Privacy policy

1) Introduction and Contact Information for the Data Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we provide information about how we handle your personal data when you use our website. Personal data refers to any data that can be used to personally identify you.

1.2 The data controller for this website within the meaning of the General Data Protection Regulation (GDPR) is Black Ursus E-Commerce e.U.

Owner: Daniel Wimmer, Karl-Popper-Straße 5/36, 1100 Vienna, Austria, Tel.: +43 1 92843790, Email: support@blackursus.at. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2) Data Collection When You Visit Our Website

2.1 When you use our website solely for informational purposes—that is, if you do not register or otherwise provide us with information—we collect only the data that your browser transmits to the website server (so-called “server log files”). When you visit our website, we collect the following data, which is technically necessary for us to display the website to you:

The page you visited
Date and time of access
Amount of data transmitted in bytes
Source/referrer from which you accessed the page
Browser used
Operating system used
IP address used (if applicable: in anonymized form)

Processing is carried out in accordance with Article 6(1)(f) of the GDPR based on our legitimate interest in improving the stability and functionality of our website. The data is not disclosed or used for any other purpose. However, we reserve the right to review the server log files retrospectively should there be concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the “https://” prefix and the padlock icon in your browser’s address bar.

3) Hosting & Content Delivery Network

3.1 Shopify

We use the system provided by the following provider to host our website and display its content: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”)

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada

All data collected on our website is processed on the provider’s servers. We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

When data is transferred to Canada, an adequate level of data protection is guaranteed by an adequacy decision issued by the European Commission.

3.2 Cloudflare

We use a content delivery network provided by the following vendor: Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA

This service enables us to deliver large media files—such as graphics, page content, or scripts—more quickly via a network of regionally distributed servers. Data processing is carried out to safeguard our legitimate interest in improving the stability and functionality of our website in accordance with Article 6(1)(f) of the GDPR. We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

For data transfers to the United States, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with European data protection standards based on an adequacy decision by the European Commission.

3.3 Shopify

We use a content delivery network provided by the following vendor: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”)

Data may also be transferred to:

Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada
Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA

This service enables us to deliver large media files such as graphics, page content, or scripts more quickly via a network of regionally distributed servers. The processing is carried out to safeguard our legitimate interest in improving the stability and functionality of our website in accordance with Art. 6(1)(f) of the GDPR. We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

For data transfers to the United States, the data recipient has adhered to the EU-US Data Privacy Framework, which ensures compliance with European data protection standards based on an adequacy decision by the European Commission.

4) Cookies

To make your visit to our website more enjoyable and to enable the use of certain features, we use cookies—small text files that are stored on your device. Some of these cookies are automatically deleted when you close your browser (so-called “session cookies”), while others remain on your device for a longer period and allow page settings to be saved (so-called “persistent cookies”). In the latter case, you can find the storage duration in the overview of your web browser’s cookie settings.

If personal data is processed through individual cookies we use, such processing is carried out in accordance with Article 6(1)(b) of the GDPR either for the performance of a contract, in accordance with Article 6(1)(a) of the GDPR if consent has been given, or in accordance with Article 6(1)(f) of the GDPR to safeguard our legitimate interests in ensuring the best possible functionality of the website and a user-friendly and effective experience for visitors.

You can configure your browser to notify you when cookies are set and decide on a case-by-case basis whether to accept them, or to block the acceptance of cookies in specific cases or generally.

Please note that if you do not accept cookies, the functionality of our website may be limited.

5) Contacting Us

5.1 Zendesk

This website uses a live chat system provided by the following vendor: Zendesk International Ltd., 55 Charlemont Place, Saint Kevin's, Dublin D02 F985, Ireland

The processing of personal data transmitted via the chat takes place either in accordance with Article 6(1)(b) of the GDPR, because it is necessary for the initiation or performance of a contract, or in accordance with Article 6(1)(f) of the GDPR based on our legitimate interest in providing effective support to our website visitors.
The data you provide in this manner will be deleted once the matter in question has been conclusively resolved, subject to any conflicting statutory retention periods.

In addition, for the purpose of creating pseudonymized usage profiles using cookies, further information may be collected and analyzed; however, this information does not serve to identify you personally and is not combined with other data records. If this information is personally identifiable, processing is carried out in accordance with Article 6(1)(f) of the GDPR based on our legitimate interest in the statistical analysis of user behavior for optimization purposes.

The use of cookies can be prevented by adjusting your browser settings accordingly. However, this may limit the functionality of our website. You may object to the collection and storage of data for the purpose of creating a pseudonymized user profile at any time, with effect for the future.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

5.2 Judge.me

We use the services of the following provider for review reminders: Judge.me Ltd., c/o Buckworths, 2nd Floor, 1-3 Worship Street, London, England, EC2A 2AB, United Kingdom

Solely on the basis of your explicit consent pursuant to Art. 6(1)(a) of the GDPR, we transmit your email address and, if applicable, other customer data to the provider so that the provider can contact you via email with a review reminder.

You may revoke your consent at any time with future effect by notifying us or the provider.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

In the event of data transfer to the provider’s location, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

5.3 Zendesk

To process customer inquiries, we use the email ticketing system provided by the following vendor: Zendesk International Ltd., 55 Charlemont Place, Saint Kevin's, Dublin D02 F985, Ireland

If you submit contact requests via email through our website, these are stored and organized in the ticketing system to enable chronological processing and improve the service experience. You can always view the current status of your request using the individually assigned ticket number.

For the organization and processing of inquiries, personal data is collected to the extent it is provided—and in any case, at a minimum, your last name, first name, and email address—and is transmitted to the provider, where it is stored and accessed.

The legal basis for processing this data is our legitimate interest in efficiently organizing our customer service, responding to your inquiry as quickly as possible, and optimizing our service offerings in accordance with Article 6(1)(f) of the GDPR.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

5.4 WhatsApp Business

You have the option to contact us via the WhatsApp messaging service provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For this purpose, we use the so-called “Business version” of WhatsApp.

If you contact us via WhatsApp in connection with a specific business matter (such as a completed order), we will store and use the mobile phone number you use with WhatsApp, as well as your first and last name (if provided), in accordance with Article 6(1)(b) of the GDPR to process and respond to your inquiry. Based on the same legal basis, we may ask you via WhatsApp to provide additional data (order number, customer number, address, or email address) so that we can assign your inquiry to a specific transaction.

If you use our WhatsApp contact for general inquiries (such as regarding our range of services, availability, or our website), we will store and use the mobile phone number you use on WhatsApp as well as—if provided — your first and last name in accordance with Art. 6(1)(f) of the GDPR, based on our legitimate interest in providing the requested information efficiently and in a timely manner.

Your data will always be used solely to respond to your inquiry via WhatsApp. It will not be disclosed to third parties.

Please note that WhatsApp Business has access to the address book of the mobile device we use for this purpose and automatically transfers phone numbers stored in the address book to a server operated by the parent company, Meta Platforms Inc., in the United States. To operate our WhatsApp Business account, we use a mobile device whose address book contains only the WhatsApp contact information of users who have actually contacted us via WhatsApp.

This ensures that every person whose WhatsApp contact information is stored in our address book has already consented to the transfer of their WhatsApp phone number from the address books of their chat contacts, in accordance with Article 6(1)(a) of the GDPR, by accepting the WhatsApp Terms of Service when they first used the app on their device. The transfer of data from users who do not use WhatsApp and/or have not contacted us via WhatsApp is therefore excluded.

For information on the purpose and scope of data collection, as well as the further processing and use of the data by WhatsApp, and your related rights and privacy settings, please refer to WhatsApp’s Privacy Policy: https://www.whatsapp.com/legal/?eea=1#privacy-policy

We have entered into a data processing agreement with the provider that protects the data of our website visitors and prohibits disclosure to third parties.

As part of the processing described above, data may be transferred to servers operated by Meta Platforms Inc. in the United States.

For data transfers to the United States, the provider has adhered to the EU-US Data Privacy Framework, which ensures compliance with European data protection standards based on an adequacy decision by the European Commission.

5.5 When you contact us (e.g., via the contact form or email), personal data is processed—solely for the purpose of handling and responding to your inquiry and only to the extent necessary for that purpose.

The legal basis for processing this data is our legitimate interest in responding to your inquiry pursuant to Article 6(1)(f) of the GDPR. If your contact is aimed at entering into a contract, the additional legal basis for the processing is Article 6(1)(b) of the GDPR. Your data will be deleted when it is clear from the circumstances that the matter in question has been conclusively resolved and provided that no statutory retention obligations preclude such deletion.

6) Data Processing When Opening a Customer Account

In accordance with Article 6(1)(b) of the GDPR, personal data will continue to be collected and processed to the extent necessary when you provide it to us upon opening a customer account. You can find out which data is required to open an account by referring to the input fields on the corresponding form on our website.

You may delete your customer account at any time by sending a message to the controller’s address listed above. After your customer account is deleted, your data will be deleted provided that all contracts concluded through the account have been fully settled, no statutory retention periods prevent such deletion, and we no longer have a legitimate interest in continuing to store the data.

7) Use of Customer Data for Direct Marketing

7.1 Subscription to Our Email Newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only required information for receiving the newsletter is your email address. Providing additional information is voluntary and is used to address you personally. We use the so-called double opt-in procedure to send the newsletter, which ensures that you will only receive the newsletter once you have explicitly confirmed your consent to receive it by clicking on a verification link sent to the email address you provided.

By activating the confirmation link, you grant us your consent to use your personal data in accordance with Article 6(1)(a) of the GDPR. In doing so, we store your IP address as recorded by your Internet Service Provider (ISP), as well as the date and time of registration, in order to be able to trace any potential misuse of your email address at a later date. The data we collect when you subscribe to the newsletter is used strictly for the intended purpose.

You can unsubscribe from the newsletter at any time by clicking the link provided in the newsletter or by sending a message to the data controller named at the beginning of this notice. Once you have unsubscribed, your email address will be immediately deleted from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to use your data beyond this scope, which is permitted by law and about which we inform you in this statement.

7.2 Email Notifications Regarding Product Availability

For items that are temporarily unavailable, you can sign up to receive email notifications regarding product availability. In this case, we will send you a one-time email message regarding the availability of the item you have selected. The only required information for sending this notification is your email address. Providing additional information is voluntary and may be used to address you personally. We use the so-called double opt-in procedure for sending emails, which ensures that you will only receive a notification once you have expressly confirmed your consent by clicking on a verification link sent to the email address you provided.

By activating the confirmation link, you grant us your consent to use your personal data in accordance with Article 6(1)(a) of the GDPR. In doing so, we store your IP address as recorded by your Internet Service Provider (ISP), as well as the date and time of registration, in order to be able to trace any potential misuse of your email address at a later date. The data we collect when you sign up for our email notification service regarding product availability is used strictly for the intended purpose.

You may unsubscribe from the availability notifications at any time by sending a message to the data controller named at the beginning of this notice. Once you have unsubscribed, your email address will be immediately deleted from our mailing list set up for this purpose, unless you have expressly consented to further use of your data or we reserve the right to use your data for other purposes that are permitted by law and about which we inform you in this notice.

7.3 Shopping Cart Reminders via Email

If you abandon your shopping session with us before completing your order, you have the option to receive a one-time email reminder of the contents of your virtual shopping cart.

The only required information for sending this reminder is your email address. Providing additional information is voluntary and may be used to address you personally. We use the so-called double opt-in procedure for sending emails, which ensures that you will only receive a notification once you have expressly confirmed your consent by clicking on a verification link sent to the email address you provided.

By activating the confirmation link, you grant us your consent to use your personal data in accordance with Article 6(1)(a) of the GDPR for the purpose of sending a shopping cart reminder. In doing so, we store your IP address as recorded by your Internet Service Provider (ISP), as well as the date and time of registration, in order to be able to trace any potential misuse of your email address at a later date. The data we collect when you register for our email notification service is used strictly for the intended purpose.

You may unsubscribe from shopping cart reminders at any time by sending a message to the data controller named at the beginning of this notice. Once you have unsubscribed, your email address will be immediately deleted from our mailing list set up for this purpose, unless you have expressly consented to further use of your data or we reserve the right to use your data for other purposes that are permitted by law and about which we inform you in this notice.

8) Data Processing for Order Fulfillment

8.1 Submission of Image Files via Email for Order Fulfillment

On our website, we offer customers the option to request the personalization of products by submitting image files via email. The submitted image is used as a template for personalizing the selected product.

Using the email address provided on the website, the customer can send us one or more image files from the storage of the device being used. We then collect, store, and use the files transmitted in this manner exclusively for the production of the personalized product in accordance with the respective service description on our website. If the transmitted image files are shared with specific service providers for the production and fulfillment of the order, you will be explicitly informed of this in the following paragraphs. No further sharing of this information will take place. If the transmitted files or digital images contain personal data (in particular, images of identifiable individuals), all of the aforementioned processing operations are carried out exclusively for the purpose of fulfilling your online order in accordance with Article 6(1)(b) of the GDPR.

Once the order has been fully processed, the submitted image files will be automatically and completely deleted.

8.2 Submission of Image Files for Order Processing via the Messaging Function

If the customer has the option to request the personalization of products by submitting image files via the messaging function, the submitted image will be used as a template for personalizing the selected product.

Using the available messaging feature, the customer can send one or more image files from the storage of the device being used to us. We then collect, store, and use the files transmitted in this manner exclusively for the production of the personalized product in accordance with the respective description of our services.

If the transmitted image files are shared with specific service providers for the production and fulfillment of the order, you will be explicitly informed of this in the following paragraphs. No further sharing will take place. If the transmitted files or digital images contain personal data (in particular, images of identifiable individuals), all of the aforementioned processing operations are carried out exclusively for the purpose of fulfilling your online order in accordance with Article 6(1)(b) of the GDPR.

Once the order has been fully processed, the transmitted image files will be automatically and completely deleted.

8.3 Submission of Image Files for Order Processing via the Upload Function

On our website, we offer customers the option to request product personalization by submitting image files via an upload function. The submitted image is used as a template for personalizing the selected product.

Using the upload form on the website, the customer can send one or more image files directly from the storage of the device being used to us via automated, encrypted data transmission. We then collect, store, and use the transmitted files exclusively for the production of the personalized product in accordance with the respective service description on our website. If the transmitted image files are shared with specific service providers for the production and fulfillment of the order, you will be explicitly informed of this in the following paragraphs. No further disclosure will take place. If the transmitted files or digital images contain personal data (in particular, images of identifiable individuals), all of the aforementioned processing operations are carried out exclusively for the purpose of fulfilling your online order in accordance with Article 6(1)(b) of the GDPR.

Once the order has been fully processed, the transmitted image files will be automatically and completely deleted.

8.4 To the extent necessary for the performance of the contract for delivery and payment purposes, the personal data we collect will be disclosed to the contracted shipping company and the contracted financial institution in accordance with Article 6(1)(b) of the GDPR.

If, based on a corresponding contract, we are obligated to provide updates for goods with digital elements or for digital products, we will process the contact information you provided when placing your order in order to personally inform you in accordance with our legal obligations to provide information under Article 6(1)(c) of the GDPR. Your contact information is used strictly for the specific purpose of communicating updates that we are obligated to provide and is processed by us for this purpose only to the extent necessary to provide the respective information.

To process your order, we also work with the service provider(s) listed below, who assist us, in whole or in part, in fulfilling concluded contracts. Certain personal data is transferred to these service providers in accordance with the following information.

8.5 To fulfill our contractual obligations to our customers, we work with external shipping partners. We disclose your name, your shipping address, and—to the extent necessary for delivery—your phone number exclusively for the purpose of delivering the goods (Art. 6(1)(b) GDPR) to a shipping partner selected by us.

8.6 Billbee

We use the following provider for order processing: Billbee GmbH, Arolser Str. 10, 34477 Twistetal

Your name, address, and, if applicable, other personal data are transferred to the provider in accordance with Article 6(1)(b) of the GDPR solely for the purpose of processing your online order. Your data will only be transferred to the extent that it is actually necessary for processing the order.

8.7 Printful

We use the following provider for order processing: Printful, Inc., 11025 Westlake Drive, Charlotte, NC 28273, USA

Your name, address, and, if applicable, other personal data are transferred to the provider in accordance with Article 6(1)(b) of the GDPR exclusively for the purpose of processing the online order. Your data will only be transferred to the extent that it is actually necessary for the processing of the order.

For the transfer of data to the United States, the provider relies on the European Commission’s Standard Contractual Clauses, which are intended to ensure compliance with European data protection standards.

8.8 Disclosure of Personal Data to Shipping Service Providers

- Deutsche Post

We use the following provider as our shipping service provider: Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany

We will disclose your email address and/or phone number to the provider in accordance with Article 6(1)(a) of the GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or notifying you of the delivery, provided that you have given your explicit consent to this during the ordering process. Otherwise, for the purpose of delivery in accordance with Article 6(1)(b) of the GDPR, we will only disclose the recipient’s name and the delivery address to the provider. This disclosure is made only to the extent necessary for the delivery of the goods. In this case, it is not possible to coordinate the delivery date with the provider in advance or to receive a delivery notification.

You may revoke your consent at any time with future effect by contacting the controller named above or the provider.
- DHL

We use the following provider as our shipping service provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany

We will disclose your email address and/or phone number to the provider in accordance with Article 6(1)(a) of the GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or providing a delivery notification, provided that you have given your explicit consent to this during the ordering process. Otherwise, for the purpose of delivery in accordance with Article 6(1)(b) of the GDPR, we will only disclose the recipient’s name and the delivery address to the provider. This disclosure is made only to the extent necessary for the delivery of the goods. In this case, it is not possible to coordinate the delivery date with the provider in advance or to provide a delivery notification.

You may revoke your consent at any time with future effect by contacting the controller named above or the provider.
- DHL Express

We use the following provider as our shipping service provider: DHL Express Germany GmbH, Heinrich-Brüning-Str. 5, 53113 Bonn, Germany

We will disclose your email address and/or phone number to the provider in accordance with Article 6(1)(a) of the GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or providing a delivery notification, provided that you have given your explicit consent to this during the ordering process. Otherwise, for the purpose of delivery in accordance with Article 6(1)(b) of the GDPR, we will only disclose the recipient’s name and the delivery address to the provider. This disclosure is made only to the extent necessary for the delivery of the goods. In this case, it is not possible to coordinate the delivery date with the provider in advance or to provide a delivery notification.

You may revoke your consent at any time with future effect by contacting the controller named above or the provider.
- DHL Express Austria

We use the following provider as our shipping service provider: DHL Express (Austria) GmbH, Am Europlatz 2 (Building G), 1120 Vienna

We will disclose your email address and/or phone number to the provider in accordance with Article 6(1)(a) of the GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or providing a delivery notification, provided that you have given your explicit consent to this during the ordering process. Otherwise, for the purpose of delivery in accordance with Article 6(1)(b) of the GDPR, we will only provide the provider with the recipient’s name and the delivery address. This information is disclosed only to the extent necessary for the delivery of the goods. In this case, it is not possible to coordinate the delivery date with the provider in advance or to receive a delivery notification.

You may revoke your consent at any time with future effect by contacting the controller named above or the provider.
- DHL Austria

As a shipping service provider, we use the following carrier: DHL Paket (Austria) GmbH, Campus 21, Liebermannstrasse F08/401, 2345 Brunn am Gebirge
Austria

You may revoke your consent at any time with future effect by contacting the controller named above or the provider.
- DPD

We use the following provider as our shipping service provider: DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg, Germany

We will disclose your email address and/or phone number to the provider in accordance with Article 6(1)(a) of the GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or providing a delivery notification, provided that you have given your explicit consent to this during the ordering process. Otherwise, for the purpose of delivery in accordance with Article 6(1)(b) of the GDPR, we will only provide the provider with the recipient’s name and the delivery address. This information is shared only to the extent necessary for the delivery of the goods. In this case, it is not possible to coordinate the delivery date with the provider in advance or to receive a delivery notification.

You may revoke your consent at any time with future effect by contacting the controller named above or the provider.
- DPD Austria

We use the following provider as our shipping service provider: DPD Direct Parcel Distribution Austria GmbH, Arbeitergasse 46, Leopoldsdorf 2333, Austria

We will disclose your email address and/or phone number to the provider in accordance with Article 6(1)(a) of the GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or providing a delivery notification, provided that you have given your explicit consent to this during the ordering process. Otherwise, for the purpose of delivery in accordance with Article 6(1)(b) of the GDPR, we will only disclose the recipient’s name and the delivery address to the provider. This disclosure is made only to the extent necessary for the delivery of the goods. In this case, it is not possible to coordinate the delivery date with the provider in advance or to receive a delivery notification.

You may revoke your consent at any time with future effect by contacting the controller named above or the provider.
- GLS

We use the following provider as our shipping service provider: General Logistics Systems Germany GmbH & Co. OHG, GLS Germany-Straße 1–7, 36286 Neuenstein, Germany

We will disclose your email address and/or phone number to the provider in accordance with Article 6(1)(a) of the GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or providing a delivery notification, provided that you have given your explicit consent to this during the ordering process. Otherwise, for the purpose of delivery in accordance with Article 6(1)(b) of the GDPR, we will only disclose the recipient’s name and the delivery address to the provider. This disclosure is made only to the extent necessary for the delivery of the goods. In this case, it is not possible to coordinate the delivery date with the provider in advance or to provide a delivery notification.

You may revoke your consent at any time with future effect by contacting the controller named above or the provider.
- Hermes

We use the following provider as our shipping service provider: Hermes Logistik Gruppe Deutschland GmbH, Essener Straße 89, 22419 Hamburg, Germany

We will disclose your email address and/or phone number to the provider in accordance with Art. 6(1)(a) GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or providing a delivery notification, provided that you have given your explicit consent to this during the ordering process. Otherwise, for the purpose of delivery in accordance with Article 6(1)(b) of the GDPR, we will only provide the provider with the recipient’s name and the delivery address. This information is disclosed only to the extent necessary for the delivery of the goods. In this case, it is not possible to coordinate the delivery date with the provider in advance or to provide a delivery notification.

You may revoke your consent at any time with future effect by contacting the controller named above or the provider.
- Austrian Post

As a shipping service provider, we use the following carrier: Österreichische Post Aktiengesellschaft, Rochusplatz 1, 1030 Vienna, Austria

We will disclose your email address and/or phone number to the provider in accordance with Article 6(1)(a) of the GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or notifying you of the delivery, provided that you have given your explicit consent to this during the ordering process. Otherwise, for the purpose of delivery in accordance with Article 6(1)(b) of the GDPR, we will only provide the provider with the recipient’s name and the delivery address. This information is disclosed only to the extent necessary for the delivery of the goods. In this case, it is not possible to coordinate the delivery date with the provider in advance or to provide a delivery notification.

You may revoke your consent at any time with future effect by contacting the controller named above or the provider.
- PostNL

We use the following provider as our shipping service provider: Koninklijke PostNL BV, Waldorpstraat 3, 2521CA The Hague, Netherlands

We will disclose your email address and/or phone number to the provider in accordance with Article 6(1)(a) of the GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or providing a delivery notification, provided that you have given your explicit consent to this during the ordering process. Otherwise, for the purpose of delivery in accordance with Article 6(1)(b) of the GDPR, we will only disclose the recipient’s name and the delivery address to the provider. This disclosure is made only to the extent necessary for the delivery of the goods. In this case, it is not possible to coordinate the delivery date with the provider in advance or to provide a delivery notification.

You may revoke your consent at any time with future effect by contacting the controller named above or the provider.
- UPS

We use the following provider as our shipping service provider: United Parcel Service Deutschland Inc. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany

We will disclose your email address and/or phone number to the provider in accordance with Article 6(1)(a) of the GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or providing a delivery notification, provided that you have given your explicit consent to this during the ordering process. Otherwise, for the purpose of delivery in accordance with Article 6(1)(b) of the GDPR, we will only disclose the recipient’s name and the delivery address to the provider. This disclosure is made only to the extent necessary for the delivery of the goods. In this case, it is not possible to coordinate the delivery date with the provider in advance or to receive a delivery notification.

You may revoke your consent at any time with future effect by contacting the controller named above or the provider.
- UPS Austria

We use the following provider as our shipping service provider: United Parcel Service Speditionsgesellschaft m.b.H, Cargo Nord, Objekt 1, 1300 Vienna Airport, Austria

We will disclose your email address and/or phone number to the provider in accordance with Article 6(1)(a) of the GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or providing a delivery notification, provided that you have given your explicit consent to this during the ordering process. Otherwise, for the purpose of delivery in accordance with Article 6(1)(b) of the GDPR, we will only disclose the recipient’s name and the delivery address to the provider. This disclosure is made only to the extent necessary for the delivery of the goods. In this case, it is not possible to coordinate the delivery date with the provider in advance or to provide a delivery notification.

You may revoke your consent at any time with future effect by contacting the controller named above or the provider.

8.9 Use of Payment Service Providers (Payment Services)

- Apple Pay

If you choose the “Apple Pay” payment method offered by Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment processing is handled via the “Apple Pay” feature on your iOS, watchOS, or macOS device by charging a payment card stored with “Apple Pay.” Apple Pay uses security features integrated into your device’s hardware and software to protect your transactions. To authorize a payment, you must therefore enter a code you have previously set and verify your identity using your device’s “Face ID” or “Touch ID” feature.

For the purpose of processing the payment, the information you provided during the ordering process, along with your order details, is transmitted to Apple in encrypted form. Apple then re-encrypts this data using a developer-specific key before transmitting it to the payment service provider associated with the payment card stored in Apple Pay to complete the transaction. The encryption ensures that only the website through which the purchase was made can access the payment data. After the payment has been made, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website to confirm that the payment was successful.

If personal data is processed during the transmissions described above, such processing is carried out exclusively for the purpose of payment processing in accordance with Article 6(1)(b) of the GDPR.

Apple retains anonymized transaction data, including the approximate purchase amount, the approximate date and time, and whether the transaction was successfully completed. Anonymization completely precludes any personal identification. Apple uses the anonymized data to improve “Apple Pay” and other Apple products and services.

When you use Apple Pay on your iPhone or Apple Watch to complete a purchase you initiated via Safari on your Mac, your Mac and the authorization device communicate via an encrypted channel through Apple’s servers. Apple does not process or store any of this information in a format that could be used to identify you personally. You can disable the ability to use Apple Pay on your Mac in your iPhone’s Settings. Go to “Wallet & Apple Pay” and turn off “Allow Payments on Mac.”

For more information about Apple Pay’s privacy practices, visit the following website: https://support.apple.com/de-de/HT203027
- EPS Transfer

This website offers one or more online payment methods from the following provider: PSA Payment Services Austria GmbH, Handelskai 92, Gate 2, 1200 Vienna, Austria

If you select a payment method from this provider that requires you to pay in advance (such as credit card payment), your payment details provided during the ordering process (including name, address, bank and payment card information, currency, and transaction number), as well as information about the contents of your order, will be shared with the provider in accordance with Article 6(1)(b) of the GDPR. In this case, your data is transferred exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.
- Google Pay

If you choose the “Google Pay” payment method offered by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), payment processing takes place via the “Google Pay” app on your mobile device—which must be running at least Android 4.4 (“KitKat”) and have NFC functionality—by charging a payment card stored with Google Pay or a payment system verified there (e.g., PayPal). To authorize a payment via Google Pay exceeding €25, you must first unlock your mobile device using the verification method you have set up (such as facial recognition, a password, a fingerprint, or a pattern).

For the purpose of processing payments, the information you provide during the ordering process, along with the details of your order, is shared with Google. Google then transmits your payment information stored in Google Pay—in the form of a one-time transaction number—to the originating website to verify that the payment has been made. This transaction number does not contain any information regarding the actual payment details of the payment method stored in Google Pay; rather, it is generated and transmitted as a numeric token valid for a single use. For all transactions via Google Pay, Google acts solely as an intermediary for processing the payment. The transaction is carried out exclusively between the user and the originating website by debiting the payment method stored in Google Pay.

To the extent that personal data is processed in connection with the transmissions described above, such processing is carried out exclusively for the purpose of payment processing in accordance with Article 6(1)(b) of the GDPR.

Google reserves the right to collect, store, and analyze certain transaction-specific information for every transaction made through Google Pay. This includes the date, time, and amount of the transaction; the merchant’s location and description; a description of the goods or services purchased provided by the merchant; photos you have attached to the transaction, the name and email address of the seller and buyer or the sender and recipient, the payment method used, your description of the reason for the transaction, and, if applicable, the offer associated with the transaction.

According to Google, this processing is carried out exclusively in accordance with Article 6(1)(f) of the GDPR on the basis of a legitimate interest in proper accounting, the verification of transaction data, and the optimization and maintenance of the Google Pay service.

Google also reserves the right to combine the processed transaction data with additional information collected and stored by Google when you use other Google services.

The Google Pay Terms of Service can be found here:

https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=de
For more information on Google Pay's privacy policy, please visit the following website:
https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de
- Klarna

This website offers one or more online payment methods from the following provider: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden

If you select a payment method in which the provider pays in advance (such as purchase on account, installment plan, or direct debit), you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, ZIP code, city, date of birth, email address, phone number, and, if applicable, details regarding an alternative payment method).

To safeguard our legitimate interest in determining our customers’ creditworthiness, we forward this data to the provider in accordance with Article 6(1)(f) of the GDPR for the purpose of conducting a credit check. Based on the personal data you have provided, as well as additional data (such as your shopping cart, invoice amount, order history, and payment history), the provider assesses whether the payment option you have selected can be granted in light of payment and/or credit default risks.

In addition to the provider’s internal criteria pursuant to Article 6(1)(f) of the GDPR, identity and creditworthiness information from the following credit bureaus may also be taken into account when making a decision as part of the application review:

https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The credit report may contain probability values (so-called “score” values). To the extent that score values are included in the credit report’s findings, they are based on a scientifically recognized mathematical-statistical method. The calculation of the score values includes, among other things but not exclusively, address data.

You may object to this processing of your data at any time by sending us a message or by contacting the provider. However, the provider may still be entitled to process your personal data if this is necessary for the contractual processing of payments.
- PayPal

This website offers one or more online payment methods from the following provider: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method from this provider that requires you to pay in advance, your payment details provided during the ordering process (including name, address, bank and payment card information, currency, and transaction number), as well as information about the contents of your order, will be transmitted to the provider in accordance with Article 6(1)(b) of the GDPR. In this case, your data is transferred exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.

If you select a payment method where we cover the cost upfront, you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, ZIP code, city, date of birth, email address, phone number, and, if applicable, details regarding an alternative payment method).

In order to safeguard our legitimate interest in determining your creditworthiness in such cases, we will forward this data to the provider in accordance with Article 6(1)(f) of the GDPR for the purpose of a credit check. Based on the personal data you have provided, as well as additional data (such as your shopping cart, invoice amount, order history, and payment history), the provider assesses whether the payment option you have selected can be granted in light of the risks of non-payment and/or bad debt.

The credit report may contain probability values (so-called “score” values). To the extent that score values are included in the credit report’s results, they are based on a scientifically recognized mathematical-statistical method. The calculation of the score values includes, among other things but not exclusively, address data.

You may object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may still be entitled to process your personal data if this is necessary for the contractual processing of payments.
- PayPal Checkout

This website uses PayPal Checkout, an online payment system from PayPal that consists of PayPal’s own payment methods and local payment methods from third-party providers.

When paying via PayPal, credit card via PayPal, direct debit via PayPal, or—if offered—“Pay Later” via PayPal, we will share your payment information with PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”) for the purpose of processing the payment. This transfer is carried out in accordance with Article 6(1)(b) of the GDPR and only to the extent necessary for payment processing.

PayPal reserves the right to conduct a credit check for the following payment methods: credit card via PayPal, direct debit via PayPal, or—if offered—“Pay Later” via PayPal. For this purpose, your payment data may be shared with credit bureaus in accordance with Article 6(1)(f) of the GDPR, based on PayPal’s legitimate interest in determining your creditworthiness. PayPal uses the result of the credit check—which reflects the statistical probability of payment default—to determine whether to make the respective payment method available. The credit report may contain probability values (so-called “score values”). To the extent that score values are included in the credit report’s result, they are based on a scientifically recognized mathematical-statistical method. The calculation of these score values includes, among other things but not exclusively, address data. You may object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for the contractual processing of payments.

If the PayPal payment method “Purchase on Account” is available and selected, your payment information will first be transmitted to PayPal to process the payment; PayPal will then forward this information to Ratepay GmbH, Franklinstraße 28-29, 10587 Berlin (“Ratepay”) to complete the transaction. The legal basis in each case is Article 6(1)(b) of the GDPR. In this case, Ratepay conducts an identity and creditworthiness check in its own name to determine your ability to pay in accordance with the principle mentioned above and, based on its legitimate interest in determining your ability to pay pursuant to Article 6(1)(f) of the GDPR, shares your payment data with credit reporting agencies. A list of the credit reporting agencies that Ratepay may use can be found here: https://www.ratepay.com/legal-payment-creditagencies/

When using a payment method from a local third-party provider, your payment data is first transferred to PayPal in accordance with Article 6(1)(b) of the GDPR to prepare the payment. Depending on your selection of an available local payment method, PayPal then transmits your payment data to the relevant provider in accordance with Article 6(1)(b) of the GDPR to process the payment:

- Apple Pay (Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
- Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)
- iDeal (Currence Holding BV, Beethovenstraat 300, Amsterdam, Netherlands)
- Bancontact (Bancontact Payconiq Company, Rue d'Arlon 82, 1040 Brussels, Belgium)
- blik (Polski Standard Płatności sp. z o.o., ul. Czerniakowska 87A, 00-718 Warsaw, Poland)
- eps (PSA Payment Services Austria GmbH, Handelskai 92, Gate 2
1200 Vienna, Austria)
- MyBank (PRETA S.A.S, 40 Rue de Courcelles, F-75008 Paris, France)
- Przelewy24 (PayPro SA, Kanclerska 15A, 60-326 Poznań, Poland)

For further information regarding data protection, please refer to PayPal’s Privacy Policy: https://www.paypal.com/de/legalhub/paypal/privacy-full
- Shopify Payments

This website offers one or more online payment methods from the following provider: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

If you select a payment method offered by the provider that requires you to pay in advance (such as credit card payment), your payment details provided during the ordering process (including name, address, bank and payment card information, currency, and transaction number), as well as information about the contents of your order, will be shared with the provider in accordance with Article 6(1)(b) of the GDPR. In this case, your data is transferred exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.

9) Web Analytics Services

9.1 Cloudflare Web Analytics

This website uses the web analytics service provided by the following vendor: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA

To protect website visitors, the provider uses a pseudonymized visitor identifier to enable various analyses of website usage within a short time window of no more than 24 hours. This visitor identifier is a randomly generated, time-limited hash value created based on a reduced set of technical attributes. These include, in particular, the user agent (information about the browser and operating system) and the anonymized IP address, which is processed exclusively for the duration of the analysis and subsequently discarded.

If, in individual cases, personal data is processed, such processing is based on our legitimate interest in the statistical evaluation of usage behavior for optimization purposes in accordance with Article 6(1)(f) of the GDPR. In this case, you may permanently object to the collection and storage of your visitor data for the future by notifying us.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

9.2 Google Optimize

This website uses “Google Optimize,” a service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).

Based on “Google Analytics,” this service enables a statistical analysis of how users interact with new features and content on the website by presenting test variants to specific user groups. This allows us to determine which variants users prefer, with the aim of improving the appeal of our website.

To do this, Google Optimize uses cookies—small text files stored on your device that enable an analysis of your use of the website. The information collected by cookies regarding your use of the website is generally transmitted to a Google server, where it is stored and processed. This may also involve the transmission of information to the servers of Google LLC, headquartered in the United States, where the information may be further processed.

All processing described above—in particular, the setting of cookies to store and retrieve information on the device you use to access the website—will only take place if you have given us your explicit consent in accordance with Article 6(1)(a) of the GDPR. Without your consent, Google Optimize will not be used while you are using the website. You may revoke your consent at any time with future effect. To exercise your right to revoke consent, please deactivate this service using the “Cookie Consent Tool” provided on the website.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

For data transfers to the U.S., the provider has joined the EU-U.S. Data Privacy Framework, which ensures compliance with European data protection standards based on an adequacy decision by the European Commission.

For more information on Google’s privacy policies, please visit: https://business.safety.google/intl/de/privacy/ and https://policies.google.com/privacy?hl=de&gl=de

9.3 Google Tag Manager

This website uses “Google Tag Manager,” a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”).

Google Tag Manager provides a technical foundation for bundling various web applications—including tracking and analytics services—and for configuring, controlling, and conditioning them via a unified user interface. Google Tag Manager itself does not store any information on users’ devices or read such information. Nor does the service perform any independent data analysis. However, when you visit a page, Google Tag Manager transmits your IP address to Google, where it may be stored. Transmission to servers operated by Google LLC in the United States is also possible.

This processing is carried out only if you have given us your explicit consent in accordance with Article 6(1)(a) of the GDPR. Without this consent, Google Tag Manager will not be used during your visit to the site. You may revoke your consent at any time with future effect. To exercise your right to revoke consent, please deactivate this service using the “Cookie Consent Tool” provided on the website.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

For further legal information regarding Google Tag Manager, please visit https://business.safety.google/intl/de/privacy/ and https://policies.google.com/privacy?hl=de&gl=de

9.4 Shopify Analytics

This website uses the web analytics service provided by the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada

Using cookies and/or similar technologies (tracking pixels, web beacons, algorithms for reading device and browser information), the service collects and stores pseudonymized visitor data, including information about the device used—such as the IP address and browser information—in order to evaluate it for statistical analyses of usage behavior on our website and to create pseudonymized usage profiles. Pseudonymization fundamentally precludes direct personal identification. This data is not combined with personally identifiable information collected by other means.

All processing described above—in particular, the retrieval or storage of information on the device you are using—will only take place if you have given us your explicit consent in accordance with Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect by deactivating this service in the “Cookie Consent Tool” provided on the website.

We have entered into a data processing agreement with the provider that protects the data of our website visitors and prohibits disclosure to third parties.

In the case of data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision issued by the European Commission.

9.5 Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), which enables an analysis of your use of our website.

By default, when you visit the website, Google Analytics 4 sets cookies, which are small text files stored on your device and collect certain information. This information includes your IP address, although Google truncates the last few digits to prevent direct identification of individuals.

The information is transmitted to Google’s servers and processed there. This may also involve transfers to Google LLC, which is headquartered in the United States.

Google uses the collected information on our behalf to evaluate your use of the website, compile reports on website activity for us, and provide other services related to website and internet usage. The truncated IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google. The data collected through the use of Google Analytics 4 is stored for a period of two months and then deleted.

All processing described above, in particular the placement of cookies on the device you are using, takes place only if you have given us your explicit consent in accordance with Article 6(1)(a) of the GDPR.
Without your consent, Google Analytics 4 will not be used during your visit to the site. You may revoke your consent at any time with future effect. To exercise your right of revocation, please deactivate this service using the “Cookie Consent Tool” provided on the website.

We have entered into a data processing agreement with Google that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

Further legal information regarding Google Analytics 4 can be found at https://business.safety.google/intl/de/privacy/, https://policies.google.com/privacy?hl=de&gl=de, and at https://policies.google.com/technologies/partner-sites

Demographic Characteristics
Google Analytics 4 uses the special “demographic characteristics” feature and can use it to generate statistics that provide insights into the age, gender, and interests of site visitors. This is done by analyzing advertising and information from third-party providers. This allows target audiences to be identified for marketing activities. However, the collected data cannot be linked to any specific individual and is deleted after being stored for a period of two months.

Google Signals
As an extension of Google Analytics 4, Google Signals may be used on this website to generate cross-device reports. If you have enabled personalized ads and linked your devices to your Google Account, Google may—subject to your consent to the use of Google Analytics pursuant to Art. 6(1)(a) of the GDPR—analyze your usage behavior across devices and create database models, including those related to cross-device conversions. We do not receive any personal data from Google, only statistics. If you wish to stop cross-device analysis, you can disable the “Personalized Ads” feature in your Google Account settings. To do so, follow the instructions on this page: https://support.google.com/My-Ad-Center-Help/answer/12155764?hl=de
For more information about Google Signals, please visit the following link: https://support.google.com/analytics/answer/7532985?hl=de

UserIDs
As an extension of Google Analytics 4, the “UserIDs” feature can be used on this website. If you have consented to the use of Google Analytics 4 in accordance with Article 6(1)(a) of the GDPR, have set up an account on this website, and sign in to that account on various devices, your activities—including conversions—can be analyzed across devices.

10) Retargeting/Remarketing and Conversion Tracking

Meta Pixel

Within our online platform, we use the “Meta Pixel” service provided by the following vendor: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Meta”)

If a user clicks on an advertisement we have placed on Facebook and/or Instagram, “Meta Pixel” adds a parameter to the URL of our linked page. After the user is redirected, this URL parameter is then stored in the user’s browser via a cookie set by our linked page itself.

This enables Meta, on the one hand, to identify visitors to our online offering as a target audience for the display of advertisements (so-called “Ads”). Accordingly, we use this service to display the Facebook and/or Instagram ads we place only to users who have shown an interest in our online offering or who exhibit certain characteristics (e.g., interests in specific topics or products, determined based on the websites they have visited), which we transmit to Meta (so-called “Custom Audiences”).

Furthermore, the “Meta Pixel” allows us to track whether users were redirected to our website after clicking on an advertisement and what actions they take there (so-called “conversion tracking”).

The data collected is anonymous to us, meaning it does not allow us to identify individual users. However, the data is stored and processed by Meta, which means it can be linked to the respective user profile, and Meta may use the data for its own advertising purposes.

All processing described above—in particular, the setting of cookies to read information from the device you are using—is carried out only if you have given us your explicit consent in accordance with Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect by deactivating this service in the “Cookie Consent Tool” provided on the website.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

The information generated by Meta is generally transmitted to and stored on a Meta server; in this context, it may also be transferred to servers operated by Meta Platforms Inc. in the United States.

11) Website Features

11.1 Facebook Plugins

Our website uses plugins from the social network provided by the following company: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

These plugins enable direct interaction with content on the social network.

To enhance the protection of your data when you visit our website, the plugins are initially deactivated and integrated into the page using a so-called “2-click” or “Shariff” solution.

This integration ensures that when you access a page on our website that contains such plugins, no connection is yet established with the provider’s servers.

Only when you activate the plugins—and thereby give your consent to the data transfer in accordance with Article 6(1)(a) of the GDPR—does your browser establish a direct connection to the provider’s servers. In this process, regardless of whether you are logged into an existing user profile, certain information about the device you are using (including your IP address), your browser, and your browsing history is transmitted to the provider and may be further processed there.

If you are logged into an existing user profile on the provider’s social network, information about interactions carried out via the plugins will also be published there and displayed to your contacts.
You can revoke your consent at any time by clicking on the plugin again to deactivate it. However, this revocation does not affect data that has already been transferred to the provider.

Data may also be transferred to: Meta Platforms Inc., USA

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

11.2 Instagram Plugins

Our website uses plugins from the social network operated by the following provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

These plugins enable direct interaction with content on the social network.

To enhance the protection of your data when you visit our website, the plugins are initially deactivated and integrated into the page using a so-called “2-click” or “Shariff” solution.

This integration ensures that when you access a page on our website that contains such plugins, no connection is yet established with the provider’s servers.

11.3 YouTube

This website uses plugins to display and play videos from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transmitted to: Google LLC, USA

When you visit a page on our website that contains such a plugin, your browser establishes a direct connection to the provider’s servers—at the latest when the video begins playing—to load the content. In the process, certain information, including your IP address, is transmitted to the provider.

When playback of embedded videos is initiated via the plugin, the provider also uses cookies to collect information about user behavior, compile playback statistics, and prevent abusive behavior.

If you are logged into a user account with the provider while visiting the site, your data will be directly associated with your account when you click on a video. If you do not want this data to be associated with your account, you must log out before clicking the play button.

If you are logged into an existing user profile on the provider’s social network, information about interactions carried out via the plugins will also be published there and displayed to your contacts.
You can revoke your consent at any time by clicking on the activated plugin again to deactivate it. However, this revocation does not affect data that has already been transferred to the provider.

Data may also be transferred to: Meta Platforms Inc., USA

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

For data transfers to the U.S., the provider has joined the EU-U.S. Data Privacy Framework, which, based on an adequacy decision by the European Commission, ensures compliance with European data protection standards.

All of the aforementioned processing activities, in particular the setting of cookies for reading information on the device used, only take place if you have given us your explicit consent in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future by deactivating this service via the "Cookie Consent Tool" provided on the website.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

11.4 Trust Widget of the IT Law Firm

Our website uses graphic elements from the following provider to display an externally awarded trust seal: IT Law Firm GmbH & Co. KG, Alter Messeplatz 2, 80339 Munich

When you access a page on our website that contains such graphic elements, your browser establishes a direct connection to the provider's servers to load the elements correctly. In doing so, certain browser information, including your IP address, is transmitted to the provider.

To the extent that personal data is also processed in this context, this is done in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest in the optimal marketing of our services and the appealing design of our website.

11.5 Google Maps API

To enable real-time verification of certain entries in the address form of our online shop's order process for input errors, we use the services of the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

Data may also be transferred to: Google LLC, USA.

The provider validates the entered address, verifies its spelling, and completes any missing data. For ambiguous addresses, correct alternative suggestions are displayed. For this purpose, the address data you enter is transmitted to the provider, stored there, and analyzed.

This processing is carried out in accordance with Article 6 Paragraph 1 Letter f GDPR based on our legitimate interest in the proper recording of the customer's correct address data for the conscientious fulfillment of our contractual delivery obligations and to prevent problems with contract execution.

The provider processes the affected data separately and does not combine it with other data sets, deleting it as soon as its status and accuracy have been confirmed, but no later than 30 days.

Further information on Google's privacy policy can be found here: https://business.safety.google/intl/de/privacy/

11.6 Google Web Fonts

This site uses web fonts from the following provider for the uniform display of fonts: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

When you access a page, your browser loads the required web fonts into its browser cache to display texts and fonts correctly and establishes a direct connection to the provider's servers. Certain browser information, including your IP address, will be transmitted to the provider.

Data may also be transmitted to: Google LLC, USA

The processing of personal data during the connection process with the font provider will only take place if you have given us your explicit consent in accordance with Art. 6 Para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future by deactivating this service via the "Cookie Consent Tool" provided on the website. If your browser does not support web fonts, a standard font from your computer will be used.

Further information on Google's privacy policy can be found here: https://business.safety.google/intl/de/privacy/

11.7 Cloudflare Turnstile

This website uses the CAPTCHA service provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

This service verifies whether an entry is made by a human or abusively by automated processing and blocks spam, DDoS attacks, and similar automated malicious access. To ensure that an action is performed by a human and not an automated bot, Cloudflare Turnstile collects the IP address of the device used, identification data of the browser and operating system used, and the date and duration of the visit, and transmits this information to the provider's servers for evaluation.

The legal basis for this is our legitimate interest in establishing individual responsibility on the internet and preventing misuse and spam, in accordance with Article 6(1)(f) GDPR.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

12) Tools and Other Services

12.1 Billbee

For our accounting, we use the cloud-based accounting software service of the following provider: Billbee GmbH, Arolser Str. 10, 34477 Twistetal, Germany.

The provider processes incoming and outgoing invoices, as well as, where applicable, our company's bank transactions, in order to automatically record invoices, match them to transactions, and generate the financial accounting records in a semi-automated process.

If personal data is processed in this context, the processing is based on our legitimate interest in the efficient organization and documentation of our business transactions in accordance with Article 6(1)(f) GDPR.

12.2 sevDesk

For our accounting, we use the cloud-based accounting software service of the following provider: sevDesk GmbH, Hauptstraße 115, 77652 Offenburg, Germany.

We have concluded a data processing agreement with the provider, which ensures the protection of our customers' data and prohibits unauthorized disclosure to third parties.

If personal data is processed in this context, the processing is based on our legal obligation to maintain proper accounting records in accordance with Article 6(1)(c) GDPR.

12.3 Cookie Consent Tool

This website uses a "cookie consent tool" to obtain valid user consent for cookies and cookie-based applications that require consent. The cookie consent tool is displayed to users upon visiting the site as an interactive interface, where consent for specific cookies and/or cookie-based applications can be granted by ticking boxes. By using this tool, all cookies/services requiring consent are only loaded if the respective user grants the corresponding consent by ticking the boxes. This ensures that such cookies are only placed on the user's device if consent has been given.

The tool uses technically necessary cookies to store your cookie preferences. No personal user data is processed in this process.

If, in individual cases, the processing of personal data (such as the IP address) occurs for the purpose of storing, assigning, or logging cookie settings, this is done in accordance with Article 6(1)(f) GDPR based on our legitimate interest in legally compliant, user-specific, and user-friendly cookie consent management and thus in the legally compliant design of our website.

A further legal basis for processing is Article 6(1)(c) GDPR. As the data controller, we are subject to the legal obligation to make the use of cookies that are not technically necessary dependent on the respective user's consent.

Where necessary, we have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

Further information about the operator and the settings options of the cookie consent tool can be found directly in the corresponding [link to cookie consent tool].

13) Data Subject Rights

13.1 Applicable data protection law grants you the following data subject rights (rights of access and intervention) with regard to the processing of your personal data by the controller. The respective legal bases for exercising these rights are listed below:

Right of access pursuant to Article 15 GDPR;

Right to rectification pursuant to Article 16 GDPR;

Right to erasure pursuant to Article 17 GDPR;

Right to restriction of processing pursuant to Article 18 GDPR;

Right to be informed pursuant to Article 19 GDPR;

Right to data portability pursuant to Article 20 GDPR;

Right to withdraw consent pursuant to Article 7(3) GDPR;

Right to lodge a complaint pursuant to Article 77 GDPR.

13.2 Right to Object

If we process your personal data based on our overriding legitimate interest, you have the right to object to this processing at any time, on grounds relating to your particular situation, with effect for the future.

If you exercise your right to object, we will cease processing the data in question. Further processing will only be permitted if we can demonstrate compelling legitimate grounds for the processing which override your interests, fundamental rights and freedoms, or if the processing serves the establishment, exercise or defense of legal claims.

If we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing. You can exercise your right to object as described above.

If we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing. If you exercise your right to object, we will cease processing the data in question for direct marketing purposes.

14) Duration of storage of personal data

The duration of storage of personal data is determined by the respective legal basis, the purpose of processing, and – where applicable – the respective statutory retention period (e.g., commercial and tax law retention periods).

When processing personal data based on explicit consent pursuant to Art. 6 para. 1 lit. a GDPR, the data in question will be stored until you withdraw your consent.

If statutory retention periods exist for data processed in connection with contractual or quasi-contractual obligations based on Article 6(1)(b) GDPR, this data will be routinely deleted after the retention periods have expired, unless it is still required for the performance of a contract or for taking steps prior to entering into a contract and/or we have a legitimate interest in its continued storage.

When processing personal data based on Article 6(1)(f) GDPR, this data will be stored until you exercise your right to object pursuant to Article 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims. When processing personal data for direct marketing purposes based on Article 6(1)(f) GDPR, this data will be stored until you exercise your right to object pursuant to Article 21(2) GDPR.

Unless otherwise specified in this privacy policy regarding specific processing situations, stored personal data will be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.