurt). Emails are sent via our email delivery provider acting as a processor under a data-processing agreement. We do not sell your data. Because the controller is established in Germany, your data is not transferred to a controller outside the EU. Any processor located outside the EU/UK is covered by the European Commission's 2021 Standard Contractual Clauses. Our forms are protected against automated abuse by Cloudflare Turnstile, which processes limited technical data (e.g., IP address and browser signals) for security only; Cloudflare acts as a processor under Standard Contractual Clauses.
How long we keep it
Waitlist and application data for applicants who do not go on to onboard is kept on a short cycle and then permanently deleted. (Because we deliberately do not collect regulated KYC/tax data at this stage, none of the long statutory retention obligations apply to these records.)
Your rights
You have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, and to lodge a complaint with a supervisory authority. We respond within one month. To exercise a right, email privacy@ermelle.com.
Cookies and analytics
We use analytics and advertising measurement via Google Tag Manager (including Google Analytics) and the Meta Pixel (Facebook), loaded with EU Consent Mode: advertising and analytics storage are denied by default and only enabled if you accept in the cookie banner. After you accept, we may also send a hashed Lead event to Meta’s Conversions API as a server-side fallback when the browser Pixel is blocked — never without that consent. You can change your choice at any time via “Cookie settings” in the footer of the home page.
Prohibited species
Ermelle will never list CITES-listed species, seal or other marine-mammal products, or dog and cat fur — anywhere. Wild cats (lynx, ocelot, and similar), big cats, gray wolf, otters, vicuña and wild chinchilla, and all CITES Appendix II fur are not accepted at launch. If your work includes any of these, tell us in the application and we'll advise you.