Privacy policy

1) Introduction and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below we inform you about the handling of your personal data when using our website. Personal data means any data with which you can be personally identified.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Mamarella GmbH, Gmunder Str. 53, 81379 Munich, Germany, Tel.: +49 (0)89 - 14727690, Email: support@mamarella.com. The controller responsible for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2) Data Collection When Visiting Our Website

2.1 When using our website for purely informational purposes, i.e., if you do not register or otherwise provide us with information, we only collect data that your browser transmits to the page server (so-called "server log files"). When you access our website, we collect the following data that is technically necessary for us to display the website to you:

• The website you visited
• Date and time at the moment of access
• Amount of data sent in bytes
• Source/referrer from which you reached the site
• Browser used
• Operating system used
• IP address used (if applicable: in anonymized form)

The processing is carried out pursuant to Art. 6 para. 1 lit. f GDPR based on our legitimate interest in improving the stability and functionality of our website. No transfer or other use of the data takes place. However, we reserve the right to retrospectively review the server log files should there be concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the character string "https://" and the lock symbol in your browser’s address bar.

3) Hosting & Content Delivery Network

Shopify

For hosting our website and displaying the page content, we use the system of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland („Shopify“)

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada

All data collected on our website is processed on the provider’s servers. We have concluded a data processing agreement with the provider, which ensures the protection of our site visitors’ data and prohibits unauthorized disclosure to third parties.

In the case of data transfer to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

4) Cookies

In order to make the visit to our website attractive and to enable the use of certain functions, we use cookies, i.e., small text files that are stored on your device. Some of these cookies are automatically deleted after closing the browser (so-called "session cookies"), while others remain on your device longer and allow the storage of page settings (so-called "persistent cookies"). In the latter case, you can find the storage duration in the overview of the cookie settings of your web browser.

If personal data is processed by individual cookies used by us, the processing is carried out in accordance with Art. 6 para. 1 lit. b GDPR either for the performance of the contract, in accordance with Art. 6 para. 1 lit. a GDPR in the case of given consent, or in accordance with Art. 6 para. 1 lit. f GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the site visit.

You can configure your browser so that you are informed about the setting of cookies and decide individually on their acceptance or exclude the acceptance of cookies for certain cases or in general.

Please note that if you do not accept cookies, the functionality of our website may be limited.

5) Contact

5.1 Zendesk

This website uses a live chat system from the following provider: Zendesk International Ltd., 55 Charlemont Place, Saint Kevin's, Dublin D02 F985, Ireland

The processing of personal data transmitted via the chat is carried out either pursuant to Art. 6 para. 1 lit. b GDPR, because it is necessary for the initiation or performance of a contract, or pursuant to Art. 6 para. 1 lit. f GDPR based on our legitimate interest in the effective support of our website visitors.
Your data transmitted in this way will be deleted, subject to any statutory retention periods, once the relevant matter has been conclusively clarified.

Additionally, further information may be collected and evaluated using cookies for the purpose of creating pseudonymized usage profiles, which, however, do not serve to personally identify you and are not merged with other data sets. If this information contains personal references, the processing is carried out pursuant to Art. 6 para. 1 lit. f GDPR based on our legitimate interest in the statistical analysis of user behavior for optimization purposes.

Setting cookies can be prevented by appropriate browser settings. However, in this case, the functionality of our website may be limited. You may object to the collection and storage of data for the purpose of creating a pseudonymized usage profile at any time with effect for the future.

We have concluded a data processing agreement with the provider, which ensures the protection of the data of our website visitors and prohibits unauthorized disclosure to third parties.

5.2 Zendesk

For processing customer inquiries, we use the email ticketing system of the following provider: Zendesk International Ltd., 55 Charlemont Place, Saint Kevin's, Dublin D02 F985, Ireland

If you submit contact inquiries via email through our website, these are stored and organized in the ticket system to enable chronological processing and improve the service experience. You can always view the current status of the processing of your request via the individually assigned ticket number.

For the organization and processing of inquiries, personal data is collected to the extent provided, but at least name, first name, and email address, transmitted to the provider, stored there, and accessed.

The legal basis for processing this data is our legitimate interest in the efficient design of our customer service, the prompt response to your request, and the optimization of our service offering pursuant to Art. 6 para. 1 lit. f GDPR.

We have concluded a data processing agreement with the provider, which ensures the protection of the data of our website visitors and prohibits unauthorized disclosure to third parties.

5.3 WhatsApp Business

You have the option to contact us via the messaging service WhatsApp of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For this purpose, we use the so-called "Business Version" of WhatsApp.

If you contact us via WhatsApp in connection with a specific transaction (for example, a placed order), we store and use the mobile phone number you use on WhatsApp as well as – if provided – your first and last name pursuant to Art. 6 para. 1 lit. b GDPR to process and respond to your request. Based on the same legal basis, we may ask you via WhatsApp to provide further data (order number, customer number, address, or email address) in order to assign your inquiry to a specific transaction.

If you use our WhatsApp contact for general inquiries (such as about the range of services, availability, or our website), we store and use the mobile phone number you use on WhatsApp as well as – if provided – your first and last name pursuant to Art. 6 para. 1 lit. f GDPR based on our legitimate interest in the efficient and timely provision of the requested information.

Your data is always used only to respond to your inquiry via WhatsApp. No disclosure to third parties takes place.

Please note that WhatsApp Business obtains access to the address book of the mobile device we use for this purpose and automatically transfers telephone numbers stored in the address book to a server of the parent company Meta Platforms Inc. in the USA. For operating our WhatsApp Business account, we use a mobile device whose address book contains exclusively the WhatsApp contact data of users who have also contacted us via WhatsApp.

This ensures that every person whose WhatsApp contact data is stored in our address book has already consented to the transmission of their WhatsApp phone number from the address books of their chat contacts pursuant to Art. 6 para. 1 lit. a GDPR by accepting the WhatsApp terms of use upon first use of the app on their device. The transmission of data of users who do not use WhatsApp and/or have not contacted us via WhatsApp is therefore excluded.

For the purpose and scope of data collection and the further processing and use of data by WhatsApp as well as your related rights and privacy settings, please refer to WhatsApp’s privacy policy: https://www.whatsapp.com/legal/?eea=1#privacy-policy

We have concluded a data processing agreement with the provider that protects the data of our website visitors and prohibits disclosure to third parties.

In the course of the above-mentioned processing, data transfers to servers of Meta Platforms Inc. in the USA may occur.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level based on an adequacy decision by the European Commission.

5.4 In the context of contacting us (e.g., via contact form or email), personal data is processed exclusively for the purpose of handling and responding to your request and only to the extent necessary for this purpose.

The legal basis for processing this data is our legitimate interest in responding to your request pursuant to Art. 6 para. 1 lit. f GDPR. If your contact is aimed at a contract, the additional legal basis for processing is Art. 6 para. 1 lit. b GDPR. Your data will be deleted when it can be inferred from the circumstances that the relevant matter has been conclusively clarified and provided that no statutory retention obligations oppose this.

6) Data Processing When Opening a Customer Account

In accordance with Art. 6 para. 1 lit. b GDPR, personal data will continue to be collected and processed to the extent necessary when you provide it to us during the opening of a customer account. Which data is required for opening the account can be found in the input mask of the corresponding form on our website.

Deletion of your customer account is possible at any time and can be requested by sending a message to the above-mentioned address of the controller. After deletion of your customer account, your data will be deleted provided that all contracts concluded through it have been fully fulfilled, no statutory retention periods prevent deletion, and we have no legitimate interest in further storage.

7) Use of Customer Data for Direct Advertising

7.1 Registration for Our Email Newsletter

If you register for our email newsletter, we will regularly send you information about our offers. The only mandatory information for sending the newsletter is your email address. Providing additional data is voluntary and is used to address you personally. For sending the newsletter, we use the so-called double opt-in procedure, which ensures that you only receive newsletters after you have explicitly confirmed your consent to receive the newsletter by clicking a verification link sent to the specified email address.

By activating the confirmation link, you give us your consent to use your personal data pursuant to Art. 6 para. 1 lit. a GDPR. In this context, we store the IP address assigned to you by your Internet Service Provider (ISP) as well as the date and time of registration to be able to trace any possible misuse of your email address at a later time. The data collected by us during newsletter registration is used strictly for the intended purpose.

You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending a corresponding message to the controller named at the beginning. After successful deregistration, your email address will be deleted from our newsletter distribution list immediately, unless you have explicitly consented to further use of your data or we reserve the right to use data beyond this, which is legally permitted and about which we inform you in this declaration.

7.2 Sending Email Newsletters to Existing Customers

If you have provided us with your email address when purchasing goods or services, we reserve the right to regularly send you offers for similar goods or services from our range by email. For this purpose, we do not need to obtain separate consent from you pursuant to § 7 para. 3 UWG. The data processing is based solely on our legitimate interest in personalized direct advertising pursuant to Art. 6 para. 1 lit. f GDPR. If you initially objected to the use of your email address for this purpose, no emails will be sent by us.

You have the right to object to the use of your email address for the aforementioned advertising purpose at any time with effect for the future by sending a message to the controller named at the beginning. Only transmission costs according to the basic tariffs will be charged to you. After receipt of your objection, the use of your email address for advertising purposes will be discontinued immediately.

7.3 Klaviyo

The sending of our email newsletters and other promotional email communications is carried out via this provider: Klaviyo, Inc., 125 Summer St., Ste 600, Boston, MA 02110, USA

Based on our legitimate interest in effective and user-friendly email marketing, we forward the data you provide during registration pursuant to Art. 6 para. 1 lit. f GDPR to this provider so that they can carry out the mailing on our behalf.

Subject to your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR, the provider also conducts a statistical success evaluation of mail campaigns using web beacons or tracking pixels in the sent emails, which can measure open rates and specific interactions with the newsletter content. Device information (e.g., time of access, IP address, browser type, and operating system) is also collected and evaluated but is not merged with other data sets.

You can revoke your consent to mail tracking at any time with effect for the future.

We have concluded a data processing agreement with the provider that protects the data of our website visitors and prohibits disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level based on an adequacy decision by the European Commission.

7.4 Rapidmail

The sending of our email newsletters is carried out via this provider: rapidmail GmbH, Wentzingerstraße 21, 79106 Freiburg, Germany

Based on our legitimate interest in effective and user-friendly newsletter marketing, we forward the data you provide during newsletter registration pursuant to Art. 6 para. 1 lit. f GDPR to this provider so that they can carry out the newsletter dispatch on our behalf.

Subject to your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR, the provider also conducts a statistical success evaluation of newsletter campaigns using web beacons or tracking pixels in the sent emails, which can measure open rates and specific interactions with the newsletter content. Device information (e.g., time of access, IP address, browser type, and operating system) is also collected and evaluated but is not merged with other data sets.
You can revoke your consent to newsletter tracking at any time with effect for the future.

We have concluded a data processing agreement with the provider that protects the data of our website visitors and prohibits disclosure to third parties.

7.5 WhatsApp Newsletter

If you register for our WhatsApp newsletter, we will regularly send you information about our offers via WhatsApp. The only mandatory information for sending the newsletter is your mobile phone number.

To send the newsletter, you add our provided mobile phone number to the address contacts of your mobile device and send us the message “Start” via WhatsApp. By sending this WhatsApp message, you give us your consent to use your personal data pursuant to Art. 6 para. 1 lit. a GDPR for the purpose of sending the newsletter. We will then add you to our newsletter distribution list.

The data collected by us during newsletter registration is processed exclusively for the purpose of advertising via the newsletter. You can unsubscribe from the newsletter at any time by sending us the message “Stop” via WhatsApp. After successful deregistration, your mobile phone number will be deleted from our newsletter distribution list immediately, unless you have explicitly consented to further use of your data or we reserve the right to use data beyond this, which is legally permitted and about which we inform you in this declaration.

Please note that WhatsApp Business obtains access to the address book of the mobile device we use for this purpose and automatically transfers phone numbers stored in the address book to a server of the parent company Meta Platforms Inc. in the USA.

For sending our WhatsApp newsletter, we therefore use a mobile device whose address book contains only the WhatsApp contact data of our newsletter recipients. This ensures that every person whose WhatsApp contact data is stored in our address book has already consented to the transmission of their WhatsApp phone number from the address books of their chat contacts pursuant to Art. 6 para. 1 lit. a GDPR by accepting the WhatsApp terms of use when first using the app on their device. Transmission of data of users who do not use WhatsApp and/or have not contacted us via WhatsApp is thus excluded.

The purpose and scope of data collection and the further processing and use of data by WhatsApp as well as your related rights and privacy settings can be found in WhatsApp’s privacy policy: https://www.whatsapp.com/legal/?eea=1#privacy-policy

We have concluded a data processing agreement with WhatsApp that protects the data of our newsletter recipients and prohibits disclosure to third parties.

In the context of the above-mentioned processing, data transfers to servers of Meta Platforms Inc. in the USA may occur.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level based on an adequacy decision by the European Commission.

7.6 - Klaviyo

The sending of our WhatsApp newsletters is carried out via this provider: Klaviyo, Inc., 125 Summer St., Ste 600, Boston, MA 02110, USA

Based on our legitimate interest in effective and user-friendly newsletter marketing, we forward the phone number linked to your WhatsApp account and, if applicable, your first and last name pursuant to Art. 6 para. 1 lit. f GDPR to this provider so that they can carry out the newsletter dispatch on our behalf.

Subject to your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR, the provider also conducts a statistical success evaluation of newsletter campaigns using web beacons or tracking pixels in the sent WhatsApp messages, which can measure open rates and specific interactions with the newsletter content. Device information (e.g., time of access, IP address, browser type, and operating system) is also collected and evaluated but is not merged with other data sets.

You can revoke your consent to newsletter tracking at any time with effect for the future.

We have concluded a data processing agreement with the provider that protects the data of our website visitors and prohibits disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level based on an adequacy decision by the European Commission.

7.7 Email Notification of Product Availability

For temporarily unavailable items, you can register to receive email notifications of product availability. We will send you a one-time email notification about the availability of the item you selected. The only mandatory information for sending this notification is your email address. Providing additional data is voluntary and may be used to address you personally. For sending the email, we use the so-called double opt-in procedure, which ensures that you only receive a notification after you have explicitly confirmed your consent by clicking a verification link sent to the specified email address.

By activating the confirmation link, you give us your consent to use your personal data pursuant to Art. 6 para. 1 lit. a GDPR. In this context, we store the IP address assigned to you by your Internet Service Provider (ISP) as well as the date and time of registration to be able to trace any possible misuse of your email address at a later time. The data collected by us during registration for our email notification service for product availability is used strictly for the intended purpose.

You can unsubscribe from the availability notifications at any time by sending a corresponding message to the controller named at the beginning. After successful deregistration, your email address will be deleted from the distribution list set up for this purpose immediately, unless you have explicitly consented to further use of your data or we reserve the right to use data beyond this, which is legally permitted and about which we inform you in this declaration.

7.8 Email Cart Reminders

If you abandon your purchase with us before completing the order, you have the option to receive a one-time email reminder of the contents of your virtual shopping cart.

The only mandatory information for sending this reminder is your email address. Providing additional data is voluntary and may be used to address you personally. For sending the email, we use the so-called double opt-in procedure, which ensures that you only receive a notification after you have explicitly confirmed your consent by clicking a verification link sent to the specified email address.

By activating the confirmation link, you give us your consent to use your personal data pursuant to Art. 6 para. 1 lit. a GDPR for sending a cart reminder. In this context, we store the IP address assigned to you by your Internet Service Provider (ISP) as well as the date and time of registration to be able to trace any possible misuse of your email address at a later time. The data collected by us during registration for our email notification service is used strictly for the intended purpose.

You can unsubscribe from cart reminders at any time by sending a corresponding message to the controller named at the beginning. After successful deregistration, your email address will be deleted from the distribution list set up for this purpose immediately, unless you have explicitly consented to further use of your data or we reserve the right to use data beyond this, which is legally permitted and about which we inform you in this declaration.

8) Data Processing for Order Fulfillment

8.1 To the extent necessary for contract fulfillment for delivery and payment purposes, the personal data collected by us will be transmitted in accordance with Art. 6 para. 1 lit. b GDPR to the commissioned shipping company and the commissioned financial institution.

If, based on a corresponding contract, we owe you updates for goods with digital elements or for digital products, we process the contact data you provided during the order to personally inform you within the scope of our legal information obligations pursuant to Art. 6 para. 1 lit. c GDPR. Your contact data will be used strictly for the purpose of notifications about updates owed by us and will only be processed by us to the extent necessary for the respective information.

For the processing of your order, we also cooperate with the following service provider(s) who support us wholly or partly in the execution of concluded contracts. Certain personal data will be transmitted to these service providers in accordance with the following information.

8.2 Post & DHL Shipping (official)

For the preparation of shipping, we use the services of the following provider: Deutsche Post DHL Research And Innovation GmbH, Kurt-Schumacher-Str. 1, 53113 Bonn
In accordance with Art. 6 para. 1 lit. b GDPR, we transmit digital shipping labels with your delivery information exclusively for the purpose of processing your online order from our order processing system to the provider, who then sends these to our local printers to enable printing. Data is only shared to the extent actually necessary for processing.

8.3 Disclosure of Personal Data to Shipping Service Providers

- DHL

As a transport service provider, we use the following provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany

We disclose your email address and/or telephone number pursuant to Art. 6 para. 1 lit. a GDPR before delivery of the goods for the purpose of coordinating a delivery appointment or for delivery notification to the provider, provided you have given your explicit consent during the ordering process. Otherwise, for delivery purposes pursuant to Art. 6 para. 1 lit. b GDPR, only the recipient's name and delivery address are disclosed to the provider. Disclosure only occurs to the extent necessary for the delivery of goods. In this case, prior coordination of the delivery appointment with the provider or delivery notification is not possible.

The consent can be revoked at any time with effect for the future vis-à-vis the above-mentioned controller or the provider.
- DHL Express

As a transport service provider, we use the following provider: DHL Express Germany GmbH, Heinrich-Brüning-Str. 5, 53113 Bonn, Germany

We disclose your email address and/or telephone number pursuant to Art. 6 para. 1 lit. a GDPR before delivery of the goods for the purpose of coordinating a delivery appointment or for delivery notification to the provider, provided you have given your explicit consent during the ordering process. Otherwise, for delivery purposes pursuant to Art. 6 para. 1 lit. b GDPR, only the recipient's name and delivery address are disclosed to the provider. Disclosure only occurs to the extent necessary for the delivery of goods. In this case, prior coordination of the delivery appointment with the provider or delivery notification is not possible.

The consent can be revoked at any time with effect for the future vis-à-vis the above-mentioned controller or the provider.
- GLS

As a transport service provider, we use the following provider: General Logistics Systems Germany GmbH & Co. OHG, GLS Germany-Straße 1 – 7, 36286 Neuenstein, Germany

We disclose your email address and/or telephone number pursuant to Art. 6 para. 1 lit. a GDPR before delivery of the goods for the purpose of coordinating a delivery appointment or for delivery notification to the provider, provided you have given your explicit consent during the ordering process. Otherwise, for delivery purposes pursuant to Art. 6 para. 1 lit. b GDPR, only the recipient's name and delivery address are disclosed to the provider. Disclosure only occurs to the extent necessary for the delivery of goods. In this case, prior coordination of the delivery appointment with the provider or delivery notification is not possible.

The consent can be revoked at any time with effect for the future vis-à-vis the above-mentioned controller or the provider.
- Hermes

As a transport service provider, we use the following provider: Hermes Logistik Gruppe Deutschland GmbH, Essener Straße 89, 22419 Hamburg, Germany

We disclose your email address and/or telephone number pursuant to Art. 6 para. 1 lit. a GDPR before delivery of the goods for the purpose of coordinating a delivery appointment or for delivery notification to the provider, provided you have given your explicit consent during the ordering process. Otherwise, for delivery purposes pursuant to Art. 6 para. 1 lit. b GDPR, only the recipient's name and delivery address are disclosed to the provider. Disclosure only occurs to the extent necessary for the delivery of goods. In this case, prior coordination of the delivery appointment with the provider or delivery notification is not possible.

The consent can be revoked at any time with effect for the future vis-à-vis the above-mentioned controller or the provider.
- UPS

As a transport service provider, we use the following provider: United Parcel Service Deutschland Inc. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany

We disclose your email address and/or telephone number pursuant to Art. 6 para. 1 lit. a GDPR before delivery of the goods for the purpose of coordinating a delivery appointment or for delivery notification to the provider, provided you have given your explicit consent during the ordering process. Otherwise, for delivery purposes pursuant to Art. 6 para. 1 lit. b GDPR, only the recipient's name and delivery address are disclosed to the provider. Disclosure only occurs to the extent necessary for the delivery of goods. In this case, prior coordination of the delivery appointment with the provider or delivery notification is not possible.

The consent can be revoked at any time with effect for the future vis-à-vis the above-mentioned controller or the provider.

8.4 Use of Payment Service Providers (Payment Services)

- Apple Pay

If you choose the payment method “Apple Pay” of Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, the payment processing is carried out via the “Apple Pay” function of your device operated with iOS, watchOS, or macOS by charging a payment card stored in “Apple Pay.” Apple Pay uses security features integrated into the hardware and software of your device to protect your transactions. To authorize a payment, you must enter a code previously set by you and verify via the “Face ID” or “Touch ID” function of your device.

For the purpose of payment processing, the information you provide during the ordering process along with information about your order is transmitted to Apple in encrypted form. Apple then encrypts this data again with a developer-specific key before transmitting the data to the payment service provider of the payment card stored in Apple Pay to carry out the payment. The encryption ensures that only the website through which the purchase was made can access the payment data. After the payment is made, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website to confirm the payment success.

If personal data is processed during the described transmissions, the processing is carried out exclusively for the purpose of payment processing pursuant to Art. 6 para. 1 lit. b GDPR.

Apple stores anonymized transaction data, including the approximate purchase amount, approximate date and time, and whether the transaction was successfully completed. Anonymization completely excludes any personal reference. Apple uses the anonymized data to improve “Apple Pay” and other Apple products and services.

If you use Apple Pay on the iPhone or Apple Watch to complete a purchase made via Safari on the Mac, the Mac and the authorization device communicate via an encrypted channel on Apple servers. Apple does not process or store any of this information in a format that can identify you personally. You can disable the ability to use Apple Pay on your Mac in your iPhone settings. Go to “Wallet & Apple Pay” and disable “Allow Payments on Mac.”

Further information on data protection with Apple Pay can be found at the following internet address: https://support.apple.com/de-de/HT203027
- Google Pay

If you choose the payment method “Google Pay” of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), the payment processing is carried out via the “Google Pay” application of your mobile device operated with at least Android 4.4 (“KitKat”) and equipped with an NFC function by charging a payment card stored in Google Pay or a verified payment system there (e.g., PayPal). To authorize a payment via Google Pay exceeding €25, unlocking your mobile device by the respective verification method set up (such as facial recognition, password, fingerprint, or pattern) is required.

For the purpose of payment processing, the information you provide during the ordering process along with information about your order is transmitted to Google. Google then transmits your payment information stored in Google Pay in the form of a one-time assigned transaction number to the originating website, which verifies the payment made. This transaction number contains no information about the real payment data of your payment methods stored in Google Pay but is created and transmitted as a one-time valid numerical token. For all transactions via Google Pay, Google acts solely as an intermediary for processing the payment transaction. The transaction is carried out exclusively between the user and the originating website by charging the payment method stored in Google Pay.

If personal data is processed during the described transmissions, the processing is carried out exclusively for the purpose of payment processing pursuant to Art. 6 para. 1 lit. b GDPR.

Google reserves the right to collect, store, and evaluate certain transaction-specific information for each transaction made via Google Pay. This includes date, time, and amount of the transaction, merchant location and description, a description of the purchased goods or services provided by the merchant, photos you attached to the transaction, the name and email address of the seller and buyer or sender and recipient, the payment method used, your description of the reason for the transaction, and possibly the offer associated with the transaction.

According to Google, this processing is carried out exclusively pursuant to Art. 6 para. 1 lit. f GDPR based on the legitimate interest in proper accounting, verification of transaction data, and optimization and maintenance of the Google Pay service.

Google also reserves the right to combine the processed transaction data with other information collected and stored by Google when using other Google services.

The terms of use for Google Pay can be found here:

https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=de
Further information on data protection with Google Pay can be found at the following internet address:
https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de
- Paypal

One or more online payment methods of the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method of the provider where you pay in advance, your payment data provided during the ordering process (including name, address, bank and card information, currency, and transaction number) as well as information about the content of your order will be transmitted to the provider pursuant to Art. 6 para. 1 lit. b GDPR. The transmission of your data in this case is exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

If you select a payment method where we pay in advance, you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, telephone number, possibly data on an alternative payment method).

To protect our legitimate interest in determining your creditworthiness in such cases, these data will be forwarded by us pursuant to Art. 6 para. 1 lit. f GDPR to the provider for the purpose of a credit check. The provider checks, based on the personal data you provided as well as other data (such as shopping cart, invoice amount, order history, payment experiences), whether the payment method you selected can be granted with regard to payment and/or default risks.

The credit report may contain probability values (so-called score values). To the extent that score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of the score values includes, among other things but not exclusively, address data.

You can object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may still be entitled to process your personal data if this is necessary for contract-compliant payment processing.
- Paypal Checkout

This website uses PayPal Checkout, an online payment system from PayPal, which consists of PayPal's own payment methods and local payment methods from third-party providers.

When paying via PayPal, credit card via PayPal, direct debit via PayPal, or – if offered – “Pay Later” via PayPal, we forward your payment data within the scope of payment processing to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”). The disclosure is made pursuant to Art. 6 para. 1 lit. b GDPR and only to the extent necessary for payment processing.

PayPal reserves the right to conduct a credit check for the payment methods credit card via PayPal, direct debit via PayPal, or – if offered – “Pay Later” via PayPal. For this purpose, your payment data may be forwarded to credit agencies pursuant to Art. 6 para. 1 lit. f GDPR based on PayPal's legitimate interest in determining your creditworthiness. The result of the credit check regarding the statistical probability of default is used by PayPal to decide on the provision of the respective payment method. The credit report may contain probability values (so-called score values). To the extent that score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of the score values includes, among other things but not exclusively, address data. You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for contract-compliant payment processing.

If the PayPal payment method “Invoice Purchase” is available and selected, your payment data will initially be transmitted to PayPal to prepare the payment, after which PayPal forwards it to Ratepay GmbH, Franklinstraße 28-29, 10587 Berlin (“Ratepay”) to carry out the payment. The legal basis is always Art. 6 para. 1 lit. b GDPR. In this case, RatePay conducts an identity and credit check in its own name to determine creditworthiness according to the principle already described above and forwards your payment data to credit agencies based on the legitimate interest in determining creditworthiness pursuant to Art. 6 para. 1 lit. f GDPR. A list of credit agencies that Ratepay can access can be found here: https://www.ratepay.com/legal-payment-creditagencies/

If you use the payment method of a local third-party provider, your payment data will initially be transmitted to PayPal for payment preparation pursuant to Art. 6 para. 1 lit. b GDPR. Depending on your selection of an available local payment method, PayPal will then transmit your payment data for payment execution pursuant to Art. 6 para. 1 lit. b GDPR to the respective provider:

- Apple Pay (Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
- Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)
- iDeal (Currence Holding BV, Beethovenstraat 300 Amsterdam, Netherlands)
- bancontact (Bancontact Payconiq Company, Rue d'Arlon 82, 1040 Brussels, Belgium)
- blik (Polski Standard Płatności sp. z o.o., ul. Czerniakowska 87A, 00-718 Warsaw, Poland)
- eps (PSA Payment Services Austria GmbH, Handelskai 92, Gate 2
1200 Vienna, Austria)
- MyBank (PRETA S.A.S, 40 Rue de Courcelles, F-75008 Paris, France)
- Przelewy24 (PayPro SA, Kanclerska 15A, 60-326 Poznań, Poland)

For further data protection information, please refer to PayPal's privacy policy: https://www.paypal.com/de/legalhub/paypal/privacy-full
- Shopify Payments

One or more online payment methods of the following provider are available on this website: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

If you select a payment method of the provider where you pay in advance (e.g., credit card payment), your payment data provided during the ordering process (including name, address, bank and card information, currency, and transaction number) as well as information about the content of your order will be transmitted to the provider pursuant to Art. 6 para. 1 lit. b GDPR. The transmission of your data in this case is exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

9) Web Analytics Services

9.1 Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which enables an analysis of your use of our website.

By default, Google Analytics 4 sets cookies when you visit the website, which are small text files stored on your device and collect certain information. This information includes your IP address, which is however truncated by Google to exclude direct personal identification.

The information is transmitted to Google servers and processed there. Transfers to Google LLC based in the USA are also possible.

Google uses the collected information on our behalf to evaluate your use of the website, compile reports on website activity for us, and provide other services related to website and internet usage. The truncated IP address transmitted by your browser within Google Analytics is not merged with other Google data. The data collected through Google Analytics 4 is stored for a period of two months and then deleted.

All processing described above, especially the setting of cookies on the device used, only takes place if you have given us your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR.
Without your consent, the use of Google Analytics 4 during your visit will not take place. You can revoke your consent at any time with effect for the future. To exercise your right of revocation, please deactivate this service via the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with Google that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

Further legal information about Google Analytics 4 can be found at https://business.safety.google/intl/de/privacy/, https://policies.google.com/privacy?hl=de&gl=de and at https://policies.google.com/technologies/partner-sites

Demographic Characteristics
Google Analytics 4 uses the special feature "demographic characteristics" and can create statistics that provide information about the age, gender, and interests of website visitors. This is done by analyzing advertising and information from third parties. This allows target groups to be identified for marketing activities. However, the collected data cannot be assigned to any specific person and is deleted after being stored for two months.

Google Signals
As an extension to Google Analytics 4, Google Signals may be used on this website to create cross-device reports. If you have enabled personalized ads and linked your devices to your Google account, Google may, subject to your consent to the use of Google Analytics pursuant to Art. 6 para. 1 lit. a GDPR, analyze your usage behavior across devices and create database models, including for cross-device conversions. We do not receive any personal data from Google, only statistics. If you wish to stop cross-device analysis, you can disable the "Personalized Ads" feature in your Google account settings. Please follow the instructions on this page: https://support.google.com/My-Ad-Center-Help/answer/12155764?hl=de
Further information about Google Signals can be found at the following link: https://support.google.com/analytics/answer/7532985?hl=de

UserIDs
As an extension to Google Analytics 4, the "UserIDs" feature may be used on this website. If you have consented to the use of Google Analytics 4 pursuant to Art. 6 para. 1 lit. a GDPR, have created an account on this website, and log in on different devices with this account, your activities, including conversions, can be analyzed across devices.

Collection of Data Provided by Users
To improve analysis results for users whose contact data we have received in the context of business or business-like relationships, we use the feature "Collection of Data Provided by Users".
Subject to your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR, we transmit one or more files containing aggregated customer data about you (especially email address and phone number) electronically to Google within this feature. Google does not gain access to clear data but automatically encrypts the information in the customer files during the transmission process using a special algorithm. The encrypted information can then only be used by Google to match it to existing Google accounts set up by the data subjects.
The processing serves to refine measurement data, improves cross-device user tracking, and enables the integration of analysis results into advertising personalization and conversion tracking functions of Google Ads.
You can revoke your consent to us at any time with effect for the future. Further information on Google's data protection measures regarding the transmission of customer data can be found here: https://support.google.com/google-ads/answer/6334160?hl=de&ref_topic=10550182

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level based on an adequacy decision by the European Commission.

9.2 Google Tag Manager

This website uses the "Google Tag Manager", a service of the following provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google").

The Google Tag Manager provides a technical foundation to bundle various web applications, including tracking and analytics services, and to calibrate, control, and link them to conditions via a unified user interface. The Google Tag Manager itself does not store any information on user devices or read such information. It also does not perform independent data analyses. However, the Google Tag Manager transmits your IP address to Google upon page call and may store it there. Transfers to servers of Google LLC in the USA are also possible.

This processing only takes place if you have given us your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR. Without this consent, the use of Google Tag Manager during your visit will not take place. You can revoke your consent at any time with effect for the future. To exercise your revocation, please deactivate this service in the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level based on an adequacy decision by the European Commission.

Further legal information about Google Tag Manager can be found at https://business.safety.google/intl/de/privacy/ and https://policies.google.com/privacy?hl=de&gl=de

10) Retargeting/Remarketing and Conversion Tracking

10.1 Meta Pixel

Within our online offering, we use the service "Meta Pixel" from the following provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Meta").

If a user clicks on an advertisement placed by us on Facebook and/or Instagram, the URL of our linked page is extended by a parameter using "Meta Pixel." This URL parameter is then entered into the user's browser via a cookie set by our linked page itself after the redirect.

This enables Meta, on the one hand, to determine the visitors of our online offering as a target group for displaying advertisements (so-called "Ads"). Accordingly, we use the service to show the Facebook and/or Instagram ads placed by us only to those users who have shown an interest in our online offering or who exhibit certain characteristics (e.g., interests in specific topics or products determined based on the visited websites) which we transmit to Meta (so-called "Custom Audiences").

On the other hand, the "Meta Pixel" can track whether users were redirected to our website after clicking on an advertisement and what actions they perform there (so-called "Conversion Tracking").

The data collected is anonymous to us and therefore does not allow conclusions about the identity of the users. However, the data is stored and processed by Meta, so a connection to the respective user profile is possible, and Meta can use the data for its own advertising purposes.

All the processing described above, especially setting cookies to read information on the device used, is only carried out if you have given us your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future by disabling this service in the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with the provider that ensures the protection of the data of our site visitors and prohibits unauthorized disclosure to third parties.

The information generated by Meta is usually transmitted to a Meta server and stored there; in this context, a transfer to servers of Meta Platforms Inc. in the USA may also occur.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level based on an adequacy decision by the European Commission.

10.2 Google Ads Remarketing

This website uses retargeting technology from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

For this purpose, Google sets a cookie in the browser of your device, which automatically enables interest-based advertising using a pseudonymous cookie ID and based on the pages you have visited. Further data processing only takes place if you have consented to Google linking your internet and app browser history with your Google account and using information from your Google account to personalize ads you view on the web. If you are logged into Google during your visit to our website, Google uses your data together with Google Analytics data to create and define audience lists for cross-device remarketing. For this purpose, your personal data is temporarily linked with Google Analytics data to form audiences. In the context of using Google Ads Remarketing, personal data may also be transferred to servers of Google LLC in the USA.

All the processing described above, especially setting cookies to read information on the device used, is only carried out if you have given us your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR. Without this consent, the use of retargeting technology during your visit is omitted.

You can revoke your consent at any time with effect for the future. To exercise your revocation, please disable this service in the "Cookie Consent Tool" provided on the website.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level based on an adequacy decision by the European Commission.

Details about the processing initiated by Google and Google's handling of data from websites can be found here: https://policies.google.com/technologies/partner-sites

Further information on Google's privacy policies can be found here: https://business.safety.google/intl/de/privacy/ and https://www.google.de/policies/privacy/

10.3 Pinterest Retargeting Pixel

This website uses retargeting technology from the following provider: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland.

This enables us to specifically address visitors of our websites with personalized, interest-based advertising who have already shown interest in our shop and products. The display of advertising media is based on a cookie-based analysis of past and current usage behavior.

In cases of retargeting technology, a cookie is stored on your computer or mobile device to collect pseudonymized data about your interests and thus individually tailor the advertising to the stored information. These cookies are small text files stored on your computer or mobile device. This way, you are shown advertising that is highly likely to correspond to your product and information interests.

All the processing described above, especially setting cookies to read information on the device used, is only carried out if you have given us your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR. Without this consent, the use of retargeting technology during your visit is omitted.

You can revoke your consent at any time with effect for the future. To exercise your revocation, please disable this service in the "Cookie Consent Tool" provided on the website.

10.4 Taboola

This website uses retargeting technology from the following provider: Taboola Inc., 16 Madison Square West 7th Floor, New York, NY 10010, USA.

This enables us to specifically address visitors of our websites with personalized, interest-based advertising who have already shown interest in our shop and products. The display of advertising media is based on a cookie-based analysis of past and current usage behavior.

In cases of retargeting technology, a cookie is stored on your computer or mobile device to collect pseudonymized data about your interests and thus individually tailor the advertising to the stored information. These cookies are small text files stored on your computer or mobile device. This way, you are shown advertising that is highly likely to correspond to your product and information interests.

All the processing described above, especially setting cookies to read information on the device used, is only carried out if you have given us your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR. Without this consent, the use of retargeting technology during your visit is omitted.

You can revoke your consent at any time with effect for the future. To exercise your revocation, please disable this service in the "Cookie Consent Tool" provided on the website.

For data transfers to the USA, the provider relies on standard contractual clauses of the European Commission, which are intended to ensure compliance with the European data protection level.

10.5 Google Ads Conversion Tracking

This website uses the online advertising program "Google Ads" and, within the framework of Google Ads, the conversion tracking of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

We use the Google Ads service to draw attention to our attractive offers on external websites using advertising media (so-called Google AdWords). In relation to the data from the advertising campaigns, we can determine how successful the individual advertising measures are. Our aim is to show you advertising that is of interest to you, to make our website more interesting for you, and to achieve a fair calculation of the advertising costs incurred.

The cookie for conversion tracking is set when a user clicks on an ad placed by Google Ads. Cookies are small text files stored on your device. These cookies usually expire after 30 days and are not used for personal identification. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognize that the user clicked on the ad and was redirected to this page. Each Google Ads customer receives a different cookie. Cookies cannot therefore be tracked across the websites of Google Ads customers. The information collected using the conversion cookie is used to create conversion statistics for Google Ads customers who have opted for conversion tracking. The customers learn the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they do not receive any information that would allow users to be personally identified.

In the context of using Google Ads, personal data may also be transferred to servers of Google LLC in the USA.

Details about the processing initiated by Google Ads Conversion Tracking and Google's handling of data from websites can be found here: https://policies.google.com/technologies/partner-sites

All the processing described above, especially setting cookies to read information on the device used, is only carried out if you have given us your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future by disabling this service in the "Cookie Consent Tool" provided on the website.

You can also permanently object to the setting of cookies by Google Ads Conversion Tracking by downloading and installing the browser plug-in available at the following link:
https://support.google.com/My-Ad-Center-Help/answer/12155656?hl=de

To address users whose data we have received in the context of business or business-like relationships in an even more interest-based manner, we use a customer matching function within Google Ads. For this purpose, we electronically transmit one or more files with aggregated customer data (mainly email addresses and phone numbers) to Google. Google does not gain access to clear data but automatically encrypts the information in the customer files during the transmission process using a special algorithm. The encrypted information can then only be used by Google to assign it to existing Google accounts set up by the data subjects. This enables the display of personalized advertising across all Google services linked to the respective Google account.

The transmission of customer data to Google only takes place if you have given us your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR. You can revoke this consent at any time with effect for the future. Further information on Google's data protection measures regarding the customer matching function can be found here: https://support.google.com/google-ads/answer/6334160?hl=de&ref_topic=10550182
Google's privacy policies can be viewed here: https://business.safety.google/intl/de/privacy/ and https://www.google.de/policies/privacy/

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level based on an adequacy decision by the European Commission.

10.6 Pinterest Tag Conversion Tracking

This website uses the conversion tracking technology of the following provider: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland.

If you have arrived on our website from an advertisement on the provider's domain, the success of the advertisement can be tracked using cookies and/or comparable technologies (tracking pixels, web beacons, pings, or HTTP requests).

For this purpose, certain device and browser information, including possibly your IP address, is read out via the tracking technology to capture and evaluate predefined user actions by us (e.g., completed transactions, leads, searches on the website, views of product pages). This enables the creation of statistics about user behavior on our website after being redirected from an advertisement, which serve to optimize our offering.
All the processing described above, especially setting cookies to read information on the device used, is only carried out if you have given us your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future by disabling this service in the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with the provider that ensures the protection of the data of our site visitors and prohibits unauthorized disclosure to third parties.

10.7 TikTok Pixel

This website uses the conversion tracking technology of the following provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.

If you have arrived on our website from an advertisement on the provider's domain, the success of the advertisement can be tracked using cookies and/or comparable technologies (tracking pixels, web beacons, pings, or HTTP requests).

For this purpose, certain device and browser information, including possibly your IP address, is read out via the tracking technology to capture and evaluate predefined user actions by us (e.g., completed transactions, leads, searches on the website, views of product pages). This enables the creation of statistics about user behavior on our website after being redirected from an advertisement, which serve to optimize our offering.

All the processing described above, especially setting cookies to read information on the device used, is only carried out if you have given us your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future by disabling this service in the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with the provider that ensures the protection of the data of our site visitors and prohibits unauthorized disclosure to third parties.

11) Website Functionalities

11.1 Facebook Plugins

Plugins from the social network of the following provider are used on our website: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

These plugins enable direct interactions with content on the social network.

To increase the protection of your data when visiting our website, the plugins are initially deactivated and integrated into the site using a so-called "2-click" or "Shariff" solution.

This integration ensures that when a page of our website containing such plugins is accessed, no connection to the provider's servers is established yet.

Only when you activate the plugins and thereby give your consent to the data transmission pursuant to Art. 6 para. 1 lit. a GDPR, your browser establishes a direct connection to the provider's servers. In this process, information about your device used (including your IP address), your browser, and your browsing history is transmitted to the provider and possibly further processed there, regardless of whether you are logged into an existing user profile.

If you are logged into an existing user profile on the provider's social network, information about interactions performed via the plugins is also published there and shown to your contacts.
You can revoke your consent at any time by deactivating the activated plugin by clicking it again. However, the revocation does not affect data that has already been transmitted to the provider.

Data may also be transferred to: Meta Platforms Inc., USA

We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

11.2 Instagram Plugins

Plugins from the social network of the following provider are used on our website: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

These plugins enable direct interactions with content on the social network.

To increase the protection of your data when visiting our website, the plugins are initially deactivated and integrated into the site using a so-called "2-click" or "Shariff" solution.

This integration ensures that when a page of our website containing such plugins is accessed, no connection to the provider's servers is established yet.

Only when you activate the plugins and thereby give your consent to the data transmission pursuant to Art. 6 para. 1 lit. a GDPR, your browser establishes a direct connection to the provider's servers. In this process, information about your device used (including your IP address), your browser, and your browsing history is transmitted to the provider and possibly further processed there, regardless of whether you are logged into an existing user profile.

If you are logged into an existing user profile on the provider's social network, information about interactions performed via the plugins is also published there and shown to your contacts.
You can revoke your consent at any time by deactivating the activated plugin by clicking it again. However, the revocation does not affect data that has already been transmitted to the provider.

Data may also be transferred to: Meta Platforms Inc., USA

We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

11.3 Pinterest Plugins

Plugins from the social network of the following provider are used on our website: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland

These plugins enable direct interactions with content on the social network.

To increase the protection of your data when visiting our website, the plugins are initially deactivated and integrated into the site using a so-called "2-click" or "Shariff" solution.

This integration ensures that when a page of our website containing such plugins is accessed, no connection to the provider's servers is established yet.

Only when you activate the plugins and thereby give your consent to the data transmission pursuant to Art. 6 para. 1 lit. a GDPR, your browser establishes a direct connection to the provider's servers. In this process, information about your device used (including your IP address), your browser, and your browsing history is transmitted to the provider and possibly further processed there.

If you are logged into an existing user profile on the provider's social network, information about interactions performed via the plugins is also published there and shown to your contacts.
You can revoke your consent at any time by deactivating the activated plugin by clicking it again. However, the revocation does not affect data that has already been transmitted to the provider.

Data may also be transferred to: Pinterest Inc., USA

We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider relies on standard contractual clauses of the European Commission, which are intended to ensure compliance with the European level of data protection.

11.4 YouTube

This website uses plugins to display and play videos from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transmitted to: Google LLC., USA

When you access a page of our website that contains such a plugin, your browser establishes a direct connection to the provider's servers at the latest when the video is played in order to load the content. Certain information, including your IP address, is transmitted to the provider in this process.

If the playback of embedded videos is started via the plugin, the provider also uses cookies to collect information about user behavior, create playback statistics, and prevent abusive behavior.

If you are logged into a user account with the provider during your visit, your data will be directly assigned to your account when you click on a video. If you do not want the assignment to your account, you must log out before activating the playback button.

All aforementioned processing, especially the setting of cookies to read information on the device used, only takes place if you have given us your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR. You can revoke the given consent at any time with effect for the future by deactivating this service via the "Cookie Consent Tool" provided on the website.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

11.5 Adobe Fonts (Typekit)

This site uses so-called web fonts from the following provider for uniform font display: Adobe Systems Incorporated, 345 Park Avenue, San Jose, CA 95110-2704, USA

When a page is accessed, your browser loads the required web fonts into its browser cache to display texts and fonts correctly and establishes a direct connection to the provider's servers. Certain browser information, including your IP address, is transmitted to the provider in this process.

The processing of personal data in connection with the connection to the font provider only takes place if you have given us your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR. You can revoke your given consent at any time with effect for the future by deactivating this service via the "Cookie Consent Tool" provided on the website. If your browser does not support web fonts, a standard font from your computer will be used.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

11.6 Google Web Fonts

This site uses so-called web fonts from the following provider for uniform font display: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

When a page is accessed, your browser loads the required web fonts into its browser cache to display texts and fonts correctly and establishes a direct connection to the provider's servers. Certain browser information, including your IP address, is transmitted to the provider in this process.

Data may also be transmitted to: Google LLC, USA

The processing of personal data in connection with the connection to the font provider only takes place if you have given us your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR. You can revoke your given consent at any time with effect for the future by deactivating this service via the "Cookie Consent Tool" provided on the website. If your browser does not support web fonts, a standard font from your computer will be used.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

Further information on Google's privacy policies can be found here: https://business.safety.google/intl/de/privacy/

11.7 Google Customer Reviews (formerly Google Certified Shops Program)

We cooperate with Google within the framework of the "Google Customer Reviews" program. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). This program allows us to collect customer reviews from users of our website. After a purchase on our website, you will be asked whether you would like to participate in an email survey from Google.

If you give your consent pursuant to Art. 6 para. 1 lit. a GDPR, we transmit your email address to Google. You will receive an email from Google Customer Reviews asking you to rate your purchase experience on our website. The rating you provide will then be aggregated with our other ratings and displayed in our Google Customer Reviews badge as well as in our Merchant Center dashboard. Additionally, your rating will be used for Google Seller Ratings. In the course of using Google Customer Reviews, personal data may also be transmitted to the servers of Google LLC in the USA.

You can revoke your consent at any time by sending a message to the data controller or directly to Google.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

Further information on Google's privacy policies can be found here: https://business.safety.google/intl/de/privacy/

11.8 Applications for Job Postings via Email

On our website, we currently advertise vacant positions in a separate section, to which interested parties can apply by email to the provided contact address.

Applicants must provide all personal data necessary for a thorough assessment, including general information such as name, address, and contact details, as well as performance-related evidence and, if applicable, health-related information. Details regarding the application can be found in the job posting.

After receiving the application by email, the data will be stored and evaluated exclusively for the purpose of processing the application. For inquiries, we use either the applicant's email address or telephone number. The processing is based on Art. 6 para. 1 lit. b GDPR (or § 26 para. 1 BDSG), according to which the application process is considered as the initiation of an employment contract.

To the extent that special categories of personal data within the meaning of Art. 9 para. 1 GDPR (e.g., health data such as information about severe disability status) are requested from applicants during the application process, the processing takes place pursuant to Art. 9 para. 2 lit. b GDPR so that we can exercise rights and fulfill obligations arising from labor law and social security and social protection law.

Cumulatively or alternatively, the processing of special categories of data may also be based on Art. 9 para. 1 lit. h GDPR if it is carried out for purposes of health care or occupational medicine, for assessing the applicant's ability to work, for medical diagnosis, care, or treatment in the health or social sector, or for the management of health or social care systems and services.

If the applicant is not selected or withdraws the application prematurely, the transmitted data as well as all electronic correspondence, including the application email, will be deleted no later than 6 months after appropriate notification. This period is based on our legitimate interest in answering any follow-up questions regarding the application and, if necessary, fulfilling our documentation obligations under the regulations on equal treatment of applicants.

In the event of a successful application, the data provided will be processed on the basis of Art. 6 para. 1 lit. b GDPR (in Germany in conjunction with § 26 para. 1 BDSG) for the purpose of carrying out the employment relationship.

12) Tools and Miscellaneous

12.1 - DATEV

For the completion of accounting, we use the service of the cloud-based accounting software from the following provider: DATEV eG, Paumgartnerstr. 6-14, 90429 Nuremberg, Germany

The provider processes incoming and outgoing invoices as well as, if applicable, the bank transactions of our company in order to automatically record invoices, match them to the transactions, and thereby create the financial accounting in a semi-automated process.

If personal data is also processed in this context, the processing is based on our legitimate interest in an efficient organization and documentation of our business processes pursuant to Art. 6 para. 1 lit. f GDPR.
- pathway solutions

For the completion of accounting, we use the service of the cloud-based accounting software from the following provider: pathway solutions gmbh, c/o ba tax gmbh, Alstertwiete 3, 20099 Hamburg

The provider processes incoming and outgoing invoices as well as, if applicable, the bank transactions of our company in order to automatically record invoices, match them to the transactions, and thereby create the financial accounting in a semi-automated process.

If personal data is also processed in this context, the processing is based on our legitimate interest in an efficient organization and documentation of our business processes pursuant to Art. 6 para. 1 lit. f GDPR.

12.2 Cookie Consent Tool

This website uses a so-called "Cookie Consent Tool" to obtain effective user consents for cookies and cookie-based applications that require consent. The "Cookie Consent Tool" is displayed to users upon page access in the form of an interactive user interface, where consents for certain cookies and/or cookie-based applications can be granted by ticking checkboxes. By using this tool, all cookies/services requiring consent are only loaded if the respective user has given the corresponding consent by ticking the checkbox. This ensures that such cookies are only set on the respective user’s device if consent has been granted.

The tool sets technically necessary cookies to save your cookie preferences. Personal user data is generally not processed in this context.

If, in individual cases, personal data (such as the IP address) is processed for the purpose of storing, assigning, or logging cookie settings, this processing is based on our legitimate interest in a legally compliant, user-specific, and user-friendly consent management for cookies and thus in a legally compliant design of our website pursuant to Art. 6 para. 1 lit. f GDPR.

Further legal basis for the processing is also Art. 6 para. 1 lit. c GDPR. As controllers, we are legally obliged to make the use of technically non-essential cookies dependent on the respective user’s consent.

Where necessary, we have concluded a data processing agreement with the provider that ensures the protection of our site visitors’ data and prohibits unauthorized disclosure to third parties.

Further information about the operator and the configuration options of the Cookie Consent Tool can be found directly in the corresponding user interface on our website.

12.3 - Docusign

For the digital signing of documents, we use the services of the following provider: Docusign International (EMEA) Ltd., 5 Hanover Quay Grand Canal Dock, Dublin, D02 VY79, Ireland

The service enables the legally valid signing of documents by electronic signature from any device.

For this purpose, the service collects, stores, and transmits, in addition to the electronic signature for verification and proof of signing, usage data of the device used (in particular the IP address) as well as certain transaction data.

The processing is based on our legitimate interest in efficient and time-saving business management and customer-friendly and effective document management pursuant to Art. 6 para. 1 lit. f GDPR.

We have concluded a data processing agreement with the provider that protects the data of our site visitors and prohibits disclosure to third parties.

13) Rights of the Data Subject

13.1 The applicable data protection law grants you the following data subject rights (rights to information and intervention) against the controller regarding the processing of your personal data, whereby the respective conditions for exercising these rights refer to the cited legal basis:

• Right of access pursuant to Art. 15 GDPR;
• Right to rectification pursuant to Art. 16 GDPR;
• Right to erasure pursuant to Art. 17 GDPR;
• Right to restriction of processing pursuant to Art. 18 GDPR;
• Right to notification pursuant to Art. 19 GDPR;
• Right to data portability pursuant to Art. 20 GDPR;
• Right to withdraw consent pursuant to Art. 7 para. 3 GDPR;
• Right to lodge a complaint pursuant to Art. 77 GDPR.

13.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA BASED ON OUR LEGITIMATE INTERESTS WITHIN THE FRAMEWORK OF A BALANCE OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE PERSONAL DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS PERMISSIBLE IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS, AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE PERSONAL DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

14) Duration of Storage of Personal Data

The duration of storage of personal data is determined based on the respective legal basis, the purpose of processing, and – if applicable – additionally based on the respective statutory retention period (e.g., commercial and tax law retention periods).

When processing personal data based on an explicit consent pursuant to Art. 6 para. 1 lit. a GDPR, the affected data will be stored as long as you do not revoke your consent.

If there are statutory retention periods for data processed within the framework of contractual or contract-like obligations based on Art. 6 para. 1 lit. b GDPR, these data will be routinely deleted after the expiration of the retention periods, provided they are no longer necessary for contract fulfillment or contract initiation and/or we no longer have a legitimate interest in further storage.

When processing personal data based on Art. 6 para. 1 lit. f GDPR, these data will be stored until you exercise your right to object pursuant to Art. 21 para. 1 GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the assertion, exercise, or defense of legal claims.

When processing personal data for the purpose of direct marketing based on Art. 6 para. 1 lit. f GDPR, these data will be stored until you exercise your right to object pursuant to Art. 21 para. 2 GDPR.

Unless otherwise specified in the other information of this declaration regarding specific processing situations, stored personal data will otherwise be deleted when they are no longer necessary for the purposes for which they were collected or otherwise processed.