Privacy policy

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. For detailed information about data protection, please refer to our privacy policy set out below.

Data collection on this website

Who is responsible for collecting data on this website?

Data on this website is processed by the website operator. You can find their contact details in the “Information about the controller” section of this privacy policy.

How do we collect your data?

Some data is collected when you provide it to us. This may, for example, be data you enter in a contact form.

Other data is collected automatically or with your consent by our IT systems when you visit the website. This primarily consists of technical data, such as your internet browser, operating system or the time a page was accessed. This data is collected automatically as soon as you enter this website.

What do we use your data for?

Some data is collected to ensure that the website is provided without errors. Other data may be used to analyse your user behaviour.

What rights do you have regarding your data?

You have the right at any time to obtain information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request that this data be rectified or erased. If you have consented to data processing, you can withdraw that consent at any time with effect for the future. In certain circumstances, you also have the right to request restriction of the processing of your personal data. You additionally have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time about this or any other questions concerning data protection.

Analytics tools and third-party tools

When you visit this website, your browsing behaviour may be statistically analysed. This is primarily done using analytics programs.

You can find detailed information about these analytics programs in the following privacy policy.

2. Hosting

We host the content of our website with the following provider:

Shopify

The provider is Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland (hereinafter “Shopify”).

Shopify is a tool for creating and hosting websites. When you visit our website, Shopify collects your IP address and information about your device and browser. Shopify also analyses visitor numbers, visitor sources and customer behaviour and compiles user statistics. When you make a purchase on our website, Shopify also collects your name, email address, delivery and billing addresses, payment details and other data related to the purchase, such as your telephone number and transaction amounts. Shopify stores cookies in your browser for analytics purposes.

For details, please refer to Shopify’s privacy policy: https://www.shopify.de/legal/datenschutz.

Shopify is used on the basis of Article 6(1)(f) GDPR. We have a legitimate interest in presenting our website as reliably as possible. Where consent has been requested, processing takes place exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) TTDSG, insofar as consent covers the storage of cookies or access to information on the user’s device, such as device fingerprinting, within the meaning of the TTDSG. Consent may be withdrawn at any time.

3. General information and mandatory disclosures

Data protection

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection requirements and this privacy policy.

Various personal data is collected when you use this website. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this takes place.

Please note that transmitting data over the internet, for example when communicating by email, can involve security vulnerabilities. Complete protection of data against access by third parties is not possible.

Information about the controller

The controller responsible for data processing on this website is:

PKS Bikes GmbH
Maienfeldstraße 15
63303 Dreieich
Germany
Telephone: +49 1577 4433514
Business email: info@pks-store.com
Customer enquiries: support@pks-store.com

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data, such as names and email addresses.

Retention period

Unless a more specific retention period is stated in this privacy policy, we retain your personal data until the purpose of processing no longer applies. If you submit a justified request for erasure or withdraw your consent to data processing, your data will be erased unless we have other legally permissible grounds for retaining it, such as retention periods under tax or commercial law. In the latter case, it will be erased once those grounds cease to apply.

General information on the legal bases for data processing on this website

If you have consented to data processing, we process your personal data on the basis of Article 6(1)(a) GDPR or Article 9(2)(a) GDPR where special categories of data under Article 9(1) GDPR are processed. Where you have explicitly consented to the transfer of personal data to third countries, processing is additionally based on Article 49(1)(a) GDPR. If you have consented to the storage of cookies or access to information on your device, for example through device fingerprinting, processing is additionally based on Section 25(1) TTDSG. Consent may be withdrawn at any time. Where your data is necessary for performing a contract or taking steps prior to entering into a contract, we process it on the basis of Article 6(1)(b) GDPR. We also process your data on the basis of Article 6(1)(c) GDPR where this is necessary to comply with a legal obligation. Processing may also be based on our legitimate interests under Article 6(1)(f) GDPR. The following sections of this privacy policy explain which legal bases apply in each case.

Information on transfers to third countries that do not provide adequate data protection and to US companies not certified under the DPF

Among other tools, we use tools from companies based in third countries that do not provide adequate data protection and US tools whose providers are not certified under the EU–US Data Privacy Framework (DPF). When these tools are active, your personal data may be transferred to and processed in those countries. Please note that a level of data protection comparable to that of the EU cannot be guaranteed in third countries that do not provide adequate data protection.

Please note that, as a safe third country, the United States generally provides a level of data protection comparable to that of the EU. A transfer of data to the United States is therefore permissible if the recipient is certified under the EU–US Data Privacy Framework (DPF) or has appropriate additional safeguards. Information about transfers to third countries, including the data recipients, can be found in this privacy policy.

Recipients of personal data

In the course of our business, we work with various external parties. This sometimes requires personal data to be transferred to them. We disclose personal data to external parties only where this is necessary to perform a contract, where we are legally obliged to do so, for example to tax authorities, where we have a legitimate interest in disclosure under Article 6(1)(f) GDPR, or where another legal basis permits disclosure. When using processors, we disclose our customers’ personal data only on the basis of a valid data processing agreement. Where processing is carried out jointly, a joint controllership agreement is concluded.

Withdrawal of your consent to data processing

Many processing operations are possible only with your express consent. You may withdraw consent you have already given at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Right to object to data collection in specific situations and to direct marketing (Article 21 GDPR)

WHERE DATA IS PROCESSED ON THE BASIS OF ARTICLE 6(1)(e) OR (f) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO THE PROCESSING OF YOUR PERSONAL DATA; THIS ALSO APPLIES TO PROFILING BASED ON THOSE PROVISIONS. THE RELEVANT LEGAL BASIS FOR PROCESSING IS SET OUT IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS THE PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR PROCESSING IS NECESSARY FOR THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION UNDER ARTICLE 21(1) GDPR).

WHERE YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING; THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS RELATED TO DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION UNDER ARTICLE 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, particularly in the Member State of their habitual residence, place of work or the place of the alleged infringement. This right applies without prejudice to any other administrative or judicial remedy.

Right to data portability

You have the right to receive data that we process automatically on the basis of your consent or in performance of a contract, or to have it provided to a third party, in a commonly used, machine-readable format. If you request direct transmission to another controller, this will take place only where technically feasible.

Access, rectification and erasure

Within the framework of applicable law, you have the right at any time to obtain information free of charge about your stored personal data, its origin and recipients and the purpose of processing, and, where applicable, the right to have that data rectified or erased. You can contact us at any time about this or any other questions concerning personal data.

Right to restriction of processing

You have the right to request restriction of the processing of your personal data. You can contact us at any time for this purpose. This right applies in the following situations:

If you dispute the accuracy of your personal data held by us, we generally need time to verify it. You have the right to request restriction of processing for the duration of this verification.
If your personal data has been or is being processed unlawfully, you can request restriction of processing instead of erasure.
If we no longer need your personal data, but you require it for the exercise, defence or establishment of legal claims, you have the right to request restriction of processing instead of erasure.
If you have objected under Article 21(1) GDPR, your interests must be weighed against ours. Until it has been established whose interests prevail, you have the right to request restriction of the processing of your personal data.

Where processing has been restricted, your data may, apart from storage, be processed only with your consent, for the establishment, exercise or defence of legal claims, to protect the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries you send to us as the website operator, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the browser address changing from “http://” to “https://” and by the padlock symbol in your browser’s address bar.

When SSL or TLS encryption is enabled, data you transmit to us cannot be read by third parties during transmission.

Encrypted payment transactions on this website

If, after concluding a contract requiring payment, you are obliged to provide payment details, such as a bank account number for a direct debit mandate, that data is needed to process the payment.

Payments using common payment methods, such as Visa/MasterCard or direct debit, are processed exclusively over an encrypted SSL or TLS connection. You can recognise an encrypted connection by the browser address changing from “http://” to “https://” and by the padlock symbol in your browser’s address bar.

With encrypted communication, payment details you transmit to us cannot be read by third parties during transmission.

Objection to promotional emails

We hereby object to the use of contact details published under the legal notice requirement for sending advertising and information material that has not been expressly requested. The website operators expressly reserve the right to take legal action in the event of unsolicited advertising, such as spam emails.

4. Data collection on this website

Cookies

Our websites use cookies. Cookies are small data packets and do not harm your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted after your visit ends. Persistent cookies remain on your device until you delete them or your web browser deletes them automatically.

Cookies may originate from us (first-party cookies) or from third-party companies (third-party cookies). Third-party cookies allow certain services provided by other companies to be integrated into websites, such as cookies used to process payment services.

Cookies have various functions. Many are technically necessary because certain website functions would not work without them, such as the shopping cart or displaying videos. Other cookies may be used to analyse user behaviour or for advertising purposes.

Cookies required to carry out electronic communications, provide certain functions you request, such as the shopping cart, or optimise the website, such as audience measurement cookies (necessary cookies), are stored on the basis of Article 6(1)(f) GDPR unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies to provide its services without technical errors and in an optimised manner. Where consent to the storage of cookies and comparable recognition technologies has been requested, processing takes place exclusively on the basis of that consent (Article 6(1)(a) GDPR and Section 25(1) TTDSG); consent may be withdrawn at any time.

You can configure your browser to notify you when cookies are set, allow them only in individual cases, refuse them in certain cases or generally, and automatically delete cookies when you close the browser. Disabling cookies may limit the functionality of this website.

You can find information about the cookies and services used on this website in this privacy policy.

Consent with Usercentrics

This website uses Usercentrics consent technology to obtain your consent to the storage of certain cookies on your device or the use of certain technologies and to document it in compliance with data protection law. The provider is Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany, website: https://usercentrics.com/de/ (hereinafter “Usercentrics”).

When you enter our website, the following personal data is transferred to Usercentrics:

Your consent(s) or withdrawal of consent
Your IP address
Information about your browser
Information about your device
Time of your visit to the website
Geolocation

Usercentrics also stores a cookie in your browser to associate you with the consents you have given or withdrawn. The data collected in this way is stored until you request its erasure, delete the Usercentrics cookie yourself, or the purpose of storage no longer applies. Mandatory statutory retention obligations remain unaffected.

The Usercentrics banner on this website was configured with the help of eRecht24. This is indicated by the eRecht24 logo in the banner. To display that logo, a connection is established with eRecht24’s image server. Your IP address is also transmitted, but is stored in server logs only in anonymised form. eRecht24’s image server is located in Germany with a German provider. The banner itself is provided exclusively by Usercentrics.

Usercentrics is used to obtain the legally required consent for the use of certain technologies. The legal basis is Article 6(1)(c) GDPR.

Processing on our behalf

We have concluded a data processing agreement for the use of the service mentioned above. This is an agreement required under data protection law that ensures the service processes the personal data of visitors to our website only on our instructions and in compliance with the GDPR.

Server log files

The website provider automatically collects and stores information in server log files that your browser automatically transmits to us. This includes:

Browser type and version
Operating system used
Referrer URL
Host name of the accessing computer
Time of the server request
IP address

This data is not combined with other data sources.

This data is collected on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in ensuring that the website is displayed without technical errors and in optimising it; collecting server log files is necessary for this purpose.

Contact form

If you send us enquiries using the contact form, we store the information you provide in the form, including the contact details entered there, to process your enquiry and any follow-up questions. We do not disclose this data without your consent.

This data is processed on the basis of Article 6(1)(b) GDPR if your enquiry concerns performance of a contract or is necessary to take steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in dealing effectively with enquiries addressed to us (Article 6(1)(f) GDPR) or on your consent (Article 6(1)(a) GDPR), where requested; consent may be withdrawn at any time.

Data you enter in the contact form remains with us until you request its erasure, withdraw your consent to storage, or the purpose of storage no longer applies, for example after your enquiry has been fully processed. Mandatory statutory provisions, particularly retention periods, remain unaffected.

Enquiries by email, telephone or fax

If you contact us by email, telephone or fax, we store and process your enquiry, including all personal data it contains, such as your name and enquiry details, to deal with your request. We do not disclose this data without your consent.

Data you send us in enquiries remains with us until you request its erasure, withdraw your consent to storage, or the purpose of storage no longer applies, for example after your request has been fully processed. Mandatory statutory provisions, particularly statutory retention periods, remain unaffected.

Communication via WhatsApp

We use the instant messaging service WhatsApp, among other services, to communicate with customers and other third parties. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Communication uses end-to-end encryption (peer-to-peer), preventing WhatsApp or other third parties from accessing the content of communications. However, WhatsApp can access metadata generated during communication, such as sender, recipient and time. Please also note that WhatsApp states that it shares its users’ personal data with its US-based parent company Meta. Further details on processing are available in WhatsApp’s privacy policy: https://www.whatsapp.com/legal/#privacy-policy.

WhatsApp is used on the basis of our legitimate interest in communicating as quickly and effectively as possible with customers, prospective customers and other business and contractual partners (Article 6(1)(f) GDPR). Where consent has been requested, data is processed exclusively on the basis of consent, which may be withdrawn at any time with effect for the future.

The content of communications exchanged between you and us on WhatsApp remains with us until you request its erasure, withdraw your consent to storage, or the purpose of storage no longer applies, for example after your enquiry has been fully processed. Mandatory statutory provisions, particularly retention periods, remain unaffected.

The company is certified under the EU–US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the United States intended to ensure compliance with European data protection standards when data is processed in the United States. Every DPF-certified company undertakes to comply with these standards. Further information is available from the provider at: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt00000011sfnAAA&status=Active

We use the WhatsApp Business version of WhatsApp.

Transfers of data to the United States are based on the European Commission’s Standard Contractual Clauses. Details are available here: https://www.whatsapp.com/legal/business-data-transfer-addendum.

We have concluded a data processing agreement with the provider mentioned above.

Use of chatbots

We use chatbots to communicate with you. Chatbots can respond to your questions and other inputs without human assistance. To provide suitable answers, they analyse other data in addition to your inputs, such as names, email addresses and other contact details, customer numbers and other identifiers, orders and chat histories. The chatbot may also collect your IP address, log files, location information and other metadata. This data is stored on the chatbot provider’s servers.

User profiles may be created from the data collected. The data may also be used to display interest-based advertising if the other legal requirements, particularly consent, are met. Chatbots may be connected to analytics and advertising tools for this purpose.

The data collected may also be used to improve our chatbots and the way they respond (machine learning).

Data you enter during communication remains with us or the chatbot operator until you request its erasure, withdraw your consent to storage, or the purpose of storage no longer applies, for example after your enquiry has been fully processed. Mandatory statutory provisions, particularly retention periods, remain unaffected.

The legal basis for using chatbots is Article 6(1)(b) GDPR where the chatbot is used to initiate or perform a contract. Where consent has been requested, processing takes place exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) TTDSG, insofar as consent covers the storage of cookies or access to information on the user’s device, such as device fingerprinting, within the meaning of the TTDSG. Consent may be withdrawn at any time. In all other cases, use is based on our legitimate interest in communicating with customers as effectively as possible (Article 6(1)(f) GDPR).

Calendly

You can book appointments with us on our website. We use the Calendly tool for appointment bookings. The provider is Calendly LLC, 271 17th St NW, 10th Floor, Atlanta, Georgia 30363, USA (hereinafter “Calendly”).

To book an appointment, you enter the requested data and your preferred appointment time in the form provided. The data entered is used to plan, conduct and, where applicable, follow up on the appointment. Appointment data is stored for us on Calendly’s servers. Its privacy policy is available here: https://calendly.com/privacy.

Data you enter remains with us until you request its erasure, withdraw your consent to storage, or the purpose of storage no longer applies. Mandatory statutory provisions, particularly retention periods, remain unaffected.

The legal basis for processing is Article 6(1)(f) GDPR. The website operator has a legitimate interest in making appointment booking as straightforward as possible for prospective customers and customers. Where consent has been requested, processing takes place exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) TTDSG, insofar as consent covers the storage of cookies or access to information on the user’s device, such as device fingerprinting, within the meaning of the TTDSG. Consent may be withdrawn at any time.

Transfers of data to the United States are based on the European Commission’s Standard Contractual Clauses. Details are available here: https://calendly.com/pages/dpa.

Processing on our behalf

Registration on this website

You can register on this website to use additional functions. We use the data you enter solely to enable you to use the particular offer or service for which you registered. All mandatory information requested during registration must be provided in full. Otherwise, we will reject the registration.

For important changes, such as changes to the scope of the service or technically necessary changes, we use the email address supplied during registration to notify you.

Data entered during registration is processed to perform the user relationship established through registration and, where applicable, to initiate further contracts (Article 6(1)(b) GDPR).

We store the data collected during registration for as long as you remain registered on this website and erase it afterwards. Statutory retention periods remain unaffected.

5. Social media

Instagram

This website incorporates functions of the Instagram service. These functions are provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

When the social media element is active, a direct connection is established between your device and Instagram’s server. Instagram thereby receives information about your visit to this website.

If you are logged into your Instagram account, clicking the Instagram button allows you to link content from this website to your Instagram profile. Instagram can then associate your visit to this website with your user account. Please note that, as the website provider, we have no knowledge of the content of the data transmitted or how Instagram uses it.

Where consent has been obtained, the service mentioned above is used on the basis of Article 6(1)(a) GDPR and Section 25 TTDSG. Consent may be withdrawn at any time. Where no consent has been obtained, the service is used on the basis of our legitimate interest in achieving the broadest possible visibility on social media.

Insofar as the tool described here collects personal data on our website and transmits it to Facebook or Instagram, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this processing (Article 26 GDPR). Joint responsibility is limited exclusively to collecting the data and transmitting it to Facebook or Instagram. Subsequent processing by Facebook or Instagram is not part of the joint responsibility. Our respective obligations are set out in a joint processing agreement available at: https://www.facebook.com/legal/controller_addendum. Under this agreement, we are responsible for providing data protection information when using the Facebook or Instagram tool and for implementing it on our website in a manner compliant with data protection requirements. Facebook is responsible for the data security of Facebook and Instagram products. You can exercise data subject rights, such as access requests, concerning data processed by Facebook or Instagram directly with Facebook. If you exercise these rights with us, we are obliged to forward them to Facebook.

Transfers of data to the United States are based on the European Commission’s Standard Contractual Clauses. Details are available here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://privacycenter.instagram.com/policy/ and https://de-de.facebook.com/help/566994660333381.

Further information is available in Instagram’s privacy policy: https://privacycenter.instagram.com/policy/.

6. Analytics tools and advertising

Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that allows us to integrate tracking or statistical tools and other technologies into our website. Google Tag Manager itself does not create user profiles, store cookies or perform its own analyses. It serves only to manage and deploy the tools integrated through it. However, Google Tag Manager collects your IP address, which may also be transferred to Google’s parent company in the United States.

Google Tag Manager is used on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in integrating and managing various tools on its website quickly and easily. Where consent has been requested, processing takes place exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) TTDSG, insofar as consent covers the storage of cookies or access to information on the user’s device, such as device fingerprinting, within the meaning of the TTDSG. Consent may be withdrawn at any time.

Google Analytics

This website uses functions of the web analytics service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse visitor behaviour. The operator receives various usage data, such as page views, time spent on the site, operating systems used and the user’s origin. This data is assigned to the user’s device. It is not assigned to a user ID.

Google Analytics also allows us to record, among other things, your mouse movements, scrolling and clicks. It also uses various modelling approaches to supplement the data collected and machine learning technologies to analyse it.

Google Analytics uses technologies that allow users to be recognised for the purpose of analysing user behaviour, such as cookies or device fingerprinting. Information collected by Google about the use of this website is generally transferred to a Google server in the United States and stored there.

This service is used on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TTDSG. Consent may be withdrawn at any time.

Transfers of data to the United States are based on the European Commission’s Standard Contractual Clauses. Details are available here: https://privacy.google.com/businesses/controllerterms/mccs/.

Browser plugin

You can prevent Google from collecting and processing your data by downloading and installing the browser plugin available at: https://tools.google.com/dlpage/gaoptout?hl=de.

For more information about how Google Analytics handles user data, please refer to Google’s privacy information: https://support.google.com/analytics/answer/6004245?hl=de.

Google signals

We use Google signals. When you visit our website, Google Analytics collects, among other things, your location, search history, YouTube history and demographic data (visitor data). Google signals may use this data for personalised advertising. If you have a Google account, Google signals links the visitor data to your Google account and uses it for personalised advertising messages. The data is also used to produce anonymised statistics about our users’ behaviour.

Processing on our behalf

We have concluded a data processing agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

Google Analytics ecommerce measurement

This website uses the ecommerce measurement function of Google Analytics. This enables the website operator to analyse visitors’ purchasing behaviour in order to improve its online marketing campaigns. Information collected includes orders placed, average order values, shipping costs and the time between viewing and purchasing a product. Google may combine this data under a transaction ID assigned to the user or their device.

Hotjar

This website uses Hotjar. The provider is Hotjar Ltd., Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe (website: https://www.hotjar.com).

Hotjar is a tool for analysing your behaviour on this website. It allows us to record, among other things, your mouse movements, scrolling and clicks. Hotjar can also determine how long your mouse pointer remains at a particular position. It uses this information to create heatmaps showing which areas of the website visitors prefer to view.

We can also determine how long you stayed on a page and when you left it. We can additionally identify the point at which you stopped entering information in a contact form (conversion funnels).

Hotjar can also be used to obtain direct feedback from website visitors. This function helps improve the website operator’s online services.

Hotjar uses technologies that enable users to be recognised for the purpose of analysing user behaviour, such as cookies or device fingerprinting.

Where consent has been obtained, the service mentioned above is used exclusively on the basis of Article 6(1)(a) GDPR and Section 25 TTDSG. Consent may be withdrawn at any time. Where no consent has been obtained, the service is used on the basis of Article 6(1)(f) GDPR; the website operator has a legitimate interest in analysing user behaviour to optimise both its website and its advertising.

Disabling Hotjar

To disable data collection by Hotjar, click the following link and follow the instructions: https://www.hotjar.com/policies/do-not-track/

Please note that Hotjar must be disabled separately for each browser or device.

For further information about Hotjar and the data it collects, please refer to Hotjar’s privacy policy at: https://www.hotjar.com/privacy

Processing on our behalf

Google Ads

The website operator uses Google Ads, an online advertising program provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads enables us to display advertisements in the Google search engine or on third-party websites when users enter certain search terms in Google (keyword targeting). Targeted ads can also be displayed based on user data held by Google, such as location data and interests (audience targeting). As the website operator, we can analyse this data quantitatively, for example by examining which search terms triggered our ads and how many ads led to clicks.

This service is used on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TTDSG. Consent may be withdrawn at any time.

Transfers of data to the United States are based on the European Commission’s Standard Contractual Clauses. Details are available here: https://policies.google.com/privacy/frameworks and https://privacy.google.com/businesses/controllerterms/mccs/.

Google Ads Remarketing

This website uses Google Ads Remarketing functions. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads Remarketing allows us to assign people who interact with our online services to specific audiences so that we can subsequently show them interest-based advertising within Google’s advertising network (remarketing or retargeting).

Advertising audiences created with Google Ads Remarketing can also be linked to Google’s cross-device functions. This allows personalised, interest-based advertising messages tailored to your previous usage and browsing behaviour on one device, such as a mobile phone, to be displayed on another of your devices, such as a tablet or computer.

If you have a Google account, you can opt out of personalised advertising at: https://www.google.com/settings/ads/onweb/.

This service is used on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TTDSG. Consent may be withdrawn at any time.

Further information and privacy provisions are available in Google’s privacy information at: https://policies.google.com/technologies/ads?hl=de.

Creating audiences with Customer Match

We use Google Ads Remarketing Customer Match, among other methods, to create audiences. We transmit certain customer data from our customer lists, such as email addresses, to Google. If the customers concerned are Google users and are logged into their Google accounts, they are shown suitable advertising messages within the Google network, for example on YouTube, Gmail or the search engine.

Google conversion tracking

This website uses Google conversion tracking. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google conversion tracking allows Google and us to identify whether users have performed certain actions. For example, we can analyse how often buttons on our website are clicked and which products are viewed or purchased particularly often. This information is used to compile conversion statistics. We learn the total number of users who clicked our ads and what actions they performed. We receive no information that would allow us to identify users personally. Google itself uses cookies or comparable recognition technologies for identification.

This service is used on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TTDSG. Consent may be withdrawn at any time.

Further information about Google conversion tracking is available in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

Meta Pixel (formerly Facebook Pixel)

This website uses Facebook/Meta’s visitor action pixel to measure conversions. The service provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. According to Facebook, the data collected is also transferred to the United States and other third countries.

This makes it possible to track visitors’ behaviour after they have been redirected to the provider’s website by clicking a Facebook advertisement. The effectiveness of Facebook ads can therefore be evaluated for statistical and market research purposes, and future advertising measures can be optimised.

The data collected is anonymous to us as the website operator, and we cannot draw conclusions about users’ identities. However, Facebook stores and processes the data, enabling a connection to the relevant user profile, and may use it for its own advertising purposes in accordance with its data policy (https://de-de.facebook.com/about/privacy/). This enables Facebook to display ads both on and outside Facebook. We, as the website operator, have no influence over this use of the data.

This service is used on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TTDSG. Consent may be withdrawn at any time.

We use the advanced matching function within Meta Pixel.

Advanced matching allows us to transmit to Meta (Facebook) various types of data about customers and prospective customers collected through our website, such as place of residence, state or region, postcode, hashed email addresses, names, gender, date of birth or telephone number. Enabling this function lets us tailor Facebook advertising campaigns more precisely to people interested in our offers. Advanced matching also improves attribution of website conversions and expands Custom Audiences.

Insofar as the tool described here collects personal data on our website and transmits it to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this processing (Article 26 GDPR). Joint responsibility is limited exclusively to collecting the data and transmitting it to Facebook. Subsequent processing by Facebook is not part of the joint responsibility. Our respective obligations are set out in a joint processing agreement available at: https://www.facebook.com/legal/controller_addendum. Under this agreement, we are responsible for providing data protection information when using the Facebook tool and for implementing it on our website in a manner compliant with data protection requirements. Facebook is responsible for the data security of its products. You can exercise data subject rights, such as access requests, concerning data processed by Facebook directly with Facebook. If you exercise these rights with us, we are obliged to forward them to Facebook.

Transfers of data to the United States are based on the European Commission’s Standard Contractual Clauses. Details are available here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

Further information about protecting your privacy is available in Facebook’s privacy information: https://de-de.facebook.com/about/privacy/.

You can also disable the Custom Audiences remarketing function in the ad settings at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. You must be logged into Facebook to do this.

If you do not have a Facebook account, you can disable Facebook’s interest-based advertising on the European Interactive Digital Advertising Alliance website: http://www.youronlinechoices.com/de/praferenzmanagement/.

TikTok Pixel

We have integrated TikTok Pixel into this website. The provider is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (hereinafter “TikTok”).

TikTok Pixel allows us to show interest-based advertising on TikTok (TikTok Ads) to website visitors who have viewed our offers. It also allows us to determine how effective our TikTok advertising is. The effectiveness of TikTok ads can therefore be evaluated for statistical and market research purposes and optimised for future advertising. Various usage data is processed, such as IP address, page views, time spent on the site, operating systems used, the user’s origin, information about the ad clicked on TikTok or an event that was triggered (timestamp). This data is combined under a user ID and assigned to the website visitor’s device.

This service is used on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TTDSG. Consent may be withdrawn at any time.

Transfers of data to third countries are based on the European Commission’s Standard Contractual Clauses. Details are available here: https://www.tiktok.com/legal/page/eea/privacy-policy/de-DE and https://ads.tiktok.com/i18n/official/policy/controller-to-controller.

Processing on our behalf

7. Newsletter

Newsletter data

If you wish to receive the newsletter offered on the website, we need your email address and information allowing us to verify that you own that email address and consent to receiving the newsletter. No other data is collected, or it is collected only voluntarily. We use the newsletter service providers described below to manage newsletters.

Rapidmail

This website uses Rapidmail to send newsletters. The provider is rapidmail GmbH, Augustinerplatz 2, 79098 Freiburg im Breisgau, Germany.

Rapidmail is a service that can be used, among other things, to organise and analyse newsletter distribution. Data you enter to subscribe to the newsletter is stored on Rapidmail’s servers in Germany.

Data analysis by Rapidmail

For analysis purposes, emails sent using Rapidmail contain a tracking pixel that connects to Rapidmail’s servers when the email is opened. This makes it possible to determine whether a newsletter message has been opened.

Rapidmail also allows us to determine whether and which links in a newsletter message are clicked. All links in the email are tracking links that enable clicks to be counted. If you do not want Rapidmail to analyse your activity, you must unsubscribe from the newsletter. We provide an unsubscribe link in every newsletter message.

Further information about Rapidmail’s analytics functions is available at: https://de.rapidmail.wiki/kategorien/statistiken/.

Legal basis

Data is processed on the basis of your consent (Article 6(1)(a) GDPR). You can withdraw this consent at any time. Withdrawal does not affect the lawfulness of processing already carried out.

Retention period

Data you provide to subscribe to the newsletter is stored by us or the newsletter service provider until you unsubscribe and is removed from the mailing list after you unsubscribe. Data stored by us for other purposes is unaffected.

After you unsubscribe from the mailing list, your email address may be stored by us or the newsletter service provider in a suppression list if necessary to prevent future mailings. Data in this list is used only for that purpose and is not combined with other data. This serves both your interest and our interest in complying with legal requirements when sending newsletters (legitimate interest under Article 6(1)(f) GDPR). Storage in the suppression list is not time-limited. You may object to this storage if your interests override our legitimate interest.

Further details are available in Rapidmail’s data security information at: https://www.rapidmail.de/datensicherheit.

Processing on our behalf

8. Plugins and tools

YouTube with enhanced privacy

This website embeds videos from YouTube. The website operator is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

We use YouTube in privacy-enhanced mode. According to YouTube, this mode means that YouTube does not store information about visitors to this website until they watch a video. However, privacy-enhanced mode does not necessarily prevent data from being disclosed to YouTube partners. YouTube establishes a connection to the Google Marketing Network regardless of whether you watch a video.

As soon as you start a YouTube video on this website, a connection is established to YouTube’s servers. The YouTube server is informed which of our pages you visited. If you are logged into your YouTube account, you allow YouTube to associate your browsing behaviour directly with your personal profile. You can prevent this by logging out of your YouTube account.

After a video starts, YouTube may also store various cookies on your device or use comparable recognition technologies, such as device fingerprinting. This allows YouTube to obtain information about visitors to this website. This information is used, among other things, to compile video statistics, improve usability and prevent attempted fraud.

Starting a YouTube video may trigger further processing operations over which we have no influence.

YouTube is used in the interest of presenting our online services attractively. This constitutes a legitimate interest under Article 6(1)(f) GDPR. Where consent has been requested, processing takes place exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) TTDSG, insofar as consent covers the storage of cookies or access to information on the user’s device, such as device fingerprinting, within the meaning of the TTDSG. Consent may be withdrawn at any time.

Further information about data protection at YouTube is available in its privacy policy at: https://policies.google.com/privacy?hl=de.

Google Fonts (local hosting)

This website uses Google Fonts, provided by Google, to display fonts consistently. Google Fonts are installed locally. No connection to Google’s servers is established for this purpose.

Further information about Google Fonts is available at https://developers.google.com/fonts/faq and in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

Font Awesome (local hosting)

This website uses Font Awesome to display fonts consistently. Font Awesome is installed locally. No connection to the servers of Fonticons, Inc. is established for this purpose.

Further information about Font Awesome is available in its privacy policy at: https://fontawesome.com/privacy.

Google Maps

This website uses the Google Maps mapping service. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Your IP address must be stored to use Google Maps functions. This information is generally transferred to a Google server in the United States and stored there. The website provider has no influence over this transfer. When Google Maps is enabled, Google may use Google Fonts to display fonts consistently. When you access Google Maps, your browser loads the required web fonts into its cache to display text and fonts correctly.

Google Maps is used in the interest of presenting our online services attractively and making locations indicated on our website easy to find. This constitutes a legitimate interest under Article 6(1)(f) GDPR. Where consent has been requested, processing takes place exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) TTDSG, insofar as consent covers the storage of cookies or access to information on the user’s device, such as device fingerprinting, within the meaning of the TTDSG. Consent may be withdrawn at any time.

Transfers of data to the United States are based on the European Commission’s Standard Contractual Clauses. Details are available here: https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

Further information about the handling of user data is available in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

Google reCAPTCHA

We use Google reCAPTCHA (hereinafter “reCAPTCHA”) on this website. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

The purpose of reCAPTCHA is to check whether data entered on this website, for example in a contact form, is entered by a person or an automated program. To do this, reCAPTCHA analyses visitor behaviour using various characteristics. This analysis begins automatically as soon as a visitor enters the website. reCAPTCHA evaluates various information, such as IP address, time spent on the website and mouse movements. The data collected during the analysis is transmitted to Google.

reCAPTCHA analyses run entirely in the background. Visitors are not informed that an analysis is taking place.

Data is stored and analysed on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in protecting its online services against abusive automated data extraction and spam. Where consent has been requested, processing takes place exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) TTDSG, insofar as consent covers the storage of cookies or access to information on the user’s device, such as device fingerprinting, within the meaning of the TTDSG. Consent may be withdrawn at any time.

Further information about Google reCAPTCHA is available in Google’s privacy policy and terms of service at: https://policies.google.com/privacy?hl=de and https://policies.google.com/terms?hl=de.

9. Ecommerce and payment providers

Processing customer and contract data

We collect, process and use personal customer and contract data to establish, define the content of and amend our contractual relationships. We collect, process and use personal data concerning the use of this website (usage data) only insofar as necessary to enable users to use the service or to bill for it. The legal basis is Article 6(1)(b) GDPR.

The customer data collected is erased after the order is completed or the business relationship ends and any applicable statutory retention periods have expired. Statutory retention periods remain unaffected.

Data transfers when concluding contracts for online shops, retailers and shipping goods

When you order goods from us, we disclose your personal data to the carrier entrusted with delivery and the payment service provider entrusted with processing payment. Only data needed by each provider to perform its task is disclosed. The legal basis is Article 6(1)(b) GDPR, which permits processing for the performance of a contract or steps prior to entering into one. If you have given consent under Article 6(1)(a) GDPR, we will provide your email address to the carrier so that it can inform you by email about the shipping status of your order. You may withdraw that consent at any time.

Credit checks

For purchases on account or other payment methods where we provide goods or services before receiving payment, we may carry out a credit check (scoring). We transmit the data you enter, such as your name, address, age or bank details, to a credit reference agency. This data is used to determine the probability of default. If the risk of default is too high, we may refuse the payment method concerned.

Credit checks are carried out for the performance of a contract (Article 6(1)(b) GDPR) and to prevent payment defaults (legitimate interest under Article 6(1)(f) GDPR). Where consent has been obtained, the credit check is based on that consent (Article 6(1) GDPR); consent may be withdrawn at any time.

Payment services

We integrate payment services from third-party companies into our website. When you make a purchase from us, the payment service provider processes your payment data, such as name, payment amount, bank account details and credit card number, to process the payment. The respective providers’ contractual and privacy provisions apply to these transactions. Payment service providers are used on the basis of Article 6(1)(b) GDPR (contract performance) and in the interest of a payment process that is as smooth, convenient and secure as possible (Article 6(1)(f) GDPR). Where consent is requested for particular actions, Article 6(1)(a) GDPR is the legal basis for processing; consent may be withdrawn at any time with effect for the future.

We use the following payment services or providers on this website:

PayPal

The provider of this payment service is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”).

Transfers of data to the United States are based on the European Commission’s Standard Contractual Clauses. Details are available here: https://www.paypal.com/de/webapps/mpp/ua/pocpsa-full.

For details, please refer to PayPal’s privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Apple Pay

The payment service provider is Apple Inc., Infinite Loop, Cupertino, CA 95014, USA. Apple’s privacy policy is available at: https://www.apple.com/legal/privacy/de-ww/.

Google Pay

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google’s privacy policy is available here: https://policies.google.com/privacy.

Klarna

The provider is Klarna AB, Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter “Klarna”). Klarna offers various payment options, such as payment by instalments. If you choose to pay with Klarna (Klarna Checkout), Klarna will collect various personal data from you. Klarna uses cookies to optimise the use of Klarna Checkout. Details about Klarna cookies are available at: https://cdn.klarna.com/1.0/shared/content/policy/cookie/de_de/checkout.pdf.

Further details are available in Klarna’s privacy policy at: https://www.klarna.com/de/datenschutz/.

Paydirekt

The provider of this payment service is Paydirekt GmbH, Hamburger Allee 26–28, 60486 Frankfurt am Main, Germany (hereinafter “Paydirekt”). When you pay using Paydirekt, it collects various transaction data and forwards it to the bank with which you registered for Paydirekt. In addition to data required for payment, Paydirekt may collect other data during transaction processing, such as the delivery address or individual items in the cart. Paydirekt then authenticates the transaction using the authentication procedure registered with the bank. The payment amount is subsequently transferred from your account to ours. Neither we nor third parties have access to your account data. Details about paying with Paydirekt are available in its terms and conditions and privacy provisions at: https://www.paydirekt.de/agb/index.html.

Sofort bank transfer

The provider of this payment service is Sofort GmbH, Theresienhöhe 12, 80339 Munich, Germany (hereinafter “Sofort GmbH”). With the Sofort transfer procedure, we receive payment confirmation from Sofort GmbH in real time and can begin fulfilling our obligations immediately. If you choose this payment method, you transmit your PIN and a valid transaction authentication number (TAN) to Sofort GmbH, enabling it to log into your online banking account. After logging in, Sofort GmbH automatically checks your balance and uses the TAN you supplied to transfer the payment to us. It then immediately sends us a transaction confirmation. After login, your transactions, overdraft limit, the existence of other accounts and their balances are also checked automatically. In addition to your PIN and TAN, payment details you enter and personal data are transmitted to Sofort GmbH. This personal data includes your first and last names, address, telephone number(s), email address, IP address and any other data required to process the payment. Transmitting this data is necessary to establish your identity beyond doubt and prevent attempted fraud. Details about paying with Sofort are available at: https://www.sofort.de/datenschutz.html and https://www.klarna.com/sofort/.

Mollie

The provider of this payment service is Mollie B.V., Keizersgracht 126, 1015CW Amsterdam, Netherlands (hereinafter “Mollie”). Mollie allows us to integrate various payment methods into our website. For details, please refer to Mollie’s privacy policy: https://www.mollie.com/de/privacy.

giropay

The provider of this payment service is paydirekt GmbH, Stephanstraße 14–16, 60313 Frankfurt am Main, Germany (hereinafter “giropay”).

For details, please refer to giropay’s privacy policy: https://www.paydirekt.de/agb/index.html.

Shopify Payment

The provider of this payment service in the EU is Shopify International Limited, 2nd Floor Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland (hereinafter “Shopify Payment”).

For details, please refer to Shopify Payment’s privacy policy: https://www.shopify.de/legal/datenschutz.

Mastercard

The provider of this payment service is Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium (hereinafter “Mastercard”).

Mastercard may transfer data to its parent company in the United States. Transfers to the United States are based on Mastercard’s Binding Corporate Rules. Details are available here: https://www.mastercard.de/de-de/datenschutz.html and https://www.mastercard.us/content/dam/mccom/global/documents/mastercard-bcrs.pdf.

VISA

The provider of this payment service is Visa Europe Services Inc., London branch, 1 Sheldon Square, London W2 6TT, United Kingdom (hereinafter “VISA”).

The United Kingdom is considered a third country with adequate data protection. This means it provides a level of data protection equivalent to that in the European Union.

VISA may transfer data to its parent company in the United States. Transfers to the United States are based on the European Commission’s Standard Contractual Clauses. Details are available here: https://www.visa.de/nutzungsbedingungen/visa-globale-datenschutzmitteilung/mitteilung-zu-zustandigkeitsfragen-fur-den-ewr.html.

Further information is available in VISA’s privacy policy: https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html.

10. Our own services

Handling job applicant data

We offer you the opportunity to apply for a job with us, for example by email, post or an online application form. Below, we explain the scope, purpose and use of personal data collected during the application process. We assure you that your data is collected, processed and used in accordance with applicable data protection law and all other legal requirements and is treated as strictly confidential.

Scope and purpose of data collection

If you submit an application, we process the associated personal data, such as contact and communication details, application documents and notes from interviews, insofar as necessary to decide whether to establish an employment relationship. The legal bases are Section 26 of the German Federal Data Protection Act (BDSG) (initiating an employment relationship), Article 6(1)(b) GDPR (general steps prior to a contract) and, where you have consented, Article 6(1)(a) GDPR. Consent may be withdrawn at any time. Within our company, your personal data is disclosed only to people involved in processing your application.

If your application is successful, the data you submitted is stored in our data processing systems to perform the employment relationship on the basis of Section 26 BDSG and Article 6(1)(b) GDPR.

Data retention period

If we cannot offer you a position, you decline an offer, or you withdraw your application, we reserve the right to retain the data you supplied for up to six months after the application process ends (rejection or withdrawal), on the basis of our legitimate interests (Article 6(1)(f) GDPR). The data is then erased and physical application documents destroyed. Retention serves particularly as evidence in the event of a legal dispute. If it is apparent that the data will be needed after the six-month period, for example because of a threatened or pending dispute, it is erased only once the purpose of further retention no longer applies.

Longer retention may also occur if you have given consent (Article 6(1)(a) GDPR) or statutory retention obligations prevent erasure.

Inclusion in the candidate pool

If we do not offer you a position, we may be able to include you in our candidate pool. If you are included, all application documents and information are added to the pool so that we can contact you about suitable vacancies.

Inclusion in the candidate pool is based exclusively on your express consent (Article 6(1)(a) GDPR). Giving consent is voluntary and is unrelated to the current application process. You may withdraw your consent at any time. In that case, data is irreversibly erased from the candidate pool unless there are statutory grounds for retention.

Data in the candidate pool is irreversibly erased no later than two years after consent was given.