Privacy policy

1. Access data and hosting

You can visit our web pages without providing any information about yourself. Each time a web page is accessed, the web server automatically stores a so-called server log file, which contains, for example, the name of the requested file, your IP address, date and time of access, data volume transferred and the requesting provider (access data) and documents the access. These access data are evaluated exclusively for the purpose of ensuring trouble-free operation of the site and improving our offering. This serves to safeguard our overriding legitimate interests in a correct presentation of our offering within the framework of a balancing of interests pursuant to Art. 6(1)(f) GDPR. All access data are deleted no later than seven days after the end of your visit to the site. All access data are only processed for as long as is necessary to achieve the processing purposes mentioned above.

1.1 Hosting

Services for hosting and displaying the website are partly provided by our service providers within the scope of processing on our behalf. Unless otherwise explained in this privacy policy, all access data and all data collected in the forms provided for this purpose on this website are processed on their servers. If you have any questions about our service providers and the basis of our cooperation with them, please contact the contact option described in this privacy policy.

1.2 Content Delivery Network

For the purpose of shorter loading times, we use a so-called content delivery network (“CDN”) for some offerings. With this service, content, e.g. large media files, is delivered via regionally distributed servers of external CDN service providers. Access data are therefore processed on the service providers’ servers. Our service providers act for us within the scope of processing on our behalf.

Our service providers are based and/or use servers in countries outside the EU and the EEA. There is no adequacy decision by the European Commission for these countries. Our cooperation with them is based on the European Commission’s standard contractual clauses.

If you have any questions about our service providers and the basis of our cooperation with them, please contact the contact option described in this privacy policy.

2. Data processing for contract handling and contact

2.1 Data processing for contract handling

For the purpose of processing the contract (including enquiries about and handling of any existing claims under warranty, non-performance and the right of withdrawal as well as any statutory update obligations) pursuant to Art. 6(1)(b) GDPR, we collect personal data when you voluntarily provide these to us in the course of your order. Mandatory fields are marked as such, because in these cases we necessarily require the data to process the contract and, without their provision, we cannot dispatch the order. Which data are collected can be seen from the respective input forms.

Further information on the processing of your data, in particular on disclosure to our service providers for the purpose of order, payment and dispatch processing, can be found in the following sections of this privacy policy. After complete performance of the contract, your data are restricted for further processing and deleted after expiry of the tax and commercial retention periods pursuant to Art. 6(1)(c) GDPR, unless you have expressly consented to further use of your data pursuant to Art. 6(1)(a) GDPR or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this notice.

Merchandise management system

For order and contract processing, we use merchandise management systems of external service providers. Our service providers act for us within the scope of processing on our behalf. If you have any questions about our service providers and the basis of our cooperation with them, please contact the contact option described in this privacy policy.

2.2 Customer account

If you have given your consent pursuant to Art. 6(1)(a) GDPR by choosing to open a customer account, we use your data for the purpose of opening the customer account and storing your data for future orders on our website. You can delete your customer account at any time, either by sending a message to the contact option described in this privacy policy or via a function provided for this purpose in the customer account. After deletion of your customer account, your data will be deleted, unless you have expressly consented to further use of your data pursuant to Art. 6(1)(a) GDPR or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this notice.

2.3 Contact

As part of customer communication, we collect personal data to process your enquiries pursuant to Art. 6(1)(b) GDPR when you voluntarily provide these to us when contacting us (e.g. via contact form, live chat tool or email). Mandatory fields are marked as such, because in these cases we necessarily require the data to process your contact enquiry. Which data are collected can be seen from the respective input forms. After fully processing your enquiry, your data will be deleted, unless you have expressly consented to further use of your data pursuant to Art. 6(1)(a) GDPR or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this notice.

3. Data processing for the purpose of dispatch processing

For the performance of the contract pursuant to Art. 6(1)(b) GDPR, we pass your data on to the shipping service provider commissioned with the delivery, insofar as this is necessary for the delivery of ordered goods. If you have any questions about our service providers and the basis of our cooperation with them, please contact the contact option described in this privacy policy.

3.1 Transfer of data to shipping service providers for shipping notification

If you have given us your express consent to this during or after your order, we will transfer your email address and telephone number to the selected shipping service provider on the basis of this consent pursuant to Art. 6(1)(a) GDPR so that they can contact you prior to delivery for the purpose of delivery notification or coordination.

You may withdraw your consent at any time by sending a message to the contact option described in this privacy policy. After withdrawal, we delete the data you provided for this purpose, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this notice. If you have any questions about our service providers and the basis of our cooperation with them, please contact the contact option described in this privacy policy.

4. Data processing for payment processing

For processing payments in our online shop, we work with the following partners: technical service providers, credit institutions, payment service providers.

4.1 Data processing for transaction handling

Depending on the selected payment method, we transfer the data necessary for processing the payment transaction to our technical service providers or to the commissioned credit institutions or to the selected payment service provider, insofar as this is necessary for processing the payment. This serves the performance of the contract pursuant to Art. 6(1)(b) GDPR. In some cases, the payment service providers collect the data required for processing the payment themselves, e.g. on their own website or via a technical integration in the order process. The respective payment service provider’s privacy policy applies in this respect.

Depending on the selected payment method, data may be transferred to third countries outside the EU/EEA, for which the European Commission has determined an adequate level of data protection by decision. Insofar as data are transferred to third countries outside the EU/EEA for which the European Commission has not issued a decision on an adequate level of data protection, cooperation is based on the European Commission’s standard contractual clauses.

If you have questions about our partners for payment processing or the basis of our cooperation with them, please contact the contact option stated in this privacy policy.

4.2 Data processing for the purpose of fraud prevention and optimisation of our payment processes

Where applicable, we pass on additional data to the aforementioned service providers, which they use, together with the data necessary for processing the payment, for the purpose of fraud prevention and the optimisation of our payment processes (e.g. invoicing, handling disputed payments, supporting accounting). This serves, pursuant to Art. 6(1)(f) GDPR, to safeguard our overriding legitimate interests in protecting ourselves against fraud and in efficient payment management.

4.3 Identity and credit check when selecting Klarna payment services

Purchase on account via Klarna

If you decide to use payment services of Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter Klarna), we ask for your consent pursuant to Art. 6(1)(a) GDPR to transmit to Klarna the data necessary for processing the payment and for an identity and credit check. In Germany, the credit agencies named in the Klarna privacy policy (opens in a new window) may be used for identity and credit checks. Klarna uses the information received about the statistical probability of a payment default for a balanced decision about the establishment, execution or termination of the contractual relationship. You can withdraw your consent at any time by sending a message to the contact option stated in this privacy policy. This may result in us no longer being able to offer you certain payment options. You can also withdraw your consent to this use of personal data at any time vis-à-vis Klarna.

5. Advertising by email

5.1 Email newsletter with registration; newsletter tracking with separate consent

If you subscribe to our newsletter, we use the data required for this purpose or provided separately by you to send you our email newsletter regularly on the basis of your consent pursuant to Art. 6(1)(a) GDPR. You can unsubscribe from the newsletter at any time, either by sending a message to the contact option described below or via a link provided for this purpose in the newsletter. After unsubscribing, we delete your email address from the recipient list, unless you have expressly consented to further use of your data pursuant to Art. 6(1)(a) GDPR or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this notice.

If, in addition, you have given us your consent pursuant to Art. 6(1)(a) GDPR to analyse our newsletters, we also analyse your handling of our newsletter by measuring, storing and evaluating opening and click rates for the purpose of designing future newsletter campaigns (“newsletter tracking”).

For this evaluation, the emails sent contain single-pixel technologies (e.g. so-called web beacons, tracking pixels) that are stored on our website. For the evaluations, we link in particular the following “newsletter data”

• the page from which the page was requested (so-called referrer URL),
• the date and time of access,
• a description of the type of web browser used,
• the IP address of the requesting computer,
• the email address,
• the date and time of registration and confirmation

and the single-pixel technologies with your email address or your IP address and, where applicable, an individual ID. Links contained in the newsletter may also contain this ID.

You can unsubscribe from newsletter tracking at any time, either by sending a message to the contact option described or via a link provided for this purpose in the newsletter. The information is stored for as long as you are subscribed to the newsletter.

5.2 Email newsletter without registration and your right to object

When we receive your email address in connection with the sale of a good or service, we reserve the right to send you regular offers by email for similar products from our range to those already purchased. We will not send you such offers if you have already objected to this use of your email address or are listed in a Robinson list that must be observed by law.

You can object to this use of your email address at any time easily and free of charge by sending a message to the contact option described in this privacy policy or via a link provided for this purpose in the marketing email, i.e. without incurring any costs other than the transmission costs according to the basic rates. After unsubscribing, we delete your email address from the recipient list, unless you have expressly consented to further use of your data pursuant to Art. 6(1)(a) GDPR or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this notice.

5.3 Newsletter dispatch

The newsletter and the newsletter tracking described above may also be sent by our service providers within the scope of processing on our behalf. If you have any questions about our service providers and the basis of our cooperation with them, please contact the contact option described in this privacy policy.

Our service providers are based and/or use servers in the following countries for which the European Commission has determined an adequate level of data protection by decision: USA, Canada.

There is an adequacy decision by the European Commission for the USA as a basis for a third-country transfer, insofar as the respective service provider is certified. Until our service providers are certified, the data transfer will continue to be based on the following basis: the European Commission’s standard contractual clauses.

Our service providers are based and/or use servers in these countries: India. For this country, there is no adequacy decision by the European Commission. Our cooperation with them is based on the following safeguards: the European Commission’s standard contractual clauses.

5.4 Sending review requests by email

If you have given us your express consent for this during or after your order pursuant to Art. 6(1)(a) GDPR, we will use your email address to request a review of your order via the review system we use. You can withdraw this consent at any time by sending a message to the contact option described in this privacy policy or via a link provided for this purpose in the review request. After you have withdrawn your consent, we delete your email address from the recipient list, unless you have expressly consented to further use of your data pursuant to Art. 6(1)(a) GDPR or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this notice.

The review requests may also be sent by our service provider Trusted Shops SE, Subbelrather Str. 15C, 50823 Cologne (“Trusted Shops”).

In the course of sending review requests, we receive information about the respective status from Trusted Shops (e.g. whether the review request was sent and whether it arrived). This is done pursuant to Art. 6(1)(f) GDPR to fulfil our legitimate interest in receiving information about review invitations in order to make optimisations where appropriate on that basis, and to fulfil Trusted Shops’ legitimate interest in being able to offer this service.

We are jointly responsible with Trusted Shops for sending review requests and for collecting and displaying review or status information.

Within the framework of the joint controllership between us and Trusted Shops, please preferably contact Trusted Shops for data protection questions and to assert your rights; you can find their contact options in their privacy notices (opens in a new window). You can find further information on data protection in the membership terms (PDF, opens in a new window). Irrespective of this, you can always also contact us via the contact option described in this privacy policy. Your enquiry will then, if necessary, be forwarded to the other controller for response.

6. Cookies and other technologies

6.1 General information

To make visiting our website attractive and to enable the use of certain functions, we use technologies on various pages, including so-called cookies. Cookies are small text files that are automatically stored on your end device. Some of the cookies we use are deleted again after the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your end device and enable us to recognise your browser the next time you visit (persistent cookies). You can find the storage duration in the overview in your web browser’s cookie settings.

Protection of privacy on end devices

When using our online offering, we use strictly necessary technologies to be able to provide the expressly requested digital service. In this respect, storing information on your end device or accessing information already stored on your end device does not require consent.

For non-essential functions, storing information on your end device or accessing information already stored on your end device requires your consent. We would like to point out that if consent is not granted, parts of the website may not be fully usable. Any consents you have granted remain in place until you adjust or reset the respective settings on your end device.

Any subsequent data processing by cookies and other technologies

We use technologies that are strictly necessary for the use of certain functions of our website. Through these technologies, the IP address, time of visit, device and browser information as well as information on your use of our website are collected and processed. This serves, within the framework of a balancing of interests, to safeguard overriding legitimate interests in an optimised presentation of our offering pursuant to Art. 6(1)(f) GDPR.

We also use technologies to fulfil the legal obligations to which we are subject (e.g. to be able to prove consents to the processing of your personal data) as well as for web analysis and online marketing. Further information on this, including the respective legal basis for data processing, can be found in the following sections of this privacy policy.

Cookie settings

You can find the cookie settings for your browser at the following links:

• Microsoft Edge (opens in a new window)
• Safari (opens in a new window)
• Chrome (opens in a new window)
• Firefox (opens in a new window)
• Opera (opens in a new window)

Insofar as you have consented to the use of the technologies pursuant to Art. 6(1)(a) GDPR, you can withdraw your consent at any time by sending a message to the contact option described in the privacy policy. Alternatively, you can also access your cookie settings via the link in the footer.

6.2 Consent Manager Platform (CMP)

On our website, we use a consent management service (“Consent Manager Platform (CMP)”) to inform you about the cookies and other technologies we use on our website and to obtain, manage and document your consent where required for the processing of your personal data by these technologies. This is necessary pursuant to Art. 6(1)(c) GDPR to comply with our legal obligation under Art. 7(1) GDPR to be able to prove your consent to the processing of your personal data. The Consent Manager Platform (CMP) used is an offering by Papoo Software & Media GmbH, Auguststr. 4, 53229 Bonn, Germany, which processes your data on our behalf.

After you submit your cookie declaration on our website, the web server stores the following data: IP address, device information, browser information, language set, the website called up or its URL, date and time of your declaration of consent as well as information about your consent behaviour.

In addition, the following technologies are used, which contain information about your consent behaviour: cookies.

Your data are deleted after one year, unless you have expressly consented to further use of your data pursuant to Art. 6(1)(a) GDPR or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this notice.

7. Use of cookies and other technologies

We use the following cookies and other technologies from third-party providers on our website. Unless otherwise stated for the individual technologies, this is done on the basis of your consent pursuant to Art. 6(1)(a) GDPR. After the purpose ceases to apply and after we end the use of the respective technology, the data collected in this context are deleted. You can withdraw your consent at any time with effect for the future. For further information on your withdrawal options, please see the section “Cookies and other technologies”. Further information, including the basis of our cooperation with the individual providers, can be found with the individual technologies. If you have any questions about the providers and the basis of our cooperation with them, please contact the contact option described in this privacy policy.

7.1 Use of Google services

We use the technologies of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) described below. The information about your use of our website automatically collected through Google technologies is generally transmitted to a server of Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA and stored there. Unless otherwise stated for the individual technologies, data are processed on the basis of an agreement between joint controllers pursuant to Art. 26 GDPR. You can find further information about data processing by Google in Google’s privacy notices (opens in a new window).

Our service providers are based and/or use servers in countries outside the EU and the EEA for which the European Commission has determined an adequate level of data protection by decision.

Our service providers are based and/or use servers in countries outside the EU and the EEA. There is no adequacy decision by the European Commission for these countries. Our cooperation with them is based on the European Commission’s standard contractual clauses.

Google Analytics

For the purpose of website analysis, data (IP address, time of visit, device and browser information as well as information about your use of our website) are automatically collected and stored with Google Analytics, from which usage profiles are created using pseudonyms. Cookies may be used for this purpose. If you visit our website from the EU, your IP address is stored on a server located in the EU to derive location data and then immediately deleted before the traffic is forwarded to other Google servers for processing. Data are processed on the basis of a data processing agreement by Google.

For the purpose of optimised marketing of our website, we have activated the data sharing settings for “Google products and services”. This allows Google to access the data collected and processed by Google Analytics and subsequently use them to improve Google services. Data sharing with Google within the scope of these data sharing settings is based on an additional agreement between controllers. We have no influence on the subsequent data processing by Google.

For the purpose of optimised marketing of our website, we use the so-called User ID function. With this function, we can assign a unique, permanent ID to your interaction data from one or more sessions on our online presences and thus analyse your user behaviour across devices and sessions.

For web analysis, the Google Signals extension of Google Analytics enables so-called cross-device tracking. Insofar as your internet-enabled devices are linked to your Google account and you have activated the “personalised advertising” setting in your Google account, Google can create reports on your usage behaviour (in particular the numbers of users across devices), even if you change your end device. No processing of personal data by us takes place in this respect; we only receive statistics created on the basis of Google Signals.

For web analysis and advertising purposes, the DoubleClick cookie extension of Google Analytics enables your browser to be recognised when visiting other websites. Google will use this information to compile reports on website activity and to provide other services related to website usage.

If you do not give us consent pursuant to Art. 6(1)(a) GDPR to use Google Analytics, no cookies will be stored on or read from your device. The data processing described in the preceding paragraphs will not take place. To close gaps in web analytics by behavioural and conversion modelling, pings with data (user agent, information about your consent behaviour, screen resolution, IP address) are sent to Google.

Google Ads

For advertising purposes in Google search results and on third-party websites, when you visit our website the so-called Google Remarketing cookie is set, which automatically enables interest-based advertising by collecting and processing data (IP address, time of visit, device and browser information as well as information about your use of our website) using a pseudonymous cookie ID and on the basis of the pages you have visited. Further data processing only takes place if you have activated the “personalised advertising” setting in your Google account. If you are logged into Google during your visit to our website in this case, Google uses your data together with Google Analytics data to create and define target group lists for cross-device remarketing.

For website analysis and event tracking, we measure your subsequent usage behaviour via Google Ads Conversion Tracking when you have reached our website via a Google Ads advert. Cookies may be used for this purpose and data (IP address, time of visit, device and browser information as well as information about your use of our website on the basis of events specified by us such as visiting a web page or subscribing to a newsletter) may be collected, from which usage profiles are created using pseudonyms.

If you do not give us consent pursuant to Art. 6(1)(a) GDPR to use Google Ads, no cookies will be stored on or read from your device. The data processing described in the preceding paragraphs will not take place. To close gaps in web analytics by behavioural and conversion modelling, pings with data (user agent, information about your consent behaviour, screen resolution, IP address, page URL, information on ad clicks in URL parameters) are sent to Google. Your IP address is used to derive the IP country.

Google Tag Manager

Google Tag Manager allows us to manage various codes and services on our website. When implementing the individual tags, Google may also process personal data (e.g. IP address, online identifiers (including cookies)). Data are processed on the basis of a data processing agreement by Google.

By using Google Tag Manager, various services/technologies can be integrated. If you do not wish to use individual tracking services and have therefore deactivated them, the deactivation remains in effect for all affected tracking tags that are integrated via Google Tag Manager.

YouTube Video Plugin

To embed third-party content, data (IP address, time of visit, device and browser information) are collected via the YouTube Video Plugin in the enhanced privacy mode we use, transmitted to Google and then processed by Google only when you play a video.

7.2 Use of Microsoft services

We use the technologies of Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (“Microsoft”) described below. Data are processed on the basis of an agreement between joint controllers pursuant to Art. 26 GDPR. The information about your use of our website automatically collected through Microsoft technologies is generally transmitted to a server of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA and stored there. You can find further information about data processing by Microsoft in Microsoft’s privacy notices (opens in a new window).

Our service providers are based and/or use servers in countries outside the EU and the EEA for which the European Commission has determined an adequate level of data protection by decision.

Our service providers are based and/or use servers in countries outside the EU and the EEA. There is no adequacy decision by the European Commission for these countries. Our cooperation with them is based on the European Commission’s standard contractual clauses.

Microsoft Advertising

For advertising purposes in Bing, Yahoo and MSN search results as well as on third-party websites, when you visit our website the so-called Microsoft Advertising Remarketing cookie is set, which automatically enables interest-based advertising by collecting and processing data (IP address, time of visit, device and browser information as well as information about your use of our website) using a pseudonymous cookie ID and on the basis of the pages you have visited.

For website analysis and event tracking, we measure your subsequent usage behaviour via Microsoft Advertising Universal Event Tracking (UET) when you have reached our website via a Microsoft Advertising advert. Cookies may be used for this purpose and data (IP address, time of visit, device and browser information as well as information about your use of our website on the basis of events specified by us such as visiting a web page or subscribing to a newsletter) may be collected, from which usage profiles are created using pseudonyms. Insofar as your internet-enabled devices are linked to your Microsoft account and you have not deactivated the “interest-based advertising” setting in your Microsoft account, Microsoft can create reports on usage behaviour (in particular the numbers of users across devices) even if you change your end device, so-called “cross-device tracking”. No processing of personal data takes place by us in this respect; we only receive statistics created on the basis of Microsoft UET.

7.3 Use of Meta services

Use of Meta Pixel

We use the Meta Pixel within the scope of the technologies described below of Meta Platforms Ireland Ltd. (opens in a new window), Block J, Serpentine Avenue, Dublin 4, Ireland (“Facebook (by Meta)” or “Meta Platforms Ireland”). With the Meta Pixel, data (IP address, time of visit, device and browser information as well as information about your use of our website on the basis of events specified by us such as visiting a web page or subscribing to a newsletter) are automatically collected and stored, from which usage profiles are created using pseudonyms. As part of the so-called advanced matching, information hashed for matching purposes is also collected and stored, with which individuals can be identified (e.g. names, email addresses and telephone numbers). When you visit our website, a cookie is automatically set by the Meta Pixel, which automatically enables a pseudonymous cookie ID to recognise your browser when visiting other websites. Meta Platforms Ireland will combine this information with further data from your Facebook account and use it to compile reports on website activity and to provide other services related to website usage, in particular personalised and group-based advertising.

The information about your use of our website automatically collected through the technologies of Meta Platforms Ireland is generally transmitted to a server of Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025, USA and stored there. You can find further information about data processing by Meta Platforms Ireland in the privacy notices of Meta Platforms Ireland (opens in a new window).

Our service providers are based and/or use servers in the following countries for which the European Commission has determined an adequate level of data protection by decision: Brazil, USA, Canada, Japan, South Korea, New Zealand, United Kingdom, Argentina.

The adequacy decision for the USA applies as a basis for the third-country transfer, insofar as the respective service provider is certified. Certification is in place.

Our service providers are based and/or use servers in these countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Mexico. There is no adequacy decision by the European Commission for these countries. Our cooperation with them is based on the following safeguards: the European Commission’s standard contractual clauses.

Meta Ads Manager

Via Meta Ads Manager we advertise for this website on Facebook (by Meta) and on other platforms. We determine the parameters of the respective advertising campaign. The precise implementation, in particular the decision on the placement of the adverts with individual users, is the responsibility of Meta Platforms Ireland. Unless otherwise stated for the individual technologies, data are processed on the basis of an agreement between joint controllers pursuant to Art. 26 GDPR. The joint controllership is limited to the collection of data and their transmission to Meta Platforms Ireland. The subsequent data processing by Meta Platforms Ireland is not covered by this.

On the basis of the statistics of visitor activities on our website created via Custom Audiences, we carry out group-based advertising on Facebook (by Meta) by determining the characteristics of the respective target group. Within the scope of the advanced matching taking place to determine the respective target group (see above), Meta Platforms Ireland acts as our processor.

On the basis of the pseudonymous cookie ID set by the Meta Pixel and the data collected about your usage behaviour on our website, we carry out personalised advertising via Custom Audiences.

Via Conversions (via Meta Pixel or Conversions API), we measure your subsequent usage behaviour for web analysis and event tracking when you have reached our website via an advert from Meta Ads Manager. Data are processed on the basis of a processing agreement by Meta Platforms Ireland.

7.4 Other providers of web analysis and online marketing services

Use of etracker for web analysis

For the purpose of website analysis, data (IP address, time of visit, device and browser information as well as information about your use of our website) are automatically collected and stored with technologies of etracker GmbH (opens in a new window), Erste Brunnenstraße 1, 20459 Hamburg, Germany (“etracker”), from which usage profiles are created using pseudonyms. Cookies may be used for this purpose. The pseudonymised usage profiles are not merged with personal data about the bearer of the pseudonym without separate, express consent. etracker acts for us on our behalf.

Use of the Vimeo video plugin to embed third-party content

To embed third-party content, data (IP address, time of visit, device and browser information) are collected via the video plugin of Vimeo (opens in a new window) Inc., 330 West 34th Street, 5th Floor, New York 10011, USA (“Vimeo”), transmitted to Vimeo and then processed by Vimeo. Data are processed on the basis of an agreement between joint controllers pursuant to Art. 26 GDPR. Google Analytics is automatically integrated into the Vimeo video plugin. For the purpose of website analysis, data (IP address, time of visit, device and browser information as well as information about your use of our website) are automatically collected and stored with Google Analytics, from which usage profiles are created using pseudonyms. Cookies may be used for this purpose. Google Analytics is an offering by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The information about your use of our website automatically collected by Google is generally transmitted to a server of Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA and stored there. If you visit our website from the EU, your IP address is stored on a server located in the EU to derive location data and then immediately deleted before the traffic is forwarded to other Google servers for processing. We have no influence or access to the data processing by Vimeo, including the settings and the results of Google Analytics.

Our service providers are based and/or use servers in countries outside the EU and the EEA for which the European Commission has determined an adequate level of data protection by decision.

Our service providers are based and/or use servers in countries outside the EU and the EEA. There is no adequacy decision by the European Commission for these countries. Our cooperation with them is based on the European Commission’s standard contractual clauses.

8. Integration of the Trusted Shops trustbadge / other widgets

Provided you have given your consent pursuant to Art. 6(1)(a) GDPR, Trusted Shops widgets are integrated on this website to display Trusted Shops services (e.g. trustmark, collected reviews) and to offer Trusted Shops products for buyers after an order.

The trustbadge and the services advertised with it are an offering by Trusted Shops SE, Subbelrather Str. 15C, 50823 Cologne (“Trusted Shops”), with whom we are joint controllers under Art. 26 GDPR. In these privacy notices, we inform you below about the essential contractual content pursuant to Art. 26(2) GDPR.

Within the framework of the joint controllership between us and Trusted Shops SE, please preferably contact Trusted Shops for data protection questions and to assert your rights using the contact options specified in the privacy information (opens in a new window). Irrespective of this, you can always contact the controller of your choice. Your enquiry will then, if necessary, be forwarded to the other controller for response.

8.1 Data processing when embedding the trustbadge / other widgets

The trustbadge is provided by a US content delivery network (CDN) provider. An adequate level of data protection is ensured in each case by an adequacy decision of the EU Commission, which for the USA is available on EUR-Lex (opens in a new window). Service providers used from the USA are generally certified under the EU–US Data Privacy Framework (DPF). Further information can be found on the DPF website (opens in a new window). Where service providers used are not certified under the DPF, standard contractual clauses have been concluded as an appropriate safeguard.

When the trustbadge is called up, the web server automatically stores a so-called server log file, which also contains your IP address, date and time of access, data volume transferred and the requesting provider (access data), and documents the access. The IP address is anonymised immediately after collection so that the stored data can no longer be assigned to your person. The anonymised data are used in particular for statistical purposes and error analysis.

8.2 Data processing after order completion

If you have given your consent, after order completion the trustbadge accesses order information (order total, order number, any product purchased) stored in your end device as well as your email address, and your email address is hashed using a cryptographic one-way function. The hash value is then transmitted together with the order information to Trusted Shops pursuant to Art. 6(1)(a) GDPR. This serves to check whether you are already registered for Trusted Shops services. If this is the case, further processing takes place in accordance with the contractual agreement (PDF, opens in a new window) concluded between you and Trusted Shops. If you are not yet registered for the services or do not give your consent to automatic recognition via the trustbadge, you will subsequently have the option to register manually for the use of the services or to complete the protection within the scope of your existing user agreement, if applicable.

For this purpose, after you complete your order the trustbadge accesses the following information stored on the end device you use: order total, order number and email address. This is necessary so that we can offer you buyer protection. Data are only transmitted to Trusted Shops when you actively decide to conclude buyer protection by clicking the correspondingly designated button in the so-called trustcard. If you decide to use the services, the further processing is based on the contractual agreement with Trusted Shops pursuant to Art. 6(1)(b) GDPR, in order to complete your registration for buyer protection and secure the order as well as, where applicable, to be able to send you review invitations by email thereafter.

Trusted Shops uses service providers in the areas of hosting, monitoring and logging. The legal basis is Art. 6(1)(f) GDPR for the purpose of ensuring trouble-free operation. Processing may take place in third countries (USA, United Kingdom and Israel). An adequate level of data protection is ensured in each case by an adequacy decision of the EU Commission. The decisions are available for the USA (opens in a new window), for the United Kingdom (PDF, opens in a new window) and for Israel (opens in a new window). Service providers used from the USA are generally certified under the EU–US Data Privacy Framework (DPF). Further information can be found on the DPF website (opens in a new window). Where service providers used are not certified under the DPF, standard contractual clauses have been concluded as an appropriate safeguard.

9. Social media

9.1 Our online presence on Facebook (by Meta), Instagram (by Meta), YouTube, LinkedIn

Insofar as you have given your consent pursuant to Art. 6(1)(a) GDPR to the respective social media operator, when you visit our online presences on the social media mentioned above, your data are automatically collected and stored for market research and advertising purposes, from which usage profiles are created using pseudonyms. These can be used, for example, to place adverts on and off the platforms that presumably match your interests. Cookies are generally used for this purpose. Please refer to the providers’ privacy notices linked below for detailed information on the processing and use of data by the respective social media operator as well as a contact option and your related rights and settings options to protect your privacy. If you still need help in this regard, you can contact us.

Facebook (by Meta)

Facebook (by Meta) (opens in a new window) is an offering by Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland (“Meta Platforms Ireland”). The information about your use of our online presence on Facebook (by Meta) automatically collected by Meta Platforms Ireland is generally transmitted to a server of Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025, USA and stored there. Data processing in the course of visiting a Facebook (by Meta) fan page is based on an agreement between joint controllers pursuant to Art. 26 GDPR. You can find further information about insights data at Facebook (opens in a new window).

Our service providers are based and/or use servers in the following countries for which the European Commission has determined an adequate level of data protection by decision: Brazil, USA, Canada, Japan, South Korea, New Zealand, United Kingdom, Argentina.

The adequacy decision for the USA applies as a basis for the third-country transfer, insofar as the respective service provider is certified. Certification is in place.

Our service providers are based and/or use servers in these countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Mexico. There is no adequacy decision by the European Commission for these countries. Our cooperation with them is based on the following safeguards: the European Commission’s standard contractual clauses.

Instagram (by Meta)

Instagram (by Meta) (opens in a new window) is an offering by Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland (“Meta Platforms Ireland”). The information about your use of our online presence on Instagram automatically collected by Meta Platforms Ireland is generally transmitted to a server of Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA and stored there. Data processing in the course of visiting an Instagram (by Meta) fan page is based on an agreement between joint controllers pursuant to Art. 26 GDPR. You can find further information about insights data at Facebook (opens in a new window).

Our service providers are based and/or use servers in the following countries for which the European Commission has determined an adequate level of data protection by decision: Brazil, USA, Canada, Japan, South Korea, New Zealand, United Kingdom, Argentina.

The adequacy decision for the USA applies as a basis for the third-country transfer, insofar as the respective service provider is certified. Certification is in place.

Our service providers are based and/or use servers in these countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Mexico. There is no adequacy decision by the European Commission for these countries. Our cooperation with them is based on the following safeguards: the European Commission’s standard contractual clauses.

YouTube

YouTube (opens in a new window) is an offering by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The information about your use of our online presence on YouTube automatically collected by Google is generally transmitted to a server of Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA and stored there.

Our service providers are based and/or use servers in countries outside the EU and the EEA for which the European Commission has determined an adequate level of data protection by decision.

Our service providers are based and/or use servers in countries outside the EU and the EEA. There is no adequacy decision by the European Commission for these countries. Our cooperation with them is based on the European Commission’s standard contractual clauses.

LinkedIn

LinkedIn (opens in a new window) is an offering by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”). The information about your use of our online presence on LinkedIn automatically collected by LinkedIn is generally transmitted to a server of LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA and stored there.

Our service providers are based and/or use servers in the following countries for which the European Commission has determined an adequate level of data protection by decision: USA.

The adequacy decision for the USA applies as a basis for the third-country transfer, insofar as the respective service provider is certified. Certification is in place.

10. Contact options and your rights

10.1 Your rights

As a data subject, you have the following rights:

• pursuant to Art. 15 GDPR, the right to obtain, to the extent specified therein, access to your personal data processed by us;
• pursuant to Art. 16 GDPR, the right to obtain without undue delay the rectification of inaccurate or completion of your personal data stored by us;
• pursuant to Art. 17 GDPR, the right to obtain the erasure of your personal data stored by us, unless further processing is required
  • for exercising the right of freedom of expression and information;
  • for compliance with a legal obligation;
  • for reasons of public interest; or
  • for the establishment, exercise or defence of legal claims;
• pursuant to Art. 18 GDPR, the right to obtain restriction of processing of your personal data insofar as
  • you contest the accuracy of the data;
  • the processing is unlawful, but you oppose the erasure of the data;
  • we no longer need the data, but you need them for the establishment, exercise or defence of legal claims; or
  • you have objected to processing pursuant to Art. 21 GDPR;
• pursuant to Art. 20 GDPR, the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request transmission to another controller;
• pursuant to Art. 77 GDPR, the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your habitual residence or place of work or of our company’s registered office for this purpose.

10.2 Contact options

If you have questions about the collection, processing or use of your personal data, about access, rectification, restriction or erasure of data as well as withdrawal of any consent given or objection to a particular use of data, please contact:

Roman Strauß
Finkensteiner Straße 5
9585 Gödersdorf
Austria
+43 4257 29064 762
[email protected]