Privacybeleid

1) Introduction and Contact Details of the Controller

1.1 We are delighted that you are visiting our website and thank you for your interest. This privacy policy explains how we handle your personal data when you use our website. Personal data refers to any information that can be used to identify you personally.

1.2 The controller responsible for data processing on this website, within the meaning of the General Data Protection Regulation (GDPR), is Arando OHG, Mühlenkamp 38, 28844 Weyhe, Germany, Tel.: 04218984628, Email: info@arando-online.de. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

2) Data Collection When Visiting Our Website

2.1 When you use our website for informational purposes only, i.e., without registering or otherwise providing us with information, we collect only the data that your browser transmits to our server (so-called “server log files”). When you visit our website, we collect the following data, which is technically necessary to display the website to you:

Our visited website
Date and time of access
Amount of data sent in bytes
Source/referral from which you accessed the page
Browser used
Operating system used
IP address used (if applicable, in anonymised form)

Processing is carried out pursuant to Article 6(1)(f) GDPR based on our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to check the server log files retrospectively if there are specific indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string “https://” and the lock icon in your browser’s address bar.

3) Hosting & Content Delivery Network

3.1 Shopify

We use the system of the following provider for hosting our website and displaying its content: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”).

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.

All data collected on our website is processed on the provider’s servers. We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

3.2 Cloudflare

We use a Content Delivery Network provided by: Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA.

This service enables us to deliver large media files, such as graphics, page content, or scripts, more quickly via a network of regionally distributed servers. Processing is carried out pursuant to Article 6(1)(f) GDPR based on our legitimate interest in improving the stability and functionality of our website. We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with European data protection standards based on an adequacy decision by the European Commission.

3.3 imgix

We use a Content Delivery Network provided by: Zebrafish Labs Inc., 423 Tehama St., San Francisco, CA 94103, USA.

4) Cookies

To make visiting our website attractive and to enable the use of certain functions, we use cookies, which are small text files stored on your device. Some of these cookies are automatically deleted after you close your browser (so-called “session cookies”), while others remain on your device for a longer period to save page settings (so-called “persistent cookies”). In the latter case, you can find the storage duration in your web browser’s cookie settings overview.

If personal data is processed by individual cookies we use, the processing is carried out pursuant to Article 6(1)(b) GDPR for the performance of a contract, Article 6(1)(a) GDPR in case of consent, or Article 6(1)(f) GDPR to safeguard our legitimate interests in providing the best possible website functionality and a customer-friendly and effective design of the website visit.

You can configure your browser to inform you about the setting of cookies and decide on their acceptance individually or to exclude the acceptance of cookies for specific cases or entirely.

Please note that if you do not accept cookies, the functionality of our website may be restricted.

5) Contacting Us

5.1 Judge.me

For review reminders, we use the services of the following provider: Judge.me Ltd., c/o Buckworths, 2nd Floor, 1-3 Worship Street, London, England, EC2A 2AB, United Kingdom.

Based solely on your explicit consent pursuant to Article 6(1)(a) GDPR, we transfer your email address and, if applicable, other customer data to the provider so that they can contact you with a review reminder by email.

You can withdraw your consent at any time with effect for the future by contacting us or the provider.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

For data transfers to the provider’s location, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

5.2 When you contact us (e.g., via contact form or email), personal data is processed solely for the purpose of processing and responding to your request and only to the extent necessary.

The legal basis for processing this data is our legitimate interest in responding to your request pursuant to Article 6(1)(f) GDPR. If your contact aims at concluding a contract, an additional legal basis for processing is Article 6(1)(b) GDPR. Your data will be deleted once it is clear from the circumstances that the matter has been conclusively resolved, provided no statutory retention obligations apply.

6) Data Processing for Opening a Customer Account

Pursuant to Article 6(1)(b) GDPR, personal data will continue to be collected and processed to the extent necessary when you provide it to us when opening a customer account. The required data for opening an account can be found in the input form on our website.

You can delete your customer account at any time by sending a message to the controller’s address mentioned above. After deletion of your customer account, your data will be deleted, provided all contracts concluded via the account have been fully processed, no statutory retention periods apply, and we have no legitimate interest in further storage.

7) Use of Customer Data for Direct Marketing

7.1 Subscription to Our Email Newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information for sending the newsletter is your email address. Providing additional data is voluntary and used to address you personally. We use the so-called double opt-in procedure for sending the newsletter, ensuring that you only receive the newsletter after explicitly confirming your consent by activating a verification link sent to the provided email address.

By activating the verification link, you give us your consent to use your personal data pursuant to Article 6(1)(a) GDPR. We store your IP address, as entered by your Internet Service Provider (ISP), as well as the date and time of registration to trace any potential misuse of your email address at a later date. The data collected during newsletter registration is used strictly for its intended purpose.

You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending a message to the controller mentioned above. After unsubscribing, your email address will be immediately removed from our newsletter distribution list, unless you have explicitly consented to further use of your data or we reserve the right to use data beyond this, as permitted by law and about which we inform you in this policy.

7.2 Klaviyo

Our email newsletters are sent via this provider: Klaviyo, Inc., 125 Summer St., Ste 600, Boston, MA 02110, USA.

Based on our legitimate interest in effective and user-friendly newsletter marketing, we share the data you provided during newsletter registration with this provider pursuant to Article 6(1)(f) GDPR so that they can handle the newsletter dispatch on our behalf.

Subject to your explicit consent pursuant to Article 6(1)(a) GDPR, the provider also conducts a statistical evaluation of newsletter campaigns using web beacons or tracking pixels in the sent emails, which can measure open rates and specific interactions with newsletter content. Device information (e.g., time of access, IP address, browser type, and operating system) is also collected and evaluated but not merged with other data sets.

You can withdraw your consent to newsletter tracking at any time with effect for the future.

We have concluded a data processing agreement with the provider, which protects our website visitors’ data and prohibits disclosure to third parties.

7.3 Cart Abandonment Reminders via Email

If you abandon your purchase with us before completing the order, you have the option to receive a one-time email reminder about the contents of your virtual shopping cart.

The only mandatory information for sending this reminder is your email address. Providing additional data is voluntary and may be used to address you personally. We use the double opt-in procedure for sending the email, ensuring that you only receive a notification after explicitly confirming your consent by activating a verification link sent to the provided email address.

By activating the verification link, you give us your consent to use your personal data pursuant to Article 6(1)(a) GDPR for sending a cart abandonment reminder. We store your IP address, as entered by your Internet Service Provider (ISP), as well as the date and time of registration to trace any potential misuse of your email address at a later date. The data collected during registration for our email notification service is used strictly for its intended purpose.

You can unsubscribe from cart abandonment reminders at any time by sending a message to the controller mentioned above. After unsubscribing, your email address will be immediately removed from our dedicated distribution list, unless you have explicitly consented to further use of your data or we reserve the right to use data beyond this, as permitted by law and about which we inform you in this policy.

8) Data Processing for Order Processing

8.1 To the extent necessary for contract processing for delivery and payment purposes, the personal data we collect is shared with the commissioned transport company and credit institution pursuant to Article 6(1)(b) GDPR.

If we owe you updates for goods with digital elements or digital products based on a corresponding contract, we process the contact data you provided during the order to inform you personally about upcoming updates within the legally stipulated period pursuant to Article 6(1)(c) GDPR. Your contact data is used strictly for notifications about updates we owe and processed only to the extent necessary for the respective information.

To process your order, we also work with the following service provider(s), who support us wholly or partially in executing concluded contracts. Certain personal data is shared with these service providers in accordance with the following information.

8.2 Sharing Personal Data with Shipping Service Providers

- Deutsche Post

We use the following transport service provider: Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany.

We share your email address and/or phone number with the provider pursuant to Article 6(1)(a) GDPR before the delivery of goods for the purpose of coordinating a delivery date or announcing delivery, provided you have given your explicit consent during the ordering process. Otherwise, we only share the recipient’s name and delivery address with the provider for delivery purposes pursuant to Article 6(1)(b) GDPR. The sharing occurs only to the extent necessary for the delivery of goods. In this case, prior coordination of the delivery date with the provider or delivery announcement is not possible.

You can withdraw your consent at any time with effect for the future by contacting the controller mentioned above or the provider.

- DHL

We use the following transport service provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany.

You can withdraw your consent at any time with effect for the future by contacting the controller mentioned above or the provider.

8.3 Use of Payment Service Providers

- Apple Pay

If you choose the “Apple Pay” payment method of Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment processing is carried out via the “Apple Pay” function of your device running iOS, watchOS, or macOS by charging a payment card stored in “Apple Pay”. Apple Pay uses security features integrated into your device’s hardware and software to protect your transactions. To authorise a payment, you must enter a previously defined code and verify it using the “Face ID” or “Touch ID” function of your device.

For payment processing purposes, the information you provide during the ordering process, along with information about your order, is shared with Apple in encrypted form. Apple then re-encrypts this data with a developer-specific key before transmitting it to the payment service provider of the payment card stored in Apple Pay to execute the payment. Encryption ensures that only the website where the purchase was made can access the payment data. After the payment is made, Apple sends your device account number and a transaction-specific dynamic security code to the originating website to confirm the payment’s success.

If personal data is processed during the described transfers, the processing is carried out exclusively for payment processing pursuant to Article 6(1)(b) GDPR.

Apple retains anonymised transaction data, including the approximate purchase amount, approximate date and time, and whether the transaction was successfully completed. Anonymisation completely excludes any personal reference. Apple uses the anonymised data to improve “Apple Pay” and other Apple products and services.

When you use Apple Pay on an iPhone or Apple Watch to complete a purchase made via Safari on a Mac, the Mac and the authorising device communicate over an encrypted channel on Apple’s servers. Apple does not process or store this information in a format that can identify you. You can disable the ability to use Apple Pay on your Mac in your iPhone settings. Go to “Wallet & Apple Pay” and disable “Allow Payments on Mac”.

Further information on data protection with Apple Pay can be found at: https://support.apple.com/en-gb/HT203027.

- BLIK

One or more online payment methods are available on this website from the following provider: Polski Standard Płatności Sp. z o.o., Czerniakowska 87a, 00-718 Warsaw, Poland.

To process your payment, the payment data provided during the ordering process (including name, address, bank and payment card information, currency, and transaction number) and information about the content of your order are shared with the provider pursuant to Article 6(1)(b) GDPR. The sharing of your data is carried out exclusively for payment processing with the provider and only to the extent necessary.

- EPS Transfer

One or more online payment methods are available on this website from the following provider: PSA Payment Services Austria GmbH, Handelskai 92, Gate 2, 1200 Vienna, Austria.

If you select a payment method from the provider where you pay in advance (e.g., credit card payment), the payment data you provided during the ordering process (including name, address, bank and payment card information, currency, and transaction number) and information about the content of your order are shared with the provider pursuant to Article 6(1)(b) GDPR. The sharing of your data is carried out exclusively for payment processing with the provider and only to the extent necessary.

- Google Pay

If you choose the “Google Pay” payment method of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), payment processing is carried out via the “Google Pay” application on your mobile device running at least Android 4.4 (“KitKat”) with NFC functionality by charging a payment card stored in Google Pay or a payment system verified there (e.g., PayPal). For payments over €25 via Google Pay, you must first unlock your mobile device using the configured verification measure (e.g., facial recognition, password, fingerprint, or pattern).

For payment processing purposes, the information you provide during the ordering process, along with information about your order, is shared with Google. Google then transmits your payment information stored in Google Pay in the form of a unique transaction number to the originating website to verify a completed payment. This transaction number contains no information about the actual payment data of your payment methods stored in Google Pay but is created and transmitted as a one-time valid numeric token. For all transactions via Google Pay, Google acts solely as an intermediary for payment processing. The transaction is executed exclusively between the user and the originating website by charging the payment method stored in Google Pay.

If personal data is processed during the described transfers, the processing is carried out exclusively for payment processing pursuant to Article 6(1)(b) GDPR.

Google reserves the right to collect, store, and evaluate certain transaction-specific information for each transaction made via Google Pay. This includes the date, time, and amount of the transaction, merchant location and description, a description provided by the merchant of the purchased goods or services, photos you attached to the transaction, the name and email address of the seller and buyer or sender and recipient, the payment method used, your description of the transaction’s purpose, and, if applicable, the offer associated with the transaction.

According to Google, this processing is carried out exclusively pursuant to Article 6(1)(f) GDPR based on the legitimate interest in proper accounting, verification of transaction data, and optimisation and maintenance of the Google Pay service.

Google also reserves the right to merge the processed transaction data with other information collected and stored by Google when using other Google services.

The terms of use for Google Pay can be found here: https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=en.

Further information on data protection with Google Pay can be found at: https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en.

- iDeal

One or more online payment methods are available on this website from the following provider: Currence Holding BV, Beethovenstraat 300, Amsterdam, Netherlands.

- Klarna

One or more online payment methods are available on this website from the following provider: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden.

If you select a payment method where the provider pays in advance (e.g., invoice or instalment purchase or direct debit), you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postcode, city, date of birth, email address, phone number, and, if applicable, data on an alternative payment method).

To safeguard our legitimate interest in determining our customers’ creditworthiness, we share this data with the provider for a credit check pursuant to Article 6(1)(f) GDPR. The provider checks, based on the personal data you provided and other data (e.g., shopping cart, invoice amount, order history, payment experiences), whether the selected payment option can be granted with regard to payment and/or default risks.

For decisions in the context of the application review, identity and creditworthiness information from the following credit agencies may also be included, in addition to provider-internal criteria, pursuant to Article 6(1)(f) GDPR: https://cdn.klarna.com/1.0/shared/content/legal/terms/0/en/credit_rating_agencies.

The credit report may contain probability values (so-called score values). If score values are included in the credit report’s result, they are based on a scientifically recognised mathematical-statistical method. Address data, among other things, but not exclusively, is included in the calculation of score values.

You can object to this processing of your data at any time by sending a message to us or the provider. However, the provider may still be entitled to process your personal data if this is necessary for contractual payment processing.

- PayPal

One or more online payment methods are available on this website from the following provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

If you select a payment method from the provider where you pay in advance, the payment data you provided during the ordering process (including name, address, bank and payment card information, currency, and transaction number) and information about the content of your order are shared with the provider pursuant to Article 6(1)(b) GDPR. The sharing of your data is carried out exclusively for payment processing with the provider and only to the extent necessary.

If you select a payment method where we pay in advance, you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postcode, city, date of birth, email address, phone number, and, if applicable, data on an alternative payment method).

To safeguard our legitimate interest in determining your creditworthiness in such cases, we share this data with the provider for a credit check pursuant to Article 6(1)(f) GDPR. The provider checks, based on the personal data you provided and other data (e.g., shopping cart, invoice amount, order history, payment experiences), whether the selected payment option can be granted with regard to payment and/or default risks.

- Shopify Payments

One or more online payment methods are available on this website from the following provider: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

9) Web Analytics Services

9.1 Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), which enables analysis of your use of our website.

By default, Google Analytics 4 sets cookies when you visit the website, which are stored as small text files on your device and collect certain information. This information includes your IP address, which is shortened by Google to exclude direct personal identification.

The information is transferred to Google’s servers and processed there. Transfers to Google LLC, based in the USA, are also possible.

Google uses the collected information on our behalf to evaluate your use of the website, compile reports on website activities for us, and provide other services related to website and internet use. The shortened IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. The data collected as part of Google Analytics 4 is stored for two months and then deleted.

All processing described above, particularly the setting of cookies on the device used, is carried out only if you have given us your explicit consent pursuant to Article 6(1)(a) GDPR.

Without your consent, Google Analytics 4 will not be used during your visit to the website. You can withdraw your consent at any time with effect for the future. To exercise your right of withdrawal, please deactivate this service via the “Cookie Consent Tool” provided on the website.

We have concluded a data processing agreement with Google, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

Further legal information on Google Analytics 4 can be found at: https://business.safety.google/intl/en/privacy/, https://policies.google.com/privacy?hl=en&gl=nl, and https://policies.google.com/technologies/partner-sites.

Demographic Characteristics

Google Analytics 4 uses the special “demographic characteristics” function to create statistics about the age, gender, and interests of website visitors. This is done through the analysis of advertising and third-party information. This enables the identification of target groups for marketing activities. However, the collected data cannot be attributed to a specific person and is deleted after being stored for two months.

Google Signals

As an extension to Google Analytics 4, this website may use Google Signals to generate cross-device reports. If you have enabled personalised ads and linked your devices to your Google account, Google may, subject to your consent to the use of Google Analytics pursuant to Article 6(1)(a) GDPR, analyse your usage behaviour across devices and create database models, including for cross-device conversions. We do not receive personal data from Google, only statistics. If you wish to stop cross-device analysis, you can disable the “Personalised Ads” function in your Google account settings. Follow the instructions here: https://support.google.com/ads/answer/2662922?hl=en. Further information on Google Signals can be found at: https://support.google.com/analytics/answer/7532985?hl=en.

UserIDs

As an extension to Google Analytics 4, this website may use the “UserIDs” function. If you have consented to the use of Google Analytics 4 pursuant to Article 6(1)(a) GDPR, created an account on this website, and log in to this account on different devices, your activities, including conversions, can be analysed across devices.

9.2 Google Tag Manager

This website uses the “Google Tag Manager,” a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

The Google Tag Manager provides a technical foundation for bundling various web applications, including tracking and analytics services, and calibrating, controlling, and linking them to conditions via a unified user interface. The Google Tag Manager itself does not store or read information on user devices or conduct independent data analyses. However, when the website is accessed, your IP address is transmitted to Google and may be stored there. Transfers to servers of Google LLC in the USA are also possible.

This processing is carried out only if you have given us your explicit consent pursuant to Article 6(1)(a) GDPR. Without this consent, the Google Tag Manager will not be used during your visit to the website. You can withdraw your consent at any time with effect for the future. To exercise your withdrawal, please deactivate this service in the “Cookie Consent Tool” provided on the website.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

Further legal information on Google Tag Manager can be found at: https://business.safety.google/intl/en/privacy/ and https://policies.google.com/privacy?hl=en&gl=nl.

9.3 Microsoft Clarity

This website uses the web analytics service provided by: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

Using cookies and/or comparable technologies (tracking pixels, web beacons, algorithms for reading device and browser information), the service collects and stores pseudonymised visitor data, including information about the device used, such as the IP address and browser information, to evaluate it for statistical analyses of user behaviour on our website and create pseudonymised user profiles. This enables, among other things, the evaluation of movement patterns (so-called heatmaps), which show the duration of page visits and interactions with page content (e.g., text entries, scrolling, clicks, and mouse-overs). Pseudonymisation generally excludes direct personal identification. No merging with clear data about your person collected in other ways takes place.

All processing described above, particularly the reading or storage of information on the device used, is carried out only if you have given us your explicit consent pursuant to Article 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service in the “Cookie Consent Tool” provided on the website.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

9.4 Triple Whale Analytics

This website uses the web analytics service provided by: Triple Whale Inc., 7th Floor, Jaffa St 224, Jerusalem, Israel.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

For data transfers to the provider’s location, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

10) Retargeting/Remarketing and Conversion Tracking

10.1 Meta Pixel with Enhanced Data Matching

Within our online offering, we use the “Meta Pixel” service in enhanced data matching mode provided by: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Meta”).

When a user clicks on an advertisement we place on Facebook or Instagram, the URL of our linked page is extended by a parameter using the “Meta Pixel.” This URL parameter is then stored in the user’s browser via a cookie set by our linked page after redirection. Additionally, this cookie collects specific customer data, such as the email address, which we collect on our website linked to the Facebook or Instagram ad during actions such as purchase completions, account logins, or registrations (enhanced data matching). The cookie is then read, enabling the transmission of data, including specific customer data, to Meta.

We use the “Meta Pixel” with enhanced data matching to make our advertisements (so-called “Ads”) on Facebook and/or Instagram more effective and to ensure they align with users’ interests or have specific characteristics (e.g., interests in certain topics or products determined based on visited websites), which we transmit to Meta (so-called “Custom Audiences”).

Furthermore, we analyse the effectiveness of our advertisements by tracking whether users were redirected to our website after clicking an advertisement (conversion). Compared to the standard version of the “Meta Pixel,” the enhanced data matching function helps us better measure the effectiveness of our advertising campaigns by capturing more attributed conversions.

All transmitted data is stored and processed by Meta, enabling association with the respective user profile, and Meta may use the data for its own advertising purposes in accordance with Meta’s data usage guidelines (https://www.facebook.com/about/privacy/). The data may enable Meta and its partners to place advertisements on and off Facebook.

All processing described above, particularly the setting of cookies to read information on the device used, is carried out only if you have given us your explicit consent pursuant to Article 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service in the “Cookie Consent Tool” provided on the website.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

The information generated by Meta is usually transferred to a Meta server and stored there; this may also involve transmission to servers of Meta Platforms Inc. in the USA.

10.2 Google Ads Remarketing

This website uses retargeting technology provided by: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

For this purpose, Google sets a cookie in your device’s browser, which automatically enables interest-based advertising using a pseudonymous cookie ID and based on the pages you visit. Further data processing occurs only if you have consented to Google linking your internet and app browsing history with your Google account and using information from your Google account to personalise ads you view on the web. If you are logged into Google during your visit to our website in this case, Google uses your data together with Google Analytics data to create and define target group lists for cross-device remarketing. To this end, Google temporarily links your personal data with Google Analytics data to form target groups. As part of the use of Google Ads Remarketing, personal data may also be transmitted to the servers of Google LLC in the USA.

All processing described above, particularly the setting of cookies to read information on the device used, is carried out only if you have given us your explicit consent pursuant to Article 6(1)(a) GDPR. Without this consent, retargeting technology will not be used during your visit to the website.

You can withdraw your consent at any time with effect for the future. To exercise your withdrawal, please deactivate this service in the “Cookie Consent Tool” provided on the website.

Details on the processing initiated by Google and Google’s handling of website data can be found here: https://policies.google.com/technologies/partner-sites.

Further information on Google’s data protection policies can be found here: https://business.safety.google/intl/en/privacy/ and https://www.google.com/policies/privacy/.

10.3 Outbrain

This website uses retargeting technology provided by: Outbrain Inc., 39 W 13th Street, New York, NY 10011, USA.

This enables us to target visitors to our website with personalised, interest-based advertising if they have already shown interest in our shop and products. The display of advertising material is based on a cookie-based analysis of previous and current usage behaviour, but no personal data is stored. In the case of retargeting technology, a cookie is stored on your computer or mobile device to collect pseudonymised data about your interests and thus tailor advertising individually to the stored information. These cookies are small text files stored on your computer or mobile device. You are shown advertising that is highly likely to match your product and information interests.

All processing described above, particularly the setting of cookies to read information on the device used, is carried out only if you have given us your explicit consent pursuant to Article 6(1)(a) GDPR. Without this consent, retargeting technology will not be used during your visit to the website.

You can withdraw your consent at any time with effect for the future. To exercise your withdrawal, please deactivate this service in the “Cookie Consent Tool” provided on the website.

For data transfers to the USA, the provider relies on standard contractual clauses of the European Commission, which are intended to ensure compliance with European data protection standards.

10.4 Taboola

This website uses retargeting technology provided by: Taboola Inc., 16 Madison Square West 7th Floor, New York, NY 10010, USA.

All processing described above, particularly the setting of cookies to read information on the device used, is carried out only if you have given us your explicit consent pursuant to Article 6(1)(a) GDPR. Without this consent, retargeting technology will not be used during your visit to the website.

You can withdraw your consent at any time with effect for the future. To exercise your withdrawal, please deactivate this service in the “Cookie Consent Tool” provided on the website.

For data transfers to the USA, the provider relies on standard contractual clauses of the European Commission, which are intended to ensure compliance with European data protection standards.

10.5 Google Ads Conversion Tracking

This website uses the online advertising programme “Google Ads” and, within the framework of Google Ads, the conversion tracking of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).

We use Google Ads to draw attention to our attractive offers on external websites with the help of advertising materials (so-called Google AdWords). We can determine how successful individual advertising measures are in relation to the data of the advertising campaigns. Our aim is to show you advertising that is of interest to you, make our website more interesting for you, and achieve a fair calculation of the advertising costs incurred.

The conversion tracking cookie is set when a user clicks on an Ads advertisement placed by Google. Cookies are small text files stored on your device. These cookies usually expire after 30 days and are not used for personal identification. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognise that the user clicked on the advertisement and was redirected to this page. Each Google Ads customer receives a different cookie. Cookies cannot be tracked across the websites of Google Ads customers. The information obtained using the conversion cookie is used to create conversion statistics for Google Ads customers who have opted for conversion tracking. Customers learn the total number of users who clicked on their advertisement and were redirected to a page tagged with a conversion tracking tag. However, they do not receive information that can personally identify users.

As part of the use of Google Ads, personal data may also be transmitted to the servers of Google LLC in the USA.

Details on the processing initiated by Google Ads Conversion Tracking and Google’s handling of website data can be found here: https://policies.google.com/technologies/partner-sites.

You can also permanently object to the setting of cookies by Google Ads Conversion Tracking by downloading and installing the Google browser plug-in available at the following link: https://www.google.com/settings/ads/plugin?hl=en.

To address users whose data we have received in the context of business or business-like relationships in a more interest-based manner, we use a customer matching function within Google Ads. To this end, we transmit one or more files with aggregated customer data (primarily email addresses and phone numbers) electronically to Google. Google does not have access to clear data but automatically encrypts the information in the customer files during the transmission process using a special algorithm. The encrypted information can then only be used by Google to associate it with existing Google accounts that the individuals have set up. This enables the display of personalised advertising via all Google services linked to the respective Google account.

The transmission of customer data to Google is carried out only if you have given us your explicit consent pursuant to Article 6(1)(a) GDPR. You can withdraw this consent at any time with effect for the future. Further information on Google’s data protection measures regarding the customer matching function can be found here: https://support.google.com/google-ads/answer/6334160?hl=en&ref_topic=10550182.

Google’s data protection policies can be viewed here: https://business.safety.google/intl/en/privacy/ and https://www.google.com/policies/privacy/.

10.6 Outbrain Pixel

This website uses conversion tracking technology provided by: Outbrain, Inc., 39 W 13th St, New York 10011, USA.

If you have reached our website via an advertisement on the provider’s domain, the success of the advertisement can be tracked using cookies and/or comparable technologies (tracking pixels, web beacons, pings, or HTTP requests).

For this purpose, certain device and browser information, possibly including your IP address, is read via the tracking technology to record and evaluate predefined user actions (e.g., completed transactions, leads, search queries on the website, product page views). This enables the creation of statistics on user behaviour on our website after redirection from an advertisement, which we use to optimise our offering.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider relies on standard contractual clauses of the European Commission, which are intended to ensure compliance with European data protection standards.

10.7 Taboola Pixel

This website uses conversion tracking technology provided by: Taboola Inc., 16 Madison Square West 7th Floor, New York, NY 10010, USA.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

10.8 TikTok Pixel

This website uses conversion tracking technology provided by: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

11) Website Functionalities

11.1 YouTube

This website uses plugins to display and play videos from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

Data may also be transmitted to: Google LLC, USA.

When you visit a page on our website that contains such a plugin, your browser establishes a direct connection to the provider’s servers to load the plugin. Certain information, including your IP address, is transmitted to the provider during this process.

If the playback of embedded videos is started via the plugin, the provider also uses cookies to collect information about user behaviour, create playback statistics, and prevent abusive behaviour.

If you are logged into a user account with the provider during your visit to the website, your data is directly associated with your account when you click on a video. If you do not wish this association with your account, you must log out before activating the playback button.

All processing described above, particularly the setting of cookies to read information on the device used, is carried out only if you have given us your explicit consent pursuant to Article 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service via the “Cookie Consent Tool” provided on the website.

11.2 hCaptcha

This website uses the CAPTCHA service provided by: Intuition Machines, Inc., 350 Alabama St, San Francisco, CA 94110, USA.

The service checks whether an input is made by a natural person or abusively by automated processing and blocks spam, DDoS attacks, and similar automated malicious access. To ensure that an action is performed by a human and not an automated bot, the provider collects the IP address of the device used, identification data of the browser and operating system type used, and the date and duration of the visit, and transmits this to the provider’s servers for evaluation.

The legal basis is our legitimate interest in establishing individual responsibility on the internet and preventing abuse and spam pursuant to Article 6(1)(f) GDPR.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider relies on standard contractual clauses of the European Commission, which are intended to ensure compliance with European data protection standards.

12) Tools and Miscellaneous

Cookie Consent Tool

This website uses a so-called “Cookie Consent Tool” to obtain effective user consent for cookies and cookie-based applications requiring consent. The “Cookie Consent Tool” is displayed to users when they access the website in the form of an interactive user interface, on which consents for specific cookies and/or cookie-based applications can be given by ticking boxes. By using the tool, all cookies/services requiring consent are loaded only if the respective user gives corresponding consents by ticking boxes. This ensures that such cookies are only set on the user’s device if consent has been given.

The tool sets technically necessary cookies to store your cookie preferences. Personal user data is generally not processed in this context.

If, in individual cases, personal data (such as the IP address) is processed for the purpose of storing, assigning, or logging cookie settings, this is done pursuant to Article 6(1)(f) GDPR based on our legitimate interest in legally compliant, user-specific, and user-friendly consent management for cookies and, consequently, a legally compliant design of our website.

A further legal basis for processing is Article 6(1)(c) GDPR. As the controller, we are subject to the legal obligation to make the use of technically unnecessary cookies dependent on the respective user’s consent.

Where necessary, we have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

Further information about the operator and the settings options of the Cookie Consent Tool can be found directly in the corresponding user interface on our website.

13) Data Subject Rights

13.1 The applicable data protection law grants you the following data subject rights (rights to information and intervention) vis-à-vis the controller with regard to the processing of your personal data, with reference to the stated legal basis for the respective exercise conditions:

Right to information pursuant to Article 15 GDPR;
Right to rectification pursuant to Article 16 GDPR;
Right to erasure pursuant to Article 17 GDPR;
Right to restriction of processing pursuant to Article 18 GDPR;
Right to be informed pursuant to Article 19 GDPR;
Right to data portability pursuant to Article 20 GDPR;
Right to withdraw consent given pursuant to Article 7(3) GDPR;
Right to lodge a complaint pursuant to Article 77 GDPR.

13.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA BASED ON OUR OVERRIDING LEGITIMATE INTEREST IN THE CONTEXT OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS, AND FREEDOMS, OR IF THE PROCESSING SERVES THE ASSERTION, EXERCISE, OR DEFENCE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

14) Duration of Storage of Personal Data

The duration of the storage of personal data is determined based on the respective legal basis, the purpose of processing, and, where relevant, the respective statutory retention period (e.g., commercial and tax retention periods).

When processing personal data based on explicit consent pursuant to Article 6(1)(a) GDPR, the data concerned is stored until you withdraw your consent.

If statutory retention periods exist for data processed within the framework of legal or quasi-legal obligations based on Article 6(1)(b) GDPR, this data is routinely deleted after the retention periods expire, provided it is no longer required for contract fulfilment or contract initiation and/or we have no legitimate interest in further storage.

When processing personal data based on Article 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Article 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights, and freedoms, or the processing serves the assertion, exercise, or defence of legal claims.

When processing personal data for direct marketing purposes based on Article 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Article 21(2) GDPR.

Unless otherwise stated in the other information in this policy about specific processing situations, stored personal data is otherwise deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.