General information and obligation to provide data

We take the protection of your data seriously and handle it carefully, transparently and securely in accordance with national and European data protection law. Below we inform you about the processing of your personal data when using this website and about your related rights.

“Personal data” means any information relating to an identified or identifiable natural person.

Unless otherwise stated below, the provision of your personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide the data, and failure to provide it has no consequences. This applies only insofar as no other statement is made in connection with the processing operations described below.

Controller

The controller responsible for data processing within the meaning of Art. 4(7) GDPR is

Kolonne Null GmbH Frobenstraße 1 10783 Berlin Germany

Phone: +49 30 54907969 Email: info@kolonnenull.com

If you have any questions about data protection, you can reach us using the contact details above.

Website access, server log files and hosting

You can visit our websites without providing any personal information.

Each time our website is accessed, usage data is transmitted by your internet browser to us or to our web host and stored in log data (known as server log files). This data includes, for example, the name of the page accessed, the date and time of access, the IP address, the volume of data transferred and the requesting provider.

This processing is carried out on the basis of Art. 6(1)(f) GDPR, on the basis of our overriding legitimate interest in ensuring the trouble-free operation of our website and in improving our offering.

Our online shop is operated and hosted by Shopify International Limited (2nd Floor Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland; “Shopify”) as a processor on our behalf. Shopify is an affiliate of Shopify Inc. (151 O’Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada).

Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. An adequacy decision of the EU Commission exists for Canada. For the USA, an adequacy decision also exists in the form of the Trans-Atlantic Data Privacy Framework (TADPF); Shopify is not certified under the TADPF. This data transfer takes place on the basis of contractual obligations comparable to the EU Commission’s standard contractual clauses.

Further information on data protection at Shopify: https://www.shopify.com/legal/privacy. Information on the data processing agreement: https://www.shopify.com/legal/dpa.

Contact by email and via the contact form

If you contact us by email or through our contact form, we collect your personal data (name, email address, message content) only to the extent you provide it. The processing serves the purpose of handling and responding to your enquiry.

Where contact serves to carry out pre-contractual measures (for example advice on a purchase enquiry or preparing a quote) or relates to a contract already concluded between you and us, this processing is carried out on the basis of Art. 6(1)(b) GDPR.

Where contact is made for other reasons, this processing is carried out on the basis of Art. 6(1)(f) GDPR, on the basis of our overriding legitimate interest in handling and responding to your enquiry. In this case you have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you.

We use your email address solely to handle your enquiry. Your data is subsequently deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

We use Freshdesk to handle support and customer enquiries (see the “Customer service” section).

Withdrawal button

If you have concluded a contract via our online presence, we provide you with a withdrawal function (withdrawal button) through which you can submit your declaration of withdrawal directly.

When you use this function, we collect your personal data (name, email address, details identifying the contract or part of the contract you wish to withdraw from, and the date and time the declaration of withdrawal was sent) only to the extent you provide it. The processing serves the purpose of providing you with the statutory option to withdraw from your contract and of handling your withdrawal properly.

The processing is carried out on the basis of Art. 6(1)(b) GDPR insofar as it relates to a contract already concluded, and otherwise on the basis of Art. 6(1)(c) GDPR in order to comply with our legal obligation under Section 356a of the German Civil Code (BGB).

Your data is subsequently deleted in compliance with statutory retention periods.

Job applications

You can apply to us for vacancies advertised on our website. In doing so, we collect your personal data only to the extent you provide it. This includes your contact details (for example name, email address, telephone number), information on your professional qualifications and education, information on further professional training, and performance-related evidence.

The processing serves the purpose of making contact and deciding on whether to establish an employment relationship with you. Provision of the data is necessary in order to carry out the application process. The processing is carried out on the basis of Art. 6(1)(b) GDPR in conjunction with Section 26(1) of the German Federal Data Protection Act (BDSG) for the purpose of pre-contractual measures.

Where you have given us consent to be included in our applicant pool, the processing is carried out on the basis of Art. 6(1)(a) GDPR. You may withdraw your consent at any time without affecting the lawfulness of processing carried out on the basis of the consent up to the point of withdrawal.

Where special categories of personal data within the meaning of Art. 9(1) GDPR are requested during the application process, such as information on the degree of a disability, this is done on the basis of Art. 9(2)(b) GDPR.

We store your personal data for as long as is necessary to decide on your application. Your data is then deleted after six months at the latest, unless you have consented to further processing and use. If an employment relationship results from the application process, the data provided will be further processed on the basis of Art. 6(1)(b) GDPR in conjunction with Section 26(1) BDSG and subsequently transferred to your personnel file.

Customer account and orders

Customer account. When you open a customer account, we collect your personal data to the extent specified there. The processing serves the purpose of improving your shopping experience and simplifying order processing, and is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You may withdraw your consent at any time by notifying us; your customer account will then be deleted.

Orders. When you place an order, we collect and process your personal data only insofar as this is necessary to fulfil and process your order and to handle your enquiries. Provision of the data is necessary for the conclusion of the contract; failure to provide it means that no contract can be concluded. The processing is carried out on the basis of Art. 6(1)(b) GDPR.

Your data is passed on in this context to shipping companies, payment service providers, our ERP system and IT service providers. The scope of the data transfer is limited to a minimum.

Shipping service providers

As part of shipping, we transmit personal data (name, address, where applicable email address and/or mobile telephone number, and other shipment-related data) to one of our shipping partners:

• DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany
• DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg, Germany

The processing is carried out on the basis of Art. 6(1)(f) GDPR; our overriding legitimate interest lies in the smooth handling of shipping with the support of a service provider. You may object at any time to the transfer of additional information such as your email address or mobile telephone number by notifying us, or, in the case of deliveries by DPD, by contacting DPD directly at widerspruch_predictbenachrichtigung@dpd.de or via the link in each shipment notification.

We pass on your email address to the transport company as part of contract processing, provided you have expressly consented to this during the order process. The purpose is to inform you about the shipping status by email. The processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent, which you may withdraw at any time by notifying us or the transport company.

ERP system

We use an enterprise resource planning system for contract processing, operated as a processor on our behalf. For this purpose, the personal data collected in connection with your order is transmitted to

weclapp GmbH, Friedrich-Ebert-Straße 28, 97318 Kitzingen, Germany.

The processing serves the purpose of fulfilling the contract concluded with you, in particular invoicing, and is carried out on the basis of Art. 6(1)(b) GDPR.

Payment service providers

Shopify Payments (including credit card, Apple Pay, Google Pay and Shop Pay)

We use the payment service “Shopify Payments” provided by Shopify International Limited (2nd Floor Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland). Payment is processed by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; “Stripe”). When you select and use a payment method offered through Shopify Payments – including credit card, Apple Pay, Google Pay and Shop Pay – the data required for payment processing is transmitted to Stripe. This processing is carried out on the basis of Art. 6(1)(b) GDPR.

Stripe reserves the right to obtain a credit assessment based on mathematical and statistical procedures using credit agencies. Such an assessment may include probability values (score values), the calculation of which takes address data into account, among other factors. The processing serves the purpose of assessing creditworthiness in connection with the initiation of a contract and is carried out on the basis of Art. 6(1)(f) GDPR, on the basis of our overriding legitimate interest in protection against payment default. You have the right to object to this processing, on grounds relating to your particular situation, by notifying Stripe.

If you wish, Shop Pay stores your payment and delivery details with Shopify in order to speed up future orders. This storage is carried out on the basis of Art. 6(1)(a) GDPR with your consent.

Further information: https://www.shopify.com/legal/privacy and https://stripe.com/privacy.

PayPal

We use the payment service provided by PayPal (Europe) S.à r.l. et Cie, S.C.A. (22–24 Boulevard Royal, L-2449 Luxembourg; “PayPal”), both as PayPal Express on the website and as a payment method at checkout. In order to integrate PayPal Express, it is necessary for PayPal to collect, store and analyse data when the website is accessed (for example IP address, device type, operating system, browser type, location of your device). Cookies may be used for this purpose.

This processing is carried out on the basis of Art. 6(1)(f) GDPR, on the basis of our overriding legitimate interest in offering a customer-oriented range of payment methods. You have the right to object to this processing at any time on grounds relating to your particular situation.

When you select and use PayPal, the data required for payment processing is transmitted to PayPal. This processing is carried out on the basis of Art. 6(1)(b) GDPR. For individual payment methods, PayPal reserves the right to obtain a credit assessment based on mathematical and statistical procedures using credit agencies. This processing is carried out on the basis of Art. 6(1)(f) GDPR, on the basis of our overriding legitimate interest in protection against payment default where PayPal makes an advance payment. You may object to this processing by notifying PayPal. Provision of the data is necessary for the conclusion of a contract using your chosen payment method.

Further information: https://www.paypal.com/uk/webapps/mpp/ua/privacy-full.

Klarna

We use the payment service provided by Klarna Bank AB (publ) (Sveavägen 46, 111 34 Stockholm, Sweden; “Klarna”). When you select and use Klarna, the data required for payment processing is transmitted to Klarna so that the contract can be fulfilled using the chosen payment method. This processing is carried out on the basis of Art. 6(1)(b) GDPR. Cookies that allow your browser to be recognised may be stored in this context; that processing is carried out on the basis of Art. 6(1)(f) GDPR, on the basis of our overriding legitimate interest in offering a customer-oriented range of payment methods.

For individual payment methods such as “Pay Later” (purchase on invoice), “Pay Now” (direct debit, credit card, instant bank transfer) and “Financing” (instalment purchase), Klarna reserves the right to carry out an identity and credit check. For this purpose, Klarna transmits the personal data required – such as first and last name, address, gender, email address, IP address and order-related data – to a credit agency. Such an assessment may include probability values (score values), the calculation of which takes address data into account, among other factors. The processing is carried out on the basis of Art. 6(1)(f) GDPR, on the basis of our overriding legitimate interest in protection against payment default where Klarna makes an advance payment. You may object to this processing by notifying Klarna. Provision of the data is necessary for the conclusion of a contract using your chosen payment method.

Further information on the credit agencies used by Klarna: https://cdn.klarna.com/1.0/shared/content/legal/terms/0/en_gb/credit_rating_agencies. Klarna’s privacy notice: https://cdn.klarna.com/1.0/shared/content/legal/terms/0/en_gb/privacy.

Newsletter and email marketing

We use your email address to send you information and offers by newsletter, provided you have expressly consented to this. For this purpose we process your email address and, where applicable, any other details you provided voluntarily when signing up.

We use the double opt-in procedure for sign-ups: after registering, you receive an email in which you confirm that you wish to receive the newsletter. This allows us to verify that you are the owner of the email address provided and that you agree to receive it.

The processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You may withdraw your consent at any time without affecting the lawfulness of processing carried out up to the point of withdrawal, for example via the unsubscribe link in the newsletter or by notifying us. Your email address will then be removed from the distribution list.

Despite removal from the distribution list, we may continue to store your email address on a blocklist in order to prevent you from receiving newsletters from us in future. This storage is carried out on the basis of Art. 6(1)(f) GDPR, on the basis of our and your legitimate interest in preventing your email address from being used again. You have the right to object to this processing at any time on grounds relating to your particular situation.

Service provider. We use Omnisend, provided by UAB Omnisend (Verkių g. 25C-1, LT-08223 Vilnius, Lithuania; “Omnisend”), as a processor on our behalf to send our newsletters and other email communications. In this context your email address, your sign-up and consent data, and order- and usage-related data are processed. Omnisend analyses whether and when you open our emails and which links you click in them, in order to tailor content to your interests. This processing is also carried out on the basis of Art. 6(1)(a) GDPR with your consent.

Omnisend uses sub-processors, which may result in data being transferred to the USA. This transfer takes place on the basis of the EU Commission’s standard contractual clauses. Further information: https://www.omnisend.com/privacy-policy/.

Reviews

We use the review system “Judge.me” provided by Judge.me Ltd (c/o Buckworths, 2nd Floor, 1–3 Worship Street, London, EC2A 2AB, United Kingdom; “Judge.me”). Judge.me allows us to collect customer reviews and display them on our website.

After placing an order, you may receive an invitation from us or from Judge.me to submit a review. The following data may be processed in this context: email address, name, telephone number, address, information about your device (IP address, browser, operating system), information about the product purchased (order number, product details), the content of your review and your star rating, and any photos or videos you attach. This data may also be used to verify your review. Judge.me uses technologies such as cookies.

Your data may be transferred to the United Kingdom, for which an adequacy decision of the EU Commission exists, and where applicable to the USA. For the USA, an adequacy decision exists in the form of the Trans-Atlantic Data Privacy Framework (TADPF); Judge.me is not certified under the TADPF. The transfer takes place on the basis of contractual guarantees ensuring a comparable level of protection.

The use of cookies or comparable technologies is carried out with your consent on the basis of Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1)(a) GDPR. You may withdraw your consent at any time.

Further information: https://judge.me/privacy.

Customer service (Freshdesk)

We use the ticketing system “Freshdesk” provided by Freshworks Inc. (2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA). Freshdesk allows us to handle support and customer enquiries received by chat, email or contact form. Incoming enquiries are recorded centrally, assigned and answered either automatically or manually.

Freshdesk uses functions based on artificial intelligence. In accordance with Art. 50 of the EU AI Act, we point out that you may be interacting with an AI system. Automatically generated responses may contain errors or be incomplete and do not constitute legally binding advice. Please review the content critically and do not rely solely on these outputs for legally binding matters.

The following data is processed: your contact details (name, email address, where applicable telephone number), the content of your enquiry, technical metadata (IP address, timestamp, browser information), and your support history and response content.

Your data may be transferred to the USA. For the USA, an adequacy decision exists in the form of the Trans-Atlantic Data Privacy Framework (TADPF); Freshworks is certified under the TADPF.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures) and otherwise Art. 6(1)(f) GDPR, on the basis of our legitimate interest in handling enquiries efficiently.

Further information: https://www.freshworks.com/privacy/.

Cookies and consent management

Our website uses cookies. Cookies are small text files stored in or by the internet browser on a user’s computer system. A cookie contains a characteristic string of characters that allows the browser to be uniquely identified when the website is accessed again.

Cookies are stored on your computer, so you have full control over their use. By selecting the appropriate technical settings in your browser, you can be notified before cookies are set, decide individually whether to accept them, and prevent them from being stored. Cookies that have already been stored can be deleted at any time. Please note that you may then not be able to use all functions of this website in full.

You can find out how to manage cookies in the most common browsers at the following links:

• Chrome: https://support.google.com/accounts/answer/61416
• Microsoft Edge: https://support.microsoft.com/microsoft-edge
• Mozilla Firefox: https://support.mozilla.org/kb/enable-and-disable-cookies-website-preferences
• Safari: https://support.apple.com/guide/safari/sfri11471/mac

Technically necessary cookies

Unless otherwise stated below, we only use technically necessary cookies for the purpose of making our offering more user-friendly, effective and secure. Some functions of our website cannot be provided without the use of cookies.

Their use is based on Section 25(2) TDDDG. The processing of your personal data is carried out on the basis of Art. 6(1)(f) GDPR, on the basis of our overriding legitimate interest in the functionality of the website. You have the right to object to this processing at any time on grounds relating to your particular situation.

Usercentrics

We use the consent management tool Usercentrics provided by Usercentrics GmbH (Rosenthal 4, 80331 Munich, Germany; “Usercentrics”). The tool allows you to give consent to data processing via the website, in particular the setting of cookies, and to withdraw consent already given. The processing serves the purpose of obtaining and documenting the necessary consents.

The following information may be collected and transmitted to Usercentrics: date and time of the page visit, information about your browser and device, anonymised IP address, and opt-in and opt-out data. Usercentrics uses the Google Cloud Platform of Google Ireland Limited, which may result in your data being transferred to the USA. For the USA, an adequacy decision exists in the form of the Trans-Atlantic Data Privacy Framework (TADPF); Google is certified under the TADPF.

The processing is carried out in order to comply with a legal obligation on the basis of Art. 6(1)(c) GDPR. Records of a withdrawal of consent are retained for three years.

Further information: https://usercentrics.com/privacy-policy/.

Analytics

Google Analytics 4

We use the web analytics service Google Analytics provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”). The processing serves the purpose of analysing this website and its visitors as well as marketing and advertising purposes. On our behalf, Google uses the information obtained to evaluate your use of the website, compile reports on website activity and provide further services relating to website use.

The following information may be collected: IP address, date and time of the page visit, click path, information about your browser and device, pages visited, referrer URL, location data and purchase activity. Your data may be linked by Google with other data, such as your search history or your personal accounts.

Google uses technologies such as cookies, browser web storage and tracking pixels. Their use is carried out with your consent on the basis of Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1)(a) GDPR. You may withdraw your consent at any time.

In this context we also use Google Signals, which enables cross-device tracking if you have activated personalised advertising in your account settings and linked your devices to your Google account. The resulting reports contain aggregated data only. You can deactivate the “personalised ads” function in your Google account settings (https://support.google.com/ads/answer/2662922).

The information generated is generally transmitted to and stored on a Google server in the USA. For the USA, an adequacy decision exists in the form of the Trans-Atlantic Data Privacy Framework (TADPF); Google is certified under the TADPF.

Further information: https://policies.google.com/privacy and https://business.safety.google/privacy/.

Shopify statistics

We use the statistics and analytics functions of Shopify International Limited (2nd Floor Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland) as a processor on our behalf. The processing serves the purpose of analysing this website and its visitors; data is stored for marketing and optimisation purposes and made available in reports.

The following is collected, among other things: information about your web browser, your IP address, your time zone and some of the cookies installed on your device. As you navigate the website, information on the pages or products accessed, the referrer URL and how you interact with the website is also recorded. Technologies such as cookies, web beacons, tags and pixels are used for this purpose.

Your data may be transferred to Canada and the USA. An adequacy decision of the EU Commission exists for Canada. For the USA, the Trans-Atlantic Data Privacy Framework (TADPF) exists; Shopify is not certified under the TADPF. The transfer takes place on the basis of contractual obligations comparable to the EU Commission’s standard contractual clauses.

The use of cookies or comparable technologies is carried out with your consent on the basis of Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR, and the processing of your personal data on the basis of Art. 6(1)(a) GDPR. You may withdraw your consent at any time.

Microsoft Clarity

We use the analytics tool “Microsoft Clarity” provided by Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; “Microsoft”). The processing serves the purpose of designing, optimising and analysing our website in line with demand. The tool records the movements of site visitors on a sample basis, producing a record of mouse movements, scrolling behaviour, time spent on the site and clicks (known as a heatmap).

The following information may be collected: IP address, time of access, click path, information about the device used (device type, screen size and resolution, device identifier, operating system), browser type and version, location data, preferred language, subpages visited, time spent and content viewed. User profiles are created from this data under a pseudonym. The data is not used to identify you personally and is not combined with personal data relating to the bearer of the pseudonym.

Your data may be transferred to the USA. For the USA, the Trans-Atlantic Data Privacy Framework (TADPF) exists; Microsoft is certified under the TADPF.

The use of cookies or comparable technologies is carried out with your consent on the basis of Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR, and the processing of your personal data on the basis of Art. 6(1)(a) GDPR. You may withdraw your consent at any time.

Further information: https://learn.microsoft.com/en-us/clarity/faq#privacy and https://privacy.microsoft.com/privacystatement.

Advertising and tracking

Meta Pixel

We use the Meta Pixel provided by Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; “Meta”) on our website.

Meta and we are joint controllers for the collection of your data that takes place when the service is integrated and for the transfer of that data to Meta. This is based on an agreement on joint processing of personal data, available at https://www.facebook.com/legal/terms/businesstools. Under that agreement, we are responsible in particular for fulfilling the information obligations under Art. 13 and 14 GDPR, for complying with Art. 32 GDPR as regards correct technical implementation and configuration of the service, and for the obligations under Art. 33 and 34 GDPR insofar as a personal data breach concerns our obligations. Meta is responsible for enabling data subject rights under Art. 15 to 20 GDPR, for complying with the security requirements of Art. 32 GDPR as regards the security of the service, and for the obligations under Art. 33 and 34 GDPR insofar as they concern Meta.

The application serves the purpose of addressing website visitors with interest-based advertising on the social networks Facebook and Instagram. Through the remarketing tag, a direct connection to Meta’s servers is established when you visit the website, transmitting which of our pages you have visited. Meta assigns this information to your personal user account.

The application also serves the purpose of compiling conversion statistics. We learn the total number of users who clicked on one of our ads and were redirected, and which actions were taken afterwards. We do not receive any information that would allow users to be identified personally.

Your data may be transferred to the USA. For the USA, the Trans-Atlantic Data Privacy Framework (TADPF) exists; Meta is certified under the TADPF.

The processing is carried out with your consent on the basis of Art. 6(1)(a) GDPR, and the use of cookies on the basis of Section 25(1) sentence 1 TDDDG. You may withdraw your consent at any time. Further information: https://www.facebook.com/about/privacy/.

Google Ads conversion tracking and remarketing

We use the online advertising programme “Google Ads” provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”), and within it conversion tracking as well as the remarketing and “similar audiences” functions.

When you click on an ad placed by Google, a conversion tracking cookie is stored on your computer. If you then visit certain pages of our website and the cookie has not yet expired, Google and we can see that you clicked on the ad and were redirected. The information obtained serves the purpose of compiling conversion statistics; we do not receive any information that would allow users to be identified personally.

The remarketing function serves the purpose of analysing visitor behaviour and interests as the basis for interest-based advertising. If you subsequently visit another website in the Google Display Network, you will be shown advertisements that take into account product and information areas you previously accessed.

Your data may be transferred to Google servers in the USA. For the USA, the Trans-Atlantic Data Privacy Framework (TADPF) exists; Google is certified under the TADPF.

The use of cookies or comparable technologies is carried out with your consent on the basis of Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR, and the processing of your personal data on the basis of Art. 6(1)(a) GDPR. You may withdraw your consent at any time.

Further information: https://policies.google.com/privacy and https://business.safety.google/privacy/.

Plug-ins and other services

Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). This application manages JavaScript and HTML tags used in particular to implement tracking and analytics tools. The processing serves the purpose of designing and optimising our website in line with demand.

Google Tag Manager itself does not store cookies and does not process personal data through this function. However, it enables other tags to be triggered which may collect and process personal data. Further information: https://policies.google.com/privacy.

Social plug-ins

We use social network plug-ins on our website as well as an embedded Instagram feed. Their integration serves the purpose of optimising advertising for our products.

When these are integrated, a connection is established between your device and the servers of the respective provider and the plug-in is displayed on the page, provided you have expressly consented to this. Both your IP address and information about which of our pages you visited are transmitted to the provider’s servers. This applies regardless of whether you are registered with or logged into the social network. If you are logged into your account at the same time, the information collected may be assigned to your profile. You can prevent this assignment by logging out of your social media accounts before visiting our website.

The use of cookies or comparable technologies is carried out with your consent on the basis of Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR, and the processing of your personal data on the basis of Art. 6(1)(a) GDPR. You may withdraw your consent at any time.

The following are integrated:

• Facebook and Instagram, provided by Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). Meta and we are joint controllers for the collection of your data and its transfer to Facebook on the basis of the agreement available at https://www.facebook.com/legal/controller_addendum; the allocation of responsibilities corresponds to that described in the Meta Pixel section. Privacy notices: https://www.facebook.com/about/privacy/ and https://help.instagram.com/155833707900388.
• LinkedIn, provided by LinkedIn Ireland Unlimited Company (Wilton Place, Dublin 2, Ireland). Privacy notice: https://www.linkedin.com/legal/privacy-policy.

Your data may be transferred to the USA. For the USA, the Trans-Atlantic Data Privacy Framework (TADPF) exists; Meta and LinkedIn are certified under the TADPF.

Google Maps (store finder)

We use the function for embedding Google Maps provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) in our store finder. The function enables the visual display of geographical information and interactive maps so that you can find retailers near you. When pages containing embedded Google Maps are accessed, Google also collects, processes and uses visitor data.

Your data may be transferred to the USA. For the USA, the Trans-Atlantic Data Privacy Framework (TADPF) exists; Google is certified under the TADPF.

The use of cookies or comparable technologies is carried out with your consent on the basis of Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR, and the processing of your personal data on the basis of Art. 6(1)(a) GDPR. You may withdraw your consent at any time.

Further information: https://policies.google.com/privacy.

Transfer of data to third parties and third-country transfers

Where we transfer your data to third parties or otherwise grant them access to the data, this is done exclusively on the basis of a legal basis.

When selecting our service providers and partners, we rely on European partners wherever possible. Transfers of data to a third country take place only where the specific requirements of Art. 44 et seq. GDPR are met, that is on the basis of an adequacy decision, specific safeguards such as the standard contractual clauses, or, in individual cases, your consent.

If data is transferred to the USA or another country without an equivalent level of data protection, we point out that there is a risk that your data may be processed by authorities there for monitoring and surveillance purposes, potentially without you having any legal remedies available.

Storage period

The stored data is retained until the purpose of the processing ceases to apply and no statutory retention periods prevent its deletion.

Where a contract has been concluded, the data is retained after the contract has been fully performed, initially for the duration of the warranty period and thereafter in accordance with statutory retention periods, in particular those under tax and commercial law, and is deleted once those periods expire, unless you have consented to further processing.

Rights of the data subject

Where the statutory requirements are met, you have the rights set out in Art. 15 to 20 GDPR: the right of access, the right to rectification, the right to erasure, the right to restriction of processing and the right to data portability.

Right to object

Under Art. 21(1) GDPR you have the right to object to processing based on Art. 6(1)(f) GDPR and to processing for the purposes of direct marketing. Where the processing described here is based on our legitimate interest, you have the right to object at any time with effect for the future, on grounds relating to your particular situation.

Following an objection, we will cease processing the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Right to withdraw consent

You may withdraw consent you have given at any time with effect for the future and without stating reasons. Processing carried out up to the point of withdrawal remains unaffected.

Right to lodge a complaint with a supervisory authority

Under Art. 77 GDPR you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data is unlawful. The supervisory authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit Alt-Moabit 59–61 10555 Berlin, Germany Phone: +49 30 138890 Email: mailbox@datenschutz-berlin.de