Privacy policy

This Privacy Policy explains how we process personal data when you visit brothersinarms.shop, place an order, contact us or use any of our services. It also tells you which rights you have and how to exercise them.

1. Controller, Personal Data and Other Definitions

This privacy policy informs users of our website about the nature, scope, and purposes of the collection and use of personal data during their use of the website operated by the following company:

SemperFi GmbH

Gluckstraße 10, 65193 Wiesbaden (please do not send returns to this address, see our Return and Refund Policy)

Email: service@brothersinarms.shop

Contact form: contact form

Managing Director: David Hübner

Commercial Register: Amtsgericht Wiesbaden, HRB 34003

VAT ID No.: DE359642835

(hereinafter collectively referred to as "we/us/our")

"Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more specific characteristics that express the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Further definitions of terms can be found in the annex "Definitions".

2. General Information

2.1 Reasons and Legal Bases for Data Processing

We use your data for initiating business relations, fulfilling contractual and legal obligations, executing contractual relationships, offering products and services, ensuring quality, and strengthening customer relations, which may include analyses for marketing purposes and direct advertising. When processing your personal data, the provisions of the EU General Data Protection Regulation (GDPR) and all other applicable data protection regulations are observed. The legal basis for processing personal data may either be your explicit consent (Article 6(1)(a) GDPR) or another basis as stipulated in the applicable data protection laws, particularly the GDPR and the Federal Data Protection Act (BDSG). Where personal data is processed for the purpose of fulfilling a contract, the legal basis is Article 6(1)(b) GDPR. This also applies to processing operations necessary for carrying out pre-contractual measures. If the processing of personal data is necessary to comply with a legal obligation (e.g., statutory retention requirements) to which our company is subject, Article 6(1)(c) GDPR serves as the legal basis. If the vital interests of the data subject or another natural person require the processing of personal data, the legal basis is Article 6(1)(d) GDPR.Where processing is necessary to protect a legitimate interest of our company or a third party, and such interests are not overridden by the interests, fundamental rights, and freedoms of the data subject, Article 6(1)(f) GDPR shall apply as the legal basis for processing. If additional regional or national laws apply, we will inform you accordingly in the following sections.

2.2 Data Deletion and Storage Duration

Personal data of the data subject shall be deleted or blocked as soon as the purpose of storage no longer applies. Data may also be stored if such storage is provided for by European or national legislators in EU regulations, laws, or other legal provisions to which we are subject (e.g. statutory retention periods). Data will also be blocked or deleted if a storage period prescribed by these standards expires, unless further storage of the data is required for the conclusion or performance of a contract. In the case of legal disputes, specific statutory provisions may require longer retention periods, such as compliance with statutory limitation periods. The regular limitation period is between one and three years, but can also extend up to thirty years.

2.3 Hosting / Shop System

2.3.1 Shopify

We use the shop system provided by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"), for the purpose of hosting and displaying the online store based on processing on our behalf. All data collected on our website is processed on Shopify's servers. As part of the aforementioned Shopify services, data may also be transferred for further processing on behalf of the Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada, Shopify Data Processing (USA) Inc., Shopify Payments (USA) Inc., or Shopify (USA) Inc. In case of data transfers to Shopify Inc. in Canada, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission. Further information about Shopify's data protection can be found at: https://www.shopify.com/legal/privacy. Any further processing on servers other than the aforementioned Shopify servers only takes place within the scope communicated below.

2.3.2 Bunny

We use "Bunny," a content delivery network (CDN) provided by BUNNYWAY d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia ("Bunny"). A CDN is an online service used to deliver especially large media files (e.g. graphics, page content or scripts) through a network of regionally distributed servers connected via the internet. Using Bunny's CDN helps us optimize the loading speeds of our website. Bunny does not interact with visitors to our website and does not process any personal visitor data. If processing does occur in individual cases, it is based on Article 6(1)(f) GDPR on the basis of our legitimate interest in secure and efficient provision as well as the improvement of the stability and functionality of our website.

More information is available in Bunny's privacy policy: https://bunny.net/privacy

2.4 Data Security

During your visit to the website, we use the SSL (Secure Socket Layer) or TLS (Transport Layer Security) protocol in conjunction with the highest encryption level supported by your browser. You can recognize whether an individual page of our website is encrypted by the closed display of the key or padlock symbol in the lower status bar of your browser. We also employ suitable technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.

3. Use of the Website

Your visit to our website is possible without having to provide any personal information. However, standard information about the visit is collected automatically without your intervention.

3.1 Provision of the Website, Log Files

Each time our website is accessed, our system automatically collects data and information from the computer system of the requesting device in log files. The following data is collected:

• Information about the browser type and version used
• The user's operating system
• The user's internet service provider
• The user's IP address
• Date and time of access
• Websites from which the user's system accessed our website
• Websites accessed by the user's system via our website
• User ID of the user (on websites requiring login)

The data contained in the log files (e.g. IP address, user ID) can be linked to individual users. Personal data may also be processed, for instance, if the link to the website of origin or destination contains personal information.

3.2 Purpose of Data Processing

The processing of the aforementioned data is carried out for the following purposes:

• To enable the technical functionality of the website
• To authenticate and authorize a user for using the website
• To generate pseudonymized usage statistics (e.g. analysis of usage for optimization and marketing purposes, particularly to improve products)
• To document any contract conclusions or consents in a legally compliant manner
• To prevent data misuse and investigate criminal offenses

3.3 Legal Basis for Data Processing

The legal basis for the temporary storage of data in log files is Article 6(1)(b) GDPR. In this respect, we are fulfilling the contract with the user, even for free services, regarding the use of the website. We also process the data based on our legitimate interests pursuant to Article 6(1)(f) GDPR in order to provide the website/product to you in a technically functional manner. Our legitimate interest lies in providing you with an attractive, technically functioning, user-friendly, and secure website/product. The legal basis for documenting the conclusion of a contract or the granting of consent is Article 6(1)(b) GDPR or alternatively Article 6(1)(f) GDPR. Our legitimate interest lies in the proper documentation of contract conclusions/consents, in order to be able to prove the granting of consent or the contract conclusion in case of disputes. If we process data for the purpose of generating pseudonymized usage statistics, the legal basis is Article 6(1)(f) GDPR. In this case, our interest in understanding user behavior and thereby enabling continuous optimization of our offerings outweighs the fundamental rights and freedoms of users. In this balancing of interests, we particularly took into account the categories of data processed (IP address, user ID) and their pseudonymized processing. Also considered was the necessity of the processing in achieving the intended purpose, which may also be beneficial to the user.

3.4 Duration of Storage

Data is deleted as soon as it is no longer required for the purpose for which it was collected. In the case of data collected to provide the website, this is the case when the respective session has ended. In the case of storage in log files, this is the case after a maximum of ninety days. Data will not be stored beyond this period. In such cases, the users' IP addresses are either deleted or anonymized so that an association with the accessing client is no longer possible.

3.5 Right to Object

The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. Therefore, users have no right to object in this respect. Users may object at any time to the processing of their data for the creation of anonymous usage statistics. For more details, please refer to Section 11 "Your rights as a data subject."

4. Cookies

When using our website, cookies are used. The purpose of cookies is to personalize the website experience for the user and to facilitate its use. A cookie typically contains the name of the domain from which the cookie originates, the "lifetime" of the cookie, and a unique identifier. Cookies are either stored temporarily for the duration of a session (session cookies) or permanently (persistent cookies) on your end device. Session cookies are automatically deleted at the end of your visit. Persistent cookies remain stored on your end device until you delete them yourself or your web browser deletes them automatically. In some cases, cookies from third-party companies (third-party cookies) may also be stored on your device when you visit our site. These cookies enable us or you to use certain services of the third-party provider (e.g. cookies for handling payment services). Cookies serve various functions. Many cookies are technically necessary because certain website functions would not work without them (e.g. the shopping cart function or the display of videos). Other cookies are used to analyze user behavior or to display advertising. Cookies that are necessary for the performance of the electronic communication process (necessary cookies) or for providing certain functions desired by you (functional cookies, e.g. for the shopping cart function), or for optimizing the website (e.g. cookies for measuring the web audience), are stored on the basis of Article 6(1)(f) GDPR, unless another legal basis is specified. The website operator has a legitimate interest in the storage of cookies to ensure the technically error-free and optimized provision of its services. Where consent to the storage of cookies has been requested, the relevant cookies are stored solely on the basis of this consent (Article 6(1)(a) GDPR); the consent can be revoked at any time.

4.1 Browser Settings / Plug-ins

You can also control the use of cookies through appropriate settings in your browser, provided such options are supported.

5. Tools and Services

5.1 Microsoft Clarity

This website uses the web analytics service provided by:

Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA.

Using cookies and/or similar technologies (tracking pixels, web beacons, algorithms to read device and browser information), the service collects and stores pseudonymized visitor data, including information about the device used (such as the IP address and browser information), for statistical analysis of usage behavior on our website and to create pseudonymized user profiles. Among other things, this allows analysis of movement patterns (so-called heatmaps), showing how long pages were visited and how users interacted with content (e.g. text input, scrolling, clicks, mouse-overs). Pseudonymization fundamentally prevents direct personal identification. No data is merged with other directly identifying data. All of the aforementioned processing, particularly the reading or storage of information on the user's device, is only carried out if you have explicitly consented to it in accordance with Article 6(1)(a) GDPR.

You may withdraw your consent at any time with future effect. We have entered into a data processing agreement with the provider, ensuring that the data of our website visitors is protected and not unlawfully shared with third parties. For data transfers to the USA, the provider participates in the EU-U.S. Data Privacy Framework, which ensures compliance with European data protection standards on the basis of an adequacy decision by the European Commission. For further information about possible third-country transfers, please see section 8.2 "Data Transfers to Third Countries."

5.2 Google Analytics

This website uses features of the web analytics service Google Analytics.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics enables the website operator to analyze the behavior of website visitors. The website operator receives various usage data such as page views, time spent on pages, operating systems used, and the user's origin. These data are compiled into a user ID and assigned to the respective device. Additionally, we can track mouse and scroll movements, clicks, and use of modeling techniques and machine learning for data enhancement. Google Analytics uses technologies that enable user recognition for behavioral analysis (e.g. cookies, device fingerprinting). The information collected is usually transferred to a Google server in the USA and stored there. Use of this service is based on your consent under Article 6(1)(a) GDPR and § 25(1) TDDDG. You may revoke your consent at any time. Data transfer to the USA is based on EU Standard Contractual Clauses. Details: https://privacy.google.com/businesses/controllerterms/mccs/. Google is certified under the EU-U.S. Data Privacy Framework (DPF).

Details: https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt000000001L5AAI&status=ActiveMore information: https://policies.google.com/privacy/frameworks?hl=de see also section 8.2 "Data Transfers to Third Countries"

IP Anonymization

IP anonymization is enabled. Your IP address is shortened by Google within the EU/EEA before transfer to the USA. Only in exceptional cases is the full IP address sent and shortened there. The IP address transmitted by your browser will not be merged with other Google data.

Browser Plugin

You can prevent data collection by installing the browser plugin available here:

https://tools.google.com/dlpage/gaoptout?hl=enFurther information:

https://support.google.com/analytics/answer/6004245?hl=en

We have a data processing agreement with Google and comply with the strict requirements of the German data protection authorities.

5.3 Google Tag Manager

We use Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Tag Manager allows us to integrate tracking or analytics tools and other technologies on our website. The manager itself does not create user profiles, store cookies, or carry out any analyses. It merely facilitates the deployment of integrated tools. However, it does process your IP address, which may be transferred to the parent company in the United States. The use of Google Tag Manager is based on Article 6(1)(f) GDPR.

We have a legitimate interest in the easy and efficient integration and management of tools on our website. Where user consent is obtained, processing is based solely on Article 6(1)(a) GDPR and § 25(1) TDDDG, to the extent it involves storing cookies or accessing information on the user's device (e.g., device fingerprinting). Consent may be revoked at any time. Google is certified under the EU-U.S. Data Privacy Framework (DPF).

Details: https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt00000001L5AAI&status=Active

Also see: https://policies.google.com/privacy/frameworks?hl=de section 8.2 "Data Transfers to Third Countries"

5.4 Google Ads (formerly AdWords Conversions)

We use Google Ads to draw attention to our offerings.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Ads allows us to display advertisements in the Google search engine or on third-party websites when users enter specific search terms (keyword targeting). Targeted ads may also be displayed based on user data held by Google (e.g., location, interests) (audience targeting). As the website operator, we can evaluate this data quantitatively, e.g., by analyzing which keywords led to the display of ads and how many resulted in clicks. Use of this service is based on your consent in accordance with Article 6(1)(a) GDPR and § 25(1) TDDDG. Consent may be revoked at any time.

Ad Server Cookies

Advertisements are delivered by Google via so-called ad servers. In doing so, ad server cookies are used, allowing success metrics such as ad impressions or clicks to be measured. If you reach our website via a Google ad, a cookie will be stored on your computer by Google Ads. This cookie typically stores:

• A unique cookie ID
• Number of ad impressions per placement (frequency)
• Last impression (relevant for post-view conversions)
• Opt-out information (e.g., user's choice not to be targeted again)

These cookies allow Google to recognize your browser. If a user visits certain pages of an Ads client's website and the stored cookie has not yet expired, Google and the client can detect that the user clicked the ad and was redirected to that page. Each Ads client receives a different cookie, so cookies cannot be tracked across Ads clients' websites.

Ad server cookies generally expire after 30 days and are not intended to personally identify you.

Data Transmission to Google

Due to the use of these marketing tools, your browser automatically connects directly to Google servers. We have no control over the extent or further use of the data collected by Google through this tool. According to our knowledge, Google receives information that you have accessed a specific section of our website or clicked one of our ads. If you are registered with a Google service, Google may associate your visit with your account. Even if you are not registered or logged in, Google may still obtain and store your IP address.

Opt-Out Options

You can prevent participation in this tracking process in various ways:

1. By adjusting your browser settings to block third-party cookies (you will then not receive ads from third-party providers)
2. By disabling cookies for conversion tracking via browser settings that block cookies from www.googleadservices.com: https://www.google.de/settings/ads
3. By disabling interest-based advertising from providers who are part of the "About Ads" self-regulation campaign: http://www.aboutads.info/choices
4. By permanently deactivating it in your browser (e.g., via plugin): http://www.google.com/settings/ads/plugin

Please note: If you disable cookies, some website functions may no longer work properly. We do not collect or process any personal data through these advertising measures. We only receive statistical reports from Google. These reports allow us to understand which advertising methods are effective. We do not receive data that enables us to identify users. For information about potential data transfers to third countries, see: https://policies.google.com/privacy/frameworks?hl=de and section 8.2 "Data Transfers to Third Countries".

5.5 Google Ads Remarketing

This website uses the features of Google Ads Remarketing.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). With Google Ads Remarketing, we can assign individuals who interact with our online offer to specific audience segments, and then show them interest-based advertisements in the Google advertising network (remarketing or retargeting). The advertising audiences created via Google Ads Remarketing may be linked to Google's cross-device features. This means that personalized advertising messages based on your previous usage and browsing behavior on one device (e.g., smartphone) may also be displayed on another device (e.g., tablet or PC). If you have a Google account, you can opt out of personalized advertising via the following link:

https://adssettings.google.com/anonymous?hl=de. Use of this service is based on your consent under Article 6(1)(a) GDPR and § 25(1) TDDDG.

You may revoke your consent at any time. More information and Google's privacy policy:

https://policies.google.com/technologies/ads?hl=de. Google is certified under the EU-U.S. Data Privacy Framework (DPF).

Certification details:

https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt00000001L5AAI&status=ActiveFor more information on possible third-country data transfers, see: https://policies.google.com/privacy/frameworks?hl=de

and section 8.2 "Data Transfers to Third Countries".

Audience Matching via Customer Data

For audience creation, we use customer matching through Google Ads Remarketing. We transmit selected customer data (e.g. email addresses) from our customer lists to Google. If those individuals are Google users and logged into their Google accounts, they are shown matching ads across the Google network (e.g., on YouTube, Gmail, or in the search engine).

5.6 Google My Business

We maintain a so-called Google My Business listing.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). When visiting and interacting with our Google My Business entry, Google collects your IP address and other information stored as cookies on your device. This data is used to provide us, as the operator of the Google My Business listing, with statistical insights on the use of Google services. When accessing Google services, the IP address assigned to your device is transmitted to Google. Furthermore, Google stores information about users' devices; under certain circumstances, this may allow IP addresses to be associated with individual users or user accounts. If you contact us via direct message through our Google My Business profile or other Google services, we cannot rule out the possibility that these messages may also be read and analyzed by Google, either by staff or via automated systems. We delete such conversations no later than 14 days after the last chat activity, or immediately after switching to another communication channel. The scope and purpose of data collection and further processing and use of the data by Google, as well as your rights and options for privacy settings, can be found in Google's privacy policy:

https://www.google.com/policies/privacy/partners/?hl=de. We, as the provider of the Google My Business profile, do not collect or process any further data from your use of this Google service.

Google processes your data, including in the USA.For more information about potential third-country data transfers, see: https://policies.google.com/privacy/frameworks?hl=de

and section 8.2 "Data Transfers to Third Countries".

5.7 Google Conversion Tracking

This website uses Google Conversion Tracking.

Provider: Google Ireland Limited ("Google"). Google Conversion Tracking allows Google and us to determine whether a user has completed certain actions. For example, we can assess which buttons on our website are clicked, how often, and which products are most frequently viewed or purchased. This data is used to generate conversion statistics. We learn the total number of users who clicked on our ads and which actions they took. However, we do not receive any information that allows us to personally identify users. Google uses cookies or comparable recognition technologies for this purpose. Use of this service is based on your consent under Article 6(1)(a) GDPR and § 25(1) TDDDG.

Consent may be revoked at any time. Further information:

https://policies.google.com/privacy?hl=de. Google is certified under the EU-U.S. Data Privacy Framework (DPF). This framework is an agreement between the EU and the USA ensuring that US data processing complies with European data protection standards. Certification details:

https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt00000001L5AAI&status=ActiveMore information on potential third-country data transfers: https://policies.google.com/privacy/frameworks?hl=de

and section 8.2 "Data Transfers to Third Countries"

5.8 Google Customer Reviews

We participate in the Google Customer Reviews program.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). This program allows us to collect customer reviews from users of our website. After visiting our site, you may be asked if you would like to participate in a Google email survey. If you give your explicit consent in accordance with Article 6(1)(a) GDPR and § 25(1) TDDDG, we will transmit your email address to Google. You will then receive an email from Google Customer Reviews asking you to rate your experience on our website. Your review will be aggregated with other reviews and displayed in our Google Customer Reviews badge and in our Merchant Center dashboard. As part of this program, personal data may also be transferred to Google servers in the USA.

Further details on potential data transfers to third countries are available at: https://policies.google.com/privacy/frameworks?hl=de

and in section 8.2 "Data Transfers to Third Countries."For more information about Google's data protection in connection with the Customer Reviews program, visit: https://support.google.com/merchants/answer/7188525?hl=de

5.9 Google Marketing Platform

We use Google Marketing Platform products on our website.

These include various tools such as Data Studio, Surveys, Campaign Manager 360, Display & Video 360, or Search Ads 360.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The use of this analytics tool is based on Article 6(1)(f) GDPR.

Our legitimate interest lies in enabling us to:

• Display relevant ads to users
• Improve campaign performance reports
• Avoid showing the same ad multiple times to the same user

Using a cookie ID, Google determines which ads were shown in which browser and can prevent them from being displayed multiple times.

Additionally, conversions related to ad requests can be tracked via cookie IDs. Due to the tools used, your browser automatically connects directly to Google's servers. We have no influence on the scope and further use of the data collected by Google through this tool and inform you based on the level of our knowledge. Through the integration of these tools, Google learns that you have accessed a specific part of our website or clicked on one of our ads. If you are registered with a Google service, Google may associate the visit with your account. Even if you are not registered or logged in, Google may still obtain and store your IP address.

Opt-Out Options

You can prevent participation in tracking in several ways:

1. By configuring your browser to block third-party cookies
2. By disabling cookies for conversion tracking by blocking cookies from www.googleadservices.com: https://www.google.de/settings/ads
3. By opting out of interest-based ads via the "About Ads" campaign: http://www.aboutads.info/choices
4. By installing the Google browser plugin: http://www.google.com/settings/ads/plugin

Note: Some functions of our website may not be available if cookies are disabled. More information about potential third-country data transfers can be found at: https://policies.google.com/privacy/frameworks?hl=de and section 8.2 "Data Transfers to Third Countries."

5.10 Google Conversion Tracking, Additional Information

This website uses Google Conversion Tracking.

Provider: Google Ireland Limited ("Google"). With the help of Google Conversion Tracking, Google and we can determine whether users have taken certain actions. For example, we can analyze which buttons on our website are clicked, how often, and which products are viewed or purchased most frequently. This data is used to generate conversion statistics. We learn the total number of users who clicked on our ads and what actions they performed. We do not receive any information that personally identifies users. Google itself uses cookies or similar recognition technologies for this purpose. The use of this service is based on your consent pursuant to Article 6(1)(a) GDPR and § 25(1) TDDDG.

You may revoke your consent at any time. More information: https://policies.google.com/privacy?hl=de. Google is certified under the EU-U.S. Data Privacy Framework (DPF).

This framework ensures compliance with European data protection standards for processing in the USA.Certification details:

https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt00000001L5AAI&status=ActiveMore on third-country data transfers: https://policies.google.com/privacy/frameworks?hl=de and section 8.2 "Data Transfers to Third Countries."

5.11 Meta Pixel (formerly Facebook Pixel)

This website uses the Meta Pixel (also known as Facebook Pixel) for conversion tracking.

Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. According to Meta, the data collected may also be transferred to the USA or other third countries.

This allows us to track the behavior of visitors after they have clicked on a Facebook ad and been redirected to the provider's website. This enables evaluation of the effectiveness of Facebook ads for statistical and market research purposes and to optimize future advertising efforts. The data collected is anonymous for us as the website operator, we cannot draw conclusions about users' identities.

However, Meta stores and processes the data so that a connection to the respective user profile may be possible. Meta may use this data for its own advertising purposes in accordance with the Facebook Data Usage Policy: https://de-de.facebook.com/about/privacy/. Meta can thereby enable ads on and off Facebook. We, as the website operator, have no influence on this use of data. The use of this service is based on your consent under Article 6(1)(a) GDPR and § 25(1) TDDDG.

Consent may be revoked at any time.

Advanced Matching

We use the advanced matching function within the Meta Pixel. This allows us to transmit various types of data (e.g., location, postal code, hashed email addresses, names, gender, date of birth, or telephone numbers) that we collect on our website to Meta (Facebook). This helps us better tailor our Facebook advertising campaigns to people likely to be interested in our offers. It also improves attribution of website conversions and expands custom audiences.

Joint Responsibility (Art. 26 GDPR)

Where personal data is collected on our website and transmitted to Facebook via this tool, we and Meta Platforms Ireland Limited are jointly responsible (Article 26 GDPR).

The joint responsibility only covers the collection and transmission of the data. Processing by Facebook after transmission is not included. The joint responsibility is documented in the "Controller Addendum": https://www.facebook.com/legal/controller_addendum. Under this agreement, we are responsible for:

• Providing privacy notices when using Facebook tools
• Implementing the tool in a GDPR-compliant manner on our website

Facebook is responsible for the data security of Facebook products and handling data subject rights requests related to data processed by Facebook.

If you assert your data subject rights with us, we are required to forward your request to Facebook. Data transfers to the USA are based on EU Standard Contractual Clauses.

Details: https://www.facebook.com/legal/EU_data_transfer_addendum

https://de-de.facebook.com/help/566994660333381. More info on privacy: https://de-de.facebook.com/about/privacy/. You can deactivate Custom Audiences via your Facebook ad preferences: https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen (login required)-

If you don't have a Facebook account, you can disable behavior-based ads via:

http://www.youronlinechoices.com/de/praferenzmanagement/. Meta is certified under the EU-U.S. Data Privacy Framework (DPF).

Certification details:

https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt000000GnywAAC&status=ActiveSee also section 8.2 "Data Transfers to Third Countries."

5.12 TikTok Ads and TikTok Pixel

5.12.1 TikTok Pixel Usage

We use TikTok Ads in combination with the "TikTok Pixel".

The TikTok Pixel is a code embedded on our profile that transmits events from website visitors to us. With TikTok Pixel, we can evaluate the success of our advertising campaigns. When the ad is loaded, a technical procedure allows us to determine how a user interacts with the site after clicking on the advertisement and whether one of our services was actually used. This provides us with statistical information, such as:

• The total number of ad views
• Which ads were most effective
• Which user actions were triggered (e.g., visiting the website, placing an order)

The legal basis for this processing is Article 6(1)(f) GDPR.

We have a legitimate interest in promoting our services through advertising and in planning, executing, and optimizing advertising campaigns more effectively. These purposes constitute the legal basis for our legitimate interest.

5.12.2 Data Processing by TikTok for Own Purposes

Please note that TikTok also uses the above-mentioned data for its own purposes.

TikTok remains the sole controller for these processing activities. We have no control over how TikTok processes this data. Therefore, we refer you to TikTok's Privacy Policy and Cookie Guidelines. In particular, we cannot predict the exact scope and purpose of TikTok's data processing. Please consult the following:

• TikTok's Global Privacy Policy (Web, Apps, Services): https://www.tiktok.com/legal/page/eea/privacy-policy/de-DE
• TikTok Cookie Policy: https://www.tiktok.com/legal/tiktok-website-cookies-policy?lang=en https://www.tiktok.com/legal/page/global/cookie-policy/de-DE

TikTok's Tracking Technologies

TikTok uses cookies, pixels, and local storage to record and evaluate your interactions with the website.

This allows TikTok to recognize users and use the data for analytics and advertising purposes.

Personalization and Privacy Settings

You can find information on available personalization and privacy settings here:

https://support.tiktok.com/de/account-and-privacy/account-privacy-settingsYou can also request data access or submit archive requests via the TikTok Privacy Form:

https://www.tiktok.com/legal/report/privacy?lang=de

Disabling Personalized Ads

You can change your preferences for personalized ads here:

https://support.tiktok.com/de/account-and-privacy/personalized-ads-and-data

5.13 Triple Whale Analytics

Our website uses the web analytics service provided by Triple Whale Inc.,

7th Floor, Jaffa St 224, Jerusalem, Israel. Using cookies and/or similar technologies (e.g., tracking pixels, web beacons, algorithms for reading device and browser data), the service collects and stores pseudonymized visitor data, including device-related information such as IP address and browser data, for the purpose of statistical analysis of usage behavior and to generate pseudonymized user profiles. Among other things, this enables the evaluation of movement patterns (so-called heatmaps) showing the duration of visits to specific pages as well as interactions with content (e.g. text input, scrolling, clicks, and mouseovers). The pseudonymization of data generally prevents any direct association with a specific individual. There is no merging of this data with other identifiers that would allow personal identification. All processing operations described above, including the reading or storing of information on your end device, are carried out only if you have given explicit consent in accordance with Article 6(1)(a) GDPR.

You can revoke your consent at any time with future effect. We have entered into a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties. Where data is transmitted to the provider's location, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission. For more details on possible third-country data transfers, see section 8.2 "Data Transfers to Third Countries."

5.14 Cloudflare

Our website uses services from Cloudflare, Inc.,

represented in Germany by Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich,

to enhance website security and performance.

The legal basis for this is Article 6(1)(f) GDPR.If you do not agree with this data processing, you may choose not to use our website.

The services we use include:

• Cloudflare CDN: A content delivery network that improves loading times by delivering content from a server geographically closer to the user.
• Cloudflare Universal SSL Certificate: Provides encrypted communication between your browser and our website.
• Cloudflare Web Application Firewall (WAF): Protects our website from malicious attacks and security threats.
• Cloudflare Turnstile: A CAPTCHA system that prevents automated bot access without requiring real users to solve puzzles.

What data does Cloudflare process?

Cloudflare may gain access to your IP address, system configuration data, and other information about traffic to and from the website to deliver its services. This data may be stored outside the European Economic Area, including in the United States. Cloudflare is certified under the Trans-Atlantic Data Privacy Framework, which ensures an adequate level of data protection in accordance with EU standards.

Additionally, we have entered into Standard Contractual Clauses (SCCs) with Cloudflare, which can be viewed here: https://www.cloudflare.com/cloudflare_customer_SCCs-German.pdf. For further information about Cloudflare's data protection practices, please refer to their privacy policy: https://www.cloudflare.com/privacypolicy/. Also see section 8.2 "Data Transfers to Third Countries."

5.15 ProfitMetrics

We use ProfitMetrics, a profitability tracking service for online stores. ProfitMetrics receives data about completed orders, in particular order value, ordered products, costs and margins, currency, country and the marketing channel through which an order was generated. On this basis it calculates contribution margins and transmits profit based conversion values to advertising platforms such as Google and Meta.

The purpose is to measure and control our advertising on the basis of actual profit instead of revenue. The legal basis is Art. 6 (1) (f) GDPR, our legitimate interest in economically effective advertising. Where cookies or comparable technologies are stored on your device for this purpose, this is done on the basis of your consent under Art. 6 (1) (a) GDPR in conjunction with section 25 (1) TDDDG. You can withdraw your consent at any time via the cookie settings.

Further information is available at profitmetrics.io.

5.16 Data Processing by Social Networks

We maintain publicly accessible profiles on various social networks.

These social media presences are intended to ensure the broadest possible visibility of our business online. This constitutes a legitimate interest pursuant to Article 6(1)(f) GDPR.Social networks typically analyze your user behavior extensively when you visit their websites or websites that incorporate social media content (e.g., Like buttons or advertising banners). Visiting our social media profiles may trigger numerous data protection-relevant processing operations. If you are logged into your social media account while visiting our presence, the platform operator can assign this visit to your user account. Even if you are not logged in or do not have an account, data may still be collected, for example via cookies stored on your device or by capturing your IP address. These data can be used by platform operators to create user profiles, which in turn are used to show you interest-based advertising both within and outside the platform. If you have an account, such advertising may be shown across all your devices. When you visit one of our social media profiles, we are jointly responsible with the respective platform operator for the data processing activities triggered by your visit (cf. Art. 26 GDPR). You can assert your data subject rights (see section 11) both with us and with the platform operator. Please note that our influence on the platform-specific data processing is limited. The applicable processing operations depend largely on each platform's corporate policies. For details, please refer to the privacy policies and terms of use of the respective providers listed below.

5.16.1 Facebook

We maintain a profile on Facebook.

Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. According to Meta, data collected may be transferred to the USA or other third countries. We have signed a joint controller agreement (Controller Addendum) with Facebook, which specifies the responsibilities of each party when you visit our Facebook page.

You can access this agreement here: https://www.facebook.com/legal/terms/page_controller_addendum. You can customize your ad preferences and opt out of ad targeting: https://www.facebook.com/settings?tab=ads

http://www.youronlinechoices.com. Privacy policy: https://www.facebook.com/about/privacy/

5.16.2 YouTube

We maintain a profile on YouTube.

Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Details about how your data is handled:

• Privacy policy: https://policies.google.com/privacy
• Opt-out tools: https://tools.google.com/dlpage/gaoptout?hl=de http://www.youronlinechoices.com

5.16.3 TikTok

We maintain a profile on TikTok, operated in the EU by TikTok Technology Limited,

10 Earlsfort Terrace, Dublin, D02 T380, Ireland. More information about TikTok's data processing can be found here:

• Privacy policy: https://www.tiktok.com/legal/privacy-policy?lang=de
• Opt-out: https://support.tiktok.com/en/account-and-privacy/personalized-ads-and-data/personalization-and-data http://www.youronlinechoices.com

5.16.4 Instagram

We maintain a profile on Instagram.

Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. More information about privacy and third-country data transfers:

• EU SCC Addendum: https://www.facebook.com/legal/EU_data_transfer_addendum
• Instagram Help Center: https://help.instagram.com/519522125107875
• Facebook data transfer guidance: https://de-de.facebook.com/help/566994660333381

Privacy policy: https://help.instagram.com/519522125107875

Opt-out: http://www.networkadvertising.org/managing/opt_out.asp

http://www.youronlinechoices.com

5.16.5 Spotify

We maintain a profile on Spotify, and our website integrates Spotify content.

Provider: Spotify AB, Birger Jarlsgatan 61, 113 56 Stockholm, Sweden. Before any Spotify content is displayed, we ask for your consent. Once granted, Spotify elements are loaded and may establish a direct connection between your browser and Spotify's servers. This gives Spotify your IP address and knowledge of your visit to our site. If you are logged into your Spotify account, you may be able to link content from our website to your Spotify profile, allowing Spotify to associate the visit with your account. Note: Spotify may use Google Analytics cookies, potentially transferring your data to Google LLC in the USA. We, as website operators, have no influence over this processing. Spotify is solely responsible. Processing is based on Article 6(1)(a) GDPR.

Consent may be revoked at any time. Spotify privacy policy: https://www.spotify.com/de/legal/privacy-policy/. To prevent association with your Spotify account, log out before viewing Spotify content.

To revoke consent for Spotify integration, toggle the relevant switch below embedded content.

5.17 Redirects to External Websites

Our website may contain links to third-party websites. When you click such a link, you will be redirected to the external website of the respective provider. Please note that different privacy policies may apply on those external websites, over which we have no control.

We therefore recommend that you review the privacy policies on those websites to understand how your personal data is handled there.

5.18 Inquiries (Contact Requests, Reviews)

5.18.1 Contact by Email, Telephone or Contact Form

If you contact us via email or telephone, your inquiry, including all personal data you voluntarily provide (such as name and contact details), will be stored and processed by us for the purpose of handling your request. We do not disclose this data without your consent. The legal basis for this processing is:

• Article 6(1)(b) GDPR if your inquiry is related to a contractual obligation or pre-contractual measure;
• Article 6(1)(f) GDPR if the inquiry is general and we have a legitimate interest in efficiently responding to inquiries;
• or Article 6(1)(a) GDPR, if your explicit consent is required and has been obtained.

The data you provide will remain with us until:

• You request its deletion,
• You revoke your consent to storage, or
• The purpose for which the data was stored no longer applies (e.g. your request has been processed).

Mandatory legal retention obligations remain unaffected.

5.18.2 Contact via Contact Form

If you submit a request via our contact form, the data you enter, including your contact information, will be stored and processed by us for the purpose of responding to your inquiry and any follow-up questions. We follow the principle of data minimization and will not share your data without your consent. Processing is based exclusively on your consent under Article 6(1)(a) GDPR.The data you provide via the contact form will remain with us until:

• You request deletion,
• You withdraw your consent to storage, or
• The purpose of storage no longer applies.

Statutory retention requirements remain unaffected.

5.18.3 Reviews.io

We use the services of Reviews.io 2020 GmbH,

Skalitzer Str. 104, 10997 Berlin, Germany, for sending review reminders. Based solely on your explicit consent under Article 6(1)(a) GDPR, we may forward your email address and, if applicable, other customer data to Reviews.io so that they can contact you via email to request a review. You may revoke your consent at any time with future effect by contacting us or Reviews.io. We have entered into a data processing agreement with Reviews.io, ensuring the protection of your data and preventing any unauthorized disclosure to third parties.

5.19 Newsletter

Our email newsletters are sent via the provider Klaviyo,

225 Franklin St, Boston, MA 02110, USA

https://www.klaviyo.com/. When you sign up for the newsletter, your data provided during registration is transmitted to Klaviyo. This transfer is based on Article 6(1)(f) GDPR and serves our legitimate interest in using an effective, secure, and user-friendly newsletter system. Please note: your data is usually transmitted to and stored on a Klaviyo server in the USA.Klaviyo uses this data solely to send newsletters on our behalf.

Klaviyo does not use this data to contact you independently or share it with third parties. To safeguard your data in the USA, we have signed a data processing agreement ("Data Processing Agreement") with Klaviyo. This contract obliges Klaviyo to:

• Protect user data,
• Process it in accordance with our instructions and data protection rules,
• And, in particular, not disclose it to third parties.

You can review Klaviyo's privacy policy here: https://www.klaviyo.com/privacy

5.20 Disclosure of Personal Data to Shipping Providers

5.20.1 Deutsche Post

If your order is shipped via Deutsche Post (Deutsche Post AG, Charles-de-Gaulle-Strasse 20, 53113 Bonn), we will share your email address with Deutsche Post in advance only if you have explicitly consented to this during the order process (Article 6(1)(a) GDPR), so that delivery details can be coordinated or you can receive delivery notifications. If no such consent is provided, we will share only the recipient's name and delivery address with Deutsche Post pursuant to Article 6(1)(b) GDPR for the sole purpose of fulfilling the delivery. In this case, no prior coordination or delivery notification is possible. You may revoke your consent at any time with future effect, either by contacting us or Deutsche Post directly.

5.20.2 DHL

If your order is shipped via DHL (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn), we will share your email address with DHL only if you have explicitly consented to this during the ordering process (Article 6(1)(a) GDPR), so you can be contacted regarding delivery times or receive delivery updates. If you do not give consent, we will share only the name and address of the recipient with DHL (Article 6(1)(b) GDPR), solely to enable delivery.

In such cases, no prior coordination or notification is possible. You may withdraw your consent at any time with future effect by contacting us or DHL directly.

5.21 BixGrow Affiliate Program

We operate an affiliate and referral program using the BixGrow app. If you reach our store through an affiliate link or a referral link, a cookie or a comparable identifier is stored so that the resulting order can be attributed to the referring partner. Processed data includes the referral link used, the time of the visit, order number and order value.

The purpose is the operation and settlement of our partner program. The legal basis is Art. 6 (1) (f) GDPR, our legitimate interest in a measurable partner program, and, for the storage of information on your device, your consent under Art. 6 (1) (a) GDPR in conjunction with section 25 (1) TDDDG.

5.22 Resolvia, Customer Service and Withdrawal Portal

We use Resolvia for two purposes.

Customer service. Inquiries that reach us by email or through our contact form can be processed with AI assistance in order to prepare or send a reply. Processed data includes your name, email address, order number and the content of your message.

Withdrawal portal. Our withdrawal page at bia.retoure-anmelden.de is operated by Resolvia on our behalf on a separate domain. If you declare a withdrawal there, your email address and your order number are processed in order to identify your order, and your withdrawal declaration is recorded and forwarded to us. That page has its own legal notice and its own privacy information.

The legal basis is Art. 6 (1) (b) GDPR for the performance of the contract and the handling of your withdrawal, and Art. 6 (1) (c) GDPR for our statutory obligation to confirm receipt of a withdrawal without delay. For general inquiries outside a contractual relationship, the legal basis is Art. 6 (1) (f) GDPR, our legitimate interest in answering your inquiry.

6. Payments, Payment Services, Credit Checks and Accounting

6.1 PayPal

Our website offers one or more payment methods via the following provider:

PayPal (Europe) S.à r.l. et Cie, S.C.A.,

22-24 Boulevard Royal, L-2449 Luxembourg. If you choose a payment method that requires advance payment on your part, we transmit certain payment-related information (e.g., name, address, bank or card details, currency, transaction ID) and order details in accordance with Article 6(1)(b) GDPR to PayPal.

This data transfer is made solely for the purpose of processing the payment and only to the extent necessary. If you select a payment method that does not require advance payment, you will be required to provide personal information during the order process (e.g., name, address, date of birth, email address, telephone number, and, if applicable, information about alternative payment methods). To protect our legitimate interest in checking your creditworthiness, we may transmit this data to PayPal in accordance with Article 6(1)(f) GDPR. PayPal then uses your information, together with other indicators (e.g., order history, payment behavior, invoice amount), to assess the risk and to determine whether the selected payment method should be approved. Score values based on mathematical-statistical procedures may also be included in the credit check. These scores may incorporate address data, among other factors. You have the right to object to the processing of your data at any time by notifying us or PayPal.

However, PayPal may continue to use the data if it is required for contractual payment processing.

6.2 Shopify Payments

We use Shopify Payments to process payments, operated by:

Shopify International Ltd.,

3rd Floor, Europa House, Harcourt Building, Harcourt Street, Dublin 2, Ireland. If you choose a payment method offered via Shopify Payments, the technical processing is carried out by:

Stripe Payments Europe Ltd.,

1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. In this context, we transmit the following data in accordance with Article 6(1)(b) GDPR:

• Your payment information collected during checkout
• Order-related information (e.g., name, address, bank details, credit card data, amount, currency, transaction number)

This transfer occurs solely for the purpose of payment processing and only to the extent required. You can find details about data protection at Shopify Payments here:

https://www.shopify.com/legal/privacy. Information on data handling by Stripe is available at: https://stripe.com/de/privacy

6.3 Klarna

If you choose the "purchase on account" or, if available, "installment purchase" option via Klarna, the payment is processed by:

Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden ("Klarna"). To provide these services, we transmit certain personal data to Klarna.

This may include:

• Full name
• Address, postal code, city
• Gender
• Email address
• Phone number
• IP address

Additionally, order-related data may be transferred (e.g., invoice amount, items ordered, selected shipping method), only if you have given explicit consent during the checkout process. This data allows Klarna to:

• Verify your identity, and
• Assess your creditworthiness

Klarna may consult data from credit agencies listed here: https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_ch/credit_rating_agencies

Scoring and Credit Assessment

As part of the credit assessment, so-called score values may be used.

These probability scores are based on mathematically-statistical models and may incorporate address data. Based on this information, Klarna decides whether, and under what conditions, a contract with you can be concluded or continued. You may withdraw your consent to data processing at any time, either with Klarna or with us.

However, this does not affect Klarna's right to process your data if required for the fulfillment of an existing contract. For more information about Klarna's data protection practices, see:

https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_ch/privacy_bp

6.4 Apple Pay

If you choose Apple Pay as a payment method on our website, the payment is processed by:

Apple Distribution International,

Hollyhill Industrial Estate, Hollyhill, Cork, Ireland ("Apple"). The charge is made through a credit or debit card stored in your Apple Wallet and used via an Apple device (iOS, macOS, or watchOS). Apple Pay protects your payment information using built-in security features in your device's hardware and software. You authorize each transaction via a code, Face ID, or Touch ID.During the payment process:

• Your order and payment information is transmitted in encrypted form to Apple.
• Apple further encrypts this data using a unique, device-specific key before forwarding it to your card provider.

This multilayer encryption ensures that only the website where the purchase occurs has access to your payment data. After a successful transaction, Apple provides the website with:

• A device-specific account number, and
• A dynamic security code for confirmation.

Where personal data is processed during this procedure, it is done solely for the purpose of payment execution pursuant to Article 6(1)(b) GDPR.Apple may store certain transaction details in anonymized form, such as approximate purchase amount, date, time, and transaction success.

This information is not personally identifiable and is used to improve Apple Pay and related services. If you initiate a purchase in Safari on Mac and complete it using Apple Pay on an iPhone or Apple Watch, the devices communicate over an encrypted Apple server connection. No data is processed or stored in a way that allows Apple to identify you. To disable Apple Pay on Mac, go to:

iPhone → Settings → Wallet & Apple Pay → Deactivate "Allow payments on Mac"

More information: https://support.apple.com/de-de/HT203027

6.5 Credit Check

For certain payment methods (e.g., purchase on account or installment payment), we reserve the right to carry out a credit check as part of the ordering process. To do this, we may transmit your:

• First and last name
• Date of birth
• Address

to credit reporting agencies. The legal basis for this is our legitimate interest in avoiding payment defaults, pursuant to Article 6(1)(f) GDPR.The outcome of the credit check, especially the statistical likelihood of payment default helps us decide whether or not to offer the respective payment method. The credit information may include score values, which are calculated using scientifically recognized mathematical-statistical methods.

Address data may also be part of the calculation. You may object to this data processing at any time by notifying us.

However, in that case, certain payment methods may no longer be available to you.

7. Apps and Services in the Shop Backend

In addition to the services described above we use apps inside our Shopify administration. These process order and customer data on our behalf and only to the extent necessary for the respective function. Data processing agreements under Art. 28 GDPR are in place with the providers. The legal basis is Art. 6 (1) (b) GDPR where processing is necessary for the performance of the contract with you, and otherwise Art. 6 (1) (f) GDPR, our legitimate interest in efficient and error free order processing.

7.1 Order Printer Pro

For the accounting and logistical management of orders, we use the service

Order Printer Pro by FORSBERG+TWO,

Tranegårdsvej 74, 2900 Hellerup, Denmark. This service enables the automated creation of:

• Invoices
• Receipts
• Shipping labels
• Other business documents

Where personal order data is processed via this service, it is done exclusively for the proper execution of online orders and on the legal basis of Article 6(1)(b) GDPR.

7.2 AddressHero

We use AddressHero to check and correct delivery addresses. When you enter an address in the checkout, the address data is validated and, where necessary, corrected or completed so that your parcel can be delivered. Processed data includes name, street, house number, postal code, city and country.

7.3 CS Amazon Sync

We also sell through Amazon. CS Amazon Sync transfers orders placed on Amazon into our Shopify administration so that we can fulfil and invoice them. Processed data includes order data, the delivery address and the contact details transmitted by Amazon.

7.4 Matrixify

We use Matrixify to export and import store data, for example for bulk changes, analyses and backups. Depending on the export, this may include order and customer data.

7.5 Further Apps

We also use apps that support the operation of the store without pursuing their own purposes with your data, in particular for shipping label creation with Post and DHL, checkout rules and checkout extensions, automated order tagging, search and product recommendations, post purchase offers, and translation of store content.

8. Recipients of Personal Data

8.1 Categories of Recipients

We share your personal data with the aforementioned service providers and vendors, who support us in delivering our services. Additionally, your data may be transmitted to:

• IT service providers (e.g., for system administration and maintenance)
• Payment providers and banks
• Public authorities and institutions, if we are legally obligated to do so

8.2 Data Transfers to Third Countries

In the context of using certain tools and services, your personal data may be transferred to third countries (outside the European Union). In such cases, the providers are typically contractually bound by the EU Standard Contractual Clauses issued by the European Commission, and where applicable, additional safeguards are implemented.

These clauses ensure compliance with the data protection level of the European Union. You can find the relevant Commission Decision and Standard Contractual Clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

Important Note on Third-Country Risks

Despite contractual and technical safeguards, the level of data protection in some third countries may not be equivalent to that of the EU.When such transfers occur, the legal basis is your explicit consent in accordance with Article 49(1)(a) GDPR, which is obtained via the cookie banner or other forms (e.g., registrations, contact forms). Please be aware that especially when data is transferred to the United States, your personal data may be accessed by government agencies for surveillance purposes, without adequate legal remedies or awareness of such access. We have no influence over these processing activities.

9. Automated Decision-Making and Profiling

We do not engage in automated decision-making within the meaning of Article 22 GDPR.However, we may perform profiling in the following limited cases:

• To present you with personalized content
• To suggest products based on your previous interactions
• To improve marketing relevance and ad targeting

This profiling is based either on:

• Your explicit consent in accordance with Article 6(1)(a) GDPR,
• Or our legitimate interests pursuant to Article 6(1)(f) GDPR, such as optimizing user experience and advertising efficiency.

You have the right to object to such profiling at any time (see Section 11 for your data subject rights).

10. Your Rights as a Data Subject

Under the General Data Protection Regulation (GDPR), you are entitled to the following rights regarding your personal data:

10.1 Right of Access (Art. 15 GDPR)

You have the right to obtain confirmation as to whether or not personal data concerning you is being processed.

If this is the case, you are entitled to information including:

• The purposes of the processing
• The categories of data concerned
• The recipients or categories of recipients
• The envisaged storage period or the criteria used to determine it
• The existence of your rights
• The origin of the data (if not collected directly from you)
• The existence of automated decision-making, including profiling

10.2 Right to Rectification (Art. 16 GDPR)

You have the right to request the correction of inaccurate personal data or the completion of incomplete data without undue delay.

10.3 Right to Erasure (Art. 17 GDPR)

You may request the deletion of your personal data, in particular when:

• The data is no longer needed for the purposes collected
• You withdraw your consent (and no other legal basis exists)
• You object to the processing
• The data has been unlawfully processed
• The erasure is required by law

This right may be limited in certain cases (e.g., if legal retention obligations apply).

10.4 Right to Restriction of Processing (Art. 18 GDPR)

You have the right to restrict the processing of your personal data if:

• You contest its accuracy (for a period enabling verification)
• Processing is unlawful, but you oppose erasure
• The data is no longer needed by us, but you need it for legal claims
• You have objected to processing pending verification of legitimate grounds

10.5 Right to Data Portability (Art. 20 GDPR)

You may receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and you have the right to transmit this data to another controller without hindrance, where:

• The processing is based on consent or a contract, and
• The processing is carried out by automated means

You also have the right to request that we transmit the data directly to another controller, where technically feasible.

11. Right to Object, Right to Lodge a Complaint, Revocation of Consent

11.1 Right to Object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is based on:

• Article 6(1)(e) GDPR (processing in the public interest), or
• Article 6(1)(f) GDPR (processing based on legitimate interests)

If you file an objection, we will no longer process your personal data, unless we can demonstrate:

• Compelling legitimate grounds for the processing,
• Which override your interests, rights, and freedoms, or
• The processing is necessary for the establishment, exercise, or defense of legal claims

If your data is processed for direct marketing purposes, you may object at any time without providing a specific reason.

If you object to such processing, we will immediately stop using your data for this purpose.

11.2 Right to Withdraw Consent (Art. 7(3) GDPR)

You may withdraw your previously given consent at any time with future effect.

This also applies to any consent declarations given before the GDPR came into effect (i.e., before May 25, 2018). Upon withdrawal of consent, we will no longer process your data, unless there is a legal basis for doing so. Please note: The withdrawal of consent does not affect the lawfulness of data processing carried out prior to the withdrawal.

11.3 Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

If you believe that your data is being processed unlawfully, you have the right to lodge a complaint with a data protection supervisory authority, especially:

• In the Member State of your habitual residence
• Place of work, or
• Place of the alleged infringement

The supervisory authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit

Wilhelmstraße 7

65185 Wiesbaden, Germany

Postal address: Postfach 3163, 65021 Wiesbaden, Germany

Phone: +49 611 1408-0

Website: datenschutz.hessen.de

12. Children

Our store is not directed at children. We do not knowingly collect personal data from children. To place an order you must be at least sixteen years of age, as set out in our Terms of Service. If you believe that a child has provided us with personal data, please contact us and we will delete the data.

13. Changes to This Privacy Policy

We update this Privacy Policy when our processing activities change, for example when we add or remove a service, or when legal requirements change. The current version always applies and is available on this page. The date of the last update is shown below.

Version: 14 August 2026