PRIVACY POLICY
1) Information about the collection of personal data and contact details of the controller.
1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we explain how we handle your personal data when you use our website. Personal data means any data through which you can be personally identified.
1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Shop Name. The controller responsible for processing personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.
1.3 For security reasons and to protect the transmission of personal data and other confidential content (such as orders or enquiries sent to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by “https://” and the padlock symbol in your browser’s address bar.
2) DATA COLLECTION WHEN VISITING OUR WEBSITE
If you use our website for information only—that is, if you do not register or otherwise submit information to us—we collect only the data your browser sends to our server (“server log files”). When you access our website, we collect the following data, which is technically necessary to display the website:
The page of our website visited
Date and time of access
Amount of data sent in bytes
Source/referring page from which you arrived
Browser used
Operating system used
IP address used (where applicable, in anonymised form)
Processing takes place under Article 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not disclosed or used for any other purpose. However, we reserve the right to review server log files retrospectively where specific evidence indicates unlawful use.
3) COOKIES
To make visiting our website attractive and enable certain functions, we use cookies on various pages. Cookies are small text files stored on your device. Some cookies are deleted when the browser session ends, meaning when you close your browser (“session cookies”). Other cookies remain on your device and allow us or our partner companies (third-party cookies) to recognise your browser on your next visit (“persistent cookies”). When cookies are placed, they collect and process certain user information to varying extents, such as browser and location data and IP-address values. Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie.
Some cookies simplify the ordering process by saving settings, such as remembering the contents of a virtual shopping basket for a later visit. Where personal data is processed by individual cookies implemented by us, processing takes place either under Article 6(1)(b) GDPR for performance of the contract, or under Article 6(1)(f) GDPR to protect our legitimate interests in ensuring the best possible website functionality and a customer-friendly, effective website experience.
We may work with advertising partners who help make our online offering more interesting to you. In this case, cookies from partner companies may also be stored on your hard drive when you visit our website (third-party cookies). If we work with such advertising partners, you will be informed separately in the paragraphs below about the use of these cookies and the scope of the information collected in each case.
You can configure your browser to notify you when cookies are placed, decide individually whether to accept them, or reject cookies in certain cases or generally. Each browser manages cookie settings differently. Its Help menu explains how to change them. Instructions for the relevant browsers are available here:
Internet Explorer: https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies
Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Chrome: https://support.google.com/chrome/answer/95647?hl=de&hlrm=en
Safari: https://support.apple.com/kb/ph21411?locale=de_DE
Opera: https://help.opera.com/en/latest/web-preferences/#cookies
Please note that refusing cookies may limit the functionality of our website.
4) CONTACTING US
When you contact us, for example through a contact form or by email, personal data is collected. The data collected through a contact form is shown on the relevant form. This data is stored and used exclusively to respond to your request or to make contact and carry out the associated technical administration. The legal basis is our legitimate interest in responding to your request under Article 6(1)(f) GDPR. If your contact is intended to lead to a contract, Article 6(1)(b) GDPR is an additional legal basis. Your data will be deleted once your enquiry has been conclusively processed, provided the circumstances show that the matter has been fully resolved and no statutory retention duties prevent deletion.
5) DATA PROCESSING WHEN OPENING A CUSTOMER ACCOUNT AND FOR CONTRACT PERFORMANCE
Under Article 6(1)(b) GDPR, personal data is also collected and processed when you provide it to us to perform a contract or open a customer account. The data collected is shown on the relevant input forms. You may delete your customer account at any time by sending a message to the controller at the address stated above. We store and use the data you provide to process the contract. After the contract has been completed or your customer account deleted, your data will be blocked in consideration of tax and commercial-law retention periods and deleted when those periods expire, unless you have expressly consented to further use or we have reserved a legally permitted further use, about which we inform you below.
6) USE OF YOUR DATA FOR DIRECT ADVERTISING
6.1 Subscription to our email newsletter
If you subscribe to our email newsletter, we will regularly send you information about our offers. Your email address is the only mandatory information required. Any further information is voluntary and is used to address you personally. We use the double opt-in procedure: we will send you a newsletter only after you expressly confirm that you consent to receiving it. We will send a confirmation email asking you to click a link to confirm that you wish to receive future newsletters.
By activating the confirmation link, you consent to our use of your personal data under Article 6(1)(a) GDPR. When you register, we store the IP address recorded by your Internet service provider, together with the date and time, so that we can trace possible misuse of your email address later. Data collected during newsletter registration is used exclusively for advertising through the newsletter. You may unsubscribe at any time through the link in the newsletter or by contacting the controller named at the beginning. After unsubscribing, your email address will immediately be removed from our newsletter list unless you have expressly consented to further use or we reserve another use permitted by law and explained in this policy.
6.2 Email newsletters to existing customers
If you provided your email address when purchasing goods or services, we reserve the right to email you regularly with offers for similar goods or services from our range. We do not need separate consent for this. Processing is based solely on our legitimate interest in personalised direct advertising under Article 6(1)(f) GDPR. If you initially objected to use of your email address for this purpose, we will not send such emails. You may object at any time, with future effect, by notifying the controller named at the beginning. You will incur only transmission costs at basic rates. Once we receive your objection, use of your email address for advertising will stop immediately.
7) DATA PROCESSING FOR ORDER FULFILMENT
7.1 Personal data collected by us will be passed to the transport company commissioned with delivery where necessary to deliver the goods. We pass your payment data to the commissioned financial institution where required to process payment. Where payment-service providers are used, we expressly explain this below. The legal basis for disclosure is Article 6(1)(b) GDPR.
7.2 Use of payment-service providers
PayPal
When paying through PayPal, by credit card through PayPal, by direct debit through PayPal, or—where offered—by “purchase on account” or “instalment payment” through PayPal, we pass your payment data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (“PayPal”). Disclosure takes place under Article 6(1)(b) GDPR and only to the extent necessary for payment processing.
For credit-card payments through PayPal, direct debit through PayPal and, where offered, purchase on account or instalment payments, PayPal reserves the right to carry out a credit check. For this purpose, your payment data may be sent to credit agencies under Article 6(1)(f) GDPR, based on PayPal’s legitimate interest in determining your ability to pay. PayPal uses the credit-check result relating to the statistical likelihood of payment default to decide whether to provide the relevant payment method. The credit report may contain probability values (“score values”). Where score values influence the result, they are based on a scientifically recognised mathematical-statistical procedure. Address data is among the information used to calculate scores. For further information, including the credit agencies used, see PayPal’s privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
You may object to this processing at any time by notifying PayPal. PayPal may nevertheless remain entitled to process your personal data where necessary for contractual payment processing.
SOFORT
If you select “SOFORT,” payment is processed by SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany (“SOFORT”). Under Article 6(1)(b) GDPR, we send SOFORT the information provided during checkout together with information about your order. SOFORT GmbH is part of Klarna Group (Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden). Your data is disclosed solely for payment processing and only to the extent necessary. More information about SOFORT’s privacy provisions is available at: https://www.klarna.com/sofort/datenschutz
8) CONTACT FOR REVIEW REMINDERS
Our own review reminder (not sent through a customer-review system)
We use your email address once to remind you to review your order using our review system, provided you gave us express consent during or after your order under Article 6(1)(a) GDPR. You may withdraw consent at any time by notifying the controller.
9) USE OF SOCIAL MEDIA: SOCIAL PLUGINS
9.1 Facebook plugins using the Shariff solution
Special additional customs-clearance costs and/or import duties are not included in the price and are payable by the customer.
Our website uses social plugins from Facebook, operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA (“Facebook”). To improve protection of your data, these buttons are not integrated without restriction as plugins; instead, they are embedded using an HTML link. Therefore, opening a page containing these buttons does not yet establish a connection to Facebook’s servers. If you click the button, a new browser window opens Facebook, where—after entering login details if necessary—you may interact with its plugins.
Facebook Inc., based in the USA, is certified under the EU–US Privacy Shield, which was intended to ensure compliance with the level of data protection applicable in the EU. For the purpose and scope of data collection, Facebook’s further processing and use, your rights, and settings available to protect your privacy, see Facebook’s privacy information: https://www.facebook.com/policy.php
9.2 Google+ plugins using the Shariff solution
Our website uses social plugins from Google+, operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). To improve protection of your data, these buttons are embedded only through an HTML link. Opening a page containing them therefore does not yet connect to Google+ servers. If you click the button, a new browser window opens Google+, where—after entering login details if necessary—you may interact with its plugins.
Google LLC, based in the USA, is certified under the EU–US Privacy Shield, which was intended to ensure compliance with the level of protection applicable in the EU. For the purpose and scope of collection, Google’s further processing and use, your rights, and privacy settings, see: https://www.google.com/intl/de/policies/privacy/
9.3 Instagram plugin using the Shariff solution
Our website uses social plugins from Instagram, operated by Instagram LLC, 1601 Willow Rd, Menlo Park, CA 94025, USA (“Instagram”). To improve protection of your data, these buttons are embedded only through an HTML link. Opening a page containing them therefore does not yet connect to Instagram’s servers. If you click the button, a new browser window opens Instagram, where—after entering login details if necessary—you may interact with its plugins.
Instagram LLC, based in the USA, is certified under the EU–US Privacy Shield, which was intended to ensure compliance with the level of protection applicable in the EU. For the purpose and scope of collection, Instagram’s further processing and use, your rights, and privacy settings, see: https://help.instagram.com/155833707900388/
10) ONLINE MARKETING
10.1 DoubleClick by Google
This website uses DoubleClick by Google, an online-marketing tool operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“DoubleClick”). DoubleClick uses cookies to show users relevant advertisements, improve campaign-performance reports, and prevent users seeing the same advertisements repeatedly. Using a cookie ID, Google records which advertisements are shown in which browser and can prevent repeat display. Processing is based on our legitimate interest in optimally marketing our website under Article 6(1)(f) GDPR.
DoubleClick may also use cookie IDs to record conversions connected to advertising requests—for example, when a user sees a DoubleClick advertisement, later visits the advertiser’s website with the same browser and makes a purchase. According to Google, DoubleClick cookies contain no personal information.
Because of the marketing tools used, your browser automatically establishes a direct connection with Google’s server. We have no influence over the scope or further use of data collected by Google through this tool. To our knowledge, Google learns that you accessed the relevant part of our website or clicked one of our advertisements. If you are registered with a Google service, Google may associate the visit with your account. Even if you are not registered or logged in, the provider may learn and store your IP address.
You may prevent participation in tracking by disabling conversion-tracking cookies through your browser settings, by blocking cookies from www.googleadservices.com, or by changing settings at https://www.google.de/settings/ads; this setting is deleted if you delete your cookies. Alternatively, learn about cookies and set preferences through the Digital Advertising Alliance at www.aboutads.info. You may also configure your browser to notify you about cookies and accept them individually, or reject them in certain cases or generally. Refusing cookies may limit website functionality.
Google LLC, based in the USA, is certified under the EU–US Privacy Shield, which was intended to ensure compliance with EU data-protection standards. More information about DoubleClick privacy is available at: https://www.google.de/policies/privacy/
10.2 Google AdWords conversion tracking
This website uses “Google AdWords” and its conversion tracking, provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). We use Google AdWords advertising on external websites to draw attention to our offers. Campaign data allows us to measure the success of individual advertising measures. Our interest is in showing you relevant advertising, making our website more interesting, and achieving fair calculation of advertising costs.
A conversion-tracking cookie is placed when a user clicks a Google AdWords advertisement. These small text files are stored on the computer, normally expire after 30 days and do not personally identify the user. If the user visits certain pages before expiry, Google and we can see that the advertisement was clicked and the user was directed to that page. Each AdWords customer receives a different cookie, so cookies cannot be tracked across AdWords customers’ websites. Information obtained through the conversion cookie is used to produce statistics for customers who use conversion tracking. Customers learn the total number of users who clicked their advertisement and were directed to a page carrying a conversion-tracking tag, but receive no information that personally identifies users.
If you do not wish to participate, you can disable Google conversion-tracking cookies in your browser’s user settings. You will then not be included in conversion statistics. We use Google AdWords on the basis of our legitimate interest in targeted advertising under Article 6(1)(f) GDPR.
Google LLC is certified under the EU–US Privacy Shield. Further information is available at https://www.google.de/policies/privacy/. You can permanently disable advertising-preference cookies through browser settings or install the plugin at https://www.google.com/settings/ads/plugin?hl=de. Please note that disabling cookies may make some website functions unavailable or restricted.
11) WEB ANALYTICS SERVICES
Google (Universal) Analytics
This website uses Google Analytics, provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google Analytics uses cookies stored on your computer to analyse your use of the website. Information generated by the cookie about your use, including the shortened IP address, is normally sent to and stored on a Google server in the USA.
This website uses Google Analytics only with “_anonymizeIp()”, which anonymises IP addresses by shortening them and prevents direct personal identification. Google shortens your IP address within EU Member States or other states party to the European Economic Area Agreement before transmission. Only exceptionally is the full IP address sent to a US server and shortened there. In these cases, processing takes place under Article 6(1)(f) GDPR based on our legitimate interest in statistically analysing user behaviour for optimisation and marketing.
On our behalf, Google uses this information to evaluate website use, compile activity reports and provide other services connected with website and Internet use. The IP address sent by your browser through Google Analytics is not combined with other Google data.
You can prevent cookie storage through browser settings, although you may then be unable to use all website functions fully. You can also prevent Google collecting and processing cookie-generated data concerning your use, including your IP address, by downloading and installing the plugin at: https://tools.google.com/dlpage/gaoptout?hl=de
Alternatively, especially on mobile browsers, click the “Disable Google Analytics” link on the website to set an opt-out cookie. It prevents future collection on this website and works only in that browser and for that domain. If you delete cookies, you must click the link again.
Google LLC is certified under the EU–US Privacy Shield. This website also uses Google Analytics for cross-device analysis of visitor flows through a user ID. On first opening a page, the user receives a unique, permanent, anonymised ID set across devices. This allows interaction data from different devices and sessions to be assigned to one user. The ID contains no personal data and sends none to Google.
You may object to collection and storage through the user ID at any time with future effect. You must disable Google Analytics on all systems you use, such as another browser or mobile device. You may do so using Google’s plugin at https://tools.google.com/dlpage/gaoptout?hl=de or the website’s “Disable Google Analytics” opt-out link. More information about Universal Analytics: https://support.google.com/analytics/answer/2838718?hl=de&ref_topic=6010376
12) RETARGETING, REMARKETING AND RECOMMENDATION ADVERTISING
Facebook Custom Audience using the pixel method
This website uses the Facebook Pixel from Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA (“Facebook”). Where express consent is given, this allows user behaviour to be tracked after users see or click a Facebook advertisement. The process evaluates the effectiveness of Facebook advertising for statistics and market research and may help optimise future advertising.
The data collected is anonymous to us and does not reveal users’ identities. However, Facebook stores and processes it, allowing association with the relevant user profile, and may use it for its own advertising in accordance with its data-use policy: https://www.facebook.com/about/privacy/. The data can enable Facebook and its partners to display advertisements on and outside Facebook. A cookie may be stored for these purposes. Processing takes place only with express consent under Article 6(1)(a) GDPR.
Only users over 13 may consent to use of the Facebook Pixel. Younger users should ask a parent or guardian for permission. Facebook Inc. is certified under the EU–US Privacy Shield.
To disable cookies, configure your browser so that no future cookies can be placed or delete existing cookies. Disabling all cookies may prevent some website functions from working. You can also disable third-party cookies, including Facebook cookies, through the Digital Advertising Alliance: https://www.aboutads.info/choices/
Google AdWords Remarketing
Our website uses Google AdWords Remarketing to advertise this website in Google search results and on third-party websites. It is provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google places a cookie in your device’s browser that automatically enables interest-based advertising using a pseudonymous cookie ID and the pages you visited. Processing is based on our legitimate interest in optimally marketing our website under Article 6(1)(f) GDPR.
Further processing takes place only if you agreed that Google may link your Internet and app browsing history to your Google account and use information from that account to personalise advertisements you view online. If you are logged into Google while visiting our website, Google uses your data together with Google Analytics data to create and define audience lists for cross-device remarketing. Your personal data is temporarily linked with Analytics data to form audiences.
You can permanently disable advertising-preference cookies by installing the plugin at https://www.google.com/settings/ads/onweb/. Alternatively, obtain information and change cookie settings through the Digital Advertising Alliance at www.aboutads.info, or configure your browser to notify you about cookies and allow individual acceptance or partial/general rejection. Rejecting cookies may limit website functionality.
Google LLC is certified under the EU–US Privacy Shield. Further information about advertising and Google privacy is available at: https://www.google.com/policies/technologies/ads/
13) RIGHTS OF THE DATA SUBJECT
13.1 Applicable data-protection law gives you extensive rights against the controller concerning processing of your personal data, including the following information and intervention rights:
Right of access under Article 15 GDPR: You have the right to information about personal data processed by us; the purposes of processing; categories of data; recipients or categories of recipients to whom it has been or will be disclosed; intended retention period or criteria used to determine it; rights to rectification, erasure, restriction and objection; the right to complain to a supervisory authority; the source where we did not collect the data from you; the existence of automated decision-making including profiling and, where applicable, meaningful information about the logic involved, its significance and intended effects; and the safeguards under Article 46 GDPR where data is transferred to third countries.
Right to rectification under Article 16 GDPR: You have the right to immediate correction of inaccurate data concerning you and/or completion of incomplete data stored by us.
Right to erasure under Article 17 GDPR: You may request deletion where Article 17(1) conditions are met. This right does not apply in particular where processing is necessary to exercise freedom of expression and information, comply with a legal obligation, serve the public interest, or establish, exercise or defend legal claims.
Right to restriction under Article 18 GDPR: You may request restriction while accuracy disputed by you is verified; where you reject deletion due to unlawful processing and request restriction instead; where you need the data to establish, exercise or defend legal claims after we no longer need it for its purpose; or where you have objected for reasons related to your situation while it is determined whether our legitimate grounds override yours.
Right to notification under Article 19 GDPR: If you exercise rectification, erasure or restriction rights, the controller must notify every recipient to whom your personal data was disclosed, unless impossible or involving disproportionate effort. You have the right to be informed about those recipients.
Right to data portability under Article 20 GDPR: You have the right to receive personal data you provided in a structured, commonly used, machine-readable format or request transmission to another controller where technically feasible.
Right to withdraw consent under Article 7(3) GDPR: You may withdraw consent at any time with future effect. Following withdrawal, we will immediately delete the affected data unless further processing can rely on a legal basis that does not require consent. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.
Right to complain under Article 77 GDPR: If you consider that processing of your personal data infringes the GDPR, you may complain to a supervisory authority—particularly in the Member State of your residence, workplace or the alleged infringement—without prejudice to other administrative or judicial remedies.
13.2 RIGHT TO OBJECT
WHERE WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST FOLLOWING A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME, FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, TO OBJECT TO THIS PROCESSING WITH FUTURE EFFECT.
IF YOU OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE MAY CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR WHERE PROCESSING SERVES TO ESTABLISH, EXERCISE OR DEFEND LEGAL CLAIMS.
WHERE WE PROCESS YOUR PERSONAL DATA FOR DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO PROCESSING FOR SUCH ADVERTISING. YOU MAY OBJECT AS DESCRIBED ABOVE.
IF YOU OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT-ADVERTISING PURPOSES.
14) RETENTION PERIOD FOR PERSONAL DATA
The retention period for personal data is determined by the applicable statutory retention period, such as commercial and tax-law retention periods. Once that period expires, the relevant data is routinely deleted, provided it is no longer needed to perform or initiate a contract and we have no continuing legitimate interest in retaining it.