Privacy policy

Unless otherwise stated below, the provision of your personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide the data. Failure to provide it will have no consequences. This applies only insofar as no other information is provided for the processing operations described below.

“Personal data” means any information relating to an identified or identifiable natural person.

Server Log Files

You can visit our websites without providing any information about yourself. Each time you access our website, usage data is transmitted to us or our web host / IT service provider by your internet browser and stored in log data (so-called server log files). This stored data includes, for example, the name of the page accessed, the date and time of access, the IP address, the amount of data transferred and the requesting provider.

Processing is carried out on the basis of Art. 6(1)(f) GDPR due to our overriding legitimate interest in ensuring the trouble-free operation of our website and improving our services.

Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. The European Commission has issued an adequacy decision for Canada. An adequacy decision by the European Commission also exists for the USA in the form of the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to the European Commission’s Standard Contractual Clauses.

Contact

Controller

Please contact us if you wish. The controller responsible for data processing is:

Kombuchery GmbH
Torstraße 105–107
10119 Berlin
Germany
+49 175 457926
imprint@kombuchery.de

Customer-Initiated Contact by Email

If you contact us by email on your own initiative for business purposes, we collect your personal data (name, email address, message text) only to the extent provided by you. The purpose of data processing is to process and respond to your enquiry.

If the contact serves to carry out pre-contractual measures (e.g. advice in the event of an interest in purchasing, preparation of an offer) or relates to a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6(1)(b) GDPR.

If contact is made for other reasons, this data processing is carried out on the basis of Art. 6(1)(f) GDPR due to our overriding legitimate interest in processing and responding to your enquiry. In this case, you have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you based on Art. 6(1)(f) GDPR.

We use your email address solely to process your enquiry. Your data will subsequently be deleted in compliance with statutory retention periods unless you have consented to further processing and use.

Collection and Processing When Using the Contact Form

When you use the contact form, we collect your personal data (name, email address, message text) only to the extent provided by you. The purpose of the data processing is to enable contact.

Collection and Processing When Using the Withdrawal Button

If you have concluded a contract via our online presence, we provide you with a withdrawal function (withdrawal button) through which you can submit your declaration of withdrawal directly.

When using the withdrawal function, we collect your personal data (name, email address, information identifying the contract or part of the contract you wish to withdraw from, and the time and date on which the withdrawal declaration was submitted) only to the extent provided by you.

The purpose of the data processing is to provide you with the legally required option to withdraw from your contract and to properly process your withdrawal.

If the contact relates to a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6(1)(b) GDPR. Otherwise, the data processing is carried out on the basis of Art. 6(1)(c) GDPR in order to comply with our legal obligation to provide a withdrawal function on our online presence.

We use your email address solely to process your declaration of withdrawal. Your data will subsequently be deleted in compliance with statutory retention periods unless you have consented to further processing and use.

The processing of your personal data serves the purpose of ensuring legally compliant fulfilment of the statutory requirements governing the design of the withdrawal function and is carried out on the basis of Art. 6(1)(c) GDPR.

This data processing is additionally carried out on the basis of Art. 6(1)(f) GDPR due to our overriding legitimate interest in providing you with a user-friendly withdrawal option. In this case, you have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you based on Art. 6(1)(f) GDPR.

Collection and Processing When Using the Cancellation Button

If you terminate a subscription contract concluded via our online presence using the legally required cancellation button (“cancellation button”), we process the data entered by you in the confirmation screen.

When using the cancellation button, we collect your personal data (name, email address, where applicable your telephone number, information identifying the contract you wish to terminate, and the date and time at which the cancellation declaration was submitted) only to the extent provided by you.

The purpose of the data processing is to provide you with the legally required option to terminate your continuing contractual relationship and to properly process your cancellation.

If the contact relates to a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6(1)(b) GDPR. Otherwise, the data processing is carried out on the basis of Art. 6(1)(c) GDPR because we are legally obliged to provide a cancellation button on our online presence.

We use your email address solely to process your cancellation declaration. Your data will subsequently be deleted in compliance with statutory retention periods unless you have consented to further processing and use.

Use of Google Maps API Address Validation

We use the address validation service provided by Google (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland; “Google”) on our website.

The purpose of data processing is to check the information entered in our address forms in real time for input and spelling errors and, where necessary, to supplement missing data. If data has been entered incorrectly, alternative suggestions for correcting the data are displayed.

For this purpose, the address data entered by you is transmitted to the provider, where it is stored and evaluated. Among other things, the following information may be transmitted to and processed by Google: postal addresses (country, city, postcode, street, house number), email address and telephone number.

Your data may also be transferred to the USA. An adequacy decision by the European Commission exists for the USA in the form of the Trans-Atlantic Data Privacy Framework (TADPF). Google is certified under the TADPF and has therefore committed to complying with European data protection principles.

Your personal data is processed on the basis of Art. 6(1)(f) GDPR due to our overriding legitimate interest in maintaining an accurate data basis for the fulfilment of our contractual obligations. You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you.

The data is processed separately by the provider and is not combined with other data. It is deleted by the provider as soon as the status of the data entered has been determined, but no later than after 30 days.

Further information on Google’s terms of use and privacy practices can be found in the Google Maps Platform Terms and Google’s Privacy Policy.

Collection and Processing When Using the Application Form

When using the application form, we collect your personal data only to the extent provided by you. This includes your contact details (e.g. name, email address, telephone number), information about your professional qualifications and education, information about professional training and job-specific supporting documents.

The purpose of data processing is to contact you and make a decision regarding the establishment of an employment relationship with you. Providing the data is necessary in order to carry out the application process.

Your personal data is processed on the basis of Art. 6(1)(b) GDPR in conjunction with Section 26(1) BDSG for the purpose of carrying out pre-contractual measures (completion of the application procedure as initiation of an employment contract).

If you have given us consent to process personal data for inclusion in our applicant pool, e.g. by ticking a checkbox, processing is carried out on the basis of Art. 6(1)(a) GDPR. You may withdraw your consent at any time without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

Where special categories of personal data within the meaning of Art. 9(1) GDPR are requested from applicants as part of the application process, such as information concerning the degree of severe disability, this is carried out on the basis of Art. 9(2)(b) GDPR so that we can exercise rights and fulfil obligations arising from employment law and social security and social protection law.

We store your personal data for as long as necessary to make a decision regarding your application. Your data will subsequently be deleted no later than six months thereafter unless you have consented to further processing and use.

If an employment relationship is established following the application procedure, the data provided will be further processed on the basis of Art. 6(1)(b) GDPR in conjunction with Section 26(1) BDSG for the purposes of carrying out the employment relationship and subsequently transferred to the personnel file.

WhatsApp Business

If you contact us for business purposes via WhatsApp, we use the WhatsApp Business version provided by WhatsApp Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; “WhatsApp”). If you are located outside the European Economic Area, this service is provided by WhatsApp Inc. (1601 Willow Road, Menlo Park, CA 94025, USA).

The purpose of data processing is to process and respond to your enquiry. For this purpose, we collect and process the mobile telephone number stored with WhatsApp, your name if provided, and other data to the extent provided by you.

For the service, we use a mobile device whose address book contains exclusively data relating to users who have contacted us via WhatsApp. Personal data is therefore not disclosed to WhatsApp unless you have already consented to this vis-à-vis WhatsApp.

Your data is transferred by WhatsApp to servers of Meta Platforms Inc. in the USA. An adequacy decision by the European Commission exists for the USA in the form of the Trans-Atlantic Data Privacy Framework (TADPF). Meta Platforms Inc. is certified under the TADPF and has therefore committed to complying with European data protection principles.

If contact is made for other reasons, this data processing is carried out on the basis of Art. 6(1)(f) GDPR due to our overriding legitimate interest in providing a quick and simple means of communication and responding to your enquiry. In this case, you have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you based on Art. 6(1)(f) GDPR.

We use your personal data solely to process your enquiry. Your data will subsequently be deleted in compliance with statutory retention periods unless you have consented to further processing and use.

Further information on WhatsApp’s terms of use and privacy practices can be found in WhatsApp’s Terms of Service and Privacy Policy.

Customer Account and Orders

Customer Account

When you open a customer account, we collect your personal data to the extent specified there. The purpose of data processing is to improve your shopping experience and simplify order processing.

Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You may withdraw your consent at any time by notifying us, without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal. Your customer account will subsequently be deleted.

Collection, Processing and Disclosure of Personal Data When Placing Orders

When you place an order, we collect and process your personal data only to the extent necessary to fulfil and process your order and to deal with your enquiries.

Providing the data is necessary for the conclusion of the contract. Failure to provide it means that no contract can be concluded. Processing is carried out on the basis of Art. 6(1)(b) GDPR and is necessary for the performance of a contract with you.

Your data may be disclosed, for example, to shipping companies, dropshipping or fulfilment providers, payment service providers, service providers for order processing and IT service providers. In all cases, we strictly comply with statutory requirements. The scope of data transmission is limited to the minimum necessary.

Use of REVIEWS.io

We use the REVIEWS.io service provided by REVIEWS.io Limited, 29 St Nicholas Place, Leicester, LE1 4LD, United Kingdom, to collect, manage and display customer reviews.

In connection with the review function, data processed may include, in particular, your name, email address, order or purchase information, the review submitted and technical information.

REVIEWS.io describes itself as a processor when collecting reviews on behalf of merchants. Once a person submits a review themselves and agrees to REVIEWS.io’s terms, REVIEWS.io may act as an independent controller for further processing carried out there.

Where we transmit data to REVIEWS.io in order to enable a review requested by you or to display reviews on our website, processing is carried out, depending on the specific operation, on the basis of Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR (legitimate interest in authentic customer feedback and quality assurance).

You may withdraw any consent granted at any time with effect for the future.

Further information on data processing by REVIEWS.io can be found in REVIEWS.io’s User Privacy Policy and other privacy information.

Advertising and Marketing Communications

Use of Your Personal Data for Postal Advertising

We use your personal data (name, address) obtained in connection with the sale of goods or services to send you postal advertising unless you have objected to such use.

Providing this data is necessary for the conclusion of the contract. Failure to provide it means that no contract can be concluded.

Processing is carried out on the basis of Art. 6(1)(f) GDPR due to our overriding legitimate interest in direct advertising.

You may object to the use of your address data at any time by notifying us. The contact details for exercising your right to object can be found in our Legal Notice.

Use of Your Email Address for Direct Advertising

We use your email address obtained in connection with the sale of goods or services to electronically send advertising for our own goods or services similar to those you have already purchased from us, unless you have objected to such use.

Providing the email address is necessary for the conclusion of the contract. Failure to provide it means that no contract can be concluded.

Processing is carried out on the basis of Art. 6(1)(f) GDPR due to our overriding legitimate interest in direct advertising.

You may object to the use of your email address at any time by notifying us. The contact details for exercising your right to object can be found in our Legal Notice. You may also use the link provided for this purpose in the advertising email. No costs other than the transmission costs according to the basic rates will be incurred.

Use of Klaviyo

We use Klaviyo Inc. (125 Summer St Floor 7, Boston, MA 02111, USA; “Klaviyo”) as a processor for sending newsletters.

We provide Klaviyo with the information you supplied when registering for the newsletter (email address and, where applicable, first and last name). The purpose of data processing is to send the newsletter and statistically evaluate it.

To evaluate newsletter campaigns, newsletters sent contain a 1x1 pixel graphic (tracking pixel) or tracking link. This enables us to determine whether you have opened the newsletter and whether you have clicked on any links contained therein.

In this context, we collect personal data such as your IP address, browser type, device and the time of interaction. Pseudonymous usage profiles may be created from this data. The data collected is not used to personally identify you. It is used solely for statistical evaluation in order to improve newsletter campaigns.

Your data is generally transferred to and stored on Klaviyo servers in the USA. An adequacy decision by the European Commission exists for the USA in the form of the Trans-Atlantic Data Privacy Framework (TADPF). Klaviyo is certified under the TADPF and has therefore committed to complying with European data protection principles.

Your personal data is processed on the basis of Art. 6(1)(f) GDPR due to our overriding legitimate interest in a targeted, effective and user-friendly newsletter system.

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you.

Further information on Klaviyo’s privacy practices can be found in Klaviyo’s Privacy Notice and Data Processing Agreement.

Use of Your Mobile Number for SMS Advertising

We use your mobile telephone number independently of contract processing exclusively for our own advertising purposes to send SMS advertising, provided that you have expressly consented to this.

Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You may withdraw your consent at any time by notifying us without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

Your mobile telephone number will subsequently be removed from the distribution list.

Your mobile telephone number is disclosed to an SMS service provider acting as a processor.

Use of Your Email Address for Availability Notifications

We offer a product availability notification service on our website. If an item is temporarily unavailable, you can enter your email address for the relevant item and, provided you have consented, be notified by email when the item becomes available.

You will receive a one-time email notification regarding the availability of the relevant item.

Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You may withdraw your consent at any time without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

You can unsubscribe from the availability notification service at any time by notifying us. Your email address will subsequently be removed from the distribution list.

Disclosure of Your Email Address to Shipping Companies for Shipping Status Information

As part of contract processing, we disclose your email address to the shipping company if you have expressly consented to this during the ordering process.

The purpose of disclosure is to enable the shipping company to inform you about the shipping status by email.

Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You may withdraw your consent at any time by notifying us or the shipping company without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

Order Processing and Payment

Use of an External Enterprise Resource Planning System

We use an enterprise resource planning system as a processor for contract processing. For this purpose, personal data collected as part of your order is transmitted to:

weclapp GmbH
Friedrich-Ebert-Straße 28
97318 Kitzingen
Germany

Your personal data is processed for the purpose of fulfilling the contract concluded with you and on the basis of Art. 6(1)(b) GDPR.

Use of PayPal Express

We use the PayPal Express payment service provided by PayPal (Europe) S.à r.l. et Cie, S.C.A. (22–24 Boulevard Royal, L-2449 Luxembourg; “PayPal”) on our website.

The purpose of data processing is to enable us to offer you payment via PayPal Express. In order to integrate this payment service, PayPal needs to collect, store and analyse data when the website is accessed (e.g. IP address, device type, operating system, browser type and location of your device). Cookies may also be used for this purpose. The cookies enable your browser to be recognised.

Your personal data is processed on the basis of Art. 6(1)(f) GDPR due to our overriding legitimate interest in providing a customer-oriented range of different payment methods. You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you.

When you select and use PayPal Express, the data required for payment processing is transmitted to PayPal in order to fulfil the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6(1)(b) GDPR.

Use of PayPal Checkout

We use the PayPal Checkout payment service provided by PayPal (Europe) S.à r.l. et Cie, S.C.A. (22–24 Boulevard Royal, L-2449 Luxembourg; “PayPal”) on our website.

The purpose of data processing is to enable us to offer you payment via the payment service.

When selecting and using payment via PayPal, credit card via PayPal, direct debit via PayPal or “Pay Later” via PayPal, the data required for payment processing is transmitted to PayPal in order to fulfil the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6(1)(b) GDPR.

Cookies may be stored that enable your browser to be recognised. The resulting data processing is carried out on the basis of Art. 6(1)(f) GDPR due to our overriding legitimate interest in providing a customer-oriented range of different payment methods. You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you.

Credit Card via PayPal, Direct Debit via PayPal & “Pay Later” via PayPal

For individual payment methods such as credit card via PayPal, direct debit via PayPal or “Pay Later” via PayPal, PayPal reserves the right to obtain a credit report based on mathematical-statistical procedures using credit agencies.

For this purpose, PayPal transmits the personal data required for a credit check to a credit agency and uses the information received regarding the statistical probability of payment default to make a balanced decision concerning the establishment, performance or termination of the contractual relationship.

The credit report may include probability values (score values) calculated using scientifically recognised mathematical-statistical methods, which may include address data.

Your legitimate interests are taken into account in accordance with statutory provisions.

The purpose of data processing is to conduct a credit check for the initiation of a contract. Processing is carried out on the basis of Art. 6(1)(f) GDPR due to PayPal’s overriding legitimate interest in protection against payment default where PayPal makes advance payments.

You have the right, on grounds relating to your particular situation, to object to such processing based on Art. 6(1)(f) GDPR by notifying PayPal.

Providing the data is necessary for the conclusion of the contract using your desired payment method. Failure to provide the data means that the contract cannot be concluded using your selected payment method.

Third-Party Providers

When paying using a third-party provider’s payment method, the data required for payment processing is transmitted to PayPal. This processing is carried out on the basis of Art. 6(1)(b) GDPR.

To execute the selected payment method, PayPal may subsequently transmit the data to the respective provider. This processing is carried out on the basis of Art. 6(1)(b) GDPR.

Local third-party providers may include:

Apple Pay (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)

Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)

Purchase on Account via PayPal

When paying by purchase on account, the data required for payment processing is initially transmitted to PayPal.

To execute this payment method, PayPal subsequently transmits the data to Ratepay GmbH (Franklinstraße 28–29, 10587 Berlin; “Ratepay”) in order to fulfil the contract with you using your selected payment method. This processing is carried out on the basis of Art. 6(1)(b) GDPR.

Ratepay may carry out a credit check based on mathematical-statistical methods (probability or score values) using credit agencies in accordance with the procedure described above.

The purpose of data processing is to conduct a credit check for the initiation of a contract. Processing is carried out on the basis of Art. 6(1)(f) GDPR due to our overriding legitimate interest in protection against payment default where Ratepay makes advance payments.

Use of Shopify Payments

We use the “Shopify Payments” payment service provided by Shopify International Limited (2nd Floor Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland; “Shopify”) on our website.

Payment processing in this case is carried out by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; “Stripe”).

The purpose of data processing is to enable us to offer you payment via Shopify Payments.

When selecting and using a corresponding Shopify Payments payment method, the data required for payment processing is transmitted to Stripe in order to fulfil the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6(1)(b) GDPR.

Stripe reserves the right, where applicable, to obtain a credit report based on mathematical-statistical procedures using credit agencies.

For this purpose, Stripe transmits the personal data required for a credit check to a credit agency and uses the information received regarding the statistical probability of payment default to make a balanced decision concerning the establishment, performance or termination of the contractual relationship.

The credit report may include probability values (score values) calculated using scientifically recognised mathematical-statistical procedures, which may include address data. Your legitimate interests are taken into account in accordance with statutory provisions.

You have the right, on grounds relating to your particular situation, to object to such processing based on Art. 6(1)(f) GDPR by notifying Stripe.

Cookies and Consent Management

Cookies

Our website uses cookies. Cookies are small text files that are stored in the internet browser or by the internet browser on a user’s computer system.

When a user accesses a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string that enables the browser to be uniquely identified when the website is accessed again.

Cookies are stored on your computer. You therefore have full control over the use of cookies. By selecting the appropriate technical settings in your internet browser, you can be notified before cookies are set and decide whether to accept them individually, as well as prevent cookies from being stored and the data contained therein from being transmitted.

Cookies that have already been stored can be deleted at any time. However, please note that you may then not be able to use all functions of this website to their full extent.

You can find information on how to manage and disable cookies in the major browsers in the respective browser support documentation.

Technically Necessary Cookies

Unless otherwise stated in this Privacy Policy, we only use technically necessary cookies for the purpose of making our services more user-friendly, effective and secure.

Cookies also enable our systems to recognise your browser after you change pages and provide services to you. Certain functions of our website cannot be offered without the use of cookies. These functions require the browser to be recognised even after a page change.

The use of cookies or comparable technologies is based on Section 25(2) TDDDG.

Your personal data is processed on the basis of Art. 6(1)(f) GDPR due to our overriding legitimate interest in ensuring the optimal functionality of the website and providing a user-friendly and effective design of our services.

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you.

Use of the Shopify Consent Tool (Shopify Privacy & Compliance)

We use the “Shopify Privacy & Compliance” consent tool provided by Shopify International Ltd. (Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland; “Shopify”) on our website.

Shopify is affiliated with Shopify Inc. (151 O’Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada).

The tool enables you to grant consent to data processing via the website, in particular the setting of cookies, and to exercise your right to withdraw consent previously granted.

The purpose of data processing is to obtain and document the necessary consent to data processing and thereby comply with statutory obligations.

Cookies may be used for this purpose. User information, including your IP address, may be collected and transmitted to Shopify.

This data transfer is based on contractual obligations comparable to the European Commission’s Standard Contractual Clauses.

Data processing is carried out to fulfil a legal obligation on the basis of Art. 6(1)(c) GDPR.

Analytics and Tracking

Use of Google Analytics 4

We use the Google Analytics web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”) on our website.

The purpose of data processing is to analyse this website and its visitors and for marketing and advertising purposes.

For this purpose, Google will use the information obtained on behalf of the operator of this website to evaluate your use of the website, compile reports on website activity and provide other services relating to website and internet usage to the website operator.

The following information may be collected, among other things: IP address, date and time of page access, click path, information about the browser and device used, pages visited, referrer URL, location data and purchasing activities.

Your data may be linked by Google with other data, such as your search history, personal accounts, usage data from other devices and any other data Google holds about you.

Your IP address is first truncated by us on our own servers. Google therefore only receives pseudonymised data.

Google uses technologies such as cookies, browser web storage and tracking pixels that enable your use of the website to be analysed.

The use of cookies or comparable technologies is carried out with your consent on the basis of Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

Your personal data is processed with your consent on the basis of Art. 6(1)(a) GDPR. You may withdraw your consent at any time without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

We also use Google Signals in this context. Google Signals enables cross-device tracking. Your data can therefore be analysed across devices if you have enabled “personalised advertising” in your account settings and your devices are linked to your Google account.

This makes it possible, for example, to recognise which device you use to search for products and whether you later return to complete purchases using another device such as a tablet.

The cross-device reports created in this context contain only aggregated data. We therefore only receive statistics generated on the basis of Google Signals.

We use the advanced implementation of Consent Mode (Advanced Consent Mode). In this context, usage data is transmitted to Google in the form of “pings” even where consent has not been granted.

These pings may include information such as the IP address for deriving the IP country (the IP address itself is not logged), date and time of page access, URL of pages visited, user agent, referrer URL or information about website events such as a conversion.

Based on this information, Google models usage data in order to enable comprehensive usage analysis despite the refusal of consent.

The information generated about your use of this website is generally transferred to and stored on a Google server in the USA.

An adequacy decision by the European Commission exists for the USA in the form of the Trans-Atlantic Data Privacy Framework (TADPF). Google is certified under the TADPF and has therefore committed to complying with European data protection principles.

Both Google and US government authorities may have access to your data.

Use of Hotjar

We use the Hotjar analytics tool provided by Hotjar Ltd. (Level 2, St Julian’s Business Centre, 3 Elia Zammit Street, St Julians STJ1000, Malta; “Hotjar”) on our website.

The purpose of data processing is to enable needs-based design, optimisation and analysis of our website.

The tool records the movements of selected website visitors on a sample basis. This creates a record of mouse movements, scrolling behaviour, time spent on the website and clicks (a so-called heatmap).

Hotjar uses cookies, among other technologies, for this purpose.

Information collected may include your IP address in anonymised form, information about your device, screen size, unique device identifier, browser information, country-level location data, preferred language and operating system.

Pseudonymous user profiles are created from this data. The data is not used to personally identify visitors to the website and is not combined with personal data relating to the holder of the pseudonym.

Hotjar is contractually prohibited from selling the collected data to other third parties.

Your data may be transferred to the USA. An adequacy decision by the European Commission exists for the USA in the form of the TADPF. Hotjar is not certified under the TADPF. Data transfers are carried out, among other things, on the basis of appropriate safeguards.

The use of cookies or comparable technologies is carried out with your consent on the basis of Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

Use of Shopify Analytics

We use the statistics and analytics functions provided by Shopify International Ltd. (Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland; “Shopify”) as part of commissioned processing.

Shopify is affiliated with Shopify Inc. (151 O’Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada).

The purpose of data processing is to analyse this website and its visitors. Data is stored for marketing and optimisation purposes and provided in reports, analyses and statistics.

Device information collected and processed may include information about your web browser, IP address, time zone and some of the cookies installed on your device.

When you navigate the website, information about pages or products viewed, the referrer URL and information about how you interact with the website is also collected.

Technologies such as cookies, web beacons, tags and pixels are used for this purpose.

Such data transfers are based on contractual obligations comparable to the European Commission’s Standard Contractual Clauses.

The use of cookies or comparable technologies is carried out with your consent on the basis of Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

Your personal data is processed with your consent on the basis of Art. 6(1)(a) GDPR.

Use of the Triple Whale Pixel

We use technologies provided by Triple Whale Inc., 266 N 5th Street, Columbus, OH 43215, USA (“Triple Whale”) for analytics, attribution and marketing evaluations.

Triple Whale provides an e-commerce analytics platform for merchants and, according to its own documentation, processes merchant data on behalf of its customers.

In connection with the Triple Whale Pixel or comparable tracking technologies, device and cookie IDs, log file data, IP addresses, cookie data and information about visits, interactions, orders and other conversion events may be processed and combined with data from connected marketing and shop systems.

The purpose of processing is to measure and attribute marketing activities, analyse the customer journey and generate reports.

Non-essential cookies or comparable technologies are used only with your consent on the basis of Section 25(1) TDDDG. Personal data is processed in this respect on the basis of Art. 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future using the privacy or cookie settings provided on our website.

According to its Privacy Notice, Triple Whale processes data in the USA, Europe, Israel and other countries. For transfers from the EEA to countries without an adequate level of data protection, Triple Whale provides, in particular, for the use of the European Commission’s Standard Contractual Clauses.

Use of Microsoft Clarity

We use the “Microsoft Clarity” analytics tool provided by Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; “Microsoft”) on our website.

Microsoft is affiliated with Microsoft Corporation (One Microsoft Way, Redmond, Washington 98052, USA).

The purpose of data processing is the needs-based design, optimisation and analysis of our website.

The tool records the movements of selected website visitors on a sample basis. This creates a record of mouse movements, scrolling behaviour, time spent and clicks on the website (a so-called heatmap).

Cookies or comparable technologies are used for this purpose.

Information collected may include your IP address, time of access, click path, information about your device, device type, screen size and resolution, unique device identifier, operating system, browser type and version, location data, preferred language, pages visited, duration of visits, content viewed and requested websites or files.

Pseudonymous user profiles are created from this data. The data is not used to personally identify website visitors and is not combined with personal data relating to the holder of the pseudonym.

Microsoft is contractually prohibited from selling the collected data to other third parties.

Your data may be transferred to the USA. An adequacy decision by the European Commission exists for the USA in the form of the TADPF. Microsoft is certified under the TADPF and has therefore committed to complying with European data protection principles.

The use of cookies or comparable technologies and the processing of your personal data are based on your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

Advertising Tracking

Use of the Meta Pixel

We use the Meta Pixel provided by Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; “Meta”) on our website.

Meta and we are joint controllers for the collection of your data and transmission of this data to Meta that takes place when the service is integrated.

The basis for this is an agreement between us and Meta on the joint processing of personal data, in which the respective responsibilities are defined.

Under this agreement, we are responsible in particular for fulfilling the information obligations pursuant to Art. 13 and 14 GDPR, complying with the security requirements of Art. 32 GDPR with regard to the correct technical implementation and configuration of the service, and complying with the obligations under Art. 33 and 34 GDPR insofar as a personal data breach concerns our obligations under the joint processing agreement.

Meta is responsible for enabling data subject rights pursuant to Art. 15–20 GDPR, complying with the security requirements of Art. 32 GDPR with regard to the security of the service and complying with the obligations under Art. 33 and 34 GDPR insofar as a personal data breach concerns Meta’s obligations under the joint processing agreement.

The application is used to target website visitors with interest-based advertising on the Facebook and Instagram social networks.

For this purpose, Meta’s remarketing tag has been implemented on the website. When you visit the website, this tag establishes a direct connection to Meta’s servers. This informs Meta’s server which of our pages you have visited.

Meta may associate this information with your personal Facebook and/or Instagram user account. When you visit Facebook or Instagram, personalised, interest-based advertisements may then be displayed to you.

The application is also used to generate conversion statistics. This enables us to determine the total number of users who clicked on one of our advertisements and were redirected to a page containing a conversion tracking tag, as well as the actions taken after being redirected to this website.

However, we do not receive information that allows us to personally identify users.

Your data may be transferred to the USA. An adequacy decision by the European Commission exists for the USA in the form of the TADPF. Meta is certified under the TADPF.

Your personal data is processed with your consent on the basis of Art. 6(1)(a) GDPR. You may withdraw your consent at any time.

Use of Google Ads Conversion Tracking

We use the “Google Ads” online advertising programme and, as part of this, conversion tracking.

Google Conversion Tracking is an analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”).

When you click on an advertisement placed by Google, a conversion tracking cookie is stored on your computer. These cookies have a limited validity period, do not contain personal data and are therefore not used for personal identification.

If you visit certain pages of our website while the cookie is still valid, Google and we can recognise that you clicked on the advertisement and were redirected to that page.

Each Google Ads customer receives a different cookie. Cookies therefore cannot be tracked across the websites of different Ads customers.

The information obtained using the conversion cookie is used to generate conversion statistics. This allows us to determine the total number of users who clicked on one of our advertisements and were redirected to a page containing a conversion tracking tag.

However, we do not receive information that allows us to personally identify users.

We use the advanced implementation of Consent Mode (Advanced Consent Mode). Usage data is transmitted to Google in the form of “pings” even where consent has not been granted.

These pings may contain information including the IP address for deriving the IP country, date and time of page access, URLs visited, user agent, referrer URL or information about website events such as conversions.

Based on this information, Google models usage data in order to enable comprehensive usage analysis despite refusal of consent.

Your data may be transferred to Google LLC servers in the USA. Google is certified under the TADPF.

The use of cookies or comparable technologies and processing of your personal data are carried out with your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

Use of Microsoft Advertising

We use Microsoft Advertising provided by Microsoft Corporation (One Microsoft Way, Redmond, WA 98052-6399, USA; “Microsoft”) on our website.

The purpose of data processing is marketing and advertising and measuring the success of advertising activities (conversion tracking).

We receive information about the total number of users who clicked on one of our advertisements and were redirected to a page containing a conversion tracking tag. This does not enable us to personally identify these users.

Microsoft Advertising uses technologies such as cookies and tracking pixels that enable analysis of your use of the website.

Information collected may include your IP address, identifiers assigned by Microsoft, information about your browser and device, referrer URL and the URL of our website.

Your data may be transferred to the USA. Microsoft is certified under the TADPF.

The use of cookies or comparable technologies and processing of your personal data are carried out with your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

Use of the Pinterest Tag

We use the Pinterest Tag provided by Pinterest Europe Limited (Palmerston House, 2nd, Fenian Street, Floor, Dublin 2, Ireland; “Pinterest”) on our website.

The application is used to target website visitors with interest-based advertising on the Pinterest social network.

For this purpose, Pinterest’s conversion tag has been implemented on the website. When you visit the website, a direct connection is established with Pinterest’s servers. This informs Pinterest which of our pages you have visited.

Pinterest may associate this information with your personal Pinterest user account if you are logged into the social network.

The information obtained using conversion tracking is also used to generate conversion statistics and optimise our website. Information processed may include the total number of users who clicked on our Pins and were redirected to our website, pages visited on our website, search queries, shopping cart contents and completed transactions.

Your data may be transferred to the USA. Pinterest is not certified under the TADPF. Data transfers are carried out, among other things, on the basis of Standard Contractual Clauses as appropriate safeguards.

The use of cookies or comparable technologies and processing of your personal data are carried out with your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

Use of the TikTok Pixel

We use the TikTok Pixel provided by TikTok Technology Limited (10 Earlsfort Terrace, Dublin, D02 T380, Ireland; “TikTok Ireland”) and TikTok Information Technologies UK Limited (6th Floor, One London Wall, London, EC2Y 5EB, United Kingdom; “TikTok UK”).

The companies are joint controllers for the relevant data processing (“TikTok”).

The purpose of data processing is to identify and analyse website visits, improve customer targeting through targeted advertisements and evaluate the effectiveness of advertisements on TikTok.

TikTok uses technologies such as cookies and pixels that enable your browser to be recognised.

Information collected and transmitted to TikTok may include the date and time of your visit, information about your browser and device type, screen resolution and IP address.

TikTok may associate this information with your personal TikTok user account. Pseudonymous usage profiles may be created from the data collected.

Your data may be transferred to third countries, including the USA. TikTok is not certified under the TADPF. Transfers to the USA and other third countries without an adequacy decision are carried out, among other things, on the basis of Standard Contractual Clauses.

The use of cookies or comparable technologies and processing of your personal data are carried out with your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

Use of Criteo

We use technology provided by Criteo SA (32 Rue Blanche, 75009 Paris, France; “Criteo”) on our website.

The application is used to target website visitors with interest-based advertising in the form of personalised advertising banners on other websites (so-called publishers).

Criteo uses technologies such as cookies that enable your browser to be recognised.

Information collected and transmitted to Criteo may include the referrer URL, pages visited on our website, date and time of the visit, your smartphone advertising ID, information about your browser and device, and shopping cart contents.

Pseudonymous usage profiles may be created from this data. This does not enable users to be personally identified.

The use of cookies or comparable technologies and processing of your personal data are carried out with your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

Affiliate Programmes

Use of the ADCELL Affiliate Programme

We use the “ADCELL” affiliate programme provided by Firstlead GmbH (Rosenfelder Str. 15–16, 10315 Berlin; “ADCELL”).

ADCELL and we are joint controllers for the collection of your data and transmission of this data to ADCELL that takes place when the service is integrated.

The basis for this is an agreement between us and ADCELL on the joint processing of personal data.

If you click on an advertisement containing an affiliate link, ADCELL stores a conversion tracking cookie on your computer. The cookies are used to ensure correct billing within the affiliate programme by recording the success of advertising material.

ADCELL also uses tracking pixels. These enable information such as visitor traffic on pages to be evaluated.

The information generated by cookies and tracking pixels concerning the use of this website, including the IP address, is transmitted to and stored on an ADCELL server.

The use of cookies or comparable technologies and processing of your personal data are carried out with your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

Use of the Amazon Affiliate Programme

We use the “AmazonPartnerNet” affiliate programme provided by Amazon EU S.à r.l. (5 Rue Plaetis, L-2338 Luxembourg; “Amazon”).

We have placed advertisements on our website in the form of links to offers on various Amazon websites.

Amazon uses cookies for the purpose of correctly billing transactions within the affiliate programme. The cookies enable Amazon to determine that you clicked on an advertising link and to trace the origin of an order generated via the advertising link.

Your data may be transferred to the USA. Amazon is certified under the TADPF.

The use of cookies or comparable technologies and processing of your personal data are carried out with your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

Use of the Awin Affiliate Programme

We use the “Awin” affiliate programme provided by AWIN AG (Eichhornstraße 3, 10785 Berlin; “Awin”).

If you click on an advertisement containing an affiliate link, Awin stores a conversion tracking cookie on your computer. The cookies are used to ensure correct billing within the affiliate programme by recording the success of advertising material.

Awin also uses fingerprinting, which can be used to recognise the device you are using.

Awin may collect transaction data such as order value, product type, sales channel and use of a voucher, as well as a user identifier in the form of an individual numerical sequence.

Your data may be transferred to third countries such as the USA. Such transfers are carried out, among other things, on the basis of Standard Contractual Clauses as appropriate safeguards.

The use of cookies or comparable technologies and processing of your personal data are carried out with your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

AI and Automated Systems

Use of the AI-Supported Chat System “ChatGPT”

We use the “ChatGPT” chat system provided by OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (“OpenAI”) on our website.

ChatGPT is an automated system based on artificial intelligence. The systems used are based on Large Language Models (LLMs) trained using machine learning methods.

In simplified terms, the system works as follows:

text inputs are converted into numerical representations (“token vectors”);
based on probabilistic methods (Transformer architecture, deep learning), the model calculates the most likely subsequent tokens;
the response is generated step by step from these probabilities.

This is stochastic text generation rather than “human thinking”. Content may be incorrect or incomplete. We do not perform human review in real time.

In accordance with Art. 52 of the AI Act, we inform you that you are interacting with an AI system. Responses generated by ChatGPT may contain errors or be incomplete. Please critically review the content and do not rely exclusively on chatbot responses for legally binding matters.

The system is used for automated communication and to simplify and accelerate responses to customer enquiries, particularly regarding order status, product characteristics and shipment tracking.

We ask you not to enter personal, business or confidential information into the chatbot. Your inputs to OpenAI are not used to train OpenAI’s models.

The following data may be collected and processed: your IP address, date and time of page access, click path, information about your browser and device, pages visited, referrer URL, location data, your chat input and the responses generated by the chatbot.

This information is stored so that relevant information can subsequently be provided in the event of enquiries or information requests made by you.

Authentication takes place explicitly only using an existing order number and the corresponding postcode.

Cookies are used for this purpose. The cookies enable the internet browser to be recognised.

Your data may be transferred to the USA. OpenAI is not certified under the TADPF. Data transfers are carried out, among other things, on the basis of Standard Contractual Clauses as appropriate safeguards.

The use of cookies or comparable technologies is carried out with your consent on the basis of Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

Use of “Shopify Network Intelligence”

We use the “Shopify Network Intelligence” security and analytics function provided by Shopify Inc., Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland, in our online shop.

Shopify Network Intelligence is an automated system based on artificial intelligence. The system is used for network security, fraud detection and optimisation of shop performance.

For this purpose, Shopify Network Intelligence monitors network access and user behaviour in order to detect and prevent fraudulent activities such as credit card misuse and bot attacks at an early stage. Data is also used for technical stability and performance analysis.

Shopify Network Intelligence is used to ensure IT security and fraud prevention, the availability of the online shop, and analysis and optimisation of shop performance.

Cookies are used for this purpose. The cookies enable the internet browser to be recognised.

Your data may be transferred to Canada. The European Commission has issued an adequacy decision for Canada covering data processing by companies subject to the Personal Information Protection and Electronic Documents Act (PIPEDA).

The use of cookies or comparable technologies and processing of your personal data are carried out with your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

Other Services and Content

Use of Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”) on our website.

This application is used to manage JavaScript and HTML tags that are used, in particular, to implement tracking and analytics tools.

The purpose of data processing is the needs-based design and optimisation of our website.

Google Tag Manager itself does not store cookies and does not itself process personal data. However, it enables other tags to be triggered that may collect and process personal data.

Use of Google reCAPTCHA

We use the reCAPTCHA service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”) on our website.

The purpose of the service is to distinguish between input made by a human and automated machine processing.

For this purpose, your input is transmitted to Google and further processed there. Your IP address and, where applicable, other data required by Google for the reCAPTCHA service are also transmitted to Google.

Your data may be transferred to Google LLC servers in the USA. Google is certified under the TADPF.

The use of cookies or comparable technologies and processing of your personal data are carried out with your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

Use of Google Invisible reCAPTCHA

We use the invisible reCAPTCHA service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”) on our website.

The purpose is to distinguish between input made by a human and automated machine processing.

In the background, Google collects and analyses usage data that Invisible reCAPTCHA uses to distinguish ordinary users from bots.

For this purpose, your input is transmitted to Google and further processed there. Your IP address and, where applicable, other data required by Google for Invisible reCAPTCHA are also transmitted to Google.

The use of cookies or comparable technologies and processing of your personal data are carried out with your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

Use of Cloudflare

We use the Cloudflare CDN content delivery network provided by Cloudflare Inc. (101 Townsend St, San Francisco, CA 94107, USA; “Cloudflare”) on our website.

This is a geographically distributed network of servers in various data centres through which our web server connects and certain content on our website is delivered.

The purpose of data processing is to optimise the loading times of our website and thereby make our services more user-friendly.

Information collected may include your IP address, system configuration information and information about traffic to and from customer websites (server log files).

Your data may be transferred to the USA. Cloudflare is certified under the TADPF and has therefore committed to complying with European data protection principles.

Your personal data is processed on the basis of Art. 6(1)(f) GDPR due to our overriding legitimate interest in the needs-based and targeted design of the website.

You have the right, on grounds relating to your particular situation, to object at any time to processing based on Art. 6(1)(f) GDPR.

Use of Google Maps

We use the function for embedding Google Maps provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”) on our website.

The function enables the visual display of geographical information and interactive maps.

When pages containing embedded Google Maps are accessed, Google also collects, processes and uses data relating to website visitors.

Your data may also be transferred to the USA. Google is certified under the TADPF.

The use of cookies or comparable technologies and processing of your personal data are carried out with your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

Use of OpenStreetMap

We use the open-source mapping service provided by the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom; “OpenStreetMap”) on our website.

The purpose of data processing is to visually display geographical information and maps in order to show you our location.

Cookies may be used. Information collected and processed may include the date and time of access, IP address and information about your browser and device.

If you have an OpenStreetMap user account and are logged in when visiting the website, this information may be associated with your personal user account. Additional information such as your user ID, the email address associated with the account and content blocked by you may then be collected and processed.

Your data may be transferred outside the EU to the United Kingdom. The European Commission has issued an adequacy decision for the United Kingdom.

The use of cookies or comparable technologies and processing of your personal data are carried out with your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

Use of YouTube

We use the function for embedding YouTube videos provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “YouTube”) on our website.

YouTube is affiliated with Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”).

The function displays videos hosted on YouTube in an iFrame on our website. The “Privacy-Enhanced Mode” option is enabled.

As a result, YouTube does not store information about website visitors merely when the page is accessed. Only when you watch a video is information transmitted to and stored by YouTube.

Your data may be transferred to the USA. YouTube/Google is certified under the TADPF.

The use of cookies or comparable technologies and processing of your personal data are carried out with your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

Use of Google Fonts

We use Google Fonts provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”) on our website.

The purpose of data processing is to ensure the consistent display of fonts on our website.

To load the fonts, a connection to Google’s servers is established when the page is accessed. Your IP address and information about the browser you are using may be processed and transmitted to Google. This data is not linked to your Google account.

Your data may be transferred to the USA. Google is certified under the TADPF.

The use of cookies or comparable technologies and processing of your personal data are carried out with your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

Data Subject Rights and Storage Period

Duration of Storage

After the contract has been fully processed, the data is initially stored for the duration of the statutory warranty period and subsequently in accordance with statutory retention periods, in particular those under tax and commercial law. After expiry of these periods, the data is deleted unless you have consented to further processing and use.

Rights of the Data Subject

If the statutory requirements are met, you have the following rights pursuant to Art. 15–20 GDPR:

right of access;
right to rectification;
right to erasure;
right to restriction of processing;
right to data portability.

In addition, pursuant to Art. 21(1) GDPR, you have the right to object to processing based on Art. 6(1)(f) GDPR and to processing for direct marketing purposes.

Right to Lodge a Complaint with the Supervisory Authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data is not lawful.

You may lodge a complaint, among others, with the supervisory authority responsible for us:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219
Visitor entrance: Puttkamerstr. 16–18 (5th floor)
10969 Berlin
Germany
Tel.: +49 30 138890
Fax: +49 30 2155050
Email: mailbox@datenschutz-berlin.de

Right to Object

If the processing of personal data described herein is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR, you have the right, on grounds relating to your particular situation, to object to such processing at any time with effect for the future.

Following an objection, processing of the data concerned will cease unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or where processing serves the establishment, exercise or defence of legal claims.

If personal data is processed for direct marketing purposes, you may object to such processing at any time by notifying us. Following your objection, we will cease processing the data concerned for direct marketing purposes.