datenschutz - sanoia-jewelry.com

Privacy Policy

1. Introduction and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we explain how we process your personal data when you use our website. Personal data means any information that can be used to identify you personally.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Sandra Kusterer, SANOIA, Goethering 7, 63067 Offenbach, Germany, Tel.: +49 174 8114112, Email: info@sanoia-jewelry.com. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2. Data Collection When You Visit Our Website

2.1 When you use our website for informational purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the data that your browser transmits to our server (so-called **server log files**). When you access our website, we collect the following data, which is technically necessary to display the website to you:

Website visited
Date and time of access
Amount of data transmitted (in bytes)
Referring website (source/reference from which you accessed our website)
Browser used
Operating system used
IP address used (where applicable, in anonymised form)

The data is processed in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be disclosed to third parties or used for any other purpose. However, we reserve the right to review the server log files retrospectively if there are concrete indications of unlawful use.

2.2 This website uses SSL and/or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (such as orders or enquiries submitted to the controller). You can recognise an encrypted connection by the **"https://"** prefix in your browser's address bar and the padlock symbol displayed there.

3) Hosting & Content-Delivery-Network

3.1 We use a hosting provider to host our website and deliver its content. The provider performs these services, either directly or through carefully selected subcontractors, exclusively on servers located within the European Union.

Sämtliche auf unserer Website erhobenen Daten werden auf diesen Servern verarbeitet, sofern nicht im Nachstehenden für spezifische Datenverarbeitungen abweichende Datenempfänger genannt sind.

We have concluded a Data Processing Agreement (DPA) with the provider to ensure the protection of our website visitors' personal data and to prohibit any unauthorised disclosure to third parties.

3.2 IONOS

We use a Content Delivery Network (CDN) provided by the following provider: 1&1 IONOS Internet SE Elgendorfer Str. 57 56410 Montabaur Germany

This service enables us to deliver large media files, such as graphics, website content or scripts, more quickly via a network of regionally distributed servers. The processing is carried out in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website.

We have concluded a Data Processing Agreement (DPA) with the provider to ensure the protection of our website visitors' personal data and to prohibit any unauthorised disclosure to third parties.

4) Cookies

To make your visit to our website more user-friendly and to enable the use of certain features, we use cookies. Cookies are small text files that are stored on your device. Some of these cookies are automatically deleted when you close your browser (so-called **session cookies**). Others remain on your device for a longer period and allow us to save your website preferences (so-called **persistent cookies**). In the latter case, you can find the storage period in the cookie settings overview of your web browser.

Where personal data is processed through individual cookies used by us, such processing is carried out in accordance with Article 6(1)(b) GDPR where it is necessary for the performance of a contract, in accordance with Article 6(1)(a) GDPR where you have given your consent, or in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest in ensuring the best possible functionality of the website and providing a user-friendly and efficient browsing experience.

You can configure your browser to notify you whenever cookies are set and to decide on a case-by-case basis whether to accept them. You may also choose to reject cookies in specific cases or generally.

Please note that if you do not accept cookies, the functionality of our website may be limited.

5) Contacting Us

5.1 When you contact us (e.g. via the contact form or by email), personal data is processed solely for the purpose of handling and responding to your enquiry, and only to the extent necessary for that purpose.

The legal basis for processing this data is our legitimate interest in responding to your enquiry in accordance with Article 6(1)(f) GDPR. Where your enquiry relates to the conclusion or performance of a contract, the additional legal basis for processing is Article 6(1)(b) GDPR. Your data will be deleted once it can be inferred from the circumstances that the matter in question has been conclusively resolved, provided that no statutory retention obligations require otherwise.

5.2 - Brevo

We use the following provider to send transactional emails, i.e. event-based messages triggered by a specific user action (such as the conclusion of a contract, registration, or a password reset): Brevo GmbH Köpenicker Str. 126 10179 Berlin Germany

On the basis of our legitimate interest in efficient and user-friendly email communication, we transfer the data you provide when carrying out such a user action to this provider in accordance with Article 6(1)(f) GDPR so that the provider can send the relevant emails on our behalf.

We have concluded a Data Processing Agreement (DPA) with this provider, ensuring that the personal data of our website visitors is protected and not disclosed to third parties.

6) Data Processing When Creating a Customer Account

In accordance with Article 6(1)(b) GDPR, we collect and process personal data to the extent necessary where you provide such data when creating a customer account. The data required for account registration can be found in the input form provided on our website.

You may delete your customer account at any time by contacting the controller at the address provided above. Once your customer account has been deleted, your personal data will also be deleted, provided that all contracts concluded through the account have been fully performed, no statutory retention periods apply, and we have no legitimate interest in retaining the data.

7) Use of Customer Data for Direct Marketing

7.1 Subscription to Our Email Newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information required for receiving the newsletter is your email address. Providing any additional information is voluntary and is used to address you personally. We use the double opt-in procedure for newsletter subscriptions. This means that you will only receive our newsletter after you have expressly confirmed your consent by clicking the verification link sent to the email address you provided.

By activating the confirmation link, you give us your consent to process your personal data in accordance with Article 6(1)(a) GDPR. For this purpose, we store the IP address assigned by your Internet Service Provider (ISP), as well as the date and time of your subscription, in order to be able to trace any possible misuse of your email address at a later date. The data collected when you subscribe to the newsletter is used exclusively for this purpose.

You may unsubscribe from the newsletter at any time by using the unsubscribe link included in each newsletter or by contacting the controller named at the beginning of this Privacy Policy. Once you have unsubscribed, your email address will be removed from our newsletter mailing list without undue delay, unless you have expressly consented to the further use of your data or we reserve the right to use your data in ways permitted by law, as explained in this Privacy Policy.

7.2 Brevo

Our email newsletters and other promotional email communications are sent via the following provider: Brevo GmbH Köpenicker Str. 126 10179 Berlin Germany

We reserve the right—solely on the basis of your express consent pursuant to Art. 6(1)(a) GDPR—to conduct a statistical analysis of the performance of email campaigns using web beacons or tracking pixels embedded in the emails sent; these tools can measure open rates and specific interactions with the newsletter content. In this process, information regarding the end device (e.g., time of access, IP address, browser type, and operating system) is collected and analyzed but is not combined with other datasets.

You may revoke your consent to email tracking at any time, with effect for the future.

We have concluded a Data Processing Agreement (DPA) with this provider, ensuring that the personal data of our website visitors is protected and not disclosed to third parties.

7.3 Product availability notification via email

8) Data processing for order processing

8.1 To the extent necessary for the performance of the contract for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned transport company and the commissioned financial institution in accordance with Art. 6(1)(b) GDPR.

Where we are obliged under a relevant contract to provide you with updates for goods with digital elements or for digital products, we process the contact details you provided when placing your order in order to inform you personally, in compliance with our statutory information obligations under Art. 6(1)(c) GDPR. In this context, your contact details are used strictly for the purpose of communicating updates we are required to provide, and are processed by us only to the extent necessary for the specific notification in question.

To process your order, we also work with the service provider(s) listed below, who assist us—in whole or in part—in the execution of concluded contracts. Certain personal data are transmitted to these service providers in accordance with the information below.

8.2 Billbee

We use the following provider for order processing: Billbee GmbH, Arolser Str. 10, 34477 Twistetal.

Your name, address, and—where applicable—other personal data are transmitted to the provider exclusively for the purpose of processing the online order, in accordance with Art. 6(1)(b) GDPR. Your data is transmitted only to the extent actually necessary for processing the order.

8.3 Post & DHL Shipping (Official)

To prepare for shipment, we use the services of the following provider: Deutsche Post DHL Research And Innovation GmbH, Kurt-Schumacher-Str. 1, 53113 Bonn.
In accordance with Art. 6(1)(b) GDPR, we transmit digital shipping labels containing your delivery information from our order processing system to the service provider—solely for the purpose of processing your online order—who then sends them to our local printers for printing. Data is disclosed only to the extent actually necessary for processing the order.

8.4 Use of payment service providers (payment services)

- Apple Pay

If you choose the "Apple Pay" payment method provided by Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment is processed via the "Apple Pay" feature on your device running iOS, watchOS, or macOS by charging a payment card stored in Apple Pay. Apple Pay utilizes security features integrated into your device's hardware and software to protect your transactions. Consequently, authorizing a payment requires entering a code you have previously set and verifying the transaction using your device's "Face ID" or "Touch ID" function.

For the purpose of payment processing, the information you provide during the ordering process, along with details of your order, is transmitted to Apple in encrypted form. Apple then re-encrypts this data using a developer-specific key before transmitting it to the payment service provider associated with the payment card stored in Apple Pay to execute the payment. This encryption ensures that only the website where the purchase was made can access the payment data. Once the payment has been made, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website to confirm that the payment was successful.

To the extent that personal data is processed during the described transmissions, such processing takes place exclusively for the purpose of payment processing in accordance with Art. 6(1)(b) GDPR.

Apple retains anonymized transaction data, including the approximate purchase amount, the approximate date and time, and an indication of whether the transaction was successfully completed. Anonymization ensures that any link to an individual is completely eliminated. Apple uses the anonymized data to improve Apple Pay and other Apple products and services.

When you use Apple Pay on your iPhone or Apple Watch to complete a purchase initiated via Safari on your Mac, the Mac and the authorizing device communicate over an encrypted channel on Apple servers. Apple does not process or store any of this information in a format that can identify you personally. You can disable the ability to use Apple Pay on your Mac in your iPhone settings. Go to "Wallet & Apple Pay" and turn off "Allow Payments on Mac."

Further information on data protection regarding Apple Pay can be found at the following web address: https://support.apple.com/de-de/HT203027
- Google Pay

If you choose the “Google Pay” payment method provided by Google Ireland Limited (Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland; “Google”), payment is processed via the “Google Pay” application on your mobile device—which must run on at least Android 4.4 (“KitKat”) and feature NFC functionality—by charging a payment card stored in Google Pay or using a payment system verified therein (e.g., PayPal). To authorize a Google Pay payment exceeding €25.00, you must first unlock your mobile device using the verification method you have set up (such as facial recognition, a password, a fingerprint, or a pattern).

For the purpose of payment processing, the information you provide during the ordering process, along with details of your order, is transmitted to Google. Google then transmits the payment information stored in your Google Pay account to the originating website in the form of a unique transaction number, which serves to verify that payment has been made. This transaction number does not contain any actual payment details regarding the payment method stored in Google Pay; instead, it is generated and transmitted as a unique, one-time numeric token. In all transactions involving Google Pay, Google acts solely as an intermediary for processing the payment. The transaction itself takes place exclusively between the user and the originating website through the debiting of the payment method stored in Google Pay.

To the extent that personal data is processed during the described transmissions, such processing takes place exclusively for the purpose of payment processing in accordance with Art. 6(1)(b) GDPR.

Google reserves the right to collect, store, and analyze certain transaction-specific information for every transaction made via Google Pay. This includes the date, time, and amount of the transaction; the merchant's location and description; a description of the purchased goods or services provided by the merchant; photos you have attached to the transaction; the names and email addresses of the seller and buyer (or sender and recipient); the payment method used; your description of the reason for the transaction; and, where applicable, the offer associated with the transaction.

According to Google, this processing takes place exclusively in accordance with Art. 6(1)(f) GDPR, based on the legitimate interest in proper accounting, the verification of transaction data, and the optimization and maintenance of the functionality of the Google Pay service.

Google also reserves the right to combine the processed transaction data with other information collected and stored by Google during the use of other Google services.

The Google Pay Terms of Service can be found here:

https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=de
Further information on data protection for Google Pay can be found at the following web address:
https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de
- Klarna

One or more online payment methods from the following provider are available on this website: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden.

If you select a payment method offered by the provider that requires advance payment (such as credit card payment), the payment details you provided during the ordering process (including name, address, bank and payment card information, currency, and transaction number) as well as information regarding the content of your order will be transmitted to the provider in accordance with Art. 6(1)(b) GDPR. In this case, your data is transmitted solely for the purpose of processing the payment with the provider and only to the extent necessary for that purpose.

When selecting a payment method where the provider makes an advance payment (such as purchase on invoice, installment payment, or direct debit), you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, telephone number, and, if applicable, details regarding an alternative payment method).

To safeguard our legitimate interest in verifying our customers' solvency, we forward this data to the provider for the purpose of a credit check, in accordance with Art. 6(1)(f) GDPR. Based on the personal data you have provided as well as other data (such as shopping cart contents, invoice amount, order history, and payment history), the provider assesses whether the payment method you have selected can be approved, taking into account risks of non-payment and/or default.

In addition to the provider's internal criteria pursuant to Art. 6(1)(f) GDPR, identity and creditworthiness information from the following credit reference agencies may also be taken into account when deciding on the application:

https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The credit report may contain probability values (so-called score values). Where score values are incorporated into the result of the credit report, they are based on a scientifically recognized mathematical-statistical method. Address data, among other factors, are included in the calculation of the score values.

You may object to this processing of your data at any time by notifying us or the provider. However, the provider may remain entitled to process your personal data if this is necessary for processing payments in accordance with the contract.
- Paypal

One or more online payment methods from the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

If you select a payment method offered by the provider that requires advance payment, the payment details you provided during the ordering process (including name, address, bank and payment card information, currency, and transaction number) as well as information regarding the content of your order will be transmitted to the provider in accordance with Art. 6(1)(b) GDPR. In this case, your data is transmitted solely for the purpose of processing the payment with the provider and only to the extent necessary for that purpose.

If you select a payment method where we provide the service or goods in advance, you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, telephone number, and, if applicable, details regarding an alternative payment method).

Um in solchen Fällen unser berechtigtes Interesse an der Feststellung Ihrer Zahlungsfähigkeit zu wahren, werden diese Daten von uns gemäß Art. 6 Abs. 1 lit. f DSGVO zum Zwecke einer Bonitätsprüfung an den Anbieter weitergeleitet. Der Anbieter prüft auf Basis der von Ihnen angegebenen persönlichen Daten sowie weiterer Daten (wie etwa Warenkorb, Rechnungsbetrag, Bestellhistorie, Zahlungserfahrungen), ob die von Ihnen ausgewählte Zahlungsmöglichkeit im Hinblick auf Zahlungs- und/oder Forderungsausfallrisiken gewährt werden kann.

This website uses PayPal Checkout, an online payment system from PayPal that comprises PayPal's own payment methods and local payment methods from third-party providers.

When paying via PayPal, credit card via PayPal, direct debit via PayPal, or—if offered—"Pay Later" via PayPal, we transmit your payment data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal") for the purpose of processing the payment. This transmission takes place in accordance with Art. 6(1)(b) GDPR and only to the extent necessary for payment processing.

For the payment methods "Credit Card via PayPal," "Direct Debit via PayPal," or—if offered—"Pay Later via PayPal," PayPal reserves the right to conduct a credit check. For this purpose, your payment data may be transmitted to credit reference agencies in accordance with Art. 6(1)(f) GDPR, based on PayPal’s legitimate interest in assessing your creditworthiness. PayPal uses the result of the credit check—specifically the statistical probability of payment default—to decide whether to make the respective payment method available. The credit check may include probability values (so-called "score values"). Where score values are included in the credit check result, they are based on a scientifically recognized mathematical-statistical method. Address data, among other factors, are included in the calculation of these score values. You may object to this processing of your data at any time by notifying PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for processing payments in accordance with the contract.

If the PayPal "Purchase on Invoice" payment method is available and selected, your payment data is first transmitted to PayPal to prepare for the payment; PayPal then forwards this data to Ratepay GmbH, Franklinstraße 28-29, 10587 Berlin ("Ratepay"), to process the payment. The legal basis in each case is Art. 6(1)(b) GDPR. In this instance, Ratepay conducts an identity and credit check in its own name to assess creditworthiness—in accordance with the principle mentioned above—and shares your payment data with credit reference agencies based on the legitimate interest of assessing creditworthiness pursuant to Art. 6(1)(f) GDPR. A list of the credit reference agencies Ratepay may consult can be found here: https://www.ratepay.com/legal-payment-creditagencies/

When using a local third-party payment method, your payment data is first transmitted to PayPal to prepare for the payment, in accordance with Art. 6(1)(b) GDPR. Depending on the available local payment method you select, PayPal then transmits your payment data to the respective provider to execute the payment, in accordance with Art. 6(1)(b) GDPR:

- Apple Pay (Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Irland)
- Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Irland)
- iDeal (Currence Holding BV, Beethovenstraat 300 Amsterdam, Netherlands)
- bancontact (Bancontact Payconiq Company, Rue d'Arlon 82, 1040 Brussels, Belgium)
- blik (Polski Standard Płatności sp. z o.o., ul. Czerniakowska 87A, 00-718 Warsaw, Poland)
- eps (PSA Payment Services Austria GmbH, Handelskai 92, Gate 2
1200 Vienna, Austria)
- MyBank (PRETA S.A.S, 40 Rue de Courcelles, F-75008 Paris, France)
- Przelewy24 (PayPro SA, Kanclerska 15A, 60-326 Poznań, Poland)

For further information regarding data protection, please refer to PayPal's privacy policy: https://www.paypal.com/de/legalhub/paypal/privacy-full
- WooCommerce Payments

One or more online payment methods from the following provider are available on this website: Automattic Inc., 60 29th Street #343, San Francisco, CA 94110-4929, USA.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection based on an adequacy decision by the European Commission.

8.5 Electronic right of withdrawal for distance contracts

Consumers who enter into contracts on this website that are subject to a statutory right of withdrawal have the option to declare their withdrawal using an electronic withdrawal function, in accordance with the applicable withdrawal provisions.

When using the right of withdrawal function, in addition to details identifying the contract to be revoked, further personal information—such as the consumer's first name, surname, and email address—must be provided or confirmed.

The collection of this information and its transmission to us are carried out in accordance with Art. 6(1)(b) GDPR and only to the extent necessary for the proper processing of the revocation. The personal data provided is also used—on the basis of Art. 6(1)(b) GDPR—to confirm receipt of the notice of revocation via email. An additional legal basis for the processing is Art. 6(1)(c) GDPR; we are legally required to provide an electronic revocation function for consumer distance contracts involving payment.

9) Online-Marketing

Brevo Tracker

This website uses the software-based marketing service of the following provider to deliver and synchronize various customer management services: Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.

The service enables the automated processing of feed activities, the management of advertising across marketing channels, and the analysis of marketing campaign performance, as well as centralized email marketing and contact management.

Cookies—small text files stored locally in your web browser's cache on your device—are used to fulfill various functions and enable us to analyze your use of the website. In doing so, the cookies capture specific information, such as your IP address, location, and the time the page was accessed.

All processing operations described above—in particular, the setting of cookies to access information on the device being used—are carried out only if you have given us your express consent in accordance with Art. 6(1)(a) GDPR. You may revoke your consent at any time with effect for the future by deactivating this service in the "cookie consent tool" provided on the website.

Other legal bases for data processing activities applicable in the context of specific service functions (such as the requirement for explicit consent pursuant to Art. 6(1)(a) GDPR for sending newsletters) remain unaffected by this.

We have concluded a Data Processing Agreement (DPA) with the provider to ensure the protection of our website visitors' personal data and to prohibit any unauthorised disclosure to third parties.

10) Retargeting/remarketing and conversion tracking

10.1 Meta Pixel

As part of our online services, we use the "Meta Pixel" service provided by: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Meta").

When a user clicks on an advertisement we have placed on Facebook and/or Instagram, the URL of our linked page is extended by a parameter using "Meta Pixel." Following the redirect, this URL parameter is then stored in the user's browser via a cookie set by the linked page itself.

This enables Meta, on the one hand, to identify visitors to our online services as a target audience for the display of advertisements (so-called "Ads"). Accordingly, we use this service to show the Facebook and/or Instagram ads we run only to users who have demonstrated an interest in our online services or who exhibit specific characteristics (e.g., interests in particular topics or products, determined based on the websites visited) that we transmit to Meta (so-called "Custom Audiences").

On the other hand, the “Meta Pixel” makes it possible to track whether users were redirected to our website after clicking on an advertisement and what actions they take there (so-called “conversion tracking”).

The data collected is anonymous to us, meaning it does not allow us to draw conclusions about the users' identities. However, the data is stored and processed by Meta, making it possible to link it to the respective user profile and allowing Meta to use the data for its own advertising purposes.

We have concluded a Data Processing Agreement (DPA) with the provider to ensure the protection of our website visitors' personal data and to prohibit any unauthorised disclosure to third parties.

The information generated by Meta is generally transmitted to a Meta server and stored there; in this context, a transfer to servers of Meta Platforms Inc. in the USA may also occur.

10.2 Pinterest-Tag Conversion-Tracking

This website uses the conversion tracking technology of the following provider: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland.

If you arrived at our website via an advertisement on the provider's domain, the success of the advertisement can be tracked using cookies and/or comparable technologies (tracking pixels, web beacons, pings, or HTTP requests).

To this end, tracking technology is used to retrieve specific device and browser information—potentially including your IP address—in order to capture and analyze user actions predefined by us (e.g., completed transactions, leads, website search queries, or views of product pages). This enables the compilation of statistics regarding user behavior on our website following redirection from an advertisement, which helps us optimize our offerings.
All processing operations described above—in particular, the setting of cookies to access information on the device being used—are carried out only if you have given us your express consent in accordance with Art. 6(1)(a) GDPR. You may revoke your consent at any time with effect for the future by deactivating this service in the "cookie consent tool" provided on the website.

We have concluded a Data Processing Agreement (DPA) with the provider to ensure the protection of our website visitors' personal data and to prohibit any unauthorised disclosure to third parties.

10.3 WooCommerce Order Attribution Tracking

This website uses the conversion tracking technology of the following provider: Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA.

To this end, tracking technology is used to retrieve specific device and browser information—potentially including your IP address—in order to record and analyze user actions predefined by us (e.g., completed transactions, leads, website search queries, or views of product pages). This enables the compilation of statistics regarding user behavior on our website following a referral from an advertisement, which helps us optimize our offerings.
All processing operations described above—in particular, the setting of cookies to access information on the device being used—are carried out only if you have given us your express consent in accordance with Art. 6(1)(a) GDPR. You may revoke your consent at any time with effect for the future by deactivating this service in the "cookie consent tool" provided on the website.

We have concluded a Data Processing Agreement (DPA) with the provider to ensure the protection of our website visitors' personal data and to prohibit any unauthorised disclosure to third parties.

11) Page functionalities

11.1 Facebook-Plugins

Our website uses plugins from the social network of the following provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

These plugins enable direct interactions with content on the social network.

To enhance the protection of your data when visiting our website, the plugins are initially deactivated and integrated into the page using a so-called "2-click" or "Shariff" solution.

This integration ensures that no connection to the provider's servers is established when a page of our website containing such plugins is accessed.

If you are logged into an existing user profile on the provider's social network, information regarding interactions carried out via the plugins will also be published there and displayed to your contacts.
You can revoke your consent at any time by deactivating the enabled plugin—simply click on it again. However, the revocation does not affect data that has already been transmitted to the provider.

Data may also be transferred to: Meta Platforms Inc., USA

We have concluded a Data Processing Agreement (DPA) with the provider to ensure the protection of our website visitors' personal data and to prohibit any unauthorised disclosure to third parties.

11.2 Instagram-Plugins

Our website uses plugins from the social network of the following provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

These plugins enable direct interactions with content on the social network.

To enhance the protection of your data when visiting our website, the plugins are initially deactivated and integrated into the page using a so-called "2-click" or "Shariff" solution.

This integration ensures that no connection to the provider's servers is established when a page of our website containing such plugins is accessed.

Only when you activate the plugins and thus give your consent to the data transfer in accordance with Article 6 Paragraph 1 Letter a of the GDPR will your browser establish a direct connection to the provider's servers. Regardless of whether you log in to an existing user profile, a certain amount of information about the device you use (including your IP address), your browser and your page history is transmitted to the provider and, if necessary, further processed there.

If you are logged into an existing user profile on the provider's social network, information regarding interactions carried out via the plugins will also be published there and displayed to your contacts.
You can revoke your consent at any time by deactivating the enabled plugin—simply click on it again. However, the revocation does not affect data that has already been transmitted to the provider.

Data may also be transferred to: Meta Platforms Inc., USA

We have concluded a Data Processing Agreement (DPA) with the provider to ensure the protection of our website visitors' personal data and to prohibit any unauthorised disclosure to third parties.

11.3 Pinterest-Plugins

This website uses the conversion tracking technology of the following provider: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland.

These plugins enable direct interactions with content on the social network.

To enhance the protection of your data when visiting our website, the plugins are initially deactivated and integrated into the page using a so-called "2-click" or "Shariff" solution.

This integration ensures that no connection to the provider's servers is established when a page of our website containing such plugins is accessed.

Data may also be transferred to: Pinterest Inc., USA

We have concluded a Data Processing Agreement (DPA) with the provider to ensure the protection of our website visitors' personal data and to prohibit any unauthorised disclosure to third parties.

For the transfer of data to the USA, the provider relies on the European Commission’s Standard Contractual Clauses, which are intended to ensure compliance with the European level of data protection.

12) Tools and Miscellaneous

12.1 Billbee

To handle our accounting, we use the cloud-based accounting software service provided by: Billbee GmbH, Arolser Str. 10, 34477 Twistetal, Germany.

The provider processes our company’s incoming and outgoing invoices—and, where applicable, bank transactions—in order to automatically capture invoices, match them to transactions, and generate financial accounting records through a semi-automated process.

To the extent that personal data is processed in this context, such processing is based on our legitimate interest in the efficient organization and documentation of our business operations pursuant to Art. 6(1)(f) GDPR.

12.2 Lexware Office

For handling our accounting, we use the cloud-based accounting software service provided by: Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany.

12.3 Cookie-Consent-Tool

This website uses a so-called "cookie consent tool" to obtain valid user consent for cookies and cookie-based applications that require consent. When the page is accessed, the "cookie consent tool" is displayed to users as an interactive interface where they can grant consent for specific cookies and/or cookie-based applications by selecting the corresponding checkboxes. The tool ensures that any cookies or services requiring consent are loaded only if the user has granted the necessary consent via these checkboxes. This guarantees that such cookies are placed on the user's device only when consent has been given.

The tool sets technically necessary cookies to save your cookie preferences. As a general rule, no personal user data is processed in this process.

If, in an individual case, the processing of personal data (such as the IP address) does occur for the purpose of storing, assigning, or logging cookie settings, this takes place in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in ensuring legally compliant, user-specific, and user-friendly cookie consent management—and, consequently, in the legally compliant design of our website.

A further legal basis for the processing is Article 6(1)(c) of the GDPR. As the controller, we are subject to a legal obligation to make the use of cookies that are not technically necessary conditional upon the respective user's consent.

Where necessary, we have entered into a data processing agreement with the provider that ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

Further information regarding the operator and the configuration options for the cookie consent tool can be found directly in the corresponding user interface on our website.

13) Rights of the data subject

13.1 Applicable data protection law grants you the following data subject rights (rights of access and intervention) vis-à-vis the controller regarding the processing of your personal data, with reference made to the cited legal basis for the respective conditions of exercise:

Right of access pursuant to Art. 15 GDPR;
Right to rectification pursuant to Art. 16 GDPR;
Right to erasure pursuant to Art. 17 GDPR;
Right to restriction of processing pursuant to Art. 18 GDPR;
Right to be informed pursuant to Art. 19 GDPR;
Right to data portability pursuant to Art. 20 GDPR;
Right to withdraw consent given, pursuant to Art. 7(3) GDPR;
Right to lodge a complaint pursuant to Art. 77 GDPR.

13.2 RIGHT TO OBJECT

If we process your personal data based on our overriding legitimate interests within the framework of a balancing of interests, you have the right to object to this processing at any time, with effect for the future, on grounds relating to your particular situation.

If you exercise your right to object, we will cease processing the data concerned. However, we reserve the right to continue processing if we can demonstrate compelling legitimate grounds for the processing that override your interests, fundamental rights, and fundamental freedoms, or if the processing serves the establishment, exercise, or defense of legal claims.

If your personal data is processed by us for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for such marketing purposes. You may exercise this right to object as described above.

If you exercise your right to object, we will stop processing the data concerned for direct marketing purposes.

14) Duration of storage of personal data

The duration for which personal data is stored is determined by the respective legal basis, the purpose of processing, and—where applicable—any relevant statutory retention periods (e.g., retention periods under commercial and tax law).

When processing personal data based on explicit consent pursuant to Art. 6(1)(a) GDPR, the data concerned is stored until you withdraw your consent.

Where statutory retention periods apply to data processed in the context of contractual or quasi-contractual obligations pursuant to Art. 6(1)(b) GDPR, such data are routinely deleted after the retention periods have expired, provided they are no longer required for the performance or initiation of a contract and/or we no longer have a legitimate interest in their continued storage.

When processing personal data based on Article 6(1)(f) of the GDPR, such data is stored until you exercise your right to object pursuant to Article 21(1) of the GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

When processing personal data for the purpose of direct marketing based on Article 6(1)(f) of the GDPR, such data is stored until you exercise your right to object pursuant to Article 21(2) of the GDPR.

Unless otherwise indicated in the other information provided in this statement regarding specific processing situations, stored personal data will otherwise be deleted when they are no longer necessary for the purposes for which they were collected or otherwise processed.

Stand: 22.08.2026, 03:56:32