Data protection

General note and mandatory information
Designation of the responsible body

The controller responsible for data processing on this website is

Katrin Tindler-Kempen
2bu design
Mörsenbroicher Weg 200
40470 Düsseldorf
Germany

T +49 221 20438716

The controller decides alone or jointly with others on the purposes and means of processing personal data (e.g. names, contact details, etc.).

Revocation of your consent to data processing

Some data processing operations are only possible with your express consent. You can withdraw your consent at any time. An informal notification by e-mail is sufficient for cancellation. The legality of the data processing carried out until the revocation remains unaffected by the revocation.

Right to lodge a complaint with the competent supervisory authority

As a data subject, you have the right to lodge a complaint with the competent supervisory authority in the event of a breach of data protection law. The competent supervisory authority for data protection issues is the state data protection officer of the federal state in which the registered office of our company is located. The following link provides a list of data protection officers and their contact details: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to third parties. The data will be provided in a machine-readable format. If you request the direct transfer of the data to another controller, this will only take place if it is technically feasible.

Right to information, rectification, blocking, erasure

You have the right to free information about your stored personal data, the origin of the data, its recipients and the purpose of the data processing and, if necessary, a right to correction, blocking or deletion of this data at any time within the framework of the applicable legal provisions. You can contact us at any time using the contact options listed in the legal notice if you have any further questions on the subject of personal data.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content that you send to us as the site operator, our website uses SSL or TLS encryption. This means that data that you transmit via this website cannot be read by third parties. You can recognise an encrypted connection by the „https://“ address line of your browser and the lock symbol in the browser line.

Server log filesIn server log files, the website provider automatically collects and stores information that your browser automatically transmits to us. These are

• Visited page on our domain
• Date and time of the server request
• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• IP address

This data is not merged with other data sources. The basis for data processing is Art. 6 para. 1 lit. b GDPR, which permits the processing of data for the fulfilment of a contract or pre-contractual measures.

Data transmission upon conclusion of a contract for the purchase and dispatch of goods

Personal data will only be transmitted to third parties if this is necessary in the context of contract processing. Third parties may be, for example, payment service providers or logistics companies. Any further transmission of data will not take place or will only take place if you have expressly consented to this.

The basis for data processing is Art. 6 para. 1 lit. b GDPR, which permits the processing of data for the fulfilment of a contract or pre-contractual measures.

Registration on this website

You can register on our website to use certain functions. The data transmitted is used exclusively for the purpose of using the respective offer or service. Mandatory information requested during registration must be provided in full. Otherwise we will refuse the registration.

In the event of important changes, for example for technical reasons, we will inform you by e-mail. The e-mail will be sent to the address provided during registration.

The processing of the data entered during registration is based on your consent (Art. 6 para. 1 lit. a GDPR). You can withdraw your consent at any time. An informal notification by e-mail is sufficient for the cancellation. The legality of the data processing that has already taken place remains unaffected by the cancellation.

We store the data collected during registration for the period that you are registered on our website. Your data will be deleted if you cancel your registration. Statutory retention periods remain unaffected.

Contact form

Data transmitted via the contact form, including your contact details, will be stored in order to process your enquiry or to be available for follow-up questions. This data will not be passed on without your consent.

The data entered in the contact form is processed exclusively on the basis of your consent (Art. 6 para. 1 lit. a GDPR). You can withdraw your consent at any time. An informal notification by e-mail is sufficient to revoke your consent. The legality of the data processing operations carried out until the revocation remains unaffected by the revocation.

Data transmitted via the contact form will remain with us until you ask us to delete it, revoke your consent to its storage or there is no longer any need to store the data. Mandatory statutory provisions –, in particular retention periods –, remain unaffected.

By e-mail, telephone or fax

If you contact us by e-mail, telephone or fax, your enquiry including all personal data (name, enquiry) will be stored and processed by us for the purpose of processing your request. We will not pass on this data without your consent.

This data is processed on the basis of Art. 6 para. 1 lit. b GDPR if your enquiry is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the enquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested.

The data you send to us via contact requests will remain with us until you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies (e.g. after your request has been processed). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

WhatsApp

For communication with our customers and other third parties, we use the instant messaging service WhatsApp, among others. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Communication takes place via end-to-end encryption (peer-to-peer), which prevents WhatsApp or other third parties from gaining access to the communication content. However, WhatsApp receives access to metadata that is created in the course of the communication process (e.g. sender, recipient and time). We would also like to point out that WhatsApp states that it shares personal data of its users with its parent company Facebook, which is based in the USA. Further details on data processing can be found in WhatsApp's privacy policy at https://www.whatsapp.com/legal/#privacy-policy.

WhatsApp is used on the basis of our legitimate interest in communicating as quickly and effectively as possible with customers, interested parties and other business and contractual partners (Art. 6 para. 1 sentence 1 lit. f GDPR). If a corresponding consent has been requested, the data processing takes place exclusively on the basis of the consent; this can be revoked at any time with effect for the future.

The communication content exchanged between and on WhatsApp will remain with us until you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies (e.g. after your enquiry has been processed). Mandatory statutory provisions –, in particular retention periods –, remain unaffected.

We use WhatsApp in the „WhatsApp Business“ version.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.whatsapp.com/legal/business-data-transfer-addendum.

We have set up our WhatsApp accounts so that it does not automatically synchronise data with the address book on the smartphones in use. We have concluded an order processing contract with WhatsApp.

Newsletter data

We require an e-mail address from you in order to send you our newsletter. Verification of the e-mail address provided is necessary and you must consent to receiving the newsletter. Additional data is not collected or is voluntary.

The data is used exclusively for sending the newsletter.

The data provided when registering for the newsletter will be processed exclusively on the basis of your consent (Art. 6 para. 1 lit. a GDPR). You can withdraw your consent at any time. To withdraw your consent, simply send us an informal email or unsubscribe via the “Unsubscribe” link in the newsletter. The legality of the data processing operations that have already taken place remains unaffected by the cancellation.

Data entered to set up the subscription will be deleted in the event of cancellation. If this data has been transmitted to us for other purposes and elsewhere, it will remain with us.

MailerLite

This website uses MailerLite’s services to send out newsletters. The provider is MailerLite Limited, 88 Harcourt Street, Dublin 2, D02 DK18, Ireland.

MailerLite is a service that can be used, amongst other things, to organise and analyse the sending of newsletters. If you enter data for the purpose of subscribing to a newsletter (e.g. your email address), this data is stored on MailerLite’s servers. According to MailerLite, these servers are located in the European Union.

We use MailerLite to analyse our newsletter campaigns. When you open an email sent via MailerLite, a file contained within the email (known as a web beacon) connects to MailerLite’s servers. This allows us to determine whether a newsletter has been opened and which links have been clicked. Technical information is also collected (e.g. time of access, IP address, browser type and operating system). We use this information to improve our newsletters.

If you do not wish to receive analytics from MailerLite, you must unsubscribe from the newsletter. We provide a link for this purpose in every newsletter message.

The data processing takes place on the basis of your consent (Art. 6 para. 1 lit. a GDPR). You can revoke this consent at any time by unsubscribing from the newsletter. The legality of the data processing operations that have already taken place remains unaffected by the cancellation.

The data you have provided to us for the purpose of subscribing to the newsletter will be stored by us or by MailerLite until you unsubscribe from the newsletter, and will be deleted from the newsletter distribution list once you have unsubscribed. Data stored by us for other purposes remains unaffected by this.

Where MailerLite transfers data to service providers outside the European Union, such transfers are based on the European Commission’s Standard Contractual Clauses. Further details can be found in MailerLite’s privacy policy: https://www.mailerlite.com/legal/privacy-policy.

Conclusion of a contract for data processing
We have entered into a data processing agreement (Article 28 of the GDPR) with MailerLite. Under this agreement, MailerLite undertakes to protect our users’ data and to process it only in accordance with our instructions: https://www.mailerlite.com/legal/data-processing-agreement.

YouTube

Our website uses plugins from YouTube to integrate and display video content. The provider of the video portal is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA.

When a page with an integrated YouTube plugin is accessed, a connection to the YouTube servers is established. This tells YouTube which of our pages you have visited.

YouTube can assign your surfing behaviour directly to your personal profile if you are logged into your YouTube account. You can prevent this by logging out beforehand.

The use of YouTube is in the interest of an appealing presentation of our online offers. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR.

Details on the handling of user data can be found in YouTube's privacy policy at: https://www.google.de/intl/de/policies/privacy.

Cookies and consent

Our website uses cookies and similar technologies. We set technically necessary cookies (e.g. for the shopping basket or to save your cookie preferences) on the basis of Section 25(2)(2) of the TDDDG and Article 6(1)(f) of the GDPR. We only set all other cookies, such as those used for statistics, with your consent (Section 25(1) of the TDDDG, Article 6(1)(a) of the GDPR).

We manage your consent using the Complianz plugin, which runs on our own server. Your selection is stored in a cookie in your browser. You can change or withdraw your consent at any time via „Manage consent“ in the bottom right-hand corner.

You can find a full list of all cookies, including their purpose and retention period, on our website Cookies.

Google Analytics

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This enables us to find out which pages are visited and for how long, and to improve our website.

Google Analytics is only loaded if you have consented to the „Statistics“ category in the cookie banner. The legal basis is your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG. You may withdraw your consent at any time with future effect via „Manage consent“.

This involves setting the _ga and _ga_* cookies and transmitting usage data (e.g. pages viewed, time spent on the site, device, browser, approximate location) to Google. Google Analytics 4 does not store full IP addresses. We have disabled Google Signals and the sharing of data with other Google products.

Data may be transferred to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses also apply. We have entered into a data processing agreement with Google.

Event data is automatically deleted after 2 months; user-related data is automatically deleted after 14 months. Further information: policies.google.com/privacy

PayPal

Our website enables payment via PayPal. The provider of the payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

If you pay with PayPal, the payment data you enter will be transmitted to PayPal.

The transmission of your data to PayPal is based on Art. 6 para. 1 lit. a GDPR (consent) and Art. 6 para. 1 lit. b GDPR (processing for the fulfilment of a contract). You can withdraw your consent at any time.

Data processing operations in the past remain effective in the event of cancellation.

Meta Pixel (Facebook Pixel)

On our website, we use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. This enables us to track how visitors use our website after clicking on an advert on Facebook or Instagram, and to target our advertising more effectively.

The meta-pixel is only loaded if you have consented to the „Marketing“ category in the cookie banner. The legal basis is your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG. You may withdraw your consent at any time with future effect via „Manage consent“.

This sets the _fbp cookie and transmits data such as the pages you have visited, the time of your visit, browser and device information, and your IP address to Meta. If you are logged in to Facebook or Instagram, Meta can associate your visit with your account.

We are jointly responsible with Meta for the collection and transmission of the data (Article 26 of the GDPR). You can find the relevant agreement at facebook.com/legal/controller_addendum. Meta is solely responsible for any further processing. Data may be transferred to Meta Platforms Inc. in the USA; Meta is certified under the EU-US Data Privacy Framework.

Further information: facebook.com/privacy/policy

Twitter plugin

Our website uses functions of the Twitter service. The provider is Twitter Inc, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA.

When you use Twitter and the “Re-Tweet” function, websites you visit are linked to your Twitter account and published in your Twitter feed. This involves the transmission of data to Twitter. We have no knowledge of the content of the transmitted data or the use of this data by Twitter. Details can be found in Twitter's privacy policy: https://twitter.com/privacy.

You can change your privacy settings on Twitter: https://twitter.com/account/settings

Pinterest plugin

Our website uses functions of the social network Pinterest. The provider is Pinterest Inc, 808 Brannan Street, San Francisco, CA 94103-490, USA.

When you access a page with Pinterest functions, your browser establishes a direct connection to the Pinterest servers. Log data is transmitted to the Pinterest servers. The servers are located in the USA. The log data may allow conclusions to be drawn about your IP address, websites visited, browser type and settings, date and time of the request, your use of Pinterest and cookies.

You can find details on this in Pinterest's privacy policy: https://about.pinterest.com/de/privacy-policy.

Amazon Partner Programme

As the operator of this website, we participate in the Amazon EU Partner Programme. Advertisements from Amazon and links to Amazon are integrated on our pages in order to earn money through advertising cost reimbursements. Amazon cookies are used, whereby Amazon recognises that you have clicked on an affiliate link on our website.

The storage of “Amazon cookies” takes place on the basis of Art. 6 lit. f GDPR. As the website operator, we have a legitimate interest in this, as the amount of the advertising cost reimbursement can only be determined through the cookies.

Details on the use of data by Amazon can be found in the Amazon privacy policy: https://www.amazon.de/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&nodeId=3312401.

Google AdWords and Google Conversion Tracking

Our website uses Google AdWords. The provider is Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States.

AdWords is an online advertising programme. We work with conversion tracking as part of the online advertising programme. After clicking on an advert placed by Google, a cookie is set for conversion tracking. Cookies are small text files that your web browser stores on your end device. Google AdWords cookies lose their validity after 30 days and are not used to personally identify users. The cookie allows Google and us to recognise that you have clicked on an ad and have been redirected to our website.

Each Google AdWords customer receives a different cookie. The cookies cannot be tracked via the websites of AdWords customers. Conversion cookies are used to create conversion statistics for AdWords customers who use conversion tracking. AdWords customers find out how many users clicked on their advert and were redirected to pages with a conversion tracking tag. However, AdWords customers do not receive any information that allows users to be personally identified. If you do not wish to participate in tracking, you can object to its use. In this case, the conversion cookie must be deactivated in the user settings of the browser. This also prevents inclusion in the conversion tracking statistics.

“Conversion cookies” are stored on the basis of Art. 6 para. 1 lit. f GDPR. As the website operator, we have a legitimate interest in analysing user behaviour in order to optimise our website and our advertising.

Details on Google AdWords and Google Conversion Tracking can be found in Google's privacy policy: https://www.google.de/policies/privacy/.

With a modern web browser, you can monitor, restrict or prevent the setting of cookies. Deactivating cookies may result in limited functionality of our website.

Social media presence

We maintain social media presences in order to communicate with active customers, interested parties and users and to keep them up to date with news and services in a contemporary way. We have linked to these on our website. Visitor data may also be processed in countries outside the European area. Different data protection standards apply there. We would therefore like to point out that there are risks associated with this; for example, data processing is subject to other regulations with regard to transparency or law enforcement. User data may also be used for market research and advertising purposes. Usage profiles can also be created from the collected data, in particular from the behaviour when using certain offers and the interests determined in the process. These in turn can also be used to place adverts within social media, but also on other channels. This information is often collected with the help of cookies on users' end devices and analysed according to certain criteria. The data stored in the social networks for the individual profiles can also be linked to the data stored with the help of cookies.

The maintenance of appearances in social media and the resulting processing of personal data takes place on the basis of our legitimate interests in effective and up-to-date information and communication of users and interested parties in accordance with Art. 6 para. 1 lit. f. GDPR. GDPR takes place. If consent to data processing is obtained, the processing is carried out on the basis of Art. 6 para. 1 lit. a, Art. 7 GDPR. We would like to ask you to note the individual information provided by the providers regarding the details of the individual processing operations and objection options. We would like to point out that the most effective way to assert user rights and requests for information is to contact the providers. Only they have the necessary database and the technical and organisational means to take the necessary measures for this purpose. We will be happy to provide you with any assistance you may require.

• Facebook, Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland), on the basis of an agreement on joint processing of personal data – Privacy Policy: https://www.facebook.com/about/privacy/, Opt-out option (opt-out): https://www.facebook.com/settings?tab=ads and https://www.youronlinechoices.com
• Instagram (Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA), privacy policy and opt-out option: https://instagram.com/about/legal/privacy/.
• Twitter (Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA), Privacy Policy: https://twitter.com/de/privacy/, Opt-out option (opt-out): https://twitter.com/personalization/,
• Youtube (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), Privacy Policy: https://www.google.com/policies/privacy/, Opt-out option (opt-out): https://myaccount.google.com/not-supported
• Xing (XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany)d
  Data protection declaration/option to object (opt-out): https://privacy.xing.com/de/datenschutzerklaerung.
• LinkedIn (LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland) – Privacy Policy: https://www.linkedin.com/legal/privacy-policy, Possibility of objection (opt-out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out/,
• Pinterest (Pinterest Inc., 808 Brannan St, San Francisco, CA 94103, USA), Privacy Policy https://policy.pinterest.com/de/privacy-policy/, Opt-out option (opt-out): https://help.pinterest.com/de/article/personalized-ads-on-pinterest/
• TikTok Technology Limited (10 Earlsfort Terrace, Dublin, D02 T380, Ireland)
  Privacy policy: https://www.tiktok.com/legal/privacy-policy-eea?lang=de&selection=true
  Possibility of objection: https://support.tiktok.com/de/safety-hc/account-and-user-safety/account-safety/