Privacy policy

Privacy Policy

Preamble

With the following Privacy Policy, we would like to inform you about the types of personal data (hereinafter also referred to as “data”) we process, the purposes for which we process it, and the scope of such processing. This Privacy Policy applies to all processing of personal data carried out by us, both in connection with the provision of our services and, in particular, on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as the “Online Offering”).

The terms used are gender-neutral.

Effective as of June 4, 2026

Data Controller

Alexander Mettke
Am Rathausring 5
74889 Sinsheim
Germany

Email address: support@skeld.de

Legal Notice: https://skeld.de/policies/legal-notice

Overview of Data Processing

The following overview summarizes the types of data processed and the purposes of their processing, and identifies the data subjects.

Types of Data Processed

Master data.
Payment data.
Contact data.
Content data.
Contract data.
Usage data.
Meta, communication, and procedural data.
Event data (Facebook).
Log data.

Purposes of Processing

Provision of contractual services and fulfillment of contractual obligations.
Communication.
Security measures.
Direct marketing.
Audience measurement.
Tracking.
Office and organizational procedures.
Conversion measurement.
Target group identification.
Organizational and administrative procedures.
Content Delivery Network (CDN).
Feedback.
Marketing.
Profiles containing user-related information.
Provision of our online services and user-friendliness.
IT infrastructure.
Financial and payment management.
Public relations.
Sales promotion.
Business processes and operational procedures.

Applicable Legal Bases

Applicable Legal Bases Under the GDPR: Below is an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your country of residence or our country of incorporation. Furthermore, should more specific legal bases apply in individual cases, we will inform you of these in the Privacy Policy.

Consent (Art. 6(1), Sent. 1, lit. a) GDPR) - The data subject has given consent to the processing of personal data concerning him or her for a specific purpose or for several specific purposes.
Performance of a Contract and Pre-Contractual Inquiries (Art. 6(1), Sent. 1, lit. b) GDPR) - Processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of pre-contractual measures taken at the data subject’s request.
Legal obligation (Art. 6(1), sentence 1, letter c) GDPR) - Processing is necessary for compliance with a legal obligation to which the controller is subject.
Legitimate Interests (Art. 6(1), first sentence, lit. f) GDPR) - Processing is necessary to protect the legitimate interests of the controller or a third party, provided that the interests, fundamental rights, and fundamental freedoms of the data subject requiring the protection of personal data do not take precedence.

National Data Protection Regulations in Germany: In addition to the data protection provisions of the GDPR, national data protection regulations apply in Germany. These include, in particular, the Act on the Protection against the Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). The BDSG contains, in particular, special provisions regarding the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and the transfer of data, as well as automated decision-making in individual cases, including profiling. Furthermore, state data protection laws of the individual federal states may apply.

Relevant legal bases under the Swiss Data Protection Act: If you are located in Switzerland, we process your data based on the Federal Act on Data Protection (abbreviated as “Swiss DSG”) . Unlike the GDPR, for example, the Swiss DSG generally does not require that a legal basis for the processing of personal data be specified; rather, it requires that the processing of personal data be carried out in good faith and be lawful and proportionate (Art. 6, paras. 1 and 2 of the Swiss DSG). In addition, we collect personal data only for a specific purpose that is apparent to the data subject and process it only in a manner consistent with that purpose (Art. 6(3) of the Swiss PDPA).

Note on the Applicability of the GDPR and the Swiss Data Protection Act (DSG): This privacy policy serves to provide information in accordance with both the Swiss Data Protection Act (DSG) and the General Data Protection Regulation (GDPR). For this reason, please note that the terms used in the GDPR are employed here due to its broader geographical scope and greater clarity. In particular, instead of the terms “processing” of “personal data,” “overriding interest,” and “special categories of personal data” used in the Swiss Data Protection Act (DSG), the terms “processing” of “personal data,” “legitimate interest,” and “special categories of data” used in the GDPR are employed. However, the legal meaning of these terms continues to be determined in accordance with the Swiss Data Protection Act (DSG) within the scope of its applicability.

Security Measures

In accordance with legal requirements and taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the varying likelihood and severity of threats to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access to, input of, and disclosure of the data, ensuring its availability, and maintaining its separation. Furthermore, we have established procedures that ensure the exercise of data subjects’ rights, the erasure of data, and responses to data breaches. In addition, we take the protection of personal data into account from the outset during the development or selection of hardware, software, and procedures in accordance with the principle of data protection by design and by default.

Securing Online Connections Using TLS/SSL Encryption Technology (HTTPS): To protect user data transmitted via our online services from unauthorized access, we rely on TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the Internet. These technologies encrypt the information transmitted between the website or app and the user’s browser (or between two servers), thereby protecting the data from unauthorized access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions meet the highest security standards. When a website is secured by an SSL/TLS certificate, this is indicated by the display of “HTTPS” in the URL. This serves as an indicator to users that their data is being transmitted securely and in encrypted form.

International Data Transfers

Data Processing in Third Countries: If we transfer data to a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs in connection with the use of third-party services or the disclosure or transfer of data to other individuals, entities, or companies (which can be identified by the provider’s mailing address or if the privacy policy explicitly refers to data transfers to third countries), this is always done in accordance with legal requirements.

For data transfers to the U.S., we primarily rely on the Data Privacy Framework (DPF), which was recognized as a secure legal framework by an adequacy decision of the European Commission dated July 10, 2023. In addition, we have entered into standard contractual clauses with the respective providers that comply with the European Commission’s requirements and establish contractual obligations to protect your data.

This dual safeguard ensures comprehensive protection of your data: The DPF serves as the primary layer of protection, while the standard contractual clauses provide additional security. Should any changes occur within the framework of the DPF, the standard contractual clauses will serve as a reliable fallback option. This ensures that your data remains adequately protected at all times, even in the event of political or legal changes.

For each individual service provider, we inform you whether they are certified under the DPF and whether standard contractual clauses are in place. Further information on the DPF and a list of certified companies can be found on the U.S. Department of Commerce website at https://www.dataprivacyframework.gov/ (in English).

Appropriate security measures apply to data transfers to other third countries, in particular standard contractual clauses, explicit consent, or transfers required by law. Information on transfers to third countries and applicable adequacy decisions can be found on the European Commission’s website: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

Transfer of Personal Data Abroad: In accordance with the Swiss Data Protection Act (DSG), we transfer personal data abroad only if adequate protection for the data subjects is guaranteed (Art. 16 of the Swiss DSG). Unless the Federal Council has determined that adequate protection exists (list: https://www.bj.admin.ch/bj/de/home/staat/datenschutz/internationales/anerkennung-staaten.html), we implement alternative security measures.

For data transfers to the U.S., we primarily rely on the Data Privacy Framework (DPF), which was recognized as a secure legal framework by a Swiss adequacy decision dated September 15, 2024. In addition, we have entered into Standard Data Protection Clauses with the respective providers, which have been approved by the Federal Data Protection and Information Commissioner (FDPIC) and establish contractual obligations to protect your data.

This dual safeguard ensures comprehensive protection of your data: The DPF serves as the primary layer of protection, while the standard data protection clauses provide additional security. Should changes occur within the framework of the DPF, the standard data protection clauses serve as a reliable fallback option. This ensures that your data remains adequately protected at all times, even in the event of political or legal changes.

For each service provider, we inform you whether they are certified under the DPF and whether Standard Data Protection Clauses are in place. You can find the list of certified companies and further information about the DPF on the U.S. Department of Commerce website at https://www.dataprivacyframework.gov/ (in English).

Appropriate security measures apply to data transfers to other third countries, including international agreements, specific safeguards, standard data protection clauses approved by the EDÖB, or internal corporate data protection policies recognized in advance by the EDÖB or a competent data protection authority in another country.

General Information on Data Storage and Deletion

We delete the personal data we process in accordance with legal requirements as soon as the underlying consents are revoked or there are no longer any legal grounds for processing. This applies to cases in which the original purpose of processing no longer applies or the data is no longer needed. Exceptions to this rule apply if legal obligations or special interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for legal proceedings or to protect the rights of other natural or legal persons, must be archived accordingly.

Our Privacy Policy contains additional information on the retention and deletion of data that applies specifically to certain processing operations.

If there are multiple specifications regarding the retention period or deletion deadlines for a piece of data, the longest period shall always apply. We process data that is no longer retained for its originally intended purpose—but rather due to legal requirements or other reasons—exclusively for the purposes that justify its retention.

Retention and Deletion of Data: The following general time limits apply to the retention and archiving of data under German law:

10 years—retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, as well as the work instructions and other organizational documents necessary for their understanding (Section 147(1)(1) in conjunction with (3) of the German Fiscal Code (AO), § 14b(1) of the Value-Added Tax Act (UStG), § 257(1)(1) in conjunction with (4) of the Commercial Code (HGB)).
8 years—accounting documents, such as invoices and expense receipts (Section 147(1)(4) and (4a) in conjunction with (3), first sentence, of the German Fiscal Code (AO), as well as Section 257(1)(4) in conjunction with (4) of the German Commercial Code (HGB)).
6 years – Other business records: received commercial or business correspondence, copies of sent commercial or business correspondence, and other documents to the extent they are relevant for tax purposes, e.g., hourly wage slips, payroll sheets, cost calculation documents, price tags, as well as payroll records, provided they are not already accounting vouchers, and cash register receipts (Section 147(1)(2), 3, 5 in conjunction with para. 3 of the German Fiscal Code (AO), § 257(1)(2) and (3) in conjunction with para. 4 of the German Commercial Code (HGB)).
3 years—Data required to address potential warranty and damage claims or similar contractual claims and rights, as well as to process related inquiries, based on past business experience and standard industry practices, is retained for the duration of the regular statutory limitation period of three years (Sections 195, 199 BGB).

Data Retention and Deletion: The following general retention periods apply to the retention and archiving of data under Swiss law:

10 years – Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, accounting vouchers, and invoices, as well as all necessary work instructions and other organizational documents (Art. 958f of the Swiss Code of Obligations (OR)).
10 years - Data necessary to address potential claims for damages or similar contractual claims and rights, as well as to process related inquiries, based on past business experience and standard industry practices, is retained for the statutory limitation period of ten years, unless a shorter period of five years applies, which is relevant in certain cases (Art. 127, 130 CO). Claims for rent, lease payments, and interest on capital, as well as other periodic payments arising from the delivery of food, for meals and tavern debts, and from craftsmanship, retail sales of goods, medical services, professional services provided by attorneys, legal agents, solicitors, and notaries, and arising from the employment relationship of employees (Art. 128 OR).

Commencement of the Statute of Limitations at the End of the Year: If a time limit does not expressly begin on a specific date and lasts at least one year, it automatically begins at the end of the calendar year in which the event triggering the time limit occurred. In the case of ongoing contractual relationships under which data is stored, the event triggering the time limit is the date on which the termination or other termination of the legal relationship takes effect.

Rights of Data Subjects

Rights of Data Subjects under the GDPR: As a data subject under the GDPR, you are entitled to various rights, which arise in particular from Articles 15 through 21 of the GDPR:

Right to Object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out pursuant to Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions. If personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing.
Right to Withdraw Consent: You have the right to withdraw any consent you have given at any time.
Right of Access: You have the right to request confirmation as to whether data concerning you is being processed, as well as access to this data, further information, and a copy of the data in accordance with legal requirements.
Right to Rectification: In accordance with legal requirements, you have the right to request that data concerning you be completed or that inaccurate data concerning you be corrected.
Right to erasure and restriction of processing: In accordance with legal requirements, you have the right to request that data concerning you be erased without delay or, alternatively, to request a restriction on the processing of such data in accordance with legal requirements.
Right to Data Portability: You have the right, in accordance with legal requirements, to receive the data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, or to request that it be transmitted to another data controller.
Complaint to a supervisory authority: In accordance with legal requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority—in particular, a supervisory authority in the Member State where you habitually reside— the supervisory authority at your place of work or the location of the alleged violation, if you believe that the processing of your personal data violates the GDPR.

Rights of Data Subjects Under the Swiss Data Protection Act (DSG):

As a data subject, you are entitled to the following rights in accordance with the provisions of the Swiss DSG:

Right of access: You have the right to request confirmation as to whether personal data concerning you is being processed and to receive the information necessary to enable you to exercise your rights under this law and to ensure transparent data processing.
Right to Data Disclosure or Portability: You have the right to request the disclosure of your personal data that you have provided to us in a commonly used electronic format.
Right to Rectification: You have the right to request the rectification of inaccurate personal data concerning you.
Right to Object, Erasure, and Destruction: You have the right to object to the processing of your data, as well as to request that the personal data concerning you be erased or destroyed.

Business Processes and Procedures

Personal data of service recipients and clients—including customers, clients, or, in specific cases, legal clients, patients, or business partners, as well as other third parties—is processed within the framework of contractual and comparable legal relationships and pre-contractual measures such as the initiation of business relationships. This data processing supports and facilitates business processes in areas such as customer management, sales, payment transactions, accounting, and project management.

The data collected is used to fulfill contractual obligations and to streamline business processes. This includes processing business transactions, managing customer relationships, optimizing sales strategies, and ensuring internal accounting and financial processes. In addition, the data supports the protection of the controller’s rights and facilitates administrative tasks as well as the organization of the company.

Personal data may be disclosed to third parties to the extent necessary to fulfill the aforementioned purposes or legal obligations. Once statutory retention periods have expired or the purpose of processing no longer applies, the data will be deleted. This also includes data that must be stored for a longer period due to tax and legal documentation requirements.

Types of data processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); payment data (e.g., bank account information, invoices, payment history); contact data (e.g., mailing and email addresses or phone numbers); content data (e.g., text or image-based messages and posts, as well as related information such as details regarding authorship or the time of creation); contract data (e.g., subject matter of the contract, term, customer category); Usage data (e.g., page views and time spent on pages, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features); Meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers, individuals involved). Log data (e.g., log files regarding logins, data retrieval, or access times).
Data subjects: Service recipients and clients; prospective customers; communication partners; business and contractual partners; customers; third parties; users (e.g., website visitors, users of online services). Employees (e.g., staff, applicants, temporary workers, and other personnel).
Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; office and organizational procedures; business processes and management procedures; security measures; Provision of our online services and user-friendliness; communication; marketing; sales promotion; public relations; financial and payment management; IT infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)).
Retention and deletion: Deletion in accordance with the information provided in the section “General Information on Data Storage and Deletion.”
Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR); Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR). Legal obligation (Art. 6(1), sentence 1, lit. c) GDPR).

Further information on processing operations, procedures, and services:

Contact management and maintenance: Procedures required for the organization, maintenance, and security of contact information (e.g., setting up and maintaining a central contact database, regularly updating contact information, monitoring data integrity, implementing data protection measures, ensuring access controls, performing backups and restores of contact data, training employees in the effective use of contact management software, regularly reviewing communication history, and adjusting contact strategies); Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).
Customer Account: Customers can create an account within our online service (e.g., customer or user account, hereinafter “customer account”). If registration of a customer account is required, customers will be notified of this as well as of the information required for registration. Customer accounts are not public and cannot be indexed by search engines. As part of the registration process, as well as subsequent logins and use of the customer account, we store customers’ IP addresses along with the times of access in order to verify the registration and prevent any misuse of the customer account. If the customer account is terminated, the data associated with the account will be deleted after the termination date, unless it is retained for purposes other than those related to the customer account or must be retained for legal reasons (e.g., internal storage of customer data, order transactions, or invoices). It is the customer’s responsibility to back up their data upon termination of the customer account; Legal basis: Contract performance and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR), Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR).
General payment transactions: Processes required for the execution of payment transactions, the monitoring of bank accounts, and the control of cash flows (e. g., creating and verifying wire transfers, processing direct debits, reviewing account statements, monitoring incoming and outgoing payments, managing returned direct debits, account reconciliation, and cash management) ; Legal basis: Contract performance and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR), Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR).
Accounting, accounts payable, accounts receivable: Processes required for the recording, processing, and verification of business transactions in the areas of accounts payable and accounts receivable (e.g., creating and verifying incoming and outgoing invoices, monitoring and managing open items, processing payments, handling collection procedures, reconciling accounts related to receivables and payables, accounts payable, and accounts receivable); Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR), Legal obligation (Art. 6(1), sentence 1, lit. c) GDPR), Legitimate interests (Art. 6(1), first sentence, lit. f) GDPR).
Financial Accounting and Taxes: Processes required for the recording, management, and control of financially relevant business transactions, as well as for the calculation, reporting, and payment of taxes (e.g., account assignment and posting of business transactions, preparation of quarterly and annual financial statements, processing of payments, handling of collection procedures, account reconciliation, tax consulting, preparation and filing of tax returns, handling of tax matters); Legal Basis: Contract performance and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR), Legal obligation (Art. 6(1), sentence 1, lit. c) GDPR), Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR).
Marketing, advertising, and sales promotion: Processes required in the context of marketing, advertising, and sales promotion (e.g., market analysis and target group identification, development of marketing strategies, planning and implementation of advertising campaigns, design and production of advertising materials, online marketing including SEO and social media campaigns, event marketing and trade show participation, customer loyalty programs, sales promotion measures, performance measurement and optimization of marketing activities, budget management, and cost control); Legal basis: Legitimate interests (Art. 6(1), sentence 1, lit. f) of the GDPR).
Economic Analyses and Market Research: To fulfill business management purposes and to identify market trends, as well as the preferences of contractual partners and users, the available data on business transactions, contracts, inquiries, etc., is analyzed. The group of data subjects may include contractual partners, prospective customers, customers, visitors, and users of the controller’s online offerings. The analyses are conducted for the purposes of business evaluation, marketing, and market research (e.g., to identify customer groups with different characteristics). In doing so, profiles of registered users—including their information regarding services used—are taken into account, if available. The analyses are used exclusively by the controller and are not disclosed externally, unless they consist of anonymous analyses containing aggregated—and thus anonymized—values. Furthermore, users’ privacy is respected; the data is processed for analytical purposes in a pseudonymized manner whenever possible and, where feasible, in an anonymized manner (e.g., as aggregated data); Legal basis: Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR).
Public relations: Processes required in the context of public relations (e.g., developing and implementing communication strategies, planning and executing PR campaigns, drafting and distributing press releases, maintaining media contacts, monitoring and analyzing media coverage, organizing press conferences and public events, crisis communication, creating content for social media and corporate websites, and managing corporate branding); Legal basis: Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR).

Use of Online Platforms for Marketing and Sales Purposes

We offer our services on online platforms operated by other service providers. In this context, the privacy policies of the respective platforms apply in addition to our privacy policy. This applies in particular with regard to the execution of the payment process and the procedures used on the platforms for audience measurement and interest-based marketing.

Types of data processed: Master data (e.g., full name, home address, contact information, customer number, etc.); payment data (e.g., bank account information, invoices, payment history) ; contact data (e.g., mailing and email addresses or phone numbers); contract data (e.g., subject matter of the contract, term, customer category); usage data (e.g., page views and time spent on pages, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved).
Data subjects: Service recipients and clients; business and contractual partners; prospective customers.
Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; marketing; business processes and operational procedures; conversion tracking (measuring the effectiveness of marketing measures). Provision of our online services and user-friendliness.
Retention and deletion: Deletion in accordance with the information in the section “General Information on Data Storage and Deletion.”
Legal bases: Contract performance and pre-contractual inquiries (Art. 6(1), Sent. 1, Letter b) GDPR) . Legitimate interests (Art. 6(1), first sentence, lit. f) GDPR).

Further information on processing operations, procedures, and services:

Amazon: Online marketplace for e-commerce; Service provider: Amazon EU S.à r.l. (Société à responsabilité limitée), 38 avenue John F. Kennedy, L-1855 Luxembourg; Legal basis: Legitimate interests (Art. 6(1), first sentence, lit. f) GDPR) ; Website: https://www.amazon.de/; Privacy Policy: https://www.amazon.de/gp/help/customer/display.html?nodeId=201909010. Legal basis for transfers to third countries: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF).
eBay: Online marketplace for e-commerce; Service provider: eBay Marketplaces GmbH, Helvetiastrasse 15/17, 3005 Bern, Switzerland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.ebay.de/; Privacy Policy: https://www.ebay.de/help/policies/member-behavior-policies/datenschutzerklrung? id=4260. Data Processing Agreement: Provided by the service provider.
Etsy: Online marketplace for e-commerce; Service provider: Etsy, Inc., 55 Washington Street, Suite 712, Brooklyn, NY 11201, USA; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.etsy.com/de. Privacy Policy: https://www.etsy.com/de/legal/privacy/?ref=ftr.
hood.de: Online marketplace for e-commerce; Service provider: Hood Media GmbH, Hämmerchensgäßchen 2A, 52349 Düren, Germany; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.hood.de/. Privacy Policy: https://www.hood.de/datenschutz.htm.
Shopify: platform through which e-commerce services are offered and carried out. The services and related processes include, in particular, online stores, websites, their offerings and content, community features, purchase and payment transactions, customer communication, as well as analytics and marketing; Service Provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; Legal Basis: Legitimate Interests (Art. 6(1), Sentence 1, Letter f) GDPR); Website: https://www.shopify.com/de/ . Privacy Policy: https://www.shopify.com/de/legal/datenschutz.
kleinanzeigen: Online marketplace for e-commerce; Service provider: kleinanzeigen.de GmbH, Albert-Einstein-Ring 26, 14532 Kleinmachnow, Germany; Legal Basis: Legitimate Interests (Art. 6(1)(f) GDPR); Website: https://www.kleinanzeigen.de/ . Privacy Policy: https://themen.kleinanzeigen.de/datenschutzerklaerung/.

Providers and Services Used in the Course of Business Operations

In the course of our business operations, we use additional third-party services, platforms, interfaces, or plug-ins (hereinafter “Services”) in compliance with legal requirements. Their use is based on our interests in the proper, lawful, and efficient management of our business operations and internal organization.

Types of data processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); Payment data (e.g., bank account information, invoices, payment history); contact data (e.g., mailing and email addresses or phone numbers); content data (e.g., textual or visual messages and posts, as well as related information such as details regarding authorship or the time of creation); Contract data (e.g., subject matter of the contract, term, customer category). Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features).
Data Subjects: Service recipients and clients; prospective clients; business and contractual partners; communication partners.
Purposes of Processing and Legitimate Interests: Provision of contractual services and fulfillment of contractual obligations; office and organizational procedures; business processes and management procedures. Communication.
Retention and deletion: Deletion in accordance with the information provided in the section “General Information on Data Storage and Deletion.”
Legal bases: Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR) .

Additional information on processing procedures, processes, and services:

Easybill: Online software for invoicing, accounting, banking, and tax filing with document storage; Service provider: easybill GmbH, Düsselstr. 21, 41564 Kaarst, Germany; Legal basis: Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR) ; Website: https://www.easybill.de; Privacy Policy: https://www.easybill.de/datenschutz. Data Processing Agreement: Provided by the service provider.
Tidio: Chat and chatbot software and related services; Service Provider: Tidio LLC, 180 Steuart St, CA 94119, San Francisco, USA; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.tidio.com/; Privacy Policy: https://www.tidio.com/privacy-policy/ ; Data Processing Agreement: Provided by the service provider. Legal Basis for Transfers to Third Countries: EU/EEA – Standard Contractual Clauses (provided by the service provider), Switzerland – Standard Contractual Clauses (provided by the service provider).
EasyDHL: Creation of shipping labels, handling of customs formalities, shipment tracking, automatic transmission of shipment data to customers, direct integration with Shopify; Service provider: Processed on Shopify’s servers.; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR). Website: https://apps.shopify.com/easydhl.

Payment Methods

Within the framework of contractual and other legal relationships, due to legal obligations, or otherwise based on our legitimate interests, we offer data subjects efficient and secure payment options and, for this purpose, utilize banks, credit institutions, and other service providers (collectively “payment service providers”). In accordance with the state of the art, payment transactions take place exclusively via encrypted connections, ensuring that the data entered is protected from unauthorized access during transmission.

The data processed by the payment service providers includes master data, such as the name and address, bank details, such as account numbers or credit card numbers, passwords, TANs, and checksums, as well as information related to the contract, transaction amount, and recipient. This information is required to execute the transactions. However, the data entered is processed and stored exclusively by the payment service providers. In other words, we do not receive any account- or credit card-related information, but only information confirming the payment or indicating that the payment was declined. Under certain circumstances, the payment service providers may transmit the data to credit bureaus. The purpose of this transmission is to verify identity and creditworthiness. For more information, please refer to the terms and conditions and privacy policies of the respective payment service providers.

The terms and conditions and privacy policies of the respective payment service providers apply to payment transactions; these are available on the respective websites or within the transaction applications. We also refer you to these for further information and to exercise your rights of withdrawal, access, and other data subject rights.

Types of data processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); Payment data (e.g., bank account information, invoices, payment history); Contract data (e.g., subject matter of the contract, term, customer category); Usage data (e.g., page views and time spent on pages, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved parties). Contact data (e.g., postal and email addresses or phone numbers).
Data subjects: Service recipients and clients; business and contractual partners; prospective customers.
Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; business processes and operational procedures. Financial and payment management.
Retention and deletion: Deletion in accordance with the information provided in the section “General Information on Data Storage and Deletion” .
Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR). Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR).

Additional information on processing operations, procedures, and services:

Amazon Payments: Payment services (technical integration of online payment methods); Service provider: Amazon Payments Europe S.C.A., 38 avenue J.F. Kennedy, L-1855 Luxembourg; Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, lit. b) GDPR); Website: https://pay.amazon.de/. Privacy Policy: https://pay.amazon.de/help/201212490.
American Express: Payment services (technical integration of online payment methods); Service provider: American Express Europe S.A., Theodor-Heuss-Allee 112, 60486 Frankfurt am Main, Germany; Legal Basis: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR); Website: https://www.americanexpress.com/ de/. Privacy Policy: https://www.americanexpress.com/de-de/firma/legal/datenschutz-center/online-datenschutzerklarung/.
Apple Pay: Payment services (technical integration of online payment methods); Service provider: Apple Inc., Infinite Loop, Cupertino, CA 95014, USA; Legal basis: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR); Website: https://www.apple.com/de/ apple-pay/. Privacy Policy: https://www.apple.com/legal/privacy/de-ww/.
Google Pay: Payment services (technical integration of online payment methods); Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR); Website: https://pay.google.com/intl/de_de/about/. Privacy Policy: https://business.safety.google/privacy/.
Klarna: Payment services (technical integration of online payment methods); Service provider: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden; Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR) ; Website: https://www.klarna.com/de. Privacy Policy: https:// www.klarna.com/de/datenschutz.
Mastercard: Payment services (technical integration of online payment methods); Service provider: Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium; Legal basis: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR); Website: https://www.mastercard.de/de-de.html. Privacy Policy: https://www.mastercard.com/de/de/datenschutz.html.
PayPal: Payment services (technical integration of online payment methods) (e.g., PayPal, PayPal Plus, Braintree); Service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; Legal basis: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR); Website: https://www.paypal.com/de. Privacy Policy: strong> https://www.paypal.com/de/legalhub/paypal/privacy-full.
Shopify Payments: Payment services (technical integration of online payment methods). Payments are processed via Shopify Payments, Shopify’s integrated payment platform. It allows customers to use various supported payment methods, depending on the region. Payment processing is subject to the Shopify Payments Terms of Service, which are displayed to the customer during the checkout process. Additional information is available at https://www.shopify.com/de/payments; Service Provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; Legal Basis: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR); Website: https://www.shopify.de. Privacy Policy: https://www.shopify.de/legal/datenschutz.
Visa: Payment services (technical integration of online payment methods); Service provider: Visa Europe Services Inc., London Branch, 1 Sheldon Square, London W2 6TT, UK; Legal basis: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR); Website: https://www.visa.de. Privacy Policy: https://www.visa.de/nutzungsbedingungen/visa-globale-datenschutzmitteilung.html.
WERO: Payment services (technical integration of online payment methods); Service provider: EPI Company SE, Lignestraat 13, 1000 Brussels, Belgium; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://wero-wallet.eu/ de. Privacy Policy: https://wero-wallet.eu/de/datenschutzcenter.
Paylax: Paylax is a German digital escrow service which secures online purchases and sales (e.g., on platforms such as classified ads or for services). It protects both buyers and sellers from fraud by holding the money in a secure escrow account and releasing it only once the goods or services have been received; Service Provider: Continental Payment GmbH, Bleibtreustr. 5, 110623, Berlin; Website: https://paylax.com/de. Privacy Policy: https://paylax.com/de/privacy.
USDC: USDC (USD Coin) is a digital currency (stablecoin) that is pegged to the U.S. dollar: 1 USDC is always equal to 1 U.S. dollar. As a payment provider or payment method, USDC enables global, lightning-fast, and low-fee money transfers via the blockchain, combining the stability of traditional currencies with the internet; Service Provider: Circle Internet Group, Inc.
One World Trade Center
New York, NY 10007
USA; Website: https://www.usdc.com/. Privacy Policy: https://www.circle.com/legal/privacy-policy.

Provision of Online Services and Web Hosting

We process users’ data in order to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or device.

Types of data processed: Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features); Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved individuals); log data (e.g., log files regarding logins, data retrieval, or access times); Content data (e.g., text or image-based messages and posts, as well as related information such as details regarding authorship or the time of creation).
Data subjects: Users (e.g., website visitors, users of online services).
Purposes of processing and legitimate interests: Provision of our online services and user-friendliness; IT infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)); security measures; Content Delivery Network (CDN). Provision of contractual services and fulfillment of contractual obligations.
Retention and Deletion: Deletion in accordance with the information in the section “General Information on Data Storage and Deletion.”
Legal Bases: Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing activities, procedures, and services:

Provision of online services on leased server space: To provide our online services, we use server space, computing capacity, and software that we lease or otherwise obtain from a server provider (also known as a “web host”); Legal bases: Legitimate interests (Art. 6(1), sentence 1, subparagraph (f) of the GDPR).
Collection of access data and log files: Access to our online offering is logged in the form of so-called “server log files.” Server log files may include the address and name of the web pages and files accessed, the date and time of access, the amount of data transferred, a notification of successful access, the browser type and version, the user’s operating system, the referrer URL (the previously visited page), and, as a rule, IP addresses and the requesting provider. The server log files may be used, on the one hand, for security purposes—e.g., to prevent server overload (particularly in the event of malicious attacks, such as DDoS attacks)—and, on the other hand, to ensure server capacity and stability; Legal basis: Legitimate interests (Art. 6(1), sentence 1, lit. f) of the GDPR). Deletion of Data: Log file information is stored for a maximum of 30 days and is then deleted or anonymized. Data that must be retained for evidentiary purposes is exempt from deletion until the respective incident has been fully resolved.
1& 1 IONOS: Services in the field of providing information technology infrastructure and related services (e.g., storage space and/or computing capacity); Service provider: 1&1 IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany; Legal basis: Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR); Website: https://www.ionos.de; Privacy Policy: https://www.ionos.de/terms-gtc/terms-privacy. Data Processing Agreement: https://www.ionos.de/hilfe/datenschutz/ general-information-on-the-general-data-protection-regulation-gdpr/conclude-a-data-processing-agreement-dpa-with-ionos/.
Cloudflare: Content Delivery Network (CDN)—a service that enables the content of a website, particularly large media files such as graphics or program scripts, to be delivered more quickly and securely using servers distributed regionally and connected via the Internet; Service Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA; Legal Basis: Legitimate Interests (Art. 6(1)(f) GDPR); Website: https://www.cloudflare.com; Privacy Policy: https://www.cloudflare.com/privacypolicy/; Data Processing Agreement: https://www.cloudflare.com/cloudflare-customer-dpa/. Legal Basis for Transfers to Third Countries: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.cloudflare.com/cloudflare-customer-scc/), Switzerland – Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.cloudflare.com/cloudflare-customer-scc/).

Use of Cookies

The term “cookies” refers to functions that store and retrieve information on users’ devices. Cookies may also be used for various purposes, such as ensuring the functionality, security, and convenience of online services, as well as analyzing visitor traffic. We use cookies in accordance with legal requirements. To this end, we obtain users’ consent in advance when necessary. If consent is not required, we rely on our legitimate interests. This applies when the storage and retrieval of information are essential to provide explicitly requested content and features. This includes, for example, saving settings and ensuring the functionality and security of our online services. Consent may be revoked at any time. We provide clear information about the scope of consent and which cookies are used.

Information on legal bases under data protection law: Whether we process personal data using cookies depends on consent. If consent has been given, it serves as the legal basis. Without consent, we rely on our legitimate interests, which are explained above in this section and in the context of the respective services and procedures.

Retention period: With regard to the retention period, the following types of cookies are distinguished:

Temporary cookies (also known as session cookies): Temporary cookies are deleted at the latest after a user leaves an online service and closes their device (e.g., browser or mobile application).
Persistent cookies: Persistent cookies remain stored even after the device is closed. This allows, for example, the login status to be saved and preferred content to be displayed directly when the user visits a website again. Likewise, user data collected via cookies may be used for audience measurement. Unless we provide users with explicit information regarding the type and storage duration of cookies (e.g., when obtaining consent), they should assume that these cookies are persistent and may be stored for up to two years.

General Information on Withdrawal of Consent and Objection (Opt-out): Users may withdraw the consent they have provided at any time and may also object to the processing in accordance with legal requirements, including through their browser’s privacy settings.

Types of data processed: Meta, communication, and procedural data (e.g., IP addresses, time stamps, identification numbers, individuals involved).
Data subjects: Users (e.g., website visitors, users of online services).
Legal bases: Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR). Consent (Art. 6(1), first sentence, letter a) of the GDPR).

Further information on processing activities, procedures, and services:

Processing of cookie data based on consent: We use a consent management solution to obtain users’ consent to the use of cookies or to the procedures and providers specified within the consent management solution. This procedure serves to obtain, log, manage, and revoke consents, particularly with regard to the use of cookies and similar technologies used to store, read, and process information on users’ end devices. As part of this process, users’ consent is obtained for the use of cookies and the associated processing of information, including the specific processing activities and providers mentioned in the consent management process. Users also have the option to manage and revoke their consent. Consent declarations are stored to avoid repeated requests and to maintain proof of consent in accordance with legal requirements. Storage takes place on the server and/or in a cookie (a so-called opt-in cookie) or via comparable technologies to associate the consent with a specific user or their device. Unless specific information regarding the providers of consent management services is available, the following general guidelines apply: Consent is stored for up to two years. A pseudonymous user identifier is created, which is stored together with the time of consent, details regarding the scope of consent (e.g., B. relevant categories of cookies and/or service providers), as well as information about the browser, the operating system, and the end device used; Legal basis: Consent (Art. 6(1), sentence 1, lit. a) GDPR).

Registration, Login, and User Account

Users can create a user account. During registration, users are informed of the required mandatory information, which is processed for the purpose of providing the user account based on the fulfillment of contractual obligations. The data processed includes, in particular, login information (username, password, and an email address).

When users utilize our registration and login functions, as well as when they use their user account, we store the IP address and the time of the respective user action. This data is stored based on our legitimate interests, as well as those of the users, in protecting against misuse and other unauthorized use. This data is generally not disclosed to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so.

Users may be notified via email about events relevant to their user account, such as technical changes.

Types of data processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); Contact data (e.g., mailing and email addresses or phone numbers); Content data (e.g., text or image-based messages and posts, as well as related information such as details regarding authorship or the time of creation); Usage data (e.g., page views and time spent on pages, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features); Log data (e.g., log files regarding logins, data retrieval, or access times).
Data subjects: Users (e.g., website visitors, users of online services).
Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; security measures; organizational and administrative procedures. Provision of our online offerings and user-friendliness.
Retention and deletion: Deletion in accordance with the information in the section “General Information on Data Storage and Deletion.” Deletion upon termination.
Legal Bases: Contract performance and pre-contractual inquiries (Art. 6(1), Sent. 1, lit. b) GDPR). Legitimate interests (Art. 6(1), Sent. 1, lit. f) GDPR).

Additional Information on Processing Activities, Procedures, and Services:

User profiles are not public: User profiles are not publicly visible or accessible.
Deletion of Data Following Termination: Once users have terminated their user account, their data related to the user account will be deleted, subject to any legal authorization, obligation, or the user’s consent; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, lit. b) GDPR).
No obligation to retain data: It is the users’ responsibility to back up their data upon termination before the end of the contract. We are entitled to irrevocably delete all user data stored during the term of the contract; Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, letter b) GDPR).

Blogs and Publication Media

We use blogs or similar means of online communication and publication (hereinafter “publication medium”). Readers’ data is processed for the purposes of the publication medium only to the extent necessary for its presentation and for communication between authors and readers, or for security reasons. For further information, please refer to the details regarding the processing of visitors to our publication medium as set forth in this Privacy Policy.

Types of Data Processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); contact data (e.g., mailing and email addresses or phone numbers); Content data (e.g., text or image-based messages and posts, as well as related information such as details regarding authorship or the time of creation); usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features) . Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved).
Data subjects: Users (e.g., website visitors, users of online services).
Purposes of processing and legitimate interests: Feedback (e.g., collecting feedback via an online form). Provision of our online services and user-friendliness.
Retention and deletion: Deletion in accordance with the information provided in the section “General Information on Data Storage and Deletion.”
Legal Bases: Legitimate Interests (Art. 6(1), Sentence 1, Letter f) of the GDPR).

Contact and Inquiry Management

When you contact us (e.g., by mail, contact form, email, phone, or social media), as well as in the context of existing user and business relationships, the information provided by the inquiring individuals is processed to the extent necessary to respond to contact inquiries and any requested actions.

Types of data processed: Contact data (e.g., mailing and email addresses or phone numbers); content data (e.g., text or image-based messages and posts, as well as related information such as details regarding authorship or the time of creation). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved individuals).
Data subjects: Communication partners.
Purposes of processing and legitimate interests: Communication; organizational and administrative procedures; Feedback (e.g., collecting feedback via an online form). Provision of our online services and user-friendliness.
Retention and deletion: Deletion in accordance with the information provided in the section “General Information on Data Storage and Deletion.”
Legal bases: Legitimate interests (Art. 6(1), sentence 1, letter f) of the GDPR). Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, letter b) of the GDPR).

Further information on processing procedures, processes, and services:

Contact form: When you contact us via our contact form, by email, or through other communication channels, we process the personal data you provide to respond to and handle your inquiry. This generally includes information such as your name, contact information, and, if applicable, other details provided to us that are necessary for proper processing. We use this data exclusively for the stated purpose of establishing contact and communication; Legal Bases: Contract performance and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR), Legitimate Interests (Art. 6(1), sentence 1, lit. f) GDPR).

Push Notifications

With the users' consent, we may send users so-called “push notifications.” These are messages that appear on users' screens, devices, or in their browsers, even when our online service is not actively in use.

To subscribe to push notifications, users must confirm the prompt from their browser or device to receive push notifications. This consent process is documented and stored. This storage is necessary to determine whether users have consented to receiving push notifications and to be able to provide evidence of that consent. For these purposes, a pseudonymous identifier from the browser (a so-called “push token”) or the device ID of an end device is stored.

Push notifications may be necessary to fulfill contractual obligations (e.g., technical and organizational information relevant to the use of our online service) and are otherwise sent based on the user’s consent, unless specifically stated below. Users can change their settings for receiving push notifications at any time using the notification settings in their respective browsers or devices.

Types of data processed: Usage data (e.g., page views and time spent on pages, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved).
Data subjects: Communication partners.
Purposes of processing and legitimate interests: Communication; provision of our online services and user-friendliness. Direct marketing (e.g., via email or mail).
Retention and Deletion: Deletion in accordance with the information in the section “General Information on Data Storage and Deletion.” Deletion upon termination.
Legal bases: Consent (Art. 6(1), sentence 1, lit. a) GDPR). Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR).

Further information on processing operations, procedures, and services:

Push notifications with promotional content: The push notifications we send may contain promotional information. Promotional push notifications are processed based on the user’s consent. If the content of the promotional push notifications is specifically described as part of the consent to receive them, those descriptions are decisive for the user’s consent. In addition, our newsletters contain information about our services and our company; Legal basis: Consent (Art. 6(1), Sentence 1, lit. a) GDPR).

Newsletters and Electronic Notifications

We send newsletters, emails, and other electronic notifications (hereinafter “newsletters”) exclusively with the recipients’ consent or on a legal basis. If the newsletter’s content is specified during the subscription process, this content is decisive for the user’s consent. To subscribe to our newsletter, providing your email address is usually sufficient. However, in order to offer you a personalized service, we may ask you to provide your name so we can address you personally in the newsletter or to provide additional information if it is necessary for the purpose of the newsletter.

Deletion and Restriction of Processing: We may store unsubscribed email addresses for up to three years based on our legitimate interests before deleting them, in order to be able to prove that consent was previously given. The processing of this data is limited to the purpose of potentially defending against claims. An individual request for deletion is possible at any time, provided that the prior existence of consent is confirmed at the same time. In the event of obligations to permanently honor objections, we reserve the right to store the email address solely for this purpose in a block list.

The registration process is logged based on our legitimate interests for the purpose of verifying that it was carried out properly. To the extent that we engage a service provider to send emails, this is done based on our legitimate interests in an efficient and secure mailing system.

Content:

Information about us, our services, promotions, and offers.

Types of data processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); contact information (e.g., mailing and email addresses or phone numbers); metadata, communication data, and process data (e.g., IP addresses, timestamps, identification numbers, individuals involved). Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features).
Data subjects: Communication partners.
Purposes of processing and legitimate interests: Direct marketing (e.g., via email or mail).
Legal bases: Consent (Art. 6(1), sentence 1, lit. a) GDPR). Legitimate interests (Art. 6(1), first sentence, lit. f) GDPR).
Right to object (opt-out): You may unsubscribe from our newsletter at any time, i.e., withdraw your consent or object to receiving further newsletters. You will find a link to unsubscribe from the newsletter either at the end of each newsletter or you can use one of the contact options listed above, preferably email, for this purpose.

Further information on processing procedures, methods, and services:

CleverReach: Email distribution and automation services; Service provider: CleverReach GmbH & Co. KG, //CRASH Building, Schafjückenweg 2, 26180 Rastede, Germany; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.cleverreach.com/de; Privacy Policy: https://www.cleverreach.com/de-de/datenschutz/. Data Processing Agreement: Provided by the service provider.

Web Analytics, Monitoring, and Optimization

Web analytics (also referred to as “audience measurement”) is used to evaluate visitor traffic to our online offering and may include pseudonymized data on visitor behavior, interests, or demographic information, such as age or gender. With the help of web analytics, we can, for example, identify at what times our online offering or its features and content are used most frequently, or encourage repeat visits. We are also able to identify which areas require optimization.

In addition to web analytics, we may also use testing methods to, for example, test and optimize different versions of our online offering or its components.

Unless otherwise specified below, profiles—that is, data aggregated for a specific usage session—may be created for these purposes, and information may be stored in a browser or on a device and then retrieved. The data collected includes, in particular, websites visited and elements used there, as well as technical information such as the browser used, the computer system used, and details regarding usage times. If users have consented to the collection of their location data by us or by the providers of the services we use, the processing of location data is also possible.

In addition, users’ IP addresses are stored. However, we use an IP masking procedure (i.e., pseudonymization by truncating the IP address) to protect users. In general, no personally identifiable user data (such as email addresses or names) is stored in the context of web analytics, A/B testing, and optimization; instead, pseudonyms are used. This means that neither we nor the providers of the software we use know the actual identity of the users, but only the information stored in their profiles for the purpose of the respective processes.

Notes on Legal Bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e., our interest in providing efficient, cost-effective, and user-friendly services). In this context, we would also like to direct your attention to the information regarding the use of cookies in this Privacy Policy.

Types of Data Processed: Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved).
Data subjects: Users (e.g., website visitors, users of online services).
Purposes of processing and legitimate interests: Audience measurement (e.g., access statistics, identification of returning visitors); Profiles containing user-related information (creation of user profiles). Provision of our online services and user-friendliness.
Retention and deletion: Deletion in accordance with the information in the section “General Information on Data Storage and Deletion.” Storage of cookies for up to 2 years (Unless otherwise specified, cookies and similar storage methods may be stored on users’ devices for a period of two years.).
Security measures: IP masking (pseudonymization of the IP address).
Legal Bases: Consent (Art. 6(1)(a) GDPR). Legitimate Interests (Art. 6(1)(f) GDPR).

Further information on processing procedures, methods, and services:

Google Analytics: We use Google Analytics to measure and analyze the use of our online offering based on a pseudonymous user identification number. This identification number does not contain any unique data, such as names or email addresses. It serves to associate analytical information with a device in order to determine which content users accessed during one or more sessions, which search terms they used, whether they revisited that content, or how they interacted with our online offering. The time of use and its duration are also stored, as well as the sources from which users were referred to our online offering and technical details about their devices and browsers.
In doing so, pseudonymous user profiles are created using information from the use of various devices, and cookies may be used for this purpose. Google Analytics does not log or store individual IP addresses for EU users. However, Analytics provides approximate geographic location data by deriving the following metadata from IP addresses: city (and the derived latitude and longitude of the city), continent, country, region, subcontinent (and ID-based equivalents). For EU data traffic, IP address data is used exclusively for this derivation of geolocation data before being immediately deleted. It is not logged, is not accessible, and is not used for any other purposes. When Google Analytics collects measurement data, all IP queries are performed on EU-based servers before the traffic is forwarded to Analytics servers for processing; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6(1)(a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Security measures: IP masking (pseudonymization of the IP address); Privacy Policy: https://business.safety.google/privacy/; Data Processing Agreement: https://business.safety.google/adsprocessorterms/ ; Legal basis for transfers to third countries: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses ( https://business.safety.google/adsprocessorterms); Opt-out option: Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for displaying ads: https://myadcenter.google.com/personalizationoff. Further information: https://business.safety.google/adsservices/ (Types of processing and the data processed).
Google Tag Manager: We use Google Tag Manager, a software tool from Google that allows us to centrally manage so-called website tags via a user interface. Tags are small code elements on our website that are used to track and analyze visitor activity. This technology helps us improve our website and the content offered on it. Google Tag Manager itself does not create user profiles, does not store cookies containing user profiles, and does not perform any independent analyses. Its function is limited to simplifying and streamlining the integration and management of the tools and services we use on our website. Nevertheless, when Google Tag Manager is used, users’ IP addresses are transmitted to Google, which is necessary for technical reasons to implement the services we use. Cookies may also be set in the process. However, this data processing only occurs when services are integrated via Tag Manager. For more detailed information about these services and their data processing, please refer to the relevant sections of this Privacy Policy; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6(1)(a) GDPR); Website: https://marketingplatform.google.com; Privacy Policy: https://business.safety.google/privacy/; Data Processing Agreement:
https://business.safety.google/adsprocessorterms. Legal Basis for Transfers to Third Countries: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses ( https://business.safety.google/adsprocessorterms).
Blockify: Fraud Filter: Blockify: Fraud Filter is a security and fraud prevention app designed for e-commerce platforms such as Shopify, Wix, and Shopline. It helps online merchants detect and prevent fraudulent orders to minimize financial losses and chargebacks; Service Provider: Blockify
18/11 Thai Ha Street
Trung Liet Ward
Hà Nội 11515
Vietnam; Website: https://blockifyapp.com/. Privacy Policy: https://blockifyapp.com/privacy-policy/.

Online Marketing

We process personal data for the purpose of online marketing, which may include, in particular, the marketing of advertising space or the display of promotional and other content (collectively referred to as “Content”) based on users’ potential interests, as well as the measurement of its effectiveness.

For these purposes, so-called user profiles are created and stored in a file (known as a “cookie”) or similar methods are used to store information about the user that is relevant to the display of the aforementioned content. This may include, for example, content viewed, websites visited, online networks used, as well as communication partners and technical details such as the browser and computer system used, and information regarding usage times and functions utilized. If users have consented to the collection of their location data, this data may also be processed.

In addition, users’ IP addresses are stored. However, we use available IP masking methods (i.e., pseudonymization by truncating the IP address) to protect users. In general, no plaintext user data (such as email addresses or names) is stored as part of the online marketing process; instead, pseudonyms are used. This means that neither we nor the providers of the online marketing services know the actual identity of users, but only the information stored in their profiles.

The information in the profiles is typically stored in cookies or via similar methods. These cookies can generally be read later on other websites that use the same online marketing process, analyzed for the purpose of displaying content, supplemented with additional data, and stored on the server of the online marketing service provider.

In exceptional cases, it is possible to associate clear data with the profiles, primarily when users are, for example, members of a social network whose online marketing methods we use and the network links the user profiles with the aforementioned information. Please note that users may enter into additional agreements with the providers, such as by giving consent during registration.

We generally only have access to aggregated information regarding the success of our advertisements. However, as part of so-called conversion tracking, we can determine which of our online marketing methods led to a so-called conversion—for example, the conclusion of a contract with us. Conversion tracking is used solely to analyze the effectiveness of our marketing measures.

Unless otherwise stated, please assume that cookies used are stored for a period of two years.

Information on Legal Bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is that consent. Otherwise, user data is processed based on our legitimate interests (i.e., our interest in providing efficient, cost-effective, and user-friendly services). In this context, we would also like to direct your attention to the information regarding the use of cookies in this privacy policy.

Information on Revocation and Objection:

We refer you to the privacy notices of the respective providers and the opt-out options specified by them . If no explicit opt-out option has been provided, you have the option of disabling cookies in your browser settings. However, this may limit certain functions of our online service. We therefore also recommend the following opt-out options, which are summarized and organized by region:

a) Europe: https://youronlinechoices.eu/.

b) Canada: https://youradchoices.ca/.

c) U.S.: https://optout.aboutads.info/.

d) Global: https://optout.aboutads.info.

Types of data processed: Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved).
Data subjects: Users (e.g., website visitors, users of online services).
Purposes of processing and legitimate interests: Audience measurement (e.g., access statistics, identification of returning visitors); tracking (e.g., interest-based/behavioral profiling, use of cookies); target group segmentation; marketing; profiles containing user-related information (creation of user profiles). Provision of our online services and user-friendliness.
Retention and deletion: Deletion in accordance with the information in the section “General Information on Data Storage and Deletion.” Storage of cookies for up to 2 years (Unless otherwise specified, cookies and similar storage methods may be stored on users’ devices for a period of two years.).
Security measures: IP masking (pseudonymization of the IP address).
Legal Bases: Legitimate Interests (Art. 6(1)(f) GDPR).

Additional Information on Processing Activities, Procedures, and Services:

Google Ad Manager: We use the “Google Ad Manager” service to place ads on the Google Display Network (e.g., in search results, in videos, on websites, etc.). Google Ad Manager is characterized by the fact that ads are displayed in real time based on users’ presumed interests. This allows us to display ads for our online offering to users who may have a potential interest in our offering or who have previously shown interest in it, as well as to measure the success of the ads; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, lit. f) GDPR) ; Website: https://marketingplatform.google.com; Privacy Policy: https://business.safety.google/privacy/; Legal basis for transfers to third countries: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF); Further information: Types of processing and data processed: https://business.safety.google/adsservices/; Data Processing Terms for Google Advertising Products: Information on the services, data processing terms between data controllers, and standard contractual clauses for data transfers to third countries: https://business.safety.google/adscontrollerterms. If Google acts as a data processor, data processing terms for Google advertising products and standard contractual clauses for data transfers to third countries: https://business.safety.google/adsprocessorterms.

Customer Reviews and Rating Processes

We participate in review and rating processes to evaluate, optimize, and promote our services. When users rate us or otherwise provide feedback via the participating review platforms or processes, the providers’ Terms and Conditions or Terms of Use and Privacy Policies also apply. As a rule, submitting a review also requires registration with the respective providers.

To ensure that reviewers have actually used our services, we transmit the necessary data regarding the customer and the service used to the respective review platform with the customer’s consent (including name, email address, and order number or item number). This data is used solely to verify the user’s authenticity.

Types of data processed: Contract data (e.g., subject matter of the contract, term, customer category); usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved). Content data (e.g., textual or visual messages and posts, as well as related information such as details regarding authorship or creation date).
Data subjects: Service recipients and clients; users (e.g., website visitors, users of online services). Business and contractual partners.
Purposes of processing and legitimate interests: Feedback (e.g., collecting feedback via an online form). Marketing.
Retention and deletion: Deletion in accordance with the information in the section “General Information on Data Storage and Deletion.”
Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Additional information on processing activities, procedures, and services:

Trustpilot: review platform; Service provider: Trustpilot A/S, Pilestræde 58, 5, 1112 Copenhagen, Denmark; Legal basis: Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR); Website: https://de.trustpilot.com; Privacy Policy: https://de.legal.trustpilot.com/for-reviewers/end-user-privacy-terms. Data Processing Agreement: https://de.legal.trustpilot.com/for-businesses/data-processing-agreement.
Judge.me Reviews: Judge. me is a popular e-commerce app and platform that allows online stores to collect, manage, and display customer reviews on their websites; Service Provider: Judge.me
Ignition Law, First Floor, Moray House
23–31 Great Titchfield Street
London W1W 7PA
United Kingdom; Website: https://judge.me/. Privacy Policy: https://judge.me/privacy.

Social Media Presence

We maintain online presences on social media platforms and, in this context, process user data to communicate with users active on those platforms or to provide information about us.

Please note that user data may be processed outside the European Union in this context. This may pose risks to users, as it could, for example, make it more difficult to enforce user rights.

Furthermore, user data within social networks is generally processed for market research and advertising purposes. For example, usage profiles may be created based on users’ behavior and the resulting interests. These profiles may in turn be used, to display advertisements—both within and outside the networks—that are presumed to correspond to users’ interests. For this reason, cookies are typically stored on users’ computers to record their usage behavior and interests. In addition, usage profiles may also store data regardless of the devices used by users (particularly if they are members of the respective platforms and are logged in there). p>

For a detailed description of the respective forms of processing and the options for opting out, please refer to the privacy policies and information provided by the operators of the respective networks.

We also note that requests for information and the exercise of data subject rights are most effectively addressed directly with the providers. Only the latter have access to the user data and can directly take appropriate measures and provide information. If you still need assistance, however, you can contact us.

Types of data processed: Contact data (e.g., postal and email addresses or phone numbers); Content data (e.g., text or image-based messages and posts, as well as related information, such as details regarding authorship or the time of creation); Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features).
Data subjects: Users (e.g., website visitors, users of online services).
Purposes of processing and legitimate interests: Communication; feedback (e.g., collecting feedback via an online form). Public relations.
Retention and deletion: Deletion in accordance with the information provided in the section “General Information on Data Storage and Deletion.”
Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Additional information on processing activities, procedures, and services:

Instagram: Social network that allows users to share photos and videos, comment on and like posts, send messages, and follow profiles and pages; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR) ; Website: https://www.instagram.com; Privacy Policy: https://privacycenter.instagram.com/policy/. Legal basis for transfers to third countries: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF).
Facebook Pages: Profiles within the Facebook social network—The data controller is jointly responsible with Meta Platforms Ireland Limited for the collection and transmission of data from visitors to our Facebook page (“Fan Page”). This includes, in particular, information about user behavior (e.g., content viewed or interacted with, actions taken) as well as device information (e.g., IP address, operating system, browser type, language settings, cookie data). Further details can be found in Facebook’s Data Policy: https://www.facebook.com/privacy/policy/. Facebook also uses this data to provide us with statistical analyses via the “Page Insights” service, which offer insights into how people interact with our page and its content. This is based on an agreement with Facebook (“Information on Page Insights”: https://www.facebook.com/legal/terms/page_controller_addendum), which governs, among other things, security measures and the exercise of data subjects’ rights. Further information can be found here: https://www.facebook.com/legal/terms/information_about_page_insights_data. Users may therefore direct requests for access or erasure directly to Facebook. Users’ rights (in particular, the right to access, erasure, objection, and lodging a complaint with a supervisory authority) remain unaffected by this. Joint responsibility is limited exclusively to the collection of data by Meta Platforms Ireland Limited (EU). Meta Platforms Ireland Limited is solely responsible for further processing, including any possible transfer to Meta Platforms Inc. in the United States; Service Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal Basis: Legitimate Interests (Art. 6(1)(f) GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/privacy/policy/ . Legal basis for transfers to third countries: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum), Switzerland – Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum).
Pinterest: Social network that allows users to share photos, comment on, favorite, and curate posts; send messages; and follow profiles; Service provider: Pinterest Europe Limited, 2nd Floor, Palmerston House, Fenian Street, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.pinterest.com. Privacy Policy: https://policy.pinterest.com/de/privacy-policy.
YouTube: Social network and video platform; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Privacy Policy: https://business.safety.google/privacy/; Basis for third-country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF). Right to object (opt-out): https://myadcenter.google.com/.

Plug-ins, Embedded Features, and Content

We incorporate functional and content elements into our online offering that are retrieved from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos, or city maps (hereinafter collectively referred to as “content”).

This integration always requires that the third-party providers of this content process the users’ IP addresses, as they would be unable to send the content to the users’ browsers without an IP address. The IP address is therefore necessary for the display of this content or these functions. We make every effort to use only content whose respective providers use the IP address solely for the purpose of delivering the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. These “pixel tags” allow information—such as visitor traffic on the pages of this website—to be analyzed. This pseudonymous information may also be stored in cookies on the user’s device and may include, among other things, technical information about the browser and operating system, referring websites, the time of the visit, and other details regarding the use of our online services; it may also be linked to such information from other sources.

Notes on Legal Bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is this consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e., our interest in providing efficient, cost-effective, and user-friendly services). In this context, we would also like to draw your attention to the information regarding the use of cookies in this Privacy Policy.

Types of Data Processed: Usage data (e.g., page views and time spent on pages, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved). Event data (Facebook) (“Event data” refers to information sent to the provider Meta—for example, via Meta Pixels (whether through apps or other channels)—that relates to individuals or their actions. This data includes, for example, details about website visits, interactions with content and features, app installations, and product purchases. Event data is processed for the purpose of creating target audiences for content and advertising messages (Custom Audiences). It is important to note that event data does not include actual content such as comments posted, login information, or contact information such as names, email addresses, or phone numbers. “Event data” is deleted by Meta after a maximum of two years, and the target audiences created from it are deleted when our Meta user accounts are deleted.).
Data subjects: Users (e.g., website visitors, users of online services).
Purposes of processing and legitimate interests: Provision of our online services and user-friendliness; audience measurement (e.g., access statistics, identification of returning visitors); tracking (e.g., interest-based/behavioral profiling, use of cookies); audience targeting; Marketing; Provision of contractual services and fulfillment of contractual obligations. Profiles containing user-related information (creation of user profiles).
Retention and deletion: Deletion in accordance with the information provided in the section “General Information on Data Storage and Deletion.” Storage of cookies for up to 2 years (Unless otherwise specified, cookies and similar storage methods may be stored on users’ devices for a period of two years.).
Legal bases: Consent (Art. 6(1), sentence 1, lit. a) GDPR) . Legitimate interests (Art. 6(1), first sentence, lit. f) GDPR).

Further information on processing operations, procedures, and services:

Facebook plugins and content: Facebook Social Plugins and Content—This may include, for example, content such as images, videos, or text, as well as buttons that allow users to share content from this website on Facebook. The list and appearance of Facebook social plugins can be viewed here: https://developers.facebook.com/ docs/plugins/ - Together with Meta Platforms Ireland Limited, we are jointly responsible for the collection or receipt—as part of a transfer (but not the further processing)—of “Event Data” that Facebook collects via the Facebook Social Plugins (and content embedding features) running on our online service or receives as part of a transfer for the following purposes: a) Displaying content and advertising information that corresponds to users’ presumed interests; b) Delivering commercial and transaction-related messages (e.g., contacting users via Facebook Messenger); c) Improving ad delivery and personalizing features and content (e.g., improving the ability to identify which content or advertising information is likely to match users’ interests). We have entered into a specific agreement with Facebook (“Addendum for Controllers,” https://www.facebook.com/legal/controller_addendum), which specifically outlines the security measures Facebook must observe (https://www.facebook.com/legal/terms/data_security_terms) and in which Facebook has agreed to honor the rights of data subjects (i.e., users can, for example, submit requests for information or deletion directly to Facebook). Note: If Facebook provides us with metrics, analyses, and reports (which are aggregated—i.e., do not contain information about individual users and are anonymous to us), then this processing does not take place within the framework of joint controllership, but rather on the basis of a data processing agreement (“Data Processing Terms,” https://www.facebook.com/legal/terms/dataprocessing), the “Data Security Terms” (https://www.facebook.com/legal/terms/data_security_terms) and, with regard to processing in the U.S., based on standard contractual clauses (“Facebook-EU Data Transfer Addendum,” https://www.facebook.com/legal/EU_data_transfer_addendum). Users’ rights (in particular the rights to access, erasure, objection, and filing a complaint with the competent supervisory authority) are not restricted by the agreements with Facebook; Service Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal Basis: Consent (Art. 6(1)(a) GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/privacy/policy/. Legal basis for transfers to third countries: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF).
Google Fonts (hosted on our own server): Provision of font files to ensure a user-friendly presentation of our online offering; Service provider: Google Fonts are hosted on our server; no data is transmitted to Google; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).
Google Fonts (Retrieval from Google’s server): Retrieval of fonts (and icons) for the purpose of ensuring technically secure, maintenance-free, and efficient use of fonts and icons with regard to up-to-date content and loading times, their consistent display, and compliance with any applicable licensing restrictions. The font provider is provided with the user’s IP address so that the fonts can be made available in the user’s browser. In addition, technical data (language settings, screen resolution, operating system, and hardware used) that are necessary for providing the fonts depending on the devices used and the technical environment. This data may be processed on a server belonging to the font provider in the United States—When visiting our online service, users’ browsers send HTTP requests to the Google Fonts Web API (i.e., a software interface for retrieving fonts). The Google Fonts Web API provides users with the Cascading Style Sheets (CSS) from Google Fonts and, subsequently, the fonts specified in the CSS. These HTTP requests include (1) the IP address used by the respective user to access the Internet, (2) the requested URL on the Google server, and (3) the HTTP headers, including the User-Agent, which describes the browser and operating system versions of the website visitors, as well as the referrer URL (i. e., the webpage on which the Google font is to be displayed) . IP addresses are neither logged nor stored on Google servers, and they are not analyzed. The Google Fonts Web API logs details of the HTTP requests (requested URL, user-agent, and referrer URL). Access to this data is restricted and strictly controlled. The requested URL identifies the font families for which the user wishes to load fonts. This data is logged so that Google can determine how often a specific font family is requested. With the Google Fonts Web API, the user agent must match the font generated for the respective browser type. The user agent is primarily logged for debugging purposes and used to generate aggregated usage statistics that measure the popularity of font families. These aggregated usage statistics are published on the “Analytics” page of Google Fonts. Finally, the referrer URL is logged so that the data can be used for production maintenance and to generate an aggregated report on the top integrations based on the number of font requests. According to Google, it does not use any of the information collected by Google Fonts to create profiles of end users or to serve targeted ads; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal Basis: Legitimate Interests (Art. 6(1)(f) GDPR); Website: https://fonts.google.com/; Privacy Policy: https://business.safety.google/privacy/ ; Legal basis for transfers to third countries: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF) . Further Information: https://developers.google.com/fonts/faq/privacy?hl=de.
Instagram Plugins and Content: Instagram Plugins and Content—This may include, for example, content such as images, videos, or text, as well as buttons that allow users to share content from this online service on Instagram. - We are jointly responsible with Meta Platforms Ireland Limited for the collection or receipt—as part of a transfer (but not the subsequent processing)—of “event data” that Facebook collects via Instagram features (e.g., content embedding features) that are executed on our online service, or that it receives as part of a transfer for the following purposes: a) Displaying content and advertising information that corresponds to users’ presumed interests; b) Delivering commercial and transaction-related messages (e.g., contacting users via Facebook Messenger); c) Improving ad delivery and personalizing features and content (e.g., improving the ability to identify which content or advertising information is likely to match users’ interests). We have entered into a specific agreement with Facebook (“Addendum for Controllers,” https://www.facebook.com/legal/controller_addendum), which specifically governs the security measures Facebook must observe (https://www.facebook.com/legal/terms/data_security_terms) and in which Facebook has agreed to uphold the rights of data subjects (i.e., users can, for example, submit inquiries or deletion requests directly to Facebook). Note: If Facebook provides us with metrics, analyses, and reports (which are aggregated, i.e., contain no information on individual users and are anonymous to us), then this processing does not take place within the framework of joint controllership, but rather on the basis of a data processing agreement (“Data Processing Terms,” https://www.facebook.com/legal/terms/dataprocessing), the “Data Security Terms” (https://www.facebook.com/legal/terms/data_security_terms) and, with regard to processing in the U.S., on the basis of standard contractual clauses (“Facebook-EU Data Transfer Addendum,” https://www.facebook.com/legal/EU_data_transfer_addendum) . Users’ rights (in particular the right to access, erasure, objection, and to lodge a complaint with the competent supervisory authority) are not restricted by the agreements with Facebook; Service Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.instagram.com. Privacy Policy: https://privacycenter.instagram.com/policy/.
Pinterest plugins and content: Pinterest plugins and content—this may include, for example, content such as images, videos, or text, as well as buttons that allow users to share content from this website on Pinterest; Service Provider: Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA; Legal Basis: Legitimate Interests (Art. 6(1)(f) GDPR); Website: https://www.pinterest.com. Privacy Policy: https://policy. pinterest.com/de/privacy-policy.
reCAPTCHA: We integrate the “reCAPTCHA” feature to determine whether entries (e.g., in online forms) are made by humans and not by automated machines (so-called “bots”). The data processed may include IP addresses, information about operating systems, devices, or browsers used, language settings, location, mouse movements, keystrokes, time spent on web pages, previously visited websites, interactions with reCAPTCHA on other websites, cookies in some cases, and results of manual verification processes (e.g., answering questions or selecting objects in images). Data processing is based on our legitimate interest in protecting our online services from abusive automated crawling and spam; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR); Website: https://cloud.google.com/security/products/recaptcha; Privacy Policy: https://business. safety.google/privacy/; Data Processing Agreement: https://cloud.google.com/terms/data-processing-addendum. Legal Basis for Transfers to Third Countries: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://cloud.google.com/terms/sccs/eu-c2p), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://cloud.google.com/terms/sccs/eu-c2p).
YouTube videos: Video content; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6(1)(a) GDPR); Website: https://www.youtube.com; Privacy Policy: https://business.safety.google/privacy/; Legal basis for transfers to third countries: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF). Opt-out option: Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for displaying ads: https://myadcenter.google.com/personalizationoff.
YouTube videos: Videos stored on YouTube are embedded within our online offering. These YouTube videos are integrated via a special domain using the “youtube-nocookie” component in what is known as “enhanced privacy mode.” In “enhanced privacy mode,” only information—including your IP address, browser details, and device information—that YouTube requires for the display, control, and optimization of video playback. As soon as you play the videos, additional information may be processed by YouTube for the purpose of analyzing user behavior, storing data in your user profile, and personalizing content and ads. Cookies may be stored for up to two years; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6(1)(a) GDPR); Website: https://www.youtube.com; Privacy Policy: https://business.safety.google/privacy/; Legal basis for transfers to third countries: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF). Further information: https://support.google.com/youtube/answer/171780? hl=de-DE#zippy=%2Cturn-on-privacy-enhanced-mode%2C-enable-enhanced-privacy-mode.
Font Awesome (retrieved from the provider’s server): strong>Retrieval of fonts (and icons) for the purpose of technically secure, maintenance-free, and efficient use of fonts and icons with regard to up-to-date content and loading times, their consistent display, and compliance with any applicable licensing restrictions. The font provider is notified of the user’s IP address so that the fonts can be made available in the user’s browser. In addition, technical data (language settings, screen resolution, operating system, hardware used) is transmitted, which is necessary for providing the fonts depending on the devices used and the technical environment; Service provider: Fonticons, Inc., 6 Porter Road, Apartment 3R, Cambridge, MA 02140, USA; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://fontawesome.com/ . Privacy Policy: https://fontawesome.com/privacy.

Management, Organization, and Support Tools

We use services, platforms, and software from other providers (hereinafter referred to as “third-party providers”) for the purposes of organizing, managing, planning, and delivering our services. When selecting third-party providers and their services, we comply with legal requirements.

In this context, personal data may be processed and stored on the third-party providers’ servers. This may involve various types of data that we process in accordance with this Privacy Policy. Such data may include, in particular, users’ master data and contact information, as well as data related to transactions, contracts, other processes, and their contents.

If users are referred to third-party providers or their software or platforms in the context of communication, business, or other relationships with us, the third-party providers may process usage data and metadata for security purposes, to optimize services, or for marketing purposes. We therefore ask that you review the privacy policies of the respective third-party providers.

Types of data processed: Content data (e.g., text or image-based messages and posts, as well as related information such as details regarding authorship or the time of creation); Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved).
Data Subjects: Communication partners. Users (e.g., website visitors, users of online services).
Purposes of Processing and Legitimate Interests: Provision of contractual services and fulfillment of contractual obligations. Office and organizational procedures.
Retention and deletion: Deletion in accordance with the information in the section “General Information on Data Storage and Deletion.”
Legal bases: Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR).

Further information on processing procedures, processes, and services:

Paylax: Paylax is a digital escrow service based in Germany that securely processes online purchases and sales. The system protects both buyers and sellers from fraud by holding the funds in a secure escrow account until the goods or services have been received in good order; Service provider: Continental Payment GmbH
Bleibtreustraße 51
10623 Berlin
Germany; Website: https://www.paylax.com/de. Privacy Policy: https://www.paylax.com/de/privacy.

Changes and Updates

We ask that you review the content of our Privacy Policy regularly. We will update the Privacy Policy as soon as changes to our data processing activities make it necessary to do so. We will notify you as soon as the changes require action on your part (e.g., consent) or any other individual notification.

If we provide addresses and contact information for companies and organizations in this Privacy Policy, please note that these addresses may change over time, and we ask that you verify the information before contacting them.

Definitions of Terms

This section provides an overview of the terms used in this Privacy Policy. To the extent that these terms are defined by law, their legal definitions apply. The explanations below, however, are primarily intended to aid understanding.

Employees: Employees are defined as individuals who are in an employment relationship, whether as staff members, employees, or in similar positions. An employment relationship is a legal relationship between an employer and an employee that is established by an employment contract or agreement. It involves the employer’s obligation to pay the employee compensation in exchange for the employee’s work. The employment relationship comprises various phases, including the establishment phase, during which the employment contract is concluded; the performance phase, during which the employee performs their work; and the termination phase, when the employment relationship ends, whether through termination, a mutual termination agreement, or otherwise. Employee data refers to all information relating to these individuals and pertaining to their employment. This includes aspects such as personal identification data, identification numbers, payroll and bank information, working hours, vacation entitlements, health data, and performance evaluations.
Master data: Master data comprises essential information necessary for the identification and management of contractual partners, user accounts, profiles, and similar assignments. This data may include, among other things, personal and demographic details such as names, contact information (addresses, phone numbers, email addresses), dates of birth, and specific identifiers (user IDs). Master data forms the basis for any formal interaction between individuals and services, institutions, or systems by enabling unique mapping and communication.
Content Delivery Network (CDN): A “Content Delivery Network” (CDN) is a service that enables the content of an online offering—in particular large media files such as graphics or program scripts—to be delivered more quickly and securely using servers distributed regionally and connected via the Internet.
Content Data: Content data encompasses information generated during the creation, editing, and publication of all types of content. This category of data may include text, images, videos, audio files, and other multimedia content published on various platforms and media. Content data is not limited to the actual content itself but also includes metadata that provides information about the content, such as tags, descriptions, author information, and publication dates
Contact Data: Contact data consists of essential information that enables communication with individuals or organizations. It includes, among other things, phone numbers, mailing addresses, and email addresses, as well as communication channels such as social media handles and instant messaging identifiers.
Conversion tracking: Conversion tracking (also known as “visit-action analysis”) is a method used to determine the effectiveness of marketing measures. To do this, a cookie is typically stored on users’ devices within the websites where the marketing measures take place and is then retrieved again on the target website. For example, this allows us to track whether the ads we placed on other websites were successful.
Meta, communication, and process data: Meta, communication, and process data are categories that contain information about how data is processed, transmitted, and managed. Meta data, also known as data about data, includes information that describes the context, origin, and structure of other data. It may include details on file size, creation date, the author of a document, and revision histories. Communication data captures the exchange of information between users via various channels, such as email correspondence, call logs, social media messages, and chat histories, including the individuals involved, timestamps, and transmission methods. Process data describes the processes and workflows within systems or organizations, including workflow documentation, transaction and activity logs, as well as audit logs used to track and verify operations.
Usage data: Usage data refers to information that captures how users interact with digital products, services, or platforms. This data encompasses a wide range of information that reveals how users use applications, which features they prefer, how long they stay on specific pages, and the paths they take when navigating through an application. Usage data may also include frequency of use, timestamps of activities, IP addresses, device information, and location data. It is particularly valuable for analyzing user behavior, optimizing user experiences, personalizing content, and improving products or services. Furthermore, usage data plays a crucial role in identifying trends, preferences, and potential problem areas within digital offerings
Personal Data: “Personal data” refers to any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier (e.g., a cookie) or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
Profiles containing user-related information: The processing of “profiles containing user-related information,” or “profiles” for short, encompasses any form of automated processing of personal data that consists of using such personal data to analyze, evaluate, or predict certain personal aspects relating to a natural person (depending on the type of profiling, this may include various information regarding demographics, behavior, and interests—such as, for example, interaction with websites and their content, etc.) or to predict them (such as, for example, interests in specific content or products, click behavior on a website, or location). Cookies and web beacons are frequently used for profiling purposes.
Log data: Log data consists of information about events or activities that have been logged in a system or network. This data typically includes information such as timestamps, IP addresses, user actions, error messages, and other details regarding the use or operation of a system. Log data is often used to analyze system issues, monitor security, or generate performance reports.
Audience measurement: Audience measurement (also known as web analytics) is used to analyze visitor traffic to an online service and may include the behavior or interests of visitors regarding specific information, such as website content. With the help of web analytics, operators of online services can, for example, determine at what times users visit their websites and what content interests them. This allows them, for example, to better tailor the content of their websites to the needs of their visitors. For the purposes of reach analysis, pseudonymous cookies and web beacons are frequently used to identify returning visitors and thus obtain more accurate analyses of the use of an online service.
Tracking: “Tracking” refers to the ability to track users’ behavior across multiple online services. As a rule, behavioral and interest-based information regarding the online services used is stored in cookies or on the servers of the providers of tracking technologies (so-called “profiling”). This information can then be used, for example, to display advertisements to users that are likely to match their interests.
Data Controller: The term “data controller” refers to the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data.
Processing: “Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and encompasses virtually any handling of data, whether it involves collection, evaluation, storage, transmission, or deletion.
Contract Data: Contract data consists of specific information relating to the formalization of an agreement between two or more parties. It documents the terms under which services or products are provided, exchanged, or sold. This data category is essential for the administration and fulfillment of contractual obligations and includes both the identification of the contracting parties and the specific terms and conditions of the agreement. Contract data may include the contract’s start and end dates, the nature of the agreed-upon services or products, pricing agreements, payment terms, termination rights, renewal options, and special terms or clauses. It serves as the legal basis for the relationship between the parties and is crucial for clarifying rights and obligations, enforcing claims, and resolving disputes.
Payment Data: Payment data encompasses all information required to process payment transactions between buyers and sellers. This data is crucial for e-commerce, online banking, and any other form of financial transaction. It includes details such as credit card numbers, bank account information, payment amounts, transaction dates, verification numbers, and billing information. Payment data may also include information about payment status, chargebacks, authorizations, and fees.
Target Audience Creation: The term “Custom Audiences” refers to the process of defining target audiences for advertising purposes, such as displaying advertisements. For example, based on a user’s interest in certain products or topics online, it can be inferred that this user is interested in ads for similar products or the online store where they viewed those products. The term “Lookalike Audiences” (or similar target groups), on the other hand, refers to the display of content deemed suitable to users whose profiles or interests are presumed to match those of the users whose profiles were used to create the audience. Cookies and web beacons are typically used for the purpose of creating Custom Audiences and Lookalike Audiences.

Item added to your cart

Privacy policy

Privacy Policy

Preamble

Table of Contents

Data Controller

Overview of Data Processing

Types of Data Processed

Categories of data subjects

Purposes of Processing

Applicable Legal Bases

Security Measures

International Data Transfers

General Information on Data Storage and Deletion

Rights of Data Subjects

Business Processes and Procedures

Use of Online Platforms for Marketing and Sales Purposes

Providers and Services Used in the Course of Business Operations

Payment Methods

Provision of Online Services and Web Hosting

Use of Cookies

Registration, Login, and User Account

Blogs and Publication Media

Contact and Inquiry Management

Push Notifications

Newsletters and Electronic Notifications

Web Analytics, Monitoring, and Optimization

Online Marketing

Customer Reviews and Rating Processes

Social Media Presence

Plug-ins, Embedded Features, and Content

Management, Organization, and Support Tools

Changes and Updates

Definitions of Terms

Country/region

Language

Country/region

Language

Privacy policy

Privacy Policy

Preamble

Table of Contents

Data Controller

Overview of Data Processing

Types of Data Processed

Categories of data subjects

Purposes of Processing

Applicable Legal Bases

Security Measures

International Data Transfers

General Information on Data Storage and Deletion

Rights of Data Subjects

Business Processes and Procedures

Use of Online Platforms for Marketing and Sales Purposes

Providers and Services Used in the Course of Business Operations

Payment Methods

Provision of Online Services and Web Hosting

Use of Cookies

Registration, Login, and User Account

Blogs and Publication Media

Contact and Inquiry Management

Push Notifications

Newsletters and Electronic Notifications

Web Analytics, Monitoring, and Optimization

Online Marketing

Customer Reviews and Rating Processes

Social Media Presence

Plug-ins, Embedded Features, and Content

Management, Organization, and Support Tools

Changes and Updates

Definitions of Terms

Get the latest news and discounts

Form