Privacy Policy

Data Protection Information in accordance with Articles 13 and 14 of the GDPR

Below you will find our data protection information for applicants, customers and suppliers available for download.

Data-Protection-Information-Applicants (PDF)

Data-Protection-Information-Customers (PDF)

Data-Protection-Information-Suppliers )PDF)

The controller responsible for data processing is:

CHANGE Sportswear GmbH & Co. KG

Industriestraße 2a

93192 Wald/Rossbach

Email: shopify@cambio.de

We are pleased that you are interested in our website. The protection of your privacy is very important to us. Below, we provide you with detailed information about how we handle your data.

1. Access Data and Hosting

You can visit our websites without providing any personal information. Each time a website is accessed, the web server automatically stores only a so-called server log file, which contains, for example, the name of the requested file, your IP address, the date and time of access, the amount of data transferred and the requesting provider (access data), and documents the access. This access data is evaluated exclusively for the purpose of ensuring the trouble-free operation of the website and improving our services. This serves to safeguard our legitimate interests in the correct presentation of our services, which prevail in the context of a balancing of interests, pursuant to Art. 6(1) sentence 1 lit. f GDPR. All access data is deleted no later than one month after the end of your visit to the website.

1.1 Hosting

The services for hosting and displaying the website are partly provided by our service providers as part of processing on our behalf. Unless otherwise explained in this Privacy Policy, all access data and all data collected in forms provided for this purpose on this website are processed on their servers. If you have any questions about our service providers and the basis of our cooperation with them, please contact us using the contact option described in this Privacy Policy.

Our service providers are based and/or use servers in the following countries for which the European Commission has determined an adequate level of data protection by means of an adequacy decision: Canada, New Zealand, Japan, United Kingdom, USA.

The adequacy decision for the USA applies as the basis for transfers to third countries, provided that the respective service provider is certified. Until our service providers are certified, the data transfer continues to be based on the following basis: Standard Contractual Clauses of the European Commission.

Our service providers are based and/or use servers in the following countries: Australia, India, Singapore.
There is no adequacy decision by the European Commission for these countries. Our cooperation with them is based on the following safeguards: Standard Contractual Clauses of the European Commission.

1.2 Content Delivery Network

For the purpose of reducing loading times, we use a so-called Content Delivery Network (“CDN”) for some services. With this service, content, e.g. large media files, is delivered via regionally distributed servers of external CDN service providers. Access data is therefore processed on the service providers’ servers. Our service providers act on our behalf as processors.

Our service providers are based and/or use servers in countries outside the EU and the EEA. There is no adequacy decision by the European Commission for these countries.
Our cooperation with them is based on the Standard Contractual Clauses of the European Commission.

If you have any questions about our service providers and the basis of our cooperation with them, please contact us using the contact option described in this Privacy Policy.

2. Data Processing for Contractual Processing and Contact

2.1 Data Processing for Contractual Processing

For the purpose of processing the contract (including enquiries regarding and the processing of any existing claims arising from warranty rights, performance issues and the right of withdrawal as well as any statutory updating obligations), we collect personal data pursuant to Art. 6(1) sentence 1 lit. b GDPR if you voluntarily provide it to us as part of your order. Mandatory fields are marked as such, as in these cases we require the data in order to process the contract and cannot dispatch the order without this information. The data collected can be seen from the respective input forms.

Further information on the processing of your data, in particular on its disclosure to our service providers for the purposes of processing orders, payments and shipping, can be found in the following sections of this Privacy Policy. Once the contract has been fully processed, your data will be restricted for further processing and deleted after expiry of the retention periods under tax and commercial law pursuant to Art. 6(1) sentence 1 lit. c GDPR, unless you have expressly consented to further use of your data pursuant to Art. 6(1) sentence 1 lit. a GDPR or we reserve the right to use data beyond this, as permitted by law and about which we inform you in this Policy.

Merchandise Management System

For order and contract processing, we use merchandise management systems provided by external service providers. Our service providers act on our behalf as processors. If you have any questions about our service providers and the basis of our cooperation with them, please contact us using the contact option described in this Privacy Policy.

2.2 Customer Account

If you have given your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR by choosing to open a customer account, we use your data for the purpose of opening the customer account and storing your data for future orders on our website. You can delete your customer account at any time either by sending a message using the contact option described in this Privacy Policy or by using a function provided for this purpose in the customer account. After your customer account has been deleted, your data will be deleted unless you have expressly consented to further use of your data pursuant to Art. 6(1) sentence 1 lit. a GDPR or we reserve the right to use data beyond this, as permitted by law and about which we inform you in this Policy.

Contact

As part of customer communication, we collect personal data for the purpose of processing your enquiries pursuant to Art. 6(1) sentence 1 lit. b GDPR if you voluntarily provide us with this data when contacting us (e.g. via contact form, live chat tool or email). Mandatory fields are marked as such, as in these cases we require the data in order to process your enquiry. The data collected can be seen from the respective input forms. Once your enquiry has been fully processed, your data will be deleted unless you have expressly consented to further use of your data pursuant to Art. 6(1) sentence 1 lit. a GDPR or we reserve the right to use data beyond this, as permitted by law and about which we inform you in this Policy.

3. Data Processing for Shipping Purposes

For the performance of the contract pursuant to Art. 6(1) sentence 1 lit. b GDPR, we disclose your data to the shipping service provider commissioned with delivery, insofar as this is necessary for the delivery of the goods ordered. If you have any questions about our service providers and the basis of our cooperation with them, please contact us using the contact option described in this Privacy Policy.

Disclosure of Data to Shipping Service Providers for the Purpose of Shipping Notifications

If you have given us your express consent to do so during or after your order, we will disclose your email address and telephone number to the selected shipping service provider on the basis of this consent pursuant to Art. 6(1) sentence 1 lit. a GDPR so that the shipping service provider can contact you prior to delivery for the purpose of announcing or coordinating the delivery.

Consent can be withdrawn at any time by sending a message using the contact option described in this Privacy Policy. Following withdrawal, we will delete the data you have provided for this purpose unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, as permitted by law and about which we inform you in this Policy. If you have any questions about our service providers and the basis of our cooperation with them, please contact us using the contact option described in this Privacy Policy.

4. Data Processing for Payment Processing

When processing payments in our online shop, we work with the following partners: technical service providers, credit institutions and payment service providers.

4.1 Data Processing for Transaction Processing

Depending on the selected payment method, we disclose the data required to process the payment transaction to our technical service providers, the commissioned credit institutions or the selected payment service provider, insofar as this is necessary for processing the payment. This serves the performance of the contract pursuant to Art. 6(1) sentence 1 lit. b GDPR. In some cases, payment service providers collect the data required to process the payment themselves, e.g. on their own website or via technical integration into the ordering process. In this respect, the Privacy Policy of the respective payment service provider applies.

Depending on the selected payment method, data may be transferred to third countries outside the EU/EEA for which the European Commission has determined an adequate level of data protection by means of an adequacy decision. Where data is transferred to third countries outside the EU/EEA for which the European Commission has not adopted an adequacy decision, the cooperation is based on the Standard Contractual Clauses of the European Commission.

If you have any questions about our payment processing partners or the basis of our cooperation with them, please contact us using the contact option specified in this Privacy Policy.

4.2 Data Processing for the Purposes of Fraud Prevention and Optimisation of Our Payment Processes

Where applicable, we provide the aforementioned service providers with additional data, which they use together with the data required for payment processing for the purposes of fraud prevention and optimisation of our payment processes (e.g. invoicing, processing disputed payments, supporting accounting). Pursuant to Art. 6(1) sentence 1 lit. f GDPR, this serves to safeguard our legitimate interests in protecting ourselves against fraud and in efficient payment management, which prevail in the context of a balancing of interests.

5. Advertising by Email

5.1 Email Newsletter with Registration and Newsletter Tracking

If you subscribe to our newsletter, we use the data required for this purpose or separately provided by you to send you our email newsletter on a regular basis on the basis of your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR. You can unsubscribe from the newsletter at any time either by sending a message using the contact option described below or via a link provided for this purpose in the newsletter. After unsubscribing, we will delete your email address from the recipient list unless you have expressly consented to further use of your data pursuant to Art. 6(1) sentence 1 lit. a GDPR or we reserve the right to use data beyond this, as permitted by law and about which we inform you in this Policy.

Please note that when sending the newsletter, we evaluate your user behaviour. For this purpose, we also analyse your interaction with our newsletter by measuring, storing and evaluating opening rates and click-through rates for the purpose of designing future newsletter campaigns (“newsletter tracking”).

For this analysis, the emails sent contain single-pixel technologies (e.g. so-called web beacons, tracking pixels) that are stored on our website. For the analyses, we link in particular the following “newsletter data”:

the page from which the page was requested (so-called referrer URL),
the date and time of access,
the description of the type of web browser used,
the IP address of the requesting computer,
the email address,
the date and time of registration and confirmation

and the single-pixel technologies with your email address or your IP address and, where applicable, an individual ID. Links contained in the newsletter may also contain this ID.

If you do not wish to have newsletter tracking, you can unsubscribe from the newsletter at any time as described above.

The information is stored for as long as you are subscribed to the newsletter.

Email Newsletter without Registration and Your Right to Object

If we receive your email address in connection with the sale of goods or services, we reserve the right to regularly send you offers by email for products from our range that are similar to those you have already purchased. We will not send you such offers if you have already objected to this use of your email address or if you are registered on a Robinson list that must be observed by law.

You may object to this use of your email address at any time, easily and free of charge, either by sending a message using the contact option described in this Privacy Policy or via a link provided for this purpose in the promotional email, i.e. without incurring any costs other than the transmission costs according to the basic tariffs. After unsubscribing, we will delete your email address from the recipient list unless you have expressly consented to further use of your data pursuant to Art. 6(1) sentence 1 lit. a GDPR or we reserve the right to use data beyond this, as permitted by law and about which we inform you in this Policy.

5.2 Newsletter Distribution

The newsletter and the newsletter tracking described above may also be sent by our service providers as part of processing on our behalf. If you have any questions about our service providers and the basis of our cooperation with them, please contact us using the contact option described in this Privacy Policy.

The adequacy decision for the USA applies as the basis for transfers to third countries, provided that the respective service provider is certified. Certification is in place.

Our service providers are based and/or use servers in the following countries: Australia, Singapore. There is no adequacy decision by the European Commission for these countries. Our cooperation with them is based on the following safeguards: Standard Contractual Clauses of the European Commission.

5.3 Sending Review Requests by Email

If you have given us your express consent to do so during or after your order pursuant to Art. 6(1) sentence 1 lit. a GDPR, we will use your email address to request a review of your order via the review system used by us. This consent can be withdrawn at any time by sending a message using the contact option described in this Privacy Policy or via a link provided for this purpose in the review request. Once you have withdrawn your consent, we will delete your email address from the recipient list unless you have expressly consented to further use of your data pursuant to Art. 6(1) sentence 1 lit. a GDPR or we reserve the right to use data beyond this, as permitted by law and about which we inform you in this Policy.

The review requests may also be sent by our service provider Trusted Shops SE, Subbelrather Str. 15C, 50823 Cologne (“Trusted Shops”).

As part of sending review requests, we receive information from Trusted Shops about the respective status (e.g. whether the review request has been sent and whether it has been received). This is carried out pursuant to Art. 6(1) sentence 1 lit. f GDPR to fulfil our legitimate interest in receiving information about the review invitations in order to make optimisations on this basis where applicable, as well as to fulfil Trusted Shops’ legitimate interest in being able to provide this service.

We and Trusted Shops are jointly responsible for sending review requests and for collecting and displaying review and status information.

Within the scope of the joint controllership between us and Trusted Shops, if you have any questions about data protection or wish to exercise your rights, please preferably contact Trusted Shops using the contact options provided here. Further information on data protection can be found via the following link here. Irrespective of this, you can always contact us using the contact option described in this Privacy Policy. Your enquiry will then, where necessary, be forwarded to the other controller for a response.

6. Cookies and Other Technologies

6.1 General Information

In order to make your visit to our website attractive and to enable the use of certain functions, we use technologies, including so-called cookies, on various pages. Cookies are small text files that are automatically stored on your end device. Some of the cookies we use are deleted after the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your end device and enable us to recognise your browser on your next visit (persistent cookies). You can find the duration of storage in the overview in your web browser’s cookie settings.

Protection of Privacy on End Devices

When you use our online services, we use technologies that are strictly necessary in order to provide the expressly requested digital service. The storage of information on your end device or access to information already stored on your end device does not require consent in this respect.

For functions that are not strictly necessary, the storage of information on your end device or access to information already stored on your end device requires your consent. Please note that if you do not give your consent, parts of the website may not be fully usable. Any consent you have given will remain in place until you adjust or reset the relevant settings on your end device.

Any Subsequent Data Processing through Cookies and Other Technologies

We use technologies that are strictly necessary for the use of certain functions of our website. These technologies collect and process the IP address, time of visit, device and browser information, as well as information about your use of our website. In the context of a balancing of interests, this serves our overriding legitimate interests in an optimised presentation of our services pursuant to Art. 6(1) sentence 1 lit. f GDPR.

In addition, we use technologies to fulfil the legal obligations to which we are subject (e.g. to be able to demonstrate consent to the processing of your personal data) as well as for web analytics and online marketing. Further information on this, including the respective legal basis for data processing, can be found in the following sections of this Privacy Policy.

Cookie Settings

You can find the cookie settings for your browser via the following links: Microsoft Edge™ / Safari™ / Chrome™ / Firefox™ / Opera™.

If you have consented to the use of technologies pursuant to Art. 6(1) sentence 1 lit. a GDPR, you can withdraw your consent at any time by sending a message using the contact option described in the Privacy Policy. Alternatively, you can click on the privacy button. If cookies are not accepted, the functionality of our website may be restricted.

6.2 Consent Manager Platform (CMP)

On our website, we use a consent management service (“Consent Manager Platform (CMP)”) to inform you about the cookies and other technologies we use on our website and, where required, to obtain, manage and document your consent to the processing of your personal data by these technologies. This is necessary pursuant to Art. 6(1) sentence 1 lit. c GDPR in order to fulfil our legal obligation under Art. 7(1) GDPR to be able to demonstrate your consent to the processing of your personal data. The Consent Manager Platform (CMP) used is a service provided by Pandectes GDPR Compliance, Pudisoo küla, Männimäe/1, 74626, Kuusalu vald, Estonia, which processes your data on our behalf.

After you submit your cookie declaration on our website, the web server stores the following data: IP address, device information, browser information, selected language, website accessed or its URL, date and time of your declaration of consent, as well as information about your consent behaviour.

In addition, the following technologies are used which contain information about your consent behaviour: cookies, log files.

Your data will be deleted after three years unless you have expressly consented to further use of your data pursuant to Art. 6(1) sentence 1 lit. a GDPR or we reserve the right to use data beyond this, as permitted by law and about which we inform you in this Policy.

7. Use of Cookies and Other Technologies

We use the following cookies and other technologies from third-party providers on our website. Unless otherwise specified for the individual technologies, this is based on your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR. Once the purpose no longer applies and we have ceased using the respective technology, the data collected in this context will be deleted. You can withdraw your consent at any time with effect for the future. Further information about your options for withdrawal can be found in the section “Cookies and Other Technologies”. Further information, including the basis of our cooperation with the individual providers, can be found under the respective technologies. If you have any questions about the providers and the basis of our cooperation with them, please contact us using the contact option described in this Privacy Policy.

7.1 Use of Google Services

We use the technologies described below from Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The information about your use of our website automatically collected by Google technologies is generally transferred to and stored on a server of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Unless otherwise specified for the individual technologies, data processing is based on an agreement concluded for the respective technology between joint controllers pursuant to Art. 26 GDPR. Further information about data processing by Google can be found in Google’s Privacy Policy.

Our service providers are based and/or use servers in countries outside the EU and the EEA for which the European Commission has determined an adequate level of data protection by means of an adequacy decision.

Our service providers are based and/or use servers in countries outside the EU and the EEA. There is no adequacy decision by the European Commission for these countries. Our cooperation with them is based on the Standard Contractual Clauses of the European Commission.

Google Analytics

For the purpose of website analysis, Google Analytics automatically collects and stores data (IP address, time of visit, device and browser information as well as information about your use of our website), from which user profiles are created using pseudonyms. Cookies may be used for this purpose. If you visit our website from the EU, your IP address is stored on a server located in the EU to derive location data and is then immediately deleted before the traffic is forwarded to other Google servers for processing. The data processing is carried out on the basis of a data processing agreement with Google.

For the purpose of optimised marketing of our website, we have activated the data sharing settings for “Google products and services”. This allows Google to access the data collected and processed by Google Analytics and subsequently use it to improve Google services. The sharing of data with Google under these data sharing settings is based on an additional agreement between controllers. We have no influence over the subsequent processing of the data by Google.

For the purpose of optimised marketing of our website, we use the so-called User ID function. This function enables us to assign a unique, permanent ID to your interaction data from one or more sessions on our online presences and thus analyse your user behaviour across devices and sessions.

For web analytics, the Google Analytics extension function Google Signals enables so-called “cross-device tracking”. If your internet-enabled devices are linked to your Google account and you have activated the “personalised advertising” setting in your Google account, Google can create reports about your usage behaviour (in particular cross-device user numbers), even if you change your end device. We do not process personal data in this respect; we merely receive statistics generated on the basis of Google Signals.

For web analytics and advertising purposes, the Google Analytics extension function known as the DoubleClick cookie enables your browser to be recognised when you visit other websites. Google will use this information to compile reports on website activity and to provide other services related to website use.

If you do not give us your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR to the use of Google Analytics, no cookies will be stored on or read from your device. The data processing described in the preceding paragraphs will not take place. In order to close gaps in web analytics through behavioural and conversion modelling, pings containing data (user agent, information about your consent behaviour, screen resolution, IP address) are sent to Google.

Google Ads

For advertising purposes in Google search results and on third-party websites, when you visit our website the so-called Google Remarketing cookie is set, which automatically enables interest-based advertising by collecting and processing data (IP address, time of visit, device and browser information as well as information about your use of our website), using a pseudonymous cookie ID and on the basis of the pages you have visited. Any further data processing only takes place if you have activated the “personalised advertising” setting in your Google account. If, in this case, you are logged into Google while visiting our website, Google uses your data together with Google Analytics data to create and define target group lists for cross-device remarketing.

For website analysis and event tracking, we use Google Ads Conversion Tracking to measure your subsequent usage behaviour if you have reached our website via a Google Ads advertisement. Cookies may be used for this purpose and data may be collected (IP address, time of visit, device and browser information as well as information about your use of our website based on events specified by us, such as visiting a website or subscribing to a newsletter), from which user profiles are created using pseudonyms.

If you do not give us your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR to the use of Google Ads, no cookies will be stored on or read from your device. The data processing described in the preceding paragraphs will not take place. In order to close gaps in web analytics through behavioural and conversion modelling, pings containing data (user agent, information about your consent behaviour, screen resolution, IP address, page URL, information about ad clicks in URL parameters) are sent to Google. Your IP address is used to derive the IP country.

Google Maps

For the visual presentation of geographical information, Google Maps collects data about your use of the Maps functions, in particular your IP address and location data, transmits this data to Google and subsequently processes it. We have no influence over this subsequent data processing.

Google reCAPTCHA

For the purpose of protecting against misuse of our web forms and spam by automated software (so-called bots), Google reCAPTCHA collects data (IP address, time of visit, browser information and information about your use of our website) and analyses your use of our website by means of so-called JavaScript and cookies. In addition, other cookies stored in your browser by Google services are evaluated. The data processing is carried out on the basis of a data processing agreement with Google. Users of a customer who access websites protected by reCAPTCHA are no longer subject to Google’s Privacy Policy and Terms of Service.

Google Tag Manager

Google Tag Manager enables us to manage various codes and services on our website. When implementing the individual tags, Google may also process personal data (e.g. IP address, online identifiers, including cookies). The data processing is carried out on the basis of a data processing agreement with Google.

The use of Google Tag Manager enables various services/technologies to be integrated.
If you do not wish individual tracking services to be used and have therefore deactivated them, the deactivation remains in place for all affected tracking tags integrated via Google Tag Manager.

7.2 Use of Meta Services

Use of Meta Pixel

We use Meta Pixel as part of the technologies described below from Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland (“Facebook (by Meta)” or “Meta Platforms Ireland”). Meta Pixel automatically collects and stores data (IP address, time of visit, device and browser information as well as information about your use of our website based on events specified by us, such as visiting a website or subscribing to a newsletter), from which user profiles are created using pseudonyms. As part of so-called advanced matching, information that can identify individuals (e.g. names, email addresses and telephone numbers) is also collected and stored in hashed form for matching purposes. For this purpose, when you visit our website, Meta Pixel automatically sets a cookie which automatically enables your browser to be recognised by means of a pseudonymous cookie ID when you visit other websites. Meta Platforms Ireland will combine this information with other data from your Facebook account and use it to compile reports on website activities and to provide other services related to website use, in particular personalised and group-based advertising.

The information about your use of our website automatically collected by the technologies of Meta Platforms Ireland is generally transferred to and stored on a server of Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025, USA. Further information about data processing by Meta Platforms Ireland can be found in Meta Platforms Ireland’s Privacy Policy.

The adequacy decision for the USA applies as the basis for transfers to third countries, provided that the respective service provider is certified. Certification is in place.

Our service providers are based and/or use servers in the following countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Mexico. There is no adequacy decision by the European Commission for these countries. Our cooperation with them is based on the following safeguards: Standard Contractual Clauses of the European Commission.

Meta Ads Manager

We use Meta Ads Manager to advertise this website on Facebook (by Meta) and other platforms. We determine the parameters of the respective advertising campaign. Meta Platforms Ireland is responsible for the precise implementation, in particular the decision regarding the placement of advertisements for individual users. Unless otherwise specified for the individual technologies, the data processing is based on an agreement between joint controllers pursuant to Art. 26 GDPR. Joint controllership is limited to the collection of data and its transmission to Meta Platforms Ireland. The subsequent processing of data by Meta Platforms Ireland is not covered by this.

Based on the statistics on visitor activity on our website generated via Meta Pixel, we conduct group-based advertising on Facebook (by Meta) via Custom Audiences by determining the characteristics of the respective target group. As part of the advanced matching process (see above) carried out to determine the respective target group, Meta Platforms Ireland acts as our processor.

Based on the pseudonymous cookie ID set by Meta Pixel and the data collected about your usage behaviour on our website, we conduct personalised advertising via Custom Audiences.

Via Conversions (through Meta Pixel or Conversations API), we measure your subsequent usage behaviour for web analytics and event tracking if you have reached our website via an advertisement from Meta Ads Manager. The data processing is carried out on the basis of a data processing agreement with Meta Platforms Ireland.

7.3 Other Providers of Web Analytics and Online Marketing Services

Use of Pinterest Tag for Web Analytics and Advertising Purposes

For web analytics and advertising purposes on Pinterest and on third-party websites, when you visit our website technologies from Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland (“Pinterest”), automatically enable interest-based advertising through the collection and processing of data (IP address, time of visit, device and browser information as well as information about your use of our website based on events specified by us, such as visiting a website or subscribing to a newsletter), by means of a pseudonymous cookie ID and on the basis of the pages you have visited. User profiles are created from the collected data using pseudonyms. Pinterest will combine this information with other data from your Pinterest account and use it to compile reports on website activity and to provide other services related to website use. We have no influence over data processing by Pinterest and merely receive statistics generated on the basis of the Pinterest Tag. This enables us to measure your subsequent usage behaviour for website analysis and event tracking if you have reached our website via a Pinterest advertisement. The information automatically collected by Pinterest is generally transferred to and stored on a server of Pinterest, Inc., 505 Brannan St., San Francisco, CA 94107, USA. Data processing is based on an agreement between joint controllers pursuant to Art. 26 GDPR.

Our service providers are based and/or use servers in countries outside the EU and the EEA. There is no adequacy decision by the European Commission for these countries. Our cooperation with them is based on the Standard Contractual Clauses of the European Commission.

Use of Vimeo Video Plugin for the Integration of Third-Party Content

For the integration of third-party content, the video plugin from Vimeo Inc., 330 West 34th Street, 5th Floor, New York 10011, USA (“Vimeo”) collects data (IP address, time of visit, device and browser information), transmits it to Vimeo and subsequently processes it. Data processing is based on an agreement between joint controllers pursuant to Art. 26 GDPR. Google Analytics is automatically integrated into the Vimeo Video Plugin. For the purpose of website analysis, Google Analytics automatically collects and stores data (IP address, time of visit, device and browser information as well as information about your use of our website), from which user profiles are created using pseudonyms. Cookies may be used for this purpose. Google Analytics is a service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The information about your use of our website automatically collected by Google is generally transferred to and stored on a server of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. If you visit our website from the EU, your IP address is stored on a server located in the EU to derive location data and is then immediately deleted before the traffic is forwarded to other Google servers for processing. We have no influence over or access to the data processing by Vimeo, including the settings and results of Google Analytics.

Our service providers are based and/or use servers in countries outside the EU and the EEA. There is no adequacy decision by the European Commission for these countries. Our cooperation with them is based on the Standard Contractual Clauses of the European Commission.

8. Integration of the Trusted Shops Trustbadge/Other Widgets

Trusted Shops widgets are integrated into this website to display Trusted Shops services (e.g. trustmark, collected reviews).

This serves to safeguard our legitimate interests in optimal marketing by enabling secure shopping, which prevail in the context of a balancing of interests, pursuant to Art. 6(1) sentence 1 lit. f GDPR. The Trustbadge and the services advertised with it are provided by Trusted Shops SE, Subbelrather Str. 15C, 50823 Cologne (“Trusted Shops”), with whom we are joint controllers under data protection law pursuant to Art. 26 GDPR. As part of this Privacy Policy, we inform you below about the essential content of the agreement pursuant to Art. 26(2) GDPR.

When interacting with Trustbadge AI+, session cookies are set to store the login status and display the so-called Welcome Layer, which displays the details of the respective online shop (company information, reviews, information about the existence of buyer protection) as well as the #trstd secret. To recognise logged-in users, a cookie is set and stored for a maximum of 400 days after login. In addition, session cookies are set to send push notifications when using the app, provided that the user has allowed them. This is necessary so that Trusted Shops can provide the digital service requested by you. Trusted Shops is responsible for data processing when interacting with Trustbadge AI+.

Within the scope of the joint controllership between us and Trusted Shops SE, if you have any questions about data protection or wish to exercise your rights, please preferably contact Trusted Shops using the contact options provided in the privacy information. Irrespective of this, you can always contact the controller of your choice. Your enquiry will then, where necessary, be forwarded to the other controller for a response.

8.1 Data Processing When Integrating the Trustbadge/Other Widgets

The Trustbadge is provided by a US-based CDN provider (Content Delivery Network). An adequate level of data protection is ensured in each case by an adequacy decision of the EU Commission, which can be accessed for the USA here. Service providers used in the USA are generally certified under the EU-U.S. Data Privacy Framework (DPF). Further information is available here. Where service providers used are not certified under the DPF, Standard Contractual Clauses have been concluded as an appropriate safeguard.

When the Trustbadge is accessed, the web server automatically stores a so-called server log file, which also contains your IP address, date and time of access, the amount of data transferred and the requesting provider (access data), and documents the access. The IP address is anonymised immediately after collection so that the stored data cannot be attributed to you personally. The anonymised data is used in particular for statistical purposes and error analysis.

8.2 Data Processing after Completion of an Order

After completion of an order, order information (order totals, order number and, where applicable, product purchased) as well as your email address hashed using a cryptographic one-way function are transmitted to Trusted Shops. The legal basis is Art. 6(1) sentence 1 lit. f GDPR. This serves to verify whether you are already registered for Trusted Shops services and is therefore necessary to fulfil our and Trusted Shops’ overriding legitimate interests in providing the respective transactional review services linked to the specific order pursuant to Art. 6(1) sentence 1 lit. f GDPR. If you are registered, further processing takes place in accordance with the contractual agreement concluded between you and Trusted Shops. If you are not yet registered for the services, you will subsequently be given the opportunity to do so for the first time. Further processing after registration is likewise governed by the contractual agreement with Trusted Shops. If you are not yet registered for the services, you will subsequently be given the opportunity to consent to receiving review invitations. If you do not give this consent, all transmitted data will automatically be deleted by Trusted Shops and it will then no longer be possible to link the data to an individual.

Trusted Shops uses service providers in the areas of hosting, monitoring and logging. The legal basis is Art. 6(1) lit. f GDPR for the purpose of ensuring trouble-free operation. Processing may take place in third countries (USA, United Kingdom and Israel). An adequate level of data protection is ensured in each case by an adequacy decision of the EU Commission, which can be accessed for the USA here, for the United Kingdom here and for Israel here. Service providers used in the USA are generally certified under the EU-U.S. Data Privacy Framework (DPF). Further information is available here. Where service providers used are not certified under the DPF, Standard Contractual Clauses have been concluded as an appropriate safeguard.

9. Social Media

Our Online Presence on Facebook (by Meta), Instagram (by Meta), YouTube, LinkedIn

If you have given your consent to the respective social media operator pursuant to Art. 6(1) sentence 1 lit. a GDPR, when you visit our online presences on the aforementioned social media platforms, your data is automatically collected and stored for market research and advertising purposes, from which user profiles are created using pseudonyms. These may be used, for example, to display advertisements within and outside the platforms that are presumed to correspond to your interests. Cookies are generally used for this purpose. For detailed information on the processing and use of data by the respective social media operator, as well as contact options and your rights and settings options for protecting your privacy, please refer to the providers’ privacy policies linked below. If you still require assistance in this regard, you can contact us.

Facebook (by Meta) is a service provided by Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland (“Meta Platforms Ireland”). The information about your use of our online presence on Facebook (by Meta) automatically collected by Meta Platforms Ireland is generally transferred to and stored on a server of Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025, USA. Data processing in connection with a visit to a Facebook (by Meta) fan page is based on an agreement between joint controllers pursuant to Art. 26 GDPR. Further information (information on Insights data) can be found here.

The adequacy decision for the USA applies as the basis for transfers to third countries, provided that the respective service provider is certified. Certification is in place.

Our service providers are based and/or use servers in the following countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Mexico.
There is no adequacy decision by the European Commission for these countries. Our cooperation with them is based on the following safeguards: Standard Contractual Clauses of the European Commission.

Instagram (by Meta) is a service provided by Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland (“Meta Platforms Ireland”). The information about your use of our online presence on Instagram automatically collected by Meta Platforms Ireland is generally transferred to and stored on a server of Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. Data processing in connection with a visit to an Instagram (by Meta) fan page is based on an agreement between joint controllers pursuant to Art. 26 GDPR. Further information (information on Insights data) can be found here.

The adequacy decision for the USA applies as the basis for transfers to third countries, provided that the respective service provider is certified. Certification is in place.

Our service providers are based and/or use servers in the following countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Mexico.
There is no adequacy decision by the European Commission for these countries. Our cooperation with you is based on the following safeguards: Standard Contractual Clauses of the European Commission.

YouTube is a service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The information about your use of our online presence on YouTube automatically collected by Google is generally transferred to and stored on a server of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Our service providers are based and/or use servers in countries outside the EU and the EEA. There is no adequacy decision by the European Commission for these countries. Our cooperation with them is based on the Standard Contractual Clauses of the European Commission.

LinkedIn is a service provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”). The information about your use of our online presence on LinkedIn automatically collected by LinkedIn is generally transferred to and stored on a server of LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.

The adequacy decision for the USA applies as the basis for transfers to third countries, provided that the respective service provider is certified. Certification is in place.

10. Contact Options and Your Rights

10.1 Your Rights

As a data subject, you have the following rights:

pursuant to Art. 15 GDPR, the right to request information about your personal data processed by us to the extent specified therein;
pursuant to Art. 16 GDPR, the right to request without undue delay the rectification of inaccurate personal data or completion of your personal data stored by us;
pursuant to Art. 17 GDPR, the right to request the erasure of your personal data stored by us, unless further processing is necessary
- to exercise the right to freedom of expression and information;
- to comply with a legal obligation;
- for reasons of public interest; or
- for the establishment, exercise or defence of legal claims;
pursuant to Art. 18 GDPR, the right to request restriction of the processing of your personal data where
- you contest the accuracy of the data;
- the processing is unlawful, but you oppose its erasure;
- we no longer require the data, but you require it for the establishment, exercise or defence of legal claims; or
- you have objected to processing pursuant to Art. 21 GDPR;
pursuant to Art. 20 GDPR, the right to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller;
pursuant to Art. 77 GDPR, the right to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority at your usual place of residence or place of work or at our company’s registered office.

Right to Object

Insofar as we process personal data as explained above to safeguard our legitimate interests, which prevail in the context of a balancing of interests, you may object to this processing with effect for the future. If the processing is carried out for direct marketing purposes, you may exercise this right at any time as described above. If the processing is carried out for other purposes, you only have a right to object on grounds relating to your particular situation.

After you have exercised your right to object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing serves the establishment, exercise or defence of legal claims.

This does not apply if the processing is carried out for direct marketing purposes. In this case, we will no longer process your personal data for this purpose.

10.2 Contact Options

If you have any questions about the collection, processing or use of your personal data, requests for information, rectification, restriction or erasure of data, withdrawal of consent given or objection to a particular use of data, please contact us directly using the contact details provided in our Legal Notice.

Data Protection Officer:
Datenschutz Symbiose GmbH, Dr Marion Herrmann
Hundingstr. 12
95445 Bayreuth
Germany

mh@datenschutz-symbiose.de