Privacy Policy
1) Introduction and Contact Details of the Controller
1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about the handling of your personal data when using our website. Personal data means all data with which you can be personally identified.
1.2 The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Armbrust-Ruf GmbH, Felix Wankel Strasse 11, 75210 Keltern, Germany, Tel.: +49723613070, E-mail: info@armbrust-ruf.de. The controller for the processing of personal data is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.
2) Data Collection When Visiting Our Website
2.1 When you use our website solely for informational purposes, i.e., when you do not register or otherwise provide us with information, we only collect data that your browser transmits to the page server (so-called “server log files”). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:
- Our website visited
- Date and time at the time of access
- Amount of data sent in bytes
- Source/referral from which you accessed the page
- Browser used
- Operating system used
- IP address used (if applicable: in anonymized form)
Processing takes place pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not disclosed or used for any other purpose. However, we reserve the right to review the server log files ex post facto should there be concrete indications of unlawful use.
2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the “https://” string and the padlock symbol in your browser bar.
3) Hosting & Content Delivery Network
Shopify
For the hosting of our website and the display of the page content, we use the system of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”)
Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada
All data collected on our website is processed on the provider's servers. We have concluded a data processing agreement with the provider, which ensures the protection of our page visitors' data and prohibits unauthorized disclosure to third parties.
In the event of data transfer to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.
4) Cookies
To make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e., small text files that are stored on your end device. Some of these cookies are automatically deleted again after closing the browser (so-called “session cookies”), while some cookies remain on your end device longer and enable the storage of page settings (so-called “persistent cookies”). In the latter case, you can find out the storage duration in the overview of the cookie settings of your web browser.
If individual cookies we use also process personal data, the processing takes place pursuant to Art. 6(1)(b) GDPR either for the performance of the contract, pursuant to Art. 6(1)(a) GDPR in the event of a granted consent, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the page visit.
You can set your browser so that you are informed about the setting of cookies and can decide individually on their acceptance or exclude the acceptance of cookies for certain cases or generally.
Please note that if cookies are not accepted, the functionality of our website may be limited.
5) Contact
5.1 Klaviyo
For review reminders, we use the services of the following provider: Klaviyo, Inc., 125 Summer St., Ste 600, Boston, MA 02110, USA
Solely on the basis of your express consent pursuant to Art. 6(1)(a) GDPR, we transfer your email address and, if applicable, further customer data to the provider so that it can contact you with a review reminder by email.
You can revoke your consent at any time with effect for the future towards us or the provider.
We have concluded a data processing agreement with the provider, which ensures the protection of our page visitors' data and prohibits unauthorized disclosure to third parties.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level on the basis of an adequacy decision of the European Commission.
5.2 In the context of contacting us (e.g., via contact form or email), personal data is processed – solely for the purpose of processing and answering your inquiry and only to the extent required for this purpose.
The legal basis for the processing of this data is our legitimate interest in answering your inquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted when it can be inferred from the circumstances that the matter concerned has been conclusively clarified and provided that no statutory retention obligations prevent this.
5.3 - Klaviyo
For the sending of transactional emails, i.e., occasion-related messages triggered by a specific user interaction (e.g.: conclusion of a contract, registration, or password reset), we use this provider: Klaviyo, Inc., 125 Summer St., Ste 600, Boston, MA 02110, USA
On the basis of our legitimate interest in effective and user-friendly email communication, we pass on the data you provided when executing such a user action pursuant to Art. 6(1)(f) GDPR to this provider so that it can take over the email sending on our behalf.
We have concluded a data processing agreement with the provider, which protects the data of our page visitors and prohibits disclosure to third parties.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level on the basis of an adequacy decision of the European Commission.
6) Use of Customer Data for Direct Marketing
6.1 Registration for our email newsletter
When you register for our email newsletter, we regularly send you information about our offers. The only mandatory information for sending the newsletter is your email address. The provision of further data is voluntary and is used to be able to address you personally. For newsletter sending, we use the so-called Double Opt-in procedure, with which it is ensured that you only receive the newsletter after you have expressly confirmed your consent to receive the newsletter by clicking a verification link sent to the provided email address.
By activating the confirmation link, you grant us your consent for the use of your personal data pursuant to Art. 6(1)(a) GDPR. Here, we store your IP address registered by the Internet Service Provider (ISP) as well as the date and time of registration so that we can trace a possible misuse of your email address at a later time. The data collected by us when registering for the newsletter is used strictly for the intended purpose.
You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending a corresponding message to the controller mentioned above. After unsubscribing, your email address will be immediately deleted from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to a further use of data that is legally permitted and about which we inform you in this declaration.
6.2 Klaviyo
The sending of our email newsletters and other promotional email communication takes place via this provider: Klaviyo, Inc., 125 Summer St., Ste 600, Boston, MA 02110, USA
On the basis of our legitimate interest in effective and user-friendly email marketing, we pass on the data you provided when registering pursuant to Art. 6(1)(f) GDPR to this provider so that it can take over the email sending on our behalf.
Subject to your express consent pursuant to Art. 6(1)(a) GDPR, the provider also carries out a statistical success evaluation of email campaigns using web beacons or tracking pixels in the sent emails, which can measure open rates and specific interactions with the content of the newsletter. In this process, end-device information (e.g., time of access, IP address, browser type, and operating system) is also collected and evaluated, but not merged with other data sets.
You can revoke your consent to email tracking at any time with effect for the future.
We have concluded a data processing agreement with the provider, which protects the data of our page visitors and prohibits disclosure to third parties.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level on the basis of an adequacy decision of the European Commission.
6.3 Cart reminders by email
In the event of abandoning your purchase with us before completing the order, you have the option to be reminded once by email of the contents of your virtual shopping cart.
The only mandatory information for sending this reminder is your email address. The provision of further data is voluntary and is used, if applicable, to be able to address you personally. For email sending, we use the so-called Double Opt-in procedure, with which it is ensured that you only receive a notification after you have expressly confirmed your consent in this regard by clicking a verification link sent to the provided email address.
By activating the confirmation link, you grant us your consent for the use of your personal data pursuant to Art. 6(1)(a) GDPR for sending a cart reminder. Here, we store your IP address registered by the Internet Service Provider (ISP) as well as the date and time of registration so that we can trace a possible misuse of your email address at a later time. The data collected by us when registering for our email notification service is used strictly for the intended purpose.
You can unsubscribe from the cart reminders at any time by sending a corresponding message to the controller mentioned above. After unsubscribing, your email address will be immediately deleted from our distribution list set up for this purpose, unless you have expressly consented to further use of your data or we reserve the right to a further use of data that is legally permitted and about which we inform you in this declaration.
7) Data processing for order fulfillment
7.1 As far as necessary for contract fulfillment for delivery and payment purposes, the personal data collected by us is passed on pursuant to Art. 6(1)(b) GDPR to the commissioned transport company and the commissioned credit institution.
If we owe you updates for goods with digital elements or for digital products based on a corresponding contract, we process the contact data you submitted when ordering to inform you personally within the scope of our statutory information obligations pursuant to Art. 6(1)(c) GDPR. Your contact data is used strictly for the purpose of communications about updates owed by us and is processed by us for this purpose only to the extent that this is necessary for the respective information.
To fulfill your order, we also work with the following service provider(s), who support us wholly or partially in the performance of concluded contracts. Certain personal data is transferred to these service providers according to the following information.
7.2 Transfer of personal data to shipping service providers
- Deutsche Post
As a transport service provider, we use the following provider: Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany
We pass on your email address and/or phone number pursuant to Art. 6(1)(a) GDPR before the delivery of the goods for the purpose of coordinating a delivery date or for the delivery notification to the provider, provided you have given your express consent for this in the ordering process. Otherwise, for the purpose of delivery pursuant to Art. 6(1)(b) GDPR, we only pass on the name of the recipient and the delivery address to the provider. The transfer takes place only insofar as this is necessary for the delivery of goods. In this case, a prior coordination of the delivery date with the provider or the delivery notification is not possible.
The consent can be revoked at any time with effect for the future towards the controller mentioned above or towards the provider.
- DHL
As a transport service provider, we use the following provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany
We pass on your email address and/or phone number pursuant to Art. 6(1)(a) GDPR before the delivery of the goods for the purpose of coordinating a delivery date or for the delivery notification to the provider, provided you have given your express consent for this in the ordering process. Otherwise, for the purpose of delivery pursuant to Art. 6(1)(b) GDPR, we only pass on the name of the recipient and the delivery address to the provider. The transfer takes place only insofar as this is necessary for the delivery of goods. In this case, a prior coordination of the delivery date with the provider or the delivery notification is not possible.
The consent can be revoked at any time with effect for the future towards the controller mentioned above or towards the provider.
- DHL Express
As a transport service provider, we use the following provider: DHL Express Germany GmbH, Heinrich-Brüning-Str. 5, 53113 Bonn, Germany
We pass on your email address and/or phone number pursuant to Art. 6(1)(a) GDPR before the delivery of the goods for the purpose of coordinating a delivery date or for the delivery notification to the provider, provided you have given your express consent for this in the ordering process. Otherwise, for the purpose of delivery pursuant to Art. 6(1)(b) GDPR, we only pass on the name of the recipient and the delivery address to the provider. The transfer takes place only insofar as this is necessary for the delivery of goods. In this case, a prior coordination of the delivery date with the provider or the delivery notification is not possible.
The consent can be revoked at any time with effect for the future towards the controller mentioned above or towards the provider.
7.3 Use of payment service providers (payment services)
- Klarna
On this website, one or more online payment methods of the following provider are available: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden
When selecting a payment method of the provider where you pay in advance (e.g., credit card payment), your payment data shared with them during the ordering process (including name, address, bank and card information, currency, and transaction number) as well as information about the contents of your order are passed on pursuant to Art. 6(1)(b) GDPR. In this case, the transfer of your data takes place exclusively for the purpose of payment processing with the provider and only to the extent that it is necessary for this purpose.
When selecting a payment method where the provider pays in advance (e.g., invoice or installment purchase or direct debit), you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, phone number, if applicable, data about an alternative payment method).
To safeguard our legitimate interest in determining the creditworthiness of our customers, we forward this data pursuant to Art. 6(1)(f) GDPR to the provider for the purpose of a credit check. Based on the personal data you provided as well as other data (such as shopping cart, invoice amount, order history, payment experiences), the provider checks whether the payment option you selected can be granted in view of payment and/or default risks.
In addition to internal provider criteria pursuant to Art. 6(1)(f) GDPR, identity and credit information from the following credit reporting agencies can also be included in the decision within the scope of the application review:
https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies
The credit report may contain probability values (so-called score values). To the extent that score values are incorporated into the result of the credit report, they are based on a scientifically recognized mathematical-statistical method. Address data, among other things, but not exclusively, is used in the calculation of the score values.
You can object to this processing of your data at any time by sending us a message or by contacting the provider. However, the provider may still be entitled to process your personal data if this is necessary for the contractual processing of payments.
- PayPal Checkout
This website uses PayPal Checkout, an online payment system from PayPal that combines PayPal's own payment methods with local payment methods from third-party providers.
When paying via PayPal, credit card via PayPal, direct debit via PayPal, or – if offered – "Pay Later" via PayPal, we pass on your payment data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal") as part of the payment processing. The disclosure is made in accordance with Art. 6(1)(b) GDPR and only to the extent that this is necessary for the processing of payments.
For the payment methods credit card via PayPal, direct debit via PayPal, or – if offered – "Pay Later" via PayPal, PayPal reserves the right to conduct a credit check. For this purpose, your payment data may be passed on to credit reporting agencies in accordance with Art. 6(1)(f) GDPR on the basis of PayPal's legitimate interest in determining your creditworthiness. PayPal uses the result of the credit check regarding the statistical probability of payment default to decide whether to provide the respective payment method. The credit report may contain probability values (so-called score values). To the extent that score values are incorporated into the result of the credit report, they are based on a scientifically recognized mathematical-statistical method. Address data, among other things, but not exclusively, is used in the calculation of the score values. You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for the contractual processing of payments.
If the PayPal payment method "Invoice" is available and selected, your payment data is initially transmitted to PayPal to prepare the payment, after which PayPal forwards it to Ratepay GmbH, Franklinstraße 28-29, 10587 Berlin ("Ratepay") to process the payment. The legal basis in each case is Art. 6(1)(b) GDPR. In this case, RatePay conducts an identity and credit check in its own name to determine creditworthiness in accordance with the principle already mentioned above and passes on your payment data to credit reporting agencies in accordance with Art. 6(1)(f) GDPR based on its legitimate interest in determining creditworthiness. A list of the credit reporting agencies that Ratepay may use can be found here: https://www.ratepay.com/legal-payment-creditagencies/
When using a local third-party payment method, your payment data is initially passed on to PayPal in accordance with Art. 6(1)(b) GDPR to prepare the payment. Depending on your selection of an available local payment method, PayPal then transmits your payment data to the respective provider in accordance with Art. 6(1)(b) GDPR to process the payment:
- Apple Pay (Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
- Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)
- iDEAL (Currence Holding BV, Beethovenstraat 300 Amsterdam, Netherlands)
- bancontact (Bancontact Payconiq Company, Rue d'Arlon 82, 1040 Brussels, Belgium)
- BLIK (Polski Standard Płatności sp. z o.o., ul. Czerniakowska 87A, 00-718 Warsaw, Poland)
- EPS (PSA Payment Services Austria GmbH, Handelskai 92, Gate 2
1200 Vienna, Austria)
- MyBank (PRETA S.A.S, 40 Rue de Courcelles, F-75008 Paris, France)
- Przelewy24 (PayPro SA, Kanclerska 15A, 60-326 Poznań, Poland)
For further data protection information, please refer to PayPal's privacy notice: https://www.paypal.com/de/legalhub/paypal/privacy-full
- Ratepay
One or more online payment methods from the following provider are available on this website: Ratepay GmbH, Ritterstr. 12-14, 10969 Berlin, Germany
When you select a payment method from the provider that requires you to pay in advance (e.g., credit card payment), your payment data provided during the ordering process (including name, address, bank and card details, currency, and transaction number), as well as information about the contents of your order, is passed on to them in accordance with Art. 6(1)(b) GDPR. In this case, your data is disclosed exclusively for the purpose of processing the payment with the provider and only to the extent that this is necessary.
When you select a payment method where the provider pays in advance (e.g., invoice, installment payment, or direct debit), you will also be asked to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, telephone number, and, if applicable, details of an alternative payment method) during the ordering process.
To protect our legitimate interest in determining the creditworthiness of our customers, we forward this data to the provider in accordance with Art. 6(1)(f) GDPR for the purpose of a credit check. Based on the personal data you provide and other data (such as the shopping cart, invoice amount, order history, and payment history), the provider checks whether the payment option you selected can be granted in view of payment and/or default risks.
In addition to the provider's internal criteria in accordance with Art. 6(1)(f) GDPR, identity and credit information from the following credit reporting agencies may also be included in the decision-making process during the application review:
see here https://www.ratepay.com/legal-payment-creditagencies/
The credit report may contain probability values (so-called score values). To the extent that score values are incorporated into the result of the credit report, they are based on a scientifically recognized mathematical-statistical method. Address data, among other things, but not exclusively, is used in the calculation of the score values.
You can object to this processing of your data at any time by sending us a message or by contacting the provider. However, the provider may still be entitled to process your personal data if this is necessary for the contractual processing of payments.
- Shopify Payments
One or more online payment methods from the following provider are available on this website: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland
When you select a payment method from the provider that requires you to pay in advance (e.g., credit card payment), your payment data provided during the ordering process (including name, address, bank and card details, currency, and transaction number), as well as information about the contents of your order, is passed on to them in accordance with Art. 6(1)(b) GDPR. In this case, your data is disclosed exclusively for the purpose of processing the payment with the provider and only to the extent that this is necessary.
- Sofortüberweisung
One or more online payment methods from the following provider are available on this website: Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden
When you select a payment method from the provider that requires you to pay in advance (e.g., credit card payment), your payment data provided during the ordering process (including name, address, bank and card details, currency, and transaction number), as well as information about the contents of your order, is passed on to them in accordance with Art. 6(1)(b) GDPR. In this case, your data is disclosed exclusively for the purpose of processing the payment with the provider and only to the extent that this is necessary.
7.4 Electronic withdrawal function for distance contracts
Consumers who enter into contracts on this website for which a statutory right of withdrawal exists have the option to declare their withdrawal via an electronic withdrawal function in accordance with the applicable withdrawal provisions.
To provide the electronic withdrawal function, we use a solution from the following provider: EU Widerruf Button.
When using the withdrawal function, in addition to details identifying the contract to be withdrawn, other personal information, such as the consumer's first and last name and email address, must also be provided or confirmed.
This information is initially collected by the provider based on our legitimate interest in a user-friendly, stable, and process-optimized solution in accordance with Art. 6(1)(f) GDPR, then used to confirm the submission of the withdrawal declaration in our name via email, and finally transmitted to us. We subsequently process the transmitted information for the proper processing of the withdrawal in accordance with Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR on the basis of our legal obligation to provide an electronic withdrawal function for paid consumer distance contracts.
The information collected by the provider is routinely deleted after the final processing of a withdrawal, unless there are statutory retention obligations to the contrary.
We have concluded a data processing agreement with the provider, which protects the data processed within the scope of the withdrawal function and prohibits unauthorized disclosure to third parties.
8) Web analytics services
Google Analytics 4
This website uses Google Analytics 4, a web analytics service from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which enables the analysis of your use of our website.
By default, Google Analytics 4 sets cookies when you visit the website. These cookies are stored as small text files on your device and collect certain information. This information also includes your IP address, although Google truncates the last digits to prevent direct identification of individuals.
The information is transmitted to Google servers and further processed there. This may also include transmissions to Google LLC, which is based in the United States.
Google uses the collected information on our behalf to evaluate your use of the website, compile reports on website activity for us, and provide other services related to website and internet use. The IP address transmitted and truncated by your browser within the scope of Google Analytics is not combined with other data from Google. The data collected during the use of Google Analytics 4 is stored for two months and then deleted.
All the processing described above, in particular the setting of cookies on the device you use, only takes place if you have given us your express consent in accordance with Art. 6(1)(a) GDPR.
Without your consent, Google Analytics 4 will not be used during your visit to the website. You can revoke your consent at any time with future effect. To exercise your right of withdrawal, please disable this service using the "Cookie Consent Tool" provided on the website.
We have concluded a data processing agreement with Google, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.
Further legal information about Google Analytics 4 can be found at https://business.safety.google/intl/de/privacy/, https://policies.google.com/privacy?hl=de&gl=de and at https://policies.google.com/technologies/partner-sites
Demographic features
Google Analytics 4 uses the special "demographic features" function and can create statistics that make statements about the age, gender, and interests of website visitors. This is done by analyzing advertising and information from third-party providers. This makes it possible to identify target groups for marketing activities. However, the collected data cannot be assigned to any specific person and is deleted after being stored for two months.
Google Signals
As an extension of Google Analytics 4, Google Signals can be used on this website to create cross-device reports. If you have enabled personalized ads and linked your devices to your Google account, Google can analyze your usage behavior across devices and create database models, including for cross-device conversions, subject to your consent to the use of Google Analytics in accordance with Art. 6(1)(a) GDPR. We do not receive any personal data from Google, only statistics. If you want to stop cross-device analysis, you can disable the "Personalized Advertising" function in your Google account settings. Follow the instructions on this page: https://support.google.com/My-Ad-Center-Help/answer/12155764?hl=de
Further information about Google Signals can be found at the following link: https://support.google.com/analytics/answer/7532985?hl=de
User IDs
As an extension of Google Analytics 4, the "User IDs" function can be used on this website. If you have consented to the use of Google Analytics 4 in accordance with Art. 6(1)(a) GDPR, have set up an account on this website, and are logged in with this account on different devices, your activities, including conversions, can be analyzed across devices.
Collection of user-provided data
To improve analysis results for users whose contact details we have received as part of business or business-like relationships, we use the "Collection of user-provided data" function.
Subject to your express consent in accordance with Art. 6(1)(a) GDPR, we transmit one or more files containing aggregated customer data related to you (primarily email address and telephone number) to Google electronically within the scope of this function. Google does not gain access to plain text data here, but automatically encrypts the information in the customer files during the transmission process using a special algorithm. Google can then only use the encrypted information to assign it to existing Google accounts set up by the data subjects.
The processing serves to refine measurement data, improves cross-device user tracking, and enables the integration of analysis results into Google Ads ad personalization and conversion tracking functions.
You can revoke your consent to us at any time with future effect. Further information about Google's data protection measures regarding the transmission of customer data can be found here: https://support.google.com/google-ads/answer/6334160?hl=de&ref_topic=10550182
For data transmissions to the United States, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.
9) Website functionalities
9.1 Facebook plugins
Plugins from the following social network provider are used on our website: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
These plugins enable direct interaction with content on the social network.
To increase the protection of your data when visiting our website, the plugins are initially disabled and embedded in the page using a so-called "2-click" or "Shariff" solution.
This embedding ensures that when a page on our website containing such plugins is accessed, no connection is yet established with the provider's servers.
Only when you activate the plugins and thereby give your consent to the data transmission in accordance with Art. 6(1)(a) GDPR does your browser establish a direct connection to the provider's servers. In this case, regardless of whether you are logged into an existing user profile, information about your device you are using (including your IP address), your browser, and your browsing history is transmitted to the provider to a certain extent and may be further processed there.
If you are logged into an existing user profile on the provider's social network, information about interactions carried out via the plugins will also be published there and displayed to your contacts.
You can revoke your consent at any time by deactivating the activated plugin by clicking it again. However, the revocation has no effect on the data that has already been transmitted to the provider.
Data may also be transmitted to: Meta Platforms Inc., USA
We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with European data protection standards based on an adequacy decision by the European Commission.
9.2 Instagram Plugins
Plugins from the following social network provider are used on our website: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
These plugins enable direct interaction with content on the social network.
To enhance the protection of your data when visiting our website, the plugins are initially disabled and embedded in the page using a so-called "2-click" or "Shariff" solution.
This implementation ensures that when you access a page on our website that contains such plugins, no connection is established with the provider's servers.
Only when you activate the plugins, thereby giving your consent to the data transfer in accordance with Art. 6(1)(a) GDPR, does your browser establish a direct connection to the provider's servers. In doing so, regardless of whether you are logged into an existing user profile, information about your device (including your IP address), your browser, and your browsing history is transmitted to the provider to a certain extent and may be further processed there.
If you are logged into an existing user profile on the provider's social network, information about interactions carried out via the plugins will also be published there and displayed to your contacts.
You can revoke your consent at any time by clicking the activated plugin again to deactivate it. However, the revocation has no effect on the data that has already been transferred to the provider.
Data may also be transferred to: Meta Platforms Inc., USA
We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with European data protection standards based on an adequacy decision by the European Commission.
9.3 Pinterest Plugins
Plugins from the following social network provider are used on our website: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland
These plugins enable direct interaction with content on the social network.
To enhance the protection of your data when visiting our website, the plugins are initially disabled and embedded in the page using a so-called "2-click" or "Shariff" solution.
This implementation ensures that when you access a page on our website that contains such plugins, no connection is established with the provider's servers.
Only when you activate the plugins, thereby giving your consent to the data transfer in accordance with Art. 6(1)(a) GDPR, does your browser establish a direct connection to the provider's servers. In doing so, regardless of whether you are logged into an existing user profile, information about your device (including your IP address), your browser, and your browsing history is transmitted to the provider to a certain extent and may be further processed there.
If you are logged into an existing user profile on the provider's social network, information about interactions carried out via the plugins will also be published there and displayed to your contacts.
You can revoke your consent at any time by clicking the activated plugin again to deactivate it. However, the revocation has no effect on the data that has already been transferred to the provider.
Data may also be transferred to: Pinterest Inc., USA
We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.
For the transfer of data to the USA, the provider relies on the European Commission's Standard Contractual Clauses, which are intended to ensure compliance with European data protection standards.
9.4 Address verification by Deutsche Post
To enable real-time checking of certain entries in the address form during our online shop's ordering process for input errors, we use the services of the following provider: Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn
The provider validates the entered address, verifies the spelling, and supplements any missing data if necessary. If the address is ambiguous, correct alternative suggestions are displayed. For this purpose, the address data you enter is transmitted to the provider, stored there, and evaluated.
This processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in properly capturing the customer's correct address data to fulfill our contractual delivery obligations conscientiously and to prevent problems with contract performance.
The provider processes the data concerned separately and does not combine it with other data sets, and deletes it as soon as its status or correctness has been confirmed, but no later than 30 days.
10) Tools and Other Services
Judge.me
To verify and publish customer reviews, we use the services of the following provider: Judge.me Ltd., c/o Buckworths, 2nd Floor, 1-3 Worship Street, London, England, EC2A 2AB, United Kingdom
If you submit a review on our website, your first and last name, email address, order date and number, as well as the product name and international references (GTIN/ISDNF), will be collected, transmitted to the provider, and evaluated there to determine whether a customer review is legitimate for a specific order. This processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in ensuring the authenticity of customer reviews by verifying that they are transaction-related and preventing review abuse. After the review has been checked and approved, the data will be deleted by the provider.
In the event of a data transfer to the provider's location, an adequate level of data protection is ensured by an adequacy decision by the European Commission.
11) Data Subject Rights
11.1 The applicable data protection law grants you the following data subject rights (rights of access and intervention) against the controller regarding the processing of your personal data, with reference to the respective requirements for exercising each right:
- Right of access in accordance with Art. 15 GDPR;
- Right to rectification in accordance with Art. 16 GDPR;
- Right to erasure in accordance with Art. 17 GDPR;
- Right to restriction of processing in accordance with Art. 18 GDPR;
- Right to notification in accordance with Art. 19 GDPR;
- Right to data portability in accordance with Art. 20 GDPR;
- Right to revoke given consent in accordance with Art. 7(3) GDPR;
- Right to lodge a complaint in accordance with Art. 77 GDPR.
11.2 RIGHT TO OBJECT
IF WE PROCESS YOUR PERSONAL DATA BASED ON OUR OVERRIDING LEGITIMATE INTERESTS AS PART OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPULSORY PROTECTIVE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS, AND FREEDOMS, OR IF THE PROCESSING IS NECESSARY FOR THE INSTITUTION, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.
IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING PURPOSES. YOU MAY EXERCISE THIS RIGHT OF OBJECTION AS DESCRIBED ABOVE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.
12) Duration of Storage of Personal Data
The duration for which personal data is stored is determined by the respective legal basis, the purpose of processing, and, where applicable, additionally by the respective statutory retention period (e.g., commercial and tax retention periods).
When personal data is processed on the basis of explicit consent in accordance with Art. 6(1)(a) GDPR, the data concerned will be stored until you revoke your consent.
If statutory retention periods exist for data processed in the context of legal or quasi-legal obligations on the basis of Art. 6(1)(b) GDPR, this data will be routinely deleted after the retention periods expire, provided it is no longer required for the fulfillment or initiation of the contract and/or we no longer have a legitimate interest in continuing to store it.
When personal data is processed on the basis of Art. 6(1)(f) GDPR, this data will be stored until you exercise your right to object under Art. 21(1) GDPR, unless we can demonstrate compelling protective grounds for the processing that override your interests, rights, and freedoms, or if the processing is necessary for the institution, exercise, or defense of legal claims.
When personal data is processed for direct marketing purposes on the basis of Art. 6(1)(f) GDPR, this data will be stored until you exercise your right to object under Art. 21(2) GDPR.
Unless otherwise stated in the other information in this notice regarding specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.