Privacy policy

PRIVACY POLICY bottegacreazioni.com

Website privacy policy and information for data subjects pursuant to Articles 13 and 14 of the GDPR.

PREAMBLE

All personal data is processed in accordance with Regulation (EU) 2016/679 as amended, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, which repeals Directive 95/46/EC (โ€œGDPRโ€), as well as Italian national legislation on personal data protection, in particular Legislative Decree 196/2003 containing the โ€œPersonal Data Protection Codeโ€ (โ€œCodeโ€), as amended by Legislative Decree 101/2018 (โ€œNational Data Protection Legislationโ€). Below you will find our Privacy Policy.

DATA CONTROLLER pursuant to GDPR and BDSG law

La Bottega delle Creazioni /ย Alessandro Pozzi
VAT number: IT 15629701002
Via Ippolito Desideri, 1a; 00126 Rome RM, Italy
Tel.: +39 338 781 7484
E-mail: bottegacreazioni20@gmail.com

  1. REASONS FOR DATA COLLECTION

We collect and process your information to provide you with the best possible service through convenient access to our services via our website.

  1. WHAT DATA IS COLLECTED, PROCESSED OR USED?

2.1 VISITING OUR WEBSITE

When you access our website, our servers automatically collect general information, in particular for the purposes of configuring the connection, functionality, and system security. This includes, for example, the type of browser used, the operating system used, the Internet service provider's domain name, the connection data of the computer used (IP address), the website from which you visit us (referrer URL), the pages you visit, and the date and duration of the visit. The processing of such data does not allow the identification of the data subjects due to pseudonymization measures.

Notice on data transfer to the USA

Among other things, our website includes tools from companies based in the USA. If these tools are active, your personal data may be transferred to the US servers of these companies. We wish to emphasize that the United States is not a third country considered secure under EU data protection legislation. US companies are required to disclose personal data to security authorities without the data subject being able to take legal action against them. Therefore, it cannot be ruled out that US authorities (e.g., intelligence services) may process, evaluate, and permanently store your data on US servers for monitoring purposes. We have no influence over these processing activities.

2.2 NEWSLETTER SUBSCRIPTION

With your consent, you can subscribe to our free newsletter, which will inform you about current offers and promotions. For newsletter subscription, we use the so-called Double Opt-In procedure. This means that we send you a newsletter by email only after you have confirmed your subscription. In this case, we send you a notification by email, asking you to click on a link contained in the message to confirm that you wish to receive our newsletter. If you do not confirm your registration, your data will not be used and will be automatically deleted after one month. In addition to your email address and any further data, we store your IP address and the date of registration and confirmation. The purpose of the procedure is to prove your registration. The only mandatory data for sending the newsletter is your email address. All other data are optional. After your confirmation, we will store your data for the purpose of sending you the newsletter. You can unsubscribe from the newsletter at any time by sending a message to the email address bottegacreazioni20@gmail.com. The legal basis for data processing in this case is consent pursuant to Article 6(1)(a) of the GDPR.

2.3 SENDING COMMERCIAL COMMUNICATIONS TO OUR CUSTOMERS

If you have provided us with your email address for the purchase of goods or services, we reserve the right to send you regular offers of goods or services similar to those already purchased, updating you on our product range via email. In accordance with Article 130(4) of the Code, no consent is required from the user. Data processing is based on our legitimate interest in sending personalized direct mail pursuant to Article 6(1)(f) of the GDPR. However, if you initially or on the occasion of subsequent communications have objected to the use of your email address for this purpose, we will not send you any communication by email. In any case, you can always object to the use of the email address for the above advertising purposes at any time with future effect by sending a communication to the data controller, as identified in the initial part of the Privacy Policy. Upon receipt of your communication to this effect, the use of your email address for advertising purposes will be immediately discontinued.

2.4 DATA PROCESSING DURING CUSTOMER REGISTRATION

We collect common personal data and process it when you provide us with this data for the execution of an order or the opening of a customer account. The legal basis for the processing of personal data in such a case consists in the performance of a contract to which the data subject is a party or pre-contractual measures pursuant to Article 6(1)(b) of the GDPR. The collected data can be viewed in their respective input fields. The deletion of your customer account is possible at any time and can be carried out by sending a communication to the data controller's contact address. We collect and use the data you have provided us for the performance of the contract between you and us. Once the contract has been performed or after the deletion of your account, your data will be retained for administrative, accounting, and tax purposes for the legally required period. Once this period has passed, your data will be deleted.

2.5 DATA PROCESSING FOR GUEST ORDERS

You have the option to order our products without registering a customer account. In this case too, the legal basis for data processing consists in the performance of a contract to which the data subject is a party or pre-contractual measures pursuant to Article 6(1)(b) of the GDPR. The collected and processed data can be viewed in their respective input fields. In this case, we store and use the data provided as a guest for the performance of the contract. Once the contract has been performed, your data will be retained for administrative, accounting, and tax purposes for the legally required period. Once this period has passed, your data will be deleted.

2.6 DATA PROCESSING FOR ORDER FULFILLMENT - COMMUNICATION OF DATA TO THIRD PARTIES

COMMUNICATION OF DATA TO THE SHIPPING SERVICE PROVIDER

The personal data we collect will be transmitted to the shipping company responsible for delivery (e.g., SDA), to the extent necessary for the delivery of the goods. For the purpose of agreeing on the delivery date for the shipment of goods, we also provide the courier with the telephone number, if provided at the time of ordering. The legal basis for data processing in this case consists in the performance of a contract pursuant to Article 6(1)(b) of the GDPR.

COMMUNICATION OF DATA TO PAYMENT SERVICE PROVIDER (PAYMENT SERVICE PROVIDER) AND AUDITING

PAYPAL, PAYPAL EXPRESS

PayPal's European operating company is PayPal (Europe) S.ร .r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg.

If the data subject selects PayPal as the payment option during the ordering process in our online store, the data subject's data will be automatically transmitted to PayPal. By selecting this payment option, the data subject accepts the communication of their personal data, which is necessary for the processing of payments.

The personal data sent to PayPal usually includes name, surname, address, email address, IP address, telephone number, mobile phone number, or other data necessary for the processing of payments. For the performance of the purchase contract, such personal data is also necessary, as it relates to the respective order.

The transmission of data serves the processing of payments and the prevention of fraud. We will transmit personal data to PayPal for this purpose, in particular if there is a legitimate interest in the transmission. The personal data exchanged between PayPal and us may be transmitted by PayPal to credit agencies. The purpose of this transmission is to verify identity and creditworthiness.

PayPal may disclose personal information to affiliates and service providers or subcontractors to the extent necessary to fulfill its contractual obligations or to process the data.

The data subject has the option to revoke consent to the processing of personal data at any time towards PayPal. The revocation does not affect the personal data that must be processed, used, or transmitted for the (contractual) processing of payments.

In addition, there is the option to use "PayPal Express" within the scope of the ordering process on our website. "PayPal Express" is a service provided by PayPal (Europe) S.ร .r.l & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg. When using "PayPal Express", personal data is transferred from PayPal to La Bottega delle Creazioni for the processing of contracts and payments. Orders with the PayPal Express payment system allow the purchase process to be shortened. In principle, a customer account on bottegacreazioni.com is not necessary, as the data you have entered in your PayPal account is used. It is specified that the ordered goods will be sent to the address stored in the PayPal account, provided that the address is not modified. Bottegacreazioni.com is obliged to send the goods to this address. It is therefore recommended to always update the stored address to prevent the goods from being delivered to an obsolete address and therefore the possible disclosure of personal data to third parties. The legal basis for data processing is Article 6, paragraph 1, letter b), GDPR.

For information regarding the processing of data by PayPal, please refer to PayPal's privacy policy, which can be viewed online at the following address:ย https://www.paypal.com/it/webapps/mpp/ua/privacy-full

2.7 SENDING ADVERTISEMENTS BY POST

We use your address in accordance with all legal provisions for sending advertisements by post.The legal basis is our legitimate interest in direct advertising pursuant to Art. 6 par. 1 lit. f in combination with the processing of personal data (47 DSGVO). Your address will be retained by us until the data processing is no longer valid. If you make a legitimate request for deletion or to revoke your consent to receive postal advertising, your data will be deleted, unless there are other legally permissible reasons to retain your personal data (e.g., retention periods based on tax or commercial law); in the latter case, deletion will occur after these reasons cease to be valid. For sending by post, we use service providers, with whom we generally enter into a data processing agreement (AVV) pursuant to Art. 28 DSGVO. This is an agreement provided for by data protection law, which guarantees that the service provider processes only our customers' personal data in accordance with our instructions and in compliance with the GDPR.

SHOPIFY PAYMENT

On our website, we have included Shopify payments references. Shopify payments is an online payment service provider that allows you to make purchases with a credit card (Mastercard, Visa, American Express, Maestro, Shop Pay, Apple Pay, Google Pay).

If a customer selects a credit card as the payment method during purchase, your data is automatically transmitted to Shopify payments.

The transmission of your data to Shopify payments is based on Art. 6 cpv. 1 a GDPR (consent) and Art. 6 cpv. 1 b GDPR (processing for the performance of a contract). You have the option to revoke your consent to data processing at any time. The revocation does not affect the validity of the data processing operations carried out in the past.

The personal data transmitted to Shopify payments are usually data that you have provided us during the ordering process, such as the card number, expiration date, CVC number, number of products, product, product data, prices, VAT, and your personal data. This data is transmitted only to the extent that it is actually necessary for the processing of payments.

The data subject has the option to revoke consent to the processing of personal data at any time towards Shopify payments. The revocation does not affect the personal data that must necessarily be processed, used, or transmitted for the (contractual) processing of payments.
The current provisions on personal data protection of Shopify payments are available on the website https://it.shopify.com/legal/privacy

  1. LINKING TO YOUTUBE VIDEOS WITH GREATER DATA PROTECTION

To improve our online offer, we use videos that are stored onย https://www.youtube.com/ย and that are directly playable from our Website. The operator of these pages is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. Only when you play the videos will your data be transmitted.

These are all integrated in "advanced privacy mode", which means that no data about you as a user is transferred to YouTube unless you play the videos. Only during the playback of the videos are the following data transmitted. We have no influence over this data transfer. By visiting the website, YouTube is informed that you have visited the relevant subpage of our website. The IP address, the date and time of the request, the time zone difference from Greenwich Mean Time (GMT), the content of the request (specific page), the access status/HTTP status code, the amount of data transferred in each case, the website from which the request originates, the browser, the operating system and its interface, the language and the version of the browser software. This happens regardless of whether YouTube provides a user account through which you are logged in or whether there is no user account. If you have logged in to Google, your data will be assigned directly to your account. If you do not want to access with your profile on YouTube, you must log out before activating the button. YouTube stores your data as user profiles and uses them for advertising purposes, market research and/or the design of its website oriented to demand. This evaluation is carried out in particular (also for users who have not logged in) for the purpose of providing advertising based on needs and informing other users of the social network about your activities on our website.

You have the right to object to the creation of these user profiles. To exercise this right, you must contact YouTube. Furthermore, YouTube can store several cookies on your end device after starting a video or use comparable recognition technologies (e.g., device fingerprinting).

For information regarding data processing, please read the privacy policy, which can be viewed online at the following addressย https://policies.google.com/privacy?hl=it.

The legal basis for data processing in this case consists in the legitimate interest pursuant to Article 6 paragraph 1 letter f) GDPR. Consent can be revoked at any time.

  1. LINKING TO GOOGLE MAPS

On this website we use the Google Maps offer. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. This allows us to display interactive maps directly on the website and enables the convenient use of the map function. By visiting the website, Google receives the information you have recalled on the corresponding subpage of our website. Furthermore, the IP address, the date and time of the request, the time zone difference from Greenwich Mean Time (GMT), the content of the request (specific page), the access status/HTTP status code, the amount of data transferred in each case, the website from which the request originates, the browser, the operating system and its interface, the language and the version of the browser software are also transmitted. This happens regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you have logged in to Google, your data will be assigned directly to your account. If you do not wish to be assigned to your Google profile, you must log out before activating the button. Google stores your data as user profiles and uses them for advertising, market research and/or the design of its demand-oriented website. This assessment is carried out in particular (also for users who have not logged in) to provide advertising based on needs and to inform other users of the social network about your activities on our website. The user has the right to object to the creation of these user profiles, so they must contact Google to exercise this right. For further information on the purpose and scope of the data collection and their processing by the plug-in provider, please consult the provider's privacy policy.

For information regarding the processing of data by Google, please refer to the privacy policy available online at the following address:ย https://policies.google.com/privacy?hl=it. The legal basis for data processing in this case consists of legitimate interest in accordance with Article 6 paragraph 1 letter f) of the GDPR. Consent can be revoked at any time.

The transmission of data to the USA is based on the EU Commission's standard contractual clauses. Details can be found here:ย https://privacy.google.com/businesses/gdprcontrollerterms/ย andย https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

  1. GIVEAWAY

From time to time, you have the opportunity to participate in prize competitions on our Website. In this case, the personal data collected consists of personal details or common data such as email address, name, address and possibly other data necessary for participation in the competition operations. The personal data provided is used (for example) for the conduct of the competition, for a notification or to send you the prize. As with any prize competition, the participant is informed about the processing of personal data through a specific privacy notice. In any case, at the end of each prize competition, the participants' data will be deleted.

  1. COOKIES

Cookies are small text files, collected automatically during the use of the Website and stored on the devices used by browsers/users for browsing, where they are stored to be retransmitted during subsequent browsing and every use of the Website. Cookies are necessary for the management of the Website and for the provision of services by the controller and, above all, to improve the browsing experience for browsers/users. The legal basis for cookie processing is Art. 6 para. 1 letter f GDPR. If consent has been requested (e.g., consent to store cookies), the processing is carried out exclusively on the basis of Art. 6 para. 1 letter a GDPR; consent can be revoked at any time.

6.1 WHICH COOKIES ARE USED

TECHNICAL COOKIES

The Website uses technical, navigation, and functionality cookies for activities strictly necessary to enable the operation and use of the Website by browsers/users.

THIRD-PARTY ANALYTICAL COOKIES

The Website uses third-party analytical cookies to identify which parts, elements, or services of the Website are most appreciated by browsers/users.

THIRD-PARTY PROFILING COOKIES

The Website uses third-party profiling cookies, which serve to create profiles related to browsers/users and their consumption habits and are used to send advertising messages in line with the preferences expressed by browsers/users within the scope of browsing the Website and interacting with its features. The Website uses third-party profiling cookies only after obtaining the consent of browsers/users. In any case, browsers/users can, at any time, revoke the expressed consent by asking the controller to disable profiling cookies.

6.2 DISABLING THIRD-PARTY COOKIES

Browsers/users can decide not to allow the use of third-party cookies (both analytical and profiling) by choosing to use the browser's incognito mode (for convenience, we refer to the following pages of the main search engines where you can enable/disable incognito mode: Internet Explorer, Google Chrome, Mozilla Firefox, Apple Safari).

Browsers/users can choose to disable only third-party profiling cookies by refusing to grant their consent upon the first access to the Website's home page or, subsequently, at any time, by revoking their consent by checking one of the following options:

o Enable profiling cookies o Disable profiling cookies

6.3 THIRD PARTIES

Below are the characteristics and functionalities of the services offered by third parties that involve the transmission of cookies from the controller's Website. Without prejudice to the possibility for browsers/users to set the browser so as not to receive third-party cookies โ€“ as indicated above, where possible, we provide links to the third-party websites from which individual cookies can be disabled directly.

FACEBOOK

This Website uses "Facebook Pixel" from Facebook Inc. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. However, according to Facebook, the collected data is also transferred to the United States and other third countries. In this way, user behavior can be tracked after they have viewed or clicked on a Facebook ad. This allows the effectiveness of Facebook ads to be assessed for statistical and market research purposes and to optimize future advertising efforts. The collected data is anonymous to us as the managers of this website; we cannot draw any conclusions about the identity of the users. However, the data is stored and processed by Facebook, so that it is possible to link it with the respective user profile and Facebook can use the data for its own advertising purposes, in accordance with Facebook's data usage policy. This allows Facebook to enable the placement of advertising ads on Facebook pages and off Facebook. This use of data cannot be influenced by us as the site managers. The use of Facebook pixels is based on Art. 6 para. 1 letter f GDPR. The website manager has a legitimate interest in adopting effective advertising measures, including social media. If corresponding consent has been requested (e.g., consent to store cookies), the processing is carried out exclusively on the basis of Art. 6 para. 1 letter a GDPR; consent can be revoked at any time. You can find further information on the protection of your privacy in Facebook's data protection notes:ย https://de-de.facebook.com/about/privacy/. You can also disable the "Custom Audiences" remarketing feature in the ad settings section onย https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. To do this, you must be logged in to Facebook. If you do not have a Facebook account, you can disable advertising based on use by Facebook on the European Interactive Digital Advertising Alliance website:ย http://www.youronlinechoices.com/de/praferenzmanagement/

You can enable Facebook and its affiliates to display advertising ads or disable them. A cookie may also be stored on your computer for these purposes. These data processing operations are carried out exclusively with prior express consent pursuant to Article 6 paragraph 1 letter letter. a) GDPR. Consent to the use of Facebook Pixel can only be given by users who are at least 14 years old, so that the processing of a minor's personal data is lawful, as indicated by the Code. If you are younger, we ask you to ask your parents for permission. You can disable the Facebook cookie on the Digital Advertising Alliance website: :
http://www.aboutads.info/choices/

GOOGLE ADS AND GOOGLE CONVERSION-TRACKING

This website uses Google Ads. Google Ads is an online advertising program by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. As part of Google Ads, we use what is known as conversion tracking. When a Google-placed ad is clicked, a conversion tracking cookie is set. Cookies are small text files that the web browser places on the user's computer. These cookies expire after 30 days and are not used to personally identify users. If the user visits some pages of this website and the cookie has not expired, we and Google can recognize that the user clicked on the ad and was redirected to that page. Each Google Ads customer receives a different cookie. Cookies cannot be tracked on Google Ads customer websites. The information collected through the conversion cookie is used to compile conversion statistics for Google Ads customers who have opted into conversion tracking. Customers are informed of the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they do not receive information that personally identifies users. If you do not want to participate in tracking, you can opt out of this use by partially disabling the Google conversion tracking cookie on your web browser under User Preferences. You will therefore not be included in the conversion tracking statistics. The storage of "conversion cookies" and the use of this tracking tool are based on Art. 6 para. 1 letter f GDPR. The website manager has a legitimate interest in analyzing user behavior in order to optimize both its website and its advertising. If corresponding consent has been requested (e.g., consent to store cookies), the processing is carried out exclusively on the basis of Art. 6 para. 1 letter a GDPR; consent can be revoked at any time.

More information on Google Ads and Google Conversion Tracking can be found in Google's Privacy Policy:

hhttps://policies.google.com/privacy?hl=it. You can set your browser so that it informs you when cookies are set and only allows cookies in individual cases, excludes the acceptance of cookies for certain cases or always, and activates the automatic deletion of cookies upon closing the browser. If you disable cookies, the functionality of this website may be limited.

ย 

GOOGLE ADSENSE (non-personalized)

This website uses Google AdSense, a service for integrating advertising ads. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. We use Google AdSense in "non-personalized" mode. Unlike personalized mode, ads are therefore not based on the user's previous behavior and no user profile is created by you. Instead, so-called "contextual information" is used to select ads. The selected ads are based, for example, on your location, the content of the website you are on, or current search terms. To learn more about the differences between personalized and non-personalized targeting with Google AdSense, visit the siteย https://support.google.com/adsense/answer/9007336

Please note that cookies can also be saved when using Google AdSense in non-personalized mode. According to Google, these are used to combat fraud and abuse. Cookies remain on your device until you delete them. The use of Google AdSense in non-personalized mode is based on Art. 6 para. 1 letter f GDPR. We have a legitimate interest in analyzing user behavior in order to optimize both our website and our advertising. If corresponding consent has been requested (e.g., consent to store cookies), the processing is carried out exclusively on the basis of Art. 6 para. 1 letter a GDPR; consent can be revoked at any time.

The transmission of data to the USA is based on the EU Commission's standard contractual clauses. Details can be found here:ย https://privacy.google.com/businesses/controllerterms/mccs/

You can independently modify your advertising settings in your user area. To do this, click the following link and log in:ย https://adssettings.google.com/authenticated

Further information on Google's advertising technologies is available here:ย https://policies.google.com/technologies/adsย andย https://www.google.de/intl/de/policies/privacy/.

This website participates in the AWIN AG, EichhornstraรŸe 3, 10785 Berlin, Germany, affiliate program, which was designed to provide a means for websites through which the placement of advertising and links to AWIN can earn advertising commissions (so-called affiliate system). AWIN uses cookies to be able to trace the origin of the conclusion of the order. Among other things, AWIN can recognize that you clicked on the affiliate link on this website and subsequently concluded a contract with or through AWIN. The legal basis is the legitimate interest Art.6 Abs.1 lit. f GDPR (Interest in the economic operation of our online offer) Further information on the use of data by Awin and the possibilities of objection can be found in the company's privacy policy:ย https://www.awin.com/it/informazioni-legali

Facebook Plugins (Like & Share-Button)

Facebook social network plugins are integrated on this site. The provider of this service is Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. However, according to Facebook, the collected data is also transferred to the United States and other third countries. Facebook plugins are recognizable by the Facebook logo or the "Like Button" ("Like") on this website. Here you can find an overview of Facebook plugins:ย https://developers.facebook.com/docs/plugins/?locale=it_IT. When you visit this website, the plugin establishes a direct connection between your browser and the Facebook server. Facebook thus receives the information that you visited this website with your IP address. By clicking on the Facebook "Like" button while logged in to your Facebook account, you can link the contents of this website to your Facebook profile. This allows Facebook to associate the visit to this website with your account. We wish to emphasize that we, as the page providers, are not aware of the content of the transmitted data and their use by Facebook. You can find further information regarding Facebook's privacy policy at the address:ย https://www.facebook.com/privacy/explanation. If you do not want Facebook to be able to assign your visit to this website to your Facebook user account, please log out of your Facebook account. The use of Facebook plugins is based on Art. 6 para. 1 letter f of the GDPR. The website manager has a legitimate interest in having the widest possible visibility on social media.

Instagram Plugin

Instagram service features are integrated into this website. These features are offered by Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. If you have logged into your Instagram account, you can link the content of this website to your Instagram profile by clicking the Instagram button. This allows Instagram to associate your visit to this website with your account. We wish to emphasize that we, as the website providers, have no knowledge of the content of the data transmitted or of its use by Instagram. The Instagram plugin is used on the basis of Art. 6(1)(f) of the GDPR. The website operator has a legitimate interest in having the broadest possible visibility on social media. For further information, please refer to Instagram's privacy policy:ย https://instagram.com/about/legal/privacy/

6.4 USEFUL LINKS TO THE PRIVACY POLICIES OF PLUGIN PROVIDERS

The collection and use of data by the social media plugin providers mentioned above are governed by their respective privacy policies, to which please refer. By clicking on the respective links below, you will also find further information about your rights and the setting options for protecting your privacy.

Addresses of the respective plugin providers and URLs with their privacy policies:

FANPAGE ON FACEBOOK

Our presence on social networks and platforms, such as Facebook, serves to ensure active and up-to-date communication with our customers and stakeholders. Here we provide information about our services, products, and interesting special offers around our company. When you visit our online presence on social media, your data may be automatically collected and stored for market research and advertising purposes. User profiles are created from this data with the help of pseudonyms. These can be used, for example, to place advertisements inside and outside the platforms that presumably correspond to your interests. For this purpose, cookies are usually used on your end device. The function of cookies is explained in our privacy policy, so please refer to the relevant information. Visitor behavior and user interests are stored in these cookies. This serves to protect our legitimate interests, which predominate in the context of the balancing of interests, in an optimized presentation of our services and offers, and in effective communication with customers and stakeholders. The legal basis for processing is therefore Art. 6(1)(f) of the GDPR. If the operators of the respective social media platforms ask you for consent (approval) to process the data, e.g. with the help of a checkbox, the legal basis for processing the data is Art. 6(1)(a) of the GDPR. We have a profile on Facebook. The provider of this service is Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. According to Facebook, the collected data is also transferred to the United States and other third countries. For detailed information on the processing and use of data by the providers on their websites, as well as a contact option and your rights and setting options for protecting your privacy, in particular the possibility to object (so-called opt-out), please refer to the provider's data protection information linked below:ย https://www.facebook.com/about/privacy/. If you have further questions in this regard, you can also contact us using the contact details listed above. We have concluded a joint processing agreement (Controller Addendum) with Facebook. This agreement defines the data processing operations for which we or Facebook are responsible when you visit our Facebook page. You can view this agreement by clicking on the following link:ย https://www.facebook.com/legal/terms/page_controller_addendum. You can independently adjust your advertising settings in your account. To do so, click on the following link and log in:ย https://www.facebook.com/settings?tab=ads.

  1. DATA SECURITY

We protect the data collected through our website and other systems through technical and organizational measures against the loss, destruction, access, modification, and dissemination of your data by unauthorized persons. Depending on the browser used, the data is transmitted using 128-bit to 256-bit SSL encryption. Despite regular checks and continuous improvement of our security measures, complete protection against all dangers cannot be guaranteed.

  1. REVIEWS

We collect and process the personal data of individuals who write reviews about our products. Processing operations may also be carried out electronically. This is always the case if the individual sends us their review electronically, for example via email or through a web form published on our Website. If we conclude a contract with an individual, the transmitted data will be processed for the purposes of performing the contractual relationship in accordance with the provisions of the law.

However, if there is no longer any contractual relationship between us and the requester, the review documents will be deleted four months after the notification of the decision to reject, provided that the deletion does not conflict with other legitimate interests of the controller (for example, for defensive purposes).

We will only publish qualified reviews and will not ask for special data such as racial and ethnic origin, political opinions, religious or ideological beliefs or affiliations, genetic data, biometric data to uniquely identify a natural person, health data, or data about sexual life.

  1. RIGHTS OF THE DATA SUBJECT

The rights of the data subject in accordance with the GDPR are listed below.

9.1 RIGHT OF ACCESS BY THE DATA SUBJECT

The data subject, as provided for in Article 15 of the GDPR, has the right to obtain from the controller confirmation as to whether or not personal data concerning them is being processed. In particular, the data subject has the right to access their personal data collected and processed within the scope of that processing and to receive from the controller a set of information related to it, to understand how that data was received, for what purpose, and how it is used.

Therefore, the data subject has the right to access their personal data and the following information:

  • the purposes of the processing;
  • the categories of personal data in question;
  • the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if they are recipients in third countries or international organizations;
  • where possible, the period of retention of personal data provided for, or, if not possible, the criteria used to determine such period;
  • the existence of the data subject's right to request the controller the rectification or erasure of personal data or the restriction of processing of personal data concerning them or to object to their processing;
  • the right to lodge a complaint with a supervisory authority;
  • if the data are not collected from the data subject, all available information about their origin.

9.2 RIGHT TO RECTIFICATION

The data subject has the right to obtain from the controller the rectification of inaccurate personal data concerning them without undue delay. Taking into account the purposes of the processing, the data subject has the right to obtain the completion of incomplete personal data, even by providing a supplementary statement.

9.3 RIGHT TO RESTRICTION OF PROCESSING

The data subject has the right to obtain from the controller the restriction of processing when one of the cases referred to in Art. 18 of the GDPR applies, for example:

  • when the data subject contests the inaccuracy of their personal data;
  • when there is unlawful processing of their data;
  • if the data subject's personal data are necessary for the establishment, exercise, or defense of a legal claim;
  • when the data subject has objected to the processing pursuant to Article 21(1) of the GDPR, pending verification of the possible predominance of the controller's legitimate grounds over those of the data subject.

If the processing is restricted pursuant to paragraph 1 of Article 18 of the GDPR above, such personal data are processed, except for retention, only with the consent of the data subject or for the establishment, exercise, or defense of a legal claim, or to protect the rights of another natural or legal person, or for reasons of substantial public interest of the Union or a Member State.

The data subject who has obtained the restriction of processing pursuant to paragraph 1 is informed by the controller before such restriction is revoked.

9.4 RIGHT TO ERASURE

OBLIGATION TO ERASE

The right to erasure of personal data is provided for in Article 17 of the GDPR. The data subject has the right to obtain from the controller the erasure of personal data concerning them without undue delay if one of the following grounds applies:

  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • the data subject withdraws the consent on which the processing is based pursuant to Article 6(1)(a) of the GDPR, or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing;
  • the data subject objects to the processing pursuant to Article 21(1) of the GDPR, and there is no overriding legitimate ground for the processing, or objects to the processing pursuant to Article 21(2) of the GDPR;
  • the personal data have been unlawfully processed;
  • the personal data must be erased to comply with a legal obligation under Union or Member State law to which the controller is subject;
  • the personal data have been collected in relation to the offering of information society services pursuant to Article 8(1) of the GDPR.

INFORMATION TO THIRD PARTIES

The controller, if they have made personal data of the data subject public for processing and are obliged to erase it, taking into account the available technology and the costs of implementation, shall adopt reasonable measures, including technical measures, to inform the controllers who are processing the personal data of the data subject's request to erase any link, copy, or reproduction of their personal data.

EXCEPTIONS

The two points above do not apply to the extent that the processing is necessary:

  • for the exercise of the right to freedom of expression and information;
  • for compliance with a legal obligation requiring processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  • for reasons of public interest in the area of public health pursuant to Article 9(2)(h) and (i) of the GDPR, and Article 9(3) of the GDPR;
  • for the establishment, exercise, or defense of a legal claim.

9.5 RIGHT TO INFORMATION

The controller shall communicate to each of the recipients to whom the personal data have been transmitted any rectifications, erasures, or restrictions of processing carried out, unless this proves impossible or involves disproportionate effort. The controller shall communicate such recipients to the data subject if the data subject requests it (Article 19 of the GDPR).

9.6 RIGHT TO DATA PORTABILITY

The data subject has the right to receive their personal data provided to a controller in a structured, commonly used, and machine-readable format, and has the right to transmit such data to another controller without hindrance from the controller to whom they provided it, provided that:

  • the processing is based on consent pursuant to Article 6(1)(a) of the GDPR, or Article 9(2)(a) of the GDPR, or on a contract pursuant to Article 6(1)(b) of the GDPR; and
  • the processing is carried out by automated means.

When exercising their rights regarding data portability, the data subject has the right to obtain the direct transmission of personal data from one controller to another, if technically feasible. The right must not adversely affect the rights and freedoms of others.

9.7 RIGHT TO OBJECT

The data subject has the right to object at any time, for reasons related to their particular situation, to the processing of personal data concerning them pursuant to Article 6(1)(e) or (f), including profiling based on such provisions. The controller shall not further process the personal data unless they demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of a legal claim.

If the personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning them for such purposes, including profiling to the extent that it is connected to such direct marketing.

If the data subject objects to the processing for direct marketing purposes, the personal data shall no longer be subject to processing for such purposes.

In the context of the use of information society services and without prejudice to Directive 2002/58/EC, the data subject may exercise their right to object by automated means using technical specifications.

9.8 RIGHT TO WITHDRAW CONSENT

The data subject has the right to withdraw their consent at any time.

Once consent is withdrawn, the controller must ensure that the data are erased, unless there is another legal basis for processing them (for example, legal obligations, or if the processing is necessary to fulfill the contract).

The withdrawal of consent does not affect the lawfulness of processing based on consent before the withdrawal (Article 7(3) of the GDPR).

9.9 AUTOMATED DECISION-MAKING RELATING TO NATURAL PERSONS, INCLUDING PROFILING

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

Article 22(2) of the GDPR lists the cases in which the above does not apply, namely cases in which the decision:

  • is necessary for entering into or performing a contract between the data subject and a controller;
  • is authorized by Union or Member State law to which the controller is subject, which also specifies suitable measures to safeguard the rights, freedoms, and legitimate interests of the data subject;
  • is based on the explicit consent of the data subject.

9.10 RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

Each data subject who considers that the processing of their personal data infringes the GDPR, in accordance with Article 77 of the GDPR, may lodge a complaint with a supervisory authority to which the data subject is habitually resident or employed, or with a supervisory authority where the alleged infringement occurred.

9.11 AMENDMENTS TO THIS PRIVACY NOTICE

We reserve the right to amend these data protection provisions at any time with future effect following changes in law or adjustments to our internal business processes. An up-to-date version is available on the website. Please visit the website regularly and keep yourself informed about the current data protection rules. If the data protection statement is translated from German, in the event of any discrepancies, the German version shall prevail.

October 2021

ย