Privacy Policy - Draft Factory

1. Introduction and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about the handling of your personal data when using our website. Personal data is any data with which you can be personally identified.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Alexander Lorenz, c/o MDC Management#8, Welserstraße 3, 87463 Dietmannsried, Germany, Email: service@draftfactory.shop.

The controller for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data

2. Data Collection When Visiting Our Website

2.1 When using our website purely for informational purposes, i.e., if you do not register or otherwise transmit information to us, we only collect data that your browser transmits to the page server (so-called “server log files”). When you access our website, we collect the following data that is technically necessary for us to display the website to you:

Our visited website
Date and time at the time of access
Amount of data sent in bytes
Source/referrer from which you reached the page
Browser used
Operating system used
IP address used (if applicable: in anonymized form)

The processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or otherwise used. However, we reserve the right to subsequently check the server log files if there are concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the character string “https://” and the padlock symbol in your browser line.

3. Hosting and Content Delivery Network

For hosting our website and displaying page content, we use a professional hosting provider that operates data centers, among other locations, within the European Union. For this website, we have selected a data center located in the EU as the primary hosting location. All data collected via our website is stored and processed on these servers, unless otherwise stated in this privacy policy.

In addition, our hosting environment uses a Content Delivery Network (CDN) that distributes content via servers at various locations worldwide in order to ensure fast and secure delivery of our website. In this context, technical usage data (in particular IP addresses and access logs) may also be processed on servers outside the European Union. Where such third‑country transfers occur, they take place only in accordance with the requirements of Art. 44 et seq. GDPR, for example on the basis of an adequacy decision of the European Commission or standard contractual clauses.

We have concluded a data processing agreement (Art. 28 GDPR) with our hosting provider that ensures the protection of our site visitors’ data, prohibits unauthorized disclosure to third parties, and obliges the provider to comply with applicable EU and German data protection law.

4. Cookies

To make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e., small text files that are stored on your end device. Some of these cookies are automatically deleted after closing the browser (so-called “session cookies”), while others remain longer on your end device and enable the storage of page settings (so-called “persistent cookies”). In the latter case, you can see the storage duration in the cookie settings overview of your web browser.

If personal data is also processed by individual cookies we use, the processing is carried out in accordance with Art. 6 para. 1 lit. b GDPR either for the performance of the contract, in accordance with Art. 6 para. 1 lit. a GDPR in the case of consent granted, or in accordance with Art. 6 para. 1 lit. f GDPR to protect our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the site visit.

You can set your browser so that you are informed about the setting of cookies and can decide individually about their acceptance or exclude the acceptance of cookies for certain cases or generally.

Please note that if cookies are not accepted, the functionality of our website may be limited.

5. Contact

5.1 Brevo

For notifications, newsletters and review reminders, we use the services of the following provider: Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany

Exclusively on the basis of your express consent in accordance with Art. 6 para. 1 lit. a GDPR, we transmit your email address and, if applicable, other customer data to the provider so that they can contact you with a review reminder by email. You can revoke your consent at any time with effect for the future to us or to the provider.

We have concluded a data processing agreement with the provider that ensures the protection of data of our site visitors and prohibits unauthorized disclosure to third parties.

5.2 Own Review Reminder

Exclusively on the basis of your express consent in accordance with Art. 6 para. 1 lit. a GDPR, we use your email address for a one-time reminder to submit a review of your order. You can revoke your consent at any time by sending a message to the controller responsible for data processing.

5.3 In the context of contacting us (e.g., via contact form or email), personal data is processed exclusively for the purpose of processing and responding to your request and only to the extent necessary for this purpose.

The legal basis for processing this data is our legitimate interest in responding to your request in accordance with Art. 6 para. 1 lit. f GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR. Your data will be deleted when it can be inferred from the circumstances that the matter in question has been conclusively clarified and provided that there are no statutory retention obligations to the contrary.

6. Registration at the Website or Forum

You can register on our website by providing personal data. Which personal data is processed for registration can be seen from the input mask used for registration. We use the so-called double opt-in procedure for registration, i.e., your registration is only complete when you have previously confirmed your registration by clicking on the link contained in a confirmation email sent to you for this purpose. If your confirmation is not received within 24 hours, your registration will be automatically deleted from our database. The provision of the aforementioned data is mandatory. You can provide all other information voluntarily by using our website.

When you use our website, we store your data required for contract fulfillment, including any payment information, until you permanently delete your access. We also store the voluntary data you provide for the duration of your use of the website, unless you delete it beforehand. You can manage and change all information in the protected customer area. The legal basis is Art. 6 para. 1 lit. f GDPR.

In addition, we store all content published by you (such as public posts, pinboard entries, guestbook entries, etc.) to operate the website. We have a legitimate interest in providing the website with the complete user-generated content. The legal basis for this is Art. 6 para. 1 lit. f GDPR. If you delete your account, your public statements, especially in the forum and product reviews, will continue to be visible to all readers, but your account will no longer be accessible. All other data will be deleted in this case.

7. Comment Function

As part of the comment function on this website, in addition to your comment, information about the time the comment was created and the commenter name you chose is stored and published on this website. Your IP address is also logged and stored. This storage of the IP address occurs for security reasons and in case the person concerned violates the rights of third parties or posts illegal content through a submitted comment. We need your email address to contact you if a third party objects to your published content as unlawful.

The legal bases for storing your data are Art. 6 para. 1 lit. b and f GDPR. We reserve the right to delete comments if they are objected to by third parties as unlawful. You as a user can subscribe to subsequent comments. You will receive a confirmation email for this purpose to ensure that you are the owner of the email address provided (double opt-in procedure). The legal basis for data processing in the case of subscribing to comments is Art. 6 para. 1 lit. a GDPR. You can unsubscribe from ongoing comment subscriptions at any time with effect for the future; for more information about the unsubscribe option, please refer to the confirmation email.

8. Data Processing When Opening a Customer Account

In accordance with Art. 6 para. 1 lit. b GDPR, personal data is collected and processed to the extent necessary if you provide it to us when opening a customer account. Which data is required for opening an account can be found in the input mask of the corresponding form on our website.

Deletion of your customer account is possible at any time and can be done by sending a message to the above address of the controller. After deletion of your customer account, your data will be deleted if all contracts concluded through it have been completely processed, there are no statutory retention periods to the contrary, and we do not have a legitimate interest in continued storage.

9. Use of Customer Data for Direct Advertising

9.1 Registration for Our Email Newsletter

If you register for our email newsletter, we will regularly send you information about our offers. The only mandatory information for sending the newsletter is your email address. Providing additional data is voluntary and will be used to address you personally. For newsletter dispatch, we use the so-called double opt-in procedure, which ensures that you will only receive newsletters when you expressly confirm your consent to receive newsletters by clicking on a verification link sent to the specified email address.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Art. 6 para. 1 lit. a GDPR. We store your IP address entered by your Internet Service Provider (ISP) as well as the date and time of registration in order to be able to trace any misuse of your email address at a later time. The data we collect when you register for the newsletter is used strictly for the purpose specified.

You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending a corresponding message to the controller mentioned at the beginning. After successful unsubscription, your email address will be immediately deleted from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this statement.

9.2 Brevo

The dispatch of our email newsletters and other promotional email communication is carried out via this provider: Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany

On the basis of our legitimate interest in effective and user-friendly email marketing, we pass on your data provided during registration in accordance with Art. 6 para. 1 lit. f GDPR to this provider so that they can handle the mail dispatch on our behalf.

Subject to your express consent in accordance with Art. 6 para. 1 lit. a GDPR, the provider also carries out a statistical success evaluation of mail campaigns using web beacons or counting pixels in the sent emails, which can measure opening rates and specific interactions with the content of the newsletter. End device information (e.g., time of access, IP address, browser type, and operating system) is also collected and evaluated but not merged with other data stocks.

You can revoke your consent to mail tracking at any time with effect for the future.

We have concluded a data processing agreement with the provider that protects the data of our site visitors and prohibits disclosure to third parties.

9.3 Product Availability Notification by Email

For temporarily unavailable items, you can register to receive email product availability notifications. We will send you an email once about the availability of the item you selected. The only mandatory information for sending this notification is your email address.

Providing additional data is voluntary and may be used to address you personally. For mail dispatch, we use the so-called double opt-in procedure, which ensures that you will only receive a notification when you expressly confirm your consent by clicking on a verification link sent to the specified email address.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Art. 6 para. 1 lit. a GDPR. We store your IP address entered by your Internet Service Provider (ISP) as well as the date and time of registration in order to be able to trace any misuse of your email address at a later time. The data we collect when registering for our email notification service for product availability is used strictly for the purpose specified.

You can unsubscribe from availability notifications at any time by sending a corresponding message to the controller mentioned at the beginning. After successful unsubscription, your email address will be immediately deleted from our distribution list set up for this purpose, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this statement.

9.4 Mailpoet

We use MailPoet, a newsletter plugin, to manage our subscriber list and send emails. MailPoet uses cookies and similar technologies to ensure that the service works correctly, track user interaction with our emails, and recognize your browser on return visits. The data collected is used solely to manage our subscriber database and analyze the performance of our email campaigns. You can opt-out of these services at any time by unsubscribing from our newsletter

We have concluded an agreement with MailPoet to protect our users’ data and ensure they are not passed on to unauthorized third parties.

You can manage or delete cookies in your browser settings at any time, though this may limit the functionality of our website.

10. Data Processing for Order Processing

10.1 Transmission of Image Files for Order Processing via Upload Function

On our website, we offer customers the opportunity to order personalized products by submitting image files via an upload function. The submitted image motif is used as a template for personalizing the selected product.

Via the upload form on the website, the customer can transmit one or more image files from the storage of the device used directly to us via automated, encrypted data transmission. We then collect, store, and use the transmitted files exclusively for the production of the personalized product in accordance with the respective service description on our website. If the transmitted image files are passed on to specialized service providers for the production and processing of the order, you will be explicitly informed about this in the following paragraphs. No further disclosure takes place. If the transmitted files or digital motifs contain personal data (especially images of identifiable persons), all the processing operations just mentioned are carried out exclusively for the purpose of processing your online order in accordance with Art. 6 para. 1 lit. b GDPR.

After final processing of the order, the transmitted image files are automatically and completely deleted.

10.2 To the extent necessary for contract processing for delivery and payment purposes, the personal data we collect is passed on to the commissioned transport company and the commissioned financial institution in accordance with Art. 6 para. 1 lit. b GDPR.

If we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we process the contact data you transmitted during the order in order to inform you personally within the framework of our statutory information obligations in accordance with Art. 6 para. 1 lit. c GDPR. Your contact data is used strictly for the purpose of communications about updates we owe and is only processed by us to the extent necessary for the respective information

To process your order, we also work with the following service provider(s), who support us in whole or in part in the implementation of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

10.3 To fulfill our contractual obligations to our customers, we work with external shipping partners. We pass on your name and your delivery address and, if necessary for delivery, your telephone number exclusively for the purposes of goods delivery in accordance with Art. 6 para. 1 lit. b GDPR to a shipping partner selected by us.

10.4 Disclosure of Personal Data to Shipping Service Providers

Deutsche Post

As a transport service provider, we use the following provider:
Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany

We pass on your email address and/or telephone number in accordance with Art. 6 para. 1 lit. a GDPR before delivery of the goods for the purpose of coordinating a delivery date or for delivery notification to the provider if you have given your express consent to this during the ordering process. Otherwise, for the purpose of delivery in accordance with Art. 6 para. 1 lit. b GDPR, we only pass on the name of the recipient and the delivery address to the provider. The disclosure only takes place to the extent necessary for the delivery of goods. In this case, prior coordination of the delivery date with the provider or delivery notification is not possible.

Consent can be revoked at any time with effect for the future to the controller designated above or to the provider.

DHL

As a transport service provider, we use the following provider:
DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany

Consent can be revoked at any time with effect for the future to the controller designated above or to the provider.

DHL Express

As a transport service provider, we use the following provider:
DHL Express Germany GmbH, Heinrich-Brüning-Str. 5, 53113 Bonn, Germany

Consent can be revoked at any time with effect for the future to the controller designated above or to the provider.

DPD

As a transport service provider, we use the following provider:
DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaenburg, Germany

Consent can be revoked at any time with effect for the future to the controller designated above or to the provider.

GLS

As a transport service provider, we use the following provider:
General Logistics Systems Germany GmbH & Co. OHG, GLS Germany-Straße 1 – 7, 36286 Neuenstein, Germany

Consent can be revoked at any time with effect for the future to the controller designated above or to the provider.

10.5 Use of Payment Service Providers

Stripe

One or more online payment methods of the following providers are available on this website:
Stripe Technology Company Limited (STC), One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland
Stripe Payment Europe, Limited, 3 Dublin Landings, North Wall Quay, Dublin 1, D01 C4E0, Ireland

If you select a payment method of the provider in which you pay in advance (such as credit card payment), your payment data provided during the ordering process (including name, address, bank and payment card information, currency, and transaction number) as well as information about the content of your order are passed on to them in accordance with Art. 6 para. 1 lit. b GDPR. The disclosure of your data takes place in this case exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

If you select a payment method in which the provider pays in advance (such as invoice or installment purchase or direct debit), you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, telephone number, and, if applicable, data on an alternative means of payment).

In order to protect our legitimate interest in establishing the creditworthiness of our customers, this data is forwarded by us to the provider for the purpose of a credit check in accordance with Art. 6 para. 1 lit. f GDPR. The provider checks, based on the personal data you provided and other data (such as shopping cart, invoice amount, order history, payment experience), whether the payment option you selected can be granted with regard to payment and/or default risks.

The credit information may contain probability values (so-called score values). If score values are included in the result of the credit information, they are based on a scientifically recognized mathematical-statistical procedure. Address data, among other things, but not exclusively, flows into the calculation of score values.

You can object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may still be entitled to process your personal data if this is necessary for contractual payment processing.

PayPal

One or more online payment methods of the following provider are available on this website:
PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

11. Online Marketing

11.1 Google AdSense

This website uses Google AdSense, a web advertising service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). Google AdSense uses so-called cookies, i.e., text files that are stored on your computer and enable an analysis of your use of the website. In addition, Google AdSense also uses so-called “web beacons” (small invisible graphics) to collect information, through the use of which simple actions such as visitor traffic to the website can be recorded, collected, and evaluated. The information generated by the cookie and/or web beacon (including your IP address) about your use of this website is usually transmitted to and stored on a Google server. This may also result in transmission to the servers of Google LLC in the USA.

Google uses the information obtained in this way to evaluate your usage behavior with regard to AdSense ads. The IP address transmitted by your browser as part of Google AdSense is not merged with other Google data. The information collected by Google may be transferred to third parties if this is required by law and/or if third parties process this data on behalf of Google.

All the processing operations described above, in particular reading information on the device used via cookies and/or web beacons, are only carried out if you have given us your express consent in accordance with Art. 6 para. 1 lit. a GDPR. Without this consent, Google AdSense is not used during your site visit.

You can revoke your granted consent at any time with effect for the future by deactivating this service in the “Cookie Consent Tool” provided on the website.

Further information on Google’s privacy policy can be found here: https://business.safety.google/intl/de/privacy/ and
https://www.google.de/policies/privacy/

11.2 Brevo Tracker

This website uses the software-based marketing service of the following provider for the provision and synchronization of various customer management services: Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany

The service enables automated processing of feed activities, control of advertising in marketing channels used, and success analysis of marketing measures as well as central email marketing and contact management.

Cookies are used to fulfill the various functions, i.e., small text files that are stored locally in the cache of your web browser on your end device and enable us to analyze your use of the website. The cookies collect certain information, such as the IP address, location, and time of page access.

All the processing operations described above, in particular the setting of cookies for reading information on the device used, are only carried out if you have given us your express consent in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your granted consent at any time with effect for the future by deactivating this service in the “Cookie Consent Tool” provided on the website.

Other legal bases for data processing that are used in the context of specific service functions (such as the necessity of express consent in accordance with Art. 6 para. 1 lit. a GDPR when sending newsletters) remain unaffected by this.

We have concluded a data processing agreement with the provider that ensures the protection of data of our site visitors and prohibits unauthorized disclosure to third parties.

11.3 Affiliate Program

In connection with the product presentations on our website, we maintain our own affiliate program, within which we provide interested third-party website operators with partner links for placement on their websites that lead to our offers. Cookies are used for the affiliate program, which are generally set on the partner site after clicking on a corresponding partner link and for which we are therefore not responsible under data protection law. Cookies are small text files that are stored on your end device in order to be able to track the origin of transactions (e.g., “sales leads”) that were generated via such links. Among other things, we can recognize that you clicked on the partner link and were redirected to our website. This information is required for payment processing between us and the affiliate partners. If the information also contains personal data, the described processing takes place on the basis of our legitimate financial interest in processing commission payments in accordance with Art. 6 para. 1 lit. f GDPR.

If you want to block the evaluation of user behavior via cookies, you can set your browser so that you are informed about the setting of cookies and can decide individually about their acceptance or exclude the acceptance of cookies for certain cases or generally.

12. Web Analysis Services

12.1 Google Analytics 4

This website uses Google Analytics 4, a web analysis service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), which enables an analysis of your use of our website.

By default, Google Analytics 4 does not use cookies when visiting the website unless you expressly consent to cookies. Instead, information about your usage behavior is collected and processed via so-called pings (small data packets sent to the host of an end device). The scope of this information also includes your IP address, which is, however, shortened by Google by the last digits to exclude direct personal reference.

The information is transmitted to Google servers and processed there.
Transmissions to Google LLC based in the USA are also possible.

Google uses the information collected on our behalf to evaluate your use of the website, to compile reports on website activities for us, and to provide other services related to website use and internet use. The IP address transmitted by your browser as part of Google Analytics and shortened will not be merged with other Google data. The data collected as part of the use of Google Analytics 4 is stored for a period of two months and then deleted.

All the processing operations described above, including data transmission through “pings” and the possible setting of Google Analytics cookies, only take place if you have given us your express consent in accordance with Art. 6 para. 1 lit. a GDPR.

Without your consent, Google Analytics 4 is not used during your site visit. You can revoke your granted consent with effect for the future at any time. To exercise your right of revocation, please deactivate this service via the “Cookie Consent Tool” provided on the website.

We have concluded a data processing agreement with Google that ensures the protection of data of our site visitors and prohibits unauthorized disclosure to third parties

Further legal information on Google Analytics 4 can be found at https://business.safety.google/intl/de/privacy/, https://policies.google.com/privacy and at https://policies.google.com/technologies/partner-sites

Demographic Characteristics

Google Analytics 4 uses the special function “demographic characteristics” and can thereby create statistics that make statements about the age, gender, and interests of site visitors. This is done by analyzing advertising and information from third-party providers. This enables target groups to be identified for marketing activities. However, the data collected cannot be assigned to a specific person and is deleted after storage for a period of two months.

Google Signals

As an extension to Google Analytics 4, Google Signals can be used on this website to have cross-device reports created. If you have activated personalized ads and linked your devices to your Google account, Google can analyze your usage behavior across devices, subject to your consent to the use of Google Analytics in accordance with Art. 6 para. 1 lit. a GDPR, and create database models, including cross-device conversions. We do not receive any personal data from Google, only statistics. If you want to stop cross-device analysis, you can deactivate the “Personalized Advertising” function in the settings of your Google account. To do this, follow the instructions on this
page: https://support.google.com/My-Ad-Center-Help/answer/12155764

Further information on Google Signals can be found at the following link: https://support.google.com/analytics/answer/7532985

UserIDs

As an extension to Google Analytics 4, the “UserIDs” function can be used on this website. If you have consented to the use of Google Analytics 4 in accordance with Art. 6 para. 1 lit. a GDPR, set up an account on this website, and log in to this account on different devices, your activities, including conversions, can be analyzed across
devices.

12.2 Google Tag Manager

This website uses the “Google Tag Manager,” a service of the following provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”).

The Google Tag Manager provides a technical basis for bundling various web applications, including tracking and analysis services, and for calibrating, controlling, and linking them to conditions via a uniform user interface. The Google Tag Manager itself does not store any information on user end devices or read them. The service also does not carry out independent data analyses. However, when the page is accessed, your IP address is transmitted to Google via the Google Tag Manager and may be stored there. Transmission to servers of Google LLC in the USA is also possible.

This processing is only carried out if you have given us your express consent in accordance with Art. 6 para. 1 lit. a GDPR. Without this consent, Google Tag Manager is not used during your site visit. You can revoke your granted consent at any time with effect for the future. To exercise your revocation, please deactivate this service in the “Cookie Consent Tool” provided on the website.

Further legal information on Google Tag Manager can be found at https://business.safety.google/intl/privacy/ and https://policies.google.com/privacy

13. Retargeting, Remarketing and Conversion Tracking

13.1 Meta Pixel

Within our online offering, we use the “Meta Pixel” service of the following provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Meta”)

If a user clicks on an advertisement we placed on Facebook and/or Instagram, the URL of our linked page is extended with a parameter using “Meta Pixel.” This URL parameter is then entered into the user’s browser by a cookie that our linked page itself sets after the redirection.

This enables Meta, on the one hand, to identify visitors to our online offering as a target group for displaying ads (so-called “Ads”). Accordingly, we use the service to display the Facebook and/or Instagram ads we place only to those users who have also shown an interest in our online offering or who have certain characteristics (e.g., interests in certain topics or products determined based on the websites visited) that we transmit to Meta (so-called “Custom Audiences”).

On the other hand, the “Meta Pixel” can be used to track whether users were redirected to our website after clicking on an advertisement and what execution actions they take there (so-called “conversion tracking”).

The data collected is anonymous for us, i.e., it does not allow us to draw conclusions about the identity of the users. However, the data is stored and processed by Meta, so that a connection to the respective user profile is possible and Meta can use the data for its own advertising purposes.

We have concluded a data processing agreement with the provider that ensures the protection of data of our site visitors and prohibits unauthorized disclosure to third parties.

The information generated by Meta is usually transmitted to and stored on a Meta server; in this context, transmission to servers of Meta Platforms Inc. in the USA may also occur.

13.2 Google Ads Remarketing

This website uses retargeting technology from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

For this purpose, Google sets a cookie in the browser of your end device, which automatically enables interest-based advertising based on a pseudonymous cookie ID and based on the pages you visited. Further data processing only takes place if you have consented to Google linking your internet and app browsing history with your Google account and using information from your Google account to personalize ads you view on the web. If you are logged in to Google during the site visit to our website in this case, Google uses your data together with Google Analytics data to create and define audience lists for cross-device remarketing. To do this, Google temporarily links your personal data with Google Analytics data to form audiences. As part of the use of Google Ads Remarketing, personal data may also be transmitted to the servers of Google LLC in the USA.

All the processing operations described above, in particular the setting of cookies for reading information on the device used, are only carried out if you have given us your express consent in accordance with Art. 6 para. 1 lit. a GDPR. Without this consent, retargeting technology is not used during your site visit.

You can revoke your granted consent at any time with effect for the future. To exercise your revocation, please deactivate this service in the “Cookie Consent Tool” provided on the website.

Details on the processing initiated by Google and Google’s handling of data from websites can be found here: https://policies.google.com/technologies/partner-sites

Further information on Google’s privacy policy can be found here: https://business.safety.google/intl/privacy/ and https://www.google.de/policies/privacy/

13.3 Microsoft Advertising

This website uses retargeting technology from the following provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA

This enables us to specifically address visitors to our websites with personalized, interest-based advertising who have already shown an interest in our shop and our products. The display of advertising material is based on a cookie-based analysis of previous and current usage behavior.

In cases of retargeting technology, a cookie is stored on your computer or mobile device to collect pseudonymized data about your interests and to adapt advertising individually to the stored information. These cookies are small text files that are stored on your computer or mobile device. You will be shown advertising that is likely to correspond to your product and information interests.

All the processing operations described above, in particular the setting of cookies for reading information on the device used, are only carried out if you have given us your express consent in accordance with Art. 6 para. 1 lit. a GDPR. Without this consent, retargeting technology is not used during your site visit.

You can revoke your granted consent at any time with effect for the future. To exercise your revocation, please deactivate this service in the “Cookie Consent Tool” provided on the website.

13.4 Pinterest Retargeting Pixel

This website uses retargeting technology from the following provider: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland

All the processing operations described above, in particular the setting of cookies for reading information on the end device used, are only carried out if you have given us your express consent in accordance with Art. 6 para. 1 lit. a GDPR. Without this consent, retargeting technology is not used during your site visit.

You can revoke your granted consent at any time with effect for the future. To exercise your revocation, please deactivate this service in the “Cookie Consent Tool” provided on the website.

13.5 Taboola

This website uses retargeting technology from the following provider: Taboola Inc., 16 Madison Square West 7th Floor, New York, NY 10010, USA

You can revoke your granted consent at any time with effect for the future. To exercise your revocation, please deactivate this service in the “Cookie Consent Tool” provided on the website.

For the transmission of data to the USA, the provider relies on standard contractual clauses of the European Commission, which are intended to ensure compliance with the European data protection level.

13.6 Google Ads Conversion Tracking

This website uses the online advertising program “Google Ads” and, as part of Google Ads, the conversion tracking of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). We use the offer from Google Ads to draw attention to our attractive offers with the help of advertising materials (so-called Google Adwords) on external websites. In relation to the data from the advertising campaigns, we can determine how successful the individual advertising measures are. In this way, we pursue the aim of showing you advertising that is of interest to you, making our website more interesting for you, and achieving a fair calculation of the advertising costs incurred.

The cookie for conversion tracking is set when a user clicks on a Google-placed Ads ad. Cookies are small text files that are stored on your end device. These cookies generally lose their validity after 30 days and are not used for personal identification. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognize that the user clicked on the ad and was redirected to this page. Each Google Ads customer receives a different cookie. Cookies can therefore not be tracked across the websites of Google Ads customers. The information obtained using the conversion cookie is used to create conversion statistics for Google Ads customers who have opted for conversion tracking. Customers learn the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they do not receive any information with which users can be personally identified. As part of the use of Google Ads, personal data may also be transmitted to the servers of Google LLC in the USA.

Details on the processing initiated by Google Ads Conversion Tracking and Google’s handling of data from websites can be found here: https://policies.google.com/technologies/partner-sites

You can also permanently object to the setting of cookies by Google Ads Conversion Tracking by downloading and installing the browser plug-in from Google available at the following link:
https://support.google.com/My-Ad-Center-Help/answer/12155656

Please note that certain functions of this website may not be used or may only be used to a limited extent if you have deactivated the use of cookies.

Google’s privacy policy can be found here: https://business.safety.google/intl/privacy/ and https://www.google.com/policies/privacy/

13.7 Reddit Tracking Pixel

This website uses the conversion tracking technology of the following provider: Reddit Inc., 420 Taylor Street San Francisco, CA 94102, USA

If you came to our website from an advertisement on the provider’s domain, the success of the advertisement can be tracked using cookies and/or comparable technologies (tracking pixels, web beacons, pings or HTTP requests).

For this purpose, certain end device and browser information, including possibly your IP address, is read out via the tracking technology in order to record and evaluate user actions we have predefined (e.g., completed transactions, leads, search queries on the website, calls to product pages). This enables the creation of statistics on usage behavior on our website after redirection from an advertisement, which serve us to optimize our offering.

We have concluded a data processing agreement with the provider that ensures the protection of data of our site visitors and prohibits unauthorized disclosure to third parties.

13.8 TikTok Pixel

This website uses the conversion tracking technology of the following provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland

We have concluded a data processing agreement with the provider that ensures the protection of data of our site visitors and prohibits unauthorized disclosure to third parties.

14. Site Functionalities

14.1 Facebook Plugins

Plugins of the social network of the following provider are used on our website: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

These plugins enable direct interactions with content on the social network.

To increase the protection of your data when visiting our website, the plugins are initially deactivated using a so-called “2-click” or “Shariff” solution integrated into the page.

This integration ensures that when you access a page of our website that contains such plugins, no connection is yet established with the provider’s servers.

Only when you activate the plugins and thereby give your consent to data transmission in accordance with Art. 6 para. 1 lit. a GDPR does your browser establish a direct connection to the provider’s servers. In this case, regardless of a login to an existing user profile, certain information about your device used (including your IP address), your browser, and your page history is transmitted to the provider and may be further processed there.

If you are logged in to an existing user profile on the provider’s social network, information about interactions carried out via the plugins is also published there and displayed to your contacts.

You can revoke your consent at any time by clicking the activated plugin again to deactivate it. However, the revocation has no effect on the data that has already been transmitted to the provider.

Data may also be transmitted to: Meta Platforms Inc., USA

We have concluded a data processing agreement with the provider that ensures the protection of data of our site visitors and prohibits unauthorized disclosure to third parties.

14.2 Pinterest Plugins

Plugins of the social network of the following provider are used on our website: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland

These plugins enable direct interactions with content on the social network.

To increase the protection of your data when visiting our website, the plugins are initially deactivated using a so-called “2-click” or “Shariff” solution integrated into the page.

This integration ensures that when you access a page of our website that contains such plugins, no connection is yet established with the provider’s servers.

If you are logged in to an existing user profile on the provider’s social network, information about interactions carried out via the plugins is also published there and displayed to your contacts.

You can revoke your consent at any time by clicking the activated plugin again to deactivate it. However, the revocation has no effect on the data that has already been transmitted to the provider.

Data may also be transmitted to: Pinterest Inc., USA

We have concluded a data processing agreement with the provider that ensures the protection of data of our site visitors and prohibits unauthorized disclosure to third parties.

14.3 X Plugins

Plugins of the social network of the following provider are used on our website: Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 Ireland

These plugins enable direct interactions with content on the social network.

To increase the protection of your data when visiting our website, the plugins are initially deactivated using a so-called “2-click” or “Shariff” solution integrated into the page.

This integration ensures that when you access a page of our website that contains such plugins, no connection is yet established with the provider’s servers.

If you are logged in to an existing user profile on the provider’s social network, information about interactions carried out via the plugins is also published there and displayed to your contacts.

You can revoke your consent at any time by clicking the activated plugin again to deactivate it. However, the revocation has no effect on the data that has already been transmitted to the provider.

Data may also be transmitted to: X Corp., USA

We have concluded a data processing agreement with the provider that ensures the protection of data of our site visitors and prohibits unauthorized disclosure to third parties.

14.4 YouTube

This website uses plugins to display and play videos from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transmitted to: Google LLC, USA

If you access a page of our website that contains such a plugin, your browser establishes a direct connection to the provider’s servers at the latest at the time of video playback in order to load the content. Certain information, including your IP address, is transmitted to the provider.

If playback of embedded videos is started via the plugin, the provider also uses cookies to collect information about user behavior, create playback statistics, and prevent abusive behavior.

If you are logged into a user account with the provider during your site visit, your data is directly assigned to your account when you click on a video. If you do not want the assignment to your account, you must log out before pressing the playback button.

All the aforementioned processing operations, in particular the setting of cookies for reading information on the device used, only take place if you have given us your express consent in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your granted consent at any time with effect for the future by deactivating this service via the “Cookie Consent Tool” provided on the website.

14.5 Google Web Fonts

This page uses so-called web fonts from the following provider for uniform display of fonts: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

When you access a page, your browser loads the required web fonts into your browser cache to display texts and fonts correctly and establishes a direct connection to the provider’s servers. Certain browser information, including your IP address, is transmitted to the provider.

Data may also be transmitted to: Google LLC, USA

The processing of personal data in the course of establishing a connection with the provider of the fonts is only carried out if you have given us your express consent in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your granted consent at any time with effect for the future by deactivating this service via the “Cookie Consent Tool” provided on the website. If your browser does not support web fonts, a standard font from your computer is used.

Further information on Google’s privacy policy can be found here: https://business.safety.google/intl/privacy/

14.6 Google reCAPTCHA

On this website, we use the CAPTCHA service of the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transmitted to: Google LLC, USA.

For the visual design of the Captcha window, “Google Fonts,” i.e., fonts loaded from the Internet by Google, are used by the provider. There is no processing of further information than those mentioned above, which are already transmitted to Google via the functionality of ReCaptcha.

The service checks whether an entry is made by a natural person or abusively by machine and automated processing, and blocks spam, DDoS attacks, and similar automated harmful access. To ensure that an action is performed by a human and not by an automated bot, the provider collects the IP address of the device used, detection data of the browser and operating system type used, as well as the date and duration of the visit, and transmits these to the provider’s servers for evaluation. Cookies may be used here, i.e., small text files that are stored in the browser of the end device.

If the processing described above is carried out on the basis of cookies, these are only set if you have given us your express consent in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your granted consent at any time with effect for the future by deactivating this service in the “Cookie Consent Tool” provided on the website.

If the processing described above is carried out without the use of cookies, the legal basis is our legitimate interest in establishing individual personal responsibility on the Internet and avoiding misuse and spam in accordance with Art. 6 para. 1 lit. f GDPR.

We have concluded a data processing agreement with the provider that ensures the protection of data of our site visitors and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level on the basis of an adequacy decision by the European Commission. Further information on Google’s privacy policy can be found here: https://business.safety.google/intl/privacy/

14.9 Google Customer Reviews (formerly Google Certified Merchant Program)

We work with Google as part of the “Google Customer Reviews” program. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). This program gives us the opportunity to obtain customer reviews from users of our website. After a purchase on our website, you will be asked whether you would like to participate in an email survey from Google.

If you give your consent in accordance with Art. 6 para. 1 lit. a GDPR, we transmit your email address to Google. You will receive an email from Google Customer Reviews asking you to rate the shopping experience on our website. The rating you submit is then summarized with our other ratings and displayed in our Google Customer Reviews logo as well as in our Merchant Center dashboard. Your rating is also used for Google Seller Ratings. As part of the use of Google Customer Reviews, personal data may also be transmitted to the servers of Google LLC in the USA.

You can revoke your consent at any time by sending a message to the controller responsible for data processing or to Google.

Further information on Google’s privacy policy can be found here: https://business.safety.google/intl/privacy/

15. Tools and Other

15.1 Cookie Consent Tool, CookieYes

This website uses a so-called “cookie consent tool” to obtain effective user consents for cookies requiring consent and cookie-based applications. The “cookie consent tool” is displayed to users when accessing the page in the form of an interactive user interface, on which consents for certain cookies and/or cookie-based applications can be granted by checking boxes. This ensures that all cookies/services requiring consent are only loaded if the respective user grants corresponding consents by checking boxes. This ensures that such cookies are only set on the respective user’s end device if consent has been granted.

The tool sets technically necessary cookies to store your cookie preferences. Personal user data is generally not processed.

If, in individual cases, personal data (such as the IP address) is processed for the purpose of storing, assigning, or logging cookie settings, this is done in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in lawful, user-specific, and user-friendly consent management for cookies and therefore in lawful design of our website.

A further legal basis for the processing is Art. 6 para. 1 lit. c GDPR. As a controller, we are subject to the legal obligation to make the use of technically non-necessary cookies dependent on the respective user consent.

Where necessary, we have concluded a data processing agreement with the provider that ensures the protection of data of our site visitors and prohibits unauthorized disclosure to third parties.

Further information about the operator and the setting options of the cookie consent tool can be found directly in the corresponding user interface on our website.

16. Rights of the Data Subject

16.1 Applicable data protection law grants you the following rights of data subjects (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data, whereby reference is made to the cited legal basis for the respective exercise requirements:

Right of access in accordance with Art. 15 GDPR
Right to rectification in accordance with Art. 16 GDPR
Right to erasure in accordance with Art. 17 GDPR
Right to restriction of processing in accordance with Art. 18 GDPR
Right to notification in accordance with Art. 19 GDPR
Right to data portability in accordance with Art. 20 GDPR
Right to withdraw consent granted in accordance with Art. 7 para. 3 GDPR
Right to lodge a complaint in accordance with Art. 77 GDPR

16.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF A BALANCING OF INTERESTS DUE TO OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS ARISING FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL END THE PROCESSING OF THE AFFECTED DATA. HOWEVER, CONTINUED PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OUTWEIGH YOUR INTERESTS, FUNDAMENTAL RIGHTS, AND FREEDOMS, OR IF THE PROCESSING SERVES THE ASSERTION, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US TO CONDUCT DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL END THE PROCESSING OF THE AFFECTED DATA FOR DIRECT ADVERTISING PURPOSES.

17. Duration of Storage of Personal Data

The duration of storage of personal data is determined by the respective legal basis, the processing purpose and – if relevant – additionally by the respective statutory retention period (e.g., commercial and tax retention periods).

When processing personal data on the basis of express consent in accordance with Art. 6 para. 1 lit. a GDPR, the affected data is stored until you revoke your consent.

If statutory retention periods exist for data that is processed as part of legal or similar legal obligations on the basis of Art. 6 para. 1 lit. b GDPR, this data is routinely deleted after expiry of the retention periods if it is no longer necessary for contract fulfillment or contract initiation and/or we no longer have a legitimate interest in continued storage.

When processing personal data on the basis of Art. 6 para. 1 lit. f GDPR, this data is stored until you exercise your right to object in accordance with Art. 21 para. 1 GDPR, unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights, and freedoms, or the processing serves the assertion, exercise, or defense of legal claims.

When processing personal data for the purpose of direct advertising on the basis of Art. 6 para. 1 lit. f GDPR, this data is stored until you exercise your right to object in accordance with Art. 21 para. 2 GDPR.

Unless otherwise stated in the other information in this statement about specific processing situations, stored personal data is deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.