Privacy policy

Unless otherwise stated below, the provision of your personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide the data. Not providing it has no consequences. This applies only insofar as no other information is given for the processing operations described below.

“Personal data” means any information relating to an identified or identifiable natural person.

Server log files

You can visit our website without providing any information about yourself.

Each time our website is accessed, usage data is transmitted by your internet browser to us or our web host / IT service provider and stored in log data (so-called server log files). This stored data includes, for example, the name of the page accessed, the date and time of access, the IP address, the amount of data transferred and the requesting provider.

The processing is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in ensuring the trouble-free operation of our website and in improving our offer.

Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. For Canada, there is an adequacy decision of the EU Commission. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to those of the EU Commission’s standard contractual clauses.

Contact

Controller

Contact us at any time. The controller responsible for data processing is: Zaiser Art GbR, Gabriele-Münter-Straße 22, 73760 Ostfildern, Germany, +49 711 84940172, info@mybearbrick.de

Contact initiated by the customer by email

If you contact us on your own initiative by email for business purposes, we collect your personal data (name, email address, message text) only to the extent provided by you. The data processing serves to handle and answer your enquiry.

If the contact serves the implementation of pre-contractual measures (e.g. advice on a purchase, preparation of an offer) or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6(1)(b) GDPR.

If the contact is made for other reasons, this data processing is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in handling and answering your enquiry. In this case, you have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you based on Art. 6(1)(f) GDPR.

We use your email address only to handle your enquiry. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Collection and processing when using the contact form

When you use the contact form, we collect your personal data (name, email address, message text) only to the extent provided by you. The data processing serves the purpose of making contact.

If the contact serves the implementation of pre-contractual measures (e.g. advice on a purchase, preparation of an offer) or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6(1)(b) GDPR.

If the contact is made for other reasons, this data processing is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in handling and answering your enquiry. In this case, you have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you based on Art. 6(1)(f) GDPR.

We use your email address only to handle your enquiry. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Collection and processing when using the withdrawal button

If you have concluded a contract via our website, we provide you with a withdrawal function (withdrawal button) through which you can submit your declaration of withdrawal directly.

When you use the withdrawal function, we collect your personal data (name, email address, information identifying the contract or part of the contract you wish to withdraw from, and the time (date and time) at which the declaration of withdrawal was sent) only to the extent provided by you. The data processing serves to provide you with the legally required means of withdrawing from your contract and to process your withdrawal properly.

If the contact concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6(1)(b) GDPR. Otherwise, the data processing is carried out on the basis of Art. 6(1)(c) GDPR to fulfil a legal obligation to provide you with a withdrawal function on our website.

We use your email address only to process your declaration of withdrawal. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

The processing of your personal data serves to meet the legal requirements for the design of the withdrawal function in a legally compliant manner and is carried out on the basis of Art. 6(1)(c) GDPR. This data processing is also carried out on the basis of Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in providing you with a user-friendly way of withdrawing. In this case, you have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you based on Art. 6(1)(f) GDPR.

Use of the Google Maps API address validation

On our website we use the address validation of the provider Google (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland; “Google”).

The data processing serves to check your entries in our address forms in real time for input and spelling errors and, where applicable, to complete missing data. If data has been entered incorrectly, alternative suggestions for correcting the data are displayed. For this purpose, the address data you enter is transmitted to the provider, stored and evaluated there.

Among other things, the following information may be transmitted to and processed by Google: postal addresses (country, city, postcode, street, house number), email address, telephone number.

Your data may also be transferred to the USA. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Google has certified itself under the TADPF and has thereby undertaken to comply with European data protection principles.

The processing of your personal data is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in a correct data basis for fulfilling our contractual obligations. You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you.

The data is processed separately by the provider and is not combined with other data. It is deleted by the provider as soon as the status of the entered data has been determined, but no later than after 30 days.

Further information on the terms of use and data protection at Google can be found at: https://cloud.google.com/maps-platform/terms and https://policies.google.com/privacy.

Use of AI when handling your enquiries

When you write to us by email, via the contact form or by other means, we use the AI system “Claude” of Anthropic Ireland, Limited (6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland; “Anthropic”) as a processor to handle your enquiry. The system summarises your message and the previous correspondence and, following our instructions, prepares a draft of our reply. For this purpose, the content of your messages, your name, your email address and – where your enquiry concerns an order – the related order data are transmitted to Anthropic. Every reply is reviewed and sent by us personally; no decision based solely on automated processing within the meaning of Art. 22 GDPR takes place. We evaluate emails from business partners in the same way in order to identify open tasks.

The data processing serves to handle your enquiry quickly and carefully. If your enquiry concerns a contract concluded with us or serves the implementation of pre-contractual measures, the processing is carried out on the basis of Art. 6(1)(b) GDPR; otherwise on the basis of Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in handling enquiries efficiently. You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you based on Art. 6(1)(f) GDPR.

Anthropic may not use the transmitted content to train its AI models. The content is generally deleted by Anthropic within 30 days; content that automated safety checks classify as violating Anthropic’s usage policies may be stored for up to two years, and the results of these checks for up to seven years.

Anthropic stores the data in the USA and may also process it in other countries outside the EU. This data transfer is based on the EU Commission’s standard contractual clauses.

Further information on data protection at Anthropic can be found at: https://www.anthropic.com/legal/privacy.

Customer account / Orders

Customer account

When you open a customer account, we collect your personal data to the extent specified there. The data processing serves to improve your shopping experience and to simplify order processing. The processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You can withdraw your consent at any time by notifying us, without affecting the lawfulness of the processing carried out on the basis of the consent before its withdrawal. Your customer account will then be deleted.

Collection, processing and transfer of personal data for orders

When you place an order, we collect and process your personal data only insofar as this is necessary to fulfil and process your order and to handle your enquiries. The provision of the data is necessary for the conclusion of the contract. If the data is not provided, no contract can be concluded. The processing is carried out on the basis of Art. 6(1)(b) GDPR and is necessary for the performance of a contract with you.

Your data is passed on, for example, to shipping companies, dropshipping or fulfilment providers, payment service providers, service providers for order processing and IT service providers. In all cases, we strictly comply with the legal requirements. The scope of the data transfer is limited to a minimum.

Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. For Canada, there is an adequacy decision of the EU Commission. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to those of the EU Commission’s standard contractual clauses.

Reviews / Advertising

Use of Trustpilot

On our website we use the review system “Trustpilot” of Trustpilot A/S (Pilestræde 58, 1112 Copenhagen, Denmark; “Trustpilot”).

Trustpilot enables us to collect customer reviews and display them on our website in order to give you an insight into the quality of our services.

In the footer of our website we link to Trustpilot’s review page. No Trustpilot content is loaded on our website. Only when you click the link does Trustpilot’s website open; your browser then transmits your IP address and the address of the page you came from to Trustpilot. Trustpilot itself is responsible for the processing on its website.

After an order, you may receive an invitation to submit a review from us or Trustpilot and may then submit a review. In doing so, the following data, among others, may be processed by us or Trustpilot: email address, name, information about your device and location (IP address, browser settings, type of browser used, browser language, time zone), information about your Trustpilot user account (user name, photo, preferred language), information about the purchased product or the service used (reference or order number, product details), the content of your review and the star rating you have given, your product photos or videos (if you have attached them to your product review). This data may also be used to verify your review.

The processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent, provided that you have expressly agreed to the transfer of your data and to receiving the review request. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent before its withdrawal.

Further information on data protection when using Trustpilot can be found at: https://legal.trustpilot.com/for-reviewers/end-user-privacy-terms.

Use of Judge.me

On our website we use the review system “Judge.me” of Judge.me Ltd (c/o Buckworths 2nd Floor, 1-3 Worship Street, London, England, EC2A 2AB; “Judge.me”).

Judge.me enables us to collect customer reviews and display them on our website in order to give you an insight into the quality of our services.

After an order, you may receive an invitation to submit a review from us or Judge.me and may then submit a review. In doing so, the following data, among others, may be processed by us or Judge.me: email address, name, telephone number, address, information about your device (IP address, information about your web browser and the operating system used), information about the purchased product or the service used (order number, product details), the content of your review and the star rating you have given, your product photos or videos (if you have attached them to your product review). This data may also be used to verify your review.

Judge.me uses technologies such as cookies.

Your data may be transferred outside the EU to the United Kingdom. For the United Kingdom, there is an adequacy decision of the EU Commission.

Your data may be transferred to the USA. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Judge.me is not certified under the TADPF. This data transfer is based on special contracts approved for use in the United Kingdom that provide the same protection as personal data has in the United Kingdom.

The use of cookies or comparable technologies is based on your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1)(a) GDPR, provided that you have expressly agreed to the transfer of your data and to receiving the review request. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent before its withdrawal.

Further information on data protection when using Judge.me can be found at: https://judge.me/privacy.

Use of Google Ads conversion tracking and remarketing

We place advertisements via Google Ads of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”) and use the conversion tracking and the remarketing function of Google Ads on our website. These services are integrated into our shop via the “Google & YouTube” app and are only loaded after you have given your consent via our cookie banner.

With conversion tracking, we measure how many visitors place an order after clicking on one of our advertisements. With remarketing, we can show visitors to our website advertisements for our products on websites of the Google advertising network as they continue to use the internet. For this purpose, cookies (e.g. “_gcl_au”) or comparable technologies are used and information about your visit (e.g. pages and products viewed, completed purchase and order value, browser and device information, IP address) is transmitted to Google.

Your data may be transferred to and processed in the USA. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Google LLC has certified itself under the TADPF and has thereby undertaken to comply with the data protection principles.

The use of cookies or comparable technologies is based on your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the “Cookie settings” link at the bottom of every page, without affecting the lawfulness of the processing carried out on the basis of the consent before its withdrawal.

Further information on data protection at Google can be found at: https://policies.google.com/privacy and on the use of data for advertising at: https://policies.google.com/technologies/ads.

Use of your email address for sending newsletters

We use your email address to send you information and offers by newsletter if you have expressly agreed to this. The data processing serves exclusively the purpose of direct advertising. For this purpose, we process your email address and, where applicable, other data that you have provided voluntarily when subscribing to our newsletter.

The processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent before its withdrawal.

To do so, you can unsubscribe from the newsletter at any time using the corresponding link in the newsletter or by notifying us. Your email address will then be removed from the mailing list. Despite removal from the mailing list, we may continue to store your email address in a so-called blacklist in order to prevent you from receiving newsletter emails from us in the future. This storage is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our and your legitimate interest in preventing your email address from being used again to send our newsletter. You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you.

Use of your email address for availability notifications

We offer an availability notification service on our website. If an item is temporarily unavailable, you can enter your email address for the respective item and be informed by us by email when it becomes available again, provided you have agreed to this. When the item becomes available, you will receive a one-time email notification of its availability. The processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent before its withdrawal. You can cancel the availability notification at any time by notifying us. Your email address will then be removed from the mailing list.

Shipping service providers / Merchandise management

Transfer of your email address and telephone number to shipping companies

If you have expressly consented to this in the shopping cart, we pass on your email address and, if you have provided it, your telephone number to the transport company we have commissioned (DHL or UPS). The transfer serves to enable the transport company to inform you of the delivery status and to coordinate the delivery with you. The processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You can withdraw your consent at any time by notifying us, without affecting the lawfulness of the processing carried out on the basis of the consent before its withdrawal; we will then no longer pass on your contact details to the transport company. Without your consent, we only transmit the details required for delivery (name and delivery address) to the transport company.

Use of an external merchandise management system

We use a merchandise management system as a processor to perform contracts. For this purpose, the personal data collected in the course of your order is transmitted to our own ERP system (hosted by Vercel, database at Neon).

The processing of your personal data serves to perform the contract concluded with you and is carried out on the basis of Art. 6(1)(b) GDPR.

Payment service providers

Use of PayPal

On our website we use the payment service PayPal of PayPal (Europe) S.à r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg; “PayPal”). The data processing serves to offer you payment via this payment service. When you select and use payment via PayPal, the data required for processing the payment is transmitted to PayPal in order to perform the contract with you using the chosen payment method. This processing is carried out on the basis of Art. 6(1)(b) GDPR.

All PayPal transactions are subject to the PayPal privacy statement, which can be found at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Use of PayPal Express

On our website we use the payment service PayPal Express of PayPal (Europe) S.à r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg; “PayPal”). The data processing serves to offer you payment via the PayPal Express payment service. To integrate this payment service, it is necessary for PayPal to collect, store and analyse data (e.g. IP address, device type, operating system, browser type, location of your device) when the website is accessed. Cookies may also be used for this purpose. The cookies enable your browser to be recognised.

The processing of your personal data is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in a customer-oriented offer of various payment methods. You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you.

When you select and use PayPal Express, the data required for processing the payment is transmitted to PayPal in order to perform the contract with you using the chosen payment method. This processing is carried out on the basis of Art. 6(1)(b) GDPR. Further information on data processing when using the PayPal Express payment service can be found in the corresponding privacy statement at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Use of Shopify Payments

On our website we use the payment service “Shopify Payments” of Shopify International Limited (2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; “Shopify”). In this case, payments are processed by the payment service provider Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; “Stripe”). The data processing serves to offer you payment via the Shopify Payments payment service. When you select and use a corresponding “Shopify Payments” payment method, the data required for processing the payment is transmitted to Stripe in order to perform the contract with you using the chosen payment method. This processing is carried out on the basis of Art. 6(1)(b) GDPR.

Stripe reserves the right, where applicable, to obtain credit information on the basis of mathematical-statistical procedures using credit agencies. For this purpose, Stripe transmits the personal data required for a credit check to a credit agency and uses the information received about the statistical probability of a payment default for a balanced decision on the establishment, performance or termination of the contractual relationship. The credit information may include probability values (score values) calculated on the basis of scientifically recognised mathematical-statistical procedures, the calculation of which includes, among other things, address data. Your legitimate interests are taken into account in accordance with the statutory provisions. The data processing serves the purpose of a credit check for the initiation of a contract. The processing is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in protection against payment default if Stripe makes an advance payment.

You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you based on Art. 6(1)(f) GDPR by notifying Stripe. The provision of the data is necessary for the conclusion of the contract with the payment method you have chosen. If the data is not provided, the contract cannot be concluded with the payment method you have chosen.

Further information on data processing when using the Shopify Payments payment service can be found in Shopify’s privacy policy at: https://www.shopify.com/legal/privacy.

Further information on data processing when payments are processed via the payment service provider Stripe can be found in Stripe’s privacy policy at: https://stripe.com/privacy.

Cookies

Our website uses cookies. Cookies are small text files that are stored in the internet browser or by the internet browser on a user’s computer system. When a user accesses a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is accessed again.

Cookies are stored on your computer. You therefore have full control over the use of cookies. By selecting the appropriate technical settings in your internet browser, you can be notified before cookies are set and decide individually whether to accept them, as well as prevent the storage of cookies and the transmission of the data they contain. Cookies that have already been stored can be deleted at any time. Please note, however, that you may then not be able to use all functions of this website to their full extent.

Using the links below, you can find out how to manage (including deactivate) cookies in the most important browsers:
Chrome: https://support.google.com/accounts/answer/61416?hl=en
Microsoft Edge: https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09
Mozilla Firefox: https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop
Safari: https://support.apple.com/en-gb/guide/safari/manage-cookies-and-website-data-sfri11471/mac

Technically necessary cookies

Unless otherwise stated below in this privacy policy, we only use these technically necessary cookies for the purpose of making our offer more user-friendly, effective and secure. Cookies also enable our systems to recognise your browser after a page change and to offer you services. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognised even after a page change.

The use of cookies or comparable technologies is based on Section 25(2) TDDDG. The processing of your personal data is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in ensuring the optimal functionality of the website and a user-friendly and effective design of our offer.

You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you.

Consent management with Consentmo

For cookies and comparable technologies that are not technically necessary, we obtain your consent via a cookie banner. For this purpose, we use the consent tool “Consentmo” of iSense Ltd (4 Prof. Georgi Bradistilov St., entrance A, 4th floor, 1700 Sofia, Bulgaria; “Consentmo”) as a processor. Your choice in the cookie banner (cookie “cookieconsent_status”) and a record of whether you gave or refused your consent are stored. The consent records are kept for five years; the application is operated in the European Economic Area.

We pass your choice on to Shopify’s privacy interface and, as part of Google Consent Mode, to the Google services we use, so that they take your decision into account. You can change your choice at any time via the “Cookie settings” link at the bottom of every page and withdraw any consent you have given with effect for the future.

Your choice is stored in the cookie on the basis of Section 25(2) no. 2 TDDDG. The processing of your personal data is carried out on the basis of Art. 6(1)(c) GDPR to fulfil our obligation to provide evidence under Art. 7(1) GDPR.

Analysis / Communication

Use of Shopify statistics

On our website we use the statistics and analysis functions of Shopify International Ltd. (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; “Shopify”) as a processor. Shopify is an affiliate of Shopify Inc. (151 O’Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada).

The data processing serves the purpose of analysing this website and its visitors. For this purpose, data is stored for marketing and optimisation purposes and made available in reports, analyses and statistics. Among other things, the following device information is collected and processed: information about the web browser, the IP address, the time zone and some of the cookies installed on your device. As you navigate the website, information about the web pages or products viewed, the referrer URL (the website via which you accessed our website) and information about how you interact with the website is also collected. Technologies such as cookies as well as web beacons, tags and pixels (electronic files for recording information about how you navigate the website) are used for this purpose.

Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. For Canada, there is an adequacy decision of the EU Commission. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to those of the EU Commission’s standard contractual clauses.

The use of cookies or comparable technologies is based on your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1)(a) GDPR. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent before its withdrawal.

Further information on data protection at Shopify can be found at https://www.shopify.com/legal/privacy, information on the data processing agreement at https://www.shopify.com/legal/dpa and information on the cookies used at https://www.shopify.com/legal/cookies.

Use of Google Analytics

On our website we use the web analytics service Google Analytics 4 of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”). Google Analytics is integrated into our shop via the “Google & YouTube” app and is only loaded after you have given your consent via our cookie banner.

The data processing serves the purpose of analysing this website and its visitors and of measuring the success of our advertising. Among other things, information about the browser and device used, the pages viewed, the referrer URL, the length of the visit and your interactions on the website (e.g. viewing products, adding to the cart, completing a purchase) is collected. Google Analytics 4 does not store your IP address. Cookies (e.g. “_ga”) with a storage period of up to two years are used for this purpose.

Your data may be transferred to and processed in the USA. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Google LLC has certified itself under the TADPF and has thereby undertaken to comply with the data protection principles.

The use of cookies or comparable technologies is based on your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the “Cookie settings” link at the bottom of every page, without affecting the lawfulness of the processing carried out on the basis of the consent before its withdrawal.

Further information on data protection at Google can be found at: https://policies.google.com/privacy.

Use of Shopify Inbox

On our website we use the live chat system Shopify Inbox of Shopify International Ltd. (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; “Shopify”) as a processor. Shopify is an affiliate of Shopify Inc. (151 O’Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada).

The data processing serves the purpose of direct and efficient communication between you and us as the provider. Data is stored and processed to operate the system and to optimise the service.

Cookies that enable the browser to be recognised may be used to operate the live chat system. The following information may be collected and processed: IP address and personal data provided by you when using the chat system.

Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. For Canada, there is an adequacy decision of the EU Commission. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to those of the EU Commission’s standard contractual clauses.

The use of cookies or comparable technologies is based on your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1)(a) GDPR. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent before its withdrawal.

Further information on data protection at Shopify can be found at https://www.shopify.com/legal/privacy and https://www.shopify.com/legal/dpa.

Plug-ins and other services

Use of hCaptcha

On our website we use the hCaptcha service of Intuition Machines Inc. (1065 SW 8th St #704, Miami, FL 33130, USA; “hCaptcha”) as a processor.

hCaptcha serves to protect our website against spam and abuse by automated access (bots). By implementing hCaptcha, we ensure that certain actions on our website can only be carried out by real people, which guarantees the security and integrity of our online services.

When hCaptcha is used, the following data may be collected and processed: the user’s IP address, information about the device used (e.g. browser and operating system), mouse movements and interactions on the website, length of stay on the website, and the user’s input behaviour.

Your data may be transferred to the USA. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). hCaptcha has certified itself under the TADPF and has thereby undertaken to comply with European data protection principles.

The use of cookies or comparable technologies is based on your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1)(a) GDPR. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent before its withdrawal.

Further information on data processing and data protection at hCaptcha can be found at https://www.hcaptcha.com/gdpr.

Use of YouTube

Our website uses the function for embedding YouTube videos by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “YouTube”). YouTube is a company affiliated with Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”).

This feature shows YouTube videos in an iFrame on the website. The option “advanced privacy mode” is enabled here. This prevents YouTube from storing information on visitors to the website. It is only if you watch a video that information is transmitted to and stored by YouTube. Your data may be transmitted to the USA. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). YouTube has certified itself in accordance with the TADPF and has thus undertaken to comply with European data protection principles.

The use of cookies or comparable technologies is based on your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1)(a) GDPR. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent before its withdrawal.

Further information on the data collected and used by YouTube and Google and your associated rights and options for protecting your privacy can be found in YouTube’s privacy policy (https://www.youtube.com/t/privacy).

Integration of the Händlerbund membership logo

We are a member of Händlerbund e.V. (Kohlgartenstraße 11–13, 04315 Leipzig, Germany; “Händlerbund”) and display its membership logo on our website. The logo is loaded from Händlerbund’s server when a page is opened. In the process, Händlerbund receives your IP address and technical information from your browser (e.g. browser type, time of access and the address of our website). To our knowledge, no cookies are set. Clicking the logo opens the membership confirmation on Händlerbund’s website.

The integration serves to present our membership in a verifiable way; the logo is provided by Händlerbund and reflects the current status of the membership. The processing is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in this presentation. You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you based on Art. 6(1)(f) GDPR.

Further information on data protection at Händlerbund can be found at https://www.haendlerbund.de/de/datenschutzerklaerung.

Rights of data subjects and storage period

Storage period

After the contract has been fully processed, the data is initially stored for the duration of the warranty period, then in accordance with statutory retention periods, in particular those under tax and commercial law, and then deleted after the periods have expired, unless you have consented to further processing and use.

Rights of the data subject

If the statutory requirements are met, you have the following rights under Art. 15 to 20 GDPR: the right of access, rectification, erasure, restriction of processing and data portability.

In addition, under Art. 21(1) GDPR you have the right to object to processing based on Art. 6(1)(f) GDPR and to processing for the purposes of direct marketing.

Right to lodge a complaint with the supervisory authority

Under Art. 77 GDPR, you have the right to lodge a complaint with the supervisory authority if you believe that the processing of your personal data is not lawful.

You can lodge a complaint, among others, with the supervisory authority responsible for us, which you can reach at the following contact details:
Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information Baden-Württemberg)
Heilbronner Straße 35
70191 Stuttgart, Germany
(Postal address: Postfach 10 29 32, 70025 Stuttgart, Germany)
Tel.: +49 711 615541-0
Email: poststelle@lfdi.bwl.de

Right to object

If the processing of personal data listed here is based on our legitimate interest under Art. 6(1)(f) GDPR, you have the right to object to such processing at any time with effect for the future on grounds relating to your particular situation.

Once you have objected, the processing of the data concerned will be stopped, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.