PROCESSING AND TRANSMISSION OF PERSONAL DATA FOR CONTRACTUAL PURPOSES

We process your personal data as necessary for the initiation, creation, execution, and/or termination of a legal transaction with our company. The legal basis for this is established under Article 6(1)(b) of the GDPR. If the data required for concluding a contract is not provided, it may be impossible to initiate, execute, or terminate a legal transaction with our company.

Once the purpose has been fulfilled (e.g. contract processing), your personal data will be blocked from further processing or deleted, unless we are entitled to retain it for an extended period and process it as required in accordance with your consent (e.g. consent for the processing of your email address for sending promotional emails), a contractual agreement, statutory authorisation (e.g. authorisation for sending direct marketing), or on the basis of legitimate interests (e.g. retention for the assertion of claims).

Your personal data may be shared if:

• It is necessary for the creation, execution, or termination of legal transactions with our company (e.g. transmitting data to a payment service provider or a shipping company to fulfil a contract with you) (Article 6(1)(b) GDPR), or
• A subcontractor or party engaged to fulfil our obligations, which we employ solely for the provision of the offers or services you have requested, requires this data (unless you are expressly informed otherwise, these auxiliary parties are only permitted to process the data to the extent necessary for the provision of the offer or service), or
• There is a valid official order (Article 6(1)(c) GDPR), or
• There is a valid court order (Article 6(1)(c) GDPR), or
• We are legally obligated to do so (Article 6(1)(c) GDPR), or
• The processing is necessary to protect the vital interests of the data subject or another natural person (Article 6(1)(d) GDPR), or
• This is required for the performance of a task carried out in the public interest or in the exercise of official authority (Article 6(1)(e) GDPR), or
• We are authorised or even obliged to pursue overriding legitimate interests (Article 6(1)(f) GDPR).

Your personal data will not be shared with other individuals, companies, or bodies unless you have provided your explicit consent for such transmission. The legal basis for this processing is then Article 6(1)(a) GDPR.

PROCESSING AND TRANSMISSION OF PERSONAL DATA IN THE ONLINE ORDERING SYSTEM

If you wish to submit an order or booking in our online shop, it is necessary for the initiation and conclusion of the contract that you provide personal data such as your name, address, and email address. The mandatory data required for order and contract processing is clearly marked; any additional information is provided voluntarily.

Failure to provide the necessary data will preclude the possibility of concluding a contract. We process your data for order fulfilment; in particular, we will forward payment data to your chosen payment service provider or our main bank. The legal basis for the processing is Article 6(1)(b) GDPR. To prevent unauthorised third parties from accessing your personal data, the ordering process on the website is encrypted using SSL/TLS technology.

You have the option to create a customer account voluntarily, in which we will store your data for future visits to the website. Upon creating a customer account, the data you enter will be processed. Once you have successfully logged in, you can edit or delete all other data, including your customer account.

As soon as storage is no longer necessary, we will erase the data generated in this context or, where statutory retention obligations apply, restrict the processing of the data. Due to mandatory commercial and tax regulations, we are obliged to retain your address, payment, and order data for a period of ten years. Two years after the termination of the contract, we will restrict processing and limit it to compliance with our existing legal obligations.

REGISTRATION/PASSWORD-PROTECTED AREA ON THE WEBSITE/CUSTOMER ACCOUNT

To use the password-protected area of our website, you must register by providing the following information:

• Email address
• First and last name, and address if a customer account is being created in connection with an order.

Additionally, the following data will be processed at the time of registration:

• IP address
• Date and time of registration.

The data will be deleted as soon as it is no longer required for the purpose of processing. This applies to the data collected during the registration process if registration on the website is cancelled or amended. The following functions are available to you in the password-protected area:

• Edit your profile data
• View past orders
• Manage the rewards system (‘Refer a friend’ and loyalty programme).

When you use the password-protected area of the website, for instance, to edit your profile data or view past orders, we also process the data about you required for the initiation or performance of the contract, particularly your address and payment information.

The legal basis for this processing is Article 6(1)(b) GDPR. The data will be deleted as soon as it is no longer required for the purpose of processing or when there are no legitimate interests preventing its erasure.

Due to mandatory commercial and tax regulations, we are obliged to retain your address, payment, and order data for a period of ten years. Two years after the termination of the contract, we will restrict processing and limit it to compliance with our existing legal obligations.

Data processing is essential for the conclusion and initiation of the contract. If you do not provide your data, you may be unable to access the password-protected area, and the conclusion or implementation of the contract may be impossible. If you provide further data voluntarily (e.g. regarding interests, age, gender, preferences), we will process this data, which is not necessary for the initiation or performance of a contract, for as long as you use the password-protected area, unless you delete it yourself beforehand. Our aim in this respect is to optimise the use of the website for you as a user. The legal basis for this is Article 6(1)(f) GDPR.

You may object to the processing. Your right of objection exists if you have reasons arising from your particular situation. We will not process your data further unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms or, moreover, the processing serves to establish, exercise, or defend against legal claims (Article 21(1) GDPR).

You may send us your objection using the contact details specified under ‘Responsible provider’ above. You can manage, amend, or delete your voluntary information at any time in the password-protected area. You are free to take measures in accordance with the ‘Your rights’ section; however, if you have any complaints, we request that you first contact our company.

APPLICATION PROCESS

We are pleased that you are interested in our company and wish to apply or have already applied for a position with us. Below, we would like to provide you with information about the processing of your personal data in connection with your application. We process the data necessary for the online application process (e.g. name, email address, and location), as well as any data you have submitted with your application, to assess your suitability for the position (or any other vacancies within our company) and to carry out the application process.

The legal basis for the processing of your personal data in this application process is primarily Section 26 of the German Federal Data Protection Act (BDSG), as amended on 25 May 2018. This allows for the processing of data required in connection with hiring decisions. Should the data be required for the assertion of legal rights after the application process has concluded, it may be processed on the basis of Article 6 GDPR, particularly to safeguard legitimate interests under Article 6(1)(f) GDPR. In such cases, our interest lies in asserting or defending claims.

In the event of a rejection, candidate data will be deleted after six months. If you have agreed to the further storage of your personal data, we will add your data to our applicant pool, where it will be deleted after two years. If you are offered a job during the application process, the data from the applicant system will be transferred to our HR information system.

We use a specialist software provider for the application process. They act as a service provider for us and may also become aware of your personal data in the context of system maintenance and support. We have concluded a data processing agreement with this provider to ensure that data processing is carried out in a lawful manner.

Upon receipt of your application, your application data will be reviewed by the HR department. Suitable applications are then forwarded internally to the relevant department heads for the respective vacancies. The next steps are then agreed upon. In principle, only those individuals within the company who require access to your data for the regular conduct of our application process will have access.

You may object to the processing. Your right of objection exists if you have reasons arising from your particular situation. We will not process your data further unless we can demonstrate compelling legitimate grounds for the processing which outweigh your interests, rights, and freedoms, or, moreover, the processing serves to establish, exercise, or defend against legal claims (Article 21(1) GDPR). You may send us your objection using the contact details specified under ‘Responsible provider’ above.

EMAIL MARKETING/ADVERTISING TO EXISTING CUSTOMERS

We reserve the right to use the email address you provided when ordering, in accordance with statutory provisions, to send you the following content by email during or after your order, unless you have already opted out of this processing of your email address:

• Other interesting offers from our portfolio
• Information about company events
• Questions about special requirements for product development
• Requests for feedback

USE OF ZENLOOP FOR SENDING FEEDBACK REQUESTS

We process your email address to send feedback requests. The email contains a so-called NPS query, a Net Promoter Score designed to measure customer satisfaction, which is generated and sent by zenloop (zenloop GmbH, Brunnenstraße 196, 10119 Berlin).

For this purpose, zenloop receives your email address, name, and order number after you have placed an order. Zenloop stores your data and feedback within the European Union. After anonymisation, zenloop uses your data to create reports or benchmarks; this anonymised data is employed for security, operational management, statistical analysis, and research and development purposes.

In principle, zenloop will erase your data after the legal retention periods have expired, unless other legal grounds justify continued data processing. For further information, please refer to zenloop’s privacy policy: zenloop Privacy Policy.

Both we and our affiliated companies utilise your data to enhance our services and implement improvements. The legal basis for this processing is Article 6(1) Sentence 1(f) of the GDPR. You have the right to object to the processing of your data. Your right of objection exists if you have reasons arising from your particular situation. We will not process your data further unless we can demonstrate compelling legitimate reasons for the processing that outweigh your interests, rights, and freedoms, or if the processing is necessary for the establishment, exercise, or defence of legal claims (Article 21(1) GDPR). You may send us your objection using the contact details provided under 'Responsible provider' above.

USE OF MAILJET FOR SENDING PRODUCT-RELATED FEEDBACK REQUESTS

We use the Mailjet email marketing service, provided by Mailjet GmbH (c/o Workrepublic, Berliner Allee 26, 40212 Düsseldorf, Germany; Mailjet), to send you product-related feedback requests by email after you have made a purchase.

For this purpose, Mailjet processes your email address within the European Union, as necessary for the provision of its services. Additional technical information is processed, such as the browser used, the time of page retrieval, and your IP address. This information is processed to analyse and technically enhance our services. The legal basis for this processing is Article 6(1) Sentence 1(f) of the GDPR. We are unaware of how long Mailjet retains data and have no influence over this.

For more information, please refer to Mailjet’s security and privacy information at Mailjet Security and Privacy and its privacy policy, accessible at Mailjet's Privacy Policy Page.

You have the right to object to the processing of your data. Your right of objection exists if you have reasons arising from your particular situation. We will not process your data further unless we can demonstrate compelling legitimate reasons for the processing that outweigh your interests, rights, and freedoms, or if the processing is necessary for the establishment, exercise, or defence of legal claims (Article 21(1) GDPR). You may send us your objection using the contact details provided under 'Responsible provider' above.

COMMENT FEATURE AND GUESTBOOK ON THE WEBSITE

Using the link to our shop system sent via Mailjet, you can, if you own a customer account, rate the product you have purchased on our website. When you post a review, we process the following personal data:

• Email address
• First and last name
• Username
• Town

Additionally, the following data is processed at the time of posting:

• IP address
• Date/time of post.

When your review is published, we will only display the name stored in your user account, not the email address you provided. You are not required to enter your real name and may choose to use a pseudonym. You can change your display name within your customer account at any time. We will review your post before publication and reserve the right to remove any posts deemed unlawful.

If necessary, we process your email address and your name/pseudonym to verify the authenticity of the content shared in the post. Furthermore, we may need to contact you if someone objects to your post on the website or to defend ourselves against any complaints or claims arising from your post.

For this purpose, we also process your IP address. We will erase the IP address after one week; however, we will retain your email address as long as the post remains on the website or we are involved in any legal dispute regarding the post. If you or we delete your post, we will retain the email address, name provided, and any other voluntary information for the duration of the statutory limitation periods for the reasons of prevention and defence, but we will restrict the processing of this data after six months.

We do not share your data with third parties unless we are legally obliged to do so or if such transmission is necessary to enforce our legitimate interests. The legal basis for the processing is Article 6(1) Sentence 1(f) of the GDPR.

You have the right to object to the processing of your data. Your right of objection exists if you have reasons arising from your particular situation. We will not process your data further unless we can demonstrate compelling legitimate reasons for the processing that outweigh your interests, rights, and freedoms, or if the processing is necessary for the establishment, exercise, or defence of legal claims (Article 21(1) GDPR). You may send us your objection using the contact details provided under 'Responsible provider' above.

You can request the deletion of your post at any time. To do so, please contact us using the contact details provided under 'Responsible provider'. You are free to exercise your rights as outlined in the 'Your rights' section; however, if you have any complaints, we kindly ask that you first contact our company.

NEWSLETTER

You have the opportunity to subscribe to our email newsletter on the website, which we use to inform you regularly about the following content:

• Offers from our portfolio
• Information about company events
• Third-party offers (including events), provided you have consented to this
• New articles/collections
• Special/time-limited offers.

To receive the newsletter, you must provide us with a valid email address. To subscribe to our email newsletter, please use the double opt-in process. Once you have entered the mandatory information, we will send you an email to the address you have provided, asking you to confirm your subscription to the newsletter by clicking on a confirmation link.

This process ensures that you genuinely wish to receive our email newsletter. If you do not confirm your subscription within 24 hours, we will block the information transferred to us and automatically erase it after one month at the latest. Additionally, the following data is processed at the time of subscription:

• IP address
• Date/time of registration for the newsletter
• Time when you click on the confirmation link.

We process your IP address, the time of registration, and the time of your confirmation to document your newsletter registration and to prevent misuse of your personal data. The legal basis for the processing is Article 6(1) Sentence 1(f) of the GDPR. We will process this data until two years after the termination of the contract. If registration for the newsletter takes place and is unrelated to the conclusion of a contract, we will process this data until two years after the termination of use. We will erase this data when the newsletter subscription ends.

After your confirmation, we will process the email address provided for the purpose of sending our email newsletter. The legal basis for this processing is Article 6(1) Sentence 1(a) of the GDPR. We will erase this data when you unsubscribe from the newsletter.

You may withdraw your consent to the processing of your email address for receiving the newsletter at any time, either by sending us a message (see the contact details under 'Responsible provider') or by clicking the unsubscribe link in the newsletter. This does not affect the lawfulness of processing that has occurred based on your consent up until the point of your withdrawal (Article 13(2)(c) of the GDPR).

We would like to inform you that we analyse your user behaviour in relation to the sending of our newsletter. For this analysis, the emails sent out contain web beacons or tracking pixels, which are single-pixel image files embedded in our website. For analysis purposes, we link the data mentioned under ‘Access data’ with your email address and an individual ID. Links received in the newsletter also contain this ID.

We use the data collected in this manner to create a user profile to tailor the newsletter to your individual interests. We record when you read our newsletters and which links you click on, allowing us to draw conclusions about your personal interests. We link this data to actions you perform on our website. The information is processed for as long as you are subscribed to the newsletter. Once you unsubscribe, we will process the data for purely statistical purposes and anonymously. Our intention here is to analyse and optimise the email advertising we send you.

The legal basis for the processing is Article 6(1) Sentence 1(f) of the GDPR. You have the right to object to receiving direct marketing and to the processing of data for direct marketing purposes at any time without incurring any costs other than standard transmission costs. You have a general right of objection without providing reasons (Article 21(2) of the GDPR). After exercising your right of objection, we will erase your data in connection with direct marketing.

To do this, click on the unsubscribe link in the respective email or send us your objection using the contact details provided under 'Responsible provider'. You can also prevent tracking by disabling the display of images in your email client by default. This will mean that the newsletter will not be fully displayed, and you may not be able to use all functions.

PAYMENT SERVICE PROVIDERS (PSPS)

PAYPAL

On our website, you have the option to pay via PayPal. This payment service is provided by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter referred to as "PayPal").
If you choose to pay via PayPal, the payment details you enter will be transferred to PayPal. The transfer of your data to PayPal is conducted on the basis of Article 6(1) Sentence 1(b) of the GDPR (processing for the performance of a contract). If you do not provide your data, it may not be possible to conclude or execute a contract. We have no knowledge of how long PayPal retains data and cannot influence this.

PAYMENT VIA STRIPE

You may also use Stripe (Stripe Payments Europe Ltd., Block 4, Harcourt Centre, Harcourt Road, Dublin 2, Ireland) as a payment method. Your data will be transmitted to Stripe, which may perform identity and credit checks based on the information you provide (including name, address, account number, bank sort code, credit card number, invoice amount, currency, and transaction number). Further details can be found in the information displayed during our booking process.

The legal basis for the processing for payment processing is Article 6(1) Sentence 1(b) of the GDPR. This data processing is essential for concluding the contract. If you do not provide your data, it may not be possible to conclude or execute a contract.

Both we and Stripe have a legitimate interest in transmitting your personal data for identity and credit checks. We and Stripe require this data to obtain information from credit reference agencies for these purposes (Article 6(1) Sentence 1(f) of the GDPR). You can find these credit agencies mentioned at https://stripe.com/de/privacy. Once storage is no longer necessary, we will erase the data generated in this context or, if statutory retention obligations apply, restrict the processing of the data.

For further information regarding the Stripe privacy policy, please refer to: www.stripe.com/de/privacy. You may object to the processing of your data. Your right to object exists if you have reasons arising from your particular situation. We will not process your data further unless we can demonstrate compelling legitimate reasons for processing that outweigh your interests, rights, and freedoms or if the processing serves to establish, exercise, or defend against legal claims (Article 21(1) of the GDPR). You may send your objection using the contact details specified under "Responsible Provider" above.

However, Stripe retains the right to process and transmit customer data if this is necessary for contractual payment processing or required by law or an official or court order. You can contact Stripe at info@stripe.com.

TRANSMISSION OF PERSONAL DATA FOR ENFORCING RIGHTS/ASCERTAINING AN ADDRESS/DEBT COLLECTION

In the event of non-payment, we reserve the right to share the data provided at the time of ordering with a lawyer and/or external companies (e.g. Verband der Vereine Creditreform e. V., Hellersbergstraße 12, 41460 Neuss, Germany) if we have a legitimate interest pursuant to Article 6(1) Sentence 1(f) of the GDPR in ascertaining an address and/or enforcing our rights.

Additionally, we may share your information if this is necessary to protect our rights as well as the rights of our affiliates, cooperation partners, employees, and/or users of our website. Under no circumstances will we sell or rent your data to third parties. Such a transmission of your data would be based on Article 6(1) Sentence 1(f) of the GDPR. Once storage is no longer necessary, we will erase the data generated in this context or, if statutory retention obligations apply, restrict the processing of the data.

You may object to the processing of your data. Your right to object exists if you have reasons arising from your particular situation. We will not process your data further unless we can demonstrate compelling legitimate reasons for the processing that outweigh your interests, rights, and freedoms or if the processing serves to establish, exercise, or defend against legal claims (Article 21(1) of the GDPR). You may send your objection using the contact details specified under "Responsible Provider" above.

HOSTING

We utilise external hosting services for providing the following services: infrastructure and platform services, computing capacity, storage resources, and database services, as well as security and technical maintenance services. This involves processing all data necessary for the operation and use of our website.

By using external hosting services, we aim to ensure the efficient and secure provision of our website. The legal basis for the processing is Article 6(1) Sentence 1(f) of the GDPR. The recording of data for the provision and use of the website, along with the processing of data using external web hosting services, is essential for the operation of the website.

You may object to the processing of your data. Your right to object exists if you have reasons arising from your particular situation. We will not process your data further unless we can demonstrate compelling legitimate reasons for the processing that outweigh your interests, rights, and freedoms or if the processing serves to establish, exercise, or defend against legal claims (Article 21(1) of the GDPR). You may send your objection using the contact details specified under "Responsible Provider" above.

INTEGRATION OF THIRD-PARTY CONTENT

The website integrates third-party content, such as videos, maps, RSS feeds, and graphics from other websites. This integration always requires that the providers of this content (“third-party providers”) perceive the IP addresses of users. Without the IP address, they would not be able to send the content to the browser of the respective user.

Therefore, the IP address is required to display this content.
We endeavour to use content from third-party providers who process the IP address solely for delivering the content. However, we have no influence over whether the third-party providers process the IP addresses for statistical purposes. If we are aware of such activity, we will inform you accordingly.

Some third-party providers may process data outside the European Union. You can object by installing a JavaScript blocker such as the browser plug-in NoScript (www.noscript.net) or by disabling JavaScript in your browser. You may object to the processing of your data. Your right to object exists if you have reasons arising from your particular situation.

We will not process your data further unless we can demonstrate compelling legitimate reasons for the processing that outweigh your interests, rights, and freedoms or if the processing serves to establish, exercise, or defend against legal claims (Article 21(1) of the GDPR). You may send your objection using the contact details specified under "Responsible Provider" above.

GOOGLE RECAPTCHA

We use Google reCAPTCHA (hereinafter referred to as "reCAPTCHA") on our website. This service is provided by Google and is used to determine whether data entered on the website (e.g. in a contact form) is provided by a person or an automated programme.

To achieve this, reCAPTCHA analyses various aspects of the visitor's behaviour on the website. This analysis begins automatically as soon as the user accesses the website. For this analysis, reCAPTCHA evaluates various information (e.g. IP address, time spent on the website, or mouse movements made by the user).
The data collected during the analysis is forwarded to Google, which processes your personal data in the USA and has subjected itself to the EU-US Privacy Shield. You can view Google’s certification at https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active.

reCAPTCHA analyses occur entirely in the background, and you will not be notified when an analysis takes place. The processing is conducted on the basis of Article 6(1) Sentence 1(f) of the GDPR. We have a legitimate interest in protecting our website from abusive automated spying and unsolicited email advertising (spam). We have no knowledge of how long reCAPTCHA retains data and cannot influence this.

Further information about reCAPTCHA and Google’s privacy policy can be found via the following links: https://www.google.com/intl/de/policies/privacy/ and https://www.google.com/recaptcha/intro/android.html. You may object to the processing of your data. Your right to object exists if you have reasons arising from your particular situation. We will not process your data further unless we can demonstrate compelling legitimate reasons for the processing that outweigh your interests, rights, and freedoms or if the processing serves to establish, exercise, or defend against legal claims (Article 21(1) of the GDPR). You may send your objection using the contact details specified under "Responsible Provider" above.

GOOGLE AJAX SEARCH API

We use the Google AJAX Search API as a central search service. The integrated search service enables a full-text search of the content on this website.
For your information, the text “Search with Google™ …” is displayed in the search box. If you select the text field of the search box and enter a search term, an additional link will appear beneath the search box, referring to this data protection information.

No data is transferred to Google until you activate the search box, initiate a full-text search, and access the search results page. By using the search function within the search results page, your data will also be transmitted to Google simultaneously, including search terms entered and the IP address of your device.
If you visit our official website without activating the Google AJAX Search API, in principle, no data will be transferred to Google. We would like to emphasise that the processing of any personal data transferred in this manner is the responsibility of Google, and