data protection
privacy policy
1. Data protection at a glance
General information
The following information provides a simple overview of what happens to your personal data
happens when you visit this website. Personal data is all data that you
can be personally identified. For detailed information on data protection, see
You can find our privacy policy below this text.
2 / 18
Data collection on this website
Who is responsible for data collection on this website?
The data processing on this website is carried out by the website operator. His contact details
can be found in the section “Information on the responsible body” in this data protection declaration.
How do we collect your data?
Your data is collected when you provide it to us. This may, for example, be
Data that you enter into a contact form.
Other data is collected automatically or with your consent when you visit the website through our IT systems
These are mainly technical data (e.g. Internet browser, operating system or time
of the page visit). This data is collected automatically as soon as you enter this website.
What do we use your data for?
Some of the data is collected to ensure error-free provision of the website. Other
Data can be used to analyze your user behavior.
What rights do you have regarding your data?
You have the right at any time to obtain information about the origin, recipient and purpose of your
You also have the right to request rectification or
to request deletion of this data. If you have given your consent to data processing,
You can revoke this consent at any time for the future. You also have the right to
to request the restriction of the processing of your personal data in certain circumstances.
Furthermore, you have the right to lodge a complaint with the competent supervisory authority.
You can contact us at any time with any questions about this or other issues relating to data protection.
analysis tools and third-party tools
When you visit this website, your surfing behavior may be statistically evaluated. This happens
especially with so-called analysis programs.
Detailed information about these analysis programs can be found in the following
privacy policy.
2. Hosting
We host the content of our website with the following provider:
Shopify
The provider is Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32,
Ireland (hereinafter “Shopify”).
Shopify is a tool for creating and hosting websites. When you visit our website,
Shopify stores your IP address as well as information about the device and browser you use.
Shopify also analyzes visitor numbers, visitor sources and customer behavior
and user statistics. When you make a purchase on our website, Shopify collects
also your name, email address, delivery and billing addresses, payment details and other
3 / 18
Data related to the purchase (e.g. telephone number, amount of sales made, etc.).
Shopify stores cookies in your browser for analytics purposes.
For details, see Shopify’s privacy policy:
https://www.shopify.de/legal/datenschutz.
The use of Shopify is based on Art. 6 Paragraph 1 Letter f of GDPR. We have a
legitimate interest in the most reliable presentation of our website. If a
If the corresponding consent has been requested, the processing will be carried out exclusively on the basis of Art.
6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG, insofar as the consent allows the storage of cookies or the
Access to information in the user's device (e.g. device fingerprinting) within the meaning of the TTDSG
Consent can be revoked at any time.
3. General information and mandatory information
data protection
The operators of these pages take the protection of your personal data very seriously. We treat your
personal data confidentially and in accordance with the statutory data protection regulations and
this privacy policy.
When you use this website, various personal data is collected.
Personal data is data that can be used to identify you personally. This
Privacy Policy explains what data we collect and what we use it for. It also explains how
and for what purpose this is done.
We would like to point out that data transmission over the Internet (e.g. when communicating by e-mail)
It is not possible to completely protect data from third-party access.
possible.
Note on the responsible body
The responsible body for data processing on this website is:
IQPAINTER
Hauptstraße 84
67697 Otterberg
Telephone: +49 (0) 6301 389 2002
E-Mail: iqpainter@gmx.de
The responsible body is the natural or legal person who, alone or jointly with others,
the purposes and means of processing personal data (e.g. names, e-mail addresses, etc.)
decides.
storage period
Unless a more specific storage period has been specified within this privacy policy,
Your personal data will be stored with us until the purpose for data processing no longer applies. If you
make a legitimate request for deletion or revoke consent to data processing,
Your data will be deleted unless we have other legally permissible reasons for storing your
personal data (e.g. retention periods under tax or commercial law); in
In the latter case, deletion will occur once these reasons no longer apply.
4 / 18
General information on the legal basis for data processing on this
website
If you have consented to data processing, we will process your personal data on
Basis of Art. 6 Para. 1 lit. a GDPR or Art. 9 Para. 2 lit. a GDPR, provided that special data categories
pursuant to Art. 9 (1) GDPR. In the case of an explicit consent to the transfer
If personal data is transferred to third countries, the data processing is also carried out on the basis of Art.
49 para. 1 lit. a GDPR. If you agree to the storage of cookies or to the access to information in
your device (e.g. via device fingerprinting), the data processing will also take place
on the basis of Section 25 Paragraph 1 TTDSG. The consent can be revoked at any time. If your data is
Contract performance or pre-contractual measures necessary, we process your
Data based on Art. 6 Paragraph 1 Letter b of GDPR. Furthermore, we process your data if it
are necessary to fulfill a legal obligation based on Art. 6 (1) (c) GDPR.
The data processing may also be based on our legitimate interest in accordance with Art. 6 para. 1 lit. f
DSGVO. The relevant legal bases in each individual case are explained in the following
paragraphs of this privacy policy.
recipients of personal data
As part of our business activities, we work with various external bodies.
In some cases, it is also necessary to transmit personal data to these external bodies.
We only pass on personal data to external parties if this is necessary within the framework of a
is necessary for the performance of the contract if we are legally obliged to do so (e.g. transfer of data
to tax authorities) if we have a legitimate interest in accordance with Art. 6 (1) lit. f GDPR in the disclosure
or if another legal basis allows the data transfer. When using
We only provide our customers’ personal data to processors on the basis of a valid
In the case of joint processing, a contract for order processing will be
joint processing concluded.
Revocation of your consent to data processing
Many data processing operations are only possible with your express consent. You can
You can revoke your consent at any time. The legality of the processing carried out up to the time of revocation
Data processing remains unaffected by the revocation.
Right to object to data collection in special cases and to
direct marketing (Art. 21 GDPR)
IF THE DATA PROCESSING IS BASED ON ART. 6 PARAGRAPH 1 LIT. E OR F GDPR
YOU HAVE THE RIGHT AT ANY TIME TO REJECT THE PROCESSING FOR REASONS ARISING FROM YOUR PARTICULAR
SITUATION, AGAINST THE PROCESSING OF YOUR PERSONAL DATA
THIS ALSO APPLIES TO ANY ACTION BASED ON THESE PROVISIONS
PROFILING. THE RESPECTIVE LEGAL BASIS ON WHICH ANY PROCESSING IS BASED,
PLEASE REFER TO THIS PRIVACY POLICY. IF YOU OBJECT,
WE WILL NO LONGER PROCESS YOUR PERSONAL DATA, IT
UNLESS WE CAN PROVE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING
WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS OR
PROCESSING IS FOR THE PURPOSE OF ASSERTING, EXERCISING OR DEFENDING
LEGAL CLAIMS (OBJECTION ACCORDING TO ART. 21 PARA. 1 GDPR).
IF YOUR PERSONAL DATA IS PROCESSED TO CARRY OUT DIRECT MARKETING,
YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR DATA AT ANY TIME
CONCERNING PERSONAL DATA FOR THE PURPOSE OF SUCH ADVERTISING
THIS ALSO APPLIES TO PROFILING IN SO FAR AS IT IS CONNECTED WITH SUCH DIRECT ADVERTISING
5 / 18
CONNECTION. IF YOU OBJECT, YOUR PERSONAL DATA WILL
SUBSEQUENTLY NO LONGER USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION
ACCORDING TO ART. 21 PARA. 2 GDPR).
right to lodge a complaint with the competent supervisory authority
In the event of violations of the GDPR, those affected have the right to lodge a complaint with a
supervisory authority, in particular in the Member State of their habitual residence, place of work
or the place of the alleged violation. The right of appeal exists without prejudice to other
administrative or judicial remedies.
right to data portability
You have the right to request that data that we process based on your consent or in fulfillment of a contract
process automatically, to itself or to a third party in a common, machine-readable format
If you wish to have the data transferred directly to another responsible party,
request, this will only be done if it is technically feasible.
information, correction and deletion
Within the framework of the applicable legal provisions, you have the right at any time to free
Information about your stored personal data, their origin and recipient and the
Purpose of the data processing and, if applicable, a right to correction or deletion of this data. For this purpose, as well as
If you have any further questions regarding personal data, you can contact us at any time.
right to restriction of processing
You have the right to request the restriction of the processing of your personal data.
You can contact us at any time. The right to restrict processing exists in
following cases:
If you dispute the accuracy of your personal data stored by us, we require
usually have time to check this. For the duration of the check, you have the right to
to request restriction of the processing of your personal data.
If the processing of your personal data was/is unlawful, you can
request the restriction of data processing instead of deletion.
If we no longer need your personal data, but you require it to exercise your right,
defense or assertion of legal claims, you have the right to request
deletion or restriction of the processing of your personal data.
If you have lodged an objection in accordance with Art. 21 Para. 1 GDPR, a balance must be struck between
your and our interests. Until it is clear whose interests
outweigh the legitimate interests of the data subject, you have the right to request the restriction of the processing of your personal data
to demand.
If you have restricted the processing of your personal data, this data may – from
apart from their storage – only with your consent or to assert, exercise or
Defence of legal claims or to protect the rights of another natural or
legal person or for reasons of important public interest of the European Union or
of a Member State.
SSL or TLS encryption
This site uses for security reasons and to protect the transmission of confidential content, such as
For example, orders or enquiries that you send to us as the website operator require an SSL or TLS
6 / 18
Encryption. You can recognize an encrypted connection by the fact that the address line of the browser is
“http://” changes to “https://” and by the lock symbol in your browser line.
If SSL or TLS encryption is activated, the data you send to us cannot
be read by third parties.
Encrypted payment transactions on this website
If, after concluding a paid contract, you are obliged to provide us with your payment details
(e.g. account number for direct debit authorization), these data will be used for payment processing
needed.
Payment transactions are made using the usual payment methods (Visa/MasterCard, direct debit)
exclusively via an encrypted SSL or TLS connection. Recognizing an encrypted connection
You will notice that the address line of the browser changes from “http://” to “https://” and the lock symbol
in your browser bar.
With encrypted communication, your payment data that you send to us cannot be
be read by third parties.
objection to advertising emails
The use of contact data published in the context of the imprint obligation for sending
We hereby object to the sending of unsolicited advertising and information materials.
The operators of the pages expressly reserve the right to take legal action in the event of unsolicited sending of
advertising information, such as spam emails.
4. Data collection on this website
cookies
Our website uses so-called “cookies”. Cookies are small data packets and are
Your device will not be harmed. They will either be temporarily blocked for the duration of a session
(session cookies) or permanently (permanent cookies) stored on your device. Session cookies
are automatically deleted after your visit. Permanent cookies remain on your device
stored until you delete them yourself or they are automatically deleted by your web browser.
Cookies can come from us (first-party cookies) or from third-party companies (so-called third-party
Third-party cookies enable the integration of certain services from
Third-party companies within websites (e.g. cookies for processing payment services).
Cookies have various functions. Many cookies are technically necessary because certain
Website functions would not work without them (e.g. the shopping cart function or the display
Other cookies may be used to evaluate user behavior or for advertising purposes
be used.
Cookies that are necessary to carry out the electronic communication process, to provide
certain functions you require (e.g. for the shopping cart function) or to optimize the
Website (e.g. cookies for measuring web audience) (necessary cookies) are stored on
Basis of Art. 6 Para. 1 lit. f GDPR, unless another legal basis is specified.
The website operator has a legitimate interest in storing necessary cookies for
technically error-free and optimized provision of its services. If consent to
If you have been asked to allow cookies and similar recognition technologies to be stored,
Processing exclusively on the basis of this consent (Art. 6 para. 1 lit. a GDPR and Section 25 para. 1
7 / 18
TTDSG); consent can be revoked at any time.
You can set your browser to inform you about the setting of cookies and
Allow cookies only in individual cases, exclude the acceptance of cookies for certain cases or generally
and activate the automatic deletion of cookies when closing the browser.
Deactivating cookies may limit the functionality of this website.
You can find out which cookies and services are used on this website here
Privacy Policy.
consent with Usercentrics
This website uses Usercentrics’ consent technology to obtain your consent to the storage
certain cookies on your device or to use certain technologies and to obtain
to document in compliance with data protection regulations. The provider of this technology is Usercentrics GmbH, Sendlinger
Straße 7, 80331 Munich, Website:
https://usercentrics.com/de/ (hereinafter “Usercentrics”).
When you enter our website, the following personal data is transferred to Usercentrics:
Your consent(s) or the revocation of your consent(s)
your IP address
information about your browser
information about your device
time of your visit to the website
geolocation
Furthermore, Usercentrics stores a cookie in your browser to show you the consent you have given
or its revocation. The data collected in this way will be stored until you inform us
Request deletion, delete the Usercentrics cookie yourself or the purpose for data storage
Mandatory statutory retention periods remain unaffected.
The Usercentrics banner on this website was configured with the help of eRecht24. You can see this
that the eRecht24 logo appears in the banner. To display the eRecht24 logo in the banner,
A connection is established to the eRecht24 image server. The IP address
transmitted, but this is only stored in an anonymized form in the server logs. The image server of
eRecht24 is located in Germany with a German provider. The banner itself is exclusively
provided by Usercentrics.
Usercentrics is used to obtain the legally required consent for the use of
certain technologies. The legal basis for this is Art. 6 (1) lit. c GDPR.
order processing
We have a data processing agreement (AVV) for the use of the above-mentioned service
This is a contract required by data protection law, which
ensures that the personal data of our website visitors is only processed in accordance with our
instructions and in compliance with the GDPR.
5. Social Media
eRecht24 Safe Sharing Tool
The content on this website can be shared in social networks such as Facebook, X & Co. in compliance with data protection regulations.
8 / 18
This site uses the
eRecht24 Safe Sharing Tool. This tool provides direct contact between the networks and users
only when the user actively clicks on one of these buttons. Clicking on the button represents a
Consent within the meaning of Art. 6 Para. 1 lit. a GDPR and Section 25 Para. 1 TTDSG. This consent can
can be revoked at any time with future effect.
An automatic transfer of user data to the operators of these platforms takes place through this
Tool does not. If the user is logged in to one of the social networks, when using the
Social media elements from Facebook, X & Co. an information window in which the user can see the text
can confirm the sending.
Our users can share the contents of this site in social networks in compliance with data protection regulations without
that complete surfing profiles are created by the network operators.
The service is used to obtain the legally required consents for the use
certain technologies. The legal basis for this is Art. 6 (1) lit. c GDPR.
This website contains elements of the social network Facebook. The provider of this service is
Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. The data collected is
However, according to Facebook, data may also be transferred to the USA and other third countries.
An overview of the Facebook social media elements can be found here:
https://developers.facebook.com/docs/plugins/?locale=de_DE.
If the social media element is active, a direct connection is established between your device and the
Facebook server. Facebook receives the information that you have entered this website with your IP address.
Website. If you click the Facebook “Like” button while you are in your Facebook
Account, you can link the contents of this website to your Facebook profile.
This allows Facebook to associate your visit to this website with your user account. We would like to point out that
that we as the provider of the pages have no knowledge of the content of the transmitted data or their use
through Facebook. For more information, see the privacy policy of
Facebook at:
https://de-de.facebook.com/privacy/explanation.
The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and §
25 para. 1 TTDSG. Consent can be revoked at any time.
To the extent that personal data is collected on our website using the tool described here and sent to
Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square,
Grand Canal Harbour, Dublin 2, Ireland is jointly responsible for this data processing (Art. 26
GDPR). The joint responsibility is limited exclusively to the recording of the
Data and its forwarding to Facebook. The processing that takes place after forwarding by
Facebook is not part of the shared responsibility. The obligations we share
were recorded in a joint processing agreement. The wording of the
Agreement can be found at:
https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for granting
the data protection information when using the Facebook tool and for the data protection-compliant
Implementation of the tool on our website. Data security of the Facebook
Products are Facebook's responsibility. Rights of data subjects (e.g. requests for information) with regard to
You can claim the data processed by Facebook directly with Facebook. If you
If you assert your rights with us, we are obliged to forward these to Facebook.
The data transfer to the USA is based on the standard contractual clauses of the EU Commission.
9 / 18
Details can be found here:
https://www.facebook.com/legal/EU_data_transfer_addendum,
https://de-de.facebook.com/help/566994660333381 and
https://www.facebook.com/policy.php.
The company is certified according to the “EU-US Data Privacy Framework” (DPF).
DPF is an agreement between the European Union and the USA that ensures compliance
European data protection standards for data processing in the USA. Every
The DPF certified company is committed to complying with these data protection standards. Further
You can obtain information about this from the provider at the following link:
https://www.dataprivacyframework.gov/s/participant-search/participantdetail?
contact=true&id=a2zt0000000GnywAAC&status=Active
This website includes functions of the Instagram service. These functions are
offered by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2,
Ireland.
If the social media element is active, a direct connection is established between your device and the
Instagram server. Instagram receives information about the visit to this website
through you.
If you are logged into your Instagram account, you can click on the Instagram button
link the contents of this website with your Instagram profile. This allows Instagram to record your visit to this
Website to your user account. We would like to point out that we, as the provider of the pages, have no
Be aware of the content of the transmitted data and its use by Instagram.
The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and §
25 para. 1 TTDSG. Consent can be revoked at any time.
To the extent that personal data is collected on our website using the tool described here and sent to
Facebook or Instagram, we and Meta Platforms Ireland Limited, 4 Grand
Canal Square, Grand Canal Harbour, Dublin 2, Ireland jointly for this data processing
(Article 26 GDPR). The joint responsibility is limited exclusively
to the collection of data and its forwarding to Facebook or Instagram. The data collected after forwarding
Processing by Facebook or Instagram is not part of the joint controllership.
The obligations incumbent upon us jointly have been laid down in an agreement on joint
processing. The wording of the agreement can be found at:
https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for granting
the data protection information when using the Facebook or Instagram tool and for the
responsible for the data protection-compliant implementation of the tool on our website.
Facebook is responsible for the data security of Facebook and Instagram products. Rights of data subjects
(e.g. requests for information) regarding the data processed by Facebook or Instagram, you can
directly with Facebook. If you assert your data subject rights with us, we are
obliged to forward this to Facebook.
The data transfer to the USA is based on the standard contractual clauses of the EU Commission.
Details can be found here:
https://www.facebook.com/legal/EU_data_transfer_addendum,
https://privacycenter.instagram.com/policy/ and
https://de-de.facebook.com/help/566994660333381.
For more information, see Instagram’s privacy policy:
https://privacycenter.instagram.com/policy/.
10 / 18
The company is certified according to the “EU-US Data Privacy Framework” (DPF).
DPF is an agreement between the European Union and the USA that ensures compliance
European data protection standards for data processing in the USA. Every
The DPF certified company is committed to complying with these data protection standards. Further
You can obtain information about this from the provider at the following link:
https://www.dataprivacyframework.gov/s/participant-search/participantdetail?
contact=true&id=a2zt0000000GnywAAC&status=Active
6th newsletter
newsletter data
If you would like to receive the newsletter offered on the website, we require an email address from you.
Address and information that allows us to verify that you are the owner of the
provided email address and agree to receive the newsletter. Further data
are not collected or are only collected on a voluntary basis. For the processing of the newsletter we use
Newsletter service providers, which are described below.
Mailchimp with deactivated success measurement
This website uses the services of Mailchimp to send newsletters. The provider is Rocket
Science Group LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA.
Mailchimp is a service that can be used to organize the sending of newsletters. If you
If you enter data for the purpose of subscribing to the newsletter (e.g. email address), these will be stored on the servers
stored by Mailchimp in the USA. We have deactivated the performance measurement at Mailchimp, so
Mailchimp will not evaluate your behavior when opening our newsletter.
If you do not want your data to be transferred to Mailchimp, you must unsubscribe from the newsletter
unsubscribe. We provide a link for this purpose in every newsletter message.
The data processing is based on your consent (Art. 6 para. 1 lit. a GDPR). You can
You can revoke your consent at any time by unsubscribing from the newsletter. The legality of the already
The revocation will not affect the data processing operations carried out.
The data you provide to us for the purpose of subscribing to the newsletter will be stored by us until you
If you unsubscribe from the newsletter, this will be stored by us or the newsletter service provider and
If you unsubscribe from the newsletter, your data will be deleted from the newsletter distribution list. Data that is stored for other purposes
stored by us remain unaffected.
The data transfer to the USA is based on the standard contractual clauses of the EU Commission.
Details can be found here:
https://mailchimp.com/eu-us-data-transfer-statement/ and
https://mailchimp.com/legal/data-processing-addendum/#Annex_C_-_Standard_Contractual_Clauses.
After you unsubscribe from the newsletter distribution list, your email address will be stored by us or the
Newsletter service provider may store your data in a blacklist if this is necessary to prevent future
Mailings are required. The data from the blacklist will only be used for this purpose and will not be used with
other data. This serves both your interest and our interest in the
Compliance with legal requirements when sending newsletters (legitimate interest within the meaning of
Art. 6 para. 1 lit. f GDPR). Storage in the blacklist is not time-limited. You can
storage if your interests outweigh our legitimate interests.
For more information, please see Mailchimp’s privacy policy at:
11 / 18
https://mailchimp.com/legal/terms/.
The company is certified according to the “EU-US Data Privacy Framework” (DPF).
DPF is an agreement between the European Union and the USA that ensures compliance
European data protection standards for data processing in the USA. Every
The DPF certified company is committed to complying with these data protection standards. Further
You can obtain information about this from the provider at the following link:
https://www.dataprivacyframework.gov/s/participant-search/participantdetail?
contact=true&id=a2zt0000000TXVKAA4&status=Active
order processing
We have a data processing agreement (AVV) for the use of the above-mentioned service
This is a contract required by data protection law, which
ensures that the personal data of our website visitors is only processed in accordance with our
instructions and in compliance with the GDPR.
7. Plugins and tools
Google Fonts
This site uses so-called Google Fonts for the uniform display of fonts, which are provided by Google
When you visit a page, your browser loads the required fonts into your browser cache,
to display texts and fonts correctly.
For this purpose, the browser you use must connect to the Google servers
This will inform Google that this website is being accessed via your IP address.
was called. The use of Google Fonts is based on Art. 6 para. 1 lit. f GDPR. The
Website operator has a legitimate interest in the uniform presentation of the typeface on his
Website. If consent has been requested, the processing will only take place
on the basis of Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TTDSG, insofar as the consent allows the storage
of cookies or access to information in the user's device (e.g. device fingerprinting) in
Purpose of the TTDSG. Consent can be revoked at any time.
If your browser does not support Google Fonts, a standard font from your computer will be used.
For more information about Google Fonts, see
https://developers.google.com/fonts/faq and in Google's privacy policy:
https://policies.google.com/privacy?hl=de.
The company is certified according to the “EU-US Data Privacy Framework” (DPF).
DPF is an agreement between the European Union and the USA that ensures compliance
European data protection standards for data processing in the USA. Every
The DPF certified company is committed to complying with these data protection standards. Further
You can obtain information about this from the provider at the following link:
https://www.dataprivacyframework.gov/s/participant-search/participantdetail?
contact=true&id=a2zt000000001L5AAI&status=Active
Adobe Fonts
This website uses Adobe Web Fonts to uniformly display certain fonts. Provider
is Adobe Systems Incorporated, 345 Park Avenue, San Jose, CA 95110-2704, USA (Adobe).
When you visit this website, your browser downloads the required fonts directly from Adobe to your
12 / 18
device correctly. Your browser establishes a connection to the Adobe servers
in the USA. This tells Adobe that this website is being accessed via your IP address.
According to Adobe, no cookies are used when providing the fonts
saved.
The storage and analysis of the data is based on Art. 6 para. 1 lit. f GDPR. The
Website operator has a legitimate interest in the uniform presentation of the typeface on his
Website. If consent has been requested, the processing will only take place
on the basis of Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TTDSG, insofar as the consent allows the storage
of cookies or access to information in the user's device (e.g. device fingerprinting) in
Purpose of the TTDSG. Consent can be revoked at any time.
The data transfer to the USA is based on the standard contractual clauses of the EU Commission.
Details can be found here:
https://www.adobe.com/de/privacy/eudatatransfers.html.
For more information about Adobe Fonts, please visit:
https://www.adobe.com/de/privacy/policies/adobe-fonts.html.
Adobe’s privacy policy can be found at:
https://www.adobe.com/de/privacy/policy.html
The company is certified according to the “EU-US Data Privacy Framework” (DPF).
DPF is an agreement between the European Union and the USA that ensures compliance
European data protection standards for data processing in the USA. Every
The DPF certified company is committed to complying with these data protection standards. Further
You can obtain information about this from the provider at the following link:
https://www.dataprivacyframework.gov/s/participant-search/participantdetail?
contact=true&id=a2zt0000000TNo9AAG&status=Active
Google Maps
This site uses the map service Google Maps. The provider is Google Ireland Limited (“Google”), Gordon
House, Barrow Street, Dublin 4, Ireland.
To use the functions of Google Maps, it is necessary to save your IP address. This
Information is usually transferred to a Google server in the USA and stored there.
The provider of this site has no influence on this data transfer. If Google Maps is activated,
Google may use Google Fonts for the purpose of uniform display of fonts.
When you open Google Maps, your browser loads the required web fonts into your browser cache in order to display texts and
to display fonts correctly.
The use of Google Maps is in the interest of an attractive presentation of our online
Offers and easy findability of the locations we indicate on the website. This represents
a legitimate interest within the meaning of Art. 6 (1) lit. f GDPR. If a corresponding
Consent has been requested, the processing will be carried out exclusively on the basis of Art. 6 para. 1 lit. a
DSGVO and Section 25 Para. 1 TTDSG, insofar as the consent allows the storage of cookies or access to
Information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. The
Consent can be revoked at any time.
The data transfer to the USA is based on the standard contractual clauses of the EU Commission.
Details can be found here:
https://privacy.google.com/businesses/gdprcontrollerterms/ and
https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.
13 / 18
For more information on how user data is handled, see Google’s privacy policy:
https://policies.google.com/privacy?hl=de.
The company is certified according to the “EU-US Data Privacy Framework” (DPF).
DPF is an agreement between the European Union and the USA that ensures compliance
European data protection standards for data processing in the USA. Every
The DPF certified company is committed to complying with these data protection standards. Further
You can obtain information about this from the provider at the following link:
https://www.dataprivacyframework.gov/s/participant-search/participantdetail?
contact=true&id=a2zt000000001L5AAI&status=Active
Google reCAPTCHA
We use “Google reCAPTCHA” (hereinafter “reCAPTCHA”) on this website. The provider is Google
Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
reCAPTCHA is used to check whether the data entered on this website (e.g. in a
contact form) by a human or by an automated program.
reCAPTCHA analyses the behaviour of the website visitor based on various characteristics.
Analysis starts automatically as soon as the website visitor enters the website. For the analysis,
reCAPTCHA collects various information (e.g. IP address, time spent by the website visitor on the
Website or mouse movements made by the user). The data collected during the analysis is sent to
redirected to Google.
The reCAPTCHA analyses run completely in the background. Website visitors are not informed
indicated that an analysis is taking place.
The storage and analysis of the data is based on Art. 6 para. 1 lit. f GDPR. The
Website operators have a legitimate interest in protecting their web offerings from abusive
automated spying and SPAM. If a corresponding consent is requested
the processing is carried out exclusively on the basis of Art. 6 Para. 1 lit. a GDPR and Section 25 Para. 1
TTDSG, insofar as the consent allows the storage of cookies or access to information in
device of the user (e.g. device fingerprinting) within the meaning of the TTDSG. The consent is
revocable at any time.
For more information about Google reCAPTCHA, please see the Google Privacy Policy and
the Google Terms of Service at the following links:
https://policies.google.com/privacy?hl=de and
https://policies.google.com/terms?hl=de.
The company is certified according to the “EU-US Data Privacy Framework” (DPF).
DPF is an agreement between the European Union and the USA that ensures compliance
European data protection standards for data processing in the USA. Every
The DPF certified company is committed to complying with these data protection standards. Further
You can obtain information about this from the provider at the following link:
https://www.dataprivacyframework.gov/s/participant-search/participantdetail?
contact=true&id=a2zt000000001L5AAI&status=Active
8. eCommerce and payment providers
processing of customer and contract data
We collect, process and use personal customer and contract data to justify,
content design and modification of our contractual relationships. Personal data about the
14 / 18
We only collect, process and use data from the use of this website (usage data) to the extent that this
is necessary to enable or bill the user for the use of the service.
The legal basis for this is Art. 6 (1) lit. b GDPR.
The collected customer data will be deleted after completion of the order or termination of the
business relationship and expiry of any existing statutory retention periods.
Statutory retention periods remain unaffected.
Data transfer when concluding a contract for online shops, retailers and shipping of goods
When you order goods from us, we will pass on your personal data to the delivery company
transport company and the payment service provider commissioned with the payment processing
Only data that the respective service provider needs to fulfil its
The legal basis for this is Art. 6 (1) lit. b GDPR, which allows the processing of data for
Fulfillment of a contract or pre-contractual measures. If you have a corresponding
If you have given your consent in accordance with Art. 6 (1) lit. a GDPR, we will forward your email address to the
Delivery to the transport company entrusted with the delivery, so that they can inform you by email about the shipping status
your order; you can revoke your consent at any time.
payment services
We integrate payment services from third-party companies on our website. If you make a purchase from us
your payment details (e.g. name, payment amount, bank details, credit card number)
processed by the payment service provider for the purpose of payment processing. For these transactions
The respective contract and data protection provisions of the respective providers apply. The use of
Payment service providers are based on Art. 6 para. 1 lit. b GDPR (contract processing) and in
Interest in a payment process that is as smooth, convenient and secure as possible (Art. 6 para. 1 lit. f
If your consent is requested for certain actions, Art. 6 para. 1 lit. a GDPR applies.
Legal basis for data processing; consent can be revoked at any time for the future.
We use the following payment services / payment service providers on this website:
PayPal
The provider of this payment service is PayPal (Europe) S.à.rl et Cie, SCA, 22-24 Boulevard Royal, L-2449
Luxembourg (hereinafter “PayPal”).
The data transfer to the USA is based on the standard contractual clauses of the EU Commission.
Details can be found here:
https://www.paypal.com/de/webapps/mpp/ua/pocpsa-full.
For details, please see PayPal’s privacy policy:
https://www.paypal.com/de/webapps/mpp/ua/privacy-full.
Apple Pay
The provider of the payment service is Apple Inc., Infinite Loop, Cupertino, CA 95014, USA.
Apple’s privacy policy can be found at:
https://www.apple.com/legal/privacy/de-ww/.
Klarna
The provider is Klarna AB, Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter "Klarna"). Klarna
offers various payment options (e.g. installment purchase). If you choose to pay with Klarna
(Klarna checkout solution), Klarna will collect various personal data from you
15 / 18
Klarna uses cookies to optimize the use of the Klarna checkout solution. Details on
For information about the use of Klarna cookies, please see the following link:
https://cdn.klarna.com/1.0/shared/content/policy/cookie/de_de/checkout.pdf.
You can find details about this in Klarna’s privacy policy at the following link:
https://www.klarna.com/de/datenschutz/.
Paydirekt
The provider of this payment service is Paydirekt GmbH, Hamburger Allee 26-28, 60486 Frankfurt am
Main, Germany (hereinafter “Paydirekt”). If you make the payment using Paydirekt,
Paydirekt collects various transaction data and forwards it to the bank where you use Paydirekt
In addition to the data required for payment, Paydirekt also collects
Transaction processing may require additional data such as delivery address or individual items in the shopping cart.
Paydirekt then authenticates the transaction using the
authentication process. The payment amount will then be transferred from your account to our account
Neither we nor third parties have access to your account details. Details for payment with Paydirekt
Please refer to Paydirekt’s terms and conditions and privacy policy at:
https://www.paydirekt.de/agb/index.html.
Sofortüberweisung
The provider of this payment service is Sofort GmbH, Theresienhöhe 12, 80339 Munich (hereinafter
“Sofort GmbH”). Using the “Sofortüberweisung” process, we receive a payment in real time.
Payment confirmation from Sofort GmbH and can immediately begin fulfilling our
Liabilities begin. If you have chosen the payment method “Instant transfer”,
Send the PIN and a valid TAN to Sofort GmbH, which will then log into your online banking
Account. Sofort GmbH automatically checks your account balance after logging in and
the transfer to us using the TAN you provided. It then sends us
You will receive a transaction confirmation immediately. After logging in, your sales, the
credit limit of the overdraft facility and the existence of other accounts and their balances
automatically checked. In addition to the PIN and TAN, the payment data you entered
and personal data to Sofort GmbH. The personal data is
to provide first and last name, address, telephone number(s), email address, IP address and possibly other
Data required for payment processing. The transmission of this data is necessary to verify your identity
to determine without a doubt and to prevent fraud attempts. Details on payment with
For instant transfer, please refer to the following link:
https://www.klarna.com/sofort/.
giropay
The provider of this payment service is paydirekt GmbH, Stephanstraße 14 – 16, 60313 Frankfurt am Main
(hereinafter “giropay”).
For details, please see giropay’s privacy policy:
https://www.paydirekt.de/agb/index.html.
Shopify Payment
The provider of this payment service in the EU is Shopify International Limited, 2nd Floor Victoria
Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (hereinafter “Shopify Payment”).
For details, see Shopify Payment’s privacy policy:
https://www.shopify.de/legal/datenschutz.
16 / 18
American Express
The provider of this payment service is American Express Europe SA, Theodor-Heuss-Allee 112, 60486
Frankfurt am Main, Germany (hereinafter “American Express”).
American Express may transfer data to its parent company in the USA. The data transfer to
the USA is based on the Binding Corporate Rules. Details can be found here:
https://www.americanexpress.com/en-nl/company/legal/privacy-centre/european-implementingprinciples/.
For further information please see the American Express privacy policy:
https://www.americanexpress.com/de/legal/online-datenschutzerklarung.html.
Mastercard
The provider of this payment service is Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410
Waterloo, Belgium (hereinafter “Mastercard”).
Mastercard may transfer data to its parent company in the USA. The data transfer to the
USA is based on Mastercard's Binding Corporate Rules. Details can be found here:
https://www.mastercard.de/de-de/datenschutz.html and
https://www.mastercard.us/content/dam/mccom/global/documents/mastercard-bcrs.pdf.
VISA
The provider of this payment service is Visa Europe Services Inc., London branch, 1 Sheldon
Square, London W2 6TT, United Kingdom (hereinafter “VISA”).
The UK is considered a safe third country in terms of data protection. This means that the UK is a
has a level of data protection that corresponds to the level of data protection in the European Union.
VISA may transfer data to its parent company in the USA. The data transfer to the USA will
based on the standard contractual clauses of the EU Commission. Details can be found here:
https://www.visa.de/USE_Conditions/visa-globale-data-protection-notification/notification-of-condition-issues-
fur-den-ewr.html.
For further information please see VISA’s privacy policy:
https://www.visa.de/USE Conditions/visa-privacy-center.html.