EOC Europe GmbH
Seeshaupter Str. 62
82377 Penzberg
Germany

Fax: +49 8856-901-101
Email: privacy@elevate-oc.eu

Introduction

EOC Europe GmbH is committed, through its parent company Elevate Outdoor Collective Holdings, LP, to respecting the privacy of our website visitors, customers, partners and employees by protecting your privacy and complying with applicable data protection and privacy laws such as the GDPR guidelines. We believe it is important that you understand what type of data we collect about you, how we protect that data and how it is used.

By using the website, signing up for e-mail news or otherwise providing us with information, you accept the practices described in this Privacy and Data Protection Policy ("Privacy Policy").

Our Privacy Policy is intended to help you understand clearly and easily: the purpose of this Privacy Policy; what information is collected; how your information is collected, used, processed and shared; your rights with respect to personal data and how you can control your information; as well as information about cookies.

We recognise the need for appropriate security measures and the handling of personal data ("personal data" refers to information about an identified or identifiable natural person) that you provide to us. This Privacy Policy sets out the data protection principles that Elevate Outdoor Collective follows with regard to your personal data.

This Privacy Policy applies to all personal data that Elevate Outdoor Collective receives on the current website. This also applies to personal data that we collect when you otherwise interact with us, for example when you make a payment, place an order, sign up for e-mails or contact customer service. This Policy also applies to personal data that we receive from our partners and third-party sources. We will protect your personal data by means of appropriate technical and organisational measures and protect it against access by unauthorised third parties. Since complete data security cannot be guaranteed by us even in e-mail communication, we recommend that you use encryption or postal mail for confidential information.

This Privacy Policy applies to personal data from the European Union, from Norway and Switzerland, which is collected, used, stored and processed by Elevate Outdoor Collective in the United States, the European Union, Canada, Japan, Norway or China.

Privacy Policy

1) Introduction and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about the processing of your personal data when using our website. Personal data herein refers to all data by which you can be personally identified.

1.2 The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is EOC Europe GmbH, Seeshaupter Str. 62, 82377 Penzberg, Germany, Tel.: +49 (0) 8856-901-0, E-Mail: info@elevate-oc.eu. The controller for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

1.3 The controller has appointed a Data Protection Officer, who can be reached as follows: "EOC Europe GmbH, Seeshaupter Str. 62, 82377 Penzberg, E-Mail: privacy@elevate-oc.eu"

2) Data Collection When Visiting Our Website

2.1 When using our website for information purposes only, i.e. if you do not register or otherwise transmit information to us, we only collect such data as your browser transmits to the page server (so-called "server log files"). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

The webpage visited
Date and time at the time of access
Volume of data sent in bytes
Source/referral from which you arrived at the page
Browser used
Operating system used
IP address used (where applicable: in anonymised form)

Processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used for any other purpose. We do however reserve the right to review the server log files retrospectively should there be specific indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the character string "https://" and the padlock symbol in your browser bar.

3) Hosting & Content Delivery Network

3.1 Amazon Web Services

For hosting our website and displaying the page content, we use the system of the following provider: AWS EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg

Data may also be transmitted to: Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, USA

All data collected on our website is processed on the servers of the provider. We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

3.2 Cloudflare

We use a content delivery network from the following provider: Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA

This service enables us to deliver large media files such as graphics, page content or scripts more quickly via a network of regionally distributed servers. Processing is carried out to safeguard our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6(1)(f) GDPR. We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

4) Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your end device. Some of these cookies are automatically deleted after closing the browser (so-called "session cookies"), while other cookies remain on your end device for a longer period and allow page settings to be saved (so-called "persistent cookies"). In the latter case, you can find the storage period in the overview of your web browser's cookie settings.

Where individual cookies used by us also process personal data, the processing is carried out pursuant to Art. 6(1)(b) GDPR for the performance of the contract, pursuant to Art. 6(1)(a) GDPR in the case of consent given, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the page visit.

You can set your browser to be informed about the setting of cookies and to decide individually about their acceptance, or to exclude the acceptance of cookies in certain cases or in general.

Please note that if you do not accept cookies, the functionality of our website may be restricted.

5) Contact

5.1 In the context of contacting us (e.g. via contact form or e-mail), personal data is processed exclusively for the purpose of handling and responding to your enquiry and only to the extent necessary for this purpose.

The legal basis for processing this data is our legitimate interest in responding to your enquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, an additional legal basis for the processing is Art. 6(1)(b) GDPR. Your data will be deleted when it can be inferred from the circumstances that the matter in question has been conclusively resolved and provided that there are no statutory retention obligations to the contrary.

5.2 Klaviyo

For the dispatch of transactional e-mails, i.e. occasion-specific messages triggered by a specific user interaction (such as conclusion of a contract, registration or password reset), we use the following provider: Klaviyo, Inc., 125 Summer St., Ste 600, Boston, MA 02110, USA

On the basis of our legitimate interest in effective and user-friendly e-mail communication, we transfer the data made available by you upon execution of such a user action to this provider pursuant to Art. 6(1)(f) GDPR so that the provider can handle the mailing on our behalf.

We have concluded a data processing agreement with the provider, which protects our website visitors' data and prohibits disclosure to third parties.

6) Data Processing Upon Opening a Customer Account

Pursuant to Art. 6(1)(b) GDPR, personal data will continue to be collected and processed to the extent necessary if you provide it to us when opening a customer account. The data required for opening an account can be found in the input mask of the relevant form on our website.

Deletion of your customer account is possible at any time and can be effected by sending a message to the above-mentioned address of the controller. After deletion of your customer account, your data will be deleted, provided that all contracts concluded via it have been fully processed, no statutory retention periods stand in the way and no legitimate interest on our part in further storage exists.

7) Use of Customer Data for Direct Marketing

7.1 Registration for Our E-Mail Newsletter

If you sign up for our e-mail newsletter, we will regularly send you information about our offers. The only mandatory information required for sending the newsletter is your e-mail address. The provision of further data is voluntary and will be used to address you personally. For the newsletter mailing, we use the so-called double opt-in procedure, which ensures that you will only receive newsletters after you have expressly confirmed your consent to receive the newsletter by clicking on a verification link sent to the specified e-mail address.

By activating the confirmation link, you give us your consent to use your personal data pursuant to Art. 6(1)(a) GDPR. In this context, we store your IP address as registered by your Internet Service Provider (ISP) as well as the date and time of registration in order to be able to trace any possible misuse of your e-mail address at a later point in time. The data we collect when you register for the newsletter is used exclusively for the stated purpose.

You may unsubscribe from the newsletter at any time via the link provided for this purpose in the newsletter or by sending a corresponding message to the controller named at the outset. After unsubscribing, your e-mail address will be deleted from our newsletter distribution list without delay, unless you have expressly consented to further use of your data or we reserve the right to use your data in ways that go beyond this and that are permitted by law and about which we inform you in this declaration.

7.2 Sending the E-Mail Newsletter to Existing Customers

If you have provided us with your e-mail address when purchasing goods or services, we reserve the right to send you regular offers by e-mail for similar goods or services to those already purchased from our range. For this, we do not need to obtain separate consent from you pursuant to Section 7(3) of the German Act Against Unfair Competition (UWG). Data processing in this respect is carried out solely on the basis of our legitimate interest in personalised direct marketing pursuant to Art. 6(1)(f) GDPR. If you have initially objected to the use of your e-mail address for this purpose, no e-mails will be sent by us.

You are entitled to object to the use of your e-mail address for the aforementioned advertising purpose at any time with effect for the future by notifying the controller named at the beginning. You will only incur transmission costs at the basic rate for this. Upon receipt of your objection, the use of your e-mail address for advertising purposes will be discontinued immediately.

7.3 Klaviyo

The sending of our e-mail newsletters and other promotional e-mail communications is handled by the following provider: Klaviyo, Inc., 125 Summer St., Ste 600, Boston, MA 02110, USA

On the basis of our legitimate interest in effective and user-friendly e-mail marketing, we transfer your data provided at registration to this provider pursuant to Art. 6(1)(f) GDPR so that the provider can handle the mailing on our behalf.

Subject to your express consent pursuant to Art. 6(1)(a) GDPR, the provider additionally carries out a statistical evaluation of the success of mail campaigns by means of web beacons or tracking pixels in the sent e-mails, which can measure open rates and specific interactions with the content of the newsletter. In this context, end device information (e.g. time of access, IP address, browser type and operating system) is also collected and evaluated, but not merged with other data sets.

You may revoke your consent to mail tracking at any time with effect for the future.

We have concluded a data processing agreement with the provider, which protects our website visitors' data and prohibits disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

7.4 Product Availability Notification by E-Mail

For temporarily unavailable items, you may register to receive e-mail product availability notifications. In this context, we will send you a one-time e-mail notification regarding the availability of the item you have selected. The only mandatory information required for sending this notification is your e-mail address. The provision of further data is voluntary and may be used to address you personally. For the mailing, we use the so-called double opt-in procedure, which ensures that you will only receive a notification after you have expressly confirmed your consent in this regard by clicking on a verification link sent to the specified e-mail address.

By activating the confirmation link, you give us your consent to use your personal data pursuant to Art. 6(1)(a) GDPR. In this context, we store your IP address as registered by your Internet Service Provider (ISP) as well as the date and time of registration in order to be able to trace any possible misuse of your e-mail address at a later point in time. The data we collect when you register for our e-mail product availability notification service is used exclusively for the stated purpose.

You may unsubscribe from the availability notifications at any time by sending a corresponding message to the controller named at the outset. After unsubscribing, your e-mail address will be deleted from our distribution list set up for this purpose without delay, unless you have expressly consented to further use of your data or we reserve the right to use your data in ways that go beyond this and that are permitted by law and about which we inform you in this declaration.

7.5 Shopping Cart Reminders by E-Mail

In the event that you abandon your purchase with us before completing the order, you have the option of receiving a one-time reminder by e-mail of the contents of your virtual shopping cart.

The only mandatory information required for sending this reminder is your e-mail address. The provision of further data is voluntary and may be used to address you personally. For the mailing, we use the so-called double opt-in procedure, which ensures that you will only receive a notification after you have expressly confirmed your consent in this regard by clicking on a verification link sent to the specified e-mail address.

By activating the confirmation link, you give us your consent to use your personal data pursuant to Art. 6(1)(a) GDPR for the sending of a shopping cart reminder. In this context, we store your IP address as registered by your Internet Service Provider (ISP) as well as the date and time of registration in order to be able to trace any possible misuse of your e-mail address at a later point in time. The data we collect when you register for our e-mail notification service is used exclusively for the stated purpose.

You may unsubscribe from the shopping cart reminders at any time by sending a corresponding message to the controller named at the outset. After unsubscribing, your e-mail address will be deleted from our distribution list set up for this purpose without delay, unless you have expressly consented to further use of your data or we reserve the right to use your data in ways that go beyond this and that are permitted by law and about which we inform you in this declaration.

8) Data Processing for Order Fulfilment

8.1 To the extent necessary for the processing of the contract for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned transport company and the commissioned credit institution pursuant to Art. 6(1)(b) GDPR.

Where we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we process the contact data transmitted by you at the time of the order in order to inform you personally in the context of our statutory duty to provide information pursuant to Art. 6(1)(c) GDPR. Your contact data is used exclusively for notifications of updates owed by us and is processed by us to this end only to the extent necessary for the respective notification.

For the processing of your order, we also work with the following service provider(s), who support us in whole or in part in the execution of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

8.2 Transfer of Personal Data to Shipping Service Providers

- GLS

As a transport service provider, we use the following provider: General Logistics Systems Germany GmbH & Co. OHG, GLS Germany-Straße 1 - 7, 36286 Neuenstein, Germany

We pass on your e-mail address and/or telephone number to the provider prior to delivery for the purpose of arranging a delivery appointment or issuing a delivery notification pursuant to Art. 6(1)(a) GDPR, provided you have given your express consent for this during the ordering process. Otherwise, we only pass on the name of the recipient and the delivery address to the provider for the purpose of delivery pursuant to Art. 6(1)(b) GDPR. The transfer only takes place to the extent necessary for the delivery of the goods. In this case, prior arrangement of a delivery appointment with the provider or a delivery notification is not possible.

Consent may be revoked at any time with effect for the future vis-à-vis the controller named above or vis-à-vis the provider.
- UPS

As a transport service provider, we use the following provider: United Parcel Service Deutschland Inc. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany

We pass on your e-mail address and/or telephone number to the provider prior to delivery for the purpose of arranging a delivery appointment or issuing a delivery notification pursuant to Art. 6(1)(a) GDPR, provided you have given your express consent for this during the ordering process. Otherwise, we only pass on the name of the recipient and the delivery address to the provider for the purpose of delivery pursuant to Art. 6(1)(b) GDPR. The transfer only takes place to the extent necessary for the delivery of the goods. In this case, prior arrangement of a delivery appointment with the provider or a delivery notification is not possible.

Consent may be revoked at any time with effect for the future vis-à-vis the controller named above or vis-à-vis the provider.
- UPS Austria

As a transport service provider, we use the following provider: United Parcel Service Speditionsgesellschaft m.b.H, Cargo Nord, Objekt 1,1300 Wien Flughafen, Austria

We pass on your e-mail address and/or telephone number to the provider prior to delivery for the purpose of arranging a delivery appointment or issuing a delivery notification pursuant to Art. 6(1)(a) GDPR, provided you have given your express consent for this during the ordering process. Otherwise, we only pass on the name of the recipient and the delivery address to the provider for the purpose of delivery pursuant to Art. 6(1)(b) GDPR. The transfer only takes place to the extent necessary for the delivery of the goods. In this case, prior arrangement of a delivery appointment with the provider or a delivery notification is not possible.

Consent may be revoked at any time with effect for the future vis-à-vis the controller named above or vis-à-vis the provider.

8.3 Use of Payment Service Providers (Payment Services)

- Apple Pay

If you choose the payment method "Apple Pay" offered by Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment processing is carried out via the "Apple Pay" function of your iOS, watchOS or macOS end device by charging a payment card stored in "Apple Pay". Apple Pay uses security features integrated into the hardware and software of your device to protect your transactions. To authorise a payment, you are required to enter a code previously set by you and to verify via the "Face ID" or "Touch ID" function of your end device.

For the purpose of payment processing, the information you have provided during the ordering process, together with information about your order, is transmitted to Apple in encrypted form. Apple then re-encrypts this data with a developer-specific key before the data is transmitted to the payment service provider of the payment card stored in Apple Pay to process the payment. The encryption ensures that only the website via which the purchase was made can access the payment data. After payment has been made, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website to confirm successful payment.

Where personal data is processed in connection with the transmissions described, processing takes place exclusively for the purpose of payment processing pursuant to Art. 6(1)(b) GDPR.

Apple retains anonymised transaction data, including the approximate purchase amount, approximate date and approximate time, as well as an indication of whether the transaction was completed successfully. Anonymisation completely excludes any personal reference. Apple uses the anonymised data to improve "Apple Pay" and other Apple products and services.

If you use Apple Pay on iPhone or Apple Watch to complete a purchase made via Safari on a Mac, the Mac and the authorisation device communicate via an encrypted channel on Apple servers. Apple does not process or store any of this information in a format by which your person can be identified. You can disable the ability to use Apple Pay on your Mac in your iPhone settings. Go to "Wallet & Apple Pay" and disable "Allow Payments on Mac".

Further information on data protection with Apple Pay can be found at the following internet address: https://support.apple.com/de-de/HT203027
- Google Pay

If you choose the payment method "Google Pay" offered by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), payment processing is carried out via the "Google Pay" application on your mobile end device running at least Android 4.4 ("KitKat") and equipped with an NFC function by charging a payment card stored in Google Pay or a verified payment system stored there (e.g. PayPal). To authorise a payment via Google Pay in excess of EUR 25.00, prior unlocking of your mobile end device by means of the verification measure you have set up (e.g. facial recognition, password, fingerprint or pattern) is required.

For the purpose of payment processing, the information you have provided during the ordering process, together with information about your order, is transmitted to Google. Google then transmits your payment information stored in Google Pay to the originating website in the form of a one-time transaction number, by means of which a completed payment is verified. This transaction number contains no information whatsoever about your actual payment details stored in Google Pay, but is created and transmitted as a one-time valid numerical token. In all transactions via Google Pay, Google acts solely as an intermediary for processing the payment. The transaction is carried out exclusively between the user and the originating website by charging the payment method stored in Google Pay.

Where personal data is processed in connection with the transmissions described, processing takes place exclusively for the purpose of payment processing pursuant to Art. 6(1)(b) GDPR.

Google reserves the right to collect, store and analyse certain transaction-specific information for each transaction made via Google Pay. This includes the date, time and amount of the transaction, the merchant location and description, a description of the goods or services purchased provided by the merchant, photos you have attached to the transaction, the name and e-mail address of the seller and buyer or sender and recipient, the payment method used, your description of the reason for the transaction and, where applicable, the offer associated with the transaction.

According to Google, this processing is carried out exclusively pursuant to Art. 6(1)(f) GDPR on the basis of the legitimate interest in proper invoicing, verification of transaction data and the optimisation and maintenance of the Google Pay service.

Google further reserves the right to merge the transaction data processed with other information collected and stored by Google in the course of the use of other Google services.

The terms of use for Google Pay can be found here:

https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=de
Further information on data protection with Google Pay can be found at the following internet address:
https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de
- Klarna

One or more online payment methods from the following provider are available on this website: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden

If you select a payment method of the provider where you pay in advance (e.g. credit card payment), your payment data provided during the ordering process (including name, address, bank and payment card details, currency and transaction number) as well as information about the content of your order will be transmitted to the provider pursuant to Art. 6(1)(b) GDPR. Your data is transferred in this case exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

If you select a payment method where the provider pays in advance (e.g. purchase on invoice, instalment purchase or direct debit), you will also be asked during the ordering process to provide certain personal data (first name, surname, street, house number, postcode, town/city, date of birth, e-mail address, telephone number and, where applicable, data relating to an alternative payment method).

In order to safeguard our legitimate interest in establishing the creditworthiness of our customers, this data will be forwarded by us to the provider pursuant to Art. 6(1)(f) GDPR for the purpose of a credit check. The provider will assess, on the basis of the personal data provided by you as well as further data (such as shopping basket, invoice amount, order history, payment experience), whether the payment option selected by you can be granted with regard to payment and/or credit default risks.

For the purpose of the application review, in addition to provider-internal criteria, identity and creditworthiness information from the following credit agencies may also be included pursuant to Art. 6(1)(f) GDPR:

https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The credit report may contain probability values (so-called score values). To the extent that score values are incorporated into the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. Among other factors, address data is included in the calculation of score values.

You may object to the processing of your data at any time by sending us a message or by contacting the provider directly. However, the provider may remain entitled to process your personal data where this is necessary for contractual payment processing.
- PayPal

One or more online payment methods from the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method of the provider where you pay in advance, your payment data provided during the ordering process (including name, address, bank and payment card details, currency and transaction number) as well as information about the content of your order will be transmitted to the provider pursuant to Art. 6(1)(b) GDPR. Your data is transferred in this case exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

If you select a payment method where we pay in advance, you will also be asked during the ordering process to provide certain personal data (first name, surname, street, house number, postcode, town/city, date of birth, e-mail address, telephone number and, where applicable, data relating to an alternative payment method).

In order to safeguard our legitimate interest in establishing your creditworthiness in such cases, this data will be forwarded by us to the provider pursuant to Art. 6(1)(f) GDPR for the purpose of a credit check. The provider will assess, on the basis of the personal data provided by you as well as further data (such as shopping basket, invoice amount, order history, payment experience), whether the payment option selected by you can be granted with regard to payment and/or credit default risks.

The credit report may contain probability values (so-called score values). To the extent that score values are incorporated into the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. Among other factors, address data is included in the calculation of score values.

You may object to the processing of your data at any time by sending us a message or by contacting the provider directly. However, the provider may remain entitled to process your personal data where this is necessary for contractual payment processing.
- PayPal Checkout

This website uses PayPal Checkout, an online payment system of PayPal that is composed of PayPal's own payment methods and local payment methods from third-party providers.

In the case of payment via PayPal, credit card via PayPal, direct debit via PayPal or — if offered — "Pay Later" via PayPal, we pass on your payment data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal") as part of payment processing. The transfer takes place pursuant to Art. 6(1)(b) GDPR and only to the extent necessary for payment processing.

PayPal reserves the right to conduct a credit check for the payment methods credit card via PayPal, direct debit via PayPal or — if offered — "Pay Later" via PayPal. For this purpose, your payment data may be forwarded to credit agencies pursuant to Art. 6(1)(f) GDPR on the basis of PayPal's legitimate interest in establishing your creditworthiness. PayPal uses the result of the credit check in relation to the statistical probability of payment default for the purpose of deciding on the provision of the respective payment method. The credit report may contain probability values (so-called score values). To the extent that score values are incorporated into the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. Among other factors, address data is included in the calculation of score values. You may object to this processing of your data at any time by contacting PayPal. However, PayPal may remain entitled to process your personal data where this is necessary for contractual payment processing.

Where the PayPal payment method "purchase on invoice" is available and selected, your payment data is first transmitted to PayPal in preparation for payment, whereupon PayPal forwards this to Ratepay GmbH, Franklinstraße 28-29, 10587 Berlin ("Ratepay") for processing the payment. The legal basis in each case is Art. 6(1)(b) GDPR. In this case, RatePay independently conducts an identity and credit check to establish creditworthiness in accordance with the principle already referred to above and transfers your payment data to credit agencies on the basis of the legitimate interest in establishing creditworthiness pursuant to Art. 6(1)(f) GDPR. A list of the credit agencies that Ratepay may use can be found here: https://www.ratepay.com/legal-payment-creditagencies/

Where a local third-party provider's payment method is used, your payment data is first transmitted to PayPal pursuant to Art. 6(1)(b) GDPR in preparation for payment. Depending on your selection of an available local payment method, PayPal then transmits your payment data to the respective provider for processing the payment pursuant to Art. 6(1)(b) GDPR:

- Apple Pay (Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
- Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)
- iDeal (Currence Holding BV, Beethovenstraat 300 Amsterdam, Netherlands)
- bancontact (Bancontact Payconiq Company, Rue d'Arlon 82, 1040 Brussels, Belgium)
- blik (Polski Standard Płatności sp. z o.o., ul. Czerniakowska 87A, 00-718 Warsaw, Poland)
- eps (PSA Payment Services Austria GmbH, Handelskai 92, Gate 2
1200 Vienna, Austria)
- MyBank (PRETA S.A.S, 40 Rue de Courcelles, F-75008 Paris, France)
- Przelewy24 (PayPro SA, Kanclerska 15A, 60-326 Poznań, Poland)

For further data protection information, please refer to PayPal's Privacy Policy: https://www.paypal.com/de/legalhub/paypal/privacy-full
- Sofortüberweisung (Instant Transfer)

One or more online payment methods from the following provider are available on this website: Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden

If you select a payment method of the provider where you pay in advance (e.g. credit card payment), your payment data provided during the ordering process (including name, address, bank and payment card details, currency and transaction number) as well as information about the content of your order will be transmitted to the provider pursuant to Art. 6(1)(b) GDPR. Your data is transferred in this case exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.
- Stripe

One or more online payment methods from the following provider are available on this website: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland

If you select a payment method of the provider where you pay in advance (e.g. credit card payment), your payment data provided during the ordering process (including name, address, bank and payment card details, currency and transaction number) as well as information about the content of your order will be transmitted to the provider pursuant to Art. 6(1)(b) GDPR. Your data is transferred in this case exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

If you select a payment method where the provider pays in advance (e.g. purchase on invoice, instalment purchase or direct debit), you will also be asked during the ordering process to provide certain personal data (first name, surname, street, house number, postcode, town/city, date of birth, e-mail address, telephone number and, where applicable, data relating to an alternative payment method).

In order to safeguard our legitimate interest in establishing the creditworthiness of our customers, this data will be forwarded by us to the provider pursuant to Art. 6(1)(f) GDPR for the purpose of a credit check. The provider will assess, on the basis of the personal data provided by you as well as further data (such as shopping basket, invoice amount, order history, payment experience), whether the payment option selected by you can be granted with regard to payment and/or credit default risks.

The credit report may contain probability values (so-called score values). To the extent that score values are incorporated into the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. Among other factors, address data is included in the calculation of score values.

You may object to the processing of your data at any time by sending us a message or by contacting the provider directly. However, the provider may remain entitled to process your personal data where this is necessary for contractual payment processing.

8.4 Electronic Withdrawal Function for Distance Contracts

Consumers who conclude contracts on this website for which a statutory right of withdrawal exists have the option of declaring the withdrawal via an electronic withdrawal function in accordance with the applicable withdrawal provisions.

When using the withdrawal function, in addition to information identifying the contract to be withdrawn, further personal information such as the first name, surname and e-mail address of the consumer must be provided or confirmed.

The collection of this information and its transmission to us is carried out pursuant to Art. 6(1)(b) GDPR and only to the extent necessary for the proper processing of the withdrawal. Also on the basis of Art. 6(1)(b) GDPR, the personal data provided is used to confirm receipt of the withdrawal declaration by e-mail. A further legal basis for the processing is Art. 6(1)(c) GDPR. We are under a statutory obligation to maintain an electronic withdrawal function for fee-based consumer distance contracts.

9) Online Marketing

Google AdSense

This website uses Google AdSense, a web advertising service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). Google AdSense uses so-called cookies, i.e. text files that are stored on your computer and that enable an analysis of your use of the website. In addition, Google AdSense also uses so-called "web beacons" (small invisible graphics) to collect information; these allow simple actions such as visitor traffic on the website to be recorded, collected and evaluated. The information generated by the cookie and/or web beacon (including your IP address) about your use of this website is usually transmitted to a Google server and stored there. This may also involve transmission to the servers of Google LLC. in the USA.

Google uses the information thus obtained to carry out an evaluation of your usage behaviour in relation to the AdSense advertisements. The IP address transmitted by your browser as part of Google AdSense is not merged with other data from Google. The information collected by Google may be transferred to third parties where required by law and/or where third parties process this data on behalf of Google.
All processing operations described above, in particular the reading of information on the end device used via cookies and/or web beacons, are only carried out if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. Without this consent being granted, the use of Google AdSense will not take place during your visit to the page.

You may revoke your consent given at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

Further information on Google's data protection provisions can be viewed here: https://business.safety.google/intl/de/privacy/ and https://www.google.de/policies/privacy/

10) Web Analytics Services

10.1 Google Analytics 4

This website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which enables an analysis of your use of our website.

By default, when visiting the website, Google Analytics 4 does not use cookies unless you expressly consent to cookies. Instead, information about your usage behaviour is collected and processed by means of so-called pings (small data packets sent to the host of an end device). The scope of this information also includes your IP address, which however is truncated by Google in the last digits to exclude a direct identification of persons.

The information is transmitted to Google's servers and further processed there. Transmissions to Google LLC located in the USA are also possible.

Google uses the information collected on our behalf to evaluate your use of the website, to compile reports on website activities for us and to provide other services relating to website usage and internet usage. The truncated IP address transmitted by your browser in the context of Google Analytics is not merged with other data from Google. The data collected in connection with the use of Google Analytics 4 is stored for a period of two months and subsequently deleted.

All processing operations described above, including data transmission by means of "pings" and the possible setting of Google Analytics cookies, are only carried out if you have given us your express consent pursuant to Art. 6(1)(a) GDPR.

Without your consent, Google Analytics 4 will not be used during your visit to the page. You may revoke your consent at any time with effect for the future. To exercise your right of revocation, please deactivate this service via the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with Google, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

Further legal information on Google Analytics 4 can be found at https://business.safety.google/intl/de/privacy/, https://policies.google.com/privacy?hl=de&gl=de and at https://policies.google.com/technologies/partner-sites

Demographic Characteristics
Google Analytics 4 uses the special "demographic characteristics" function and can thereby generate statistics that make statements about the age, gender and interests of website visitors. This is done by analysing advertising and information from third-party providers. Thereby, target groups can be identified for marketing activities. However, the data collected cannot be attributed to any specific person and will be deleted after a storage period of two months.

Google Signals
As an extension to Google Analytics 4, Google Signals may be used on this website to enable cross-device reports to be generated. If you have activated personalised advertisements and have linked your devices with your Google account, Google can, subject to your consent to the use of Google Analytics pursuant to Art. 6(1)(a) GDPR, analyse your usage behaviour across devices and create database models, including for cross-device conversions. We do not receive any personal data from Google, but only statistics. If you wish to stop cross-device analysis, you can deactivate the "Personalised Advertising" feature in the settings of your Google account. Please follow the instructions on this page: https://support.google.com/My-Ad-Center-Help/answer/12155764?hl=de
Further information on Google Signals can be found at the following link: https://support.google.com/analytics/answer/7532985?hl=de

UserIDs
As an extension to Google Analytics 4, the "UserIDs" function may be used on this website. If you have consented to the use of Google Analytics 4 pursuant to Art. 6(1)(a) GDPR, have set up an account on this website and log in to this account on various devices, your activities, including conversions, can be analysed across devices.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

10.2 Google Tag Manager

This website uses "Google Tag Manager", a service of the following provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google").

Google Tag Manager provides a technical basis for bundling various web applications, including tracking and analytics services, and for calibrating, controlling and making them subject to conditions via a uniform user interface. Google Tag Manager itself does not store any information on user end devices or read any such information. The service also does not carry out any independent data analysis. However, when a page is accessed, Google Tag Manager transmits your IP address to Google, where it may be stored. Transmission to servers of Google LLC. in the USA is also possible.

This processing is only carried out if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. Without this consent being granted, the use of Google Tag Manager will not take place during your visit to the page. You may revoke your consent at any time with effect for the future. To exercise your revocation, please deactivate this service in the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

Further legal information on Google Tag Manager can be found at https://business.safety.google/intl/de/privacy/ and https://policies.google.com/privacy?hl=de&gl=de

11) Retargeting / Remarketing and Conversion Tracking

11.1 Meta Pixel with Advanced Matching

Within our online offering, we use in advanced matching mode the service "Meta Pixel" of the following provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Meta")

When a user clicks on an advertisement placed by us on Facebook or Instagram, the URL of our linked page is extended by a parameter with the aid of "Meta Pixel". This URL parameter is then entered into the user's browser via a cookie set by our linked page itself after the redirect. In addition, this cookie captures specific customer data such as e-mail addresses that we collect on our website linked to the Facebook or Instagram advertisement during processes such as completed purchases, account registrations or sign-ups (advanced matching). The cookie is then read and enables the transmission of the data, including the specific customer data, to Meta.

We use "Meta Pixel" with advanced matching to make our advertisements (so-called "ads") on Facebook and/or Instagram more effective and to ensure that they correspond to the interests of users or have certain characteristics (e.g. interests in certain topics or products, which are determined on the basis of the websites visited), which we transmit to Meta (so-called "Custom Audiences").

In addition, we analyse the effectiveness of our advertisements by tracking whether users are redirected to our website after clicking on an advertisement (conversion). Compared to the standard version of "Meta Pixel", the advanced matching function helps us to better measure the effectiveness of our advertising campaigns by capturing more attributed conversions.

All transmitted data is stored and processed by Meta in such a way that an association with the respective user profile is possible and Meta can use the data for its own advertising purposes in accordance with Meta's data use policy (https://www.facebook.com/about/privacy/). The data may enable Meta and its partners to place advertisements on and outside of Facebook.

All processing operations described above, in particular the setting of cookies for reading information on the end device used, are only carried out if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. You may revoke your consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

The information generated by Meta is generally transmitted to a Meta server and stored there; in this context, transmission to servers of Meta Platforms Inc. in the USA may also occur.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

11.2 Google Ads Conversion Tracking

This website uses the online advertising programme "Google Ads" and, within the scope of Google Ads, the conversion tracking of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). We use Google Ads to draw attention to our attractive offers on external websites with the aid of advertising media (so-called Google Adwords). In relation to the data of the advertising campaigns, we can determine how successful the individual advertising measures are. In so doing, we pursue the aim of displaying advertising to you that is of interest to you, of making our website more interesting for you and of achieving a fair calculation of the advertising costs incurred.

The conversion tracking cookie is set when a user clicks on an ad placed by Google. Cookies are small text files stored on your end device. These cookies generally lose their validity after 30 days and are not used for personal identification. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognise that the user has clicked on the ad and has been directed to this page. Each Google Ads customer receives a different cookie. Cookies cannot therefore be tracked across the websites of Google Ads customers. The information obtained by means of the conversion cookie is used to compile conversion statistics for Google Ads customers who have opted for conversion tracking. Customers learn the total number of users who have clicked on their ad and been directed to a page tagged with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users. In the context of using Google Ads, personal data may also be transmitted to the servers of Google LLC. in the USA.

Details on the processing operations triggered by Google Ads Conversion Tracking and on how Google handles data from websites can be found here: https://policies.google.com/technologies/partner-sites

All processing operations described above, in particular the setting of cookies for reading information on the end device used, are only carried out if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. You may revoke your consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website.

You can also permanently object to the setting of cookies by Google Ads Conversion Tracking by downloading and installing the browser plug-in available at the following link:
https://support.google.com/My-Ad-Center-Help/answer/12155656?hl=de

Please note that certain features of this website may not be available or may only be available to a limited extent if you have disabled the use of cookies.
Google's data protection provisions can be viewed here: https://business.safety.google/intl/de/privacy/ and https://www.google.de/policies/privacy/

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

12) Website Functionalities

12.1 Vimeo

This website uses plugins for displaying and playing videos from the following provider: Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA

When you access a page of our website that contains such a plugin, your browser establishes a direct connection to the provider's servers in order to load the plugin. In this context, certain information, including your IP address, is transmitted to the provider.

If the playback of embedded videos is started via the plugin, the provider also uses cookies to collect information about user behaviour, to compile playback statistics and to prevent abusive behaviour.

If you are logged into a user account with the provider while visiting our page, your data will be directly attributed to your account when you click on a video. If you do not wish this attribution to your account, you must log out before activating the play button.

All processing operations mentioned above, in particular the setting of cookies for reading information on the end device used, are only carried out if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. You may revoke the consent given at any time with effect for the future by deactivating this service via the "Cookie Consent Tool" provided on the website.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

12.2 YouTube

This website uses plugins for displaying and playing videos from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transmitted to: Google LLC., USA

When you access a page of our website that contains such a plugin, your browser establishes a direct connection to the provider's servers at the latest when the video is played, in order to load the content. In this context, certain information, including your IP address, is transmitted to the provider.

If the playback of embedded videos is started via the plugin, the provider also uses cookies to collect information about user behaviour, to compile playback statistics and to prevent abusive behaviour.

If you are logged into a user account with the provider while visiting our page, your data will be directly attributed to your account when you click on a video. If you do not wish this attribution to your account, you must log out before activating the play button.

All processing operations mentioned above, in particular the setting of cookies for reading information on the end device used, are only carried out if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. You may revoke the consent given at any time with effect for the future by deactivating this service via the "Cookie Consent Tool" provided on the website.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

12.3 Mapbox

This website uses an online map service from the following provider: MapBox Inc., 740 15th St Nw Suite 500 Washington, DC 20005, USA

The online map service is a tool for displaying interactive (geo-)maps in order to present geographical information visually. This service is used to display our location and to facilitate potential geolocation.

Even when accessing those sub-pages into which the provider's map is integrated, information about your use of our website (such as your IP address) is transmitted to the provider's servers and stored there.

The processing of your personal data is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in designing our website in a needs-oriented manner. If you do not agree to the future transmission of your data to the provider, you have the option to completely deactivate the online map service by switching off the JavaScript application in your browser. The online map service on this website can then no longer be used.

Where legally required, we have obtained your consent pursuant to Art. 6(1)(a) GDPR for the processing of your data described above. You may revoke your consent at any time with effect for the future. To exercise your revocation, please follow the option for lodging an objection described above.

For data transfers to the USA, the provider relies on the standard contractual clauses of the European Commission, which are intended to ensure compliance with the European level of data protection.

12.4 Adobe Fonts (Typekit)

This page uses so-called web fonts for the uniform display of fonts from the following provider: Adobe Systems Incorporated, 345 Park Avenue, San Jose, CA 95110-2704, USA

When a page is accessed, your browser loads the required web fonts into its browser cache in order to display texts and fonts correctly, and establishes a direct connection to the provider's servers. In this context, certain browser information, including your IP address, is transmitted to the provider.

The processing of personal data in the course of establishing a connection with the provider of the fonts is only carried out if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. You may revoke your consent at any time with effect for the future by deactivating this service via the "Cookie Consent Tool" provided on the website. If your browser does not support web fonts, a standard font from your computer will be used.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

12.5 - Cloudflare Turnstile

On this website we use the CAPTCHA service from the following provider: Cloudflare, Inc., 101 Townsend St. San Francisco, CA 94107, USA

The service checks whether an input is made by a natural person or abusively by automated machine processing, and blocks spam, DDoS attacks and similar automated malicious accesses. To ensure that an action is performed by a human and not by an automated bot, Cloudflare Turnstile collects the IP address of the end device used, identification data of the browser and operating system type used, as well as the date and duration of the visit, and transmits these to the provider's servers for evaluation.

The processing described is only carried out if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. You may revoke your consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.
- Google reCAPTCHA

On this website we use the CAPTCHA service from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transmitted to: Google LLC, USA.

For the visual design of the captcha window, the provider uses "Google Fonts", i.e. fonts loaded by Google from the internet. This does not result in any further information beyond that already transmitted to Google via the functionality of reCAPTCHA being processed.

The service checks whether an input is made by a natural person or abusively by automated machine processing, and blocks spam, DDoS attacks and similar automated malicious accesses. To ensure that an action is performed by a human and not by an automated bot, the provider collects the IP address of the end device used, identification data of the browser and operating system type used, as well as the date and duration of the visit, and transmits these to the provider's servers for evaluation. Cookies may be used in this context, i.e. small text files stored in the browser of the end device.

Where the processing operations described above are carried out on the basis of cookies, these are only set if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. You may revoke your consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website.

Where the processing operations described above are carried out without the use of cookies, the legal basis is our legitimate interest in establishing individual personal accountability on the internet and in preventing misuse and spam pursuant to Art. 6(1)(f) GDPR.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

12.6 JotForm

For conducting surveys or online forms, we use the services of the following provider: JotForm Inc., 111 Pine St. Suite 1815, San Francisco, CA 94111, USA

The provider enables us to design and evaluate surveys and online forms. In addition to the respective personal data you enter into the forms, information about your operating system, browser, date and time of your visit, referrer URL and your IP address are also collected, transmitted to the provider and stored on the provider's servers.

The information you enter into the forms is stored with password protection to ensure that third-party access is excluded and that only we can evaluate the data for the purpose specified in each respective form.

Where personal data is processed that is necessary for the performance of a contract with you (this also applies to processing operations necessary for the implementation of pre-contractual measures), Art. 6(1)(b) GDPR serves as the legal basis. Where you have given us consent to the processing of your data, processing is carried out on the basis of Art. 6(1)(a) GDPR. Consent given may be revoked at any time with effect for the future.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

13) Tools and Miscellaneous

13.1 Cookie Consent Tool

This website uses a so-called "Cookie Consent Tool" to obtain effective user consent for consent-requiring cookies and cookie-based applications. The "Cookie Consent Tool" is displayed to users when the page is accessed in the form of an interactive user interface, in which consent for specific cookies and/or cookie-based applications can be granted by ticking a checkbox. By using the tool, all consent-requiring cookies/services are only loaded if the respective user has granted the corresponding consent by ticking a checkbox. This ensures that such cookies are only set on the respective end device of the user in the event of consent being granted.

The tool sets technically necessary cookies to store your cookie preferences. Personal user data is generally not processed in this context.

In individual cases where personal data (such as an IP address) is processed for the purpose of storing, assigning or logging cookie settings, such processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in legally compliant, user-specific and user-friendly consent management for cookies and thus in a legally compliant design of our website.

A further legal basis for the processing is also Art. 6(1)(c) GDPR. As controllers, we are under a legal obligation to make the use of technically non-essential cookies dependent on the respective user's consent.

Where necessary, we have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

Further information about the operator and the setting options of the Cookie Consent Tool can be found directly in the corresponding user interface on our website.

13.2 Yotpo Product Reviews

For the verification and publication of customer reviews, we use the services of the following provider: SMSBump Ltd., 51 Cherni vrah Blvd, Sofia, 1407, Bulgaria

If you submit a review on our website, your first name and surname, your e-mail address, the order date and number as well as the name and international references (GTIN/ISBN) are collected, transmitted to the provider and evaluated there in order to decide on the legitimacy of a customer review for a specific order. This processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in ensuring the authenticity of customer reviews by ensuring transaction-relatedness and preventing review abuse. After the review has been checked and approved, the data is deleted by the provider.

14) Rights of the Data Subject

14.1 The applicable data protection law grants you the following data subject rights (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data, with reference being made to the stated legal basis for the respective conditions of exercise:

Right of access pursuant to Art. 15 GDPR;
Right to rectification pursuant to Art. 16 GDPR;
Right to erasure pursuant to Art. 17 GDPR;
Right to restriction of processing pursuant to Art. 18 GDPR;
Right to notification pursuant to Art. 19 GDPR;
Right to data portability pursuant to Art. 20 GDPR;
Right to revoke consent given pursuant to Art. 7(3) GDPR;
Right to lodge a complaint pursuant to Art. 77 GDPR.

14.2 RIGHT TO OBJECT

WHERE WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST FOLLOWING A BALANCING OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME WITH EFFECT FOR THE FUTURE ON GROUNDS ARISING FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, CONTINUED PROCESSING IS RESERVED WHERE WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR WHERE THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

WHERE YOUR PERSONAL DATA IS PROCESSED BY US FOR THE PURPOSE OF CONDUCTING DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

15) Duration of Storage of Personal Data

The duration of the storage of personal data is determined by the respective legal basis, the purpose of processing and — where applicable — additionally by the respective statutory retention period (e.g. commercial and tax law retention periods).

Where personal data is processed on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the data concerned is stored until you revoke your consent.

Where statutory retention periods exist for data processed in the context of contractual or quasi-contractual obligations on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted after the retention periods have expired, provided it is no longer required for the performance or initiation of the contract and/or there is no longer a legitimate interest on our part in its continued storage.

Where personal data is processed on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data is processed for the purpose of direct marketing on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(2) GDPR.

Unless otherwise indicated by the other information in this declaration regarding specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

(As of June 2026 – This policy is drafted in the German language; any translation into another language is provided for ease of understanding only. In the event of any conflict between the German text and the translated text, the German text shall prevail.)

Product Catalogs