1) Introduction and contact details of the controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below we inform you about how your personal data is handled when you use our website. Personal data means all data by which you can be personally identified.

1.2 The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Anna Kempa, Annashop, Franz Schubert Str. 40, 84478 Waldkraiburg, Germany, e-mail: kempa-anna@web.de. The controller responsible for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2) Data collection when you visit our website

2.1 When you use our website purely for information purposes, that is, if you do not register or otherwise transmit information to us, we only collect the data that your browser transmits to our server (so-called “server log files”). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

• The page of ours you visited
• Date and time at the moment of access
• Volume of data sent in bytes
• Source/reference from which you reached the page
• Browser used
• Operating system used
• IP address used (where applicable: in anonymised form)

The processing is carried out in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used in any other way. However, we reserve the right to check the server log files retrospectively should there be concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (for example orders or enquiries sent to us), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string “https://” and the padlock symbol in your browser bar.

3) Hosting & content delivery network

For the hosting of our website and the display of the page content we use a provider who renders its services itself or through selected subcontractors exclusively on servers within the European Union.

All data collected on our website is processed on these servers.

We have concluded a data processing agreement with the provider which ensures the protection of our site visitors’ data and prohibits unauthorised disclosure to third parties.

4) Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies, that is, small text files that are stored on your device. Some of these cookies are automatically deleted again when you close your browser (so-called “session cookies”), while others remain on your device for longer and make it possible to store page settings (so-called “persistent cookies”). In the latter case you can find the storage period in the overview of the cookie settings in your web browser.

Where personal data is also processed by individual cookies we use, the processing is carried out in accordance with Art. 6 (1) (b) GDPR for the performance of the contract, in accordance with Art. 6 (1) (a) GDPR where consent has been given, or in accordance with Art. 6 (1) (f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of your visit.

You can set your browser so that you are informed about the setting of cookies and can decide individually whether to accept them, or exclude the acceptance of cookies for certain cases or in general.

Please note that if cookies are not accepted, the functionality of our website may be limited.

5) Contacting us

When you contact us (for example via the contact form or by e-mail), personal data is processed exclusively for the purpose of handling and answering your enquiry and only to the extent necessary for this.

The legal basis for processing this data is our legitimate interest in answering your enquiry pursuant to Art. 6 (1) (f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 (1) (b) GDPR. Your data will be deleted when it can be inferred from the circumstances that the matter concerned has been conclusively clarified and provided that no statutory retention obligations prevent this.

6) Comment function

Within the comment function on this website, in addition to your comment, details of the time the comment was created and the commenter name you have chosen are stored and published on this website. Your IP address is also logged and stored. This storage of the IP address takes place for security reasons and in the event that the person concerned infringes the rights of third parties or posts unlawful content through a comment. We need your e-mail address in order to contact you if a third party objects to your published content as unlawful.

The legal bases for storing your data are Art. 6 (1) (b) and (f) GDPR. We reserve the right to delete comments if they are objected to as unlawful by third parties.

7) Data processing when a customer account is opened

In accordance with Art. 6 (1) (b) GDPR, personal data continues to be collected and processed to the extent required in each case if you provide it to us when opening a customer account. You can see which data is required to open an account from the input mask of the corresponding form on our website.

Your customer account can be deleted at any time by sending a message to the address of the controller given above. After your customer account has been deleted, your data will be deleted, provided that all contracts concluded through it have been fully performed, no statutory retention periods prevent this and we no longer have a legitimate interest in continued storage.

8) Data processing for order handling

8.1 Insofar as this is necessary for the performance of the contract for delivery and payment purposes, the personal data collected by us is passed on to the transport company commissioned and the credit institution commissioned in accordance with Art. 6 (1) (b) GDPR.

Insofar as we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we process the contact details you provided when ordering (name, address, e-mail address) in order to inform you personally about upcoming updates within the period provided for by law, by a suitable means of communication (for example by post or e-mail), within the scope of our statutory information obligations pursuant to Art. 6 (1) (c) GDPR. Your contact details are used strictly for the purpose of notifications about updates owed by us and are processed by us for this purpose only to the extent necessary for the respective information.

For the handling of your order we also work with the following service provider(s), who support us in whole or in part in the performance of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

8.2 Disclosure of personal data to shipping service providers

If the goods are delivered by the transport service provider DHL (Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn), we pass on your e-mail address to DHL before delivery of the goods in accordance with Art. 6 (1) (a) GDPR for the purpose of arranging a delivery date or announcing the delivery, provided that you have given your express consent to this during the ordering process. Otherwise, for the purpose of delivery, we pass on only the name of the recipient and the delivery address to DHL in accordance with Art. 6 (1) (b) GDPR. The disclosure is made only to the extent necessary for the delivery of the goods. In this case, prior arrangement of the delivery date with DHL or the delivery announcement is not possible.

Consent may be revoked at any time with effect for the future, either towards the controller named above or towards the transport service provider DHL.

If the goods are delivered by the transport service provider Hermes (Hermes Logistik Gruppe Deutschland GmbH, Essener Straße 89, 22419 Hamburg), we pass on your e-mail address to Hermes before delivery of the goods in accordance with Art. 6 (1) (a) GDPR for the purpose of arranging a delivery date or announcing the delivery, provided that you have given your express consent to this during the ordering process. Otherwise, for the purpose of delivery, we pass on only the name of the recipient and the delivery address to Hermes in accordance with Art. 6 (1) (b) GDPR. The disclosure is made only to the extent necessary for the delivery of the goods. In this case, prior arrangement of the delivery date with Hermes or the transmission of status information on the delivery is not possible.

Consent may be revoked at any time with effect for the future, either towards the controller named above or towards the transport service provider Hermes.

8.3 Use of payment service providers (payment services)

Mollie

One or more online payment methods from the following provider are available on this website: Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands

If you select a payment method from the provider under which you pay in advance (for example card payment), the payment data you provide during the ordering process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order is passed on to that provider in accordance with Art. 6 (1) (b) GDPR. In this case, your data is passed on exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this.

8.4 Electronic withdrawal function for distance contracts

Consumers who conclude contracts on this website for which a statutory right of withdrawal exists have the option of declaring their withdrawal via an electronic withdrawal function in accordance with the applicable withdrawal provisions.

When using the withdrawal function, in addition to information identifying the contract to be withdrawn from, further personal information such as the consumer’s first and last name and e-mail address must be provided or confirmed.

The collection of this information and its transmission to us takes place in accordance with Art. 6 (1) (b) GDPR and only to the extent necessary for the proper processing of the withdrawal. Also on the basis of Art. 6 (1) (b) GDPR, the personal data provided is used to confirm receipt of the declaration of withdrawal by e-mail. A further legal basis for the processing is Art. 6 (1) (c) GDPR. We are required by law to provide an electronic withdrawal function for consumer distance contracts for a fee.

9) Web analysis services

Plausible

This website uses “Plausible”, a web analysis tool from Plausible Insights OÜ, Västriku tn 2, 50403, Tartu, Estonia. It is used to record and evaluate, in anonymised form, the interactions of randomly selected individual visitors with the website in order to obtain information about the use of the site (such as visitor numbers, page views, bounce rates and time spent on the site). Personal data is not processed at any point. When this website is used, Plausible collects exclusively non-personal data such as information about the browser and the user agent. This is stored in a form that cannot be related to a person and evaluated for statistical purposes. It is deleted as soon as the data is no longer required for our evaluation purposes. If personal data is nevertheless processed in an individual case, the processing is carried out on the basis of our legitimate interest in the statistical evaluation of user behaviour for optimisation purposes pursuant to Art. 6 (1) (f) GDPR.

10) Site functionalities

Google reCAPTCHA

On this website we use the CAPTCHA service of the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

Data may also be transmitted to: Google LLC, USA. For the visual design of the captcha window, fonts loaded from the internet by Google are used. No information is processed beyond that mentioned above, which is already transmitted to Google through the functionality of reCAPTCHA.

The service checks whether an entry is made by a natural person or improperly by automated machine processing, and blocks spam, DDoS attacks and similar automated malicious access. In order to ensure that an action is carried out by a human and not by an automated bot, the provider collects the IP address of the device used, identification data of the browser and operating system type used, as well as the date and duration of the visit, and transmits this to the provider’s servers for evaluation. Cookies may be used here, that is, small text files stored in the browser of the device.

Insofar as the processing described above is carried out on the basis of cookies, these are only set if you have given us your express consent in accordance with Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service in the “cookie consent tool” provided on the website.

If the processing described above is carried out without the use of cookies, the legal basis is our legitimate interest in establishing individual responsibility on the internet and in preventing misuse and spam pursuant to Art. 6 (1) (f) GDPR.

We have concluded a data processing agreement with the provider which ensures the protection of our site visitors’ data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which on the basis of an adequacy decision of the European Commission ensures compliance with the European level of data protection.

11) Tools and miscellaneous

Cookie consent tool

To obtain effective user consent for cookies requiring consent and cookie-based applications, this website uses a so-called “cookie consent tool”. The “cookie consent tool” is shown to you when you access the site in the form of an interactive user interface on which you can give consent for certain cookies and/or cookie-based applications by ticking boxes. Through the use of the tool, all cookies/services requiring consent are only loaded if you give the corresponding consent by ticking the box. This ensures that such cookies are only set on your device where consent has been given.

The tool sets technically necessary cookies in order to store your cookie preferences. Personal user data is generally not processed in this context.

If, in an individual case, personal data (such as the IP address) is nevertheless processed for the purpose of storing, assigning or logging cookie settings, this is carried out in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in legally compliant, user-specific and user-friendly consent management for cookies and thus in a legally compliant design of our website.

A further legal basis for the processing is Art. 6 (1) (c) GDPR. As controllers, we are under a legal obligation to make the use of technically unnecessary cookies dependent on the respective user consent.

Where necessary, we have concluded a data processing agreement with the provider which ensures the protection of our site visitors’ data and prohibits unauthorised disclosure to third parties.

You can find further information about the operator and the setting options of the cookie consent tool directly in the corresponding user interface on our website.

12) Rights of the data subject

12.1 Applicable data protection law grants you the following data subject rights (rights to information and intervention) vis-à-vis us as the controller with regard to the processing of your personal data, whereby reference is made to the legal basis cited for the respective conditions of exercise:

• Right of access pursuant to Art. 15 GDPR
• Right to rectification pursuant to Art. 16 GDPR
• Right to erasure pursuant to Art. 17 GDPR
• Right to restriction of processing pursuant to Art. 18 GDPR
• Right to notification pursuant to Art. 19 GDPR
• Right to data portability pursuant to Art. 20 GDPR
• Right to withdraw consent given pursuant to Art. 7 (3) GDPR
• Right to lodge a complaint pursuant to Art. 77 GDPR

12.2 Right to object

IF, WITHIN THE SCOPE OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. WE RESERVE THE RIGHT TO CONTINUE PROCESSING, HOWEVER, IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

13) Duration of storage of personal data

The duration of the storage of personal data is determined by the respective legal basis, the purpose of processing and — where applicable — additionally by the respective statutory retention period (for example retention periods under commercial and tax law).

Where personal data is processed on the basis of express consent pursuant to Art. 6 (1) (a) GDPR, the data concerned is stored until you withdraw your consent.

Where statutory retention periods exist for data processed within the scope of legal or quasi-legal obligations on the basis of Art. 6 (1) (b) GDPR, this data is routinely deleted after expiry of the retention periods, provided that it is no longer required for the performance or initiation of a contract and/or we no longer have a legitimate interest in continued storage.

Where personal data is processed on the basis of Art. 6 (1) (f) GDPR, this data is stored until you exercise your right to object under Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data is processed for the purpose of direct marketing on the basis of Art. 6 (1) (f) GDPR, this data is stored until you exercise your right to object under Art. 21 (2) GDPR.

Unless otherwise stated in the other information in this declaration on specific processing situations, stored personal data is otherwise deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

Copyright notice: This privacy policy was drawn up by the specialist lawyers of IT-Recht Kanzlei and is protected by copyright (www.it-recht-kanzlei.de)