Privacy Policy

EOC Europe GmbH
Seeshaupter Str. 62
82377 Penzberg
Germany

Fax: +49 8856-901-101
Email: privacy@elevate-oc.eu

Introduction

Privacy Policy

1) Introduction and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about the processing of your personal data when using our website. Personal data comprises all data by which you can be personally identified.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is EOC Europe GmbH, Seeshaupter Str. 62, 82377 Penzberg, Germany, Tel.: +49 (0) 8856-901-0, E-Mail: info@elevate-oc.eu. The controller responsible for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

1.3 The controller has appointed a Data Protection Officer, who may be contacted as follows: "EOC Europe GmbH, Seeshaupter Str. 62, 82377 Penzberg, E-Mail: privacy@elevate-oc.eu"

2) Data Collection When Visiting Our Website

2.1 When our website is used for purely informational purposes, i.e. if you do not register or otherwise transmit information to us, we only collect such data as your browser transmits to the page server (so-called "server log files"). When you access our website, we collect the following data, which are technically necessary for us to display the website to you:

• Our visited website
• Date and time at the time of access
• Amount of data sent in bytes
• Source/referral from which you accessed the page
• Browser used
• Operating system used
• IP address used (where applicable: in anonymised form)

The processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data are not disclosed or used for any other purpose. We do, however, reserve the right to review the server log files retrospectively if there are concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the controller), this website uses SSL or TLS encryption. You can identify an encrypted connection by the string "https://" and the padlock symbol in your browser bar.

3) Hosting & Content Delivery Network

3.1 Amazon Web Services

For hosting our website and presenting the page content, we use the system of the following provider: Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, USA

All data collected on our website are processed on the provider's servers.
We have concluded a data processing agreement with the provider, which ensures the protection of the data of our website visitors and prohibits any unauthorised disclosure to third parties.

For data transfers to the USA, the provider has acceded to the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

3.2 Cloudflare

We use a content delivery network provided by the following provider: Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA

This service enables us to deliver large media files such as graphics, page content or scripts more quickly via a network of regionally distributed servers. The processing is carried out to safeguard our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6(1)(f) GDPR. We have concluded a data processing agreement with the provider, which ensures the protection of the data of our website visitors and prohibits any unauthorised disclosure to third parties.

For data transfers to the USA, the provider has acceded to the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

4) Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your terminal device. Some of these cookies are automatically deleted when you close your browser (so-called "session cookies"); some remain on your terminal device for longer and enable the storage of page settings (so-called "persistent cookies"). In the latter case, you may find the storage period in the overview of the cookie settings of your web browser.

Where personal data are also processed by individual cookies used by us, the processing is carried out pursuant to Art. 6(1)(b) GDPR either for the purpose of performing the contract, pursuant to Art. 6(1)(a) GDPR in the event of consent having been given, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a user-friendly and effective design of the page visit.

You may configure your browser so that you are informed about the placement of cookies and may decide individually whether to accept them, or may exclude the acceptance of cookies in certain cases or generally.

Please note that the functionality of our website may be restricted if you do not accept cookies.

5) Contact

In the context of contacting us (e.g. via contact form or email), personal data are processed — exclusively for the purpose of handling and responding to your enquiry and only to the extent required for that purpose.

The legal basis for the processing of this data is our legitimate interest in responding to your enquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6(1)(b) GDPR. Your data will be deleted once it can be inferred from the circumstances that the matter in question has been conclusively resolved and provided no statutory retention obligations preclude deletion.

6) Data Processing When Opening a Customer Account

Pursuant to Art. 6(1)(b) GDPR, personal data shall continue to be collected and processed to the extent required if you communicate such data to us when opening a customer account. The data required for opening an account may be found in the input mask of the relevant form on our website.

Deletion of your customer account is possible at any time and may be effected by sending a message to the above-mentioned address of the controller. After deletion of your customer account, your data will be deleted, provided all contracts concluded through it have been fully processed, no statutory retention periods preclude deletion, and we have no legitimate interest in continued storage.

7) Use of Customer Data for Direct Marketing

7.1 Subscription to Our Email Newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information required for sending the newsletter is your email address. The provision of further data is voluntary and will be used for the purpose of addressing you personally. For sending the newsletter, we use the so-called double opt-in procedure, which ensures that you only receive newsletters once you have expressly confirmed your consent to receive them by clicking on a verification link sent to the specified email address.

By activating the confirmation link, you grant us your consent to the use of your personal data pursuant to Art. 6(1)(a) GDPR. In this context, we store your IP address as registered by the Internet Service Provider (ISP), as well as the date and time of registration, in order to be able to trace any possible misuse of your email address at a later point in time. The data collected by us upon registration for the newsletter are used solely for the stated purpose.

You may unsubscribe from the newsletter at any time via the designated link in the newsletter or by sending a corresponding message to the controller mentioned at the outset. Upon unsubscription, your email address will be immediately deleted from our newsletter distribution list, unless you have expressly consented to further use of your data or we have reserved a right to further use of data that is permitted by law and about which we inform you in this statement.

7.2 Sending of the Email Newsletter to Existing Customers

If you have provided us with your email address upon purchase of goods or services, we reserve the right to regularly send you offers by email for similar goods or services to those already purchased from our range. In doing so, we do not need to obtain separate consent from you pursuant to Section 7(3) of the German Act Against Unfair Competition (UWG). The data processing in this regard is carried out solely on the basis of our legitimate interest in personalised direct marketing pursuant to Art. 6(1)(f) GDPR. If you have objected to the use of your email address for this purpose from the outset, we will not send any emails.

You are entitled to object to the use of your email address for the aforementioned advertising purpose at any time with effect for the future by sending a notification to the controller named at the outset. You will only incur transmission costs for this at the basic rates. Upon receipt of your objection, the use of your email address for advertising purposes will be immediately discontinued.

7.3 Klaviyo

The sending of our email newsletters and other promotional email communications is carried out by the following provider: Klaviyo, Inc., 125 Summer St., Ste 600, Boston, MA 02110, USA

On the basis of our legitimate interest in effective and user-friendly email marketing, we transfer your data provided upon registration to this provider pursuant to Art. 6(1)(f) GDPR so that it may carry out the mailing on our behalf.

Subject to your express consent pursuant to Art. 6(1)(a) GDPR, the provider additionally carries out a statistical evaluation of the success of mail campaigns by means of web beacons or tracking pixels in the emails sent, which can measure opening rates and specific interactions with the newsletter content. In doing so, device information (e.g. time of access, IP address, browser type and operating system) is also collected and evaluated, but not merged with other datasets.

You may revoke your consent to mail tracking at any time with effect for the future.

We have concluded a data processing agreement with the provider, which protects the data of our website visitors and prohibits any disclosure to third parties.

For data transfers to the USA, the provider has acceded to the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

7.4 Product Availability Notification by Email

For temporarily unavailable items, you may register to receive email product availability notifications. In this case, we will send you a single email notification regarding the availability of the item you have selected. The only mandatory information required for sending this notification is your email address. The provision of further data is voluntary and may be used to address you personally. For the mailing, we use the so-called double opt-in procedure, which ensures that you only receive a notification once you have expressly confirmed your consent thereto by clicking on a verification link sent to the specified email address.

By activating the confirmation link, you grant us your consent to the use of your personal data pursuant to Art. 6(1)(a) GDPR. In this context, we store your IP address as registered by the Internet Service Provider (ISP), as well as the date and time of registration, in order to be able to trace any possible misuse of your email address at a later point in time. The data collected by us upon registration for our email notification service for product availability are used solely for the stated purpose.

You may unsubscribe from the availability notifications at any time by sending a corresponding message to the controller mentioned at the outset. Upon unsubscription, your email address will be immediately deleted from our distribution list set up for this purpose, unless you have expressly consented to further use of your data or we have reserved a right to further use of data that is permitted by law and about which we inform you in this statement.

7.5 Shopping Cart Reminders by Email

In the event that you abandon your purchase with us before completing your order, you have the option of being reminded by email on one single occasion of the contents of your virtual shopping cart.

The only mandatory information required for sending this reminder is your email address. The provision of further data is voluntary and may be used to address you personally. For the mailing, we use the so-called double opt-in procedure, which ensures that you only receive a notification once you have expressly confirmed your consent thereto by clicking on a verification link sent to the specified email address.

By activating the confirmation link, you grant us your consent to the use of your personal data pursuant to Art. 6(1)(a) GDPR for the sending of a shopping cart reminder. In this context, we store your IP address as registered by the Internet Service Provider (ISP), as well as the date and time of registration, in order to be able to trace any possible misuse of your email address at a later point in time. The data collected by us upon registration for our email notification service are used solely for the stated purpose.

You may unsubscribe from shopping cart reminders at any time by sending a corresponding message to the controller mentioned at the outset. Upon unsubscription, your email address will be immediately deleted from our distribution list set up for this purpose, unless you have expressly consented to further use of your data or we have reserved a right to further use of data that is permitted by law and about which we inform you in this statement.

8) Data Processing for Order Fulfilment

8.1 Where required for the performance of the contract for delivery and payment purposes, the personal data collected by us shall be disclosed pursuant to Art. 6(1)(b) GDPR to the contracted transport company and the contracted financial institution.

If we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we will process the contact data transmitted by you at the time of ordering to personally inform you within the scope of our statutory information obligations pursuant to Art. 6(1)(c) GDPR. Your contact data are used exclusively for the purpose of communicating updates owed by us and are processed by us for this purpose only to the extent required for each respective communication.

For the processing of your order, we also work with the service provider(s) listed below, who support us in whole or in part in the performance of concluded contracts. Certain personal data are transmitted to these service providers in accordance with the following information.

8.2 Disclosure of Personal Data to Shipping Service Providers

- GLS

As transport service provider we use the following provider: General Logistics Systems Germany GmbH & Co. OHG, GLS Germany-Straße 1 - 7, 36286 Neuenstein, Germany

We disclose your email address and/or telephone number to the provider prior to delivery of the goods for the purpose of coordinating a delivery date or for delivery notification pursuant to Art. 6(1)(a) GDPR, provided you have granted your express consent to this in the ordering process. Otherwise, we disclose only the name of the recipient and the delivery address to the provider for the purpose of delivery pursuant to Art. 6(1)(b) GDPR. The disclosure only takes place insofar as this is required for delivery of the goods. In this case, prior coordination of the delivery date with the provider or delivery notification is not possible.

Consent may be revoked at any time with effect for the future vis-à-vis the controller named above or vis-à-vis the provider.
- UPS

As transport service provider we use the following provider: United Parcel Service Deutschland Inc. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany

We disclose your email address and/or telephone number to the provider prior to delivery of the goods for the purpose of coordinating a delivery date or for delivery notification pursuant to Art. 6(1)(a) GDPR, provided you have granted your express consent to this in the ordering process. Otherwise, we disclose only the name of the recipient and the delivery address to the provider for the purpose of delivery pursuant to Art. 6(1)(b) GDPR. The disclosure only takes place insofar as this is required for delivery of the goods. In this case, prior coordination of the delivery date with the provider or delivery notification is not possible.

Consent may be revoked at any time with effect for the future vis-à-vis the controller named above or vis-à-vis the provider.
- UPS Austria

As transport service provider we use the following provider: United Parcel Service Speditionsgesellschaft m.b.H, Cargo Nord, Objekt 1, 1300 Vienna Airport, Austria

We disclose your email address and/or telephone number to the provider prior to delivery of the goods for the purpose of coordinating a delivery date or for delivery notification pursuant to Art. 6(1)(a) GDPR, provided you have granted your express consent to this in the ordering process. Otherwise, we disclose only the name of the recipient and the delivery address to the provider for the purpose of delivery pursuant to Art. 6(1)(b) GDPR. The disclosure only takes place insofar as this is required for delivery of the goods. In this case, prior coordination of the delivery date with the provider or delivery notification is not possible.

Consent may be revoked at any time with effect for the future vis-à-vis the controller named above or vis-à-vis the provider.

8.3 Use of Payment Service Providers

- Apple Pay

If you choose the payment method "Apple Pay" offered by Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment processing is carried out via the "Apple Pay" function of your terminal device operating iOS, watchOS or macOS by debiting a payment card stored in "Apple Pay". Apple Pay uses security features integrated into the hardware and software of your device to protect your transactions. The release of a payment therefore requires the entry of a code previously set by you as well as verification using the "Face ID" or "Touch ID" function of your terminal device.

For the purposes of payment processing, the information you provided during the ordering process, together with information about your order, is transmitted to Apple in encrypted form. Apple then re-encrypts this data with a developer-specific key before the data is transmitted to the payment service provider of the payment card stored in Apple Pay in order to execute the payment. The encryption ensures that only the website through which the purchase was made can access the payment data. After the payment has been made, Apple sends your device account number and a transaction-specific, dynamic security code to the original website to confirm the successful payment.

Where personal data are processed in connection with the transmissions described, the processing is carried out exclusively for the purpose of payment processing pursuant to Art. 6(1)(b) GDPR.

Apple retains anonymised transaction data, including the approximate purchase amount, the approximate date and time, and whether the transaction was completed successfully. Anonymisation completely excludes any personal reference. Apple uses the anonymised data to improve "Apple Pay" and other Apple products and services.

When you use Apple Pay on an iPhone or Apple Watch to complete a purchase made through Safari on a Mac, the Mac and the authorisation device communicate via an encrypted channel on Apple's servers. Apple does not process or store any of this information in a format by which your person could be identified. You can disable the ability to use Apple Pay on your Mac in your iPhone settings. Go to "Wallet & Apple Pay" and disable "Allow Payments on Mac".

Further information on data protection in relation to Apple Pay can be found at the following internet address: https://support.apple.com/de-de/HT203027
- Google Pay

If you choose the payment method "Google Pay" offered by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), payment processing is carried out via the "Google Pay" application on your mobile terminal device operating at least Android 4.4 ("KitKat") and featuring an NFC function, by debiting a payment card stored in Google Pay or a payment system verified there (e.g. PayPal). For the release of a payment via Google Pay in an amount exceeding EUR 25.00, prior unlocking of your mobile terminal device by the verification measure you have set up (e.g. facial recognition, password, fingerprint or pattern) is required.

For the purposes of payment processing, the information you provided during the ordering process, together with information about your order, is transmitted to Google. Google then transmits your payment information stored in Google Pay in the form of a one-time transaction number to the original website, by means of which a payment made is verified. This transaction number contains no information whatsoever about your actual payment data stored in Google Pay, but is created and transmitted as a one-time valid numerical token. For all transactions via Google Pay, Google acts merely as an intermediary for the processing of the payment transaction. The execution of the transaction takes place exclusively in the relationship between the user and the original website by debiting the means of payment stored in Google Pay.

Where personal data are processed in connection with the transmissions described, the processing is carried out exclusively for the purpose of payment processing pursuant to Art. 6(1)(b) GDPR.

Google reserves the right to collect, store and evaluate certain transaction-specific information for each transaction made via Google Pay. This includes the date, time and amount of the transaction, the merchant location and description, a description provided by the merchant of the goods or services purchased, photos you have attached to the transaction, the name and email address of the seller and buyer or of the sender and recipient, the payment method used, your description of the reason for the transaction, and, where applicable, the offer associated with the transaction.

According to Google, this processing is carried out exclusively pursuant to Art. 6(1)(f) GDPR on the basis of the legitimate interest in proper invoicing, verification of transaction data and the optimisation and maintenance of the Google Pay service.

Google further reserves the right to merge the processed transaction data with further information collected and stored by Google when the user uses further Google services.

The terms of use of Google Pay can be found here:

https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=de
Further information on data protection in relation to Google Pay can be found at the following internet address:
https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de
- Klarna

One or more online payment methods of the following provider are available on this website: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden

If you select a payment method of the provider whereby you pay in advance (e.g. credit card payment), your payment data communicated during the ordering process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order are transferred to the provider pursuant to Art. 6(1)(b) GDPR. In this case, your data is disclosed exclusively for the purpose of payment processing with the provider and only to the extent necessary for that purpose.

If you select a payment method whereby the provider pays in advance (e.g. invoice or instalment purchase or direct debit), you will also be requested during the ordering process to provide certain personal data (first and last name, street, house number, postcode, city, date of birth, email address, telephone number, and where applicable, data relating to an alternative means of payment).

In order to safeguard our legitimate interest in determining the creditworthiness of our customers, this data is forwarded by us pursuant to Art. 6(1)(f) GDPR to the provider for the purpose of a credit assessment. The provider assesses, on the basis of the personal data provided by you and further data (such as shopping cart, invoice amount, order history, payment experience), whether the payment option selected by you can be granted with regard to payment and/or default risks.

For the purpose of the application review, in addition to provider-internal criteria, identity and creditworthiness information from the following credit agencies may also be taken into account pursuant to Art. 6(1)(f) GDPR:

https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The credit report may contain probability values (so-called score values). Insofar as score values enter into the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. The calculation of the score values incorporates, among other things but not exclusively, address data.

You may object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may remain entitled to process your personal data if this is required for the contractual payment processing.
- PayPal

One or more online payment methods of the following provider are available on this website: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method of the provider whereby you pay in advance, your payment data communicated during the ordering process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order are transferred to the provider pursuant to Art. 6(1)(b) GDPR. In this case, your data is disclosed exclusively for the purpose of payment processing with the provider and only to the extent necessary for that purpose.

If you select a payment method whereby we pay in advance, you will also be requested during the ordering process to provide certain personal data (first and last name, street, house number, postcode, city, date of birth, email address, telephone number, and where applicable, data relating to an alternative means of payment).

In order to safeguard our legitimate interest in determining your creditworthiness in such cases, this data is forwarded by us pursuant to Art. 6(1)(f) GDPR to the provider for the purpose of a credit assessment. The provider assesses, on the basis of the personal data provided by you and further data (such as shopping cart, invoice amount, order history, payment experience), whether the payment option selected by you can be granted with regard to payment and/or default risks.

The credit report may contain probability values (so-called score values). Insofar as score values enter into the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. The calculation of the score values incorporates, among other things but not exclusively, address data.

You may object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may remain entitled to process your personal data if this is required for the contractual payment processing.
- PayPal Checkout

This website uses PayPal Checkout, an online payment system provided by PayPal, which consists of PayPal's own payment methods and local payment methods from third-party providers.

When paying via PayPal, credit card via PayPal, direct debit via PayPal or — if offered — "Pay Later" via PayPal, we forward your payment data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal") as part of payment processing. The forwarding takes place pursuant to Art. 6(1)(b) GDPR and only insofar as this is required for payment processing.

PayPal reserves the right to conduct a credit check for the payment methods credit card via PayPal, direct debit via PayPal or — if offered — "Pay Later" via PayPal. For this purpose, your payment data may be forwarded pursuant to Art. 6(1)(f) GDPR, on the basis of PayPal's legitimate interest in determining your creditworthiness, to credit agencies. PayPal uses the result of the credit assessment in relation to the statistical probability of payment default for the purpose of deciding whether to provide the respective payment method. The credit report may contain probability values (so-called score values). Insofar as score values enter into the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. The calculation of the score values incorporates, among other things but not exclusively, address data. You may object to this processing of your data at any time by sending a message to PayPal. However, PayPal may remain entitled to process your personal data if this is required for the contractual payment processing.

If the PayPal payment method "Invoice Purchase" is available and selected, your payment data will first be transmitted to PayPal in preparation for the payment, whereupon PayPal will forward it to Ratepay GmbH, Franklinstraße 28-29, 10587 Berlin ("Ratepay") for the purpose of executing the payment. The legal basis in each case is Art. 6(1)(b) GDPR. In this case, Ratepay conducts an identity and credit assessment in its own name to determine creditworthiness according to the principle already mentioned above and forwards your payment data to credit agencies on the basis of its legitimate interest in determining creditworthiness pursuant to Art. 6(1)(f) GDPR. A list of the credit agencies to which Ratepay may have recourse can be found here: https://www.ratepay.com/legal-payment-creditagencies/

When using the payment method of a local third-party provider, your payment data will first be forwarded to PayPal pursuant to Art. 6(1)(b) GDPR in preparation for the payment. Depending on your selection of an available local payment method, PayPal will then transmit your payment data to the corresponding provider for the purpose of executing the payment pursuant to Art. 6(1)(b) GDPR:

- Apple Pay (Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
- Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)
- iDeal (Currence Holding BV, Beethovenstraat 300 Amsterdam, Netherlands)
- bancontact (Bancontact Payconiq Company, Rue d'Arlon 82, 1040 Brussels, Belgium)
- blik (Polski Standard Płatności sp. z o.o., ul. Czerniakowska 87A, 00-718 Warsaw, Poland)
- eps (PSA Payment Services Austria GmbH, Handelskai 92, Gate 2
1200 Vienna, Austria)
- MyBank (PRETA S.A.S, 40 Rue de Courcelles, F-75008 Paris, France)
- Przelewy24 (PayPro SA, Kanclerska 15A, 60-326 Poznań, Poland)

Further data protection information may be found in PayPal's Privacy Policy: https://www.paypal.com/de/legalhub/paypal/privacy-full
- SOFORT (Immediate Bank Transfer)

One or more online payment methods of the following provider are available on this website: Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden

If you select a payment method of the provider whereby you pay in advance (e.g. credit card payment), your payment data communicated during the ordering process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order are transferred to the provider pursuant to Art. 6(1)(b) GDPR. In this case, your data is disclosed exclusively for the purpose of payment processing with the provider and only to the extent necessary for that purpose.
- Stripe

One or more online payment methods of the following provider are available on this website: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland

If you select a payment method of the provider whereby you pay in advance (e.g. credit card payment), your payment data communicated during the ordering process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order are transferred to the provider pursuant to Art. 6(1)(b) GDPR. In this case, your data is disclosed exclusively for the purpose of payment processing with the provider and only to the extent necessary for that purpose.

If you select a payment method whereby the provider pays in advance (e.g. invoice or instalment purchase or direct debit), you will also be requested during the ordering process to provide certain personal data (first and last name, street, house number, postcode, city, date of birth, email address, telephone number, and where applicable, data relating to an alternative means of payment).

In order to safeguard our legitimate interest in determining the creditworthiness of our customers, this data is forwarded by us pursuant to Art. 6(1)(f) GDPR to the provider for the purpose of a credit assessment. The provider assesses, on the basis of the personal data provided by you and further data (such as shopping cart, invoice amount, order history, payment experience), whether the payment option selected by you can be granted with regard to payment and/or default risks.

The credit report may contain probability values (so-called score values). Insofar as score values enter into the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. The calculation of the score values incorporates, among other things but not exclusively, address data.

You may object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may remain entitled to process your personal data if this is required for the contractual payment processing.

8.4 Electronic Right of Withdrawal for Distance Contracts

Consumers who conclude contracts on this website for which a statutory right of withdrawal exists have the possibility of declaring the withdrawal via an electronic withdrawal function in accordance with the applicable withdrawal provisions.

When using the withdrawal function, in addition to information for identifying the contract to be withdrawn, further personal information such as the first and last name and the email address of the consumer must be provided or confirmed.

The collection of this information and its transmission to us is carried out pursuant to Art. 6(1)(b) GDPR and only insofar as it is required for the proper processing of the withdrawal. Also on the basis of Art. 6(1)(b) GDPR, the personal data provided are used to confirm receipt of the withdrawal declaration by email. The additional legal basis for the processing is Art. 6(1)(c) GDPR. We are legally obliged to provide an electronic withdrawal function for paid consumer distance contracts.

9) Online Marketing

Google AdSense

This website uses Google AdSense, a web advertising service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). Google AdSense uses so-called cookies, i.e. text files that are stored on your computer and enable an analysis of your use of the website. In addition, Google AdSense also uses so-called "web beacons" (small invisible graphics) to collect information, by means of which simple actions such as visitor traffic on the website can be recorded, collected and evaluated. The information generated by the cookie and/or web beacon (including your IP address) about your use of this website is generally transmitted to a server of Google and stored there. This may also result in a transmission to the servers of Google LLC in the USA.

Google uses the information obtained in this way to carry out an evaluation of your usage behaviour with regard to the AdSense advertisements. The IP address transmitted by your browser within the framework of Google AdSense is not merged with other data from Google. The information collected by Google may under certain circumstances be transferred to third parties insofar as this is required by law and/or insofar as third parties process this data on behalf of Google.
All processing operations described above, in particular the reading of information on the terminal device used via cookies and/or web beacons, will only be carried out if you have granted us your express consent to do so pursuant to Art. 6(1)(a) GDPR. Without such consent, Google AdSense will not be used during your visit to the page.

You may revoke your granted consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website.

For data transfers to the USA, the provider has acceded to the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

Further information on Google's data protection provisions can be viewed here: https://business.safety.google/intl/de/privacy/ and https://www.google.de/policies/privacy/

10) Web Analytics Services

10.1 Google Analytics 4

This website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which enables an analysis of your use of our website.

By default, when the website is visited, Google Analytics 4 sets cookies, which are stored as small text elements on your terminal device and collect certain information. The scope of this information also includes your IP address, which is however truncated by Google in its final digits in order to exclude any direct personal reference.

The information is transmitted to servers of Google and further processed there. Transmissions to Google LLC, headquartered in the USA, are also possible.

Google uses the information collected on our behalf to evaluate your use of the website, to compile reports on website activity for us and to provide further services related to website and internet use. The truncated IP address transmitted by your browser within the framework of Google Analytics is not merged with other data from Google. The data collected within the framework of the use of Google Analytics 4 are stored for a period of two months and subsequently deleted.

All processing operations described above, in particular the setting of cookies on the terminal device used, will only be carried out if you have granted us your express consent pursuant to Art. 6(1)(a) GDPR.
Without your consent, Google Analytics 4 will not be used during your visit to the page. You may revoke your granted consent with effect for the future at any time. To exercise your right of revocation, please deactivate this service via the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with Google, which ensures the protection of the data of our website visitors and prohibits any unauthorised disclosure to third parties.

Further legal information on Google Analytics 4 can be found at https://business.safety.google/intl/de/privacy/, https://policies.google.com/privacy?hl=de&gl=de and at https://policies.google.com/technologies/partner-sites

Demographic Characteristics
Google Analytics 4 uses the special function "demographic characteristics" and can thereby generate statistics that make statements about the age, gender and interests of website visitors. This is done through the analysis of advertising and information from third-party providers. Target groups for marketing activities can thereby be identified. The data collected cannot, however, be attributed to any specific person and are deleted after a storage period of two months.

Google Signals
As an extension to Google Analytics 4, Google Signals may be used on this website to generate cross-device reports. If you have activated personalised ads and have linked your devices to your Google account, Google may, subject to your consent to the use of Google Analytics pursuant to Art. 6(1)(a) GDPR, analyse your usage behaviour across devices and create database models, including relating to cross-device conversions. We do not receive any personal data from Google, but only statistics. If you wish to stop the cross-device analysis, you may deactivate the "Personalised advertising" function in the settings of your Google account. Please follow the instructions on this page: https://support.google.com/My-Ad-Center-Help/answer/12155764?hl=de
Further information on Google Signals can be found at the following link: https://support.google.com/analytics/answer/7532985?hl=de

User IDs
As an extension to Google Analytics 4, the "User IDs" function may be used on this website. If you have consented to the use of Google Analytics 4 pursuant to Art. 6(1)(a) GDPR, have set up an account on this website and log in to this account on different devices, your activities, including conversions, can be analysed across devices.

For data transfers to the USA, the provider has acceded to the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

10.2 Google Tag Manager

This website uses the "Google Tag Manager", a service of the following provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google").

The Google Tag Manager provides a technical basis for bundling various web applications, including tracking and analytics services, and calibrating, controlling and subjecting them to conditions via a unified user interface. The Google Tag Manager itself does not store any information on user terminal devices or read any such information. Nor does the service carry out any independent data analyses. However, when a page is accessed, the Google Tag Manager transmits your IP address to Google, where it may be stored. Transmission to servers of Google LLC in the USA is also possible.

This processing will only be carried out if you have granted us your express consent pursuant to Art. 6(1)(a) GDPR. Without such consent, the Google Tag Manager will not be used during your visit to the page. You may revoke your granted consent at any time with effect for the future. To exercise your revocation, please deactivate this service in the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with the provider, which ensures the protection of the data of our website visitors and prohibits any unauthorised disclosure to third parties.

For data transfers to the USA, the provider has acceded to the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

Further legal information on Google Tag Manager can be found at https://business.safety.google/intl/de/privacy/ and https://policies.google.com/privacy?hl=de&gl=de

11) Retargeting/Remarketing and Conversion Tracking

Google Ads Conversion Tracking

This website uses the online advertising programme "Google Ads" and, within the framework of Google Ads, the conversion tracking service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). We use the Google Ads service to draw attention to our attractive offers on external websites with the help of advertising materials (so-called Google Adwords). In relation to the data of the advertising campaigns, we are able to determine how successful the individual advertising measures are. Our aim is thereby to show you advertising that is of interest to you, to make our website more interesting for you and to achieve a fair calculation of the advertising costs incurred.

The cookie for conversion tracking is set when a user clicks on an ad placed by Google. Cookies are small text files that are stored on your terminal device. These cookies generally lose their validity after 30 days and are not used for personal identification. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognise that the user clicked on the ad and was redirected to this page. Each Google Ads customer receives a different cookie. Cookies can therefore not be tracked across the websites of Google Ads customers. The information obtained with the aid of the conversion cookie is used to generate conversion statistics for Google Ads customers who have opted for conversion tracking. The customers are informed of the total number of users who have clicked on their ad and were redirected to a page tagged with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users. In the context of using Google Ads, personal data may also be transmitted to the servers of Google LLC in the USA.

Details on the processing operations triggered by Google Ads Conversion Tracking and on Google's handling of data from websites can be found here: https://policies.google.com/technologies/partner-sites

All processing operations described above, in particular the setting of cookies for reading information on the terminal device used, will only be carried out if you have granted us your express consent pursuant to Art. 6(1)(a) GDPR. You may revoke your granted consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website.

You may furthermore permanently object to the setting of cookies by Google Ads Conversion Tracking by downloading and installing the browser plug-in available at the following link from Google:
https://support.google.com/My-Ad-Center-Help/answer/12155656?hl=de

Please note that certain functions of this website may not be available or may only be available to a limited extent if you have disabled the use of cookies.
Google's data protection provisions can be viewed here: https://business.safety.google/intl/de/privacy/ and https://www.google.de/policies/privacy/

For data transfers to the USA, the provider has acceded to the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

12) Page Functionalities

12.1 Vimeo

This website uses plugins for displaying and playing videos of the following provider: Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA

When you access a page of our website that contains such a plugin, your browser establishes a direct connection to the servers of the provider in order to load the plugin. In doing so, certain information, including your IP address, is transmitted to the provider.

If playback of embedded videos is started via the plugin, the provider also uses cookies to collect information about user behaviour, to create playback statistics and to prevent abusive behaviour.

If you are logged into a user account with the provider during your visit to the page, your data will be directly associated with your account when you click on a video. If you do not wish this association with your account, you must log out before activating the play button.

All aforementioned processing operations, in particular the setting of cookies for reading information on the terminal device used, will only be carried out if you have granted us your express consent pursuant to Art. 6(1)(a) GDPR. You may revoke your granted consent at any time with effect for the future by deactivating this service via the "Cookie Consent Tool" provided on the website.

For data transfers to the USA, the provider has acceded to the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

12.2 YouTube

This website uses plugins for displaying and playing videos of the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transmitted to: Google LLC., USA

When you access a page of our website that contains such a plugin, your browser establishes a direct connection to the servers of the provider no later than at the time of video playback in order to load the content. In doing so, certain information, including your IP address, is transmitted to the provider.

If playback of embedded videos is started via the plugin, the provider also uses cookies to collect information about user behaviour, to create playback statistics and to prevent abusive behaviour.

If you are logged into a user account with the provider during your visit to the page, your data will be directly associated with your account when you click on a video. If you do not wish this association with your account, you must log out before activating the play button.

All aforementioned processing operations, in particular the setting of cookies for reading information on the terminal device used, will only be carried out if you have granted us your express consent pursuant to Art. 6(1)(a) GDPR. You may revoke your granted consent at any time with effect for the future by deactivating this service via the "Cookie Consent Tool" provided on the website.

For data transfers to the USA, the provider has acceded to the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

12.3 Mapbox

This website uses an online mapping service of the following provider: MapBox Inc., 740 15th St Nw Suite 500 Washington, DC 20005, USA

The online mapping service is a tool for displaying interactive maps in order to present geographical information visually. Through the use of this service, our location is displayed to you and any geolocalisation is facilitated.

When you access those sub-pages into which the provider's map is integrated, information about your use of our website (such as your IP address) is already transmitted to the provider's servers and stored there.

The processing of your personal data is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the needs-based design of our website. If you do not agree to the future transmission of your data to the provider, there is the option of completely deactivating the provider's online mapping service by switching off the JavaScript application in your browser. The online mapping service on this website can then no longer be used.

Insofar as required by law, we have obtained your consent pursuant to Art. 6(1)(a) GDPR for the processing of your data described above. You may revoke your granted consent at any time with effect for the future. To exercise your revocation, please follow the possibility of raising an objection described above.

For the transfer of data to the USA, the provider relies on standard contractual clauses of the European Commission, which are intended to ensure compliance with the European level of data protection.

12.4 Adobe Fonts (Typekit)

This page uses so-called web fonts for the uniform display of typefaces, provided by the following provider: Adobe Systems Incorporated, 345 Park Avenue, San Jose, CA 95110-2704, USA

When you access a page, your browser loads the required web fonts into your browser cache in order to correctly display texts and typefaces and establishes a direct connection to the provider's servers. In doing so, certain browser information, including your IP address, is transmitted to the provider.

The processing of personal data in connection with establishing contact with the provider of the typefaces will only be carried out if you have granted us your express consent pursuant to Art. 6(1)(a) GDPR. You may revoke your granted consent at any time with effect for the future by deactivating this service via the "Cookie Consent Tool" provided on the website. If your browser does not support web fonts, a standard font from your computer will be used.

For data transfers to the USA, the provider has acceded to the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

12.5 Google reCAPTCHA

On this website we use the CAPTCHA service of the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transmitted to: Google LLC, USA.

For the visual design of the CAPTCHA window, the provider uses "Google Fonts", i.e. typefaces loaded from the internet by Google. No processing of further information beyond that mentioned above, which is already transmitted to Google via the functionality of reCAPTCHA, takes place in this context.

The service checks whether an input is made by a natural person or abusively by mechanical and automated processing, and blocks spam, DDoS attacks and similar automated malicious access. In order to ensure that an action is performed by a human and not by an automated bot, the provider collects the IP address of the terminal device used, identification data of the browser and operating system type used, as well as the date and duration of the visit, and transmits these to the provider's servers for evaluation. Cookies may be used in this connection, i.e. small text files stored in the browser of the terminal device.

Insofar as the processing operations described above are carried out on the basis of cookies, these will only be set if you have granted us your express consent pursuant to Art. 6(1)(a) GDPR. You may revoke your granted consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website.

If the processing operations described above are carried out without the use of cookies, the legal basis is our legitimate interest in establishing individual personal responsibility on the internet and in the prevention of misuse and spam pursuant to Art. 6(1)(f) GDPR.

We have concluded a data processing agreement with the provider, which ensures the protection of the data of our website visitors and prohibits any unauthorised disclosure to third parties.

For data transfers to the USA, the provider has acceded to the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

12.6 JotForm

For conducting surveys or for online forms, we use the services of the following provider: JotForm Inc., 111 Pine St. Suite 1815, San Francisco, CA 94111, USA

The provider enables us to design and evaluate surveys and online forms. In addition to the respective personal data you enter into the forms, information about your operating system, browser, date and time of your visit, referrer URL and your IP address are also collected, transmitted to the provider and stored on the provider's servers.

The information entered by you into the forms is stored with password protection in order to ensure that third-party access is excluded and only we can evaluate the data for the purpose stated in the respective form.

For the processing of personal data required for the performance of a contract with you (this also applies to processing operations that are required for the implementation of pre-contractual measures), Art. 6(1)(b) GDPR serves as the legal basis. If you have given us consent to the processing of your data, the processing is carried out on the basis of Art. 6(1)(a) GDPR. Consent that has been given may be revoked at any time with effect for the future.

We have concluded a data processing agreement with the provider, which ensures the protection of the data of our website visitors and prohibits any unauthorised disclosure to third parties.

For data transfers to the USA, the provider has acceded to the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

13) Tools and Miscellaneous

13.1 Cookie Consent Tool

This website uses a so-called "Cookie Consent Tool" for obtaining effective user consent for cookies requiring consent and cookie-based applications. The "Cookie Consent Tool" is displayed to users when they access a page in the form of an interactive user interface, on which consent can be granted for certain cookies and/or cookie-based applications by ticking the relevant boxes. In doing so, the tool ensures that all cookies/services requiring consent are only loaded if the respective user has granted corresponding consent by ticking the relevant boxes. This ensures that such cookies are only set on the respective terminal device of the user if consent has been granted.

The tool sets technically necessary cookies in order to store your cookie preferences. Personal user data are in principle not processed in this connection.

In individual cases, where personal data (such as the IP address) are processed for the purpose of storing, assigning or logging cookie settings, this is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in legally compliant, user-specific and user-friendly consent management for cookies and thus in the legally compliant design of our website.

The additional legal basis for the processing is furthermore Art. 6(1)(c) GDPR. As the controller, we are subject to the legal obligation to make the use of technically non-essential cookies contingent upon the respective user consent.

Where required, we have concluded a data processing agreement with the provider, which ensures the protection of the data of our website visitors and prohibits any unauthorised disclosure to third parties.

Further information about the operator and the configuration options of the Cookie Consent Tool can be found directly in the corresponding user interface on our website.

13.2 Yotpo Product Reviews

For the verification and publication of customer reviews, we use the services of the following provider: SMSBump Ltd., 51 Cherni vrah Blvd, Sofia, 1407, Bulgaria

If you submit a review on our website, your first and last name, your email address, order date and number as well as the name and international references (GTIN/ISDN) are collected, transmitted to the provider and evaluated there in order to decide on the legitimacy of a customer review for a specific order. This processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in ensuring the authenticity of customer reviews by verifying their transaction-related nature and preventing review abuse. After the review verification and approval process has been completed, the data are deleted by the provider.

14) Rights of the Data Subject

14.1 The applicable data protection law grants you the following data subject rights (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data, with reference being made to the stated legal basis for the respective conditions of exercise:

• Right of access pursuant to Art. 15 GDPR;
• Right to rectification pursuant to Art. 16 GDPR;
• Right to erasure pursuant to Art. 17 GDPR;
• Right to restriction of processing pursuant to Art. 18 GDPR;
• Right to notification pursuant to Art. 19 GDPR;
• Right to data portability pursuant to Art. 20 GDPR;
• Right to revoke consents granted pursuant to Art. 7(3) GDPR;
• Right to lodge a complaint pursuant to Art. 77 GDPR.

14.2 RIGHT TO OBJECT

WHERE WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST FOLLOWING A BALANCING OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO SUCH PROCESSING AT ANY TIME WITH EFFECT FOR THE FUTURE ON GROUNDS ARISING FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE THE PROCESSING OF THE DATA IN QUESTION. HOWEVER, CONTINUED PROCESSING REMAINS RESERVED WHERE WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR WHERE THE PROCESSING SERVES THE PURPOSE OF ASSERTING, EXERCISING OR DEFENDING LEGAL CLAIMS.

WHERE YOUR PERSONAL DATA ARE PROCESSED BY US FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSES OF SUCH MARKETING. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE THE PROCESSING OF THE DATA IN QUESTION FOR DIRECT MARKETING PURPOSES.

15) Duration of Storage of Personal Data

The duration of the storage of personal data is determined by the respective legal basis, the purpose of processing and — where applicable — additionally by the respective statutory retention period (e.g. commercial and tax law retention periods).

When processing personal data on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the data in question are stored until you revoke your consent.

If statutory retention periods exist for data that are processed within the framework of legal or quasi-legal obligations on the basis of Art. 6(1)(b) GDPR, these data will be routinely deleted after expiry of the retention periods, provided they are no longer required for the performance or initiation of the contract and/or we have no legitimate interest in continued storage.

When processing personal data on the basis of Art. 6(1)(f) GDPR, these data are stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims.

When processing personal data for the purpose of direct marketing on the basis of Art. 6(1)(f) GDPR, these data are stored until you exercise your right to object pursuant to Art. 21(2) GDPR.

Unless the other information in this statement regarding specific processing situations indicates otherwise, stored personal data will otherwise be deleted when they are no longer necessary for the purposes for which they were collected or otherwise processed.