Privacy Policy

1) Introduction and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about the handling of your personal data when using our website. Personal data is all data with which you can be personally identified.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

The controller responsible for the processing of personal data is the natural or legal person who alone or jointly with others decides on the purposes and means of the processing of personal data.

2) Data Collection When Visiting Our Website

2.1 In the case of merely informational use of our website, i.e., if you do not register or otherwise transmit information to us, we only collect data that your browser transmits to the page server (so-called "server log files"). When you call up our website, we collect the following data, which is technically necessary for us to display the website to you:

• Our visited website
• Date and time at the moment of access
• Amount of data sent in bytes
• Source/reference from which you reached the page
• Browser used
• Operating system used
• IP address used (if applicable, in anonymized form)

The processing is carried out in accordance with Art. 6 (1) lit. f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. Data will not be passed on or otherwise used. However, we reserve the right to check the server log files retrospectively if there are concrete indications of illegal use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the character string "https://" and the lock symbol in your browser line.

3) Hosting & Content Delivery Network

For the hosting of our website and the display of page content, we use a provider that renders its services itself or through selected subcontractors exclusively on servers within the European Union.

All data collected on our website is processed on these servers.

We have concluded a data processing agreement (DPA) with the provider, which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

4) Cookies

In order to make the visit to our website attractive and to enable the use of certain functions, we use cookies, which are small text files stored on your terminal device. Some of these cookies are automatically deleted after closing the browser (so-called "session cookies"), while others remain on your terminal device for a longer period and allow page settings to be saved (so-called "persistent cookies"). In the latter case, you can find the storage duration in the overview of cookie settings in your web browser.

Insofar as personal data is also processed by individual cookies implemented by us, the processing takes place in accordance with Art. 6 (1) lit. b GDPR either for the performance of the contract, in accordance with Art. 6 (1) lit. a GDPR in the event of consent granted, or in accordance with Art. 6 (1) lit. f GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the page visit.

You can set your browser so that you are informed about the setting of cookies and decide individually on their acceptance or exclude the acceptance of cookies for certain cases or in general.

Please note that if cookies are not accepted, the functionality of our website may be restricted.

5) Contacting Us

When contacting us (e.g., via contact form or email), personal data is processed exclusively for the purpose of processing and answering your request and only to the extent required for this purpose.

The legal basis for processing this data is our legitimate interest in responding to your request in accordance with Art. 6 (1) lit. f GDPR. If your contact aims at concluding a contract, the additional legal basis for processing is Art. 6 (1) lit. b GDPR. Your data will be deleted when it can be inferred from the circumstances that the facts in question have been conclusively clarified and provided that no statutory storage obligations prevent this.

6) Data Processing Upon Opening a Customer Account

Pursuant to Art. 6 (1) lit. b GDPR, personal data continues to be collected and processed to the extent required if you provide it to us when opening a customer account. Which data is required for opening an account can be seen from the input mask of the corresponding form on our website.

Deletion of your customer account is possible at any time and can be requested by sending a message to the above-mentioned address of the controller. After deletion of your customer account, your data will be erased, provided that all contracts concluded via it have been fully processed, no statutory retention periods prevent erasure, and no legitimate interest on our part continues to exist for further storage.

7) Use of Customer Data for Direct Marketing

7.1 Subscription to Our Email Newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information required for sending the newsletter is your email address. Providing additional data is voluntary and is used to address you personally. For sending the newsletter, we use the so-called double opt-in procedure, which ensures that you only receive the newsletter once you have explicitly confirmed your consent to receiving it by clicking a verification link sent to the specified email address.

By activating the confirmation link, you grant us your consent for the use of your personal data pursuant to Art. 6 (1) lit. a GDPR. In this context, we store your IP address registered by the Internet Service Provider (ISP) as well as the date and time of registration in order to be able to trace a possible misuse of your email address at a later date. The data collected by us when registering for the newsletter will be used strictly for its intended purpose.

You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending a message to the controller named above. After unsubscribing, your email address will be deleted immediately from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve a data use beyond this which is permitted by law and about which we inform you in this declaration.

7.2 Shopping Cart Reminders by Email

In the event that you abandon your purchase with us before completing the order, you have the option of receiving a one-time reminder by email regarding the contents of your virtual shopping cart.

The only mandatory information required for sending this reminder is your email address. Providing further data is voluntary and may be used to address you personally. For sending the email, we use the so-called double opt-in procedure, which ensures that you only receive a notification if you have expressly confirmed your consent by clicking a verification link sent to the specified email address.

By activating the confirmation link, you grant us your consent for the use of your personal data pursuant to Art. 6 (1) lit. a GDPR for sending a shopping cart reminder. In this context, we store your IP address registered by the Internet Service Provider (ISP) as well as the date and time of registration in order to be able to trace a possible misuse of your email address at a later date. The data collected by us when subscribing to our email notification service will be used strictly for its intended purpose.

You can unsubscribe from shopping cart reminders at any time by sending a message to the controller named above. After unsubscribing, your email address will be deleted immediately from our distribution list set up for this purpose, unless you have expressly consented to further use of your data or we reserve a data use beyond this which is permitted by law and about which we inform you in this declaration.

8) Data Processing for Order Fulfillment

8.1 Insofar as necessary for contract fulfillment for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6 (1) lit. b GDPR.

If we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we process the contact data transmitted by you during the order in order to inform you personally within the framework of our statutory information obligations pursuant to Art. 6 (1) lit. c GDPR. Your contact details will be used strictly for communications regarding updates owed by us and will only be processed by us for this purpose to the extent necessary for the respective information.

To process your order, we also work together with the service providers listed below, who support us in whole or in part in executing concluded contracts. Certain personal data is transferred to these service providers in accordance with the following information.

8.2 Transfer of Personal Data to Shipping Service Providers

• Deutsche Post: Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany.
  We transfer your email address and/or phone number to the provider prior to delivery of the goods pursuant to Art. 6 (1) lit. a GDPR for the purpose of coordinating a delivery date or for delivery notification, provided you have given your explicit consent during the ordering process. Otherwise, for delivery purposes pursuant to Art. 6 (1) lit. b GDPR, we only transfer the recipient's name and delivery address to the provider. The transfer takes place only insofar as necessary for the delivery of goods. Consent can be revoked at any time with future effect vis-à-vis the controller named above or vis-à-vis the provider.
• DHL: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany.
  We transfer your email address and/or phone number to the provider prior to delivery of the goods pursuant to Art. 6 (1) lit. a GDPR for the purpose of coordinating a delivery date or for delivery notification, provided you have given your explicit consent during the ordering process. Otherwise, for delivery purposes pursuant to Art. 6 (1) lit. b GDPR, we only transfer the recipient's name and delivery address to the provider. The transfer takes place only insofar as necessary for the delivery of goods. Consent can be revoked at any time with future effect vis-à-vis the controller named above or vis-à-vis the provider.
• DHL Freight: DHL Freight GmbH, Godesberger Allee 102-104, 53175 Bonn, Germany.
  We transfer your email address and/or phone number to the provider prior to delivery of the goods pursuant to Art. 6 (1) lit. a GDPR for the purpose of coordinating a delivery date or for delivery notification, provided you have given your explicit consent during the ordering process. Otherwise, for delivery purposes pursuant to Art. 6 (1) lit. b GDPR, we only transfer the recipient's name and delivery address to the provider. The transfer takes place only insofar as necessary for the delivery of goods. Consent can be revoked at any time with future effect vis-à-vis the controller named above or vis-à-vis the provider.
• Kühne+Nagel: Kühne + Nagel AG & Co. KG, Wilhelm-Kaisen-Brücke 1, 28195 Bremen, Germany.
  We transfer your email address and/or phone number to the provider prior to delivery of the goods pursuant to Art. 6 (1) lit. a GDPR for the purpose of coordinating a delivery date or for delivery notification, provided you have given your explicit consent during the ordering process. Otherwise, for delivery purposes pursuant to Art. 6 (1) lit. b GDPR, we only transfer the recipient's name and delivery address to the provider. The transfer takes place only insofar as necessary for the delivery of goods. Consent can be revoked at any time with future effect vis-à-vis the controller named above or vis-à-vis the provider.
• UPS: United Parcel Service Deutschland Inc. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany.
  We transfer your email address and/or phone number to the provider prior to delivery of the goods pursuant to Art. 6 (1) lit. a GDPR for the purpose of coordinating a delivery date or for delivery notification, provided you have given your explicit consent during the ordering process. Otherwise, for delivery purposes pursuant to Art. 6 (1) lit. b GDPR, we only transfer the recipient's name and delivery address to the provider. The transfer takes place only insofar as necessary for the delivery of goods. Consent can be revoked at any time with future effect vis-à-vis the controller named above or vis-à-vis the provider.

8.3 Use of Payment Service Providers

• Amazon Pay: Amazon Payments Europe s.c.a., 38 avenue J.F. Kennedy, L-1855 Luxembourg.
  When selecting a payment method offered by the provider where you make an advance payment (such as credit card payment), your payment data provided during the ordering process (including name, address, bank and card details, currency, and transaction number) as well as information about the content of your order will be passed on pursuant to Art. 6 (1) lit. b GDPR. In this case, your data will be passed on exclusively for the purpose of payment processing with the provider and only insofar as necessary for this purpose.
• PayPal: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.
  When selecting a payment method offered by the provider where you make an advance payment, your payment data provided during the ordering process as well as information about the content of your order will be passed on pursuant to Art. 6 (1) lit. b GDPR.
  When selecting a payment method where we make an advance performance, you will be asked during the checkout process to provide personal data (first and last name, street, house number, postal code, city, date of birth, email address, phone number). In order to safeguard our legitimate interest in determining your solvency, this data is forwarded to the provider pursuant to Art. 6 (1) lit. f GDPR for the purpose of a credit check. The provider checks on the basis of mathematical-statistical methods (score values) whether the selected payment option can be granted. You can object to this processing at any time; however, the provider may remain entitled to process the data to execute payment in accordance with the contract.
• Ratepay: Ratepay GmbH, Ritterstr. 12-14, 10969 Berlin, Germany.
  When selecting a payment method with advance performance on your part, your data will be passed on to Ratepay pursuant to Art. 6 (1) lit. b GDPR.
  When selecting a payment method where the provider makes an advance performance (e.g., purchase on account, installment purchase, or direct debit), we transmit your personal data pursuant to Art. 6 (1) lit. f GDPR to Ratepay for the purpose of a credit check. To evaluate the application, credit information from credit agencies may be included (see Ratepay Credit Agencies Overview). You can object to this processing at any time.

9) Web Analytics Services

9.1 Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which enables an analysis of your use of our website. By default, cookies are set and your IP address is truncated by Google by the last digits to exclude direct personal reference. The information is transferred to Google servers and processed there (transfers to Google LLC based in the USA are possible). The data is stored for a period of two months and subsequently deleted.

All processing takes place only if you have given us your explicit consent pursuant to Art. 6 (1) lit. a GDPR. You can revoke your consent at any time via the "Cookie Consent Tool" provided on the website.

Supplementary functions:

• Demographic Characteristics: Creation of anonymous statistics on age, gender, and interests.
• Google Signals: Cross-device analysis with a linked Google account (can be deactivated in your Google account).
• UserIDs: Cross-device analysis for logged-in customer accounts.

For data transfers to the USA, the provider has certified under the EU-US Data Privacy Framework. Further information can be found at Google under: https://business.safety.google/intl/en/privacy/.

9.2 Google Tag Manager

This website uses the "Google Tag Manager" provided by Google Ireland Limited. The service provides a technical basis for managing various web applications via a central interface. The service itself does not store any data on user terminal devices, but forwards your IP address to Google when the page is called up. Processing takes place exclusively on the basis of your explicit consent pursuant to Art. 6 (1) lit. a GDPR via our cookie consent tool.

9.3 PayPal Marketing Solutions

This website uses the web analytics service of PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. By using cookies and tracking technologies, pseudonymized visitor data is collected to create usage profiles and heatmaps. Processing takes place exclusively after you have granted your explicit consent pursuant to Art. 6 (1) lit. a GDPR via our cookie consent tool.

10) Retargeting / Remarketing and Conversion Tracking

10.1 Meta Pixel

We use the "Meta Pixel" service provided by Meta Platforms Ireland Limited, Dublin, Ireland. The service enables Meta to determine visitors to our online offering as a target group for displaying ads ("Ads") on Facebook/Instagram (Custom Audiences) and to evaluate the success of advertisements (conversion tracking). Processing takes place only with consent granted pursuant to Art. 6 (1) lit. a GDPR. Data transfer to the USA is safeguarded via the EU-US Data Privacy Framework.

10.2 Google Ads Remarketing & Conversion Tracking

This website uses Google Ads Remarketing as well as Google Ads Conversion Tracking provided by Google Ireland Limited. For this purpose, cookies or technologies are set in the browser to deliver interest-based advertising and generate conversion statistics. Within Google Ads, we also use the customer match feature (transmission of encrypted customer data to Google for matching with Google accounts).

All processing takes place exclusively on the basis of your explicit consent pursuant to Art. 6 (1) lit. a GDPR. You can revoke your consent at any time via the cookie consent tool or via the browser plugin at Google Ad Center.

10.3 Google Ads Conversion Tracking Without Cookies

If Google Ads Conversion Tracking without cookies is used via your browser's Local Storage, personal data is processed pursuant to Art. 6 (1) lit. f GDPR on the basis of our legitimate interest in the statistical evaluation of our advertising campaigns.

10.4 Google Marketing Platform (GMP)

This website uses the online marketing tool Google Marketing Platform (GMP) provided by Google Ireland Limited to serve relevant ads and optimize campaign reports. Use takes place only after you have granted your explicit consent pursuant to Art. 6 (1) lit. a GDPR.

11) Site Functionalities

11.1 Login With Amazon

We provide a single sign-on function from Amazon EU S.à r.l., Luxembourg. If you have an Amazon account, you can use it to register on our website. The transfer of profile data (name, address, email address) takes place on the basis of your explicit consent pursuant to Art. 6 (1) lit. a GDPR. General integration of the login function takes place pursuant to Art. 6 (1) lit. f GDPR on the basis of our legitimate interest in a user-friendly design of our online presence.

11.2 Google reCAPTCHA

We use the CAPTCHA service of Google Ireland Limited to protect against automated abusive entries (spam/bots). The service checks input data (e.g., IP address, duration of stay) and uses Google Fonts for visual design. If cookies are used, processing takes place on the basis of Art. 6 (1) lit. a GDPR; without cookies on the basis of our legitimate interest pursuant to Art. 6 (1) lit. f GDPR in the security of our website.

12) Rights of the Data Subject (Germany & Austria)

12.1 Applicable data protection law grants you the following data subject rights vis-à-vis the controller with regard to the processing of your personal data:

• Right of access pursuant to Art. 15 GDPR
• Right to rectification pursuant to Art. 16 GDPR
• Right to erasure ("right to be forgotten") pursuant to Art. 17 GDPR
• Right to restriction of processing pursuant to Art. 18 GDPR
• Right to notification pursuant to Art. 19 GDPR
• Right to data portability pursuant to Art. 20 GDPR
• Right to withdraw consent granted pursuant to Art. 7 (3) GDPR
• Right to lodge a complaint pursuant to Art. 77 GDPR

Note on the right to lodge a complaint (Germany & Austria): You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. For this purpose, you can contact the authority responsible for your place of residence or workplace:

• In Germany: To the State Data Protection Commissioner (Landesbeauftragte für den Datenschutz) of your federal state.
• In Austria: To the Austrian Data Protection Authority (Österreichische Datenschutzbehörde - DSB), Barichgasse 40-42, 1030 Vienna, Email: dsb@dsb.gv.at, Web: https://www.dsb.gv.at.

12.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA IN THE CONTEXT OF A BALANCING OF INTERESTS ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST (ART. 6 (1) LIT. F GDPR), YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME WITH EFFECT FOR THE FUTURE FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL TERMINATE THE PROCESSING OF THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS, AND FREEDOMS, OR IF THE PROCESSING SERVES THE ASSERTION, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL TERMINATE THE PROCESSING OF THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

13) Duration of Storage of Personal Data

The duration of the storage of personal data is determined based on the respective legal basis, the purpose of processing, and – if applicable – additionally based on the respective statutory retention period (e.g., commercial and tax retention periods).

When processing personal data on the basis of explicit consent pursuant to Art. 6 (1) lit. a GDPR, the data concerned is stored until you revoke your consent.

If statutory retention periods exist for data processed within the framework of contractual or quasi-contractual obligations on the basis of Art. 6 (1) lit. b GDPR, this data is routinely erased after expiry of the retention periods, provided it is no longer required for contract fulfillment or contract initiation and/or no legitimate interest on our part continues to exist for further storage.

When processing personal data on the basis of Art. 6 (1) lit. f GDPR, this data is stored until you exercise your right to object pursuant to Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights, and freedoms, or the processing serves the assertion, exercise, or defense of legal claims.

When processing personal data for the purpose of direct marketing on the basis of Art. 6 (1) lit. f GDPR, this data is stored until you exercise your right to object pursuant to Art. 21 (2) GDPR.

Unless otherwise indicated in the other information of this declaration regarding specific processing situations, stored personal data will otherwise be erased when it is no longer necessary for the purposes for which it was collected or otherwise processed.