Privacy Policy

1) Introduction and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we provide information about how your personal data are handled when you use our website. Personal data are any data with which you can be personally identified.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Lenabo GmbH, Am Hauptbahnhof 6, 53111 Bonn, Germany, Tel.: 0228 902 44 787, email: info@lenabo.com. The controller responsible for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

2) Data Collection When Visiting Our Website

2.1 If you use our website for information purposes only, meaning that you do not register or otherwise provide us with information, we collect only the data that your browser transmits to the website server, known as “server log files”. When you access our website, we collect the following data, which are technically necessary for us to display the website to you:

• The website visited
• Date and time of access
• Amount of data sent in bytes
• Source/referrer from which you reached the page
• Browser used
• Operating system used
• IP address used, where applicable in anonymised form

Processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data are not disclosed or used in any other way. However, we reserve the right to review the server log files retrospectively should specific indications point to unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content, such as orders or enquiries sent to the controller, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the character string “https://” and the padlock symbol in your browser bar.

3) Hosting & Content Delivery Network

3.1 Shopify

For hosting our website and displaying the page content, we use the system of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”)

Data are also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada

All data collected on our website are processed on the provider’s servers. We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

Where data are transferred to Canada, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

3.2 Shopify

We use a content delivery network provided by the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”)

Data may also be transferred to:

• Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada
• Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA

This service enables us to deliver large media files, such as graphics, page content or scripts, more quickly via a network of regionally distributed servers. Processing is carried out to protect our legitimate interest in improving the stability and functionality of our website in accordance with Art. 6 para. 1 lit. f GDPR. We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

Where data are transferred to Canada, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

For data transfers to the USA, the data recipient participates in the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

4) Cookies

To make visiting our website attractive and to enable the use of certain functions, we use cookies, which are small text files stored on your device. Some of these cookies are automatically deleted when the browser is closed, known as “session cookies”, while others remain on your device for longer and enable page settings to be saved, known as “persistent cookies”. In the latter case, you can find the storage duration in the overview of your web browser’s cookie settings.

Where personal data are also processed by individual cookies used by us, processing is carried out in accordance with Art. 6 para. 1 lit. b GDPR either for the performance of the contract, in accordance with Art. 6 para. 1 lit. a GDPR where consent has been granted, or in accordance with Art. 6 para. 1 lit. f GDPR to protect our legitimate interests in ensuring the best possible functionality of the website and a customer-friendly and effective website visit.

You can configure your browser so that you are informed when cookies are set and can decide individually whether to accept them, or so that the acceptance of cookies is excluded in certain cases or generally.

Please note that the functionality of our website may be restricted if cookies are not accepted.

5) Contacting Us

When you contact us, for example via a contact form or email, personal data are processed solely for the purpose of handling and responding to your enquiry and only to the extent necessary for this purpose.

The legal basis for processing these data is our legitimate interest in responding to your enquiry in accordance with Art. 6 para. 1 lit. f GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 para. 1 lit. b GDPR. Your data will be deleted when the circumstances indicate that the matter concerned has been conclusively clarified, provided that no statutory retention obligations prevent deletion.

6) Data Processing When Opening a Customer Account

In accordance with Art. 6 para. 1 lit. b GDPR, personal data will continue to be collected and processed to the extent necessary if you provide them to us when opening a customer account. The data required to open the account can be found in the input fields of the relevant form on our website.

You can delete your customer account at any time by sending a message to the controller at the address stated above. After your customer account has been deleted, your data will be deleted provided that all contracts concluded through the account have been fully completed, no statutory retention periods prevent deletion and we have no continuing legitimate interest in retaining the data.

7) Use of Customer Data for Direct Advertising

7.1 Subscription to Our Email Newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information required for sending the newsletter is your email address. Providing any further data is voluntary and is used to address you personally. We use the double opt-in procedure for sending the newsletter, which ensures that you receive newsletters only after you have expressly confirmed your consent to receive the newsletter by activating a verification link sent to the email address provided.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Art. 6 para. 1 lit. a GDPR. In this context, we store the IP address registered by your Internet Service Provider (ISP), as well as the date and time of registration, so that any possible misuse of your email address can be traced at a later date. The data collected by us when you subscribe to the newsletter are used strictly for the intended purpose.

You can unsubscribe from the newsletter at any time using the link provided in the newsletter or by sending an appropriate message to the controller named at the beginning. Once you have unsubscribed, your email address will be immediately deleted from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to use the data further in a manner permitted by law and about which we inform you in this policy.

7.2 Shopping Basket Reminders by Email

If you abandon a purchase with us before completing the order, you have the option of receiving a one-off email reminder about the contents of your virtual shopping basket.

The only mandatory information required for sending this reminder is your email address. Providing any further data is voluntary and may be used to address you personally. We use the double opt-in procedure for sending the email, which ensures that you receive a notification only after you have expressly confirmed your consent by activating a verification link sent to the email address provided.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Art. 6 para. 1 lit. a GDPR for sending a shopping basket reminder. In this context, we store the IP address registered by your Internet Service Provider (ISP), as well as the date and time of registration, so that any possible misuse of your email address can be traced at a later date. The data collected by us when you register for our email notification service are used strictly for the intended purpose.

You can unsubscribe from shopping basket reminders at any time by sending an appropriate message to the controller named at the beginning. Once you have unsubscribed, your email address will be immediately deleted from the distribution list established for this purpose, unless you have expressly consented to further use of your data or we reserve the right to use the data further in a manner permitted by law and about which we inform you in this policy.

8) Data Processing for Order Fulfilment

8.1 Where necessary for the performance of the contract for delivery and payment purposes, the personal data collected by us are passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6 para. 1 lit. b GDPR.

Where, on the basis of a corresponding contract, we are obliged to provide you with updates for goods with digital elements or for digital products, we process the contact details you provided when placing the order in order to inform you personally as part of our statutory information obligations in accordance with Art. 6 para. 1 lit. c GDPR. Your contact details are used strictly for the purpose of providing notifications about updates owed by us and are processed by us for this purpose only to the extent necessary for the respective information.

For the fulfilment of your order, we also work with the service provider or providers listed below, who support us in whole or in part in performing concluded contracts. Certain personal data are transferred to these service providers in accordance with the following information.

8.2 Post & DHL Shipping (Official)

For preparing shipments, we use the services of the following provider: Deutsche Post DHL Research And Innovation GmbH, Kurt-Schumacher-Str. 1, 53113 Bonn

In accordance with Art. 6 para. 1 lit. b GDPR, we transmit digital shipping labels containing your delivery information from our order processing system to the provider solely for the purpose of processing your online order. The provider then sends these labels to our local printers to enable printing. Data are disclosed only to the extent actually necessary for processing.

8.3 Shopify Order Printer

For order processing, we use the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

Your name, address and, where applicable, other personal data are passed on to the provider in accordance with Art. 6 para. 1 lit. b GDPR for the purpose of processing the online order. Your data are disclosed only to the extent actually necessary for processing the order. The provider is also used for accounting purposes. The provider processes incoming and outgoing invoices and, where applicable, our company’s bank transactions in order to record invoices automatically, match them to transactions and use them to prepare financial accounts in a partially automated process.

Where personal data are also processed in this context, processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in efficiently organising and documenting our business transactions.

8.4 Disclosure of Personal Data to Shipping Service Providers

- Deutsche Post

We use the following provider as a transport service provider: Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany

Before delivery of the goods, we pass your email address and/or telephone number to the provider in accordance with Art. 6 para. 1 lit. a GDPR for the purpose of arranging a delivery date or providing a delivery notification, provided that you have given your express consent to this during the ordering process. Otherwise, for the purpose of delivery, we pass only the recipient’s name and delivery address to the provider in accordance with Art. 6 para. 1 lit. b GDPR. The data are disclosed only to the extent necessary for delivering the goods. In this case, it is not possible to arrange the delivery date with the provider in advance or to provide a delivery notification.

Consent may be revoked at any time with effect for the future by contacting the controller named above or the provider.

- DHL

We use the following provider as a transport service provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany

Before delivery of the goods, we pass your email address and/or telephone number to the provider in accordance with Art. 6 para. 1 lit. a GDPR for the purpose of arranging a delivery date or providing a delivery notification, provided that you have given your express consent to this during the ordering process. Otherwise, for the purpose of delivery, we pass only the recipient’s name and delivery address to the provider in accordance with Art. 6 para. 1 lit. b GDPR. The data are disclosed only to the extent necessary for delivering the goods. In this case, it is not possible to arrange the delivery date with the provider in advance or to provide a delivery notification.

Consent may be revoked at any time with effect for the future by contacting the controller named above or the provider.

- DHL Express

We use the following provider as a transport service provider: DHL Express Germany GmbH, Heinrich-Brüning-Str. 5, 53113 Bonn, Germany

Before delivery of the goods, we pass your email address and/or telephone number to the provider in accordance with Art. 6 para. 1 lit. a GDPR for the purpose of arranging a delivery date or providing a delivery notification, provided that you have given your express consent to this during the ordering process. Otherwise, for the purpose of delivery, we pass only the recipient’s name and delivery address to the provider in accordance with Art. 6 para. 1 lit. b GDPR. The data are disclosed only to the extent necessary for delivering the goods. In this case, it is not possible to arrange the delivery date with the provider in advance or to provide a delivery notification.

Consent may be revoked at any time with effect for the future by contacting the controller named above or the provider.

- DHL Express Austria

We use the following provider as a transport service provider: DHL Express (Austria) GmbH, Am Europlatz 2 (Objekt G), 1120 Vienna

Before delivery of the goods, we pass your email address and/or telephone number to the provider in accordance with Art. 6 para. 1 lit. a GDPR for the purpose of arranging a delivery date or providing a delivery notification, provided that you have given your express consent to this during the ordering process. Otherwise, for the purpose of delivery, we pass only the recipient’s name and delivery address to the provider in accordance with Art. 6 para. 1 lit. b GDPR. The data are disclosed only to the extent necessary for delivering the goods. In this case, it is not possible to arrange the delivery date with the provider in advance or to provide a delivery notification.

Consent may be revoked at any time with effect for the future by contacting the controller named above or the provider.

- DPD

We use the following provider as a transport service provider: DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg, Germany

Before delivery of the goods, we pass your email address and/or telephone number to the provider in accordance with Art. 6 para. 1 lit. a GDPR for the purpose of arranging a delivery date or providing a delivery notification, provided that you have given your express consent to this during the ordering process. Otherwise, for the purpose of delivery, we pass only the recipient’s name and delivery address to the provider in accordance with Art. 6 para. 1 lit. b GDPR. The data are disclosed only to the extent necessary for delivering the goods. In this case, it is not possible to arrange the delivery date with the provider in advance or to provide a delivery notification.

Consent may be revoked at any time with effect for the future by contacting the controller named above or the provider.

- DPD Austria

We use the following provider as a transport service provider: DPD Direct Parcel Distribution Austria GmbH, Arbeitergasse 46, Leopoldsdorf 2333, Austria

Before delivery of the goods, we pass your email address and/or telephone number to the provider in accordance with Art. 6 para. 1 lit. a GDPR for the purpose of arranging a delivery date or providing a delivery notification, provided that you have given your express consent to this during the ordering process. Otherwise, for the purpose of delivery, we pass only the recipient’s name and delivery address to the provider in accordance with Art. 6 para. 1 lit. b GDPR. The data are disclosed only to the extent necessary for delivering the goods. In this case, it is not possible to arrange the delivery date with the provider in advance or to provide a delivery notification.

Consent may be revoked at any time with effect for the future by contacting the controller named above or the provider.

- FedEx

We use the following provider as a transport service provider: FedEx Express Germany GmbH, Langer Kornweg 34 k, 65451 Kelsterbach, Germany

Before delivery of the goods, we pass your email address and/or telephone number to the provider in accordance with Art. 6 para. 1 lit. a GDPR for the purpose of arranging a delivery date or providing a delivery notification, provided that you have given your express consent to this during the ordering process. Otherwise, for the purpose of delivery, we pass only the recipient’s name and delivery address to the provider in accordance with Art. 6 para. 1 lit. b GDPR. The data are disclosed only to the extent necessary for delivering the goods. In this case, it is not possible to arrange the delivery date with the provider in advance or to provide a delivery notification.

Consent may be revoked at any time with effect for the future by contacting the controller named above or the provider.

- Hermes

We use the following provider as a transport service provider: Hermes Logistik Gruppe Deutschland GmbH, Essener Straße 89, 22419 Hamburg, Germany

Before delivery of the goods, we pass your email address and/or telephone number to the provider in accordance with Art. 6 para. 1 lit. a GDPR for the purpose of arranging a delivery date or providing a delivery notification, provided that you have given your express consent to this during the ordering process. Otherwise, for the purpose of delivery, we pass only the recipient’s name and delivery address to the provider in accordance with Art. 6 para. 1 lit. b GDPR. The data are disclosed only to the extent necessary for delivering the goods. In this case, it is not possible to arrange the delivery date with the provider in advance or to provide a delivery notification.

Consent may be revoked at any time with effect for the future by contacting the controller named above or the provider.

8.5 Use of Payment Service Providers

- Apple Pay

If you choose the “Apple Pay” payment method from Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment is processed via the “Apple Pay” function of your device running iOS, watchOS or macOS by charging a payment card stored with “Apple Pay”. Apple Pay uses security features integrated into the hardware and software of your device to protect your transactions. To authorise a payment, you must therefore enter a code previously specified by you and verify the payment using the “Face ID” or “Touch ID” function of your device.

For the purpose of processing the payment, the information you provide during the ordering process, together with information about your order, is transmitted to Apple in encrypted form. Apple then encrypts these data again using a developer-specific key before the data are transmitted to the payment service provider for the payment card stored in Apple Pay in order to execute the payment. The encryption ensures that only the website through which the purchase was made can access the payment data. Once the payment has been made, Apple sends your device account number and a transaction-specific dynamic security code to the originating website to confirm that the payment was successful.

Where personal data are processed in connection with the transfers described, processing is carried out solely for the purpose of payment processing in accordance with Art. 6 para. 1 lit. b GDPR.

Apple retains anonymised transaction data, including the approximate purchase amount, the approximate date and time, and whether the transaction was completed successfully. Anonymisation completely excludes any personal reference. Apple uses the anonymised data to improve “Apple Pay” and other Apple products and services.

If you use Apple Pay on an iPhone or Apple Watch to complete a purchase made via Safari on a Mac, the Mac and the authorising device communicate via an encrypted channel on Apple’s servers. Apple does not process or store any of this information in a format that can identify you. You can disable the option to use Apple Pay on your Mac in your iPhone settings. Go to “Wallet & Apple Pay” and disable “Allow Payments on Mac”.

Further information about data protection in connection with Apple Pay is available at the following address: https://support.apple.com/de-de/HT203027

- Google Pay

If you choose the “Google Pay” payment method from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), payment is processed via the “Google Pay” application on your mobile device running at least Android 4.4 (“KitKat”) and equipped with NFC functionality, by charging a payment card stored in Google Pay or a payment system verified there, such as PayPal. To authorise a Google Pay payment of more than EUR 25.00, you must first unlock your mobile device using the verification method configured on it, such as facial recognition, password, fingerprint or pattern.

For the purpose of payment processing, the information you provide during the ordering process, together with information about your order, is passed on to Google. Google then transmits the payment information stored in Google Pay to the originating website in the form of a one-time transaction number used to verify that the payment has been made. This transaction number contains no information about the actual payment details of the payment methods stored in Google Pay, but is generated and transmitted as a numerical token that is valid only once. In all transactions made via Google Pay, Google acts solely as an intermediary for processing the payment. The transaction is carried out exclusively between the user and the originating website by charging the payment method stored in Google Pay.

Where personal data are processed in connection with the transfers described, processing is carried out solely for the purpose of payment processing in accordance with Art. 6 para. 1 lit. b GDPR.

Google reserves the right to collect, store and analyse certain transaction-specific information for every transaction made via Google Pay. This includes the date, time and amount of the transaction, the merchant’s location and description, a description of the goods or services purchased provided by the merchant, photographs you have attached to the transaction, the name and email address of the seller and purchaser or the sender and recipient, the payment method used, your description of the reason for the transaction and, where applicable, the offer associated with the transaction.

According to Google, this processing is carried out exclusively in accordance with Art. 6 para. 1 lit. f GDPR on the basis of the legitimate interest in proper accounting, verification of transaction data, and optimisation and maintenance of the Google Pay service.

Google also reserves the right to combine the processed transaction data with further information collected and stored by Google when you use other Google services.

The Google Pay terms of use can be found here:

https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=de

Further information about data protection in connection with Google Pay is available at the following address:

https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de

- Klarna

One or more online payment methods provided by the following provider are available on this website: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden

If you select a payment method offered by the provider under which you make an advance payment, such as payment by credit card, the payment data you provide during the ordering process, including your name, address, bank and payment card information, currency and transaction number, as well as information about the contents of your order, are passed on to the provider in accordance with Art. 6 para. 1 lit. b GDPR. In this case, your data are transferred exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

If you select a payment method under which the provider makes an advance payment, such as purchase on account, instalment purchase or direct debit, you will also be asked during the ordering process to provide certain personal data, including your first and last name, street, house number, postcode, town or city, date of birth, email address, telephone number and, where applicable, details of an alternative payment method.

To safeguard our legitimate interest in determining the solvency of our customers, we pass these data to the provider for a credit check in accordance with Art. 6 para. 1 lit. f GDPR. On the basis of the personal data you provide and further data, such as the shopping basket, invoice amount, order history and payment experience, the provider checks whether the payment option you have selected can be granted in view of payment default and/or bad-debt risks.

When deciding on the application, identity and credit information from the following credit agencies may also be taken into account, in addition to the provider’s internal criteria and in accordance with Art. 6 para. 1 lit. f GDPR:

https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The credit report may contain probability values, known as score values. Where score values are included in the result of the credit report, they are based on a scientifically recognised mathematical and statistical procedure. Address data, among other things but not exclusively, are included in the calculation of the score values.

You may object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may remain entitled to process your personal data where this is necessary for contractual payment processing.

- PayPal

One or more online payment methods provided by the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method offered by the provider under which you make an advance payment, the payment data you provide during the ordering process, including your name, address, bank and payment card information, currency and transaction number, as well as information about the contents of your order, are passed on to the provider in accordance with Art. 6 para. 1 lit. b GDPR. In this case, your data are transferred exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

If you select a payment method under which we make an advance payment, you will also be asked during the ordering process to provide certain personal data, including your first and last name, street, house number, postcode, town or city, date of birth, email address, telephone number and, where applicable, details of an alternative payment method.

To safeguard our legitimate interest in determining your solvency in such cases, we pass these data to the provider for a credit check in accordance with Art. 6 para. 1 lit. f GDPR. On the basis of the personal data you provide and further data, such as the shopping basket, invoice amount, order history and payment experience, the provider checks whether the payment option you have selected can be granted in view of payment default and/or bad-debt risks.

The credit report may contain probability values, known as score values. Where score values are included in the result of the credit report, they are based on a scientifically recognised mathematical and statistical procedure. Address data, among other things but not exclusively, are included in the calculation of the score values.

You may object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may remain entitled to process your personal data where this is necessary for contractual payment processing.

- PayPal Checkout

This website uses PayPal Checkout, an online payment system from PayPal comprising PayPal’s own payment methods and local payment methods from third-party providers.

When paying via PayPal, credit card via PayPal, direct debit via PayPal or, where offered, “Pay Later” via PayPal, we pass your payment data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, hereinafter “PayPal”, as part of payment processing. The data are passed on in accordance with Art. 6 para. 1 lit. b GDPR and only to the extent necessary for payment processing.

For the payment methods credit card via PayPal, direct debit via PayPal or, where offered, “Pay Later” via PayPal, PayPal reserves the right to conduct a credit check. For this purpose, your payment data may be passed on to credit agencies in accordance with Art. 6 para. 1 lit. f GDPR on the basis of PayPal’s legitimate interest in determining your solvency. PayPal uses the result of the credit check regarding the statistical probability of payment default to decide whether to make the respective payment method available. The credit report may contain probability values, known as score values. Where score values are included in the result of the credit report, they are based on a scientifically recognised mathematical and statistical procedure. Address data, among other things but not exclusively, are included in the calculation of the score values. You may object to this processing of your data at any time by sending a message to PayPal. However, PayPal may remain entitled to process your personal data where this is necessary for contractual payment processing.

Where the PayPal payment method “Purchase on Account” is available and selected, your payment data are initially transmitted to PayPal in preparation for the payment, after which PayPal passes them on to Ratepay GmbH, Franklinstraße 28-29, 10587 Berlin (“Ratepay”) to execute the payment. The legal basis in each case is Art. 6 para. 1 lit. b GDPR. In this case, Ratepay carries out an identity and credit check in its own name to determine solvency in accordance with the principle already described above and passes your payment data to credit agencies on the basis of the legitimate interest in determining solvency in accordance with Art. 6 para. 1 lit. f GDPR. A list of the credit agencies used by Ratepay can be found here: https://www.ratepay.com/legal-payment-creditagencies/

When you use a payment method offered by a local third-party provider, your payment data are initially passed on to PayPal in preparation for the payment in accordance with Art. 6 para. 1 lit. b GDPR. Depending on the available local payment method you select, PayPal then transmits your payment data to the relevant provider in order to execute the payment in accordance with Art. 6 para. 1 lit. b GDPR:

- Apple Pay (Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
- Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)
- iDeal (Currence Holding BV, Beethovenstraat 300 Amsterdam, Netherlands)
- bancontact (Bancontact Payconiq Company, Rue d'Arlon 82, 1040 Brussels, Belgium)
- blik (Polski Standard Płatności sp. z o.o., ul. Czerniakowska 87A, 00-718 Warsaw, Poland)
- eps (PSA Payment Services Austria GmbH, Handelskai 92, Gate 2
1200 Vienna, Austria)
- MyBank (PRETA S.A.S, 40 Rue de Courcelles, F-75008 Paris, France)
- Przelewy24 (PayPro SA, Kanclerska 15A, 60-326 Poznań, Poland)

For further information relating to data protection, please refer to PayPal’s privacy policy: https://www.paypal.com/de/legalhub/paypal/privacy-full

- Shopify Payments

One or more online payment methods provided by the following provider are available on this website: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

If you select a payment method offered by the provider under which you make an advance payment, such as payment by credit card, the payment data you provide during the ordering process, including your name, address, bank and payment card information, currency and transaction number, as well as information about the contents of your order, are passed on to the provider in accordance with Art. 6 para. 1 lit. b GDPR. In this case, your data are transferred exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

- Sofort Bank Transfer

One or more online payment methods provided by the following provider are available on this website: Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden

If you select a payment method offered by the provider under which you make an advance payment, such as payment by credit card, the payment data you provide during the ordering process, including your name, address, bank and payment card information, currency and transaction number, as well as information about the contents of your order, are passed on to the provider in accordance with Art. 6 para. 1 lit. b GDPR. In this case, your data are transferred exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

9) Online Marketing

Google AdSense

This website uses Google AdSense, an online advertising service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). Google AdSense uses cookies, which are text files stored on your computer that enable an analysis of your use of the website. In addition, Google AdSense also uses “web beacons”, small invisible graphics, to collect information. These can be used to record, collect and evaluate simple actions such as visitor traffic on the website. The information generated by the cookie and/or web beacon about your use of this website, including your IP address, is generally transmitted to a Google server and stored there. This may also involve transmission to servers of Google LLC in the USA.

Google uses the information obtained in this way to evaluate your usage behaviour with regard to AdSense advertisements. The IP address transmitted by your browser as part of Google AdSense is not merged with other Google data. Information collected by Google may be transferred to third parties where this is required by law and/or where third parties process these data on behalf of Google.

All processing described above, in particular the reading of information on the device used via cookies and/or web beacons, is carried out only if you have given us your express consent to this in accordance with Art. 6 para. 1 lit. a GDPR. Without such consent, Google AdSense will not be used during your visit to the website.

You may revoke your consent at any time with effect for the future by disabling this service in the “cookie consent tool” provided on the website.

For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

Further information about Google’s privacy provisions can be found here: https://business.safety.google/intl/de/privacy/ and https://www.google.de/policies/privacy/

10) Web Analytics Services

10.1 Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), which enables an analysis of your use of our website.

By default, Google Analytics 4 sets cookies when you visit the website. These are small text components stored on your device that collect certain information. This information also includes your IP address, although Google shortens the final digits to prevent direct personal identification.

The information is transmitted to Google servers and processed further there. Transfers to Google LLC, based in the USA, are also possible.

Google uses the information collected on our behalf to evaluate your use of the website, compile reports on website activity for us and provide other services associated with website use and Internet use. The shortened IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. Data collected through the use of Google Analytics 4 are stored for a period of two months and then deleted.

All processing described above, in particular the setting of cookies on the device used, is carried out only if you have given us your express consent in accordance with Art. 6 para. 1 lit. a GDPR.

Without your consent, Google Analytics 4 will not be used during your visit to the website. You may revoke your consent at any time with effect for the future. To exercise your right of withdrawal, please disable this service using the “cookie consent tool” provided on the website.

We have concluded a data processing agreement with Google, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

Further legal information about Google Analytics 4 is available at https://business.safety.google/intl/de/privacy/, https://policies.google.com/privacy?hl=de&gl=de and https://policies.google.com/technologies/partner-sites

Demographic Features

Google Analytics 4 uses the special “demographic features” function and can use it to create statistics containing information about the age, gender and interests of website visitors. This is done by analysing advertising and information from third-party providers. This enables target groups to be identified for marketing activities. However, the data collected cannot be attributed to a specific person and are deleted after being stored for a period of two months.

Google Signals

As an extension to Google Analytics 4, Google Signals may be used on this website to enable cross-device reports to be generated. If you have activated personalised advertisements and linked your devices to your Google account, Google may, subject to your consent to the use of Google Analytics in accordance with Art. 6 para. 1 lit. a GDPR, analyse your usage behaviour across devices and create database models, including models relating to cross-device conversions. We do not receive any personal data from Google, only statistics. If you wish to stop cross-device analysis, you can disable the “Personalised advertising” function in your Google account settings. To do so, follow the instructions on this page: https://support.google.com/My-Ad-Center-Help/answer/12155764?hl=de

Further information about Google Signals is available at the following link: https://support.google.com/analytics/answer/7532985?hl=de

User IDs

As an extension to Google Analytics 4, the “User IDs” function may be used on this website. If you have consented to the use of Google Analytics 4 in accordance with Art. 6 para. 1 lit. a GDPR, have created an account on this website and log in to this account on different devices, your activities, including conversions, can be analysed across devices.

For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

10.2 Google Tag Manager

This website uses “Google Tag Manager”, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter “Google”.

Google Tag Manager provides a technical basis for combining various web applications, including tracking and analytics services, and for calibrating, controlling and linking them to conditions via a standardised user interface. Google Tag Manager itself does not store information on users’ devices or read information from them. Nor does the service perform independent data analyses. However, when a page is accessed, Google Tag Manager transmits your IP address to Google, where it may be stored. Transmission to servers of Google LLC in the USA is also possible.

This processing is carried out only if you have given us your express consent to this in accordance with Art. 6 para. 1 lit. a GDPR. Without such consent, Google Tag Manager will not be used during your visit to the website. You may revoke your consent at any time with effect for the future. To exercise your right of withdrawal, please disable this service in the “cookie consent tool” provided on the website.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

Further legal information about Google Tag Manager is available at https://business.safety.google/intl/de/privacy/ and https://policies.google.com/privacy?hl=de&gl=de

11) Retargeting, Remarketing and Conversion Tracking

11.1 Google Ads Conversion Tracking

This website uses the online advertising programme “Google Ads” and, as part of Google Ads, conversion tracking provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).

We use Google Ads to draw attention to our attractive offers on external websites with the help of advertising materials, known as Google AdWords. In relation to the advertising campaign data, we can determine how successful the individual advertising measures are. In doing so, we pursue the aim of showing you advertising that is of interest to you, making our website more interesting for you and achieving a fair calculation of the advertising costs incurred.

The conversion tracking cookie is set when a user clicks on an Ads advertisement placed by Google. Cookies are small text files stored on your device. These cookies generally expire after 30 days and are not used to identify you personally. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognise that the user clicked on the advertisement and was redirected to this page. Each Google Ads customer receives a different cookie. Cookies therefore cannot be tracked across the websites of Google Ads customers. The information obtained using the conversion cookie is used to compile conversion statistics for Google Ads customers who have opted for conversion tracking. Customers are informed of the total number of users who clicked on their advertisement and were redirected to a page containing a conversion tracking tag. However, they do not receive any information that can be used to identify users personally.

The use of Google Ads may also result in personal data being transferred to the servers of Google LLC in the USA.

Details of the processing initiated by Google Ads conversion tracking and how Google handles data from websites can be found here: https://policies.google.com/technologies/partner-sites

All processing described above, in particular the setting of cookies for reading information on the device used, is carried out only if you have given us your express consent to this in accordance with Art. 6 para. 1 lit. a GDPR. You may revoke your consent at any time with effect for the future by disabling this service in the “cookie consent tool” provided on the website.

You can also permanently object to the setting of cookies by Google Ads conversion tracking by downloading and installing the Google browser plug-in available at the following link:
https://support.google.com/My-Ad-Center-Help/answer/12155656?hl=de

In order to address users whose data we have received in the context of business or business-like relationships with advertising that is even more closely aligned with their interests, we use a customer matching function within Google Ads. For this purpose, we transmit one or more files containing aggregated customer data, primarily email addresses and telephone numbers, electronically to Google. Google does not gain access to data in plain text, but automatically encrypts the information in the customer files during the transmission process using a special algorithm. Google can then use the encrypted information only to match it to existing Google accounts set up by the data subjects. This enables personalised advertising to be displayed across all Google services linked to the relevant Google account.

Customer data are transferred to Google only if you have given us your express consent to this in accordance with Art. 6 para. 1 lit. a GDPR. You may revoke this consent at any time with effect for the future. Further information about Google’s data protection measures in relation to the customer matching function can be found here: https://support.google.com/google-ads/answer/6334160?hl=de&ref_topic=10550182

Google’s privacy provisions can be viewed here: https://business.safety.google/intl/de/privacy/ and https://www.google.de/policies/privacy/

For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

11.2 Google Ads Conversion Tracking Without Cookies

This website uses the online advertising programme “Google Ads” and, as part of Google Ads, conversion tracking provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).

We use Google Ads to draw attention to our attractive offers on external websites with the help of advertising materials, known as Google AdWords. In relation to the advertising campaign data, we can determine how successful the individual advertising measures are. In doing so, we pursue the aim of showing you advertising that is of interest to you, making our website more interesting for you and achieving a fair calculation of the advertising costs incurred.

This website uses Google Ads conversion tracking exclusively without the use of cookies, which means that the service does not set cookies on your device at any time.

Instead, your browser’s local storage is used to store an individual ID assigned by Google, which enables an analysis of your use of the website. Certain user information is processed via this ID.

The ID is set when a user clicks on an Ads advertisement placed by Google. If the user visits certain pages of this website, Google and we can recognise that the user clicked on the advertisement and was redirected to this page. Each Google Ads customer receives a different cookie. Cookies therefore cannot be tracked across the websites of Google Ads customers. The information obtained in this way is used to compile conversion statistics for Google Ads customers who have opted for conversion tracking. Customers are informed of the total number of users who clicked on their advertisement and were redirected to a page containing a conversion tracking tag.

However, they do not receive any information that can be used to identify users personally. The use of Google Ads may also result in personal data being transferred to the servers of Google LLC in the USA. Details of the processing initiated by Google Ads conversion tracking and how Google handles data from websites can be found here: https://policies.google.com/technologies/partner-sites

Where the information collected can be linked to an individual, processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in statistically evaluating the success of our advertising campaigns.

Google’s privacy provisions can be viewed here: https://business.safety.google/intl/de/privacy/ and https://www.google.de/policies/privacy/

For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

11.3 Google Ads Conversion Tracking

This website uses the online advertising programme “Google Ads” and, as part of Google Ads, conversion tracking provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). We use Google Ads to draw attention to our attractive offers on external websites with the help of advertising materials, known as Google AdWords. In relation to the advertising campaign data, we can determine how successful the individual advertising measures are. In doing so, we pursue the aim of showing you advertising that is of interest to you, making our website more interesting for you and achieving a fair calculation of the advertising costs incurred.

The conversion tracking cookie is set when a user clicks on an Ads advertisement placed by Google. Cookies are small text files stored on your device. These cookies generally expire after 30 days and are not used to identify you personally. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognise that the user clicked on the advertisement and was redirected to this page. Each Google Ads customer receives a different cookie. Cookies therefore cannot be tracked across the websites of Google Ads customers. The information obtained using the conversion cookie is used to compile conversion statistics for Google Ads customers who have opted for conversion tracking. Customers are informed of the total number of users who clicked on their advertisement and were redirected to a page containing a conversion tracking tag. However, they do not receive any information that can be used to identify users personally. The use of Google Ads may also result in personal data being transferred to the servers of Google LLC in the USA.

Details of the processing initiated by Google Ads conversion tracking and how Google handles data from websites can be found here: https://policies.google.com/technologies/partner-sites

All processing described above, in particular the setting of cookies for reading information on the device used, is carried out only if you have given us your express consent to this in accordance with Art. 6 para. 1 lit. a GDPR. You may revoke your consent at any time with effect for the future by disabling this service in the “cookie consent tool” provided on the website.

You can also permanently object to the setting of cookies by Google Ads conversion tracking by downloading and installing the Google browser plug-in available at the following link:
https://support.google.com/My-Ad-Center-Help/answer/12155656?hl=de

Please note that certain functions of this website may not be available or may be available only to a limited extent if you have disabled the use of cookies.

Google’s privacy provisions can be viewed here: https://business.safety.google/intl/de/privacy/ and https://www.google.de/policies/privacy/

For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

11.4 Google Marketing Platform

This website uses the online marketing tool Google Marketing Platform, operated by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“GMP”).

GMP uses cookies to display advertisements that are relevant to users, improve campaign performance reports or prevent a user from seeing the same advertisements more than once. Google uses a cookie ID to record which advertisements are displayed in which browser and can thereby prevent them from being displayed repeatedly. In addition, GMP can use cookie IDs to record conversions related to advertisement requests. This is the case, for example, where a user sees a GMP advertisement and subsequently visits the advertiser’s website using the same browser and makes a purchase through that website. According to Google, GMP cookies do not contain personal information.

Because of the marketing tools used, your browser automatically establishes a direct connection with Google’s server.

We have no influence over the scope and further use of the data collected by Google through the use of this tool and therefore provide the following information according to our current knowledge: By integrating GMP, Google receives information that you have accessed the relevant part of our website or clicked on one of our advertisements. If you are registered with a Google service, Google can associate the visit with your account. Even if you are not registered with Google or are not logged in, the provider may obtain and store your IP address. The use of GMP may also result in personal data being transferred to the servers of Google LLC in the USA.

All processing described above, in particular the setting of cookies for reading information on the device used, is carried out only if you have given us your express consent to this in accordance with Art. 6 para. 1 lit. a GDPR. You may revoke your consent at any time with effect for the future by disabling this service in the “cookie consent tool” provided on the website.

For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

The privacy provisions for GMP by Google can be found here: https://business.safety.google/intl/de/privacy/ and https://www.google.de/policies/privacy/

12) Website Functions

12.1 Facebook Plugins

Our website uses plugins from the social network operated by the following provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

These plugins enable direct interaction with content on the social network.

To increase the protection of your data when you visit our website, the plugins are initially disabled and integrated into the page using a “two-click” or “Shariff” solution.

This integration ensures that no connection to the provider’s servers is established when you access a page on our website containing such plugins.

Only when you activate the plugins and thereby give your consent to data transmission in accordance with Art. 6 para. 1 lit. a GDPR does your browser establish a direct connection to the provider’s servers. Irrespective of whether you are logged in to an existing user profile, a certain amount of information about the device you use, including your IP address, browser and browsing history, is transmitted to the provider and may be processed further there.

If you are logged in to an existing user profile on the provider’s social network, information about interactions carried out via the plugins is also published there and displayed to your contacts.

You can revoke your consent at any time by clicking the activated plugin again to disable it. However, revocation has no effect on data already transmitted to the provider.

Data may also be transferred to: Meta Platforms Inc., USA

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

12.2 Instagram Plugins

Our website uses plugins from the social network operated by the following provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland

These plugins enable direct interaction with content on the social network.

To increase the protection of your data when you visit our website, the plugins are initially disabled and integrated into the page using a “two-click” or “Shariff” solution.

This integration ensures that no connection to the provider’s servers is established when you access a page on our website containing such plugins.

Only when you activate the plugins and thereby give your consent to data transmission in accordance with Art. 6 para. 1 lit. a GDPR does your browser establish a direct connection to the provider’s servers. Irrespective of whether you are logged in to an existing user profile, a certain amount of information about the device you use, including your IP address, browser and browsing history, is transmitted to the provider and may be processed further there.

If you are logged in to an existing user profile on the provider’s social network, information about interactions carried out via the plugins is also published there and displayed to your contacts.

You can revoke your consent at any time by clicking the activated plugin again to disable it. However, revocation has no effect on data already transmitted to the provider.

Data may also be transferred to: Meta Platforms Inc., USA

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

12.3 Pinterest Plugins

Our website uses plugins from the social network operated by the following provider: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland

These plugins enable direct interaction with content on the social network.

To increase the protection of your data when you visit our website, the plugins are initially disabled and integrated into the page using a “two-click” or “Shariff” solution.

This integration ensures that no connection to the provider’s servers is established when you access a page on our website containing such plugins.

Only when you activate the plugins and thereby give your consent to data transmission in accordance with Art. 6 para. 1 lit. a GDPR does your browser establish a direct connection to the provider’s servers. Irrespective of whether you are logged in to an existing user profile, a certain amount of information about the device you use, including your IP address, browser and browsing history, is transmitted to the provider and may be processed further there.

If you are logged in to an existing user profile on the provider’s social network, information about interactions carried out via the plugins is also published there and displayed to your contacts.

You can revoke your consent at any time by clicking the activated plugin again to disable it. However, revocation has no effect on data already transmitted to the provider.

Data may also be transferred to: Pinterest Inc., USA

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider relies on the European Commission’s standard contractual clauses, which are intended to ensure compliance with the European level of data protection.

12.4 YouTube

This website uses plugins for displaying and playing videos from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transferred to: Google LLC, USA

When you access a page of our website containing such a plugin, your browser establishes a direct connection to the provider’s servers to load the content, at the latest when the video starts playing. Certain information, including your IP address, is transmitted to the provider in this context.

When playback of embedded videos is started via the plugin, the provider also uses cookies to collect information about user behaviour, create playback statistics and prevent abusive behaviour.

If you are logged in to a user account with the provider while visiting our website, your data will be assigned directly to your account when you click on a video. If you do not want the data to be assigned to your account, you must log out before clicking the play button.

All processing described above, in particular the setting of cookies for reading information on the device used, is carried out only if you have given us your express consent to this in accordance with Art. 6 para. 1 lit. a GDPR. You may revoke your consent at any time with effect for the future by disabling this service using the “cookie consent tool” provided on the website.

For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

12.5 Firebase Authentication

On our website, we use the service of the following provider to verify registration and login attempts for protected areas of the website: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”)

Solely on the basis of our legitimate interest in preserving the structural and data security of our website, your login details, including email address, user name and password, are passed on to the provider for authentication in accordance with Art. 6 para. 1 lit. f GDPR in order to decide whether to authorise the login attempt.

In addition to transferring data to the provider’s location stated above, data may also be transferred to: Google LLC, USA

We have concluded a data processing agreement with the provider, which protects our website visitors’ data and prohibits disclosure to third parties.

For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

13) Tools and Other Matters

13.1 - sevDesk

For bookkeeping, we use the cloud-based accounting software service provided by the following provider: sevDesk GmbH, Hauptstraße 115, 77652 Offenburg, Germany

The provider processes incoming and outgoing invoices and, where applicable, our company’s bank transactions in order to record invoices automatically, match them to transactions and use them to prepare financial accounts in a partially automated process.

Where personal data are also processed in this context, processing is carried out on the basis of our legitimate interest in efficiently organising and documenting our business transactions in accordance with Art. 6 para. 1 lit. f GDPR.

13.2 Cookie Consent Tool

This website uses a “cookie consent tool” to obtain valid user consent for cookies and cookie-based applications that require consent. The “cookie consent tool” is displayed to users when they access the website in the form of an interactive user interface, through which consent can be given for certain cookies and/or cookie-based applications by ticking the relevant boxes. Through the use of the tool, all cookies and services requiring consent are loaded only if the respective user gives the corresponding consent by ticking the relevant boxes. This ensures that such cookies are set on the respective user’s device only where consent has been granted.

The tool sets technically necessary cookies to store your cookie preferences. As a general rule, no personal user data are processed in this context.

If, in individual cases, personal data such as the IP address are nevertheless processed for the purpose of storing, assigning or recording cookie settings, this processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in legally compliant, user-specific and user-friendly consent management for cookies and therefore in the legally compliant design of our website.

A further legal basis for processing is Art. 6 para. 1 lit. c GDPR. As the controller, we are subject to the legal obligation to make the use of technically non-essential cookies dependent on the respective user’s consent.

Where necessary, we have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

Further information about the operator and the configuration options for the cookie consent tool can be found directly in the relevant user interface on our website.

14) Rights of the Data Subject

14.1 The applicable data protection law grants you the following rights as a data subject in relation to the controller’s processing of your personal data, including rights of access and intervention. Reference is made to the stated legal basis for the respective conditions governing the exercise of these rights:

• Right of access in accordance with Art. 15 GDPR
• Right to rectification in accordance with Art. 16 GDPR
• Right to erasure in accordance with Art. 17 GDPR
• Right to restriction of processing in accordance with Art. 18 GDPR
• Right to be informed in accordance with Art. 19 GDPR
• Right to data portability in accordance with Art. 20 GDPR
• Right to withdraw consent granted in accordance with Art. 7 para. 3 GDPR
• Right to lodge a complaint in accordance with Art. 77 GDPR

14.2 RIGHT TO OBJECT

IF, AS PART OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FUNDAMENTAL FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU MAY EXERCISE YOUR RIGHT TO OBJECT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

15) Duration of the Storage of Personal Data

The duration for which personal data are stored is determined by the respective legal basis, the purpose of processing and, where applicable, additionally by the relevant statutory retention period, such as retention periods under commercial and tax law.

Where personal data are processed on the basis of express consent in accordance with Art. 6 para. 1 lit. a GDPR, the data concerned are stored until you withdraw your consent.

Where statutory retention periods apply to data processed within the scope of contractual or contract-like obligations on the basis of Art. 6 para. 1 lit. b GDPR, these data are routinely deleted once the retention periods have expired, provided that they are no longer required for the performance of or preparation for a contract and/or we have no continuing legitimate interest in retaining them.

Where personal data are processed on the basis of Art. 6 para. 1 lit. f GDPR, these data are stored until you exercise your right to object under Art. 21 para. 1 GDPR, unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes on the basis of Art. 6 para. 1 lit. f GDPR, these data are stored until you exercise your right to object under Art. 21 para. 2 GDPR.

Unless otherwise stated in the other information contained in this policy regarding specific processing situations, stored personal data are otherwise deleted when they are no longer necessary for the purposes for which they were collected or otherwise processed.

Last updated: 29 October 2025, 07:00:32