Privacy Policy

1) Introduction and contact details of the controller

1.1 Thank you for visiting our website and for your interest. The following information explains how we process your personal data when you use our website. Personal data means any information relating to an identified or identifiable natural person.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Sebastian Brinzing
Langenburger Str. 21
74653 Künzelsau
Germany
Telephone: +49 (0)7940 1382466
Fax: +49 (0)7940 55273
Email: sebastian.brinzing@gmx.de

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

2) Data collected when you visit our website

2.1 When you use our website for information purposes only, our server records data transmitted by your browser in server log files. This may include the page visited, date and time of access, volume of data transferred, referring page, browser, operating system and IP address, where applicable in shortened form.

Processing is based on Article 6(1)(f) GDPR and our legitimate interest in ensuring the stability, security and proper functioning of our website. Log data may subsequently be reviewed where there are specific indications of unlawful use. The data is deleted when it is no longer required for these purposes, unless statutory retention obligations or legitimate security interests require longer storage.

2.2 This website uses SSL or TLS encryption to protect personal data and other confidential content, such as orders and enquiries, during transmission. An encrypted connection can be recognised by “https://” and the padlock symbol in the browser address bar.

3) Hosting and content delivery

We use a service provider to host our website and deliver its content. Data collected through this website is processed on the provider's systems. Where the provider processes data on our behalf, we have concluded a data processing agreement in accordance with Article 28 GDPR. Processing is based on Article 6(1)(f) GDPR and our legitimate interest in the secure and efficient provision of our website.

4) Cookies and consent management

We use cookies and similar technologies. Session cookies are deleted when you close your browser, while persistent cookies remain on your device for a defined period. Strictly necessary technologies are used where required to provide the website, shopping basket, checkout, account and security functions. The legal basis may be Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and, where personal data is processed, Article 6(1)(b) or (f) GDPR.

Analytics, marketing and external-media technologies are used only after you have given consent through our consent tool. The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can withdraw or change your consent at any time with effect for the future through the cookie settings provided on our website. Refusing optional cookies may limit individual functions but does not prevent the use of essential shop functions.

5) Contact

5.1 WhatsApp Business

You may contact us through WhatsApp Business, operated by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. We process your telephone number, profile information made available by you, message content and any information required to answer your enquiry. If your enquiry concerns a contract, processing is based on Article 6(1)(b) GDPR; otherwise, it is based on Article 6(1)(f) GDPR and our legitimate interest in efficient communication.

WhatsApp may transfer data to Meta Platforms, Inc. in the United States. The provider participates in the EU-US Data Privacy Framework. Further information is available in the WhatsApp privacy policy. Using WhatsApp is voluntary; you may also contact us by email or through another available channel.

5.2 Email and contact forms

When you contact us by email or through a contact form, we process the information you provide only to the extent necessary to deal with your request. Processing is based on Article 6(1)(f) GDPR or, where the request relates to a contract, Article 6(1)(b) GDPR. The data is deleted once the matter has been conclusively resolved, unless statutory retention obligations apply.

6) Comment function

If a comment function is available, we process and publish your comment, chosen display name and time of submission. We also store your IP address and email address to protect against unlawful content and to contact you if a complaint is received. Processing is based on Article 6(1)(f) GDPR and our legitimate interest in operating a lawful comment function. Where follow-up comments can be subscribed to, the subscription is activated using a double opt-in procedure on the basis of Article 6(1)(a) GDPR and may be cancelled at any time.

7) Customer accounts

When you create a customer account, we process the data requested in the registration form for account administration and contract processing pursuant to Article 6(1)(b) GDPR. You may request deletion of your account at any time. Account data will then be deleted once all contracts have been completed and no statutory retention obligation or overriding legitimate interest requires further storage.

8) Direct marketing and email notifications

8.1 Newsletter

If you subscribe to our newsletter, we use your email address and any voluntarily supplied details to send you marketing information. Subscription is confirmed using a double opt-in procedure. We store the IP address and time of confirmation as evidence of consent. Processing is based on Article 6(1)(a) GDPR. You may unsubscribe at any time using the link in each newsletter or by contacting us.

8.2 Existing customers

Where the legal requirements of Section 7(3) of the German Act Against Unfair Competition (UWG) are met, we may email existing customers about our own similar goods or services. Processing is based on Article 6(1)(f) GDPR and our legitimate interest in direct marketing. You may object at any time without incurring costs other than the basic transmission charges.

8.3 rapidmail

Newsletters are sent through rapidmail GmbH, Wentzingerstraße 21, 79106 Freiburg, Germany. We transmit newsletter data to rapidmail so that it can send messages on our behalf. This processing is based on Article 6(1)(f) GDPR. Where you have separately consented, rapidmail may analyse delivery, opening and click statistics using web beacons. Such analysis is based on Article 6(1)(a) GDPR. You may withdraw this consent at any time. We have concluded a data processing agreement with rapidmail.

8.4 Product availability notifications

If you request notification when a product becomes available, we process your email address to send the requested notification. Registration is confirmed through a double opt-in procedure. Processing is based on Article 6(1)(a) GDPR. You may cancel the notification at any time.

9) Order processing and payments

9.1 Personalisation files

If you send us images or other files to personalise a product, we process them solely to manufacture and deliver the ordered product pursuant to Article 6(1)(b) GDPR. Where necessary, the files may be transmitted to a production service provider. They are deleted after completion of the order unless retention is required for another lawful reason. You must ensure that you are authorised to provide images of identifiable persons.

9.2 Delivery and contract performance

We disclose the data required for delivery to the selected shipping provider and the data required for payment to the relevant bank or payment provider. Processing is based on Article 6(1)(b) GDPR. Contact details for delivery notifications are transferred only where this is necessary for delivery or you have consented, as applicable.

9.3 Payment services

Depending on the country, device and checkout configuration, one or more of the following payment methods may be offered. When you select a payment method, the data required to process the transaction, including name, address, payment information, amount, currency, order information and transaction identifiers, is transmitted to the relevant provider pursuant to Article 6(1)(b) GDPR.

• Amazon Pay: Amazon Payments Europe S.C.A., 38 avenue J.F. Kennedy, L-1855 Luxembourg.
• Apple Pay: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Apple Pay uses payment information stored on your compatible Apple device and provides transaction tokens for payment authorisation. Further information is available in Apple's privacy policy.
• Google Pay: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Pay transmits payment tokens and transaction information required to complete the payment. Further information is available in Google's privacy policy.
• Klarna and Sofort: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden.
• PayPal and PayPal Checkout: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal Checkout may involve local payment providers, including Apple Pay, Google Pay, iDEAL, Bancontact, BLIK, EPS, MyBank and Przelewy24. Further information is available in the PayPal privacy statement.
• TWINT: TWINT AG, Stauffacherstrasse 31, CH-8004 Zurich, Switzerland. Switzerland benefits from an adequacy decision of the European Commission.

Where a provider offers payment on account, instalments, direct debit or another method involving advance performance, the provider may carry out identity and credit checks. For this purpose, order and identification data may be transmitted to credit agencies on the basis of Article 6(1)(f) GDPR and the provider's legitimate interest in preventing payment defaults and fraud. The provider is responsible for its own credit decision. You may object to processing based on legitimate interests, although the provider may remain entitled to process data where necessary for payment or compelling legitimate reasons exist.

9.4 Electronic withdrawal function

If an electronic withdrawal function is provided, we process the information required to identify the contract and the consumer, receive the withdrawal and send confirmation. Processing is based on Article 6(1)(b) and (c) GDPR in conjunction with the applicable statutory requirements.

10) Affiliate marketing

We participate in the ADCELL affiliate programme operated by Firstlead GmbH, Rosenfelder Str. 15–16, 10315 Berlin, Germany. Tracking technologies may be used to attribute orders to affiliate links and calculate commission. Where information is stored on or read from your device through our website, this takes place only with your prior consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. You may withdraw your consent through the cookie settings.

11) Web analytics

11.1 Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics helps us understand how visitors use our website and produces reports on website activity. It may process online identifiers, IP address, device and browser information, approximate location, referrer information and usage and interaction data. Google states that IP addresses collected in the EU are not logged or stored before location data is derived.

Google Analytics is used only after consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can withdraw your consent through our cookie settings. Depending on our configuration and your Google account settings, Google Signals, demographic features and user IDs may be used to create aggregated reports, measure conversions and analyse activity across devices. Data retention settings are configured in Google Analytics; event-level data is generally retained for the selected period and then deleted.

We have concluded a data processing agreement with Google. Data may be transferred to Google LLC in the United States. Google participates in the EU-US Data Privacy Framework. Further information is available in the Google privacy policy and in Google's information on data from partner sites.

11.2 Microsoft Clarity and Microsoft Advertising

We work with Microsoft Clarity and Microsoft Advertising to analyse the use of and interaction with our website. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (“Microsoft”). Data may also be transferred to Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

Microsoft Clarity enables us to analyse behavioural metrics, heatmaps and session replays. This helps us understand how visitors use our website, which content and functions are popular and where usability problems may occur. Data processed may include device and browser information, IP address, usage and interaction data, mouse movements, clicks, scrolling and pages viewed. Entries in fields designated as sensitive are intended to be obscured by technical masking functions.

We use the information to analyse content and feature popularity, improve our website, products and services, detect potential misuse, support security and, where linked, measure and optimise advertising through Microsoft Advertising.

Microsoft Clarity uses cookies and similar tracking technologies. It is activated only after you have consented through our cookie consent tool. The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future through our cookie settings.

We have concluded a data processing agreement with Microsoft where required. Microsoft participates in the EU-US Data Privacy Framework for transfers to the United States; where the framework does not apply, the European Commission's Standard Contractual Clauses may be used as an additional transfer mechanism. Further information is available in the Microsoft Privacy Statement and the Microsoft Clarity privacy information.

12) Retargeting, remarketing and conversion measurement

Meta Pixel with advanced matching

We use the Meta Pixel, including advanced matching where configured, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The service helps us measure whether users reach our website after viewing or clicking an advertisement on Facebook or Instagram, assess conversions, build advertising audiences and display more relevant advertising.

Depending on the interaction, Meta may receive browser and device data, IP address, page and event information, purchase and conversion information, cookie identifiers and, where advanced matching is used, customer data such as an email address in hashed form. Meta may associate the information with a user account and process it for its own advertising purposes.

The Meta Pixel is activated only after consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. Consent can be withdrawn through our cookie settings. Data may be transferred to Meta Platforms, Inc. in the United States. Meta participates in the EU-US Data Privacy Framework. Further information is available in the Meta Privacy Policy.

13) Website functions

13.1 YouTube

We embed videos from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When an embedded video is activated, Google may receive your IP address, device and browser information and information about the page and video viewed. If you are signed in to Google, the activity may be associated with your account.

YouTube content is loaded only after consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. You may withdraw consent through our cookie settings. Data may be transferred to Google LLC in the United States. Google participates in the EU-US Data Privacy Framework. Further information is available in the Google privacy policy.

13.2 Google reCAPTCHA

We use Google reCAPTCHA, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to distinguish human input from automated abuse and protect forms against spam, fraud and attacks. The service may process the IP address, browser and operating-system information, date, duration and patterns of interaction. Google Fonts may be loaded as part of the reCAPTCHA display.

Where reCAPTCHA uses cookies or comparable device access, it is activated on the basis of your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. To the extent a strictly necessary, cookie-free security check is performed, processing may be based on Article 6(1)(f) GDPR and our legitimate interest in preventing misuse and protecting our systems. Data may be transferred to Google LLC in the United States. Google participates in the EU-US Data Privacy Framework.

14) Your rights

Under the applicable data protection law, you have the following rights, subject to the statutory requirements:

• right of access under Article 15 GDPR;
• right to rectification under Article 16 GDPR;
• right to erasure under Article 17 GDPR;
• right to restriction of processing under Article 18 GDPR;
• right to notification under Article 19 GDPR;
• right to data portability under Article 20 GDPR;
• right to withdraw consent at any time with effect for the future under Article 7(3) GDPR; and
• right to lodge a complaint with a supervisory authority under Article 77 GDPR. You may in particular contact the supervisory authority for your habitual residence, place of work or the place of the alleged infringement.

Right to object

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation. We will then cease processing unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or processing is required for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing, you have the right to object at any time. Following your objection, the data will no longer be processed for direct marketing purposes.

15) Retention of personal data

The retention period is determined by the legal basis, purpose of processing and applicable statutory retention periods. Data processed on the basis of consent is generally retained until consent is withdrawn, unless another legal basis permits continued processing.

Contract and transaction data is retained for as long as required to perform the contract and comply with commercial and tax-law retention duties. Data processed on the basis of legitimate interests is retained until the purpose no longer applies or a valid objection is made, unless compelling legitimate grounds or legal claims require continued storage. Once the applicable purpose and retention period have ended, the data is routinely deleted or anonymised.