1) Introduction and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about how we handle your personal data when you use our website. Personal data is any data with which you can be personally identified.

1.2 The controller responsible for data processing on this website, within the meaning of the General Data Protection Regulation (GDPR), is “Jean & Len GmbH, Brunnenstraße 31, 72505 Krauchenwies, Germany, Tel.: +49 (0) 7576 / 9295 - 444, Fax: +49 (0) 7576 / 9295 - 205, e-mail: info@jeanlen.de”. The controller for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

1.3 The controller has appointed a data protection officer, who can be reached as follows: “Matthias Walliser, Altenwaldstraße 8, 72768 Reutlingen, Germany, +49 7121 69 702 - 26, datenschutz@jeanlen.de”

2) Data Collection When You Visit Our Website

2.1 If you use our website for informational purposes only, i.e. if you do not register or otherwise send us information, we only collect the data that your browser transmits to our server (so-called “server log files”). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

• The page of our website that you visited
• Date and time of access
• Amount of data sent in bytes
• Source/referrer from which you reached the page
• Browser used
• Operating system used
• IP address used (if applicable, in anonymized form)

The processing is carried out pursuant to Art. 6 (1) (f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used in any other way. However, we reserve the right to review the server log files retrospectively if there are concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the string “https://” and the lock symbol in your browser’s address bar.

3) Hosting & Content Delivery Network

3.1 Creoline

We use a content delivery network from the following provider: Creoline GmbH, Bergstraße 9a, 48341 Altenberge, Germany

This service enables us to deliver large media files such as graphics, page content or scripts more quickly via a network of regionally distributed servers. The processing is carried out to safeguard our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6 (1) (f) GDPR.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

3.2 Zendesk CDN

Nature and scope of processing
To ensure the proper provision of the content of our website, we use Zendesk CDN. Zendesk CDN is a service of Zendesk, Inc. that acts as a content delivery network (CDN) on our website in order to ensure the functionality of further services of Zendesk, Inc. These services are covered in a separate section of this privacy policy. This section only concerns the use of the CDN.

A CDN helps to deliver content of our online offering, in particular files such as graphics or scripts, more quickly with the help of regionally or internationally distributed servers. When you access this content, you connect to servers of Zendesk, Inc., 989 Market Street #300, San Francisco, CA 94102, USA, whereby your IP address and, if applicable, browser data such as your user agent are transmitted. This data is processed exclusively for the purposes stated above and to maintain the security and functionality of Zendesk CDN.

Purpose and legal basis
The content delivery network is used on the basis of our legitimate interests, i.e. our interest in the secure and efficient provision and optimization of our online offering pursuant to Art. 6 (1) (f) GDPR.

Storage period
We cannot influence the specific storage period of the processed data; it is determined by Zendesk, Inc. Further information can be found in the privacy policy for Zendesk CDN: https://zendesk.com/company/customers-partners/privacy-policy/.

3.3 Unpkg CDN

Nature and scope of processing
To ensure the proper provision of the content of our website, we use Unpkg CDN. Unpkg CDN is a service of Cloudflare, Inc. that acts as a content delivery network (CDN) on our website. A CDN helps to deliver content of our online offering, in particular files such as graphics or scripts, more quickly with the help of regionally or internationally distributed servers. When you access this content, you connect to servers of Cloudflare, Inc., whereby your IP address and, if applicable, browser data such as your user agent are transmitted. This data is processed exclusively for the purposes stated above and to maintain the security and functionality of Unpkg CDN.

Purpose and legal basis
The content delivery network is used on the basis of our legitimate interests, i.e. our interest in the secure and efficient provision and optimization of our online offering pursuant to Art. 6 (1) (f) GDPR.

Storage period
We cannot influence the specific storage period of the processed data; it is determined by Cloudflare, Inc. Further information can be found in the privacy policy for Unpkg CDN: https://www.cloudflare.com/privacypolicy/.

3.4 JSDelivr CDN

Nature and scope of processing
To ensure the proper provision of the content of our website, we use JSDelivr CDN. JSDelivr CDN is a service of Prospect One that acts as a content delivery network (CDN) on our website. A CDN helps to deliver content of our online offering, in particular files such as graphics or scripts, more quickly with the help of regionally or internationally distributed servers. When you access this content, you connect to servers of Prospect One, Krolewska 65a, Krakow, Malopolskie 30-081, Poland, whereby your IP address and, if applicable, browser data such as your user agent are transmitted. This data is processed exclusively for the purposes stated above and to maintain the security and functionality of JSDelivr CDN.

Purpose and legal basis
The content delivery network is used on the basis of our legitimate interests, i.e. our interest in the secure and efficient provision and optimization of our online offering pursuant to Art. 6 (1) (f) GDPR.

Storage period
We cannot influence the specific storage period of the processed data; it is determined by Prospect One. Further information can be found in the privacy policy for JSDelivr CDN: https://www.jsdelivr.com/privacy-policy-jsdelivr-net.

3.5 Pinterest CDN

Nature and scope of processing
To ensure the proper provision of the content of our website, we use Pinterest CDN. Pinterest CDN is a service of Pinterest Inc. that acts as a content delivery network (CDN) on our website. A CDN helps to deliver content of our online offering, in particular files such as graphics or scripts, more quickly with the help of regionally or internationally distributed servers. When you access this content, you connect to servers of Pinterest Inc., 651 Brannan Street, San Francisco, CA 94107, United States, whereby your IP address and, if applicable, browser data such as your user agent are transmitted. This data is processed exclusively for the purposes stated above and to maintain the security and functionality of Pinterest CDN.

Purpose and legal basis
The content delivery network is used on the basis of our legitimate interests, i.e. our interest in the secure and efficient provision and optimization of our online offering pursuant to Art. 6 (1) (f) GDPR.

Storage period
We cannot influence the specific storage period of the processed data; it is determined by Pinterest Inc. Further information can be found in the privacy policy for Pinterest CDN: https://policy.pinterest.com/en/privacy-policy.

4) Cookies

To make your visit to our website more appealing and to enable certain functions, we use cookies, i.e. small text files that are stored on your end device. Some of these cookies are automatically deleted when you close your browser (so-called “session cookies”), while others remain on your end device for longer and allow site settings to be saved (so-called “persistent cookies”). In the latter case, you can check the storage period in the cookie settings of your web browser.

Where personal data is also processed through individual cookies we use, the processing is carried out pursuant to Art. 6 (1) (b) GDPR for the performance of a contract, pursuant to Art. 6 (1) (a) GDPR if you have given your consent, or pursuant to Art. 6 (1) (f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and in providing a customer-friendly and effective site experience.

You can set your browser to notify you when cookies are placed, so that you can decide individually whether to accept them, and to block cookies in specific cases or altogether.

Please note that if you do not accept cookies, the functionality of our website may be restricted.

5) Contacting Us

5.1 Zendesk (formerly Zopim)

This website uses a live chat system from the following provider: Zendesk International Ltd., 55 Charlemont Place, Saint Kevin's, Dublin D02 F985, Ireland

The processing of personal data transmitted via the chat is carried out either pursuant to Art. 6 (1) (b) GDPR, because it is necessary for the initiation or performance of a contract, or pursuant to Art. 6 (1) (f) GDPR on the basis of our legitimate interest in providing effective support to our website visitors.
Unless statutory retention periods require longer storage, the data transmitted in this way will be deleted once the matter concerned has been conclusively resolved.

In addition, for the purpose of creating pseudonymized usage profiles, further information may be collected and evaluated with the help of cookies. This information is not used to identify you personally and is not merged with other data sets. Where this information constitutes personal data, the processing is carried out pursuant to Art. 6 (1) (f) GDPR on the basis of our legitimate interest in the statistical analysis of user behavior for optimization purposes.

The placing of cookies can be prevented by adjusting your browser settings accordingly. In that case, however, the functionality of our website may be restricted. You can object to the collection and storage of data for the purpose of creating a pseudonymized usage profile at any time with effect for the future.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

5.2 In-House Review Reminder

Exclusively on the basis of your express consent pursuant to Art. 6 (1) (a) GDPR, we use your e-mail address to send you a one-time reminder to submit a review of your order. You can withdraw your consent at any time by sending a message to the controller responsible for data processing.

5.3 Trusted Shops

For review reminders, we use the services of the following provider: Trusted Shops AG, Subbelrather Str. 15c, 50823 Cologne, Germany

Exclusively on the basis of your express consent pursuant to Art. 6 (1) (a) GDPR, we transmit your e-mail address and, if applicable, other customer data to the provider so that it can contact you with a review reminder by e-mail.

You can withdraw your consent at any time with effect for the future, either towards us or towards the provider.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

5.4 Zendesk

To process customer inquiries, we use the e-mail ticketing system of the following provider: Zendesk International Ltd., 55 Charlemont Place, Saint Kevin's, Dublin D02 F985, Ireland

If you send us an inquiry by e-mail via our website, it is stored and organized in the ticket system so that it can be processed in chronological order and to improve the service experience. Using the individually assigned ticket number, you can check the current status of your inquiry at any time.

To organize and process inquiries, personal data is collected to the extent that you provide it, but in any case your last name, first name and e-mail address. This data is transmitted to the provider, stored there and accessed.

The legal basis for the processing of this data is our legitimate interest in the efficient organization of our customer service, in responding to your inquiry as quickly as possible and in optimizing our service offering pursuant to Art. 6 (1) (f) GDPR.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

5.5 WhatsApp Business

We offer visitors to our website the opportunity to contact us via the messaging service WhatsApp, provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For this purpose, we use the so-called “Business version” of WhatsApp.

If you contact us via WhatsApp in connection with a specific transaction (for example, an order you have placed), we store and use the mobile phone number you use for WhatsApp and – if provided – your first and last name pursuant to Art. 6 (1) (b) GDPR in order to process and respond to your inquiry. On the same legal basis, we may ask you via WhatsApp to provide further data (order number, customer number, address or e-mail address) so that we can assign your inquiry to a specific case.

If you use our WhatsApp contact for general inquiries (for example, about our range of services, availability or our website), we store and use the mobile phone number you use for WhatsApp and – if provided – your first and last name pursuant to Art. 6 (1) (f) GDPR on the basis of our legitimate interest in providing the requested information efficiently and promptly.

Your data is only ever used to respond to your inquiry via WhatsApp. It is not passed on to third parties.

Please note that WhatsApp Business gains access to the address book of the mobile device we use for this purpose and automatically transmits the telephone numbers stored in the address book to a server of its parent company Meta Platforms Inc. in the USA. To operate our WhatsApp Business account, we use a mobile device whose address book exclusively contains the WhatsApp contact details of those users who have also contacted us via WhatsApp.

This ensures that every person whose WhatsApp contact details are stored in our address book has already consented, when first using the app on their device by accepting the WhatsApp terms of use, to the transmission of their WhatsApp telephone number from the address books of their chat contacts pursuant to Art. 6 (1) (a) GDPR. The transmission of data of users who do not use WhatsApp and/or have not contacted us via WhatsApp is therefore ruled out.

For the purpose and scope of the data collection and the further processing and use of the data by WhatsApp, as well as your related rights and the options available to protect your privacy, please refer to the WhatsApp privacy notice: https://www.whatsapp.com/legal/?eea=1#privacy-policy

In the context of the processing described above, data may be transferred to servers of Meta Platforms Inc. in the USA.

For data transfers to the USA, the provider is certified under the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures a level of data protection that corresponds to European requirements.

5.6 When you contact us (e.g. via contact form or e-mail), personal data is processed – exclusively for the purpose of processing and responding to your inquiry and only to the extent necessary for this purpose.

The legal basis for the processing of this data is our legitimate interest in responding to your inquiry pursuant to Art. 6 (1) (f) GDPR. If your inquiry is aimed at concluding a contract, an additional legal basis for the processing is Art. 6 (1) (b) GDPR. Your data will be deleted once it is apparent from the circumstances that the matter concerned has been conclusively resolved, provided no statutory retention obligations apply.

6) Comment Function

When you use the comment function on this website, in addition to your comment, the time the comment was created and the commenter name you chose are stored and published on this website. Furthermore, your IP address is stored for security reasons so that, in the case of unlawful comments, they can be attributed to the author. Your e-mail address is stored so that we can contact you if a third party objects that your published content is unlawful.

The legal bases for the storage of your data are Art. 6 (1) (b) and (f) GDPR. We reserve the right to delete comments if third parties object to them as unlawful.

7) Data Processing When You Create a Customer Account

Pursuant to Art. 6 (1) (b) GDPR, personal data will continue to be collected and processed to the extent required in each case if you provide it to us when creating a customer account. You can see which data is required to create an account in the relevant form on our website.

You can delete your customer account at any time by sending a message to the controller at the address given above. After your customer account has been deleted, your data will be deleted, provided that all contracts concluded through it have been fully performed, no statutory retention periods apply, and we no longer have a legitimate interest in continued storage.

8) Use of Customer Data for Direct Marketing

8.1 Subscribing to Our E-Mail Newsletter

If you subscribe to our e-mail newsletter, we will regularly send you information about our offers. The only mandatory information for sending the newsletter is your e-mail address. Providing further data is voluntary and is used to address you personally. For sending the newsletter, we use the so-called double opt-in procedure, which ensures that you only receive the newsletter once you have expressly confirmed your consent to receive it by clicking a verification link sent to the e-mail address you provided.

By activating the confirmation link, you give us your consent to the use of your personal data pursuant to Art. 6 (1) (a) GDPR. In doing so, we store the IP address assigned to you by your internet service provider (ISP) as well as the date and time of your subscription, so that we can trace any possible misuse of your e-mail address at a later point in time. The data we collect when you subscribe to the newsletter is used strictly for the stated purpose.

You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending a message to the controller named at the beginning. Once you have unsubscribed, your e-mail address will be promptly deleted from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to make further use of your data where this is permitted by law and we have informed you of such use in this policy.

8.2 Klaviyo

Our e-mail newsletters are sent by this provider: Klaviyo, 225 Franklin St, Boston, MA 02110, USA

On the basis of our legitimate interest in effective and user-friendly newsletter marketing, we pass on the data you provided when subscribing to the newsletter to this provider pursuant to Art. 6 (1) (f) GDPR, so that it can send the newsletter on our behalf.

Subject to your express consent pursuant to Art. 6 (1) (a) GDPR, the provider also carries out a statistical analysis of the success of newsletter campaigns by means of web beacons or tracking pixels in the e-mails sent, which can measure open rates and specific interactions with the content of the newsletter. In doing so, end device information (e.g. time of access, IP address, browser type and operating system) is also collected and evaluated, but not merged with other data sets.

You can withdraw your consent to newsletter tracking at any time with effect for the future.

We have concluded a data processing agreement with the provider, which protects the data of our website visitors and prohibits disclosure to third parties.

For data transfers to the USA, the provider is certified under the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures a level of data protection that corresponds to European requirements.

8.3 WhatsApp Newsletter

If you subscribe to our WhatsApp newsletter, we will regularly send you information about our offers via WhatsApp. The only mandatory information for sending the newsletter is your mobile phone number.

To receive the newsletter, you add the mobile phone number we provide to the contacts on your mobile device and send us the message “Start” via WhatsApp. By sending this WhatsApp message, you give us your consent to the use of your personal data pursuant to Art. 6 (1) (a) GDPR for the purpose of sending the newsletter. We will then add you to our newsletter distribution list.

The data we collect when you subscribe to the newsletter is processed exclusively to send you advertising via the newsletter. You can unsubscribe from the newsletter at any time by sending us the message “Stop” via WhatsApp. Once you have unsubscribed, your mobile phone number will be promptly deleted from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to make further use of your data where this is permitted by law and we have informed you of such use in this policy.

Please note that WhatsApp gains access to the address book of the mobile device we use for sending the newsletter and automatically transmits the telephone numbers stored in the address book to a server of Facebook in the USA.

For sending our WhatsApp newsletter, we therefore use a mobile device whose address book exclusively contains the WhatsApp contact details of our newsletter recipients. This ensures that every person whose WhatsApp contact details are stored in our address book has already consented, when first using the app on their device by accepting the WhatsApp terms of use, to the transmission of their WhatsApp telephone number from the address books of their chat contacts pursuant to Art. 6 (1) (a) GDPR. The transmission of data of users who do not use WhatsApp and/or have not contacted us via WhatsApp is therefore ruled out.

For the purpose and scope of the data collection and the further processing and use of the data by WhatsApp, as well as your related rights and the options available to protect your privacy, please refer to the WhatsApp privacy notice: https://www.whatsapp.com/legal/?eea=1#privacy-policy

In the context of the processing described above, data may be transferred to servers of Meta Platforms Inc. in the USA.

For data transfers to the USA, the provider is certified under the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures a level of data protection that corresponds to European requirements.

8.4 Back-in-Stock Notification by E-Mail

For temporarily unavailable items, you can sign up to receive back-in-stock notifications by e-mail. In this case, we will send you a one-time e-mail message about the availability of the item you selected. The only mandatory information for sending this notification is your e-mail address. Providing further data is voluntary and, where applicable, is used to address you personally. For sending the e-mail, we use the so-called double opt-in procedure, which ensures that you only receive a notification once you have expressly confirmed your consent to this by clicking a verification link sent to the e-mail address you provided.

By activating the confirmation link, you give us your consent to the use of your personal data pursuant to Art. 6 (1) (a) GDPR. In doing so, we store the IP address assigned to you by your internet service provider (ISP) as well as the date and time of your subscription, so that we can trace any possible misuse of your e-mail address at a later point in time. The data we collect when you sign up for our back-in-stock e-mail notification service is used strictly for the stated purpose.

You can unsubscribe from the back-in-stock notifications at any time by sending a message to the controller named at the beginning. Once you have unsubscribed, your e-mail address will be promptly deleted from the distribution list set up for this purpose, unless you have expressly consented to further use of your data or we reserve the right to make further use of your data where this is permitted by law and we have informed you of such use in this policy.

8.5 Abandoned Cart Reminders by E-Mail

If you abandon your purchase with us before completing the order, you have the option of being reminded once by e-mail of the contents of your virtual shopping cart.

The only mandatory information for sending this reminder is your e-mail address. Providing further data is voluntary and, where applicable, is used to address you personally. For sending the e-mail, we use the so-called double opt-in procedure, which ensures that you only receive a notification once you have expressly confirmed your consent to this by clicking a verification link sent to the e-mail address you provided.

By activating the confirmation link, you give us your consent to the use of your personal data pursuant to Art. 6 (1) (a) GDPR for sending a shopping cart reminder. In doing so, we store the IP address assigned to you by your internet service provider (ISP) as well as the date and time of your subscription, so that we can trace any possible misuse of your e-mail address at a later point in time. The data we collect when you sign up for our e-mail notification service is used strictly for the stated purpose.

You can unsubscribe from the shopping cart reminders at any time by sending a message to the controller named at the beginning. Once you have unsubscribed, your e-mail address will be promptly deleted from the distribution list set up for this purpose, unless you have expressly consented to further use of your data or we reserve the right to make further use of your data where this is permitted by law and we have informed you of such use in this policy.

8.6 Newsletter Delivery via Charles

Our WhatsApp newsletter is sent via the technical service provider “Charles GmbH”. This is done pursuant to Art. 6 (1) (f) GDPR and serves our legitimate interest in using an effective, secure and user-friendly newsletter system. The data you provided when subscribing to the newsletter is passed on to Charles GmbH for this purpose. Please note that your data is generally stored on the servers of Charles GmbH. Charles GmbH uses this information to send the newsletter on our behalf. Charles GmbH does not use the data of our newsletter recipients to contact them itself or to pass it on to third parties. To protect your data, we have concluded a data processing agreement with Charles GmbH, in which Charles GmbH undertakes to protect the data of our users, to process it on our behalf in accordance with its data protection provisions and, in particular, not to pass it on to third parties. You can view the privacy policy of Charles GmbH here: https://www.hello-charles.de/datenschutz/.

9) Data Processing for Order Fulfillment

9.1 Where necessary for the performance of the contract for delivery and payment purposes, the personal data we collect will be passed on to the transport company and credit institution commissioned by us pursuant to Art. 6 (1) (b) GDPR.

If, on the basis of a corresponding contract, we owe you updates for goods with digital elements or for digital products, we process the contact data you provided when placing the order (name, address, e-mail address) pursuant to Art. 6 (1) (c) GDPR in order to inform you personally, via a suitable means of communication (e.g. by post or e-mail), of upcoming updates within the statutory period, as part of our statutory information obligations. Your contact data is used strictly for the purpose of notifications about updates owed by us and is processed by us for this purpose only to the extent necessary for the respective notification.

To process your order, we also work with the service provider(s) listed below, who support us in whole or in part in the performance of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

9.2 Disclosure of Personal Data to Shipping Service Providers

- DHL

We use the following provider as our transport service provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany

We pass on your e-mail address and/or telephone number to the provider pursuant to Art. 6 (1) (a) GDPR before delivery of the goods for the purpose of arranging a delivery date or announcing the delivery, provided that you have given your express consent to this during the order process. Otherwise, for the purpose of delivery, we only pass on the name of the recipient and the delivery address to the provider pursuant to Art. 6 (1) (b) GDPR. Data is only passed on to the extent necessary for the delivery of the goods. In this case, it is not possible to arrange a delivery date with the provider in advance or to receive a delivery notification.

You can withdraw your consent at any time with effect for the future by notifying either the controller named above or the provider.
- DHL Express

We use the following provider as our transport service provider: DHL Express Germany GmbH, Heinrich-Brüning-Str. 5, 53113 Bonn, Germany

We pass on your e-mail address and/or telephone number to the provider pursuant to Art. 6 (1) (a) GDPR before delivery of the goods for the purpose of arranging a delivery date or announcing the delivery, provided that you have given your express consent to this during the order process. Otherwise, for the purpose of delivery, we only pass on the name of the recipient and the delivery address to the provider pursuant to Art. 6 (1) (b) GDPR. Data is only passed on to the extent necessary for the delivery of the goods. In this case, it is not possible to arrange a delivery date with the provider in advance or to receive a delivery notification.

You can withdraw your consent at any time with effect for the future by notifying either the controller named above or the provider.

9.3 Use of Payment Service Providers

- Amazon Pay

One or more online payment methods of the following provider are available on this website: Amazon Payments Europe s.c.a., 38 avenue J.F. Kennedy, L-1855 Luxembourg

If you select a payment method of the provider where you pay in advance (e.g. credit card payment), the payment data you provided during the order process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be passed on to the provider pursuant to Art. 6 (1) (b) GDPR. In this case, your data is passed on exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.
- Apple Pay

If you choose the payment method “Apple Pay” of Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment is processed via the “Apple Pay” function of your iOS, watchOS or macOS device by charging a payment card stored in “Apple Pay”. Apple Pay uses security features built into the hardware and software of your device to protect your transactions. To authorize a payment, you must therefore enter a code you have previously set and verify using the “Face ID” or “Touch ID” function of your device.

For the purpose of payment processing, the information you provided during the order process, together with the information about your order, is passed on to Apple in encrypted form. Apple then encrypts this data again with a developer-specific key before the data is transmitted to the payment service provider of the payment card stored in Apple Pay in order to carry out the payment. The encryption ensures that only the website through which the purchase was made can access the payment data. After the payment has been made, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website to confirm that the payment was successful.

Where personal data is processed in the transmissions described, the processing is carried out exclusively for the purpose of payment processing pursuant to Art. 6 (1) (b) GDPR.

Apple retains anonymized transaction data, including the approximate purchase amount, the approximate date and time, and an indication of whether the transaction was completed successfully. Anonymization completely rules out the identification of any individual. Apple uses the anonymized data to improve “Apple Pay” and other Apple products and services.

If you use Apple Pay on your iPhone or Apple Watch to complete a purchase you made via Safari on your Mac, the Mac and the authorizing device communicate with Apple’s servers over an encrypted channel. Apple does not process or store any of this information in a format that could be used to identify you. You can disable the option to use Apple Pay on your Mac in the settings of your iPhone. Go to “Wallet & Apple Pay” and turn off “Allow Payments on Mac”.

Further information on data protection for Apple Pay can be found at the following internet address: https://support.apple.com/en-us/HT203027
- Google Pay

If you choose the payment method “Google Pay” of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), payment is processed via the “Google Pay” application of your mobile device, which runs Android 4.4 (“KitKat”) or later and has an NFC function, by charging a payment card stored in Google Pay or a payment system verified there (e.g. PayPal). To authorize a payment of more than €25 via Google Pay, you must first unlock your mobile device using the verification measure you have set up (e.g. face recognition, password, fingerprint or pattern).

For the purpose of payment processing, the information you provided during the order process, together with the information about your order, is passed on to Google. Google then transmits your payment information stored in Google Pay to the originating website in the form of a one-time transaction number, which is used to verify that a payment has been made. This transaction number does not contain any information about the actual payment data of the payment methods you have stored in Google Pay, but is created and transmitted as a numerical token that is valid only once. For all transactions via Google Pay, Google acts merely as an intermediary for processing the payment. The transaction is carried out exclusively between the user and the originating website by charging the payment method stored in Google Pay.

Where personal data is processed in the transmissions described, the processing is carried out exclusively for the purpose of payment processing pursuant to Art. 6 (1) (b) GDPR.

Google reserves the right to collect, store and evaluate certain transaction-specific information for each transaction made via Google Pay. This includes the date, time and amount of the transaction, merchant location and description, a description of the purchased goods or services provided by the merchant, photos you have attached to the transaction, the name and e-mail address of the seller and buyer or of the sender and recipient, the payment method used, your description of the reason for the transaction and, where applicable, the offer associated with the transaction.

According to Google, this processing is carried out exclusively pursuant to Art. 6 (1) (f) GDPR on the basis of the legitimate interest in proper accounting, the verification of transaction data and the optimization and maintenance of the functionality of the Google Pay service.

Google also reserves the right to merge the processed transaction data with other information that Google collects and stores when further Google services are used.

The terms of use of Google Pay can be found here:

https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=en
Further information on data protection for Google Pay can be found at the following internet address:
https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en
- giropay

One or more online payment methods of the following provider are available on this website: paydirekt GmbH, Stephanstr. 14-16, 60313 Frankfurt am Main, Germany

If you select a payment method of the provider where you pay in advance (e.g. credit card payment), the payment data you provided during the order process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be passed on to the provider pursuant to Art. 6 (1) (b) GDPR. In this case, your data is passed on exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.
- Klarna

One or more online payment methods of the following provider are available on this website: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden

If you select a payment method of the provider where you pay in advance (e.g. credit card payment), the payment data you provided during the order process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be passed on to the provider pursuant to Art. 6 (1) (b) GDPR. In this case, your data is passed on exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

If you select a payment method where the provider advances the payment (e.g. purchase on account, installment purchase or direct debit), you will also be asked during the order process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, e-mail address, telephone number and, if applicable, data on an alternative payment method).

To safeguard our legitimate interest in determining the creditworthiness of our customers, we pass on this data to the provider pursuant to Art. 6 (1) (f) GDPR for the purpose of a credit check. On the basis of the personal data you provided and further data (such as shopping cart, invoice amount, order history, payment experience), the provider checks whether the payment option you selected can be offered with regard to the risk of payment default and/or uncollectible receivables.

In deciding on the application, in addition to the provider’s internal criteria pursuant to Art. 6 (1) (f) GDPR, identity and credit information from the following credit reference agencies may also be taken into account:

https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The credit report may contain probability values (so-called score values). Where score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical method. The calculation of the score values takes into account, among other things (but not exclusively), address data.

You can object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may remain entitled to process your personal data where this is necessary for payment processing in accordance with the contract.
- Mollie

One or more online payment methods of the following provider are available on this website: Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands

If you select a payment method of the provider where you pay in advance (e.g. credit card payment), the payment data you provided during the order process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be passed on to the provider pursuant to Art. 6 (1) (b) GDPR. In this case, your data is passed on exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.
- PayPal

One or more online payment methods of the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method of the provider where you pay in advance, the payment data you provided during the order process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be passed on to the provider pursuant to Art. 6 (1) (b) GDPR. In this case, your data is passed on exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

If you select a payment method under which we deliver before receiving payment, you will also be asked during the order process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, e-mail address, telephone number and, if applicable, data on an alternative payment method).

To safeguard our legitimate interest in determining your creditworthiness in such cases, we pass on this data to the provider pursuant to Art. 6 (1) (f) GDPR for the purpose of a credit check. On the basis of the personal data you provided and further data (such as shopping cart, invoice amount, order history, payment experience), the provider checks whether the payment option you selected can be offered with regard to the risk of payment default and/or uncollectible receivables.

The credit report may contain probability values (so-called score values). Where score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical method. The calculation of the score values takes into account, among other things (but not exclusively), address data.

You can object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may remain entitled to process your personal data where this is necessary for payment processing in accordance with the contract.
- SOFORT

One or more online payment methods of the following provider are available on this website: SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany

If you select a payment method of the provider where you pay in advance (e.g. credit card payment), the payment data you provided during the order process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be passed on to the provider pursuant to Art. 6 (1) (b) GDPR. In this case, your data is passed on exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.
- Bancontact

One or more online payment methods of the following provider are available on this website: Bancontact Payconiq Company, Rue d'Arlon 82, 1040 Brussels, Belgium

If you select a payment method of the provider where you pay in advance (e.g. credit card payment), the payment data you provided during the order process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be passed on to the provider pursuant to Art. 6 (1) (b) GDPR. In this case, your data is passed on exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.
- iDEAL

One or more online payment methods of the following provider are available on this website: Currence Holding BV, Beethovenstraat 300 Amsterdam, Netherlands

If you select a payment method of the provider where you pay in advance (e.g. credit card payment), the payment data you provided during the order process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be passed on to the provider pursuant to Art. 6 (1) (b) GDPR. In this case, your data is passed on exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

10) Online Marketing

Our Own Affiliate Program

In connection with the product presentations on our website, we operate our own affiliate program, under which we provide interested third-party website operators with partner links to be placed on their websites that lead to our offers. The affiliate program uses cookies, which are generally set on the partner site after a click on a corresponding partner link and for which we are therefore not the controller within the meaning of data protection law. Cookies are small text files that are stored on your end device in order to be able to trace the origin of transactions (e.g. “sales leads”) generated via such links. Among other things, this allows us to recognize that you clicked the partner link and were redirected to our website. This information is required for payment processing between us and the affiliate partners. Where the information also contains personal data, the processing described is carried out on the basis of our legitimate financial interest in handling commission payments pursuant to Art. 6 (1) (f) GDPR.

If you wish to block the analysis of user behavior via cookies, you can set your browser to notify you when cookies are placed, so that you can decide individually whether to accept them, or to reject cookies in certain cases or altogether.

11) Web Analytics Services

11.1 Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), which enables an analysis of your use of our website.

By default, when you visit the website, Google Analytics 4 sets cookies, which are stored on your end device as small text files and collect certain information. This information includes your IP address, the last digits of which are truncated by Google in order to rule out direct identifiability.

The information is transmitted to Google servers and processed further there. Transfers to Google LLC, based in the USA, are also possible.

On our behalf, Google uses the information collected to evaluate your use of the website, to compile reports on website activity for us and to provide further services related to website and internet use. The truncated IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. The data collected through the use of Google Analytics 4 is stored for a period of two months and then deleted.

All processing described above, in particular the placing of cookies on the end device used, only takes place if you have given us your express consent to this pursuant to Art. 6 (1) (a) GDPR.
Without your consent, Google Analytics 4 is not used during your visit to the website. You can withdraw your consent at any time with effect for the future. To do so, please deactivate this service via the “cookie consent tool” provided on the website.

We have concluded a data processing agreement with Google, which ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

Further legal information on Google Analytics 4 can be found at https://policies.google.com/privacy?hl=en&gl=de and at https://policies.google.com/technologies/partner-sites

Demographics
Google Analytics 4 uses the special “demographics” function and can use it to generate statistics that provide information about the age, gender and interests of website visitors. This is done by analyzing advertising and information from third-party providers. This makes it possible to identify target groups for marketing activities. However, the data collected cannot be attributed to a specific person and is deleted after being stored for a period of two months.

Google Signals
As an extension to Google Analytics 4, Google Signals may be used on this website to generate cross-device reports. If you have enabled personalized ads and have linked your devices to your Google account, Google may, subject to your consent to the use of Google Analytics pursuant to Art. 6 (1) (a) GDPR, analyze your usage behavior across devices and create database models, including for cross-device conversions. We do not receive any personal data from Google, only statistics. If you wish to stop the cross-device analysis, you can deactivate the “Ad personalization” function in the settings of your Google account. To do so, follow the instructions on this page: https://support.google.com/ads/answer/2662922?hl=en Further information on Google Signals can be found at the following link: https://support.google.com/analytics/answer/7532985?hl=en

User IDs
As an extension to Google Analytics 4, the “User IDs” function may be used on this website. If you have consented to the use of Google Analytics 4 pursuant to Art. 6 (1) (a) GDPR, have set up an account on this website and log in to this account on different devices, your activities, including conversions, can be analyzed across devices.

For data transfers to the USA, the provider is certified under the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures a level of data protection that corresponds to European requirements.

11.2 Google Tag Manager

This website uses the “Google Tag Manager”, a service of the following provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”).

Google Tag Manager provides a technical basis for bundling various web applications, including tracking and analytics services, and for calibrating and controlling them, and making their execution subject to conditions, via a single user interface. Google Tag Manager itself does not store or read any information on users’ end devices. Nor does the service carry out any independent data analyses. However, when a page is accessed, Google Tag Manager transmits your IP address to Google, where it may be stored. A transfer to servers of Google LLC in the USA is also possible.

This processing only takes place if you have given us your express consent to it pursuant to Art. 6 (1) (a) GDPR. Without this consent, Google Tag Manager is not used during your visit to the website. You can withdraw your consent at any time with effect for the future. To do so, please deactivate this service in the “cookie consent tool” provided on the website.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider is certified under the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures a level of data protection that corresponds to European requirements.

11.3 Google reCAPTCHA

We have integrated components of Google reCAPTCHA into our website. Google reCAPTCHA is a service of Google Ireland Limited and enables us to distinguish whether a contact request comes from a natural person or is made automatically by a program. When you access this content, you establish a connection to servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, whereby your IP address and, if applicable, browser data such as your user agent are transmitted. Furthermore, Google reCAPTCHA records the user’s time spent on the page and mouse movements in order to distinguish automated requests from human ones. This data is processed exclusively for the purposes stated above and to maintain the security and functionality of Google reCAPTCHA.

Google reCAPTCHA is used on the basis of your consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TTDSG (German Telecommunications Telemedia Data Protection Act).

We intend to transfer personal data to third countries outside the European Economic Area, in particular the USA. The data transfer to the USA takes place pursuant to Art. 45 (1) GDPR on the basis of the adequacy decision of the European Commission. The US companies involved and/or their US subcontractors are certified under the EU-U.S. Data Privacy Framework (EU-U.S. DPF). In cases where no adequacy decision of the European Commission exists (including US companies that are not certified under the EU-U.S. DPF), we have put in place other appropriate safeguards within the meaning of Art. 44 et seq. GDPR with the recipients of the data. Unless stated otherwise, these are the standard contractual clauses of the EU Commission pursuant to Implementing Decision (EU) 2021/914 of 4 June 2021. You can view a copy of these standard contractual clauses at https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914&from=EN. In addition, before such a third-country transfer we obtain your consent pursuant to Art. 49 (1) sentence 1 (a) GDPR, which you give through the consent manager (or other forms, registrations, etc.). We would like to point out that, in the case of third-country transfers, there may be risks that are not known in detail (e.g. processing of data by security agencies of the third country, the precise scope and consequences of which we do not know, over which we have no influence and of which you may not become aware).

We cannot influence the specific storage period of the processed data; it is determined by Google Ireland Limited. Further information can be found in the privacy policy for Google reCAPTCHA: https://policies.google.com/privacy?hl=en-US.

12) Retargeting / Remarketing and Conversion Tracking

12.1 Facebook Pixel for Creating Custom Audiences

On our website, we use the “Facebook Pixel” service of the following provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Facebook”)

If a user clicks on an advertisement we have placed on Facebook, the “Facebook Pixel” adds a parameter to the URL of our linked page. After the redirect, this URL parameter is then written into the user’s browser by a cookie that our linked page itself sets.

On the one hand, this enables Facebook to identify the visitors to our website as a target group for the display of advertisements (so-called “Facebook Ads”). Accordingly, we use the service to show the Facebook Ads we place only to those Facebook users who have also shown an interest in our website or who exhibit certain characteristics (e.g. interests in certain topics or products, determined on the basis of the websites visited), which we transmit to Facebook (so-called “Custom Audiences”).

On the other hand, the “Facebook Pixel” can be used to trace whether users were redirected to our website after clicking on a Facebook advertisement and what actions they take there (so-called “conversion tracking”).

The data collected is anonymous to us, so it does not allow us to draw any conclusions about the identity of the users. However, the data is stored and processed by Facebook, so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes.

All processing described above, in particular the placing of cookies to read information on the device you are using, only takes place if you have given us your express consent to this pursuant to Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service in the “cookie consent tool” provided on the website.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

The information generated by Facebook is generally transmitted to a Facebook server and stored there; in this context, a transfer to servers of Meta Platforms Inc. in the USA may also take place.

For data transfers to the USA, the provider is certified under the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures a level of data protection that corresponds to European requirements.

12.2 Facebook Plugin

We have integrated components of the Facebook Plugin into our website. The Facebook Plugin is a service of Meta Platforms Ireland Limited and gives us the option of aggregating content from the social media platform and displaying it on our website. When you access this content, you connect to servers of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, whereby your IP address and, if applicable, browser data such as your user agent are transmitted. This data is processed exclusively for the purposes stated above and to maintain the security and functionality of the Facebook Plugin. If a user is registered with Meta Platforms Ireland Limited, the Facebook Plugin can assign the content viewed to the user’s profile.

The Facebook Plugin is used on the basis of your consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TTDSG.

We cannot influence the specific storage period of the processed data; it is determined by Meta Platforms Ireland Limited. Further information can be found in the privacy policy for Facebook Plugin: https://www.facebook.com/policy.php.

12.3 Google Ads Remarketing

This website uses retargeting technology of the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

For this purpose, Google places a cookie in the browser of your end device, which automatically enables interest-based advertising by means of a pseudonymous cookie ID and on the basis of the pages you have visited. Further data processing only takes place if you have agreed with Google that your internet and app browsing history is linked by Google to your Google account and that information from your Google account is used to personalize ads that you see on the web. If, in this case, you are logged in to Google while visiting our website, Google uses your data together with Google Analytics data to create and define audience lists for cross-device remarketing. For this purpose, your personal data is temporarily linked by Google with Google Analytics data in order to form target groups. When using Google Ads Remarketing, personal data may also be transferred to the servers of Google LLC in the USA.

All processing described above, in particular the placing of cookies to read information on the device you are using, only takes place if you have given us your express consent to this pursuant to Art. 6 (1) (a) GDPR. Without this consent, retargeting technology is not used during your visit to the website.

You can withdraw your consent at any time with effect for the future. To do so, please deactivate this service in the “cookie consent tool” provided on the website.

For data transfers to the USA, the provider is certified under the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures a level of data protection that corresponds to European requirements.

12.4 Google Ads Conversion Tracking

This website uses the online advertising program “Google Ads” and, as part of Google Ads, the conversion tracking of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). We use Google Ads to draw attention to our attractive offers with the help of advertising materials (so-called Google Ads) on external websites. Using the data from the advertising campaigns, we can determine how successful the individual advertising measures are. Our aim is to show you advertising that is of interest to you, to make our website more interesting for you and to achieve a fair calculation of the advertising costs incurred.

The cookie for conversion tracking is set when a user clicks on an ad placed by Google. Cookies are small text files that are stored on your end device. These cookies generally expire after 30 days and are not used for personal identification. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognize that the user clicked on the ad and was redirected to this page. Each Google Ads customer receives a different cookie. Cookies therefore cannot be tracked across the websites of Google Ads customers. The information obtained with the help of the conversion cookie is used to generate conversion statistics for Google Ads customers who have opted for conversion tracking. The customers learn the total number of users who clicked on their ad and were redirected to a page tagged with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users. When using Google Ads, personal data may also be transferred to the servers of Google LLC in the USA.

Details on the processing triggered by Google Ads Conversion Tracking and on how Google handles data from websites can be found here: https://policies.google.com/technologies/partner-sites

All processing described above, in particular the placing of cookies to read information on the device you are using, only takes place if you have given us your express consent to this pursuant to Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service in the “cookie consent tool” provided on the website.

You can also permanently object to the placing of cookies by Google Ads Conversion Tracking by downloading and installing the Google browser plug-in available at the following link:
https://www.google.com/settings/ads/plugin?hl=en

Please note that certain functions of this website may not be usable, or only to a limited extent, if you have deactivated the use of cookies.
Google’s privacy policy can be viewed here: https://www.google.de/policies/privacy/

For data transfers to the USA, the provider is certified under the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures a level of data protection that corresponds to European requirements.

12.5 Google DoubleClick

We have integrated components of Google DoubleClick into our website. DoubleClick is a brand of Google under which specialized online marketing solutions are offered mainly to advertising agencies and publishers. DoubleClick by Google transmits data to the DoubleClick server with every impression as well as with clicks or other activities. Each of these data transmissions triggers a cookie request to the data subject’s browser. If the browser accepts this request, DoubleClick places a cookie in your browser.

DoubleClick uses a cookie ID, which is required for the technical processing. The cookie ID is needed, for example, to display an advertisement in a browser. DoubleClick can also use the cookie ID to record which advertisements have already been displayed in a browser, in order to avoid duplicate placements. Furthermore, the cookie ID enables DoubleClick to record conversions. Conversions are recorded, for example, when a DoubleClick advertisement has previously been displayed to a user and the user subsequently makes a purchase on the advertiser’s website using the same internet browser. A DoubleClick cookie does not contain any personal data, but may contain additional campaign identifiers. A campaign identifier serves to identify the campaigns you have already come into contact with on other websites. As part of this service, Google receives data that it also uses to prepare commission statements. Among other things, Google can see that you have clicked on certain links on our website. In this case, your data is passed on to the operator of DoubleClick, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Further information and the applicable privacy policy of DoubleClick by Google can be found at https://policies.google.com/privacy.

We process your data with the help of the DoubleClick cookie for the purpose of optimizing and displaying advertising on the basis of your consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TTDSG. Among other things, the cookie is used to serve and display advertising that is relevant to users and to create or improve reports on advertising campaigns. The cookie also serves to avoid multiple displays of the same advertisement. Each time one of the individual pages of our website on which a DoubleClick component has been integrated is accessed, your browser is automatically prompted by the respective DoubleClick component to transmit data to Google for the purposes of online advertising and the billing of commissions. There is no statutory or contractual obligation to provide your data. If you do not give us your consent, you can visit our website without restriction, but not all functions may be fully available. We intend to transfer personal data to third countries outside the European Economic Area, in particular the USA. The data transfer to the USA takes place pursuant to Art. 45 (1) GDPR on the basis of the adequacy decision of the European Commission. The US companies involved and/or their US subcontractors are certified under the EU-U.S. Data Privacy Framework (EU-U.S. DPF).

In cases where no adequacy decision of the European Commission exists (including US companies that are not certified under the EU-U.S. DPF), we have put in place other appropriate safeguards within the meaning of Art. 44 et seq. GDPR with the recipients of the data. Unless stated otherwise, these are the standard contractual clauses of the EU Commission pursuant to Implementing Decision (EU) 2021/914 of 4 June 2021. You can view a copy of these standard contractual clauses at https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914&from=EN. In addition, before such a third-country transfer we obtain your consent pursuant to Art. 49 (1) sentence 1 (a) GDPR, which you give through the consent manager (or other forms, registrations, etc.). We would like to point out that, in the case of third-country transfers, there may be risks that are not known in detail (e.g. processing of data by security agencies of the third country, the precise scope and consequences of which we do not know, over which we have no influence and of which you may not become aware).

Storage period
We cannot influence the specific storage period of the processed data; it is determined by Google Ireland Limited. Further information can be found in the privacy policy for Google DoubleClick: https://policies.google.com/privacy.

12.6 TikTok Pixel

This website uses the conversion tracking technology of the following provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland

If you reached our website from an advertisement on the provider’s domain, the success of the advertisement can be tracked with the help of cookies and/or comparable technologies (tracking pixels, web beacons, pings or HTTP requests).

For this purpose, the tracking technology reads certain end device and browser information, including, where applicable, your IP address, in order to record and evaluate user actions predefined by us (e.g. completed transactions, leads, searches on the website, views of product pages). This makes it possible to create statistics on user behavior on our website after users are redirected from an advertisement, which helps us optimize our website.
All processing described above, in particular the placing of cookies to read information on the device you are using, only takes place if you have given us your express consent to this pursuant to Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service in the “cookie consent tool” provided on the website.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

12.7 Outbrain

We have integrated Outbrain into our website. Outbrain is a service of Outbrain Inc. for displaying targeted advertising to users. Outbrain uses cookies and other browser technologies to evaluate user behavior and recognize users. Outbrain collects information about visitor behavior on various websites. This information is used to optimize the relevance of advertising. Outbrain also delivers targeted advertising based on behavioral profiles and geographic location. Your IP address and other identifying features such as your user agent are transmitted to the provider. In this case, your data is passed on to the operator of Outbrain, Outbrain Inc., New York, New York, US.

Outbrain is used on the basis of your consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TTDSG.

We cannot influence the specific storage period of the processed data; it is determined by Outbrain Inc. Further information can be found in the privacy policy for Outbrain: https://www.outbrain.com/legal/privacy#privacy-policy.

12.8 Pinterest Conversion Tag

We use the Pinterest Conversion Tag of Pinterest Inc., 651 Brannan Street, San Francisco, CA 94107, United States, to create so-called Custom Audiences, i.e. to segment groups of visitors to our website, to determine conversion rates and subsequently to optimize them. This takes place in particular when you interact with advertisements that we have placed with Pinterest Inc.

The Pinterest Conversion Tag is used on the basis of your consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TTDSG.

We cannot influence the specific storage period of the processed data; it is determined by Pinterest Inc. Further information can be found in the privacy policy for Pinterest Conversion Tag: https://policy.pinterest.com/en/privacy-policy.

12.9 ADITION Adserving & Targeting

We use the ADITION Adserving & Targeting service of ADITION technologies AG, Oststraße 55, 40211 Düsseldorf, Germany, to show user groups specific and relevant advertisements with the help of targeting technologies. Web tracking technologies are used to create pseudonymized user profiles. As a rule, these profiles cannot be linked to you as a natural person, but serve, for example, for segmentation when displaying advertisements.

ADITION Adserving & Targeting is used on the basis of your consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TTDSG.

We cannot influence the specific storage period of the processed data; it is determined by ADITION technologies AG. Further information can be found in the privacy policy for ADITION Adserving & Targeting: https://www.adition.com/datenschutz.

12.10 Bing Ads

We have integrated Microsoft Advertising into our website. Microsoft Advertising is a service of Microsoft Corporation for displaying targeted advertising to users. Microsoft Advertising uses cookies and other browser technologies to evaluate user behavior and recognize users. Microsoft Advertising collects information about visitor behavior on various websites. This information is used to optimize the relevance of advertising. Microsoft Advertising also delivers targeted advertising based on behavioral profiles and geographic location. Your IP address and other identifying features such as your user agent are transmitted to the provider. In this case, your data is passed on to the operator of Microsoft Advertising, Microsoft Corporation, One Microsoft Way Redmond, WA 98052-6399, United States.

Microsoft Advertising is used on the basis of your consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TTDSG.

We cannot influence the specific storage period of the processed data; it is determined by Microsoft Corporation. Further information can be found in the privacy policy for Microsoft Advertising: https://privacy.microsoft.com/en-us/privacystatement.

13) Website Functionalities

13.1 YouTube

This website uses plugins for displaying and playing videos from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transferred to: Google LLC, USA

When you access a page of our website that contains such a plugin, your browser establishes a direct connection to the provider’s servers in order to load the plugin. In this process, certain information, including your IP address, is transmitted to the provider.

If playback of embedded videos is started via the plugin, the provider also uses cookies to collect information about user behavior, to compile playback statistics and to prevent abusive behavior.

If you are logged in to a user account with the provider during your visit to the website, your data will be directly assigned to your account when you click on a video. If you do not want the data to be assigned to your account, you must log out before clicking the play button.

All of the aforementioned processing, in particular the placing of cookies to read information on the device you are using, only takes place if you have given us your express consent to this pursuant to Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service via the “cookie consent tool” provided on the website.

For data transfers to the USA, the provider is certified under the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures a level of data protection that corresponds to European requirements.

13.2 Trusted Shops Trustbadge

To display external customer reviews and/or an externally awarded quality seal, graphic elements of the following provider are embedded on our website: Trusted Shops AG, Subbelrather Str. 15C, 50823 Cologne, Germany

When you access a page of our website that contains such graphic elements, your browser establishes a direct connection to the provider’s servers in order to load the elements properly. In this process, certain browser information, including your IP address, is transmitted to the provider.

Where personal data is also processed in this context, this takes place pursuant to Art. 6 (1) (f) GDPR on the basis of our legitimate interest in the optimal marketing of our offering and in an appealing design of our website.

13.3 Trusted Shops Widget

We have integrated components of the Trusted Shops Widget into our website. The Trusted Shops Widget is a review service that enables users to rate our services. If you rate our services, data about the service used may be transmitted to Trusted Shops GmbH in order to verify authenticity. The Trusted Shops Widget enables us to obtain content such as reviews directly from Trusted Shops GmbH and display it on our website. For this purpose, your current IP address is generally transmitted to the service. Furthermore, the Trusted Shops Widget stores information by means of cookies in order to find out which online offerings have been visited. In this case, your data is passed on to the operator of the Trusted Shops Widget, Trusted Shops GmbH, Subbelrather Straße 15c, 50823 Cologne, Germany.

The Trusted Shops Widget is used on the basis of Art. 6 (1) (f) GDPR in order to inform users about the quality of our services. If the user consents to the processing of their data, the legal basis for the processing is Art. 6 (1) (a) GDPR and Section 25 (1) TTDSG.

We cannot influence the specific storage period of the processed data; it is determined by Trusted Shops GmbH. Further information can be found in the privacy policy for the Trusted Shops Widget: https://business.trustedshops.de/impressum#datenschutz.

13.4 Online Applications via a Form

In a separate section of our website, we advertise currently vacant positions to which interested persons can apply via a corresponding form.

Applicants must provide all personal data required for a sound assessment, including general information such as name, address and contact details, as well as performance-related evidence and, where applicable, health-related information. Details of the application can be found in the job advertisement.

When the form is submitted, the applicant data is transmitted to us using state-of-the-art encryption, stored by us and evaluated exclusively for the purpose of processing the application. The processing is carried out pursuant to Art. 6 (1) (b) GDPR (or Section 26 (1) German Federal Data Protection Act (BDSG)), under which the application procedure is deemed to be the initiation of an employment contract.

Where special categories of personal data within the meaning of Art. 9 (1) GDPR (e.g. health data such as information on severe disability status) are requested from applicants in the course of the application procedure, the processing is carried out pursuant to Art. 9 (2) (b) GDPR so that we can exercise the rights arising from employment law and social security and social protection law and comply with our obligations in this regard.

Cumulatively or alternatively, the processing of the special categories of data may also be based on Art. 9 (1) (h) GDPR if it is carried out for the purposes of preventive healthcare or occupational medicine, for the assessment of the applicant’s working capacity, for medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services.

If the applicant is not selected or an applicant withdraws their application prematurely, the data they submitted via the form and all electronic correspondence, including the application e-mail, will be deleted after the applicant has been notified accordingly, and in any event no later than 6 months later. This period is based on our legitimate interest in answering any follow-up questions about the application and, if necessary, being able to comply with our obligations to provide evidence under the rules on equal treatment of applicants.

In the case of a successful application, the data provided will be processed on the basis of Art. 6 (1) (b) GDPR (in the case of processing in Germany in conjunction with Section 26 (1) BDSG) for the purpose of carrying out the employment relationship.

13.5 Applications for Advertised Positions by E-Mail

In a separate section of our website, we advertise currently vacant positions to which interested persons can apply by e-mail to the contact address provided.

Applicants must provide all personal data required for a sound assessment, including general information such as name, address and contact details, as well as performance-related evidence and, where applicable, health-related information. Details of the application can be found in the job advertisement.

After the application is received by e-mail, the data is stored and evaluated exclusively for the purpose of processing the application. If we have follow-up questions, we use either the applicant’s e-mail address or telephone number. The processing is carried out pursuant to Art. 6 (1) (b) GDPR (or Section 26 (1) BDSG), under which the application procedure is deemed to be the initiation of an employment contract.

Where special categories of personal data within the meaning of Art. 9 (1) GDPR (e.g. health data such as information on severe disability status) are requested from applicants in the course of the application procedure, the processing is carried out pursuant to Art. 9 (2) (b) GDPR so that we can exercise the rights arising from employment law and social security and social protection law and comply with our obligations in this regard.

Cumulatively or alternatively, the processing of the special categories of data may also be based on Art. 9 (1) (h) GDPR if it is carried out for the purposes of preventive healthcare or occupational medicine, for the assessment of the applicant’s working capacity, for medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services.

If the applicant is not selected or an applicant withdraws their application prematurely, the data they submitted and all electronic correspondence, including the application e-mail, will be deleted after the applicant has been notified accordingly, and in any event no later than 6 months later. This period is based on our legitimate interest in answering any follow-up questions about the application and, if necessary, being able to comply with our obligations to provide evidence under the rules on equal treatment of applicants.

In the case of a successful application, the data provided will be processed on the basis of Art. 6 (1) (b) GDPR (in the case of processing in Germany in conjunction with Section 26 (1) BDSG) for the purpose of carrying out the employment relationship.

13.6 Chatchamp

Nature and scope of processing
We have integrated components of the customer communication platform Chatchamp into our website. Chatchamp is a service of chatchamp UG and gives us the option of communicating with visitors to our website via chat and of providing targeted help with questions. Chatchamp uses cookies and other browser technologies to evaluate user behavior and recognize users. Chatchamp is also used to store and transmit data entered in chats by means of cookies, together with your IP address. In this case, your data is passed on to the operator of Chatchamp, chatchamp UG, Leopoldstraße 41, 80802 Munich, Germany.

Purpose and legal basis
Chatchamp is used on the basis of our legitimate interests, i.e. our interest in optimizing our online offering pursuant to Art. 6 (1) (f) GDPR.

Storage period
We cannot influence the specific storage period of the processed data; it is determined by chatchamp UG. Further information can be found in the privacy policy for Chatchamp: https://www.chatchamp.com/privacy/.

14) Tools and Miscellaneous

Usercentrics – Cookie Consent Tool

We have integrated Usercentrics into our website. Usercentrics is a consent solution of Usercentrics GmbH, Rosental 4, 80331 Munich, Germany, with which consent to the storage of cookies can be obtained and documented. Usercentrics uses cookies or other web technologies to recognize users and to store consent that has been given or withdrawn.

The tool sets technically necessary cookies to store your cookie preferences. As a rule, no personal user data is processed in this context.

If, in individual cases, personal data (such as the IP address) is nevertheless processed for the purpose of storing, assigning or logging cookie settings, this is carried out pursuant to Art. 6 (1) (f) GDPR on the basis of our legitimate interest in legally compliant, user-specific and user-friendly consent management for cookies and thus in a legally compliant website design.

A further legal basis for the processing is Art. 6 (1) (c) GDPR. As the controller, we are subject to the legal obligation to make the use of technically non-essential cookies dependent on the respective user’s consent.

Where necessary, we have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

Further information on the operator and the available settings of the cookie consent tool can be found directly in the corresponding user interface on our website.

15) Rights of the Data Subject

15.1 The applicable data protection law grants you the following data subject rights (rights of access and intervention) against the controller with regard to the processing of your personal data; the conditions for exercising each right are set out in the provision cited:

• Right of access pursuant to Art. 15 GDPR;
• Right to rectification pursuant to Art. 16 GDPR;
• Right to erasure pursuant to Art. 17 GDPR;
• Right to restriction of processing pursuant to Art. 18 GDPR;
• Right to notification pursuant to Art. 19 GDPR;
• Right to data portability pursuant to Art. 20 GDPR;
• Right to withdraw consent pursuant to Art. 7 (3) GDPR;
• Right to lodge a complaint pursuant to Art. 77 GDPR.

15.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST FOLLOWING A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU MAY EXERCISE THIS RIGHT TO OBJECT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

16) Storage Period of Personal Data

The period for which personal data is stored is determined by the respective legal basis, the purpose of the processing and – where applicable – additionally by the respective statutory retention period (e.g. retention periods under commercial and tax law).

In the case of processing of personal data on the basis of express consent pursuant to Art. 6 (1) (a) GDPR, the data concerned is stored until you withdraw your consent.

If statutory retention periods exist for data that is processed in connection with contractual or quasi-contractual obligations pursuant to Art. 6 (1) (b) GDPR, this data is routinely deleted after the retention periods have expired, provided that it is no longer required for the performance of the contract or for pre-contractual steps and/or we no longer have a legitimate interest in continued storage.

In the case of processing of personal data on the basis of Art. 6 (1) (f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

In the case of processing of personal data for the purpose of direct marketing on the basis of Art. 6 (1) (f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21 (2) GDPR.

Unless the other information in this policy on specific processing situations provides otherwise, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.