Privacy Policy

1) Introduction and Contact Information for the Data Controller

1.1We are pleased that you are visiting our website and thank you for your interest. Below, we provide information about how we handle your personal data when you use our website. Personal data refers to any data that can be used to personally identify you.

1.2The data controller for this website within the meaning of the General Data Protection Regulation (GDPR) is VITAFORM GmbH & Co. KG, Remontedepot, 72535 Heroldstatt-Breithülen, Germany, Tel.: +49 (0) 7333 925799-0, Fax: +49 (0) 7333 925799-90, Email: beratung@vitaform.com. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

1.3The controller has appointed a data protection officer, who can be contacted as follows: "Sascha Schmidt, 72535 Heroldstatt, datenschutz@VITAFORM.com"

1.4For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the “https://” prefix and the padlock icon in your browser address bar.

2) Data Collection When Visiting Our Website

When you use our website for informational purposes only—that is, if you do not register or otherwise provide us with information—we collect only the data that your browser transmits to the website server (so-called “server log files”). When you visit our website, we collect the following data, which is technically necessary for us to display the website to you:

The website you visited
Date and time of access
Amount of data transmitted in bytes
Source/referrer from which you accessed the page
Browser used
Operating system used
IP address used (if applicable: in anonymized form)

Data processing is carried out in accordance with Article 6(1)(f) of the GDPR based on our legitimate interest in improving the stability and functionality of our website. The data will not be disclosed or used for any other purpose. However, we reserve the right to review the server log files retrospectively should there be concrete indications of unlawful use.

3) Hosting & Content Delivery Network

Shopify

We use the system provided by the following provider to host our website and display its content: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”)

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada; Shopify Data Processing (USA) Inc.; Shopify Payments (USA) Inc.; or Shopify (USA) Inc.

All data collected on our website is processed on the provider’s servers. We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

When data is transferred to Canada, an adequate level of data protection is guaranteed by an adequacy decision issued by the European Commission.

For the transfer of data to the U.S., the provider relies on the European Commission’s Standard Contractual Clauses, which are intended to ensure compliance with European data protection standards.

4) Cookies

To enhance your experience on our website To make our website more appealing and enable the use of certain features, we use cookies—small text files that are stored on your device. Some of these cookies are automatically deleted when you close your browser (so-called “session cookies”), while others remain on your device for a longer period and allow us to save page settings (so-called “persistent cookies”). In the latter case, you can find the storage duration in the overview of your web browser’s cookie settings.

If personal data is processed by individual cookies we use, such processing is carried out in accordance with Article 6(1)(b) of the GDPR either for the performance of a contract, pursuant to Article 6(1)(a) of the GDPR in the event that consent has been given, or pursuant to Article 6(1)(f) of the GDPR to safeguard our legitimate interests in ensuring the best possible functionality of the website as well as a user-friendly and effective design of the site visit.

You can configure your browser to notify you when cookies are set and decide on a case-by-case basis whether to accept them, or to block the acceptance of cookies in specific cases or generally.

Please note that if you do not accept cookies, the functionality of our website may be limited.

5) Contacting Us

5.1Freshdesk

To process customer inquiries, we use the email ticketing system provided by the following vendor: Freshworks, Inc., 2950 S. Delaware Street, Suite 201, San Mateo, California 94403, USA

If you submit contact requests via email through our website, these are stored and organized in the ticketing system to enable chronological processing and improve the service experience. You can always view the current status of your request using the individually assigned ticket number.

For the organization and processing of inquiries, personal data is collected to the extent it is provided—and in any case, at a minimum, your last name, first name, and email address—and is transmitted to the provider, where it is stored and accessed.

The legal basis for processing this data is our legitimate interest in efficiently organizing our customer service, responding to your inquiry as quickly as possible, and optimizing our service offerings in accordance with Article 6(1)(f) of the GDPR.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

For the transfer of data to the United States, the provider relies on the European Commission’s Standard Contractual Clauses, which are intended to ensure compliance with European data protection standards.

5.2When you contact us (e.g., via the contact form or email), personal data is processed—exclusively for the purpose of handling and responding to your inquiry and only to the extent necessary for that purpose.

The legal basis for processing this data is our legitimate interest in responding to your inquiry pursuant to Article 6(1)(f) of the GDPR. If your contact is aimed at entering into a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR. Your data will be deleted when it is evident from the circumstances that the matter in question has been conclusively resolved and provided that no statutory retention obligations preclude this.

5.3WhatsApp Business

We offer visitors to our website the opportunity to contact us via the WhatsApp messaging service provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For this purpose, we use the so-called “Business Version” of WhatsApp.

If you contact us via WhatsApp in connection with a specific business matter (such as a completed order), we will store and use the mobile phone number you use with WhatsApp, as well as—if provided—your first and last name, in accordance with Article 6(1)(b) of the GDPR to process and respond to your inquiry. Based on the same legal basis, we may ask you via WhatsApp to provide additional data (order number, customer number, address, or email address) so that we can assign your inquiry to a specific transaction.

If you use our WhatsApp contact for general inquiries (such as regarding our range of services, availability, or our website), we will store and use the mobile phone number you use on WhatsApp as well as—if provided – your first and last name in accordance with Art. 6(1)(f) GDPR, based on our legitimate interest in providing the requested information efficiently and in a timely manner

. Your data will always be used solely to respond to your inquiry via WhatsApp. It will not be disclosed to third parties.

Please note that WhatsApp Business has access to the address book of the mobile device we use for this purpose and automatically transfers phone numbers stored in the address book to a server operated by the parent company, Meta Platforms Inc., in the United States. To operate our WhatsApp Business account, we use a mobile device whose address book contains only the WhatsApp contact information of users who have actually contacted us via WhatsApp.

This ensures that every person whose WhatsApp contact information is stored in our address book has already consented to the transfer of their WhatsApp phone number from the address books of their chat contacts—in accordance with Article 6(1)(a) of the GDPR—by accepting the WhatsApp Terms of Service when they first used the app on their device. The transmission of data from users who do not use WhatsApp and/or have not contacted us via WhatsApp is therefore excluded.

For information on the purpose and scope of data collection, as well as the further processing and use of data by WhatsApp, and your related rights and privacy settings, please refer to WhatsApp’s privacy policy:https://www.whatsapp.com/legal/?eea=1#privacy-policy

6) Data Processing When Opening a Customer Account

In accordance with Art. 6(1)(b) of the GDPR, personal data will continue to be collected and processed to the extent necessary if you provide it to us when opening a customer account. The data required to open an account is specified in the input fields of the corresponding form on our website.

You may delete your customer account at any time by sending a message to the controller’s address listed above. After your customer account is deleted, your data will be deleted provided that all contracts concluded in connection with it have been fully settled, no statutory retention periods prevent this, and we no longer have a legitimate interest in continuing to store the data.

7) Comment Feature

When using the comment feature on this website, in addition to your comment, information regarding the time the comment was posted and the commenter name you selected will be stored and published on this website. Furthermore, your IP address is stored for security reasons so that, in the event of unlawful comments, to enable attribution to the author. Your email address will be stored so that we can contact you in the event that a third party reports your published content as unlawful.

The legal basis for storing your data is Article 6(1)(b) and (f) of the GDPR. We reserve the right to delete comments if they are reported as unlawful by third parties.

8) Use of Customer Data for Direct Marketing

8.1Subscription to Our

Email Newsletter If you subscribe to our email newsletter, we will regularly send you information about our offers. The only required information for receiving the newsletter is your email address. Providing additional data is voluntary and is used to address you personally. To send the newsletter, we use the so-called double opt-inprocedure, which ensures that you will only receive the newsletter once you have expressly confirmed your consent to receive it by clicking on a verification link sent to the email address you provided.

By activating the confirmation link, you grant us your consent to the use of your personal data in accordance with Art. 6(1)(a) of the GDPR. In doing so, we store your IP address as recorded by your Internet Service Provider (ISP), as well as the date and time of registration, in order to be able to trace any potential misuse of your email address at a later date. The data we collect when you subscribe to the newsletter is used strictly for the intended purpose.

You can unsubscribe from the newsletter at any time by clicking the link provided in the newsletter or by sending a message to the data controller named at the beginning of this notice. Once you have unsubscribed, your email address will be immediately deleted from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to use your data for other purposes that are permitted by law and about which we inform you in this statement.

8.2Klaviyo

Our email newsletters are sent via this provider: Klaviyo, 225 Franklin St, Boston, MA 02110, USA

Based on our legitimate interest in effective and user-friendly newsletter marketing, we transfer the data you provided when subscribing to the newsletter to this provider in accordance with Art. 6(1)(f) GDPR so that it can handle the distribution of the newsletter on our behalf.

Subject to your explicit consent pursuant to Article 6(1)(a) of the GDPR, the provider also conducts statistical performance analysis of newsletter campaigns using web beacons or tracking pixels in the emails sent, which can measure open rates and specific interactions with the newsletter’s content. In this process, device information (e.g., time of access, IP address, browser type, and operating system) is also collected and analyzed, but is not combined with other data sets

. You may revoke your consent to newsletter tracking at any time with future effect.

We have entered into a data processing agreement with the provider that protects the data of our website visitors and prohibits disclosure to third parties.

For the transfer of data to the U.S., the provider relies on the European Commission’s Standard Contractual Clauses, which are intended to ensure compliance with European data protection standards.

8.3WhatsApp Newsletter

If you subscribe to our WhatsApp newsletter, we will regularly send you information about our offers via WhatsApp. The only required information for receiving the newsletter is your Cell phone number:

To receive the newsletter, please add the cell phone number we provided to your contacts on your mobile device and send us the message “Start” via WhatsApp. By sending this WhatsApp message, you grant us your consent to use your personal data in accordance with Article 6(1)(a) of the GDPR for the purpose of sending the newsletter. We will then add you to our newsletter distribution list.

The data we collect when you subscribe to the newsletter will be processed exclusively for the purpose of sending you promotional communications via the newsletter. You can unsubscribe from the newsletter at any time by sending us the message “Stop” via WhatsApp. Once you have unsubscribed, your cell phone number will be immediately deleted from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to use your data for other purposes that are permitted by law and about which we inform you in this statement.

Please note that WhatsApp gains access to the address book of the mobile device we use to send the newsletter and automatically transfers phone numbers stored in the address book to a Facebook server in the United States.

To send our WhatsApp newsletter, we therefore use a mobile device whose address book contains only the WhatsApp contact information of our newsletter recipients. This ensures that every person whose WhatsApp contact information is stored in our address book has already consented to the transfer of their WhatsApp phone number from the address books of their chat contacts—in accordance with Article 6(1)(a) of the GDPR—by accepting the WhatsApp Terms of Service when they first used the app on their device. The transfer of data from users who do not use WhatsApp and/or have not contacted us via WhatsApp is therefore excluded.

For information on the purpose and scope of data collection, as well as the further processing and use of the data by WhatsApp, and your related rights and privacy settings, please refer to WhatsApp’s privacy policy:https://www.whatsapp.com/legal/?eea=1#privacy-policy

8.4Advertising by Mail
Based on our legitimate interest in personalized direct marketing, we reserve the right to store your first and last name, your mailing address, and—to the extent we have received this additional information from you within the scope of the contractual relationship —your title, academic degree, year of birth, and your professional, industry, or business designation—in accordance with Art. 6(1)(f) of the GDPR and to use this information to send you interesting offers and information about our products via regular mail.
You may object to the storage and use of your data for this purpose at any time.

8.5Email Notifications Regarding Product Availability

For items that are temporarily unavailable, you can sign up to receive email notifications regarding product

availability

. In this case, we will send you a one-time email message regarding the availability of the specific item you have selected. The only required information for sending this notification is your email address. Providing additional information is optional and may be used to address you personally. We use the so-called double opt-in procedure for sending emails, which ensures that you will only receive a notification once you have confirmed your subscription by clicking on a link sent to the email address you provided. You have expressly confirmed your consent in this regard via verification links.

By activating the confirmation link, you grant us your consent to the use of your personal data in accordance with Art. 6(1)(a) of the GDPR. In doing so, we store your IP address as provided by your Internet Service Provider (ISP), as well as the date and time of registration, in order to be able to trace any potential misuse of your email address at a later date. The data we collect when you register for our email notification service regarding product availability is used strictly for the specified purpose.

You may unsubscribe from the availability notifications at any time by sending a message to the data controller named above. Once you have unsubscribed, your email address will be immediately deleted from our mailing list set up for this purpose, unless you have expressly consented to further use of your data or we reserve the right to use your data for other purposes that are permitted by law and about which we inform you in this statement.

8.6If you abandon your shopping session with us before completing your order, you have the option to receive a one-time email reminder of the contents of your virtual shopping cart.
The only required information for sending this reminder is your email address. Providing additional data is voluntary and may be used to address you personally. For email communications, we use the so-called double opt-in procedure, which ensures that you will only receive a notification once you have expressly confirmed your consent by clicking on a verification link sent to the email address you provided.

By activating the confirmation link, you grant us your consent to the use of your personal data in accordance with Article 6(1)(a) of the GDPR for the purpose of sending a shopping cart reminder. In doing so, we store your IP address as provided by your Internet Service Provider (ISP), as well as the date and time of registration, in order to be able to trace any potential misuse of your email address at a later date. The data we collect when you register for our email notification service is used strictly for the intended purpose.

You may unsubscribe from shopping cart reminders at any time by sending a message to the data controller named at the beginning of this notice. Once you have unsubscribed, your email address will be immediately deleted from our mailing list set up for this purpose, unless you have expressly consented to further use of your data or we reserve the right to use your data beyond this scope, which is permitted by law and about which we inform you in this notice.

9) Data Processing for Order Fulfilment

9.1To the extent necessary for the performance of the contract for delivery and payment purposes, the personal data we collect will be disclosed to the contracted shipping company and the contracted financial institution in accordance with Article 6(1)(b) of the GDPR.

If, based on a corresponding contract, we are obligated to provide updates for goods with digital elements or for digital products, we will process the contact information you provided when placing your order (name, address, email address) to personally inform you, within the legally prescribed timeframe and in accordance with our statutory information obligations under Article 6(1)(c) of the GDPR, via an appropriate communication channel (such as by mail or email) about upcoming updates. Your contact information will be used strictly for the specific purpose of notifying you about updates we are obligated to provide and will be processed for this purpose by We process

your

data only to the extent necessary for the respective purpose.

To process your order, we also work with the service provider(s) listed below, who assist us, in whole or in part, in fulfilling concluded contracts. Certain personal data is transferred to these service providers in accordance with the following information.

9.2Use of Specialized Services for Order Management and Fulfillment

9.3Paqato
To enable customers to track their shipments after placing an order, we use the service provided by PAQATO GmbH, Johann-Krane-Weg 6, 48149 Münster (“Paqato”).
Paqato sends shipping notifications and delivery status updates on our behalf. For this purpose, in accordance with Art. 6(1)(f) of the GDPR, based on our legitimate interest in effective and informative customer communication as well as in transparent and reliable shipping processing—which is also in the customer’s interest—we transfer certain customer data (email address, first and last name, and mailing address) along with the tracking number to Paqato after the package has been shipped.
Paqato does not disclose the data to third parties and processes it exclusively for the purpose stated above. Once shipping is complete, Paqato deletes the data.
We have entered into a data processing agreement with Paqato, under which we require Paqato to protect our customers’ data in accordance with legal requirements.
Paqato’s privacy policy can be viewed here:https://www.paqato.com/datenschutzerklaerung/

9.4Disclosure of Personal Data to Shipping Service Providers

9.5Deutsche Post

We use the following provider as our shipping service provider: Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany

We will disclose your email address and/or phone number to the provider in accordance with Art. 6(1)(a) of the GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or notifying you of the delivery, provided that you have given your explicit consent to this during the ordering process. Otherwise, for the purpose of delivery in accordance with Article 6(1)(b) of the GDPR, we will only disclose the recipient’s name and the delivery address to the provider. This information is disclosed only to the extent necessary for the delivery of the goods. In this case, it is not possible to coordinate the delivery date with the provider in advance or to receive a delivery notification

. You may revoke your consent at any time with future effect by contacting the controller named above or the provider.

9.6DHL

We use the following provider as our shipping service provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany

We will disclose your email address and/or phone number to the provider in accordance with Art. 6(1)(a) GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or providing a delivery notification, provided that you have given your express consent to this during the ordering process. Otherwise, for the purpose of delivery in accordance with Article 6(1)(b) of the GDPR, we will only disclose the recipient’s name and the delivery address to the provider. The transfer takes place only to the extent necessary for the delivery of the goods. In this case, it is not possible to coordinate the delivery date with the provider in advance or to provide advance notice of delivery

. Consent may be revoked at any time with future effect by contacting the controller named above or the provider.

9.7DHL Express

We use the following as our shipping service provider: the following provider: DHL Express Germany GmbH, Heinrich-Brüning-Str. 5, 53113 Bonn, Germany

We will disclose your email address and/or phone number to the provider in accordance with Art. 6(1)(a) of the GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or notifying you of the delivery, provided that you have given your express consent to this during the ordering process. Otherwise, for the purpose of delivery in accordance with Article 6(1)(b) of the GDPR, we will only disclose the recipient’s name and the delivery address to the provider. This information is disclosed only to the extent necessary for the delivery of the goods. In this case, it is not possible to coordinate the delivery date with the provider in advance or to receive a delivery notification

. You may revoke your consent at any time with future effect by contacting the controller named above or the provider.

9.8DPD

We use the following provider as our shipping service provider: DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg, Germany

We disclose your email address and/or phone number to the provider in accordance with Art. 6(1)(a) GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or providing a delivery notification, provided that you have given your express consent to this during the ordering process. Otherwise, for the purpose of delivery in accordance with Article 6(1)(b) of the GDPR, we will only disclose the recipient’s name and the delivery address to the provider. This information is disclosed only to the extent necessary for the delivery of the goods. In this case, it is not possible to coordinate the delivery date with the provider in advance or to receive a delivery notification.

You may revoke your consent at any time with future effect by contacting the controller named above or the provider.

9.9Post CH

We use the following provider as our shipping service provider: Post CH (Swiss Post AG, Switzerland, Wankdorfallee 4, 3030 Bern)

We will share your email address and/or phone number with the provider prior to delivery of the goods for the purpose of coordinating a delivery date or providing a delivery notification, provided that you have given your express consent to this during the ordering process. Otherwise, for the purpose of delivery, we will only share the recipient’s name and the delivery address with the provider. This information is disclosed only to the extent necessary for the delivery of the goods. In this case, it is not possible to coordinate the delivery date with the provider in advance or to receive a delivery notification.
You may revoke your consent at any time with future effect by contacting the data controller named above or the provider.

9.10Use of Payment Service Providers (Payment Services)

9.11Amazon Pay

This website offers one or more online payment methods from the following provider: Amazon Payments Europe s.c.a., 38 avenue J.F. Kennedy, L-1855 Luxembourg

If you select a payment method from this provider that requires you to pay in advance (such as a credit card payment), your payment details provided during the ordering process (including name, address, bank and payment card information, currency, and transaction number), as well as information about the contents of your order, in accordance with Article 6(1)(b) of the GDPR. In this case, your data is transferred exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.

9.12Apple Pay
If you choose the “Apple Pay” payment method offered by Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, the Payment processing via the “Apple Pay” feature on your iOS, watchOS, or macOS device by charging a payment card stored in “Apple Pay.” Apple Pay uses security features built into your device’s hardware and software to protect your transactions. To authorize a payment, you must therefore enter a code you have previously set and verify your identity using the “Face ID” or “Touch ID” feature on your device.
For the purpose of payment processing, the information you provide during the ordering process, along with your order details, is transmitted to Apple in encrypted form. Apple then re-encrypts this data using a developer-specific key before transmitting it to the payment service provider associated with the payment card stored in Apple Pay to complete the transaction. The encryption ensures that only the website through which the purchase was made can access the payment data. After the payment has been made, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website to confirm that the payment was successful.
If personal data is processed in connection with the transmissions described above, such processing is carried out exclusively for the purpose of payment processing in accordance with Art. 6(1)(b) of the GDPR.
Apple retains anonymized transaction data, including the approximate purchase amount, the approximate date and time, and whether the transaction was successfully completed. Anonymization completely precludes any personal identification. Apple uses the anonymized data to improve “Apple Pay” and other Apple products and services.
When you use Apple Pay on your iPhone or Apple Watch to complete a purchase you initiated via Safari on your Mac, the Mac and the authorization device communicate via an encrypted channel through Apple’s servers. Apple does not process or store any of this information in a format that could be used to identify you personally. You can disable the ability to use Apple Pay on your Mac in your iPhone’s Settings. Go to “Wallet & Apple Pay” and turn off “Allow Payments on Mac.”
For more information on data protection with Apple Pay, visit the following web addresses:https://support.apple.com/de-de/HT203027

9.13Google Pay
If you choose the “Google Pay” payment method provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), payment processing will take place via the “Google Pay” app on your mobile device—which must be running at least Android 4.4 (“KitKat”) and have NFC functionality—by charging a payment card stored in Google Pay or a payment system verified there (e.g., PayPal). To authorize a payment via Google Pay exceeding €25, you must first unlock your mobile device using the verification method set up on your device (such as facial recognition, password, fingerprint, or pattern).
For the purpose of payment processing, the information you provide during the ordering process, along with the details of your order, will be shared with Google. Google then transmits your payment information stored in Google Pay—in the form of a one-time transaction number—to the originating website to verify that the payment has been made. This transaction number does not contain any information regarding the actual payment details of the payment methods you have on file with Google Pay; instead, it is generated and transmitted as a one-time numeric token. For all transactions made via Google Pay, Google acts solely as an intermediary in processing the payment. The transaction is carried out exclusively between the user and the merchant’s website by charging the payment method stored in Google Pay.
If personal data is processed in connection with the described transmissions, such processing is carried out exclusively for the purpose of payment processing in accordance with Article 6(1)(b) of the GDPR.
Google reserves the right to collect, store, and analyze certain transaction-specific information for every transaction made via Google Pay. This includes the date, time, and amount of the transaction; the merchant’s location and description; a description of the purchased goods or services provided by the merchant; photos you have attached to the transaction, the name and email address of the seller and buyer or the sender and recipient, the payment method used, your description of the reason for the transaction, and, if applicable, the offer associated with the transaction.
According to Google, this processing is carried out exclusively in accordance with Article 6(1)(f) of the GDPR on the basis of a legitimate interest in proper accounting, the verification of transaction data, and the optimization and maintenance of the Google Pay service.
Google also reserves the right to combine the processed transaction data with additional information collected and stored by Google when you use other Google services.
The Google Pay Terms of Service can be found here:
https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=de
Further information on data protection for Google Pay can be found at the following web address:
https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de

9.14PayPal

One or more online payment methods from the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method from this provider that requires you to pay in advance (such as a credit card payment), the payment data you provide during the ordering process (including your name, address, bank and payment card information, currency, and transaction number), as well as information about the contents of your order, in accordance with Article 6(1)(b) of the GDPR. In this case, your data is transferred exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.

If you select a payment method in which the provider advances payment (such as purchase on account, installment purchase, or direct debit), you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, ZIP code, city, date of birth, email address, phone number, and, if applicable, details regarding an alternative payment method).

To safeguard our legitimate interest in determining our customers’ creditworthiness, we forward this data to the provider in accordance with Art. 6(1)(f) of the GDPR for the purpose of a credit check. The provider verifies, based on the information you have provided, personal data as well as other data (such as shopping cart contents, invoice amount, order history, and payment history) to determine whether the payment option you have selected can be granted in light of payment and/or credit default risks.

The credit report may contain probability values (so-called “score” values). To the extent that score values are included in the credit report, they are based on a scientifically recognized mathematical-statistical method. The calculation of the score values includes, among other things but not exclusively, address data.

You may object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may still be entitled to process your personal data if this is necessary for the contractual processing of payments.

9.15Shopify Payments

One or more online payment methods from the following provider are available on this website: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

If you select a payment method from this provider that requires you to pay in advance (such as a credit card payment), your payment data provided during the ordering process (including name, address, bank and payment card information, currency, and transaction number), as well as information about the contents of your order, will be transferred to the provider in accordance with Article 6(1)(b) of the GDPR. In this case, your data is transferred exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.

10) Online Marketing

10.1Facebook Pixel for Creating Custom Audiences with Advanced Data Matching (with Cookie Consent Tool)

Within our online platform, we use the “Facebook Pixel” service from the following provider in advanced data matching mode: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Facebook”)

If a user clicks on an advertisement we have placed on Facebook, “Facebook Pixel” adds a parameter to the URL of our linked page. After the user is redirected, this URL parameter is then stored in the user’s browser via a cookie set by our linked page itself. In addition, this cookie collects specific customer data—such as the email address—that we gather on our website linked to the Facebook ad during processes such as purchase completions, account logins, or registrations (extended data matching). The cookie is then read, enabling the transmission of the data—including the specific customer data—to Facebook.

We use “Facebook Pixel” with extended data matching to make our Facebook ads more effective and to ensure that they align with users’ interests or exhibit certain characteristics (e.g., interests in specific topics or products, determined based on the websites visited), which we transmit to Facebook (so-called “Custom Audiences”).

In addition, we analyze the effectiveness of our ads by tracking whether users were redirected to our website after clicking on an ad (conversion). Compared to the standard version of “Facebook Pixel,” the extended data matching feature helps us better measure the effectiveness of our advertising campaigns by capturing more attributed conversions.

All transmitted data is stored and processed by Facebook, enabling it to be associated with the respective user profile and allowing Facebook to use the data for its own advertising purposes. The data enables Facebook to and enable its partners to display ads on and off Facebook

All processing described above, in particular the setting of cookies to read information from the device you are using, will only take place if you have given us your explicit consent in accordance with Art. 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect by deactivating this service in the “Cookie Consent Tool” provided on the website.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

The information generated by Facebook is generally transmitted to and stored on a Facebook server; in this context, it may also be transferred to servers operated by Meta Platforms Inc. in the United States.

10.2Use of Affiliate Programs

10.3MCANISM Technology Affiliate Program

We participate in the affiliate program of the following provider: MCANISM Technology GmbH, Bei dem Neuen Krahn 2, 20457 Hamburg, Germany

. In this context, we have placed links on our website that lead to offers on the provider’s websites or those of third parties (“partner sites”).

To measure the success of an affiliate link, evaluate orders generated via such a link, and process the corresponding commission payments, the provider uses cookies and/or comparable technologies, which are generally set on the partner sites and for which we are not responsible under data protection law. In doing so, the provider regularly processes the IP address and, where applicable, additional device information.

All processing described above, in particular the reading or storage of information on the device you are using, takes place only if you have given your explicit consent in accordance with Art. 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect by using the cookie consent management options on the partner sites.

10.4Webgains

We participate in the affiliate program of the following provider: ad pepper media GmbH, FrankenStraße 150C, 90461 Nuremberg, Germany

. In this context, we have placed links on our website that lead to offers on the provider’s websites or those of third parties (“partner sites”).

To measure the success of an affiliate link, evaluate orders generated via such a link, and settle commission payments accordingly, the provider uses cookies and/or comparable technologies, which are generally set on the partner sites and for which we are not responsible under data protection law. In doing so, the provider also regularly processes the IP address and, where applicable, other device information.

11) Web Analytics Services

11.1Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), which enables us to analyze your use of our website.

By default, when you visit the website, Google Analytics 4 sets cookies, which are small text files stored on your device and used to collect certain information. This information includes your IP address; however, Google truncates the last few digits of your IP address to prevent direct personal identification.

The information is transmitted to Google’s servers and processed there. This may also involve transfers to Google LLC, which is headquartered in the United States.

Google uses the collected information on our behalf to evaluate your use of the website, compile reports on website activity for us, and provide other services related to website and internet usage. The truncated IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google. The data collected through the use of Google Analytics 4 is stored for a period of two months and then deleted.

All processing described above, in particular the placement of cookies on the device you are using, takes place only if you have given us your explicit consent in accordance with Art. 6(1)(a) GDPR.
Without your consent, Google Analytics 4 will not be used during your visit to the site. You may revoke your consent at any time with future effect. To exercise your right of revocation, please deactivate this service using the “Cookie Consent Tool” provided on the website.

We have entered into a data processing agreement with Google that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.
For the transfer of data to the United States, Google relies on the European Commission’s Standard Contractual Clauses, which are intended to ensure compliance with European data protection standards.
Further legal information regarding Google Analytics 4, including a copy of the aforementioned Standard Contractual Clauses, can be found athttps://policies.google.com/privacy?hl=de&gl=deandathttps://policies.google.com/technologies/partner-sites

Demographic Characteristics
Google Analytics 4 uses the special “demographic characteristics” feature and can use it to generate statistics that provide insights into the age, gender, and interests of website visitors. This is done by analyzing advertising and information from third-party providers. This allows target groups to be identified for marketing activities. However, the collected data cannot be attributed to any specific individual and is deleted after being stored for a period of two months.

Google Signals
As an extension to Google Analytics 4, Google Signals may be used on this website to generate cross-device reports. If you have enabled personalized ads and linked your devices to your Google Account, Google may—subject to your consent to the use of Google Analytics pursuant to Art. 6(1)(a) of the GDPR—analyze your usage behavior across devices and create database models, including those related to cross-device conversions. We do not receive any personal data from Google, but only statistics. If you want to stop cross-device analysis, you can disable the "Personalized ads" feature in your Google Account settings. To do so, follow the instructions on this page:https://support.google.com/ads/answer/2662922?hl=deFor moreinformation on Google Signals, please visit the following link:https://support.google.com/analytics/answer/7532985?hl=de

UserIDs
As an extension to Google Analytics 4, the “UserIDs” feature may be used on this website. If you have consented to the use of Google Analytics 4 in accordance with Art. 6(1)(a) of the GDPR, have set up an account on this website, and log in to this account on various devices, your activities—including conversions—can be analyzed across devices.

11.2Matomo
This website uses a web analytics service provided by the following vendor: InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand, (“Matomo”)
Pseudonymized usage profiles may be created and evaluated from this data for the same purpose. Cookies may be used for this purpose. Cookies are small text files that are stored locally in the cache of the site visitor’s web browser. Among other things, cookies enable the recognition of the web browser. If data collected using Matomo technology (including your pseudonymized IP address) is transferred to Matomo’s servers in New Zealand and processed for usage analysis purposes, we would like to inform you that the European Commission has issued an “adequacy decision” for New Zealand, which certifies compliance with European data protection standards for international data transfers.
The pseudonymized information generated by the cookie is not used to personally identify visitors to this website and is not combined with personal data about the bearer of the pseudonym.
If data is also transferred to the provider’s servers and the web analytics service has not been installed locally on our server, we have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

All processing described above, in particular the setting of cookies to read information from the device you are using, will only take place if you have given us your explicit consent in accordance with Art. 6(1)(a) of the GDPR. Without this consent, Matomo will not be used during your visit to the site.
You may revoke your consent at any time with future effect. To exercise your right to revoke consent, please deactivate this service using the “Cookie Consent Tool” provided on the website.

11.3Matomo
This website uses a web analytics service provided by the following vendor: InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand, (“Matomo”)
To protect website visitors, Matomo uses a so-called “config_id” to enable various analyses of website usage within a short time window of up to 24 hours. The site’s “config_id” is a randomly generated, time-limited hash of a limited set of the visitor’s settings and attributes. The config_id or config hash is a string generated for a visitor based on their operating system, browser, based on the user’s browser plugins, IP address, and browser language. Matomo does not use device fingerprinting and uses an anonymized IP address of the site visitor to generate the “config_id.”
If the information processed in this manner includes personal user data, the processing is carried out in accordance with Article 6(1)(f) of the GDPR based on our legitimate interest in the statistical analysis of user behavior for optimization and marketing purposes. To object to the future processing of your visitor data, we provide a separate opt-out option on our website.
We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

If data collected using Matomo technology (including your pseudonymized IP address) is transferred to Matomo’s servers in New Zealand and processed for usage analysis purposes, we would like to inform you that the European Commission has issued an “adequacy decision” for New Zealand, which certifies compliance with European data protection standards for international data transfers.

11.4Google Tag Manager

This website uses “Google Tag Manager,” a service provided by the following provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”).

Google Tag Manager provides a technical framework for bundling various web applications—including tracking and analytics services—and for configuring, controlling, and applying conditions to them via a unified user interface. Google Tag Manager itself does not store any information on users’ devices or read data from them. Nor does the service perform any independent data analysis. However, when you visit a page, Google Tag Manager transmits your IP address to Google, where it may be stored. Transmission to servers operated by Google LLC in the United States is also possible.

This processing is carried out only if you have given us your explicit consent in accordance with Article 6(1)(a) of the GDPR. Without this consent, Google Tag Manager will not be used during your visit to the site. You may revoke your consent at any time with future effect. To exercise your right to revoke consent, please deactivate this service using the “Cookie Consent Tool” provided on the website.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

12) Retargeting/Remarketing and Conversion Tracking

by Criteo

This website uses retargeting technology from the following provider: Criteo SA, 32 Rue Blanche, 75009 Paris, France

This technology enables us to target visitors to our website with personalized, interest-based advertising who have already shown an interest in our store and our products. The display of advertisements is based on a cookie-based analysis of past and current usage behavior; however, no personal data is stored. When retargeting technology is used, a cookie is stored on your computer or mobile device to collect pseudonymized data about your interests and thus tailor the advertisements to the stored information. These cookies are small text files that are stored on your computer or mobile device. This allows us to display advertisements that are highly likely to match your product and information interests.

All processing described above, in particular the setting of cookies to read information from the device you are using, will only take place if you have given us your explicit consent in accordance with Art. 6(1)(a) of the GDPR. Without this consent, retargeting technology will not be used during your visit to the site.

You may revoke your consent at any time with future effect. To exercise your right to revoke consent, please disable this service using the “Cookie Consent Tool” provided on the website.

Google Ads Remarketing
Our website uses Google Ads Remarketing features to advertise this website in Google search results and on third-party websites. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). For this purpose, Google sets a cookie in your device’s browser, which automatically enables interest-based advertising using a pseudonymous cookie ID and based on the pages you have visited. Any further data processing takes place only if you have consented to Google linking your web and app browsing history to your Google Account and using information from your Google Account to personalize the ads you see on the web. In this case, if you are logged into Google while visiting our website, Google uses your data in conjunction with Google Analytics data to create and define audience lists for cross-device remarketing. To do this, Google temporarily links your personal data with Google Analytics data to form audiences. As part of the use of Google Ads Remarketing, personal data may also be transferred to the servers of Google LLC in the United States.
Details regarding the processing triggered by Google Ads Remarketing and Google’s handling of data from websites can be found here:https://policies.google.com/technologies/partner-sites
You can permanently opt out of Google Ads Remarketing setting cookies by downloading and installing the Google browser plug-in available at the following link:
https://support.google.com/ads/answer/7395996?
You can find further information and the privacy policy regarding advertising and Google here:
https://www.google.com/policies/technologies/ads/
All processing described above, in particular the setting of cookies to read information from the device you are using, will only be carried out if you have given us your explicit consent in accordance with Art. 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect by deactivating this service in the “Cookie Consent Tool” provided on the website.

Microsoft Advertising

This website uses retargeting technology from the following provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA

This technology enables us to target visitors to our website with personalized, interest-based advertising to reach those who have already shown interest in our store and our products. The display of advertising content is based on a cookie-based analysis of past and current usage behavior; however, no personal data is stored. When retargeting technology is used, a cookie is stored on your computer or mobile device to collect pseudonymized data about your interests and thus tailor the advertising to the stored information. These cookies are small text files stored on your computer or mobile device. This allows us to display advertisements that are highly likely to match your product and information interests.

All processing described above—in particular, the setting of cookies to read information from the device you are using—is carried out only if you have given us your explicit consent in accordance with Article 6(1)(a) of the GDPR. Without this consent, retargeting technology will not be used during your visit to the website.

You may revoke your consent at any time with future effect. To exercise your right to revoke consent, please disable this service using the “Cookie Consent Tool” provided on the website.

Pinterest Retargeting Pixel

This website uses retargeting technology from the following provider: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland

. This technology enables us to target visitors to our website who have already shown an interest in our store and our products with personalized, interest-based advertising. The display of these advertisements is based on a cookie-based analysis of past and current usage behavior; however, no personal data is stored. When retargeting technology is used, a cookie is stored on your computer or mobile device to collect pseudonymized data about your interests and thus tailor the advertising to the stored information. These cookies are small text files stored on your computer or mobile device. This allows us to display advertisements that are highly likely to match your product and information interests.

You may revoke your consent at any time with future effect. To exercise your right to revoke consent, please disable this service using the “Cookie Consent Tool” provided on the website.

13) Website Features

13.1YouTube

This website uses plugins to display and play videos from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

. Data may also be transferred to: Google LLC, USA

. When you visit a page on our website that contains such a plugin, your browser establishes a direct connection to the provider’s servers to load the plugin. In the process, certain information—including your IP address—is transmitted to the provider.

If playback When an embedded video is played via the plugin, the provider also uses cookies to collect information about user behavior, generate playback statistics, and prevent abusive behavior.

If you are logged into a user account with the provider while visiting the site, your data will be directly associated with your account when you click on a video. If you do not wish for this information to be associated with your account, you must log out before clicking the play button.

All of the aforementioned processing activities, in particular the setting of cookies to read information from the device you are using, take place only if you have given us your explicit consent in accordance with Art. 6(1)(a) of the GDPR. You may revoke the consent you have given at any time with future effect by deactivating this service via the “Cookie Consent Tool” provided on the website.

13.2Google Maps API

To enable real-time verification of certain entries in the address form of our online store’s ordering process for input errors, we use the services of the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

. Data may also be transferred to: Google LLC, USA.

The provider validates the entered address, verifies the spelling, and supplements any missing data as needed. In the case of ambiguous addresses, correct alternative suggestions are displayed. For this purpose, the address data you enter is transmitted to the provider, where it is stored and analyzed.

This processing is carried out in accordance with Article 6(1)(f) of the GDPR based on our legitimate interest in the proper collection of the customer’s correct address data to ensure the diligent fulfillment of our contractual delivery obligations and to prevent issues with contract execution.

The provider processes the relevant data separately and does not merge it with other data sets; it deletes the data as soon as its status or accuracy has been confirmed, but no later than 30 days after collection.

13.3- Google Web Fonts

This site uses so-called web fonts from the following provider to ensure consistent font display: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

. When you visit a page, your browser loads the required web fonts into its cache to display text and fonts correctly and establishes a direct connection to the provider’s servers. In the process, certain browser information, including your IP address, is transmitted to the provider.

Data may also be transmitted to: Google LLC, USA

. The processing of personal data in connection with establishing a connection to the font provider is carried out only if you have given us your explicit consent to do so in accordance with Art. 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect by deactivating this service via the “Cookie Consent Tool” provided on the website. If your browser does not support web fonts, a standard font from your computer will be used.

For the transfer of data to the United States, the provider relies on the European Commission’s Standard Contractual Clauses, which to ensure compliance with European data protection standards.

13.4Google reCAPTCHA

On this website, we use the CAPTCHA service provided by the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transferred to: Google LLC, USA. For the visual design of the CAPTCHA window, the provider uses “Google Fonts,” i.e., fonts downloaded from the Internet by Google. No information other than that mentioned above—which is already transmitted to Google via the reCAPTCHA functionality—is processed in this context.

The service checks whether an input is made by a human or is being abused through machine-based and automated processing, and blocks spam, DDoS attacks, and similar automated malicious access attempts. To ensure that an action is performed by a human and not by an automated bot, Cloudflare Turnstile collects the IP address of the end device used, identification data regarding the browser and operating system types used, as well as the date and duration of the visit, and transmits this information to the provider’s servers for evaluation.

The legal basis for this is our legitimate interest in establishing individual accountability on the Internet and preventing abuse and spam, in accordance with Article 6(1)(f) of the GDPR.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

13.5Microsoft Power BI

For the internal visualization of business processes and for user-defined analyses of business processes, we use the “Microsoft Power BI” service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Where applicable, personal customer data may be subject to visualization and analysis processes and may be processed by Microsoft BI for this purpose. In this case, Microsoft processes personal data as a data processor acting under our instructions in accordance with Article 28 of the GDPR and has contractually committed to us to protect this data in accordance with legal requirements.

To this end, Microsoft uses state-of-the-art encryption methods and ensures that data processing takes place exclusively in data centers within the EU.

13.6Shopsync for Shopify

This website uses the Shopify app “Shopsync” provided by ShopSync LLC, PO Box 252, Jefferson City, TN 37760, USA.
ShopSync is used to synchronize the “Mailchimp” newsletter service with our Shopify account so that, on the one hand, updates to Mailchimp’s email lists (such as a newsletter recipient opting out) are automatically recorded in Shopify as well, and, on the other hand, new contact data generated through contract conclusions on Shopify is automatically transferred to Mailchimp’s email lists.

In the former case, data processing is carried out in accordance with Art. 6(1)(f) of the GDPR based on our legitimate interest in the effective, cross-system maintenance of our mailing lists and the efficient handling of legally significant status changes.

In the second case, solely on the basis of the user’s explicit consent pursuant to Article 6(1)(a) of the GDPR, following the conclusion of a contract on Shopify, the user’s first and last name, address, and email address—along with transaction-related Information (purchase amount, time, and date of purchase) is transferred from ShopSync to Mailchimp.

Data transferred in this way is not stored or retained by ShopSync after synchronization. All information synchronized between Shopify and Mailchimp is transmitted using SSL (Secure Socket Layer) technology, and all transmitted information remains encrypted during the synchronization process.

The synchronization process requires the transmission of information via a secure connection to servers hosted by Amazon Web Services in the United States.

For further information regarding ShopSync’s privacy policy, please visit:https://shopsync.io/privacy-policy

14) Tools and Miscellaneous

14.1Cookie Consent Tool

This website uses a so-called “Cookie Consent Tool” to obtain valid user consent for cookies and cookie-based applications that require consent. The “Cookie Consent Tool” is displayed to users when they visit the page in the form of an interactive user interface, where they can grant consent for specific cookies and/or cookie-based applications by checking the appropriate boxes. When the tool is used, all cookies and services requiring consent are loaded only if the respective user grants the corresponding consent by checking the appropriate boxes. This ensures that such cookies are set on the user’s device only if consent has been granted.

The tool sets technically necessary cookies to store your cookie preferences. Personal user data is generally not processed in this context.

However, if—in individual cases—the storage, assigning, or logging cookie settings, this is done in accordance with Article 6(1)(f) of the GDPR on the basis of our legitimate interest in legally compliant, user-specific, and user-friendly consent management for cookies and, consequently, in the legally compliant design of our website.

Another legal basis for the processing is Article 6(1)(c) of the GDPR. As the data controller, we are subject to the legal obligation to make the use of technically non-essential cookies contingent upon the user’s consent.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

Further information about the provider and the settings options for the cookie consent tool can be found directly in the corresponding user interface on our website.

14.2Google Maps

This website uses an online map service provided by the following provider: Google Maps (API) by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).

Google Maps is a web service for displaying interactive (map) maps to visually present geographic information. By using this service, our location is displayed to you, making it easier for you to find us.

As soon as you access the subpages on which the Google Maps map is embedded, information about your use of our website (such as your IP address) is transmitted to Google’s servers and stored there; this may also involve a transfer to the servers of Google LLC in the United States. This occurs regardless of whether Google provides a user account through which you are logged in or whether a user account exists. If you are logged in to Google, your data is transmitted directly associated with your account. If you do not wish to have this information linked to your Google profile, you must log out before clicking the button. Google stores your data (even for users who are not logged in) as usage profiles and analyzes this data.

The collection, storage, and analysis are carried out in accordance with Article 6(1)(f) of the GDPR based on Google’s legitimate interest in displaying personalized advertising, conducting market research, and/or tailoring Google websites to user needs. You have the right to object to the creation of these user profiles; to exercise this right, you must contact Google. If you do not consent to the future transmission of your data to Google in connection with your use of Google Maps, you also have the option to completely disable the Google Maps web service by turning off JavaScript in your browser. Google Maps—and thus the map display on this website—will then no longer be available for use.

To the extent required by law, we have obtained your consent for the processing of your data described above in accordance with Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect. To exercise your right to revoke consent, please follow the procedure for objecting described above.

15) Rights of the Data Subject

15.1Applicable data protection law grants you the following rights as a data subject (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data; please refer to the cited legal basis for the respective conditions for exercising these rights:

Right of access pursuant to Art. 15 of the GDPR;
Right to rectification pursuant to Art. 16 of the GDPR;
Right to erasure pursuant to Art. 17 of the GDPR;
Right to restriction of processing pursuant to Art. 18 GDPR;
Right to be informed pursuant to Art. 19 GDPR;
Right to data portability pursuant to Article 20 of the GDPR;
Right to withdraw consent pursuant to Article 7(3) of the GDPR;
Right to lodge a complaint pursuant to Article 77 of the GDPR.

15.2RIGHT TO OBJECT

: IF WE PROCESS YOUR PERSONAL DATA AS PART OF A BALANCING OF INTERESTS BASED ON OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO SUCH PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA IN QUESTION. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OUTWEIGH YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING IS NECESSARY FOR THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR THE PURPOSE OF SUCH MARKETING. YOU MAY EXERCISE THIS RIGHT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE RELEVANT DATA FOR DIRECT MARKETING PURPOSES.

16) Retention Period

for

Personal Data

The retention period for personal data is determined by the respective legal basis, the purpose of processing, and—where applicable—the applicable statutory retention period (e.g., retention periods under commercial and tax law).

When processing personal data based on explicit consent in accordance with Pursuant to Article 6(1)(a) of the GDPR, the data in question will be stored until you withdraw your consent.

If statutory retention periods apply to data processed in connection with contractual or quasi-contractual obligations pursuant to Article 6(1)(b) of the GDPR, such data will be routinely deleted upon expiration of the retention periods, provided that it is no longer necessary for the performance or initiation of a contract and/or we no longer have a legitimate interest in continuing to store it.

When processing personal data based on Article 6(1)(f) of the GDPR, this data will be stored until you exercise your right to object under Article 21(1) of the GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

When processing personal data for the purpose of direct marketing based on Article 6(1)(f) of the GDPR, this data will be stored until you exercise your right to object under Article 21(2) of the GDPR.

Unless otherwise specified in the other information in this statement regarding specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.