Privacy policy
General
Compliance with data protection laws is not only a legal obligation for MARCEL OSTERTAG, but also an important factor of trust. With the following privacy policy, we would therefore like to inform you transparently about the type, scope and purpose of the personal data collected and processed within this website, as well as your rights.
Responsibility for Data Processing
MARCEL OSTERTAG, owner Marcel Ostertag, Paradeisgasse 2, 91781 Weißenburg i. Bayern, (hereinafter: "We") is, as operator of the website www.marcelostertag.com, the controller pursuant to Art. 4 No. 7 of the EU General Data Protection Regulation (GDPR). If you have any questions, you can contact us at info@marcelostertag.com.
Data Protection Officer
You can reach our data protection officer by email at: info(at)marcelostertag.com
Rights of Data Subjects
Your Rights as a Data Subject
As a data subject, you have the following rights vis-à-vis us with regard to your personal data. You have:
- A right to information, among other things, about the categories of data processed, the purposes of processing, the storage period, and any recipients, pursuant to Art. 15 GDPR and § 34 BDSG.
- A right to rectification or erasure of inaccurate or incomplete data, pursuant to Art. 16 and 17 GDPR and § 35 BDSG.
- Under the conditions of Art. 18 GDPR or § 35 para. 1 sentence 2 BDSG, a right to restriction of processing.
- A right to object to processing pursuant to Art. 21 para. 1 GDPR, insofar as the data processing was carried out on the basis of a legitimate interest.
- A right to revoke a consent given, with effect for the future, pursuant to Art. 7 para. 3 GDPR.
- A right to data portability in a common format pursuant to Art. 20 GDPR.
- Pursuant to Art. 22 GDPR, you have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you. This also includes profiling within the meaning of Art. 4 No. 4 GDPR.
- You also have the right, pursuant to Art. 77 GDPR, to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement.
Procedure
If you assert your rights under the GDPR and the BDSG vis-à-vis us, we will process the data you transmit to us in doing so in order to fulfil your claim.
We will subsequently store the data you transmit to us and the data we transmit to you in return, for documentation purposes, until the expiry of the statute of limitations under administrative offence law (3 years).
The legal basis for the processing and storage of the data is Art. 6 para. 1 sentence 1 letter f) GDPR (legitimate interest in the data processing). The legitimate interest arises from our obligation to comply with your request and the need to be able to exonerate ourselves in a possible fine proceeding by proving that we properly complied with your request.
You may object at any time, under the conditions of Art. 21 GDPR, to the processing of your data based on our legitimate interest. Please use the contact details given in the legal notice for this purpose. However, we point out that the processing of your data to prove compliance with data subject rights is mandatory within the meaning of Art. 21 para. 1 GDPR, as other means of proof do not exist or are not equally suitable.
Data Protection Measures
We secure our website and other systems – and thus also your data – against loss, destruction, access, alteration or dissemination by unauthorised persons through technical and organisational measures. In particular, your personal data is transmitted over the internet in encrypted form. We use the TLS (Transport Layer Security) encoding system for this purpose.
However, the transmission of information over the internet is never completely secure, which is why we cannot guarantee 100% the security of data transmitted from our website.
Modalities of Data Processing
Sources and Categories of Personal Data
We process your personal data insofar as it is required for the establishment, content design or modification of a contractual relationship between us and you (account data). Account data may in particular include: name, salutation, contact details (postal address, telephone, email address), date of birth, etc.
Furthermore, we process your usage data. Usage data is data generated by your behaviour when using our website and our services, in particular your IP address, the beginning and end of your visit to our website, and information on which content you have accessed on our website.
We collect the aforementioned data either directly from you (e.g. through your visit to the website) or, insofar as this is permitted under data protection law, from third parties or from publicly accessible sources (e.g. commercial and association registers, press, media, internet).
Data Transfer to Third Countries Outside the EU
All information we receive from you or about you is generally processed on servers within the European Union. A transfer of your data to, or processing of your data in, third countries only takes place without your express consent if this is provided for or permitted by law and an adequate level of data protection is ensured in the third country.
Disclosure of Data, Processing on Our Behalf
We never disclose your personal data to third parties without authorisation. However, we may disclose your data to third parties in particular if you have consented to the disclosure of data, if the disclosure is necessary to fulfil our legal obligations, or if we are entitled or obliged to disclose data on the basis of statutory provisions or administrative or judicial orders. This may in particular concern the provision of information for the purposes of law enforcement, hazard prevention, or the enforcement of intellectual property rights.
We may disclose the personal data collected from you to third parties, in particular in the context of contract processing, for example to the transport company commissioned with delivery or the service used for payment, insofar as this is necessary for the performance of the contract. You will find the individual service providers and further information below in the section "Third-party services".
Under certain circumstances, we also transmit your data to external service providers who process data on our behalf and in accordance with our instructions (processors), in order to simplify or relieve our own data processing. Each processor is contractually obliged in accordance with Art. 28 GDPR. This means in particular that the processor must provide sufficient guarantees that appropriate technical and organisational measures are implemented in such a way that the processing is carried out in compliance with the requirements of the GDPR and the protection of your rights as a data subject is ensured. Despite engaging processors, we remain the controller responsible for the processing of your personal data within the meaning of data protection law.
Purpose of Data Processing
We generally only use the data for the purpose for which it was collected from you. We may further process the data for a different purpose if this other purpose is not incompatible with the original purpose (Art. 5 para. 1 lit. c) GDPR).
Storage Period
Unless stated otherwise in individual cases, we only store data collected from you for as long as is necessary for the respective purpose, unless statutory retention obligations preclude erasure, e.g. under commercial or tax law.
Individual Processing Activities
Below we would like to present to you, as transparently as possible, which data we process on which occasion, on what basis, and for what purpose.
Server Log Files
Every time a website is accessed and every time data is retrieved from a server, general information is automatically transmitted to the providing server. This data transmission occurs automatically and is a fundamental part of communication between devices on the internet.
The data transmitted as standard includes, among other things, the following information: your IP address, product and version information about the browser and operating system used (so-called user agent), the website from which your access originated (so-called referrer), the date and time of the request (so-called timestamp). In addition, the http status and the amount of data transferred as part of this request are recorded.
This information is logged by the server, stored in a table, and kept there for a short time (so-called server log files). By analysing these log files, we can identify and subsequently fix errors on the website, determine the load on the website at certain times and make adjustments or improvements based on this, as well as ensure the security of the server by being able to trace which IP address attacks on our server originated from.
Your IP address is stored only for the duration of your use of the website and is subsequently deleted without delay or partially rendered unrecognisable through truncation. The remaining data is stored for a limited period (usually 7 days).
The legal basis for the use of server log files is Art. 6 para. 1 sentence 1 letter f) GDPR (legitimate interest in the data processing). The legitimate interest arises from the necessity for the operation and maintenance of our website, as explained above. You may object at any time, under the conditions of Art. 21 GDPR, to the processing of your data based on our legitimate interest. Please use the contact details given in the legal notice for this purpose. However, we point out in advance that the processing of your data in server log files is mandatory within the meaning of Art. 21 para. 1 GDPR, as the website could otherwise not be operated at all.
Cookies and Web Storage
To improve user-friendliness on our website, we use so-called "cookies" and the "web storage" of your browser.
Cookies
What cookies are
Put simply, a cookie is a small text file that stores data about websites visited. Cookies can be used in a variety of ways. For example, they can store a kind of "user profile", i.e. things like your preferred language and other page settings that our website needs in order to be able to offer you certain services. The cookie file is stored on your device and can also help to recognise you when you visit our website again.
Under certain circumstances, cookies can also provide us with information about your preferred activities on our website, allowing us to tailor our website to your individual interests or even increase the speed of navigation on our website.
How you can avoid cookies
You can manually delete cookies in your browser's security settings at any time.
You can also prevent the storage of cookies from the outset by adjusting your browser settings accordingly. Please note, however, that in this case you may not be able to fully use all the functions of our website, or that errors may occur in the display and use of the website.
Third-party cookies
It is possible that third-party providers, whose assistance we use to design and operate our site, in particular through so-called plugins (see the section "Third-party services" below), independently store their own cookies on your device. If you only want to accept our own cookies, but not cookies from these third parties, you can prevent the storage of these cookies via the corresponding browser setting "block third-party cookies".
Which cookies are used
Specifically, our website uses the following cookies:
|
Name |
Explanation |
Origin (domain) |
Validity/ Storage period |
Third-party access |
|
__cfduid |
This cookie is used by the content network Cloudflare to identify trusted web traffic. |
.marcelostertag.com |
1 month |
Yes, Shopify |
|
_landing_page |
This cookie is set by the third-party provider Shopify and is used for reach measurement/analysis by storing information regarding landing pages. Landing pages are specially set up websites that appear after clicking on an advertisement or a search engine entry. |
.marcelostertag.com |
2 weeks |
Yes, Shopify |
|
_orig_referrer |
This cookie is set by the provider Shopify and is used for reach measurement/analysis by storing information about the user. This information represents an ID chain of a specific user, which can be used to identify groups with similar interests and preferences as target groups. The information can also be used by third parties or for advertising. |
.marcelostertag.com |
2 weeks |
Yes, Shopify |
|
_secure_session_id |
This cookie is set by the third-party provider Shopify and is used in connection with navigation in the online shop. |
.marcelostertag.com |
1 day |
Yes, Shopify |
|
_shopify_fs |
This cookie is set by the provider Shopify and is used to analyse the user by tracking and storing the user's browsing behaviour, in order to optimise the website and make advertising on the website more relevant. |
.marcelostertag.com |
2 years |
Yes, Shopify |
|
_shopify_sa_p, _shopify_sa_t |
These cookies are set by the provider Shopify and are used to analyse the user with regard to marketing by tracking and storing the user's browsing behaviour. The cookie also makes it possible to recognise referrals from other websites. |
.marcelostertag.com |
30 minutes |
Yes, Shopify |
|
_shopify_s, _s |
These cookies are set by the provider Shopify and are used to analyse the user by tracking and storing the user's browsing behaviour. |
.marcelostertag.com |
30 minutes |
Yes, Shopify |
|
_shopify_y, _y |
These cookies are set by the third-party provider Shopify and are used to analyse the user by tracking and storing the user's browsing behaviour. |
.marcelostertag.com |
1 year |
Yes, Shopify |
|
cart_currency |
This cookie is set by the third-party provider Shopify and is used for the functionality of the shopping cart in the online shop by storing the selected currency in the cookie. |
. .marcelostertag.com |
2 weeks |
Yes, Shopify |
|
cart_sig, cart_ts |
These cookies are set by the provider Shopify and are required in connection with the checkout of the web store for its functionality. |
.marcelostertag.com |
2 weeks |
Yes, Shopify |
|
cart_ver |
This cookie is set by the provider Shopify and is used for the functionality of the shopping cart in the online shop. |
.marcelostertag.com |
2 weeks |
Yes, Shopify |
|
cart |
This cookie is set by the provider Shopify and is required in connection with the shopping cart of the web store for its functionality. |
.marcelostertag.com |
2 weeks |
Yes, Shopify |
|
secure_customer_sig |
This cookie is set by the third-party provider Shopify and is used for the functionality of the user's login function on the website. |
.marcelostertag.com |
40 years |
Yes, Shopify |
|
shopify_pay_redirect |
These cookies are set by the third-party provider Shopify and are required for checkout. |
.marcelostertag.com |
1 hour |
Yes, Shopify |
|
storefront_digest |
This cookie is set by the third-party provider Shopify and is used for the functionality of the user's login function on the website. |
.marcelostertag.com |
End of session |
Yes, Shopify |
|
akavpau_ppsd, nsid, x-cdn, X-PP-L7, x-pp-s |
These cookies are used in connection with the PayPal payment function on the website and are required for a functional and secure transaction via PayPal. |
.www.paypal.com |
End of session |
Yes, PayPal |
|
enforce_policy |
These cookies are used in connection with the PayPal payment function on the website and are required for a functional and secure transaction via PayPal. |
.paypal.com |
1 year |
Yes, PayPal |
|
LANG, tsrce |
This cookie is used in connection with the PayPal payment function on the website and is required for a functional and secure transaction via PayPal. |
.paypal.com |
3 days |
Yes, PayPal |
|
ts_c, ts |
These cookies are used in connection with the PayPal payment function on the website and are required for a functional and secure transaction via PayPal. |
.paypal.com |
3 years |
Yes, PayPal |
|
x-csrf-jwt |
These cookies are used in connection with the PayPal payment function on the website and are required for a functional and secure transaction via PayPal. |
.paypal.com |
1 week |
Yes, PayPal |
|
X-PP-SILOVER |
These cookies are used in connection with the PayPal payment function on the website and are required for a functional and secure transaction via PayPal. |
.paypal.com |
45 minutes |
Yes, PayPal |
|
_landing_page, _orig_referrer |
These cookies are set by the third-party provider Shopify and are used for reach measurement/analysis by storing information regarding landing pages. Landing pages are specially set up websites that appear after clicking on an advertisement or a search engine entry. |
.shopify.com |
14 days |
Yes, Shopify |
|
_pay_session |
This cookie is set by the payment provider used, Shopify Payment, and is used for the secure payment function and checkout in the online shop. |
pay.shopify.com |
End of session |
Yes, Shopify |
|
_shopify_y, _y |
These cookies are set by the third-party provider Shopify and are used to analyse the user by tracking and storing the user's browsing behaviour. |
.shopify.com |
1 year |
Yes, Shopify |
|
tracked_start_checkout |
This cookie is set by the third-party provider Shopify and is used to analyse the user at checkout in the online shop by tracking and storing the user's browsing behaviour. |
.marcelostertag.com |
1 year |
Yes, Shopify |
Legal Basis
The legal basis for the use of cookies that are strictly necessary for the function of the website (e.g. shopping cart cookie, session cookie) is Art. 6 para. 1 sentence 1 letter f) GDPR (legitimate interest in the data processing). The legitimate interest arises from our need to be able to offer you a functioning website. Cookies are necessary for this because they are an integral part of current internet technology and many functions of current websites would not be available without cookies. We therefore need cookies in order to be able to provide you with the website upon your request.
You may object at any time, under the conditions of Art. 21 GDPR, to the processing of your data based on our legitimate interest. Please use the contact details given in the legal notice for this purpose.
However, we point out that the processing of your data in certain cookies is mandatory within the meaning of Art. 21 para. 1 GDPR, as the website could otherwise not be operated at all and we do not have the technical means to prevent cookies being set on certain individual devices. However, you may be able to do this yourself in your browser. For further information on this, please refer to your browser's instructions.
The legal basis for the use of cookies that are not strictly necessary for the function of the website is Art. 6 para. 1 sentence 1 letter a) GDPR (consent of the data subject). When you first visit the website, we ask for your consent to the use of non-necessary cookies via a displayed notice. You may revoke your consent at any time with effect for the future by deleting all cookies in your browser. You can find out how to do this in your browser from the browser's instructions.
Web Storage
What web storage is
Web storage is a technique for web applications used to store data in a web browser. Web storage can, in simplified terms, be regarded as a further development of cookies, but differs from them in some respects.
Unlike cookies, which can be accessed by both server and client, web storage is controlled entirely by the client. This means that data is not transmitted to the server with every visit to the website. Access takes place exclusively locally via scripts on the website. Specifically, this means that access by third parties to the stored information via the website is excluded. Only you and we can access the locally stored data.
Legal basis
The legal basis for the use of web storage that is strictly necessary for the function of the website is Art. 6 para. 1 sentence 1 letter f) GDPR (legitimate interest in the data processing). The legitimate interest arises from our need to be able to offer you a functioning website. Web storage is necessary for this because it is an integral part of current internet technology and many functions of current websites would not be available without it. We therefore need web storage in order to be able to provide you with the website upon your request.
You may object at any time, under the conditions of Art. 21 GDPR, to the processing of your data based on our legitimate interest. Please use the contact details given in the legal notice for this purpose.
However, we point out that the processing of your data in web storage may, under certain circumstances, be mandatory within the meaning of Art. 21 para. 1 GDPR, as the website could otherwise not be operated at all and we do not have the technical means to prevent its use on certain individual devices. However, you may be able to do this yourself in your browser. For further information on this, please refer to your browser's instructions.
The legal basis for the use of web storage that is not strictly necessary for the function of the website is Art. 6 para. 1 sentence 1 letter a) GDPR (consent of the data subject). When you first visit the website, we ask for your consent to its use via a displayed notice. You may revoke your consent at any time with effect for the future by deleting all cookies in your browser. You can find out how to do this in your browser from the browser's instructions.
Newsletter
We offer to keep you regularly informed via our newsletter and to inform you about special offers. To sign up for the newsletter, you can enter your email address in our mailing list. You will then need to confirm your registration once more (double opt-in procedure). We only use the data you provide to us for the purpose of sending the newsletter, and do not pass it on to third parties for other purposes.
Further information on data disclosure can be found below in the section "Third-party services – external newsletter service".
Further information on data processing when receiving our newsletter can be found below in the section "Third-party services – analytics services".
The legal basis for the use of your email address is Art. 6 para. 1 sentence 1 letter a) GDPR (consent of the data subject). You may revoke your consent at any time with effect for the future. Please use the link in every newsletter email for this purpose, or contact us using the contact details given in the legal notice.
Use of Our Online Shop
If you wish to order from our online shop, it is essential for the conclusion of the contract and the processing of your order that you provide certain data. These details, which are essential for processing, are marked separately; all other details can be provided voluntarily. We only process the data you provide in the course of the ordering process to process your order. If you do not provide the required data, your order cannot be processed as a result.
Furthermore, it may be necessary to pass on your data to third parties for order processing, e.g. banks/payment service providers, logistics companies, etc. Further information can be found above under "Disclosure of data" and below in the section "Third-party services".
The legal basis for the use of your data to process the order is Art. 6 para. 1 sentence 1 letter b) GDPR (data processing for the performance of a contract). The legal basis for data you voluntarily provide during the order process is Art. 6 para. 1 sentence 1 letter a) GDPR (consent of the data subject). You may revoke your consent at any time with effect for the future. Please use the contact details given in the legal notice for this purpose.
We are obliged, due to commercial and tax law requirements, to store your address, payment and order data for a period of ten years. However, after two years we restrict the processing, i.e. your data is then only used to comply with legal obligations.
To prevent unauthorised third-party access to your personal data, in particular financial data, the order process is encrypted using TLS technology.
We may also process the data you provide to inform you about other interesting products from our portfolio or to send you emails with technical information.
The legal basis for the use of your contact data for this purpose is Art. 6 para. 1 sentence 1 letter f) GDPR (legitimate interest in the data processing). The legitimate interest arises from our need to be able to provide you with interesting information about our offering and our company (direct marketing).
You may object at any time, under the conditions of Art. 21 GDPR, to the processing of your data based on our legitimate interest in direct marketing. Please use the contact details given in the legal notice for this purpose.
Electronic Withdrawal Function (Withdrawal Button)
We provide you on our website with an electronic withdrawal function ("withdrawal button") pursuant to § 356a BGB, via which you can withdraw from a contract concluded with us. If you use this function, we process the data you provide in order to receive and process your withdrawal, and to confirm receipt to you.
In connection with the withdrawal, we process in particular the following data: your name, details identifying the relevant contract or order, your contact details (in particular the email address to which we send the confirmation of receipt), as well as the date and time your withdrawal was received. After receiving your withdrawal, we will send you without delay a confirmation of receipt on a durable medium (usually by email).
The legal basis for processing this data is Art. 6 para. 1 sentence 1 letter c) GDPR (fulfilment of a legal obligation) in conjunction with § 356a BGB, as well as Art. 6 para. 1 sentence 1 letter b) GDPR (data processing for the performance or reversal of a contract). The provision of the data mentioned is necessary, as your withdrawal cannot otherwise be processed.
We store the data collected in connection with your withdrawal for as long as is necessary to process the withdrawal, as well as beyond that to prove proper processing. Insofar as the data is also part of your order and contract data, the commercial and tax law retention periods apply (see section "Use of our online shop").
Registration Area
Our website offers you the opportunity to register for further, personalised functions of the site. During registration, personal data (e.g. email address and name) is collected and processed for the purpose of providing the personalised services.
We essentially require the following information from you:
- Password: providing a password is necessary for us, as this is the only way we can adequately protect your account. We use your information exclusively for this purpose.
The legal basis for the data you provide in the registration process is Art. 6 para. 1 sentence 1 letter a) GDPR (consent of the data subject). You may revoke your consent at any time with effect for the future. Please use the contact details given in the legal notice for this purpose.
The legal basis for the processing of the mandatory information is Art. 6 para. 1 sentence 1 letter f) GDPR (legitimate interest in the data processing). We have set out the legitimate interest in the list above. You may object at any time, under the conditions of Art. 21 GDPR, to the processing of your data based on our legitimate interest. Please use the contact details given in the legal notice for this purpose.
You also have the option to change or completely delete the data provided in the registration process at any time yourself.
Third-Party Services
To simplify our data processing and to expand the range of functions of our website, we use services/resources of third parties, for example plugins, external content, software, or other external service providers (services). This may also involve the transmission of personal data to the service provider. In order to protect your data, we have, where necessary, contractually obliged the service providers pursuant to Art. 28 GDPR to process your data only in accordance with our instructions.
We expressly point out that we are generally only responsible, within the meaning of the GDPR, for the collection and transmission of data by the service, but not for any subsequent processing by the respective service provider.
Specifically, we use the following services:
Our website uses the following services of Google Ireland Limited ("Google EU"), Gordon House, Barrow Street, Dublin 4, Ireland. This company represents in the EU the company Google LLC ("Google US"), 1600 Amphitheatre Parkway Mountain View, CA 94043, USA.
By using the services, data is transmitted to Google EU and, under certain circumstances, from Google EU to Google US. The Google group may process the transmitted data to create anonymised user profiles for statistical purposes. If you also have a Google account and are logged in to it, Google can assign the transmitted data to your account – even across devices. We generally have no influence over this data processing. Google EU is therefore responsible for this data processing.
You can find more information on how user data is handled in Google's privacy policy: https://policies.google.com/privacy.
You can manage your Google advertising settings on the following website: https://adssettings.google.com/?hl=de (this setting is deleted if you delete your cookies)
We use:
Our website uses the external font service "Google Fonts" from Google. This service enables us to display our website consistently and attractively even on very differently configured user devices, by loading fonts from an external server instead of from the user's device. For this purpose, the required fonts are usually requested from a Google server in the USA. Through this request, among other things, the following information is transmitted to and stored on Google's server: your IP address, product and version information about the browser and operating system used (so-called user agent), the website from which your access originated (so-called referrer), the date and time of the request, and, where applicable, your internet service provider.
The legal basis for the processing of your data in relation to the "Google Fonts" service is Art. 6 para. 1 sentence 1 letter f) GDPR (legitimate interest in the data processing). The legitimate interest arises from our need for an attractive and consistent presentation of our online offering. You may object at any time, under the conditions of Art. 21 GDPR, to the processing of your data based on our legitimate interest. Please use the contact details given in the legal notice for this purpose.
Our website uses the abuse protection service "Google reCAPTCHA" from Google. reCAPTCHA serves to prevent cyberattacks and harassment by so-called "bots" (artificial website users) by checking, via an input field, whether the website is being visited by a real human. This service enables us to operate our website in a stable manner and protect it from misuse. For this purpose, the data entered is usually transmitted to a Google server in the USA and processed there for verification purposes. Through this request, among other things, the following information is transmitted to and stored on Google's server: your input in the input field, your IP address, product and version information about the browser and operating system used (so-called user agent), the website from which your access originated (so-called referrer), the date and time of the request, and, where applicable, your internet service provider.
This service uses your browser's web storage. Further information on this can be found above in the section "Web Storage".
The legal basis for the processing of your data in relation to the "Google reCAPTCHA" service is Art. 6 para. 1 sentence 1 letter f) GDPR (legitimate interest in the data processing). The legitimate interest arises from our need for effective protection of our online offering against cyberattacks and misuse. You may object at any time, under the conditions of Art. 21 GDPR, to the processing of your data based on our legitimate interest. Please use the contact details given in the legal notice for this purpose.
External Newsletter Service
We use external service providers that enable us to provide you with a newsletter containing current information and offers. These services are usually cloud-based services for sending newsletters. They can be used to create, send and manage newsletters. The software is provided via the internet, meaning that we use the service via a web interface on an external server of the respective provider, so that data processing may also take place outside the EU. In particular, it may be necessary to transmit the data you provided when signing up for the newsletter to the respective provider. We have concluded a so-called data processing agreement with the respective provider to ensure that it only processes your data in accordance with our instructions.
Since we ask for your consent before sending our newsletter, the legal basis for the data processing for sending the newsletter is Art. 6 para. 1 sentence 1 letter a) GDPR (consent of the data subject). You may revoke this consent at any time with effect for the future. Please use the unsubscribe link in the newsletter for this purpose, or contact us.
The legal basis for the disclosure of data in the context of using cloud newsletter software and the associated sign-up software is Art. 6 para. 1 sentence 1 letter f) GDPR (legitimate interest in the data processing), unless stated otherwise for the respective service. The legitimate interest arises from our need to simplify and relieve our data processing. You may object at any time, under the conditions of Art. 21 GDPR, to the processing of your data based on our legitimate interest. Please use the contact details given in the legal notice for this purpose.
We use:
We use the newsletter service "Mailjet" provided by Mailjet GmbH, Rankestr. 21, 10789 Berlin, a subsidiary of Mailjet SAS, 13-13 bis, rue de l'Aubrac, 75012 Paris, France.
You can find more information on how user data is handled in Mailjet's privacy policy: https://www.mailjet.de/privacy-policy.
Our website uses so-called Content Delivery Networks (CDN). A CDN is a network of high-performance servers that cache content in various locations around the world. A CDN essentially has two tasks: on the one hand, to provide content as quickly as possible, and on the other hand, to relieve the web host by distributing traffic.
CDNs transmit two types of content: static and dynamic content. All website visitors receive static content in the same form, such as video content from streaming services or code frameworks (e.g. Javascript, jQuery). Dynamic content is first adapted to the user and only created at the moment of the request. This includes content provided via web applications, email or online shops that is personalised. In order to use the latter, information about the website visitor must first be transmitted to the CDN. This may also involve the transmission of your personal data.
Every time the application is accessed, general information from your browser is automatically transmitted to the server (so-called server log files). For further information on this, see above under "Server Log Files".
The legal basis for the use of CDNs and the transmission of your data to them is Art. 6 para. 1 sentence 1 letter f) GDPR (legitimate interest in the data processing), unless stated otherwise for the respective service. The legitimate interest arises from our need for a technically flawless and fast presentation of our website and the relief of our IT infrastructure. You may object at any time, under the conditions of Art. 21 GDPR, to the processing of your data based on our legitimate interest. Please use the contact details given in the legal notice for this purpose.
We use:
Amazon Web Services – Cloudfront
We use the CDN service "Cloudfront" from Amazon Web Services. The company Amazon Web Services EMEA SARL ("AWS EU"), 38 Avenue John F. Kennedy, L-1855 Luxembourg, is responsible for personal data collected and processed via the offerings of "Amazon Web Services". AWS EU is the authorised representative of Amazon Web Services Inc. ("AWS US"), 410 Terry Avenue North, Seattle WA 98109, United States.
By using the services, data is transmitted to AWS EU and, under certain circumstances, from AWS EU to AWS US. The Amazon group may process the transmitted data to create anonymised user profiles for statistical purposes. We generally have no influence over this data processing. AWS EU is therefore responsible for this data processing.
You can find more information on how user data is handled in AWS EU's privacy policy at https://aws.amazon.com/de/privacy/?nc1=f_pr.
We use the CDN service of the company Cloudflare Inc. ("Cloudflare"), 101 Townsend St., San Francisco, California 94107, USA.
You can find more information on how user data is handled in Cloudflare's privacy policy: https://www.cloudflare.com/security-policy/.
We use the CDN service "Net DNA" of the company NetDNA LLC. This belongs to the company StackPath LLC ("StackPath"), 2021 McKinney Ave., Suite 1100, Dallas, TX 75201, USA.
You can find more information on how user data is handled in StackPath's privacy policy:
https://www.stackpath.com/privacy-statement/
Cloud Applications
Our website uses cloud-based applications. Cloud-based applications include, for example, online shops that are provided for us by a third-party provider on their servers. When you use these applications, personal data is generated at the third-party provider, which it may process on our behalf in accordance with our and its data protection provisions.
Every time the application is accessed, general information from your browser is automatically transmitted to the server (so-called server log files). For further information on this, see above under "Server Log Files".
The legal basis for the use of cloud applications and the transmission of your data to them is Art. 6 para. 1 sentence 1 letter f) GDPR (legitimate interest in the data processing), unless stated otherwise for the respective service. The legitimate interest arises from our need for a technically flawless and fast presentation of our website and the relief of our IT infrastructure. You may object at any time, under the conditions of Art. 21 GDPR, to the processing of your data based on our legitimate interest. Please use the contact details given in the legal notice for this purpose.
We use:
We use the cloud-based shop system of the service provider Shopify International Limited, Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, for hosting and displaying the online shop. All data collected on our website is processed on Shopify's servers. As part of the aforementioned services provided by Shopify, data may also be transmitted, as part of further processing, to Shopify Inc., 150 Elgin ST, Ottawa, ON K2P 1L4, Canada, Shopify Data Processing (USA) Inc., Shopify Payments (USA) Inc., or Shopify (USA) Inc. In the case of the transmission of data to Shopify Inc. in Canada, the adequate level of data protection is ensured by an adequacy decision of the European Commission.
Further information on Shopify's data protection practices can be found at: https://www.shopify.de/legal/datenschutz
Analytics Tools
We use certain services that record data from website visitors and make it available to us for analysis. We use this data for the user-oriented improvement of our website, our services and offerings. In particular, the following information about visitor behaviour may be collected: your IP address, product and version information about the browser and operating system used (so-called user agent), the website from which your access originated (so-called referrer), the date and time of the request, and, where applicable, your internet service provider, approximate origin (country and city), language, clicks on content, and viewing duration.
Unless another legal basis is stated for the specific service, the legal basis for the use of analytics tools is Art. 6 para. 1 sentence 1 letter a) GDPR (consent of the data subject). When you first visit the website, we ask for your consent to the use of the service via a displayed notice. You may revoke your consent at any time with effect for the future by deleting all cookies in your browser. You can find out how to do this in your browser from the browser's instructions.
We use:
This website uses Bugsnag, an analytics tool from Bugsnag Inc., 939 Harison Street, San Francisco, CA 94107, USA.
This programme is used to analyse errors on the website. The tool records, analyses and categorises errors and helps us maintain the functionality of our website. In the event of an error, the following data (referrer, time of error, error, IP address), among other things, may be transmitted to Bugsnag in anonymised form.
You can find more information on data protection at BugSnag via the following link:
https://docs.bugsnag.com/legal/privacy-policy/
The legal basis for the use of Bugsnag is Art. 6 para. 1 sentence 1 letter f) GDPR (legitimate interest in the data processing). The legitimate interest arises from our interest in being able to offer you a technically flawless and visually appealing website. Error analysis is essential for this. You may object at any time, under the conditions of Art. 21 GDPR, to the processing of your data based on our legitimate interest. Please use the contact details given in the legal notice for this purpose.
We use a service from Shopify International Limited, Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, for analysing the online shop.
Further information on the provider can be found above.
Our newsletter uses so-called web beacons or tracking pixels to analyse your reading behaviour. Tracking pixels are extremely small image files that are integrated into the newsletter email and thus enable log file recording and log file analysis.
When you open the newsletter email, the tracking pixel is loaded from the newsletter service's server and, at the same time, some information about you is transmitted, such as whether the email was opened, the time it was accessed, and the associated IP address.
In addition, links in the email can provide information about which products were of more interest – i.e. clicked more often than others.
Both the respective web beacon/tracking pixel and the links in the email can be uniquely assigned to the email address used for sending, and thus allow conclusions to be drawn about the respective newsletter recipient.
Media Services
We use certain services to fill and supplement our website with digital content. For this purpose, we generally use the embedding functions of external platforms. As a result, retrieving the content from the provider's server transmits data to it, which is generally stored there, e.g. your IP address, product and version information about the browser and operating system used (so-called user agent), the website from which your access originated (so-called referrer), the date and time of the request, and, where applicable, your internet service provider. For further information on this, see above under "Server Log Files".
The legal basis for the use of media services is generally Art. 6 para. 1 sentence 1 letter f) GDPR (legitimate interest in the data processing), unless stated otherwise for the respective service. The legitimate interest arises from our interest in being able to offer you a website that is appealing in terms of content and design. You may object at any time, under the conditions of Art. 21 GDPR, to the processing of your data based on our legitimate interest. Please use the contact details given in the legal notice for this purpose.
We use:
Our website uses the "Google Fonts" service from the company Google. See the privacy information above for this.
Our website uses the video service "Vimeo" from Vimeo Inc. ("Vimeo"), 555 West 18th Street, New York, New York 10011, USA. Vimeo is used to embed videos in various places on our website. When you visit our website, which is provided with a Vimeo plugin, a connection to Vimeo's servers is established. In doing so, information such as your IP address, product and version information about the browser and operating system used (so-called user agent), the website from which your access originated (so-called referrer), the date and time of the request, and, where applicable, your internet service provider, is transmitted to Vimeo. Vimeo can also track your interactions with the plugin. If you have a Vimeo user account and are logged into it on the same device, your visit to our website will be assigned to your user account. If you would like to avoid this, you can log out of your user account before visiting our website and delete the cookies set by Vimeo.
To minimise the transmission of personal data to Vimeo as much as possible, the video has been embedded in the so-called "Do Not Track" variant.
You can object to the use of non-necessary cookies by Vimeo by removing the tick at the bottom of the following page (opt-out): https://vimeo.com/cookie_policy.
You can find more information on how user data is handled in Vimeo's privacy policy at https://vimeo.com/privacy.
Service Providers for Processing Your Order
We may disclose the personal data collected from you to third parties in the context of contract processing, for example to the transport company commissioned with delivery or the service used for payment, insofar as this is necessary for the performance of the contract.
The legal basis for the transmission of the data required to process the order is Art. 6 para. 1 sentence 1 letter b) GDPR (data processing for the performance of a contract). The provision and transmission of your data is necessary, as your order could otherwise not be processed.
The legal basis for the data transmission voluntarily chosen by you in the order process (e.g. for shipping status by email) is Art. 6 para. 1 sentence 1 letter a) GDPR (consent of the data subject). You may revoke your consent at any time with effect for the future. Please use the contact details given in the legal notice for this purpose.
Specifically, we use the following service providers:
We use the Apple Pay service of Apple Distribution International Ltd., Holyhill, Cork, Ireland, for payment processing.
To enable the processing of your payment, the data collected during the ordering process (surname, first name, email address, order, payment amount) is transmitted to Apple in encrypted form. After transmission, the data is once again encrypted by Apple, so that only the transmitting website can access the payment method stored with Apple Pay. After successful payment, Apple sends a specific transaction number to the transmitting website.
Apple retains anonymised transaction data, including the approximate purchase amount, the approximate date and time, and whether the transaction was completed successfully. Apple uses this data to improve Apple Pay and other products and services.
Further information on data protection at Apple Pay can be found at:
https://support.apple.com/de-de/HT203027
If delivery of the goods is carried out by the transport service provider DHL Paket GmbH ("DHL"), Sträßchensweg 10, 53113 Bonn, we pass on your name and address to DHL for the purpose of delivery.
Further information on data protection at DHL can be found at: https://www.dhl.de/de/toolbar/footer/datenschutz.html
We use the Klarna service of Klarna Bank AB, Sveavägen 46, 11134 Stockholm, Sweden, for payment processing. To enable payment to be processed, your data (first and last name, street, house number, postal code, city, gender, email address, telephone number and IP address) as well as data collected in connection with your order (invoice amount, delivery type, items) are passed on to Klarna for the purpose of identity and credit checks.
You can view which credit reporting agencies your data may be forwarded to here:
https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies
For further data protection information, please refer to Klarna's privacy policy:
https://www.klarna.com/de/datenschutz/
We use the "PayPal Plus" service of PayPal (Europe) S.à.r.l. et Cie, S.C.A. ("PayPal"), 22-24 Boulevard Royal, L-2449 Luxembourg, for payment processing. This service enables us to offer you various payment methods in our online shop. Through its use, data is transmitted from our website to PayPal, in particular your IP address, product and version information about the browser and operating system used (so-called user agent), the website from which your access originated (so-called referrer), the date and time of the request, and, where applicable, your internet service provider. In addition, the status and the amount of data transferred as part of this request are recorded.
Details on the data collected and information on how PayPal processes the collected data can be found in PayPal's privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE
We have a legitimate interest within the meaning of Art. 6 para. 1 sentence 1 letter f) GDPR in using PayPal, which consists in offering a multitude of payment methods as simply as possible via one service provider, rather than having to engage a separate service provider for each payment method. This also reduces the number of recipients of your data at the same time.
When paying via "PayPal via PayPal Plus", "direct debit via PayPal Plus", "credit card via PayPal Plus" or "PayPal Plus invoice", we also pass on your payment and order data to PayPal as part of payment processing. PayPal reserves the right, for the payment methods credit card and direct debit, to carry out a credit check. PayPal uses the result of the credit check with regard to the statistical probability of payment default for the purpose of deciding on the provision of the respective payment method. The credit check may contain probability values (so-called score values). Insofar as score values are included in the result of the credit check, these are based on a scientifically recognised mathematical-statistical procedure. Among other things, address data is included in the calculation of the score values.
Please also refer to PayPal's privacy policy for further data protection information, including on the credit reporting agencies used: https://www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE
We use the Shopify Payments service, 3rd Floor, Europa House, Harcourt Building, Harcourt Street, Dublin 2, for payment processing.
If you choose to pay via Shopify Payments, payment processing is carried out via Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.
The following information about your order is transmitted (name, address, account number, bank sort code, credit card number, invoice amount, etc.).
For further data protection information, please also refer to the privacy policy of Stripe Payments Europe Ltd:
https://www.shopify.de/legal/datenschutz
Instant Bank Transfer (Sofort)
We use the "Sofort-Überweisung" (instant bank transfer) service of Sofort GmbH, Theresienhöhe 12, 80339 Munich, for payment processing. This service enables us to offer you various payment methods in our online shop.
In this case, the data is collected by Sofort GmbH. We do not store the data ourselves.
To do this, Sofort GmbH requires the IBAN as well as the PIN and TAN of your online banking account. During the order process, you are automatically redirected to the secure payment form of Sofort GmbH. Immediately afterwards, you receive confirmation of the transaction. We then receive the transfer credit directly.
Details on the data collected and information on how Sofort GmbH processes the collected data can be found in the notices of Sofort GmbH:
https://www.klarna.com/sofort/
Other Services
Our website uses the "GDPR Legal Cookie" service of beeclever GmbH, Universitätsstraße 3, 56070 Koblenz, Germany. This service enables us to obtain legally compliant consent from the website visitor for the storage of not strictly necessary data (cookies, local storage data, pixels) on their device.
The website visitor is shown a banner via the integration of a JavaScript code. The user can, by ticking boxes, consent to certain processing operations (storage of cookies). The banner can also be recalled at any time via a button.
Data is only stored on the user's device after consent has been given.
For the banner's functionality, data (IP address, referrer, browser information, etc.) is transmitted to beeclever GmbH's servers.
The legal basis for the use of the plugin is Art. 6 para. 1 sentence 1 letter f) GDPR (legitimate interest in the data processing). The legitimate interest arises from our need to be able to offer you a legally compliant website. You may object at any time, under the conditions of Art. 21 GDPR, to the processing of your data based on our legitimate interest. Please use the contact details given in the legal notice for this purpose.
EU Withdrawal Button & Form
To provide the statutorily required electronic withdrawal function pursuant to § 356a BGB, we use the "EU Withdrawal Button & Form" service of 401layers UG (haftungsbeschränkt), Dorothea-Erxleben-Str. 1a, 40721 Hilden, Germany.
This service enables you to withdraw from a contract concluded with us via an electronic withdrawal function and to transmit the information required for this to us. If you use the withdrawal function, the data you enter (in particular name, details identifying the contract or order, contact details, as well as the date and time of the withdrawal) is transmitted to the provider and processed on our behalf, in order to forward your withdrawal to us and to send you a confirmation of receipt on a durable medium.
The legal basis for the use of this service is Art. 6 para. 1 sentence 1 letter c) GDPR (fulfilment of a legal obligation) in conjunction with § 356a BGB. We have, where necessary, concluded a data processing agreement pursuant to Art. 28 GDPR with the provider.
Further information on data protection at this service can be found at: https://euwiderrufsbutton.de/
Our website uses the CloudSearch service of Qualiteam Software Ltd., Georgiou Katsounotou, 6, Limassol, 3036 Cyprus, as a product filter.
This service enables us to offer you an appealing product search on our homepage. This transmits data to the provider, which is generally stored there, e.g. your IP address, product and version information about the browser and operating system used (so-called user agent), the website from which your access originated (so-called referrer), the date and time of the request, and, where applicable, your internet service provider.
Qualiteam Software Ltd. reserves the right to collect anonymised search statistics.
Further information on data protection at CloudSearch can be found at:
https://cloudsearchapp.com/terms_of_service
The legal basis for the use of the plugin is Art. 6 para. 1 sentence 1 letter f) GDPR (legitimate interest in the data processing). The legitimate interest arises from our need to be able to offer you a search filter on our website, in order to make the website more appealing for you and other potential customers. You may object at any time, under the conditions of Art. 21 GDPR, to the processing of your data based on our legitimate interest. Please use the contact details given in the legal notice for this purpose.
Social Media Pages
In addition to our website, we maintain an online presence on social platforms in order to be able to communicate with the customers, prospective customers and users active there and to inform them about our services.
When you visit our presence on a social platform, your data is generally processed by the respective platform provider for our market research and advertising purposes. The provider may also process the data for its own purposes. Usage profiles can be created based on your usage behaviour and the interests resulting from it. These usage profiles can in turn be used, for example, to display advertisements within and outside the platforms that presumably correspond to your interests. For these purposes, cookies (see above) are generally stored on your device, in which your usage behaviour and interests are stored. In particular, if you are a member of the respective platforms and are logged in to them, additional data may be stored independently in the usage profiles. For a detailed description of the respective data processing and the options for objection, we refer to the provider information linked below, as only the providers know the exact processes of their data processing.
We point out that your data may also be processed outside the European Union. This can give rise to risks, as for example the enforcement of your rights could be made more difficult.
The legal basis for the use of the online presences and the associated data processing is generally Art. 6 para. 1 sentence 1 letter f) GDPR (legitimate interest in the data processing). The legitimate interest arises from our need to present ourselves to visitors and users of social networks and to contribute statements of all kinds to the media and opinion market. You may object at any time, under the conditions of Art. 21 GDPR, to the processing of your data based on our legitimate interest. Please use the contact details given in the legal notice for this purpose.
The use of statistical data on all visitors to our social media presences, which is collected, prepared and made available to us by the respective page operators, is based on Art. 6 para. 1 sentence 1 letter f) GDPR (legitimate interest in the data processing). The legitimate interest arises from our need for an anonymous evaluation of visit and usage behaviour on our online presences for the user-oriented improvement of the design of our online offering and the optimisation of our communication with prospective customers. You may object at any time, under the conditions of Art. 21 GDPR, to the processing of your data based on our legitimate interest. Please use the contact details given in the legal notice for this purpose.
If you are asked by the respective providers for consent to data processing, the legal basis for the processing is Art. 6 para. 1 sentence 1 letter a) GDPR (consent of the data subject). You may revoke this consent at any time with effect for the future. Please contact the provider that asked for your consent for this purpose.
Should you wish to assert your rights mentioned above, we point out that, despite any joint responsibility, these can most effectively be asserted with the providers. Generally, only the providers have direct access to your data and can take appropriate measures and provide information directly. Should you nevertheless need help, you can contact us and we will support you at any time within the scope of our possibilities.
We are represented on:
Facebook is a social network of Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The company Facebook Ireland Ltd. is the European subsidiary of Facebook Inc., 1601 Willow Road, Menlo Park, California 94025, USA.
Further information on data protection at Facebook can be found at: https://www.facebook.com/about/privacy/. We inform you about our own data processing in this declaration.
As part of our terms of use, we have concluded a supplementary agreement with Facebook that regulates responsibility for data processing with regard to the page insights function pursuant to Art. 26 GDPR. The details of the agreement can be found here: https://www.facebook.com/legal/terms/page_controller_addendum. Among other things, Facebook has committed to informing you about the data processing carried out as part of the page insights function. This information can be found here: https://www.facebook.com/legal/terms/information_about_page_insights_data.
Instagram
Instagram is a social network of Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The company Facebook Ireland Ltd. is the European subsidiary of Facebook Inc., 1601 Willow Road, Menlo Park, California 94025, USA.
Further information on data protection at Instagram can be found at: http://instagram.com/about/legal/privacy/.
Further information on data protection at Facebook can be found at: https://www.facebook.com/about/privacy/.
Vimeo
Vimeo is a social video platform of Vimeo Inc., 555 West 18th Street., New York, New York 10011, USA.
Further information on data protection at Vimeo can be found at: https://vimeo.com/de/features/video-privacy
Status of this privacy policy: 20.08.2020
