Privacy Policy
1) Introduction and Contact Details of the Data Controller
2) Data Collection When Visiting Our Website
2.1
The processing of this data is carried out in accordance with Article 6(1)(f) of the General Data Protection Regulation (GDPR) on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be disclosed to third parties or used for any other purpose. However, we reserve the right to review the server log files retrospectively if there are concrete indications of unlawful use.
2.2
For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries submitted to the data controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the "https://" prefix in your browser's address bar and the padlock icon displayed there.3) Hosting & Content Delivery Network
For the hosting of our website and the delivery of its content, we use a service provider that performs its services, either directly or through selected subcontractors, exclusively on servers located within the European Union.
All data collected on our website is processed on these servers.
We have concluded a Data Processing Agreement (DPA) with the service provider, ensuring the protection of our website visitors' data and prohibiting any unauthorized disclosure of such data to third parties.
4) Cookies
To make your visit to our website more attractive and to enable the use of certain features, we use cookies, which are small text files stored on your device. Some of these cookies are automatically deleted when you close your browser (so-called session cookies), while others remain on your device for a longer period and allow website settings to be saved (so-called persistent cookies). In the latter case, you can find the storage period in the overview of your web browser's cookie settings.
Where personal data is processed through individual cookies used by us, such processing is carried out in accordance with Article 6(1)(b) GDPR for the performance of a contract, Article 6(1)(a) GDPR where you have given your consent, or Article 6(1)(f) GDPR based on our legitimate interest in ensuring the best possible functionality of our website and providing a user-friendly and efficient browsing experience.
You can configure your browser to notify you whenever cookies are set, allowing you to decide on a case-by-case basis whether to accept them, or to refuse cookies for specific cases or in general.
Please note that if you choose not to accept cookies, the functionality of our website may be limited.
5) Contact
5.1 WhatsApp Business
You can contact us via the messaging service WhatsApp, provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For this purpose, we use the WhatsApp Business version of the service.
If you contact us via WhatsApp in connection with a specific business transaction (for example, an order you have placed), we will store and use the mobile phone number you use with WhatsApp and, if provided, your first and last name in accordance with Article 6(1)(b) GDPR for the purpose of processing and responding to your request. On the same legal basis, we may ask you via WhatsApp to provide additional information (such as your order number, customer number, address, or email address) in order to assign your inquiry to a specific transaction.
If you use our WhatsApp contact for general inquiries (for example, regarding our products and services, availability, or our website), we will store and use the mobile phone number you use with WhatsApp and, if provided, your first and last name in accordance with Article 6(1)(f) GDPR, based on our legitimate interest in providing the requested information efficiently and without delay.
Your data will be used exclusively to respond to your inquiry via WhatsApp. It will not be shared with third parties.
Please note that WhatsApp Business has access to the address book of the mobile device we use for this service and automatically transfers telephone numbers stored in the address book to a server operated by its parent company, Meta Platforms, Inc., in the United States. For the operation of our WhatsApp Business account, we use a mobile device whose address book contains only the WhatsApp contact details of users who have contacted us via WhatsApp.
This ensures that every person whose WhatsApp contact details are stored in our address book has already consented, upon first using the WhatsApp application on their device and by accepting the WhatsApp Terms of Service, to the transmission of their WhatsApp phone number from the address books of their chat contacts in accordance with Article 6(1)(a) GDPR. Accordingly, the transfer of data relating to users who do not use WhatsApp and/or have not contacted us via WhatsApp is excluded.
For information on the purpose and scope of data collection, as well as the further processing and use of data by WhatsApp, and your related rights and privacy settings, please refer to WhatsApp's Privacy Policy:
https://www.whatsapp.com/legal/?eea=1#privacy-policy
We have concluded a Data Processing Agreement (DPA) with the provider, ensuring the protection of our website visitors' data and prohibiting any unauthorized disclosure to third parties.
As part of the processing activities described above, personal data may be transferred to servers operated by Meta Platforms, Inc. in the United States.
For data transfers to the United States, the provider participates in the EU–U.S. Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision issued by the European Commission.
6) Data Processing When Creating a Customer Account
In accordance with Article 6(1)(b) GDPR, personal data will continue to be collected and processed to the extent necessary when you provide such data while creating a customer account. The data required for account registration can be found in the respective input form on our website.
You may request the deletion of your customer account at any time by sending a message to the data controller at the contact address provided above.
Once your customer account has been deleted, your personal data will also be deleted, provided that all contracts concluded through the account have been fully performed, no statutory retention obligations apply, and we have no legitimate interest in retaining the data further.
7) Use of Customer Data for Direct Marketing
7.1 Subscription to Our Email Newsletter
If you subscribe to our email newsletter, we will regularly send you information about our offers and promotions. The only mandatory information required for receiving the newsletter is your email address. Providing additional information is voluntary and is used to address you personally.
We use the double opt-in procedure for newsletter subscriptions. This ensures that you will only receive our newsletter after you have expressly confirmed your consent by clicking the verification link sent to the email address you provided.
By activating the confirmation link, you give us your consent to process your personal data in accordance with Article 6(1)(a) GDPR. In this context, we store the IP address assigned by your Internet Service Provider (ISP), as well as the date and time of your registration, in order to trace any possible misuse of your email address at a later date. The data collected during your newsletter registration will be used exclusively for the intended purpose.
You may unsubscribe from the newsletter at any time by clicking the unsubscribe link included in every newsletter or by sending a corresponding request to the data controller specified above. Once you have unsubscribed, your email address will be removed from our newsletter distribution list without delay, unless you have expressly consented to the continued use of your data or we are legally permitted to use your data for other purposes, about which we inform you in this Privacy Policy.
8) Data Processing for Order Fulfilment
8.1 General Information
To the extent necessary for the performance of the contract, in particular for delivery and payment purposes, the personal data collected by us will be transferred to the commissioned transport company and the payment institution in accordance with Article 6(1)(b) GDPR.
Where we are contractually obliged to provide updates for goods containing digital elements or for digital products, we process the contact details you provided when placing your order in order to inform you personally about such updates in accordance with our statutory information obligations pursuant to Article 6(1)(c) GDPR. Your contact details will be used exclusively for notifications regarding updates that we are legally or contractually required to provide and will only be processed to the extent necessary for this purpose.
For the fulfilment of your order, we also cooperate with the following service provider(s), who support us, in whole or in part, in the performance of our contractual obligations. Certain personal data will be transferred to these service providers in accordance with the information provided below.
8.2 Transfer of Personal Data to Shipping Service Providers
DHL
We use the following shipping service provider:
DHL Paket GmbH
Sträßchensweg 10
53113 Bonn
Germany
If you have expressly given your consent during the ordering process, we will provide your email address and/or telephone number to the shipping provider prior to delivery in accordance with Article 6(1)(a) GDPR, for the purpose of coordinating a delivery date or sending a delivery notification.
Otherwise, we will only transfer the recipient's name and delivery address to the shipping provider, as required for the delivery of the goods, in accordance with Article 6(1)(b) GDPR. The transfer is limited to the information necessary to complete the delivery. In this case, prior coordination of the delivery date or delivery notification by the shipping provider is not possible.
You may withdraw your consent at any time with future effect by notifying either the data controller named above or the shipping service provider.
8.3 Use of Payment Service Providers (Payment Services)
Apple Pay
If you choose the Apple Pay payment method provided by Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment processing is carried out via the Apple Pay function on your device running iOS, watchOS, or macOS by charging the payment card stored in Apple Pay. Apple Pay uses security features built into your device's hardware and software to protect your transactions. To authorize a payment, you must enter a code previously defined by you and verify the transaction using your device's Face ID or Touch ID feature.
For the purpose of processing your payment, the information you provide during the ordering process, together with information about your order, is transmitted to Apple in encrypted form. Apple then encrypts this data again using a developer-specific key before transmitting it to the payment service provider of the payment card stored in Apple Pay to complete the payment. This encryption ensures that only the website through which the purchase was made can access the payment data. After the payment has been completed, Apple sends your device account number and a transaction-specific dynamic security code to the originating website to confirm the successful payment.
Where personal data is processed as part of the data transfers described above, such processing is carried out solely for the purpose of payment processing in accordance with Article 6(1)(b) GDPR.
Apple retains anonymized transaction data, including the approximate purchase amount, the approximate date and time of the transaction, and whether the transaction was successfully completed. This anonymization completely eliminates any personal reference. Apple uses this anonymized data to improve Apple Pay and other Apple products and services.
If you use Apple Pay on your iPhone or Apple Watch to complete a purchase that you initiated in Safari on your Mac, the Mac and the authorization device communicate via an encrypted channel through Apple's servers. Apple does not process or store any of this information in a format that can identify you personally. You can disable the ability to use Apple Pay on your Mac in your iPhone settings. Go to Wallet & Apple Pay and disable Allow Payments on Mac.
Further information about data protection in connection with Apple Pay can be found at:
https://support.apple.com/en-us/HT203027
Google Pay
If you choose the Google Pay payment method provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), payment processing is carried out via the Google Pay application on your mobile device running at least Android 4.4 ("KitKat") and equipped with NFC functionality by charging a payment card stored in Google Pay or another verified payment method (e.g., PayPal). To authorize a Google Pay payment exceeding €25.00, you must first unlock your mobile device using the verification method you have configured (such as facial recognition, password, fingerprint, or pattern).
For the purpose of processing your payment, the information you provide during the ordering process, together with information about your order, is transmitted to Google. Google then forwards your payment information stored in Google Pay to the originating website in the form of a unique transaction number that verifies the completed payment. This transaction number does not contain any information about the actual payment details of the payment methods stored in Google Pay. Instead, it is created and transmitted as a unique, one-time numerical token. For all transactions made via Google Pay, Google acts solely as an intermediary for processing the payment. The transaction itself is carried out exclusively between the user and the originating website by charging the payment method stored in Google Pay.
Where personal data is processed as part of the data transfers described above, such processing is carried out solely for the purpose of payment processing in accordance with Article 6(1)(b) GDPR.
Google reserves the right to collect, store, and evaluate certain transaction-specific information for every transaction made via Google Pay. This includes the date, time, and amount of the transaction, the merchant's location and description, a description of the purchased goods or services provided by the merchant, photos you have attached to the transaction, the name and email address of the seller and buyer or sender and recipient, the payment method used, your description of the reason for the transaction, and, where applicable, any offer associated with the transaction.
According to Google, this processing is carried out exclusively in accordance with Article 6(1)(f) GDPR on the basis of Google's legitimate interest in proper accounting, verification of transaction data, and the optimization and maintenance of the Google Pay service.
Google also reserves the right to combine the processed transaction data with other information collected and stored by Google when you use other Google services.
The Google Pay Terms of Service are available at:
Further information about data protection in connection with Google Pay can be found at:
https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en
PayPal
This website offers one or more online payment methods provided by the following payment service provider:
PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg
If you select a payment method offered by the provider that requires payment in advance, the payment data you provide during the ordering process (including your name, address, bank and payment card details, currency, and transaction number), as well as information relating to your order, will be transmitted to the provider in accordance with Article 6(1)(b) GDPR. Your data will be transferred solely for the purpose of processing the payment and only to the extent necessary for this purpose.
If you choose a payment method where we provide services in advance, you will also be asked during the ordering process to provide certain personal information (such as your first and last name, street address, house number, postal code, city, date of birth, email address, telephone number, and, where applicable, details of an alternative payment method).
In order to safeguard our legitimate interest in assessing your creditworthiness in such cases, we will transmit this data to the payment provider for the purpose of a credit assessment in accordance with Article 6(1)(f) GDPR. Based on the personal data you provide and additional information (such as your shopping cart, invoice amount, order history, and previous payment experience), the provider will assess whether the selected payment method can be granted with regard to payment and default risks.
The credit assessment may include probability values (so-called score values). Where score values are incorporated into the result of the credit assessment, they are based on scientifically recognized mathematical and statistical methods. Address data may be included among the factors used to calculate these score values.
You may object to this processing of your personal data at any time by notifying either us or the payment service provider. However, the provider may still be entitled to process your personal data if this is necessary for the contractual processing of payments.
8.4 Electronic Right of Withdrawal for Distance Selling Contracts
Consumers who conclude contracts via this website and who are entitled to a statutory right of withdrawal have the option of exercising this right by means of an electronic withdrawal function, in accordance with the applicable statutory withdrawal provisions.
When using the electronic withdrawal function, consumers must provide or confirm information required to identify the contract to be withdrawn, as well as certain personal data such as their first and last name and email address.
The collection and transmission of this information to us are carried out in accordance with Article 6(1)(b) GDPR and only to the extent necessary for the proper processing of the withdrawal request. On the same legal basis, the personal data provided will also be used to confirm receipt of the withdrawal declaration by email.
An additional legal basis for this processing is Article 6(1)(c) GDPR. We are legally required to provide an electronic withdrawal function for distance selling contracts concluded with consumers for consideration.
9) Web Analytics Services
9.1 Google Analytics 4
This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland ("Google"), which enables us to analyze your use of our website.
By default, Google Analytics 4 does not use cookies when you visit this website unless you have explicitly consented to the use of cookies. Instead, information about your usage behavior is collected and processed by means of so-called pings (small data packets sent to the host of an end device). This information also includes your IP address, which is shortened by Google by removing the last digits to prevent direct identification of individuals.
The information is transmitted to Google's servers and processed there. This may also involve transfers to Google LLC in the United States.
Google processes this information on our behalf to evaluate your use of the website, compile reports on website activity, and provide other services related to website and internet usage. The shortened IP address transmitted by your browser within the scope of Google Analytics is not combined with other Google data. The data collected through Google Analytics 4 is stored for two months and then deleted.
All processing activities described above, including the transmission of data via pings and the possible setting of Google Analytics cookies, are carried out only if you have given your explicit consent pursuant to Art. 6 (1) (a) GDPR.
Without your consent, Google Analytics 4 will not be used during your visit to the website. You may withdraw your consent at any time with future effect by disabling this service via the Cookie Consent Tool provided on the website.
We have concluded a Data Processing Agreement (DPA) with Google to ensure the protection of our website visitors' data and to prevent unauthorized disclosure to third parties.
Further legal information about Google Analytics 4 can be found at:
- https://business.safety.google/intl/en/privacy/
- https://policies.google.com/privacy
- https://policies.google.com/technologies/partner-sites
Demographic Features
Google Analytics 4 uses the Demographic Features function to generate statistics regarding the age, gender, and interests of website visitors. This is based on the analysis of advertising data and information from third-party providers. These statistics help identify target groups for marketing activities. However, the collected data cannot be assigned to any specific individual and is deleted after being stored for two months.
Google Signals
As an extension of Google Analytics 4, this website may use Google Signals to generate cross-device reports.
If you have enabled personalized ads and linked your devices to your Google account, Google may, subject to your consent pursuant to Art. 6 (1) (a) GDPR, analyze your usage behavior across devices and create database models, including cross-device conversion reports.
We do not receive any personal data from Google, only aggregated statistics.
If you wish to disable cross-device analysis, you can turn off Personalized Advertising in your Google account settings.
Further information about Google Signals is available at:
https://support.google.com/analytics/answer/7532985
User IDs
As an extension of Google Analytics 4, this website may use the User IDs feature.
If you have consented to the use of Google Analytics 4 pursuant to Art. 6 (1) (a) GDPR, created an account on this website, and log in to that account from different devices, your activities, including conversions, may be analyzed across devices.
For data transfers to the United States, Google participates in the EU-U.S. Data Privacy Framework, which ensures compliance with European data protection standards based on the adequacy decision of the European Commission.
9.2 Shopware Analytics
This website uses the web analytics service provided by:
shopware AG
Ebbinghoff 10
48624 Schöppingen
Germany
Based on joint responsibility pursuant to Art. 26 GDPR, we and the service provider collect and store pseudonymized visitor data using cookies and/or comparable technologies (tracking pixels, web beacons, algorithms for reading device and browser information). This includes information about the device used, such as browser details, to analyze user behavior statistically and create pseudonymized user profiles.
Among other things, this enables the evaluation of movement patterns (heat maps) showing the duration of page visits and interactions with website content (e.g., text input, scrolling, clicks, and mouse movements). Pseudonymization generally excludes direct identification of individuals. No combination with other personally identifiable data collected by other means takes place.
All of the above processing activities, particularly the reading or storing of information on the user's device, are carried out only if you have given your explicit consent pursuant to Art. 6 (1) (a) GDPR. You may withdraw your consent at any time with future effect by disabling this service via the Cookie Consent Tool provided on the website.
10) Tools and Miscellaneous
Cookie Consent Tool
This website uses a Cookie Consent Tool to obtain legally valid user consent for cookies and cookie-based applications requiring consent.
The tool is displayed to users as an interactive interface when they visit the website, allowing them to grant consent for specific cookies and/or cookie-based applications by selecting the appropriate checkboxes.
Only after the user has granted consent are the corresponding cookies and services loaded. This ensures that cookies requiring consent are placed on the user's device only after such consent has been given.
The tool uses technically necessary cookies to store your cookie preferences. Personal data is generally not processed in this context.
If, in individual cases, personal data (such as the IP address) must be processed for storing, assigning, or documenting cookie settings, this is done pursuant to Art. 6 (1) (f) GDPR based on our legitimate interest in legally compliant, user-friendly consent management.
An additional legal basis for processing is Art. 6 (1) (c) GDPR, as we are legally obliged to make the use of non-essential cookies dependent on the user's consent.
Where required, we have concluded a Data Processing Agreement with the service provider to ensure the protection of visitors' data and prevent unauthorized disclosure to third parties.
Further information about the operator and configuration options of the Cookie Consent Tool can be found directly within the corresponding interface on our website.
11) Rights of the Data Subject
11.1 Rights under the GDPR
Applicable data protection law grants you the following rights with respect to the processing of your personal data by the controller, subject to the respective legal requirements:
- Right of access pursuant to Art. 15 GDPR
- Right to rectification pursuant to Art. 16 GDPR
- Right to erasure pursuant to Art. 17 GDPR
- Right to restriction of processing pursuant to Art. 18 GDPR
- Right to be informed pursuant to Art. 19 GDPR
- Right to data portability pursuant to Art. 20 GDPR
- Right to withdraw consent granted pursuant to Art. 7 (3) GDPR
- Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR
11.2 Right to Object
Where we process your personal data on the basis of our overriding legitimate interest following a balancing of interests, you have the right to object to such processing at any time with future effect on grounds relating to your particular situation.
If you exercise your right to object, we will stop processing the personal data concerned. However, we reserve the right to continue processing if we can demonstrate compelling legitimate grounds for the processing which override your interests, fundamental rights and freedoms, or if the processing serves the establishment, exercise, or defense of legal claims.
Where your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes. You may exercise your right to object as described above.
If you exercise your right to object, we will cease processing your personal data for direct marketing purposes.
12) Retention Period of Personal Data
The retention period for personal data is determined by the applicable legal basis, the purpose of the processing, and—where relevant—the applicable statutory retention periods (e.g., retention periods under commercial or tax law).
Where personal data is processed on the basis of your explicit consent pursuant to Art. 6 (1) (a) GDPR, such data will be stored until you withdraw your consent.
Where statutory retention periods apply to data processed within the scope of contractual or quasi-contractual obligations pursuant to Art. 6 (1) (b) GDPR, such data will be routinely deleted after the expiry of the applicable retention periods, provided that it is no longer required for the performance or initiation of the contract and that we no longer have a legitimate interest in retaining it.
Where personal data is processed on the basis of Art. 6 (1) (f) GDPR, such data will be stored until you exercise your right to object pursuant to Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.
Where personal data is processed for direct marketing purposes on the basis of Art. 6 (1) (f) GDPR, such data will be stored until you exercise your right to object pursuant to Art. 21 (2) GDPR.
Unless otherwise stated in the specific information contained in this Privacy Policy regarding individual processing activities, personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.
