Data protection

Privacy Policy

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data means any data that can be used to identify you personally. For detailed information on data protection, please refer to our privacy policy below.

Data collection on this website

Who is responsible for data collection on this website?

Data on this website is processed by the website operator. You can find the operator's contact details in the section entitled “Information about the controller” in this privacy policy.

How do we collect your data?

Some of your data is collected when you provide it to us. This may include, for example, data you enter in a contact form.

Other data is collected by our IT systems automatically or with your consent when you visit the website. This is primarily technical data (e.g. your internet browser, operating system or the time you access a page). This data is collected automatically as soon as you access this website.

What do we use your data for?

Some data is collected to ensure that the website functions correctly. Other data may be used to analyse your user behaviour. Where contracts can be concluded or initiated through the website, the data submitted is also processed for contractual offers, orders or other order enquiries.

What rights do you have regarding your data?

You have the right at any time to obtain information free of charge about the source, recipients and purpose of your stored personal data. You also have the right to request the rectification or erasure of this data. If you have given consent to data processing, you may withdraw that consent at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time about this or any other questions concerning data protection.

2. General information and mandatory disclosures

Data protection

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection provisions and this privacy policy.

Various personal data is collected when you use this website. Personal data means data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

Please note that data transmission over the internet (e.g. when communicating by email) may have security vulnerabilities. Complete protection of data against access by third parties is not possible.

Information about the controller

The controller responsible for data processing on this website is:

GGM Gastro International GmbH

Managing Directors: Ferit Inan & Ömer Elma
Weinerpark 16
D - 48607 Ochtrup

Telephone: Tel: +49 (0) 2553 - 72 20 - 0 | Fax: +49 (0) 2553 - 72 20 20 – 200
Email: info@ggmgastro.com

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data (e.g. names, email addresses or similar).

Retention period

Unless a more specific retention period is stated in this privacy policy, your personal data will remain with us until the purpose for processing it no longer applies. If you submit a valid request for erasure or withdraw your consent to data processing, your data will be erased unless we have other legally permissible grounds for retaining your personal data (e.g. retention periods under tax or commercial law); in the latter case, erasure will take place once those grounds no longer apply.

General information on the legal bases for data processing on this website

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR where special categories of data within the meaning of Art. 9(1) GDPR are processed. If you have expressly consented to the transfer of personal data to third countries, data processing is also based on Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or access to information on your device (e.g. through device fingerprinting), data processing is additionally based on Section 25(1) TDDDG. Consent may be withdrawn at any time. If your data is necessary for the performance of a contract or to take steps prior to entering into a contract, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, where your data is necessary to comply with a legal obligation, we process it on the basis of Art. 6(1)(c) GDPR. Data processing may also be based on our legitimate interest pursuant to Art. 6(1)(f) GDPR. The following sections of this privacy policy provide information about the legal bases applicable in each individual case.

Data protection officer

We have appointed a data protection officer.

Philipp Gumpert
https://gataca.de/

GATACA GmbH
Am Riettor 4
78048 Villingen-Schwenningen

datenschutz@ggmgastro.com

Information on data transfers to third countries that do not provide adequate data protection and to US companies that are not DPF-certified

Among other things, we use tools from companies based in third countries that do not provide adequate data protection, as well as US tools whose providers are not certified under the EU-US Data Privacy Framework (DPF). When these tools are active, your personal data may be transferred to and processed in these countries. Please note that a level of data protection comparable to that in the EU cannot be guaranteed in third countries that do not provide adequate data protection.

Please note that, as a safe third country, the USA generally provides a level of data protection comparable to that in the EU. Data transfers to the USA are therefore permitted if the recipient is certified under the EU-US Data Privacy Framework (DPF) or has appropriate additional safeguards in place. Information on transfers to third countries, including the recipients of the data, can be found in this privacy policy.

Recipients of personal data

We work with various external parties in the course of our business activities. In some cases, this also requires the transfer of personal data to these external parties. We only disclose personal data to external parties where this is necessary for the performance of a contract, where we are legally obliged to do so (e.g. disclosure of data to tax authorities), where we have a legitimate interest in the disclosure pursuant to Art. 6(1)(f) GDPR, or where another legal basis permits the disclosure. When using processors, we only disclose our customers' personal data on the basis of a valid data processing agreement. In the case of joint processing, a joint processing agreement is concluded.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You may withdraw consent you have already given at any time. Withdrawal does not affect the lawfulness of data processing carried out before consent was withdrawn.

Right to object to data collection in specific cases and to direct marketing (Art. 21 GDPR)

IF DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO THE PROCESSING OF YOUR PERSONAL DATA; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RELEVANT LEGAL BASIS FOR PROCESSING CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS THE PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21(1) GDPR).

WHERE YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING; THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION PURSUANT TO ART. 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement. This right to lodge a complaint is without prejudice to any other administrative or judicial remedies.

Right to data portability

You have the right to receive, or have a third party receive, data that we process by automated means on the basis of your consent or in performance of a contract, in a commonly used, machine-readable format. If you request that the data be transferred directly to another controller, this will only be done where technically feasible.

Access, rectification and erasure

Within the scope of the applicable statutory provisions, you have the right at any time to obtain information free of charge about your stored personal data, its source and recipients and the purpose of data processing and, where applicable, a right to rectification or erasure of this data. You can contact us at any time about this or any other questions concerning personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time for this purpose. The right to restriction of processing applies in the following cases:

• If you dispute the accuracy of the personal data we hold about you, we generally need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.

• If your personal data has been or is being processed unlawfully, you may request restriction of processing instead of erasure.

• If we no longer need your personal data but you require it for the exercise, defence or establishment of legal claims, you have the right to request restriction of the processing of your personal data instead of erasure.

• If you have lodged an objection pursuant to Art. 21(1) GDPR, your interests must be weighed against ours. Pending determination of whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, such data may, apart from storage, only be processed with your consent or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

SSL or TLS encryption

This website uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the website operator. You can recognise an encrypted connection by the browser's address line changing from “http://” to “https://” and by the padlock symbol in your browser's address bar.

When SSL or TLS encryption is enabled, third parties cannot read the data you transmit to us.

Encrypted payment transactions on this website

If, after concluding a contract for which payment is due, you are obliged to provide us with your payment details (e.g. your account number for a direct debit mandate), this data is required to process the payment.

Payment transactions using common payment methods (Visa/MasterCard, direct debit) are carried out exclusively via an encrypted SSL or TLS connection. You can recognise an encrypted connection by the browser's address line changing from “http://” to “https://” and by the padlock symbol in your browser's address bar.

With encrypted communication, third parties cannot read the payment details you transmit to us.

Objection to promotional emails

We hereby object to the use of contact details published as part of the mandatory legal notice for sending unsolicited advertising and information materials. The operators of this website expressly reserve the right to take legal action in the event of unsolicited promotional information being sent, for example by spam email.

3. Data collection on this website

Cookies

Our website uses “cookies”. Cookies are small data packages and do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted at the end of your visit. Persistent cookies remain stored on your device until you delete them yourself or your web browser deletes them automatically.

Cookies may originate from us (first-party cookies) or from third-party companies (third-party cookies). Third-party cookies enable certain services provided by third-party companies to be integrated into websites (e.g. cookies used to process payment services).

Cookies have various functions. Many cookies are technically necessary because certain website functions would not work without them (e.g. the shopping cart function or displaying videos). Other cookies may be used to analyse user behaviour or for advertising purposes.

Cookies required to carry out electronic communications, to provide certain functions you have requested (e.g. the shopping cart function), or to optimise the website (e.g. cookies used to measure web audiences) (necessary cookies) are stored on the basis of Art. 6(1)(f) GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies to ensure the technically error-free and optimised provision of its services. Where consent to the storage of cookies and comparable recognition technologies has been requested, processing takes place exclusively on the basis of that consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG); consent may be withdrawn at any time.

You can configure your browser to notify you when cookies are set, allow cookies only on a case-by-case basis, reject cookies in certain cases or altogether, and enable automatic deletion of cookies when you close your browser. Disabling cookies may limit the functionality of this website.

You can find information about the cookies and services used on this website in this privacy policy.

CookieFirst

Our website uses CookieFirst to obtain your consent to the storage of certain cookies on your device or the use of certain technologies and to document this in compliance with data protection requirements. The provider of this technology is Digital Data Solutions B.V. (CookieFirst), Plantage Middenlaan 42A, 1018 DH Amsterdam, Netherlands (hereinafter “CookieFirst”).

When you access our website, a connection to CookieFirst's servers is established to obtain your consent and other declarations regarding the use of cookies. CookieFirst then stores a cookie in your browser to associate the consent you have given, or its withdrawal, with you. In this process, the IP address (anonymised), the browser and operating system user agent, and the URL from which consent was given are processed and integrated into CookieFirst. The data collected in this way is stored until you ask us to delete it, delete the CookieFirst cookie yourself, or the purpose for storing the data no longer applies. Mandatory statutory retention obligations remain unaffected.

CookieFirst transfers personal data to third-party providers. These include a CDN from Slovenia, IP geolocation from Romania, and hosting by OHV in Germany and France. CookieFirst is headquartered in Amsterdam, Netherlands.

CookieFirst is used to obtain the legally required consent for the use of cookies. The legal basis for this is Art. 6(1), first sentence, point (c) GDPR.

Data processing on our behalf

We have concluded a data processing agreement (DPA) for the use of the service mentioned above. This is an agreement required by data protection law which ensures that the provider processes the personal data of visitors to our website only in accordance with our instructions and in compliance with the GDPR.

Server log files

The website provider automatically collects and stores information in server log files, which your browser automatically transmits to us. This information includes:

• Browser type and browser version

• Operating system used

• Referrer URL

• Host name of the accessing computer

• Time of the server request

• IP address

This data is not combined with other data sources.

This data is collected on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website; collecting server log files is necessary for this purpose.

Contact form

If you send us enquiries using the contact form, we will store the information provided in the enquiry form, including the contact details you enter, to process your enquiry and respond to any follow-up questions. We will not disclose this data without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR if your enquiry relates to the performance of a contract or is necessary to take steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in effectively handling enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR), where requested; consent may be withdrawn at any time.

The data you enter in the contact form will remain with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. once your enquiry has been fully processed). Mandatory statutory provisions, in particular retention periods, remain unaffected.

Enquiries by email, telephone or fax

If you contact us by email, telephone or fax, we will store and process your enquiry, including all personal data arising from it (name, enquiry), for the purpose of handling your request. We will not disclose this data without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR if your enquiry relates to the performance of a contract or is necessary to take steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in effectively handling enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR), where requested; consent may be withdrawn at any time.

The data you send us in contact enquiries will remain with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. once your request has been fully processed). Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.

Communication via WhatsApp

Among other services, we use the instant messaging service WhatsApp to communicate with our customers and other third parties. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Communication takes place using end-to-end encryption (peer-to-peer), which prevents WhatsApp or other third parties from accessing the content of the communication. However, WhatsApp has access to metadata generated during the communication process (e.g. sender, recipient and time). Please also note that, according to its own statements, WhatsApp shares its users' personal data with its US-based parent company Meta. Further details on data processing can be found in WhatsApp's privacy policy at: https://www.whatsapp.com/legal/#privacy-policy.

WhatsApp is used on the basis of our legitimate interest in communicating as quickly and effectively as possible with customers, prospective customers and other business and contractual partners (Art. 6(1)(f) GDPR). Where corresponding consent has been requested, data processing takes place exclusively on the basis of that consent; it may be withdrawn at any time with effect for the future.

The content of communications exchanged between you and us on WhatsApp will remain with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. once your enquiry has been fully processed). Mandatory statutory provisions, in particular retention periods, remain unaffected.

The company is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/7735.

We use the “WhatsApp Business” version of WhatsApp.

Data transfers to the USA are based on the European Commission's Standard Contractual Clauses. Details can be found here: https://www.whatsapp.com/legal/business-data-transfer-addendum.

We have configured our WhatsApp accounts so that they do not automatically synchronise data with the address book on the smartphones in use.

We have concluded a data processing agreement (DPA) with the provider mentioned above.

Registration on this website

You can register on this website to use additional functions. We use the data entered for this purpose only to enable you to use the relevant offering or service for which you have registered. All mandatory information requested during registration must be provided in full. Otherwise, we will reject the registration.

For important changes, such as changes to the scope of our offering or technically necessary changes, we will use the email address provided during registration to notify you.

The data entered during registration is processed for the purpose of performing the user relationship established by registration and, where applicable, initiating further contracts (Art. 6(1)(b) GDPR).

We store the data collected during registration for as long as you are registered on this website and delete it afterwards. Statutory retention periods remain unaffected.

Registration with Facebook Connect

Instead of registering directly on this website, you can register using Facebook Connect. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. According to Facebook, however, the data collected is also transferred to the USA and other third countries.

If you choose to register with Facebook Connect and click the “Login with Facebook”/“Connect with Facebook” button, you will automatically be redirected to the Facebook platform. You can log in there using your login details. This links your Facebook profile to this website or our services. Through this link, we gain access to the data you have stored on Facebook. This primarily includes:

• Facebook name

• Facebook profile picture and cover photo

• Facebook cover photo

• Email address stored on Facebook

• Facebook ID

• Facebook friends lists

• Facebook likes

• Date of birth

• Gender

• Country

• Language

This data is used to set up, provide and personalise your account.

Registration with Facebook Connect and the associated data processing operations are based on your consent (Art. 6(1)(a) GDPR). You may withdraw this consent at any time with effect for the future.

Where the tool described here collects personal data on our website and forwards it to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art. 26 GDPR). This joint responsibility is limited exclusively to the collection of the data and its disclosure to Facebook. Subsequent processing by Facebook after the data has been forwarded is not part of the joint responsibility. Our joint obligations have been set out in a joint processing agreement. The wording of the agreement can be found at: https://www.facebook.com/legal/controller_addendum. Under this agreement, we are responsible for providing data protection information when using the Facebook tool and for implementing the tool on our website in a manner that complies with data protection requirements. Facebook is responsible for the data security of Facebook products. You may assert data subject rights (e.g. requests for access) relating to data processed by Facebook directly with Facebook. If you assert your data subject rights with us, we are obliged to forward them to Facebook.

Data transfers to the USA are based on the European Commission's Standard Contractual Clauses. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://de-de.facebook.com/help/566994660333381 and https://www.facebook.com/policy.php.

Further information can be found in Facebook's Terms of Service and Privacy Policy. These are available at: https://de-de.facebook.com/about/privacy/ and https://de-de.facebook.com/legal/terms/.

The company is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/4452.

Registration with Google

Instead of registering directly on this website, you can register with Google. The provider of this service is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

To register with Google, you only need to enter your Google username and password. Google will identify you and confirm your identity to our website.

When you sign in with Google, we may be able to use certain information in your account to complete your profile with us. You decide whether and which information is available through your Google security settings, which can be found here: https://myaccount.google.com/security and https://myaccount.google.com/permissions.

The data processing associated with Google registration is based on our legitimate interest in providing our users with the simplest possible registration process (Art. 6(1)(f) GDPR). Since use of the registration function is voluntary and users can decide for themselves which access permissions to grant, there are no apparent overriding rights of data subjects that conflict with this.

The company is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

4. Social media

Pinterest

On this website, we use elements of the social network Pinterest, operated by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland.

When you access a page containing such an element, your browser establishes a direct connection to Pinterest's servers. This social media element transmits log data to Pinterest's server in the USA. This log data may include your IP address, the addresses of websites you visit that also contain Pinterest functions, the type and settings of your browser, the date and time of the request, how you use Pinterest, and cookies.

This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Consent may be withdrawn at any time.

Further information about the purpose, scope and further processing and use of the data by Pinterest, as well as your related rights and options for protecting your privacy, can be found in Pinterest's privacy policy: https://policy.pinterest.com/de/privacy-policy.

5. Analytics tools and advertising

Google Analytics

This website uses functions of the web analytics service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse the behaviour of website visitors. The website operator receives various usage data, such as page views, time spent on the website, operating systems used and the user's origin. This data is combined under a user ID and assigned to the respective device of the website visitor.

Furthermore, Google Analytics enables us to record, among other things, your mouse movements, scrolling and clicks. Google Analytics also uses various modelling approaches to supplement the data sets collected and employs machine learning technologies in data analysis.

Google Analytics uses technologies that enable users to be recognised for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is generally transmitted to a Google server in the USA and stored there.

This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Consent may be withdrawn at any time.

Data transfers to the USA are based on the European Commission's Standard Contractual Clauses. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/.

The company is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

IP anonymisation

Google Analytics IP anonymisation is enabled. As a result, Google truncates your IP address within Member States of the European Union or other states party to the Agreement on the European Economic Area before transmitting it to the USA. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, compile reports on website activity and provide the website operator with other services relating to website and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be combined with other data held by Google.

Browser plugin

You can prevent Google from collecting and processing your data by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

For more information on how Google Analytics handles user data, please refer to Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

Google signals

We use Google signals. When you visit our website, Google Analytics collects, among other things, your location, search history and YouTube history, as well as demographic data (visitor data). This data can be used for personalised advertising with Google signals. If you have a Google account, the visitor data from Google signals is linked to your Google account and used for personalised advertising messages. The data is also used to compile anonymised statistics on our users' behaviour.

Data processing on our behalf

We have concluded a data processing agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

Google Analytics ecommerce measurement

This website uses the “ecommerce measurement” function of Google Analytics. Ecommerce measurement enables the website operator to analyse website visitors' purchasing behaviour in order to improve its online marketing campaigns. Information such as orders placed, average order values, shipping costs and the time between viewing and purchasing a product is collected. Google may combine this data under a transaction ID assigned to the respective user or their device.

Google Ads

The website operator uses Google Ads. Google Ads is an online advertising programme provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads enables us to display advertisements in Google's search engine or on third-party websites when users enter certain search terms into Google (keyword targeting). Targeted advertisements can also be displayed based on user data held by Google (e.g. location data and interests) (audience targeting). As the website operator, we can evaluate this data quantitatively, for example by analysing which search terms led to our advertisements being displayed and how many advertisements resulted in clicks.

This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Consent may be withdrawn at any time.

Data transfers to the USA are based on the European Commission's Standard Contractual Clauses. Details can be found here: https://policies.google.com/privacy/frameworks and https://business.safety.google/controllerterms/.

The company is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

Google conversion tracking

This website uses Google conversion tracking. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google conversion tracking enables Google and us to identify whether users have performed certain actions. For example, we can evaluate which buttons on our website were clicked and how often, and which products were viewed or purchased particularly frequently. This information is used to compile conversion statistics. We learn the total number of users who clicked on our advertisements and which actions they performed. We do not receive any information that allows us to identify users personally. Google itself uses cookies or comparable recognition technologies for identification.

This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Consent may be withdrawn at any time.

Further information on Google conversion tracking can be found in Google's privacy policy: https://policies.google.com/privacy?hl=de.

The company is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

6. Newsletter

If you order goods or services from us and provide your email address, we may subsequently use this email address to send newsletters, provided that we inform you of this in advance. In such cases, the newsletter will only contain direct advertising for our own similar goods or services. You may unsubscribe from this newsletter at any time. Every newsletter contains a corresponding link for this purpose. In this case, the legal basis for sending the newsletter is Art. 6(1)(f) GDPR in conjunction with Section 7(3) UWG. Naturally, when collecting your email address and each time it is subsequently used, we have clearly informed you that you may object to these emails at any time. You will incur no costs other than transmission costs at basic rates.

We use the email marketing platform SAP Emarsys, a service provided by SAP Deutschland SE & Co. KG, Hasso-Plattner-Ring 7, 69190 Walldorf, to send newsletters. Data is processed on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR. Processing takes place exclusively on servers within the EU. Transfers to third countries only take place where appropriate safeguards within the meaning of Art. 44 et seq. GDPR are in place.

You may object to receiving our existing-customer newsletters at any time with effect for the future. Simply use the unsubscribe link at the end of each email or contact us using the contact details provided in the legal notice.

After you unsubscribe from the newsletter mailing list, we may store your email address on a blacklist to prevent future mailings to you. The data on the blacklist is used solely for this purpose and is not combined with other data. This serves both your interest and our interest in complying with the statutory requirements for sending newsletters (legitimate interest within the meaning of Art. 6(1)(f) GDPR). Storage on the blacklist is not subject to a time limit. You may object to this storage if your interests override our legitimate interest.

7. Ecommerce and payment providers

Processing customer and contract data

We collect, process and use personal customer and contract data to establish, define the content of and amend our contractual relationships. We collect, process and use personal data relating to the use of this website (usage data) only to the extent necessary to enable users to use the service or to bill them for it. The legal basis for this is Art. 6(1)(b) GDPR.

The customer data collected is deleted after completion of the order or termination of the business relationship and expiry of any applicable statutory retention periods. Statutory retention periods remain unaffected.

Data transfers when concluding contracts for online shops, retailers and shipping goods

When you order goods from us, we disclose your personal data to the transport company entrusted with delivery and the payment service provider entrusted with processing payment. Only the data required by the respective service provider to perform its task is disclosed. The legal basis for this is Art. 6(1)(b) GDPR, which permits the processing of data for the performance of a contract or to take steps prior to entering into a contract. If you have given corresponding consent pursuant to Art. 6(1)(a) GDPR, we will pass your email address to the transport company entrusted with delivery so that it can inform you by email about the shipping status of your order; you may withdraw this consent at any time.

Payment services

We integrate payment services provided by third-party companies into our website. If you make a purchase from us, your payment details (e.g. name, payment amount, bank details, credit card number) are processed by the payment service provider for the purpose of processing payment. The respective providers' contractual and data protection provisions apply to these transactions. Payment service providers are used on the basis of Art. 6(1)(b) GDPR (contract performance) and in the interest of ensuring a payment process that is as smooth, convenient and secure as possible (Art. 6(1)(f) GDPR). Where your consent is requested for certain actions, Art. 6(1)(a) GDPR is the legal basis for data processing; consent may be withdrawn at any time with effect for the future.

We use the following payment services/payment service providers on this website:

Payments by Credit card

Provider:

VR-Pay” provided by Card-Process-GmbH

CardProcess GmbH
Wachhausstraße 4
76227 Karlsruhe

The legal basis for this processing is Art. 6(1)(b) GDPR:

Performance of a purchase contract.

Allianz Trade pay

If you choose payment by invoice, we reserve the right, in order to safeguard our legitimate interests, to carry out a credit check via Allianz Trade pay, provided by Euler Hermes Services SAS, 1 place des Saisons, 92048 Paris – La Défense, France.

For this purpose, we transmit the company, contact and order data required for the credit check to Allianz Trade. We use the information received to assess the risk of payment default and to decide whether to make the respective payment method available.

The legal basis for this is Art. 6(1)(f) GDPR. Our legitimate interest lies in preventing payment defaults and securing receivables.

Albis-Leasing

The ALBIS Leasing Group, Ifflandstraße 4, 22087 Hamburg, Germany (“Albis”), provides the leasing financing option available during checkout. If you choose this payment method, you submit a leasing application directly to Albis. Your data is processed and stored for the purpose of taking steps prior to entering into a contract, subsequently performing the leasing agreement and providing related services. Data processing includes a credit check. Personal data relevant to contract performance may include:

• First and last name / salutation / title / company / legal form

• Contact details

• Date of birth

• Creditworthiness data

• Bank account details

• Identity document details

• Billing address

• Delivery address

• IP address, including browser and device information

• Shop order number

• Payment amount

The legal basis for data processing is Art. 6(1)(f) GDPR.

Further information about Albis's privacy policy can be found at https://www.albis-leasing.de/datenschutz

PayPal

The provider of this payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”).

Data transfers to the USA are based on the European Commission's Standard Contractual Clauses. Details can be found here: https://www.paypal.com/de/webapps/mpp/ua/pocpsa-full.

For details, please refer to PayPal's privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Apple Pay

The provider of this payment service is Apple Inc., Infinite Loop, Cupertino, CA 95014, USA. Apple's privacy policy can be found at: https://www.apple.com/legal/privacy/de-ww/.

Google Pay

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google's privacy policy can be found here: https://policies.google.com/privacy.

Klarna

The provider is Klarna AB, Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter “Klarna”). Klarna offers various payment options (e.g. payment by instalments). If you choose to pay with Klarna (Klarna checkout solution), Klarna will collect various personal data from you. Klarna uses cookies to optimise the use of the Klarna checkout solution. Details on the use of Klarna cookies can be found at the following link: https://cdn.klarna.com/1.0/shared/content/policy/cookie/de_de/checkout.pdf.

Further details can be found in Klarna's privacy policy at the following link: https://www.klarna.com/de/datenschutz/.

Paydirekt

The provider of this payment service is Paydirekt GmbH, Hamburger Allee 26-28, 60486 Frankfurt am Main, Germany (hereinafter “Paydirekt”). If you pay using Paydirekt, Paydirekt collects various transaction data and forwards it to the bank with which you are registered for Paydirekt. In addition to the data required for payment, Paydirekt may collect further data during transaction processing, such as your delivery address or individual items in your shopping cart. Paydirekt then authenticates the transaction using the authentication procedure held by the bank for this purpose. The payment amount is subsequently transferred from your account to ours. Neither we nor third parties have access to your account details. Details on payment with Paydirekt can be found in Paydirekt's terms and conditions and privacy policy at: https://www.paydirekt.de/agb/index.html.

Sofortüberweisung

The provider of this payment service is Sofort GmbH, Theresienhöhe 12, 80339 München (hereinafter “Sofort GmbH”). The “Sofortüberweisung” procedure provides us with payment confirmation from Sofort GmbH in real time, enabling us to begin fulfilling our obligations immediately. If you choose the “Sofortüberweisung” payment method, you transmit your PIN and a valid TAN to Sofort GmbH, enabling it to log in to your online banking account. After logging in, Sofort GmbH automatically checks your account balance and carries out the transfer to us using the TAN you have provided. It then immediately sends us a transaction confirmation. After logging in, your account transactions, overdraft credit limit and the existence of other accounts and their balances are also checked automatically. In addition to your PIN and TAN, the payment details you enter and your personal data are also transmitted to Sofort GmbH. This personal data includes your first and last name, address, telephone number(s), email address, IP address and, where applicable, other data required to process payment. Transmitting this data is necessary to establish your identity beyond doubt and prevent attempted fraud. Details on payment with Sofortüberweisung can be found at the following link: https://www.klarna.com/sofort/.

American Express

The provider of this payment service is American Express Europe S.A., Theodor-Heuss-Allee 112, 60486 Frankfurt am Main, Germany (hereinafter “American Express”).

American Express may transfer data to its parent company in the USA. Data transfers to the USA are based on Binding Corporate Rules. Details can be found here: https://www.americanexpress.com/en-cz/company/legal/privacy-centre/binding-corporate-rules/.

Further information can be found in American Express's privacy policy: https://www.americanexpress.com/de-de/firma/legal/datenschutz-center/online-datenschutzerklarung/.

Mastercard

The provider of this payment service is Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium (hereinafter “Mastercard”).

Mastercard may transfer data to its parent company in the USA. Data transfers to the USA are based on Mastercard's Binding Corporate Rules. Details can be found here: https://www.mastercard.de/de-de/datenschutz.html and https://www.mastercard.us/content/dam/mccom/global/documents/mastercard-bcrs.pdf.

VISA

The provider of this payment service is Visa Europe Services Inc., London branch, 1 Sheldon Square, London W2 6TT, United Kingdom (hereinafter “VISA”).

The United Kingdom is considered a safe third country under data protection law. This means that the United Kingdom provides a level of data protection equivalent to that in the European Union.

VISA may transfer data to its parent company in the USA. Data transfers to the USA are based on the European Commission's Standard Contractual Clauses. Details can be found here: https://www.visa.de/nutzungsbedingungen/visa-globale-datenschutzmitteilung/mitteilung-zu-zustandigkeitsfragen-fur-den-ewr.html.

Further information can be found in VISA's privacy policy: https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html.