Data protection

Privacy policy and information on any consents you have given

As the controller within the meaning of data protection law, we inform you below about the processing of your personal data by us.

I. The concept of personal data and other important terms

Personal data means, put simply, all information relating to you personally as a data subject. Provisions on what the term "personal data" means and what other terms relevant to the data protection information set out below mean can be found in Article 4 GDPR (General Data Protection Regulation).

II. Name and contact details of the controller; contact details of the data protection officer

The controller is, put simply, the party which alone or jointly with others determines the purposes and means of the processing of personal data. The name and contact details of the controller (and, where a data protection officer has been designated, the contact details of that officer) can be found in our company details.

III. Purposes of the processing of your personal data; legal bases for the processing

We process your personal data in the course of our business activities for the purposes set out below and on the legal bases stated for each of them.

In order to safeguard our legitimate interest in maintaining the proper operation of our website, in providing functions that are as user-friendly as possible and in analysing the use of our website, the processing of your personal data is based on Article 6(1)(f) GDPR.
In order to take steps at your request prior to entering into a contract, the processing of your personal data is based on Article 6(1)(b) GDPR.
In order to safeguard our legitimate interest in responding to enquiries and in taking further steps at your request, the processing of your personal data is based on Article 6(1)(f) GDPR.
In order to perform a contract to which you are party, the processing of your personal data is based on Article 6(1)(b) GDPR.
In order to carry out measures for advertising purposes, the processing of your personal data is based either on the consent you have given in accordance with Article 6(1)(a) GDPR or on Article 6(1)(f) GDPR.
In order to comply with the legal obligations to which we are subject, the processing of your personal data is based on Article 6(1)(c) GDPR.
In order to safeguard our legitimate interest in asserting our rights and in defending against claims brought against us, the processing of your personal data is based on Article 6(1)(f) GDPR.

Our systems are secured in line with the state of the art by means of technical and organisational measures in order to protect your personal data against access, alteration or disclosure by unauthorised persons as well as against loss and destruction.

Information on the processing of your personal data for each of the purposes can be found in the corresponding further notes within this privacy policy.

IV. Transfer of your personal data to third parties; categories of recipients of your personal data

Insofar as this is necessary in order to achieve the purposes of the processing of your personal data, we transfer your personal data to third parties within the framework of the statutory requirements. Detailed information on the transfer of your personal data to third parties for each of the purposes can be found in the corresponding further notes within this privacy policy. Where your personal data is transferred to third parties, the scope of the data transferred is limited to the minimum necessary.

V. Scope of the processing of your personal data for each of the purposes

Below we inform you in detail about the processing of your personal data for the various purposes.

1. Use of our website for information purposes

We operate our website on our own infrastructure, which we administer ourselves. The hardware used for this purpose is leased from: GS WEBSERVICES, proprietor Georg Kröber, Rodenbergweg 2, 97688 Bad Kissingen, Germany. Operation, administration and data storage are carried out by us; the provider acts exclusively on our instructions.

If you visit our website without transmitting any information to us, we process only the personal data that your browser transmits to our server. This concerns the following data, which is technically necessary in order to display our website to you and to ensure stability and security:

the page you accessed
date and time of the request
volume of data transferred
source or referrer from which you reached the page
browser you are using
operating system you are using
your IP address

The processing of your personal data is based on Article 6(1)(f) GDPR in order to safeguard our legitimate interest in maintaining the proper operation of our website, in providing functions that are as user-friendly as possible and in analysing the use of our website.

Your personal data will be erased after 6 months, unless it continues to be required for the assertion of rights or the enforcement of claims arising from acts directed against the proper operation of our website. In such cases, erasure takes place without delay once the relevant proceedings have been concluded.

You are not obliged to provide your personal data. However, failure to provide your personal data would mean that our website could not be displayed to you.

2. Handling of enquiries

If you contact us with an enquiry or a request, we process the personal data as well as the information and documents you transmit to us. Irrespective of the channel by which you send us your enquiry or request, this may concern:

date and time of contact
name details
contact details
data relating to the enquiry or request
information and documents transmitted

The processing of your personal data and of the information or documents transmitted is based — depending on the content of your enquiry or request — on Article 6(1)(b) GDPR in order to take steps prior to entering into a contract, or on Article 6(1)(b) GDPR in order to perform a contract to which you are party, or on Article 6(1)(f) GDPR in order to safeguard our legitimate interest in responding to enquiries and requests and in taking further steps in connection with handling them.

Insofar as this is necessary in order to handle your enquiry or request, we transfer your personal data to third parties within the framework of the statutory requirements. Where your personal data is transferred to third parties, the scope of the data transferred is limited to the minimum necessary.

Your personal data will be erased once your enquiry or request has been dealt with, but at the earliest upon expiry of the retention periods under tax and commercial law of 6 and 10 years respectively, unless we are permitted to continue processing the data for another purpose within the framework of the statutory requirements and in accordance with the information in this privacy policy.

You are not obliged to provide your personal data. However, failure to provide your personal data would mean that we could not deal with your enquiry or request.

3. Performance of contracts

If you transmit personal data to us for the purpose of entering into a contract or in connection with a contract, we process the data you transmit in order to perform the contract. This concerns your customer data (for example your name and address) and the contract data (for example details of the products covered by the contract as well as payment and delivery information).

The processing of your personal data is based on Article 6(1)(b) GDPR in order to perform a contract to which you are party.

Insofar as this is necessary in order to perform the contract with you, we transfer your personal data to third parties within the framework of the statutory requirements. This transfer is made to the service providers involved in the performance of the contract. These are the providers of the processing tools we use, the companies commissioned with transport and the payment service providers commissioned with payment matters.

If you use the payment service provider PayPal to process payments, we expressly point out that the PayPal privacy statement applies to all PayPal transactions: https://www.paypal.com/uk/legalhub/paypal/privacy-full

Where your personal data is transferred to third parties, the scope of the data transferred is limited to the minimum necessary.

Your personal data will be erased upon expiry of the retention periods under tax and commercial law of 6 and 10 years respectively, unless we are permitted to continue processing the data for another purpose within the framework of the statutory requirements and in accordance with the information in this privacy policy.

Provision of your personal data is necessary in order to conclude a contract with us. You are not obliged to provide your personal data. However, failure to provide your personal data would mean that we could not conclude any contract with you.

4. Shipping information

4.1 Address validation

We wish to ensure that your delivery address is valid. In order to provide these functions we use the service provider endereco UG (haftungsbeschränkt), Balthasar-Neumann-Straße 4b, 97236 Randersacker, Germany. The service provider processes the data exclusively on our instructions. The legal basis for the transfer, processing and temporary storage of the data by the service provider is Article 6(1)(b) GDPR, since in order to perform the contract or to take steps prior to entering into a contract it is essential that some of the data you have entered in the form is checked for accuracy. The service provider processes the following data:

address (country, town or city, postcode, street and, where applicable, house number)

The data is processed separately by the service provider and is not combined. Enquiries are erased by the service provider as soon as the status of the data entered has been determined and storage in the online shop has been completed, and at the latest after 30 days.

4.2 Transport service providers

For the delivery of our products we work with various shipping service providers such as DHL, DPD, GLS and FedEx. For larger consignments we also use hauliers such as Dachser and Raben. In order to ensure smooth delivery by the hauliers, we pass on the customer's telephone number where necessary. This serves to announce the delivery in advance and, where applicable, to agree delivery details.

5. Payment service providers

5.1 Adyen

We work with the payment service provider Adyen N.V. (hereinafter "Adyen"), Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Netherlands. Adyen is a full payment service provider which handles, among other things, the processing of payments.

The data required for the relevant payment method (for example credit card) is transferred to Adyen, insofar as it is not collected directly by the payment service concerned (for example PayPal).

The transfer serves the purposes of identity verification, payment processing, creditworthiness assessment and fraud prevention. Insofar as this is necessary in order to fulfil the contractual obligations, Adyen also passes the personal data on to service providers or subcontractors. The legal basis for the processing is Article 6(1)(b) and (f) GDPR. Further information on the processing of your data by Adyen can be found here: https://www.adyen.com/privacy-policy

5.2 PayPal

If you use PayPal for payment, we transfer the contract data as part of the payment processing to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal"). The legal basis for this is Article 6(1)(b) GDPR.

PayPal reserves the right to obtain a credit report for certain payment methods (credit card, direct debit, "purchase on invoice via PayPal") for the purpose of deciding whether to make the relevant payment method available. Such a report may contain so-called score values (probability values). Insofar as they form part of the credit report, the score values are based on a scientifically recognised mathematical and statistical procedure. Data such as the customer's address is taken into account in the calculation, among other factors. More detailed information on data processing by PayPal can be found in their privacy statement at: https://www.paypal.com/uk/legalhub/paypal/privacy-full

5.3 Klarna

The Klarna payment methods we offer (for example purchase on invoice) are handled via Adyen or Mollie. We transfer the contract information required for this purpose to the payment service provider concerned; that provider passes it on to Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden, hereinafter "Klarna". Further information on data processing by Klarna can be found in their privacy notice: https://www.klarna.com/uk/privacy/

5.4 Mollie

For some of the payment methods offered we work with Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands, hereinafter "Mollie". Mollie is a payment service provider authorised by the Dutch central bank and handles the processing of the payments offered through it. The data required for the relevant payment method is transferred to Mollie, insofar as it is not collected directly by the payment service concerned. The transfer serves the purposes of payment processing and fraud prevention. The legal basis for the processing is Article 6(1)(b) and (f) GDPR. Further information on the processing of your data by Mollie can be found here: https://www.mollie.com/legal/privacy

5.5 Additional information

No payment data is collected by us during the online ordering process. Your data, such as your name, email address and other payment information, is forwarded to the relevant credit institution depending on the payment method. This is done on the basis of Article 6(1)(b) GDPR.

6. Newsletter

6.1 Advertising by newsletter

When you subscribe to our newsletter, we process the email address you have transmitted to us — and, if you transmit further personal data, that data as well — in order to send you information about our offers by email. In this respect, only the provision of your email address is mandatory. If you voluntarily transmit further personal data, we may process that data in order to address you personally in the newsletter.

When you subscribe to our newsletter, you give a consent with the following content: "I agree to be informed by email about interesting offers and therefore consent to the processing of my email address and of the further personal data I have provided for the purpose of sending the newsletter. I may withdraw this consent at any time and without giving reasons, with effect for the future. The lawfulness of the processing carried out up to the withdrawal is not affected by the withdrawal."

Subscription to our newsletter takes place by means of the so-called double opt-in procedure. This means: after subscribing, you will first receive an email notifying you of the subscription to the newsletter together with a request to confirm the subscription. Your confirmation of the subscription is necessary in order to document the consent required for sending the newsletter and in order to be able to detect subscriptions using third-party email addresses. In connection with newsletter subscriptions and confirmations, the IP address as well as the date and time are logged so that, where necessary, it can be demonstrated that consent was given in accordance with the statutory requirements.

The processing of your personal data is based on the consent you have given in this respect in accordance with Article 6(1)(a) GDPR.

You may withdraw your consent at any time and without giving reasons, with effect for the future. A corresponding notification to the controller, whose contact details can be found in the information on the controller, is sufficient for this purpose. The lawfulness of the processing carried out up to the withdrawal is not affected by the withdrawal.

If you withdraw your consent or unsubscribe from our newsletter, your email address and any further data transmitted will be erased without delay, unless we are permitted to continue processing the data for another purpose within the framework of the statutory requirements and in accordance with the information in this privacy policy.

In order to receive our newsletter, provision of your email address is required as a minimum. You are not obliged to provide your email address. However, failure to provide your email address would mean that you could not subscribe to our newsletter.

6.2 Newsletter tracking

Our newsletter contains links equipped with tracking technologies. These enable us to analyse the behaviour of newsletter recipients, for example whether an email has been opened and which links within it have been clicked. This allows us to measure the effectiveness of our newsletter content and campaigns and to analyse which of our web pages have been visited or whether certain actions, such as a purchase, have taken place. We use the information obtained to optimise our offers and to tailor our content more closely to the interests of our users. This data is stored and analysed in our on-premise instance of Matomo. The data is not passed on to third parties.
If you do not agree to this type of data collection, you must unsubscribe from our newsletter.

7. Analysis and advertising tools

7.1 Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool with which we can integrate tracking or statistics tools and other technologies into our website. Google Tag Manager itself does not create user profiles, does not store cookies and does not carry out any independent analyses. It serves solely to manage and deliver the tools integrated by means of it. However, Google Tag Manager records your IP address (anonymised), which may also be transferred to Google's parent company in the USA. We have concluded a data processing addendum with Google.

The use of Google Tag Manager is based on Article 6(1)(f) GDPR. The website operator has a legitimate interest in the rapid and uncomplicated integration and management of various tools on its website. Where corresponding consent has been obtained, the processing is based exclusively on Article 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information in the user's terminal equipment (for example device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

Further information can be found in the terms of use for Google Tag Manager at: https://support.google.com/tagmanager/answer/7157428?hl=en

7.2 Matomo

This website uses the open source web analytics service Matomo.

Matomo enables us to collect and analyse data on the use of our website by visitors. This allows us, among other things, to find out when which page views took place and from which region they originate. We also record various log files (for example IP address, referrer, browsers and operating systems used) and can measure whether visitors to our website carry out certain actions (for example clicks, purchases and the like).

The use of this analytics tool is based on Article 6(1)(f) GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimise both its online offering and its advertising. Where corresponding consent has been requested, the processing is based exclusively on Article 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information in the user's terminal equipment (for example device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

7.2.1 IP anonymisation

When analysing with Matomo we use IP anonymisation. Your IP address is shortened before the analysis so that it can no longer be unambiguously attributed to you.

7.2.2 Hosting

We host Matomo exclusively on our own servers, so that all analysis data remains with us and is not passed on.

7.3 Google Ads

The website operator uses Google Ads. Google Ads is an online advertising programme of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads enables us to place advertisements in the Google search engine or on third-party websites when users enter certain search terms in Google. In addition, advertisements can be targeted on the basis of the user data held by Google (for example location data and interests). As the website operator, we can evaluate this data quantitatively, for example by analysing which search terms led to our advertisements being displayed and how many advertisements resulted in clicks.

The use of this service is based on your consent in accordance with Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent may be withdrawn at any time.

The transfer of data to the USA is based on the standard contractual clauses of the EU Commission. Details can be found at: https://policies.google.com/privacy/frameworks?hl=en and https://business.safety.google/controllerterms/.

The company is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA which is intended to ensure compliance with European data protection standards when processing data in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. You can obtain further information from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780

7.3.1 Google Ads Conversion Tracking

This website uses Google Conversion Tracking. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Conversion Tracking enables us and Google to recognise whether the user has carried out certain actions. For example, we can evaluate which products are viewed or purchased particularly frequently. This information is used to compile conversion statistics. We learn how many users in total clicked on our advertising and which actions they subsequently carried out. We do not receive any information that would enable us to identify the user personally. Google itself uses cookies or comparable recognition technologies for identification purposes.

The use of this service is based on your consent in accordance with Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent may be withdrawn at any time.

Further information on Google Conversion Tracking can be found in Google's privacy policy: https://policies.google.com/privacy?hl=en

7.3.2 Google Ads Remarketing

This website uses the Google Ads Remarketing functions. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads Remarketing enables us to assign persons who interact with our online offering to particular target groups in order subsequently to display interest-based advertising to them within the Google advertising network (remarketing or retargeting).

In addition, the advertising target groups created with Google Ads Remarketing can be linked to Google's cross-device functions. In this way, interest-based, personalised advertising messages tailored to you on the basis of your previous usage and browsing behaviour on one device (for example a mobile phone) can also be displayed to you on another of your devices (for example a tablet or computer).

If you have a Google account, you can object to personalised advertising at the following link: https://myadcenter.google.com/personalizationoff

The use of this service is based on your consent in accordance with Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent may be withdrawn at any time.

Further information and the privacy policy can be found in Google's data protection information at: https://policies.google.com/technologies/ads?hl=en

7.4 Microsoft Advertising

The website operator uses Microsoft Advertising. Microsoft Advertising is an online advertising programme of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

Microsoft Advertising enables us to place advertisements in the Bing search engine (and in partner search engines within the Microsoft advertising network) or on third-party websites when the user enters certain search terms in Bing. In addition, advertisements can be targeted on the basis of the user data held by Microsoft (for example location or interests). As the website operator, we can evaluate this data quantitatively, for example by analysing which search terms led to our advertisements being displayed and how many advertisements resulted in clicks.

On this website we use Universal Event Tracking (UET) from Microsoft Advertising. Pseudonymised data is recorded in order to track which actions you carry out on our web pages after clicking on a Microsoft Advertising advertisement. In doing so, UET records your IP address (anonymised), device identifiers, information about device and browser settings, the Microsoft Click ID, the time spent on the website, which areas of the website were accessed, which advertisement brought you to the website and which keywords were clicked.

The use of this service is based on your consent in accordance with Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent may be withdrawn at any time.

The transfer of data to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://learn.microsoft.com/en-us/compliance/regulatory/offering-eu-model-clauses.

The company holds a certification under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA which is intended to ensure compliance with European data protection standards when processing data in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. You can obtain further information from the provider at the following link: https://www.dataprivacyframework.gov/participant/6474

8. Other tools

8.1 Google reCAPTCHA

We use "Google reCAPTCHA" (hereinafter "reCAPTCHA") on this website. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

reCAPTCHA is used to check whether data entry on this website (for example in a contact form) is carried out by a human or by an automated program. To this end, reCAPTCHA analyses the behaviour of the website visitor on the basis of various characteristics. This analysis begins automatically as soon as the visitor enters the website. For the analysis, reCAPTCHA evaluates various items of information (for example IP address, the time the visitor spends on the website or mouse movements made by the user). The data recorded during the analysis is forwarded to Google.

The reCAPTCHA analyses run entirely in the background. Website visitors are not informed that an analysis is taking place.

The storage and analysis of the data is based on Article 6(1)(f) GDPR. The website operator has a legitimate interest in protecting its online offerings against abusive automated spying and against SPAM. Where corresponding consent has been requested, the processing is based exclusively on Article 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information in the user's terminal equipment (for example device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

Further information on Google reCAPTCHA can be found in Google's privacy policy and Google's terms of service at the following links:

https://policies.google.com/privacy?hl=en and https://policies.google.com/terms?hl=en

The company holds a certification under the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA which is intended to ensure compliance with European data protection standards when processing data in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. You can obtain further information on this from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

9. Compliance with the legal obligations to which we are subject

Within the framework of the corresponding requirements, we process your personal data in order to comply with the legal obligations to which we are subject.

In order to comply with the legal obligations to which we are subject, the processing of your personal data is based on Article 6(1)(c) GDPR.

Insofar as this is necessary in order to comply with the legal obligations to which we are subject, we transfer your personal data to third parties within the framework of the statutory requirements. Where your personal data is transferred to third parties, the scope of the data transferred is limited to the minimum necessary.

Your personal data will be erased once it is no longer required in order to comply with the legal obligations to which we are subject, unless we are permitted to continue processing the data for another purpose within the framework of the statutory requirements and in accordance with the information in this privacy policy.

10. Assertion of our rights and defence against claims brought against us

Where applicable, we process your personal data in order to safeguard our legitimate interest in asserting our rights and in defending against claims brought against us.

In such cases, the processing of your personal data is based on Article 6(1)(f) GDPR.

Insofar as this is necessary in order to safeguard our legitimate interest, we transfer your personal data to third parties within the framework of the statutory requirements. This transfer is made to the debt collection service providers involved or to our lawyers.

Where your personal data is transferred to third parties, the scope of the data transferred is limited to the minimum necessary.

Your personal data will be erased once the proceedings have been concluded, but at the earliest upon expiry of the retention periods under tax and commercial law of 6 and 10 years respectively, unless we are permitted to continue processing the data for another purpose within the framework of the statutory requirements and in accordance with the information in this privacy policy.

11. Use of cookies and other technologies

We may use cookies on our website so that you can use the functions we offer, so that we can analyse the use of the functions we offer and, where applicable, also so that we can present advertising that is as relevant as possible. Below we inform you about the cookies and other technologies we use.

Cookies are small files that are stored on your device and by means of which certain information is transmitted to us. The use of cookies serves to enable you to use certain functions and to make our offering more user-friendly overall.

11.1. Technically necessary cookies and technologies:

In part, the use of cookies and technologies on our website is technically necessary in order to be able to provide you with the functions of our service that you have requested and in order to document the consents you have given. For this reason, you cannot opt out of the use of the relevant cookies and technologies. You can prevent the storage of cookies by adjusting the settings of your browser software accordingly. You can delete stored cookies via the corresponding settings. We would point out, however, that in such cases you may not be able to use all the functions of our website to their full extent.

11.1.1. Consent tool

We use a so-called consent tool on our website, by means of which, in accordance with our data protection obligations under Article 5(2) GDPR in conjunction with Article 6(1)(c) GDPR, we provide information about the cookies we use and document whether and to what extent you have expressed a choice regarding the processing of your data.

Controller:

Purposes of the processing and legal basis:

Compliance with the data protection obligations to provide information about the cookies used and to store and document the consents given, in accordance with Article 5(2) GDPR in conjunction with Article 6(1)(c) GDPR

Provider of the consent tool used:

"Cookie-Script", a product of: Objectis Ltd., Laisves st. 60, LT-05120 Vilnius, Lithuania

Data protection information from the provider of the consent tool we use can be found here:

https://cookie-script.com/legal/privacy-policy

Name or designation of the cookie:

"CookieScriptConsent"

The cookie is used by the Cookie-Script.com service to store the visitor's consent settings for cookies.

Cookie lifetime:

1 month

11.1.2. Technically necessary cookies:

Technically necessary cookies are cookies that are required so that you can use the functions of our service that you have requested (in order to place an order). This concerns, for example, the storage of entries in connection with the use of the shopping basket function or the storage of entries following registration in connection with the creation of a customer account.

Controller:

The processing of your personal data is carried out by us as the controller. The name and contact details of the controller (and, where a data protection officer has been designated, the contact details of that officer) can be found in our company details. Information on whether the cookies are set by us (first-party cookies) or by a partner company (third-party cookies) can be found in the information on the individual cookies.

Purposes of the processing and legal basis:

In this respect, the processing of your personal data is based on Article 6(1)(b) GDPR in order to take steps at your request as the data subject prior to entering into a contract, or on Article 6(1)(b) GDPR in order to perform a contract to which you are party.

Name / designation	Origin	Validity / duration	Description
X-Magento-Vary	this website First-party cookie	1 day	The X-Magento-Vary cookie is used by the Magento 2 system to indicate that the version of a page requested by a user has changed. It enables different versions of the same page to be stored in the cache, for example Varnish.
user_allowed_save_cookie	this website First-party cookie	1 day	Indicates whether a customer is permitted to use cookies.
login_redirect	this website First-party cookie	2 days	Magento 2 system cookie
CookieScriptConsent	CookieScript	1 month	This cookie is used by the Cookie-Script.com service to store the visitor's consent settings for cookies. It is required for the Cookie-Script.com cookie banner to function properly.
mage-cache-sessid	this website First-party cookie	4 hours	The value of this cookie triggers the clearing of the local cache storage. When the cookie is removed by the backend application, the administrator clears the local storage and sets the cookie value to true.
form_key	this website First-party cookie	4 hours	This cookie is used to facilitate the caching of content in the browser and to speed up page loading.
PHPSESSID	this website First-party cookie	4 hours	Cookie generated by applications based on the PHP language. This is a generic identifier used to manage user session variables. It is normally a randomly generated number. The way in which it is used may be specific to the site. A good example, however, is maintaining a user's logged-in status between pages.
last_visited_store	this website First-party cookie	4 hours	Magento 2 system cookie
VISITOR_PRIVACY_METADATA	Google LLC. .youtube.com	6 months	This cookie serves to store the user's consent and privacy settings for their interaction with the website. It records data on the visitor's consent in relation to various privacy policies and settings in order to ensure that their preferences are honoured in future sessions.

11.2. Other cookies and technologies; right to withdraw consents given

In part, the use of cookies and technologies on our website is not technically essential in order to be able to provide you with the functions of our service that you have requested. These other cookies and technologies are used on our website only with your consent (opt-in). In order to enable you to make an informed decision, we inform you below about the relevant cookies and technologies. You can give your consent to the use of the relevant cookies and technologies by means of the consent tool we use. You may withdraw the consents given at any time and without giving reasons, with effect for the future. Should the consent tool not be available in your browser, a corresponding notification to the controller, whose contact details can be found in the information on the controller, is likewise sufficient for the withdrawal. The lawfulness of the processing carried out up to the withdrawal is not affected by the withdrawal.

Controller:

Purposes of the processing and legal basis:

Insofar as we use other cookies and technologies on our website, they are used to optimise the use of our website (preference cookies), to analyse the use of our website (statistics cookies) and to enable advertising that is as relevant as possible (marketing cookies). In this respect, the processing of your personal data is based on the consents you have given in accordance with Article 6(1)(a) GDPR.

11.2.1. Performance cookies

Name / designation

Origin

Validity / duration

Description

_pk_id.10.bf8c

this website

First-party cookie

1 year

This cookie name is associated with the open source web analytics platform Matomo. It is used to help website owners track visitor behaviour and measure site performance. It is a pattern cookie in which the prefix _pk_id is followed by a short series of numbers and letters which is assumed to be a reference code for the domain on which the cookie is set.

_pk_ses.10.bf8c

this website

First-party cookie

30 minutes

This cookie name is associated with the open source web analytics platform Matomo. It is used to help website owners track visitor behaviour and measure site performance. It is a pattern cookie in which the prefix _pk_ses is followed by a short series of numbers and letters which is assumed to be a reference code for the domain setting the cookie.

11.2.2. Targeting cookies

Name / designation	Origin	Validity / duration	Description
_glc_au	Google LLC.	3 months	This cookie is set by Doubleclick and contains information about how the end user uses the website as well as about advertising the end user may have seen before visiting this site. Personal data may be collected and used for personalised advertising. Further information on how Google uses personal data can be found here: https://business.safety.google/privacy/.
MUID	Microsoft Corporation .bing.com	1 year	This cookie is frequently used by Microsoft as a unique user identifier. It may be set by embedded Microsoft scripts. It is generally assumed that synchronisation across many different Microsoft domains is possible in order to enable user tracking.
_uetsid	Microsoft Corporation	1 day	This cookie is used by Bing to determine which advertisements should be served that may be relevant to the end user browsing the website.
MSPTC	Microsoft Corporation .bing.com	1 year	This cookie is used to track user engagement and interaction with the website in order to improve the customer experience and the functionality of the site. It may collect information about how users navigate and use the website, help identify preferences and improve service delivery.
IDE	Google LLC. .doubleclick.net	1 year	This cookie is set by Doubleclick and contains information about how the end user uses the website as well as about advertising the end user may have seen before visiting this site. Personal data may be collected and used for personalised advertising. Further information on how Google uses personal data can be found here: https://business.safety.google/privacy/.
_uetvid	Microsoft Corporation	1 year	This is a cookie used by Microsoft Bing Ads and is a tracking cookie. It enables us to get in touch with a user who has previously visited our website.
VISITOR_INFO1_LIVE	Google LLC. .youtube.com	6 months	This cookie is set by YouTube to track user preferences for YouTube videos embedded in websites. It can also determine whether the site visitor is using the new or the old version of the YouTube interface.

11.2.3. Functionality cookies

Name / designation

Origin

Validity / duration

Description

YSC

Google LLC.

.youtube.com

Session

This cookie is set by YouTube to track views of embedded videos.

VI. Period for which your personal data is stored, or criteria for determining that period

Your personal data will be erased once it is no longer required for the processing for the relevant purpose, unless we are permitted to continue processing the data for another purpose within the framework of the statutory requirements and in accordance with the information in this privacy policy. Information on the period for which your personal data is stored, or on the criteria for determining that period, can be found in the information on the processing of your personal data for each of the purposes in this privacy policy.

VII. Your rights

Overview

In order to ensure fair and transparent processing of personal data, you have the following rights as a data subject under data protection law:

the right of access under Article 15 GDPR,
the right to rectification under Article 16 GDPR,
the right to erasure under Article 17 GDPR,
the right to restriction of processing under Article 18 GDPR,
the right to data portability under Article 20 GDPR
the right to withdraw a consent given at any time under Article 7(3) GDPR,
the right to object to the processing under Article 21 GDPR, about which we inform you separately below
and the right to lodge a complaint with the supervisory authority under Article 77 GDPR, about which we inform you separately below.

Your right to object to the processing

The processing of personal data is permitted where the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child, Article 6(1)(f) GDPR.

As a data subject, you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(f) GDPR; this also applies to profiling based on those provisions.

If you exercise your right to object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms as a data subject, or the processing serves the establishment, exercise or defence of legal claims.

Where we process your personal data for direct marketing purposes, you have the right as a data subject to object at any time to the processing of personal data concerning you for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing. If, as a data subject, you object to processing for direct marketing purposes, your personal data will no longer be processed for those purposes.

Your right to lodge a complaint with the supervisory authority

As a data subject, you have the right, without prejudice to any other administrative or judicial remedy, to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the requirements of the GDPR. If you are resident in the United Kingdom, the competent supervisory authority is the Information Commissioner's Office (ICO).

VIII. Information on the basis for the provision of your personal data and on the possible consequences of failure to provide it

Insofar as this is necessary in order to ensure fair and transparent processing, information on the basis for the provision of your personal data and on the possible consequences of failure to provide it can be found in the information on the processing of your personal data for each of the purposes.