The controller responsible for data processing is:
CHANGE Sportswear GmbH & Co. KG
Industriestraße 2a
93192 Wald/Rossbach
Germany
shopify@cambio.de
Email: shopify@cambio.de

We are pleased that you are interested in our online shop. The protection of your privacy is very important to us. Below, we provide you with detailed information about how your data is handled.

1. Access Data and Hosting

You can visit our websites without providing any personal information. Each time a website is accessed, the web server automatically stores only a server log file which contains, for example, the name of the requested file, your IP address, the date and time of access, the amount of data transferred and the requesting provider (access data), and documents the access.

This access data is evaluated exclusively for the purpose of ensuring the trouble-free operation of the website and improving our services. Pursuant to Art. 6(1)(f) GDPR, this serves to safeguard our legitimate interests in the appropriate presentation of our services, which prevail in the context of a balancing of interests. All access data is deleted no later than one month after the end of your visit to the website.

1.1 Hosting

The services for hosting and displaying the website are partly provided by our service providers as part of processing on our behalf. Unless otherwise stated in this Privacy Policy, all access data as well as all data collected in the forms provided for this purpose on this website are processed on their servers. If you have any questions about our service providers and the basis of our cooperation with them, please contact the contact person specified in this Privacy Policy.

Our service providers are based and/or use servers in the following countries for which the European Commission has determined an adequate level of data protection by means of an adequacy decision: Canada, New Zealand, Japan, United Kingdom, USA.

The adequacy decision for the USA serves as the basis for transfers to third countries, provided that the respective service provider is certified. Pending certification of our service providers, the data transfer continues to be based on the following basis: Standard Contractual Clauses of the European Commission.

Our service providers are based and/or use servers in the following countries: Australia, India, Singapore.
The European Commission has not adopted an adequacy decision for these countries. Our cooperation with these service providers is based on the following safeguards: Standard Contractual Clauses of the European Commission.

1.2 Content Delivery Network

In order to reduce loading times, we use a Content Delivery Network (“CDN”) for several of our services. This service enables content, e.g. large media files, to be delivered via regional servers of external CDN service providers. As a result, access data is processed on the service providers’ servers. Our service providers act on our behalf as processors.

Our service providers are based and/or use servers in countries outside the EU and the EEA. The European Commission has not adopted an adequacy decision for these countries.

Our cooperation is based on the Standard Contractual Clauses adopted by the European Commission. If you have any questions about our service providers and the basis of our cooperation with them, please contact the contact person specified in this Privacy Policy.

2. Data Processing for the Purposes of Contract Performance and Contact

2.1 Data Processing for the Purposes of Contract Performance

We collect data for the purposes of contract performance (including enquiries and the processing of any claims under warranty rights, the right to performance and the right of withdrawal, as well as any statutory updating obligations) pursuant to Art. 6(1)(b) GDPR when you voluntarily provide it to us as part of your order. Mandatory fields are marked as such because, in these cases, we absolutely require this data to perform the contract and cannot dispatch the order without it. The respective input forms show which data is collected.

Further information on the processing of your data, in particular on its transfer to our service providers for the purposes of processing orders, payments and deliveries, can be found in the following sections of this Privacy Policy. Once the contract has been fully performed, we restrict the further processing of your data and delete it after expiry of the statutory retention periods under tax and commercial law pursuant to Art. 6(1)(c) GDPR, unless you have expressly consented to further use of your data pursuant to Art. 6(1)(a) GDPR or we reserve the right to use data beyond this, as permitted by law and about which we inform you in this Policy.

Merchandise Management System

We use an external merchandise management system service provider for the purposes of processing orders and contracts. Our service providers act on our behalf as processors. If you have any questions about our service providers and the basis of our cooperation with them, please contact the contact person specified in this Privacy Policy.

2.2 Customer Account

If, by choosing to open a customer account, you have given your consent pursuant to Art. 6(1)(a) GDPR, we use your data to open this account and to store your data for future orders on our website. You can delete your customer account at any time either by sending a message to the address specified in this Privacy Policy or via a function provided for this purpose in the customer account. After your customer account has been deleted, we delete your data unless you have expressly consented to further use of your data pursuant to Art. 6(1)(a) GDPR or we reserve the right to use data beyond this, as permitted by law and about which we inform you in this Policy.

2.3 Contact

As part of our communication with customers, we collect personal data for the purpose of processing your enquiries pursuant to Art. 6(1)(b) GDPR when you voluntarily provide it to us when contacting us (e.g. via contact form, live chat tool or email). Mandatory fields are marked as such because, in these cases, we absolutely require this data to process your enquiry. The respective input forms show which data is collected. Once your enquiry has been fully processed, we delete your data unless you have expressly consented to further use of your data pursuant to Art. 6(1)(a) GDPR or we reserve the right to use data beyond this, as permitted by law and about which we inform you in this Policy.

3. Data Processing for the Purposes of Delivery

For the performance of the contract pursuant to Art. 6(1)(b) GDPR, we transfer your data to the delivery service provider insofar as this is necessary for the delivery of the goods ordered. If you have any questions about our service providers and the basis of our cooperation with them, please contact the contact person specified in this Privacy Policy.

Transfer of Data to Delivery Service Providers for the Purpose of Delivery Notifications

If you have given us your express consent during or after your order, we transfer your email address and telephone number to the selected delivery service provider pursuant to Art. 6(1)(a) GDPR so that it can contact you prior to delivery for the purpose of announcing or coordinating the delivery.

Consent can be withdrawn at any time by sending a message to the contact person specified in this Privacy Policy.

Following withdrawal of consent, we delete the data you have provided for this purpose unless you have expressly consented to further use of your data or we reserve the right to use it beyond this, as permitted by law and about which we inform you in this Policy. If you have any questions about our service providers and the basis of our cooperation with them, please contact the contact person specified in this Privacy Policy.

4. Data Processing for the Purposes of Payment Processing

When processing payments in our online shop, we cooperate with the following partners: technical service providers, credit institutions and payment service providers.

4.1 Data Processing for the Purposes of Transaction Processing

Depending on the payment method selected, we transfer the data required to process the payment transaction to our payment service providers, the commissioned credit institutions or the selected payment service provider, insofar as this is necessary for processing the payment. This serves the performance of the contract pursuant to Art. 6(1)(b) GDPR. In some cases, payment service providers collect the data required for payment processing themselves, for example on their own website or through technical integration into the ordering process. The Privacy Policy of the respective payment service provider applies.

Depending on the payment method selected, data may be transferred to third countries outside the EU/EEA for which the European Commission has determined, by means of an adequacy decision, an adequate level of data protection. Where data is transferred to third countries outside the EU/EEA for which the European Commission has not adopted an adequacy decision, the cooperation is based on the Standard Contractual Clauses of the European Commission.

If you have any questions about our payment processing partners or the basis of our cooperation with them, please contact the contact person specified in this Privacy Policy.

4.2 Data Processing for the Purposes of Fraud Prevention and Optimisation of Our Payment Processes

Where applicable, we provide the aforementioned service providers with additional data which they use, together with the data required for payment processing, for the purposes of fraud prevention and optimisation of our payment processes (e.g. invoicing, processing disputed payments, accounting support).

Pursuant to Art. 6(1)(f) GDPR, this serves to safeguard our legitimate interests in protection against fraud and efficient payment management, which prevail in the context of a balancing of interests.

5. Advertising by Email

5.1 Advertising by Email with Newsletter Subscription and Newsletter Tracking

When you subscribe to our newsletter, we use the data required for this purpose or separately provided by you to send you our newsletter regularly by email on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

You can unsubscribe from the newsletter at any time either by sending a message to the contact person specified in this Privacy Policy or via a link provided for this purpose in the newsletter.

After you unsubscribe, we delete your email address from the newsletter recipient list unless you have expressly consented to further use of your data pursuant to Art. 6(1)(a) GDPR or we reserve the right to use data beyond this, as permitted by law and about which we inform you in this Policy.

Please note that we evaluate your user behaviour when sending the newsletter. For this purpose, we also analyse your use of our newsletter by measuring, recording and evaluating opening rates and click-through rates for the purpose of configuring future newsletter campaigns (“newsletter tracking”).

For this evaluation, the emails sent contain single-pixel technologies (e.g. web beacons, tracking pixels), which are stored on our website. For the evaluations, we link in particular the following “newsletter data”:

• the page from which the current page was requested (“referrer”),

• the date and time of access,

• the description of the type of web browser used,

• the IP address of the requesting device,

• the email address,

• the date and time of subscription and confirmation

and the single-pixel technologies with your email address or your IP address and, where applicable, an individual identifier. Links contained in the newsletter may also contain this identifier.

If you do not wish newsletter tracking to take place, you can unsubscribe from the newsletter at any time as described above.

The information is retained for as long as you are subscribed to the newsletter.

5.2 Advertising by Email without Newsletter Subscription and Your Right to Object

If we obtain your email address in connection with the sale of goods or services and you have not objected, we reserve the right, pursuant to Art. 1, 1° of the Royal Decree of 4 April 2003 regulating the sending of advertising by electronic mail, to regularly send you offers by email concerning products from our range that are similar to those already purchased.

You may object to this use of your email address at any time either by sending a message to the contact person specified in this Privacy Policy or via a link provided for this purpose in the promotional email, without incurring any costs other than transmission costs according to the basic tariffs. After you unsubscribe, we delete your email address from the newsletter recipient list unless you have expressly consented to further use of your data pursuant to Art. 6(1)(a) GDPR or we reserve the right to use data beyond this, as permitted by law and about which we inform you in this Policy.

5.3 Newsletter Distribution

Where applicable, the newsletter and the newsletter tracking described above are also sent by our service providers as part of processing carried out on our behalf. If you have any questions about our service providers and the basis of our cooperation with them, please contact the contact person specified in this Privacy Policy.

Our service providers are based and/or use servers in the following countries for which the European Commission has determined an adequate level of data protection by means of an adequacy decision: United Kingdom

5.4 Sending Review Invitations by Email

If you have given us your express consent for this purpose during or after your order pursuant to Art. 6(1)(a) GDPR, we will use your email address to ask you to submit a review via the customer review system we use. You can withdraw your consent at any time either by sending a message to the contact person specified in this Privacy Policy or via a link provided for this purpose in the review invitation. If you withdraw your consent, we delete your email address from the recipient list unless you have expressly consented to further use of your data pursuant to Art. 6(1)(a) GDPR or we reserve the right to use data beyond this, as permitted by law and about which we inform you in this Policy.

Where applicable, review invitations are also sent by our service provider Trusted Shops SE (hereinafter “Trustes Shops”), whose registered office is located at Subbelrather Str. 15C, 50823 Cologne, Germany.

As part of sending review invitations, we receive information from Trusted Shops about the status of the invitation (for example, whether the invitation has been sent and whether it has been successfully received). This takes place pursuant to Art. 6(1)(f) GDPR in order to fulfil our legitimate interest in receiving information about review invitations, so that we can make optimisations on this basis where applicable, and in order to fulfil Trusted Shops’ legitimate interest in being able to provide this service.

We are jointly responsible with Trusted Shops for sending review invitations as well as for collecting and displaying information relating to the review or its status.

For any questions relating to data protection or to exercise your rights within the scope of the joint controllership existing between us and Trusted Shops, please preferably contact Trusted Shops. You can find Trusted Shops’ contact details here. You can find further information on data protection under this link. Irrespective of this, you can also always contact us at the address specified in this Policy under “Contact Options”. Your enquiry will then, where necessary, be forwarded to the other controller for a response.

6. Cookies and Other Technologies

6.1 General Information

In order to make your visit to our website attractive and to enable the use of certain functions, to present suitable products or to carry out market research, we use technologies, including so-called “cookies”, on various pages. Cookies are small text files that are automatically stored on your end device. Some of the cookies we use are deleted at the end of the browser session, i.e. after you close your browser (session cookies). Other cookies remain on your end device and enable us to recognise your browser on your next visit (persistent cookies). You can view the storage duration in the overview of your web browser’s cookie settings.

Protection of Privacy on End Devices

When you use our online services, we use technologies that are absolutely necessary to provide the online public communication service expressly requested by the user. To this extent, the storage of information on your end device or access to information already stored on it does not require your consent.

For functions that are not strictly necessary, the storage of information on your end device or access to information already stored on it requires your consent. Please note that if you do not give your consent, some parts of the website may not be fully usable. Where applicable, any consent you have given remains in place until you adjust or reset the corresponding settings on your end device.

Any Subsequent Data Processing through Cookies and Other Technologies

We use technologies that are absolutely necessary for the use of certain functions of our website (e.g. the shopping basket function). These technologies are used to collect and process the IP address, time of visit, device and browser information as well as information about your use of our website (for example, information about the contents of the shopping basket). This serves to safeguard our legitimate interests in an optimised presentation of our services, which prevail in the context of a balancing of interests pursuant to Art. 6(1)(f) GDPR.

In addition, we use technologies in order to fulfil the legal obligations to which we are subject (for example, to be able to demonstrate consent to the processing of your personal data) as well as for web analytics and online marketing purposes.

Further information on this, including the corresponding legal basis for data processing, can be found in the following sections of this Privacy Policy.

Cookie Settings

You can find the cookie settings for your browser under the following links: Microsoft Edge™ / Safari™ / Chrome™ / Firefox™ / Opera™.

If you have consented to the use of technologies pursuant to Art. 6(1)(a) GDPR, you can withdraw your consent at any time by sending a message to the contact person specified in this Privacy Policy.

You can also click on the “Data Protection” button. Refusing cookies may limit the functionality of our website.

6.2 Consent Management Platform

We use a consent management system on our website to inform you about the cookies and other technologies we use on our website and, where necessary, to obtain, manage and document your consent to the processing of your personal data by these technologies. Pursuant to Art. 6(1)(c) GDPR, this is necessary to fulfil our legal obligation arising from Art. 7(1) GDPR, under which we must be able to demonstrate your consent to the processing of your personal data. The Consent Management Platform used is a service provided by Pandectes GDPR Compliance, Pudisoo küla, Männimäe/1, 74626, Kuusalu vald, Estonia, which processes your data on our behalf.

After you have submitted your cookie declaration on our website, the ConsentManager web server stores the following data: IP address, device information, browser information, selected language, website accessed or its URL, date and time of your declaration of consent as well as information about your consent behaviour. In addition, the following technologies are used, which contain information about your consent behaviour: cookies, log files

Your data will be deleted after three years unless you have expressly consented to further use of your data pursuant to Art. 6(1)(a) GDPR or we reserve the right to use data beyond this, as permitted by law and about which we inform you in this Policy.

7. Use of Cookies and Other Technologies

We use the following cookies and other technologies from third-party providers on our website. Unless otherwise stated for the individual technologies, this processing takes place on the basis of your consent pursuant to Art. 6(1)(a) GDPR. The data collected in this context will be deleted once the intended purpose has been achieved and we have ceased using the corresponding technology. You can withdraw your consent at any time with effect for the future. Further information about the options for withdrawing consent can be found in the section “Cookies and Other Technologies”. Further information, in particular on the basis of our cooperation with the individual providers, can be found under the individual technologies. If you have any questions about the providers and the basis of our cooperation with them, please contact the contact person specified in this Privacy Policy.

7.1 Use of Google Services

Data (IP address, time of visit, device and browser information, as well as information about your use of our website), from which pseudonymised usage profiles are created, is automatically collected and stored for web analytics purposes using Google Analytics. Cookies may be used for this purpose. If you access our website from the EU, your IP address is stored on a server located in the EU in order to derive location data and is then immediately deleted before the traffic is transferred to other Google servers for processing. Data processing takes place on the basis of a data processing agreement with Google.

We use the following technologies from Google Ireland Ltd., whose registered office is at Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The information about your use of our website automatically collected by Google technologies is generally transferred to and stored on a server of Google LLC, whose registered office is at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Unless otherwise stated for the individual technologies, data processing is carried out on the basis of an agreement concluded for each technology between joint controllers pursuant to Art. 26 GDPR. Further information about data processing by Google can be found in Google’s Privacy Policy.

Our service providers are based and/or use servers in countries outside the EU and the EEA for which the European Commission has determined an adequate level of data protection by means of an adequacy decision.

Our service providers are based and/or use servers in countries outside the EU and the EEA. The European Commission has not adopted an adequacy decision for these countries. Our cooperation is based on the Standard Contractual Clauses adopted by the European Commission.

Google Analytics

In order to optimise the marketing of our website, we have activated the data sharing settings for “Google products and services”. This enables Google to access the data collected and processed by Google Analytics and subsequently use it to improve Google services. The sharing of data with Google under these data sharing settings is based on an additional agreement between controllers. We have no influence over the subsequent processing of the data by Google.

In order to optimise the marketing of our website, we use the User-ID function. This function enables us to assign a unique and permanent identifier to your engagement data from one or more sessions on our online presences and thus analyse your user behaviour across different devices and sessions.

Google Signals, the Google Analytics extension function, enables “Cross-Device Tracking” for web analytics purposes. If your internet-enabled devices are linked to your Google account and you have activated the “personalised advertising” setting in your Google account, Google can generate reports on your usage behaviour (in particular on the number of cross-device users) even if you change devices.

We do not process personal data in this context; we only receive statistics generated on the basis of Google Signals.

The Google Analytics extension function enables the so-called DoubleClick cookie to recognise your browser, for advertising and web analytics purposes, when you visit other websites. Google will use this information to compile reports on website activities and to provide other services related to website use.

If you do not give us your consent pursuant to Art. 6(1)(a) GDPR to the use of Google Analytics, no cookies will be stored on or read from your device. The data processing described in the preceding paragraphs will not take place. In order to close gaps in web analytics through behavioural and conversion modelling, pings containing data (user agent, information about your consent behaviour, screen resolution, IP address) are sent to Google.

Google Ads

Google’s Remarketing cookie is set when you visit our website for advertising purposes in Google search results and on third-party websites. It automatically enables interest-based advertising through the collection and processing of data (IP address, time of visit, device and browser information, as well as information about your use of our website), using a pseudonymous cookie ID and on the basis of the pages you visit.

Any further data processing only takes place if you have activated the “personalised advertising” setting in your Google account. In this case, if you are logged into Google while visiting our website, Google uses your data together with Google Analytics data to create and define target group lists for cross-device remarketing.

We use Google Ads Conversion Tracking for web analytics and event tracking in order to measure your usage behaviour when you arrive at our website via a Google Ads advertisement. Cookies may be used for this purpose and data may be collected (IP address, time of visit, device and browser information, as well as information about your use of our website based on events specified by us, such as visiting a website or subscribing to a newsletter), from which pseudonymised usage profiles are created.

If you do not give us your consent pursuant to Art. 6(1)(a) GDPR to the use of Google Ads, no cookies will be stored on or read from your device. The data processing described in the preceding paragraphs will not take place. In order to close gaps in web analytics through behavioural and conversion modelling, pings containing data (user agent, information about your consent behaviour, screen resolution, IP address, page URL, information about advertising clicks in URL parameters) are sent to Google. Your IP address is used to determine the country of your IP address.

Google Maps

Google Maps collects data about your use of its functions, in particular the IP address and location data, for the purpose of visually displaying geographical information, and transfers this data to Google, which then processes it. We have no influence over this subsequent data processing.

Google reCAPTCHA

Google reCAPTCHA collects data (IP address, time of visit, browser information and information about your use of the website) and analyses your use of our website using JavaScript and cookies for the purpose of protecting against misuse of our web forms and spam by automated software (so-called “bots”). In addition, Google services evaluate other cookies stored in your browser. Data processing is carried out on the basis of a data processing agreement concluded with Google. Users of a customer who access websites protected by reCAPTCHA are no longer subject to Google’s Privacy Policy and Terms of Service.

Google Tag Manager

Google Tag Manager enables us to manage various codes and services on our website. When implementing the individual tags, Google may also process personal data (e.g. IP address, online identifiers (including cookies)). Data processing is carried out on the basis of a data processing agreement with Google.

The use of Google Tag Manager enables various services/technologies to be integrated.

If you do not wish certain tracking services to be used and have therefore deactivated them, this deactivation remains valid for all affected tracking tags integrated via Google Tag Manager.

7.2 Use of Meta Services

Use of Meta Pixel

For this purpose, a cookie is automatically placed by Meta Pixel when you visit our website. This cookie automatically enables your browser to be recognised when you visit other websites using a pseudonymous cookie ID. Meta Platforms Ireland will combine this information with other data from your Facebook (by Meta) account and use it to compile reports on website activities and to provide other services related to website use, in particular personalised and group-based advertising.

The information about your use of our website automatically collected by Meta Platforms Ireland technologies is generally transferred to and stored on a server of Meta Platforms, Inc., whose registered office is at 1601 Willow Road, Menlo Park, California 94025, USA. Further information about data processing by Meta Platforms Ireland can be found in Meta Platforms Ireland’s Data Policy.

Our service providers are based and/or use servers in the following countries for which the European Commission has determined an adequate level of data protection by means of an adequacy decision: Brazil, USA, Canada, Japan, South Korea, New Zealand, United Kingdom, Argentina.

The adequacy decision for the USA serves as the basis for transfers to third countries, provided that the respective service provider is certified. The service provider is certified.

Our service providers are based and/or use servers in the following countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Mexico. The European Commission has not adopted an adequacy decision for these countries. Our cooperation with these service providers is based on the following safeguards: Standard Contractual Clauses of the European Commission.

We use Meta Pixel as part of the following technologies from Meta Platforms Ireland Ltd., whose registered office is at Block J, Serpentine Avenue, Dublin 4, Ireland (“Facebook (by Meta)” or “Meta Platforms Ireland”).

Meta Pixel is used to automatically collect and store data (IP address, time of visit, device and browser information, as well as information about your use of our website based on events specified by us, such as visiting a website or subscribing to a newsletter), from which pseudonymised usage profiles are created.

Information by which individuals can be identified (for example, names, email addresses and telephone numbers) is also collected and stored in hashed form for matching purposes as part of so-called advanced data matching.

Meta Ads Manager

We use Meta Ads Manager to promote this website on Facebook (by Meta) and other platforms. We determine the parameters of the respective advertising campaign. Meta Platforms Ireland is responsible for the precise implementation, in particular the decision regarding the placement of advertisements for individual users. Unless otherwise stated for the individual technologies, data processing is carried out on the basis of an agreement concluded between joint controllers pursuant to Art. 26 GDPR. Joint controllership is limited to the collection of data and its transmission to Meta Platforms Ireland. The subsequent processing of data by Meta Platforms Ireland is not included.

Based on statistics on visitor activity on our website generated via Meta Pixel, we use Custom Audiences to conduct group-based advertising on Facebook (by Meta) by determining the characteristics of the respective target group. Meta Platforms Ireland acts as our processor in the context of the advanced data matching carried out to determine the respective target group (see above).

We use Custom Audiences to conduct personalised advertising on the basis of the pseudonymous cookie ID set by Meta Pixel and the data collected about your usage behaviour on our website.

We use Conversions (via Meta Pixel or Conversions API) for web analytics and event tracking in order to measure your subsequent usage behaviour when you arrive at our website via an advertisement from Meta Ads Manager. Data processing takes place on the basis of a data processing agreement with Meta Platforms Ireland.

7.3 Other Providers of Web Analytics and Online Marketing Services

Use of Pinterest Tag for Advertising and Web Analytics Purposes

Technologies from Pinterest Europe Ltd., whose registered office is at Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland (“Pinterest”), are used when you visit our website for advertising and web analytics purposes on Pinterest and third-party websites. They automatically enable interest-based advertising through the collection and processing of data (IP address, time of visit, device and browser information, as well as information about your use of our website) using a pseudonymous cookie ID and on the basis of the pages you visit. Pseudonymised usage profiles are created from the collected data.

Pinterest will combine this information with other data from your Pinterest account and use it to compile reports on website activities and to provide other services related to website use.

We have no influence over data processing by Pinterest; we only receive statistics generated on the basis of the Pinterest Tag. This enables us to measure your subsequent usage behaviour for web analytics and event tracking purposes when you arrive at our website via a Pinterest advertisement.

The information automatically collected by Pinterest is generally transferred to and stored on a server of Pinterest, Inc., whose registered office is at 505 Brannan St, San Francisco, CA 94107, USA. Data processing is carried out on the basis of an agreement concluded between joint controllers pursuant to Art. 26 GDPR.

Our service providers are based and/or use servers in countries outside the EU and the EEA for which the European Commission has determined an adequate level of data protection by means of an adequacy decision.

Our service providers are based and/or use servers in countries outside the EU and the EEA. The European Commission has not adopted an adequacy decision for these countries. Our cooperation is based on the Standard Contractual Clauses adopted by the European Commission.

Use of the Vimeo Video Plugin for the Integration of Third-Party Content

For the purpose of integrating third-party content, data (IP address, time of visit, device and browser information) is collected via the video plugin of Vimeo Inc., whose registered office is at 330 West 34th Street, 5th Floor, New York 10011, USA (“Vimeo”), transferred to Vimeo and subsequently processed by Vimeo. Data processing is carried out on the basis of an agreement concluded between joint controllers pursuant to Art. 26 GDPR.

Google Analytics is automatically integrated into the Vimeo video plugin. Data (IP address, time of visit, device and browser information, as well as information about your use of our website), from which pseudonymised usage profiles are created, is automatically collected and stored for web analytics purposes using Google Analytics. Cookies may be used for this purpose.

Google Analytics is a service provided by Google Ireland Ltd., whose registered office is at Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”).

The information about your use of our website automatically collected by Google is generally transferred to and stored on a server of Google LLC, whose registered office is at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. If you access our website from the EU, your IP address is stored on a server located in the EU in order to derive location data and is then immediately deleted before the traffic is transferred to other Google servers for processing. We have no influence over or access to data processing by Vimeo, including the settings and results of Google Analytics.

Our service providers are based and/or use servers in countries outside the EU and the EEA for which the European Commission has determined an adequate level of data protection by means of an adequacy decision.

Our service providers are based and/or use servers in countries outside the EU and the EEA. The European Commission has not adopted an adequacy decision for these countries. Our cooperation is based on the Standard Contractual Clauses adopted by the European Commission.

8. Integration of the Trusted Shops Trustbadge / Other Widgets

Trusted Shops widgets are integrated into this website in order to display Trusted Shops services (e.g. the Trustmark, collected reviews).

This serves to safeguard our legitimate interests in the optimal marketing of our services by enabling secure shopping, which prevail in the context of a balancing of interests pursuant to Art. 6(1)(f) GDPR. The Trustbadge and the services advertised by it are provided by Trusted Shops SE, whose registered office is at Subbelrather Straße 15C, 50823 Cologne, Germany (hereinafter “Trusted Shops”), with which we are jointly responsible for data protection pursuant to Art. 26 GDPR. Within the scope of this Privacy Policy, we inform you below about the essential content of the agreement pursuant to Art. 26(2) GDPR.

When interacting with Trustbadge AI+, session cookies are created to store the login status and display the so-called “Welcome Layer”, which presents details of the respective online shop (company information, reviews, information about the existence of Buyer Protection) as well as the #trstd secret. A cookie is stored to recognise logged-in users and is retained for a maximum of 400 days after login. In addition, session cookies are stored in order to send push notifications when using the app, provided that the user has allowed them. This is necessary so that Trusted Shops can provide you with the digital service you have requested. Trusted Shops is responsible for data processing when interacting with Trustbadge AI+.

Within the scope of the joint controllership existing between us and Trusted Shops SE, please preferably contact Trusted Shops SE for any questions relating to data protection and to exercise your rights using the contact details provided in Trusted Shops’ Privacy Policy. Irrespective of this, you can also always contact the controller of your choice. Your enquiry will then, where necessary, be forwarded to the other controller for a response.

8.1 Data Processing Related to the Integration of the Trustbadge/Other Widgets

The Trustbadge is provided by a US-based CDN (Content Delivery Network) provider. An adequate level of data protection is ensured by an adequacy decision of the European Commission, which can be accessed here for the USA. Service providers in the USA are generally certified under the EU-U.S. Data Privacy Framework. Further information is available here. Where service providers are not certified under the Data Privacy Framework, Standard Contractual Clauses have been concluded as an appropriate safeguard.

When the Trustbadge appears, the web server automatically stores a server log file which also contains your IP address, the date and time of display, the amount of data transferred and the requesting provider (log file data), and documents the display. The IP address is anonymised immediately after collection so that the stored data cannot be attributed to you personally. The anonymised data is used in particular for statistical purposes and error analysis.

8.2 Data Processing after Completion of the Order

After completion of the order, information relating to the order (order total, order number and, where applicable, product purchased) as well as your email address hashed using a cryptographic one-way function are transferred to Trusted Shops. The legal basis is Art. 6(1)(f) GDPR. This serves to verify whether you are already registered for Trusted Shops Services and is therefore necessary for the fulfilment of our overriding legitimate interests and those of Trusted Shops in providing customer review services linked to the specific order pursuant to Art. 6(1)(f) GDPR. If you are registered, further processing takes place in accordance with the contractual agreement concluded between you and Trusted Shops. If you are not yet registered for the Services, you will subsequently have the opportunity to do so for the first time. Further processing after registration is also governed by the contractual agreement concluded with Trusted Shops. If you are not yet registered for the Services, you will subsequently have the opportunity to give your consent to receiving review invitations. If you do not do so, all transmitted data will automatically be deleted by Trusted Shops and it will no longer be possible to establish a link to you personally.

Trusted Shops uses service providers in the areas of hosting, monitoring and logging. The legal basis is Art. 6(1)(f) GDPR for the purpose of ensuring trouble-free operation. In this context, processing may take place in third countries (USA, United Kingdom and Israel). An adequate level of data protection is ensured in each case by an adequacy decision of the European Commission, which can be accessed here for the USA, here for the United Kingdom and here for Israel. The US service providers used are generally certified under the EU-U.S. Data Privacy Framework. Further information is available here. Where the service providers used are not certified under the EU-U.S. Data Privacy Framework, Standard Contractual Clauses have been concluded as an appropriate safeguard.

9. Social Media

Our Online Presence on Facebook (by Meta), Instagram (by Meta), YouTube, LinkedIn

If you have given your consent to the respective social media operator pursuant to Art. 6(1)(a) GDPR, when you visit our online presences on the social networks mentioned above, your data is automatically collected and stored for market research and advertising purposes. Pseudonymised usage profiles are created from this data. These may be used, for example, to place advertisements within and outside the platforms that are presumed to correspond to your interests. Cookies are generally used for this purpose.

Further information about the processing and use of data by the respective social media operator, as well as contact options and your rights and settings options for protecting your privacy, can be found in the operators’ privacy information, the website addresses of which are integrated below. We are available to assist you if you nevertheless require help in this regard.

Facebook (by Meta) is a service provided by Meta Platforms Ireland Ltd., whose registered office is at Block J, Serpentine Avenue, Dublin 4, Ireland (“Meta Platforms Ireland”). The information about your use of our online presence on Facebook (by Meta) automatically collected by Meta Platforms Ireland is generally transferred to and stored on a server of Meta Platforms, Inc., whose registered office is at 1601 Willow Road, Menlo Park, California 94025, USA. Data processing in connection with a visit to a Facebook (by Meta) fan page is carried out on the basis of an agreement between joint controllers pursuant to Art. 26 GDPR.

Further information (information regarding Page Insights data) can be found here.

Our service providers are based and/or use servers in the following countries for which the European Commission has determined an adequate level of data protection by means of an adequacy decision: Brazil, USA, Canada, Japan, South Korea, New Zealand, United Kingdom, Argentina.

The adequacy decision for the USA serves as the basis for transfers to third countries, provided that the respective service provider is certified. The service provider is certified.

Our service providers are based and/or use servers in the following countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Mexico.

The European Commission has not adopted an adequacy decision for these countries. Our cooperation with these service providers is based on the following safeguards: Standard Contractual Clauses of the European Commission.

Instagram (by Meta) is a service provided by Meta Platforms Ireland Ltd., whose registered office is at Block J, Serpentine Avenue, Dublin 4, Ireland (“Meta Platforms Ireland”). The information about your use of our online presence on Instagram automatically collected by Meta Platforms Ireland is generally transferred to and stored on a server of Meta Platforms, Inc., whose registered office is at 1601 Willow Road, Menlo Park, California 94025, USA. Data processing in connection with a visit to an Instagram fan page is carried out on the basis of an agreement between joint controllers pursuant to Art. 26 GDPR.

Further information (information regarding Page Insights data) can be found here.

Our service providers are based and/or use servers in the following countries for which the European Commission has determined an adequate level of data protection by means of an adequacy decision: Brazil, USA, Canada, Japan, South Korea, New Zealand, United Kingdom, Argentina.

The adequacy decision for the USA serves as the basis for transfers to third countries, provided that the respective service provider is certified. The service provider is certified.

Our service providers are based and/or use servers in the following countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Mexico.

The European Commission has not adopted an adequacy decision for these countries. Our cooperation with these service providers is based on the following safeguards: Standard Contractual Clauses of the European Commission.

YouTube is a service provided by Google Ireland Ltd., whose registered office is at Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”). The information about your use of our online presence on YouTube automatically collected by Google is generally transferred to and stored on a server of Google LLC, whose registered office is at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Our service providers are based and/or use servers in countries outside the EU and the EEA for which the European Commission has determined an adequate level of data protection by means of an adequacy decision.

Our service providers are based and/or use servers in countries outside the EU and the EEA. The European Commission has not adopted an adequacy decision for these countries. Our cooperation is based on the Standard Contractual Clauses adopted by the European Commission.

LinkedIn is a service provided by LinkedIn Ireland Unlimited, whose registered office is at Wilton Place, Dublin 2, Ireland (“LinkedIn”). The information about your use of our online presence on LinkedIn automatically collected by LinkedIn is generally transferred to and stored on a server of LinkedIn Corporation, whose registered office is at 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.

Our service providers are based and/or use servers in the following countries for which the European Commission has determined an adequate level of data protection by means of an adequacy decision: USA.

The adequacy decision for the USA serves as the basis for transfers to third countries, provided that the respective service provider is certified. The service provider is certified.

10. Contact Options and Your Rights

10.1 Your Rights

As a data subject, you have the following rights:

• Pursuant to Article 15 GDPR, you have the right to access the personal data concerning you that we process.

• Pursuant to Article 16 GDPR, you have the right to have inaccurate personal data concerning you rectified without undue delay. You also have the right to request that this data be completed.

• Pursuant to Article 17 GDPR, you have the right to erasure of your personal data insofar as processing is not necessary for:

  • exercising the right to freedom of expression and information;

  • compliance with a legal obligation;

  • reasons of public interest;

  • the establishment, exercise or defence of legal claims.

• Pursuant to Article 18 GDPR, you have the right to restriction of processing where:

  • you contest the accuracy of the data;

  • the processing of the data is unlawful but you oppose its erasure;

  • we no longer need your data but you still require it for the establishment, exercise or defence of legal claims;

  • you have exercised your right to object to data processing pursuant to Article 21 GDPR.

• Pursuant to Article 20 GDPR, you have the right to receive your data in a structured, commonly used and machine-readable format and to request the transmission of this data to another controller.

• Pursuant to Article 77 GDPR, you have the right to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority at your habitual place of residence, your place of work or our registered office.

Right to Object

Insofar as we process personal data as explained above in order to safeguard our legitimate interests, which prevail in the context of a balancing of interests, you may object to this processing with effect for the future. If the processing is carried out for direct marketing purposes, you may exercise this right at any time as described above. If the processing is carried out for other purposes, you only have a right to object on grounds relating to your particular situation.

After you have exercised your right to object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves the establishment, exercise or defence of legal claims.

This does not apply if the processing is carried out for direct marketing purposes. In this case, we will no longer process your personal data for this purpose.

In addition, you have the right to lodge a complaint with the competent data protection authority in Belgium: Data Protection Authority - Rue de la Presse 35 - 1000 Brussels - email: contact@apd-gba.be

10.2 Contact Options

If you have any questions about the collection, processing or use of your personal data, any requests for information, rectification, restriction or erasure of data, as well as any withdrawal of consent given or objection to a particular use of data, please contact our services directly using the contact details provided in the Legal Notice.

Data Protection Officer:
Datenschutz Symbiose GmbH, Dr. Marion Herrmann
Hundingstr. 12
95445 Bayreuth
Germany

mh@datenschutz-symbiose.de