Data Protection & Security

Privacy Policy

The controller responsible for data processing is:

Oliver Bolk

Rathausplatz 3

52152 Simmerath

Email: info@timeshop24.de

Telephone: 49 (0) 2473-927100

We appreciate your interest in our website. Protecting your privacy is very important to us. Below, we provide detailed information about how we handle your data.

1. Access Data and Hosting

You can visit our websites without providing any personal information. Each time a website is accessed, the web server automatically stores only a so-called server log file, which contains, for example, the name of the requested file, your IP address, the date and time of access, the amount of data transferred and the requesting provider (access data), and documents the access. This access data is evaluated exclusively for the purpose of ensuring trouble-free operation of the website and improving our services. In accordance with Art. 6(1), first sentence, point (f) GDPR, this serves to safeguard our legitimate interests, which prevail in the context of a balancing of interests, in the correct presentation of our services. All access data will be deleted no later than seven days after the end of your visit to the website. All access data will only be processed for as long as is necessary to achieve the processing purposes stated above.

 Hosting

The services for hosting and displaying the website are partly provided by our service providers as part of processing on our behalf. Unless otherwise explained in this Privacy Policy, all access data and all data collected via the forms provided for this purpose on this website are processed on their servers. If you have any questions about our service providers and the basis of our cooperation with them, please use the contact option described in this Privacy Policy.

2. Data Processing for Contract Performance and Contacting Us

2.1 Data Processing for Contract Performance

For the purpose of contract performance (including enquiries regarding and the handling of any existing claims arising from warranty rights, defective performance, the right of withdrawal and any statutory updating obligations), in accordance with Art. 6(1), first sentence, point (b) GDPR, we collect personal data if you voluntarily provide it to us as part of your order. Mandatory fields are marked as such because, in these cases, we require the data for contract performance and cannot dispatch the order without this information. The data collected can be seen from the respective input forms.

Further information on the processing of your data, in particular on its disclosure to our service providers for the purpose of order, payment and shipping processing, can be found in the following sections of this Privacy Policy. Once the contract has been fully performed, further processing of your data will be restricted and the data will be deleted after expiry of the retention periods under tax and commercial law in accordance with Art. 6(1), first sentence, point (c) GDPR, unless you have expressly consented to further use of your data in accordance with Art. 6(1), first sentence, point (a) GDPR or we reserve the right to use data beyond this scope where permitted by law and about which we inform you in this Privacy Policy.

2.2 Customer Account

If you have given your consent in accordance with Art. 6(1), first sentence, point (a) GDPR by choosing to open a customer account, we use your data for the purpose of opening the customer account and storing your data for future orders on our website. You may delete your customer account at any time, either by sending a message using the contact option described in this Privacy Policy or by using the function provided for this purpose in the customer account. After your customer account has been deleted, your data will be deleted unless you have expressly consented to further use of your data in accordance with Art. 6(1), first sentence, point (a) GDPR or we reserve the right to use data beyond this scope where permitted by law and about which we inform you in this Privacy Policy.

 Contacting Us

As part of customer communication, we collect personal data in order to process your enquiries in accordance with Art. 6(1), first sentence, point (b) GDPR if you voluntarily provide this data when contacting us (e.g. via a contact form, live chat tool or email). Mandatory fields are marked as such because, in these cases, we require the data in order to process your enquiry. The data collected can be seen from the respective input forms. Once your enquiry has been fully processed, your data will be deleted unless you have expressly consented to further use of your data in accordance with Art. 6(1), first sentence, point (a) GDPR or we reserve the right to use data beyond this scope where permitted by law and about which we inform you in this Privacy Policy.

 Live Chat Tool Userlike

For the purpose of customer communication, we use the live chat tool provided by Userlike UG (limited liability), Probsteigasse 44-46, 50670 Cologne, Germany (“Userlike”). In accordance with Art. 6(1), first sentence, point (f) GDPR, this serves to safeguard our legitimate interests, which prevail in the context of a balancing of interests, in effective and improved customer communication. Userlike acts on our behalf.

 Live Chat Tool WhatsApp

For the purpose of customer communication, we use the live chat tool provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“WhatsApp”). In accordance with Art. 6(1), first sentence, point (f) GDPR, this serves to safeguard our legitimate interests, which prevail in the context of a balancing of interests, in effective and improved customer communication. WhatsApp acts on our behalf. The telephone numbers stored by us on our mobile device are automatically processed on servers operated by Meta companies headquartered at 1601 Willow Road, Menlo Park, California 94025, USA. Only telephone numbers of customers who have previously contacted us via WhatsApp and have therefore already accepted WhatsApp's terms of use and privacy terms are stored.

Our service providers are located and/or use servers in the following countries for which the European Commission has determined by decision that an adequate level of data protection exists: USA, Israel, United Kingdom.

The adequacy decision for the USA serves as the basis for transfers to third countries insofar as the respective service provider is certified. Such certification is in place.

Our service providers are located and/or use servers in the following countries: Singapore. No adequacy decision by the European Commission exists for these countries. Our cooperation with them is based on the following safeguards:  Standard Contractual Clauses of the European Commission.

3. Data Processing for Shipping

For the performance of the contract in accordance with Art. 6(1), first sentence, point (b) GDPR, we disclose your data to the shipping provider commissioned with delivery insofar as this is necessary for the delivery of the goods ordered. If you have any questions about our service providers and the basis of our cooperation with them, please use the contact option described in this Privacy Policy.

 Disclosure of Data to Shipping Providers for Shipping Notification

If you have given us your express consent to do so during or after your order, we will, on the basis of this consent pursuant to Art. 6(1), first sentence, point (a) GDPR, disclose your email address and telephone number to the selected shipping provider so that the provider can contact you prior to delivery for the purpose of announcing or coordinating delivery.
Consent may be withdrawn at any time by sending a message using the contact option described in this Privacy Policy. Following withdrawal, we will delete the data you provided for this purpose unless you have expressly consented to further use of your data or we reserve the right to use data beyond this scope where permitted by law and about which we inform you in this Privacy Policy. If you have any questions about our service providers and the basis of our cooperation with them, please use the contact option described in this Privacy Policy.

4. Data Processing for Payment Processing

When processing payments in our online shop, we cooperate with the following partners: technical service providers, financial institutions and payment service providers.

4.1 Data Processing for Transaction Processing

Depending on the payment method selected, we disclose the data required to process the payment transaction to our technical service providers, the commissioned financial institutions or the selected payment service provider insofar as this is necessary to process the payment. This serves to perform the contract in accordance with Art. 6(1), first sentence, point (b) GDPR. In some cases, payment service providers collect the data required for payment processing themselves, for example on their own website or through technical integration into the ordering process. In this respect, the Privacy Policy of the respective payment service provider applies.

Depending on the selected payment method, data may be transferred to third countries outside the EU/EEA for which the European Commission has determined by decision that an adequate level of data protection exists. Where data is transferred to third countries outside the EU/EEA for which the European Commission has not adopted an adequacy decision, the cooperation is based on the European Commission's Standard Contractual Clauses.

If you have any questions about our payment-processing partners or the basis of our cooperation with them, please use the contact option specified in this Privacy Policy.

4.2 Data Processing for Fraud Prevention and Optimisation of Our Payment Processes

Where applicable, we provide the aforementioned service providers with additional data which they use together with the data required for payment processing for the purposes of fraud prevention and optimisation of our payment processes (e.g. invoicing, handling disputed payments and accounting support). In accordance with Art. 6(1), first sentence, point (f) GDPR, this serves to safeguard our legitimate interests, which prevail in the context of a balancing of interests, in protecting ourselves against fraud and in efficient payment management.

4.3 Credit Check

If you have given us your express consent pursuant to Art. 6(1), first sentence, point (a), and Art. 22(2), point (c) GDPR, we reserve the right to obtain identity and credit information from specialised service providers (credit agencies). For this purpose, we transmit the personal data required for a credit check to:

SCHUFA Holding AG
Kormoranweg 5
65201 Wiesbaden
Germany

Appropriate measures to safeguard your rights, freedoms and legitimate interests are taken into account. You have the option of stating your point of view and contesting the decision by contacting us using the contact option described in this Privacy Policy. Once the contract has been fully performed, your data processed for this purpose will be deleted unless you have expressly consented to further use of your data or we reserve the right to use data beyond this scope where permitted by law and about which we inform you in this Privacy Policy. You may withdraw your consent at any time by sending a message to the contact details provided below. This may mean that we can no longer offer you certain payment options.

4.4 Identity and Credit Check When Selecting Klarna Payment Services

Klarna Direct Debit, Purchase on Account via Klarna, Klarna Instalment Purchase
If you choose payment services provided by Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter Klarna), we ask for your consent pursuant to Art. 6(1), first sentence, point (a) GDPR to transmit to Klarna the data required for payment processing and for an identity and credit check. In Germany, the credit agencies specified in Klarna's Privacy Policy may be used for identity and credit checks. Klarna uses the information obtained regarding the statistical probability of payment default to make a balanced decision on the establishment, performance or termination of the contractual relationship. You may withdraw your consent at any time by sending a message using the contact option specified in this Privacy Policy. This may mean that we can no longer offer you certain payment options. You may also withdraw your consent to this use of personal data directly from Klarna at any time.

4.5 Identity and Credit Check When Selecting Purchase on Account via PayPal and Ratepay

If you choose purchase on account (offered via Ratepay GmbH, Franklinstraße 28-29, 10587 Berlin (hereinafter Ratepay) and PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg (hereinafter PayPal)), we ask for your consent pursuant to Art. 6(1), first sentence, point (a) GDPR to transmit to Ratepay the data required for payment processing and for an identity and credit check. In Germany, the credit agencies specified in the Ratepay Privacy Policy may be used for identity and credit checks. Ratepay uses the information obtained regarding the statistical probability of payment default to make a balanced decision on the establishment, performance or termination of the contractual relationship. You may withdraw your consent at any time by sending a message using the contact option specified in this Privacy Policy. This may mean that we can no longer offer you certain payment options. Additional information on data protection at PayPal can be found here.

4.6 Instalment Payment Option

If you select the instalment payment option and provide the data protection consent required for this purpose pursuant to Art. 6(1), first sentence, point (a) GDPR, personal data (first name, surname, address, email, telephone number, date of birth, IP address, gender), together with data required for transaction processing (product, invoice amount, due dates, total amount, invoice number, taxes, currency, order date and order time), will be transmitted for the purpose of processing this payment method to our partner Klarna Bank AB, German Branch, Chausseestraße 117, 10115 Berlin, Germany.
To verify the customer's identity and/or creditworthiness, our partner makes enquiries and obtains information from publicly accessible databases and credit agencies. Details of the providers from which information and, where applicable, creditworthiness information is obtained on the basis of mathematical-statistical procedures, as well as further details on the processing of your data following transmission to our partner Klarna Bank AB, German Branch, can be found in its Privacy Policy, available here: https://cdn.klarna.com/1.0/shared/content/policy/data/de_de/data_protection.pdf
Our partner Klarna Bank AB, German Branch uses the information obtained regarding the statistical probability of payment default to make a balanced decision on the establishment, performance or termination of the contractual relationship. You have the option of stating your point of view and contesting the decision by contacting our partner Klarna Bank AB, German Branch. The consent to data disclosure given during the ordering process may be withdrawn from us at any time, without stating reasons, with effect for the future.

5. Advertising by Email and Post

5.1 Email Newsletter with Registration and Newsletter Tracking

If you subscribe to our newsletter, we use the data required for this purpose or separately provided by you to send you our email newsletter on a regular basis on the basis of your consent in accordance with Art. 6(1), first sentence, point (a) GDPR. You may unsubscribe from the newsletter at any time, either by sending a message using the contact option described below or by using the link provided for this purpose in the newsletter. After you unsubscribe, we will delete your email address from the recipient list unless you have expressly consented to further use of your data in accordance with Art. 6(1), first sentence, point (a) GDPR or we reserve the right to use data beyond this scope where permitted by law and about which we inform you in this Privacy Policy.

Please note that when sending the newsletter, we evaluate your user behaviour. For this purpose, we also analyse how you interact with our newsletter by measuring, storing and evaluating opening rates and click-through rates for the purpose of designing future newsletter campaigns (“newsletter tracking”).

For this evaluation, the emails sent contain one-pixel technologies (e.g. so-called web beacons, tracking pixels) that are stored on our website. For the evaluations, we link in particular the following “newsletter data”

• the page from which the page was requested (so-called referrer URL),
• the date and time of access,
• the description of the type of web browser used,
• the IP address of the requesting computer,
• the email address,
• the date and time of registration and confirmation

and the one-pixel technologies with your email address or your IP address and, where applicable, an individual ID. Links contained in the newsletter may also contain this ID.

If you do not want newsletter tracking, you can unsubscribe from the newsletter at any time as described above.

The information is stored for as long as you are subscribed to the newsletter.

 Email Newsletter without Registration and Your Right to Object

If we receive your email address in connection with the sale of goods or services, we reserve the right to regularly send you offers by email for products from our range that are similar to those you have already purchased. We will not send you such offers if you have already objected to this use of your email address or if you are entered in a Robinson list that we are legally required to observe.

You may object to this use of your email address at any time, easily and free of charge, by sending a message using the contact option described in this Privacy Policy or by using the link provided for this purpose in the advertising email, i.e. without incurring any costs other than transmission costs at the basic rates. After you unsubscribe, we will delete your email address from the recipient list unless you have expressly consented to further use of your data in accordance with Art. 6(1), first sentence, point (a) GDPR or we reserve the right to use data beyond this scope where permitted by law and about which we inform you in this Privacy Policy.

5.2 Newsletter Distribution

The newsletter and the newsletter tracking described above may also be sent by our service providers as part of processing on our behalf. If you have any questions about our service providers and the basis of our cooperation with them, please use the contact option described in this Privacy Policy.

Our service providers are located and/or use servers in the following countries for which the European Commission has determined by decision that an adequate level of data protection exists: USA, United Kingdom.

The adequacy decision for the USA serves as the basis for transfers to third countries insofar as the respective service provider is certified. Such certification is in place.

Our service providers are located and/or use servers in the following countries: Australia, Singapore. No adequacy decision by the European Commission exists for these countries. Our cooperation with them is based on the following safeguards:  Standard Contractual Clauses of the European Commission.

5.3 Postal Advertising and Your Right to Object

In addition, we reserve the right to use your first and last name and your postal address for our own advertising purposes, e.g. to send you interesting offers and information about our products by post. In accordance with Art. 6(1), first sentence, point (f) GDPR, this serves to safeguard our legitimate interests, which prevail in the context of a balancing of interests, in addressing our customers for advertising purposes. You may object to the storage and use of your data for these purposes at any time by sending a message using the contact option described in this Privacy Policy.
After you withdraw your consent, we will delete your address from the recipient list unless you have expressly consented to further use of your data in accordance with Art. 6(1), first sentence, point (a) GDPR or we reserve the right to use data beyond this scope where permitted by law and about which we inform you in this Privacy Policy.

The advertising mailings are handled by a service provider as part of processing on our behalf, to whom we disclose your data for this purpose. If you have any questions about our service providers and the basis of our cooperation with them, please use the contact option described in this Privacy Policy.

6. Cookies and Other Technologies

6.1 General Information

To make visiting our website attractive and to enable the use of certain functions, we use technologies including so-called cookies on various pages. Cookies are small text files that are automatically stored on your end device. Some of the cookies we use are deleted again at the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your end device and enable us to recognise your browser on your next visit (persistent cookies). You can find the storage duration in the overview in your web browser's cookie settings.

Protection of Privacy on End Devices

When you use our online services, we use technologies that are strictly necessary in order to provide the digital service you have expressly requested. In this respect, storing information on your end device or accessing information already stored on your end device does not require consent.

For functions that are not strictly necessary, storing information on your end device or accessing information already stored on your end device requires your consent. Please note that if you do not give your consent, parts of the website may not be fully usable. Any consent you have given remains in place until you adjust or reset the relevant settings on your end device.

Any Subsequent Data Processing by Cookies and Other Technologies

We use technologies that are strictly necessary for the use of certain functions of our website. These technologies collect and process IP address, time of visit, device and browser information as well as information about your use of our website. In accordance with Art. 6(1), first sentence, point (f) GDPR, this serves to safeguard our legitimate interests, which prevail in the context of a balancing of interests, in the optimised presentation of our services.

We also use technologies to fulfil the legal obligations to which we are subject (e.g. to be able to demonstrate consent to the processing of your personal data), as well as for web analytics and online marketing. Further information, including the respective legal basis for data processing, can be found in the following sections of this Privacy Policy.

Cookie Settings

You can find the cookie settings for your browser at the following links: Microsoft Edge™ / Safari™ / Chrome™ / Firefox™ / Opera™

If you have consented to the use of technologies in accordance with Art. 6(1), first sentence, point (a) GDPR, you may withdraw your consent at any time by sending a message using the contact option described in the Privacy Policy. Alternatively, you can click on the privacy button. If cookies are not accepted, the functionality of our website may be restricted.

6.2 Cookiebot Consent Management Platform

We use Cookiebot on our website to inform you about the cookies and other technologies we use on our website and, where required, to obtain, manage and document your consent to the processing of your personal data by these technologies. This is necessary pursuant to Art. 6(1), first sentence, point (c) GDPR in order to fulfil our legal obligation under Art. 7(1) GDPR to be able to demonstrate your consent to the processing of your personal data. Cookiebot is a service provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, which processes your data on our behalf.
After you submit your cookie declaration on our website, Cookiebot's web server stores your anonymised IP address, the date and time of your declaration, browser information, the URL from which the declaration was sent, information about your consent behaviour and an anonymous random key. A cookie is also used that contains the information about your consent behaviour and the key. Your data will be deleted after twelve months unless you have expressly consented to further use of your data in accordance with Art. 6(1), first sentence, point (a) GDPR or we reserve the right to use data beyond this scope where permitted by law and about which we inform you in this Privacy Policy.

Our service providers are located and/or use servers in the following countries for which the European Commission has determined by decision that an adequate level of data protection exists: USA.

The adequacy decision for the USA serves as the basis for transfers to third countries insofar as the respective service provider is certified. Until our service providers are certified, the data transfer continues to be based on the following safeguard: Standard Contractual Clauses of the European Commission.

7. Use of Cookies and Other Technologies

We use the following cookies and other technologies from third-party providers on our website. Unless otherwise stated for the individual technologies, this is based on your consent pursuant to Art. 6(1), first sentence, point (a) GDPR. Once the purpose no longer applies and we have ceased using the respective technology, the data collected in this context will be deleted. You may withdraw your consent at any time with effect for the future. Further information on your options for withdrawal can be found in the section "Cookies and Other Technologies". Further information, including the basis of our cooperation with the individual providers, can be found under the individual technologies. If you have any questions about the providers and the basis of our cooperation with them, please use the contact option described in this Privacy Policy.

7.1 Use of Google Services

We use the technologies described below from Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The information automatically collected by Google technologies about your use of our website is generally transferred to and stored on a server of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Unless otherwise stated for the individual technologies, data processing is carried out on the basis of an agreement concluded for the respective technology between joint controllers pursuant to Art. 26 GDPR. Further information about data processing by Google can be found in the Google Privacy Policy.

Our service providers are located and/or use servers in countries outside the EU and the EEA for which the European Commission has determined by decision that an adequate level of data protection exists.

Our service providers are located and/or use servers in countries outside the EU and the EEA. No adequacy decision by the European Commission exists for these countries. Our cooperation with them is based on the European Commission's Standard Contractual Clauses. 

 Google Analytics

For the purpose of website analysis, Google Analytics automatically collects and stores data (IP address, time of visit, device and browser information as well as information about your use of our website), from which user profiles are created using pseudonyms. Cookies may be used for this purpose. If you visit our website from the EU, your IP address is stored on a server located in the EU in order to derive location data and is then deleted immediately before the traffic is forwarded to other Google servers for processing. Data processing is carried out on the basis of a data processing agreement with Google.

For the purpose of optimised marketing of our website, we have activated the data sharing settings for "Google products and services" This allows Google to access the data collected and processed by Google Analytics and subsequently use it to improve Google services. The sharing of data with Google as part of these data sharing settings is based on an additional agreement between controllers. We have no influence over the subsequent data processing by Google.

For the purpose of optimised marketing of our website, we use the so-called User ID function. This function enables us to assign a unique, permanent ID to your interaction data from one or more sessions on our online presences and thus analyse your user behaviour across devices and sessions.

For web analytics, the Google Analytics extension function Google Signals enables so-called “cross-device tracking”. If your internet-enabled devices are linked to your Google account and you have activated the “personalised advertising” setting in your Google account, Google can create reports on your usage behaviour (in particular cross-device user numbers), even if you change your end device. We do not process personal data in this respect; we only receive statistics generated on the basis of Google Signals.

For web analytics and advertising purposes, the Google Analytics extension function, the so-called DoubleClick-Cookie enables your browser to be recognised when you visit other websites. Google will use this information to compile reports on website activities and to provide other services related to website use.

 Google Ads

For advertising purposes in Google search results and on third-party websites, when you visit our website the so-called Google Remarketing cookie is set, which automatically enables interest-based advertising by collecting and processing data (IP address, time of visit, device and browser information as well as information about your use of our website), using a pseudonymous cookie ID and based on the pages you have visited. Further data processing only takes place if you have activated the “personalised advertising” setting in your Google account. If, in this case, you are logged in to Google while visiting our website, Google uses your data together with Google Analytics data to create and define audience lists for cross-device remarketing.

For website analysis and event tracking, we use Google Ads Conversion Tracking to measure your subsequent usage behaviour if you arrived at our website via a Google Ads advertisement. Cookies may be used and data may be collected (IP address, time of visit, device and browser information as well as information about your use of our website based on events specified by us, such as visiting a website or subscribing to a newsletter), from which user profiles are created using pseudonyms.

If you give us no consent pursuant to Art. 6(1), first sentence, point (a) GDPR for the use of Google Ads, no cookies will be stored on or read from your device. The data processing described in the preceding paragraphs does not take place. To close gaps in web analytics through behavioural and conversion modelling, pings containing data (user agent, information about your consent behaviour, screen resolution, IP address, page URL, information about ad clicks in URL parameters) are sent to Google. Your IP address is used to derive the IP country.

 Google Maps

For the visual display of geographical information, Google Maps collects data about your use of the Maps functions, in particular your IP address and location data, transmits it to Google and subsequently processes it. We have no influence over this subsequent data processing.

 Google reCAPTCHA

For the purpose of protecting our web forms against misuse and spam by automated software (so-called bots), Google reCAPTCHA collects data (IP address, time of visit, browser information as well as information about your use of our website) and analyses your use of our website using so-called JavaScript and cookies. In addition, other cookies stored in your browser by Google services are evaluated. Data processing is carried out on the basis of a data processing agreement with Google. Users of a customer who access websites protected by reCAPTCHA are no longer subject to Google's Privacy Policy and Terms of Service.

 Google Fonts

For the uniform display of content on our website, the “Google Fonts” script code collects data (IP address, time of visit, device and browser information), transmits it to Google and subsequently processes it. We have no influence over this subsequent data processing.

 Google Tag Manager

The Google Tag Manager allows us to manage various codes and services on our website. When implementing individual tags, Google may also process personal data (e.g. IP address, online identifiers (including cookies)). Data processing is carried out on the basis of a data processing agreement with Google.

The use of Google Tag Manager makes it possible to integrate various services/technologies.
If you do not wish to use individual tracking services and have therefore deactivated them, the deactivation remains in place for all affected tracking tags integrated through Google Tag Manager.

 YouTube Video Plugin

To integrate third-party content, the YouTube Video Plugin in the enhanced privacy mode used by us collects data (IP address, time of visit, device and browser information), transmits it to Google and subsequently processes it, but only when you play a video.

7.2 Use of Microsoft Services

We use the technologies described below from Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (“Microsoft”). Data processing is based on an agreement between joint controllers pursuant to Art. 26 GDPR. The information automatically collected by Microsoft technologies about your use of our website is generally transferred to and stored on a server of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Further information about data processing by Microsoft can be found in the Microsoft Privacy Statement.

Our service providers are located and/or use servers in countries outside the EU and the EEA for which the European Commission has determined by decision that an adequate level of data protection exists.

Our service providers are located and/or use servers in countries outside the EU and the EEA. No adequacy decision by the European Commission exists for these countries. Our cooperation with them is based on the European Commission's Standard Contractual Clauses. 

 Microsoft Advertising

For advertising purposes in Bing, Yahoo and MSN search results and on third-party websites, when you visit our website the so-called Microsoft Advertising Remarketing cookie is set, which automatically enables interest-based advertising by collecting and processing data (IP address, time of visit, device and browser information as well as information about your use of our website), using a pseudonymous cookie ID and based on the pages you have visited.

For website analysis and event tracking, we use Microsoft Advertising Universal Event Tracking (UET) to measure your subsequent usage behaviour if you arrived at our website via a Microsoft Advertising advertisement. Cookies may be used and data may be collected (IP address, time of visit, device and browser information as well as information about your use of our website based on events specified by us, such as visiting a website or subscribing to a newsletter), from which user profiles are created using pseudonyms. If your internet-enabled devices are linked to your Microsoft account and you have not deactivated the “interest-based advertising” setting in your Microsoft account, Microsoft can create reports on usage behaviour (in particular cross-device user numbers), even if you change your end device, so-called “cross-device tracking”. We do not process personal data in this respect; we only receive statistics generated on the basis of Microsoft UET.

7.3 Use of Meta Services

 Use of Meta Pixel

We use the Meta Pixel as part of the technologies described below from Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland (“Facebook (by Meta)” or “Meta Platforms Ireland”). The Meta Pixel automatically collects and stores data (IP address, time of visit, device and browser information as well as information about your use of our website based on events specified by us, such as visiting a website or subscribing to a newsletter), from which user profiles are created using pseudonyms. As part of so-called advanced matching, information that can be used to identify individuals (e.g. names, email addresses and telephone numbers) is additionally collected and stored in hashed form for matching purposes. For this purpose, when you visit our website, the Meta Pixel automatically sets a cookie which, using a pseudonymous cookie ID, enables your browser to be recognised when you visit other websites. Meta Platforms Ireland will combine this information with other data from your Facebook account and use it to compile reports on website activities and to provide other services related to website use, in particular personalised and group-based advertising.
The information automatically collected by Meta Platforms Ireland technologies about your use of our website is generally transferred to and stored on a server of Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025, USA. Further information about data processing by Meta Platforms Ireland can be found in the Meta Platforms Ireland Privacy Policy.

Our service providers are located and/or use servers in the following countries for which the European Commission has determined by decision that an adequate level of data protection exists: Brazil, USA, Canada, Japan, South Korea, New Zealand, United Kingdom, Argentina.

The adequacy decision for the USA serves as the basis for transfers to third countries insofar as the respective service provider is certified. Such certification is in place.

Our service providers are located and/or use servers in the following countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Mexico. No adequacy decision by the European Commission exists for these countries. Our cooperation with them is based on the following safeguards:  Standard Contractual Clauses of the European Commission.

 Meta Ads Manager

We use Meta Ads Manager to advertise this website on Facebook (by Meta) and on other platforms. We determine the parameters of the respective advertising campaign. Meta Platforms Ireland is responsible for the precise implementation, in particular the decision on placing advertisements with individual users. Unless otherwise stated for individual technologies, data processing is based on an agreement between joint controllers pursuant to Art. 26 GDPR. Joint controllership is limited to the collection of data and its transmission to Meta Platforms Ireland. Subsequent data processing by Meta Platforms Ireland is not covered by this.

7.4 Other Providers of Web Analytics and Online Marketing Services

 Use of the Pinterest Tag for Web Analytics and Advertising Purposes

For web analytics and advertising purposes on Pinterest and on third-party websites, when you visit our website technologies from Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland (“Pinterest”) automatically enable interest-based advertising by collecting and processing data (IP address, time of visit, device and browser information as well as information about your use of our website based on events specified by us, such as visiting a website or subscribing to a newsletter), using a pseudonymous cookie ID and based on the pages you have visited. User profiles are created from the data collected using pseudonyms. Pinterest will combine this information with other data from your Pinterest account and use it to compile reports on website activities and to provide other services related to website use. We have no influence over data processing by Pinterest and only receive statistics generated on the basis of the Pinterest Tag. This allows us to measure your subsequent usage behaviour for website analysis and event tracking if you arrived at our website via a Pinterest advertisement. The information automatically collected by Pinterest is generally transferred to and stored on a server of Pinterest, Inc., 505 Brannan St., San Francisco, CA 94107, USA. Data processing is based on an agreement between joint controllers pursuant to Art. 26 GDPR.

Our service providers are located and/or use servers in countries outside the EU and the EEA for which the European Commission has determined by decision that an adequate level of data protection exists.

Our service providers are located and/or use servers in countries outside the EU and the EEA. No adequacy decision by the European Commission exists for these countries. Our cooperation with them is based on the European Commission's Standard Contractual Clauses. 

 Use of Amazon Services for Online Marketing

Through the advertising partner Amazon Europe Core S.à.r.l., 38 avenue John F. Kennedy, L-1855, Luxembourg (“Amazon”), we market advertising space for third-party advertisers on Amazon. These advertisements are displayed to you at various points on this website. Using cookies, Amazon can track the course of the respective order and, in particular, determine that you clicked on the respective advertisement and subsequently ordered the product. For this purpose, data (IP address, time of visit, device and browser information as well as information about your use of our website) is collected, transmitted to Amazon and processed by Amazon. We have no influence over this data processing. Data processing is based on an agreement between joint controllers pursuant to Art. 26 GDPR. The information automatically collected by Amazon about your use of our website is generally transferred to and stored on a server of Amazon, Inc., 2021 7TH Ave, Seattle, WA 98121, USA.

Our service providers are located and/or use servers in countries outside the EU and the EEA for which the European Commission has determined by decision that an adequate level of data protection exists.

Our service providers are located and/or use servers in countries outside the EU and the EEA. No adequacy decision by the European Commission exists for these countries. Our cooperation with them is based on the European Commission's Standard Contractual Clauses. 

 Use of Criteo for Online Marketing

Through the advertising partner Criteo SA, 32 Rue Blanche, 75009 Paris, France (“Criteo”), we advertise this website in search results and on third-party websites. When you visit our website, a retargeting cookie from Criteo or its partners is automatically set, which enables interest-based advertising using a pseudonymous cookie ID and based on the pages you have visited. Data processing is based on an agreement between joint controllers pursuant to Art. 26 GDPR. We determine the parameters of the respective advertising campaign. Criteo is responsible for the precise implementation (e.g. the decision on the placement of individual advertisements). The data automatically collected by Criteo (IP address, time of visit, device and browser information as well as information about your use of our website) may be combined by Criteo with information from other sources and transmitted to Criteo advertising partners.

Our service providers are located and/or use servers in countries outside the EU and the EEA for which the European Commission has determined by decision that an adequate level of data protection exists.

Our service providers are located and/or use servers in countries outside the EU and the EEA. No adequacy decision by the European Commission exists for these countries. Our cooperation with them is based on the European Commission's Standard Contractual Clauses. 

8. Integration of the Trusted Shops Trustbadge / Other Widgets

If you have given your consent pursuant to Art. 6(1), first sentence, point (a) GDPR, Trusted Shops widgets are integrated on this website to display Trusted Shops services (e.g. quality seals, collected reviews) and to offer Trusted Shops products to buyers after an order.

The Trustbadge and the services advertised with it are provided by Trusted Shops SE, Subbelrather Str. 15C, 50823 Cologne ("Trusted Shops"), with whom we are joint controllers under data protection law pursuant to Art. 26 GDPR. In the following, as part of this privacy information, we inform you about the essential contents of the agreement pursuant to Art. 26(2) GDPR.

When you interact with the Trustbadge AI+, session cookies are set to store the login status and display the so-called Welcome Layer, which shows details of the respective online shop (company information, reviews, information about the existence of buyer protection) as well as the #trstd secret. To recognise logged-in users, a cookie is set and stored for a maximum of 400 days after login. Session cookies are also set to send push notifications when using the app, provided the user has allowed them. This is necessary so that Trusted Shops can provide the digital service you have requested. Trusted Shops is responsible for data processing when you interact with the Trustbadge AI+.

Within the framework of the joint controllership existing between us and Trusted Shops SE, for data protection questions and to exercise your rights, please preferably contact Trusted Shops using the contact options specified in the privacy information However, you may always contact the controller of your choice. If necessary, your request will then be forwarded to the other controller for response.

8.1 Data Processing When Integrating the Trustbadge / Other Widgets

The Trustbadge is provided by a US-based CDN provider (Content Delivery Network). An adequate level of data protection is ensured in each case by an adequacy decision of the EU Commission, which for the USA is available here Service providers used in the USA are generally certified under the EU-U.S. Data Privacy Framework (DPF). Further information is available here. If service providers used are not certified under the DPF, Standard Contractual Clauses have been concluded as an appropriate safeguard.

When the Trustbadge is accessed, the web server automatically stores a so-called server log file, which also contains your IP address, the date and time of access, the amount of data transferred and the requesting provider (access data) and documents the access. The IP address is anonymised immediately after collection so that the stored data cannot be attributed to you personally. The anonymised data is used in particular for statistical purposes and error analysis.

8.2 Data Processing after Completion of an Order

If you have given your consent, after completion of an order the Trustbadge accesses order information stored on your end device (order total, order number and, where applicable, purchased product) as well as your email address, and your email address is hashed using a cryptographic one-way function. The hash value is then transmitted to Trusted Shops together with the order information pursuant to Art. 6(1), first sentence, point (a) GDPR.
This is used to check whether you are already registered for Trusted Shops services. If this is the case, further processing is carried out in accordance with the contractual agreement concluded between you and Trusted Shops. For Germany, this can be found here; for Austria here and for Switzerland here. If you are not yet registered for the services or do not give your consent to automatic recognition via the Trustbadge, you will subsequently have the option of registering manually to use the services or of taking out protection under any user agreement you may already have.

For this purpose, after completion of your order the Trustbadge accesses the following information stored on the end device you use: order total, order number and email address. This is necessary so that we can offer you buyer protection. Data is only transmitted to Trusted Shops if you actively choose to take out buyer protection by clicking the appropriately labelled button in the so-called Trustcard. If you choose to use the services, further processing is governed by the contractual agreement with Trusted Shops pursuant to Art. 6(1), point (b) GDPR, in order to complete your registration for buyer protection and secure the order and, where applicable, subsequently send you review invitations by email.

Trusted Shops uses service providers in the areas of hosting, monitoring and logging. The legal basis is Art. 6(1), point (f) GDPR for the purpose of ensuring trouble-free operation. Processing may take place in third countries (USA, United Kingdom and Israel). An adequate level of data protection is ensured in each case by an adequacy decision of the EU Commission, which for the USA is available here, for the United Kingdom here and for Israel here Service providers used in the USA are generally certified under the EU-U.S. Data Privacy Framework (DPF). Further information is available here. If service providers used are not certified under the DPF, Standard Contractual Clauses have been concluded as an appropriate safeguard.

9. Social Media

9.1 Social Buttons from Facebook (by Meta), X (formerly: Twitter), Instagram (by Meta), Pinterest, Xing, WhatsApp

Social buttons from social networks are used on our website. They are integrated into the page merely as HTML links, so no connection to the servers of the respective provider is established when our website is accessed. If you click on one of the buttons, the website of the respective social network opens in a new window of your browser. There you can, for example, use the Like or Share button.

9.2 Our Online Presence on Facebook (by Meta), X (formerly: Twitter), Instagram (by Meta), YouTube, Pinterest, LinkedIn, Xing

If you have given your consent pursuant to Art. 6(1), first sentence, point (a) GDPR to the respective social media operator, when you visit our online presences on the social media platforms mentioned above, your data is automatically collected and stored for market research and advertising purposes, from which user profiles are created using pseudonyms. These may be used, for example, to place advertisements within and outside the platforms that are presumed to correspond to your interests. Cookies are generally used for this purpose. Detailed information on the processing and use of data by the respective social media operator, as well as a contact option and your rights and setting options in this regard to protect your privacy, can be found in the providers' privacy policies linked below. If you still need assistance in this regard, you can contact us.

Facebook (by Meta) is a service provided by Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland (“Meta Platforms Ireland”). The information automatically collected by Meta Platforms Ireland about your use of our online presence on Facebook (by Meta) is generally transferred to and stored on a server of Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025, USA. Data processing in connection with visiting a Facebook (by Meta) fan page is based on an agreement between joint controllers pursuant to Art. 26 GDPR. Further information (information on Insights data) can be found here.

Our service providers are located and/or use servers in the following countries for which the European Commission has determined by decision that an adequate level of data protection exists: Brazil, USA, Canada, Japan, South Korea, New Zealand, United Kingdom, Argentina.

The adequacy decision for the USA serves as the basis for transfers to third countries insofar as the respective service provider is certified. Such certification is in place.

Our service providers are located and/or use servers in the following countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Mexico.
No adequacy decision by the European Commission exists for these countries. Our cooperation with them is based on the following safeguards:  Standard Contractual Clauses of the European Commission.

X is a service provided by X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland (“X”). The information automatically collected by X about your use of our online presence on X is generally transferred to and stored on a server of X Corp., FM 1209, Building 2, Bastrop, TX 78602, USA.

Our service providers are located and/or use servers in countries outside the EU and the EEA for which the European Commission has determined by decision that an adequate level of data protection exists.

Our service providers are located and/or use servers in countries outside the EU and the EEA. No adequacy decision by the European Commission exists for these countries. Our cooperation with them is based on the European Commission's Standard Contractual Clauses. 

Instagram (by Meta) is a service provided by Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland (“Meta Platforms Ireland”). The information automatically collected by Meta Platforms Ireland about your use of our online presence on Instagram is generally transferred to and stored on a server of Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. Data processing in connection with visiting an Instagram (by Meta) fan page is based on an agreement between joint controllers pursuant to Art. 26 GDPR. Further information (information on Insights data) can be found here.

Our service providers are located and/or use servers in the following countries for which the European Commission has determined by decision that an adequate level of data protection exists: Brazil, USA, Canada, Japan, South Korea, New Zealand, United Kingdom, Argentina.

The adequacy decision for the USA serves as the basis for transfers to third countries insofar as the respective service provider is certified. Such certification is in place.

Our service providers are located and/or use servers in the following countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Mexico.
No adequacy decision by the European Commission exists for these countries. Our cooperation with you is based on the following safeguards: Standard Contractual Clauses of the European Commission.

YouTube is a service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The information automatically collected by Google about your use of our online presence on YouTube is generally transferred to and stored on a server of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Our service providers are located and/or use servers in countries outside the EU and the EEA for which the European Commission has determined by decision that an adequate level of data protection exists.

Our service providers are located and/or use servers in countries outside the EU and the EEA. No adequacy decision by the European Commission exists for these countries. Our cooperation with them is based on the European Commission's Standard Contractual Clauses. 

Pinterest is a service provided by Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland (“Pinterest”). The information automatically collected by Pinterest about your use of our online presence on Pinterest is generally transferred to and stored on a server of Pinterest, Inc., 505 Brannan St., San Francisco, CA 94107, USA.

Our service providers are located and/or use servers in countries outside the EU and the EEA for which the European Commission has determined by decision that an adequate level of data protection exists.

Our service providers are located and/or use servers in countries outside the EU and the EEA. No adequacy decision by the European Commission exists for these countries. Our cooperation with them is based on the European Commission's Standard Contractual Clauses. 

LinkedIn is a service provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”). The information automatically collected by LinkedIn about your use of our online presence on LinkedIn is generally transferred to and stored on a server of LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.

Our service providers are located and/or use servers in the following countries for which the European Commission has determined by decision that an adequate level of data protection exists: USA.

The adequacy decision for the USA serves as the basis for transfers to third countries insofar as the respective service provider is certified. Such certification is in place.

Xing is a service provided by New Work SE, Am Strandkai 1, 20457 Hamburg, Germany.

Our service providers are located and/or use servers in countries outside the EU and the EEA for which the European Commission has determined by decision that an adequate level of data protection exists.

Our service providers are located and/or use servers in countries outside the EU and the EEA. No adequacy decision by the European Commission exists for these countries. Our cooperation with them is based on the European Commission's Standard Contractual Clauses. 

10. Contact Options and Your Rights

10.1 Your Rights

As a data subject, you have the following rights:

• pursuant to Art. 15 GDPR, the right to request information, to the extent specified therein, about your personal data processed by us;
• pursuant to Art. 16 GDPR, the right to request without delay the rectification of inaccurate personal data or completion of your personal data stored by us;
• pursuant to Art. 17 GDPR, the right to request the erasure of your personal data stored by us, unless further processing is necessary
  • for exercising the right of freedom of expression and information;
  • for compliance with a legal obligation;
  • for reasons of public interest; or
  • for the establishment, exercise or defence of legal claims;
• pursuant to Art. 18 GDPR, the right to request restriction of the processing of your personal data where
  • you contest the accuracy of the data;
  • the processing is unlawful, but you oppose its erasure;
  • we no longer need the data, but you require it for the establishment, exercise or defence of legal claims; or
  • you have objected to processing pursuant to Art. 21 GDPR;
• pursuant to Art. 20 GDPR, the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request transmission to another controller;
• pursuant to Art. 77 GDPR, the right to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority at your habitual place of residence or place of work or at our company's registered office.

Right to Object Where we process personal data as explained above in order to safeguard our legitimate interests, which prevail in the context of a balancing of interests, you may object to this processing with effect for the future. If the processing is carried out for direct marketing purposes, you may exercise this right at any time as described above. If the processing is carried out for other purposes, you only have a right to object on grounds relating to your particular situation. After you exercise your right to object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing serves the establishment, exercise or defence of legal claims. This does not apply if the processing is carried out for direct marketing purposes. In that case, we will no longer process your personal data for this purpose.

10.2 Contact Options

If you have any questions about the collection, processing or use of your personal data, requests for information, rectification, restriction or erasure of data, withdrawal of consent given or objection to a particular use of data, please contact us directly using the contact details in our legal notice.