Privacy policy
1. Controller
The controller responsible for the processing of your personal data on this website is:
Hairoyal - Diana Berthold
Schlesischer Platz 2
01097 Dresden
Germany
Telephone: +49 351 8106212
Email: info@hairoyal.de
If you have any questions about data protection or wish to exercise your rights, please contact us directly using the details above.
2. General information on data processing
We process personal data only where this is permitted by law or where you have given us your consent. The legal bases are in particular:
- Article 6(1)(b) GDPR, processing necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract (for example order processing, customer account, delivery).
- Article 6(1)(a) GDPR, your consent, for example for analytics and marketing cookies or for receiving our newsletter. You may withdraw your consent at any time with effect for the future.
- Article 6(1)(f) GDPR, our legitimate interests, for example in the secure and stable operation of this website and in the statistical evaluation of its use, provided that your interests do not override ours.
- Article 6(1)(c) GDPR, compliance with legal obligations, in particular retention obligations under commercial and tax law.
3. Disclosure of Data to Third Parties and Third-Party Providers
(1) If, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transfer it to them, or otherwise grant them access to the data, this is done only on the basis of legal permission. This applies, for example, to transfers of data pursuant to Art. 6 (1) sentence 1 lit. b) GDPR to third parties if this is necessary for contract fulfillment (e.g., for shipping goods), if you have consented, if a legal obligation provides for this, or on the basis of our legitimate interests (e.g., use of service providers, web hosts, payment service providers, etc.). If you use third-party payment services, you must log in to the selected payment service provider during the order process using your access data or register for the first time. The terms and conditions and privacy notices of the respective payment service provider apply, which can be accessed on their websites or transaction applications.
(2) If we process data in a third country (i.e., outside the European Union or the European Economic Area) or this occurs in the context of using third-party services or disclosure/transfer of data to third parties, this is only done if the special requirements of Art. 44 et seq. GDPR are met. Some third countries are certified by the European Commission via so-called adequacy decisions as having a level of data protection comparable to the EEA standard (a list of these countries and copies of the adequacy decisions can be found here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en). For transfers of personal data to the USA, the European Commission has adopted the so-called EU-US Data Privacy Framework. In other third countries to which personal data may be transferred, there may, however, be no consistently high level of data protection due to the absence of legal provisions. In such cases, data protection may be ensured by other measures, such as binding corporate rules, standard contractual clauses of the European Commission for the protection of personal data pursuant to Art. 46 (1), (2) lit. c GDPR, certifications, or recognized codes of conduct. We inform you of the respective details of such transfers at the relevant points below.
(3) If we commission third parties with the processing of data on the basis of a so-called “data processing agreement,” this is done on the basis of Art. 28 GDPR.
4. Shopify as our shop platform and hosting provider
This online shop is operated on the platform of
Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.
Shopify provides the technical infrastructure of our shop (hosting, presentation of our products, checkout and order management) and processes personal data in this respect on our behalf as a processor within the meaning of Article 28 GDPR. For its own purposes, in particular to analyse and improve the platform, for fraud prevention and for its own advertising, Shopify additionally acts as a controller in its own right; Shopify's own privacy notice applies to that processing. Where Shopify additionally acts as a payment service provider (Shopify Payments, Shop Pay), it processes the payment data as an independent controller; please see section 9. The basis for the processing on our behalf is Shopify's Data Processing Addendum (https://www.shopify.com/legal/dpa), which forms part of our agreement with Shopify.
When you visit our shop, Shopify processes in particular your IP address, technical information about your device and browser, the pages you access, and, when you place an order, the data required to process your order.
Transfer to third countries: Shopify uses infrastructure and affiliated companies outside the European Union, in particular Shopify Inc. in Canada and companies in the United States. For Canada, the European Commission has adopted an adequacy decision confirming an adequate level of data protection for companies subject to the Canadian data protection act PIPEDA. Transfers to the United States are based on the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914) as agreed in Shopify's Data Processing Addendum. Please note that despite these safeguards, US authorities may be granted access to personal data, and that enforcing your rights in the United States may be more difficult than within the European Union. Those clauses cover the processing carried out on our behalf. For the processing Shopify carries out as a controller in its own right, any transfer to third countries is governed by Shopify's own privacy notice; we are not involved in it.
Further information on data processing by Shopify: https://www.shopify.com/legal/privacy
We delete the data arising at Shopify in the course of running the shop as soon as it is no longer required to operate the shop and to process your orders. Order and invoice data is subject to the commercial and tax retention periods set out in section 19; Shopify deletes the platform's technical log data in accordance with the periods stated in the privacy notice linked above.
Legal basis: Article 6(1)(b) and (f) GDPR (provision and secure operation of our online shop). Where Shopify processes the data for its own purposes, Shopify is solely responsible for that; the legal basis and any right to object follow from Shopify's own privacy notice.
5. Server log files
Each time our shop is accessed, technical access data is automatically recorded (so-called server log files): IP address, date and time of access, the page accessed, the referring page, browser type and version, operating system and the amount of data transferred. This data is processed to enable the delivery of the website, to ensure system security and stability, and to detect and trace technical faults and attacks. It is not merged with other data sources.
The log files are generated on Shopify's infrastructure; we have no access to them. The criteria set out in section 4 apply to the storage period.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in the secure and stable operation of our website).
6. Cookies and consent management
Our shop uses cookies and comparable technologies. Cookies are small text files stored on your device.
Technically necessary cookies are required for the operation of the shop, for example to remember the contents of your shopping cart, to keep you logged in, or to store your cookie preferences. These are used without your consent on the basis of section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Article 6(1)(b) and (f) GDPR.
Cookies that are not technically necessary, in particular for statistics and marketing, are only used with your prior consent in accordance with section 25(1) TDDDG and Article 6(1)(a) GDPR.
To obtain and manage your consent, we use the consent management tool Pandectes, provided by Pandectes P.C., Estonia. You can view the full list of cookies used, with name, provider, purpose and storage period, at any time in the consent settings. The tool stores your consent decision on your device and documents it so that we can demonstrate compliance with our legal obligations. Pandectes processes this data on our behalf as a processor within the meaning of Article 28 GDPR. We retain the record of your consent for the duration of the consent and for three years thereafter in order to provide evidence. You can call up the consent settings at any time via the link in the footer of our website and change or withdraw your decision with effect for the future.
Legal basis: Article 6(1)(c) and (f) GDPR (documentation of consent), section 25(2) no. 2 TDDDG for the storage of and access to information on your device, because the consent record is strictly necessary in order to provide the shop.
7. Processing of orders
If you place an order, we process the data you provide (in particular your name, billing and delivery address, email address, telephone number where given, order details and payment information) in order to perform the contract. This data is passed on to the service providers involved in fulfilling your order, in particular the payment service provider and the shipping company, to the extent necessary.
We store order data for as long as required by commercial and tax law retention obligations: eight years for invoices and other accounting vouchers, six years for business correspondence and ten years for commercial books and annual accounts (section 257 of the German Commercial Code (HGB), section 147 of the German Fiscal Code (AO)). Each period starts at the end of the calendar year in which the accounting voucher was created, the correspondence was received or sent, or the annual accounts were drawn up.
Legal basis: Article 6(1)(b) GDPR (performance of the contract) and Article 6(1)(c) GDPR (retention obligations).
8. Customer account
You can create a customer account in our shop. Shopify uses passwordless login: you enter your email address and receive a one-time code by email. In your customer account we store the data you provide as well as your order history so that you do not have to re-enter your details for future orders.
You can delete your customer account at any time. Deletion does not affect data that we are required to retain under statutory retention obligations.
Legal basis: Article 6(1)(b) GDPR.
9. Payment service providers
Depending on the payment method you choose, we transmit the data required for payment processing to the respective payment service provider. The payment service providers process this data as independent controllers under their own privacy policies.
Shopify Payments (card payments, Shop Pay, Apple Pay, Google Pay), provided by Shopify International Limited, Ireland. Technical processing is carried out by the payment processors used by Shopify; for Germany, Shopify currently lists Stripe Payments Europe, Limited (Ireland), Adyen N.V. (Netherlands) and PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), see https://www.shopify.com/legal/processor-list. Data processed includes card details, name, address, email address and the order amount, as well as data used for fraud prevention.
Shop Pay, if you use Shop Pay, Shopify stores your payment and address details in encrypted form so that you can use them again in other shops that offer Shop Pay. This storage takes place with Shopify across shops and allows you to be recognised in other Shopify shops. Shopify processes this data as an independent controller; the legal basis follows from Shopify's own privacy notice.
Klarna, provided by Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. If you choose Klarna, the data required for payment processing is transmitted to Klarna. Klarna may carry out identity and credit checks and transmit the data required for this to credit reference agencies. Further information: https://www.klarna.com/international/privacy-policy/
Advance bank transfer and direct debit (business customers only), in these cases no payment service provider is involved; payment is made directly to our bank account. For direct debit, we process your bank details for this purpose.
Cash on delivery, in this case the shipping company collects the invoice amount upon delivery. For this purpose, we transmit the amount to be collected to the shipping company in addition to the data listed in section 10.
Transfers to third countries: Where Shopify transfers data to affiliated companies in Canada or the United States in connection with Shopify Payments and Shop Pay, the safeguards described in section 4 apply. The payment processors may transfer data to affiliated companies in the United States, Stripe for example to Stripe, LLC. Where an adequacy decision of the European Commission exists for the recipient country, the transfer takes place on that basis (Art. 45 GDPR); otherwise it relies on the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914) pursuant to Art. 46 (2) (c) GDPR. Please note that despite these safeguards US authorities may gain access to personal data and that enforcing your rights may be more difficult than within the European Union. Details of the processing by Stripe: https://stripe.com/privacy
Legal basis: Article 6(1)(b) GDPR (performance of the contract) and Article 6(1)(f) GDPR (fraud prevention).
10. Shipping
To deliver your order we pass on your delivery address and, where you have provided them for delivery notifications, your email address and telephone number to the shipping service provider commissioned by us (currently DHL, Deutsche Post DHL Group).
Legal basis: Article 6(1)(b) GDPR.
11. Online withdrawal function
We provide an online withdrawal function that allows you to withdraw from your contract directly on our website in accordance with section 356a of the German Civil Code. If you use this function, we process the details you enter (in particular your name, email address and order number) in order to receive and process your withdrawal, to send you the confirmation of receipt required by law, and to document the transaction.
This function is provided using the app "Revoq" (EU Withdrawal Button) by Jonas Busch (BuschBytes), Germany. The provider processes this data on our behalf as a processor within the meaning of Article 28 GDPR. The data is stored on servers in the European Union. The provider sends the confirmation of receipt via the service Resend of Plus Five Five, Inc., USA, with servers in Ireland; standard contractual clauses of the European Commission have been agreed with Resend. In the app, the details of your withdrawal are automatically deleted after 90 days.
Legal basis: Article 6(1)(c) GDPR (compliance with our statutory obligations) and Article 6(1)(b) GDPR.
12. Contacting us
If you contact us by email, telephone or via a contact form, we process the information you provide in order to deal with your enquiry. We delete this data once your enquiry has been dealt with in full and no retention obligations apply.
Legal basis: Article 6(1)(b) GDPR where your enquiry relates to a contract, otherwise Article 6(1)(f) GDPR (legitimate interest in responding to enquiries).
Our website also contains a button that lets you write to us via WhatsApp. It is a plain link: no data is transmitted until you click the button and WhatsApp opens on your device. If you contact us this way, we process your mobile number, the profile name stored in your WhatsApp account and the content of your message in order to answer your enquiry. The service is operated by WhatsApp Ireland Limited, Ireland, which acts as a controller in its own right; its privacy notice is available at https://www.whatsapp.com/legal/privacy-policy-eea. In doing so, WhatsApp may transfer data to WhatsApp LLC and other Meta companies in the United States; these are certified under the EU-US Data Privacy Framework, for which the European Commission has found an adequate level of data protection. We delete the chat history once your enquiry has been dealt with in full and no retention obligations apply. If your message relates to an order, we transfer the details required to process it into the order records; the periods set out in section 19 apply to those. If you would like to avoid this transfer, please use email, the telephone or our contact form.
Legal basis: Article 6(1)(b) GDPR where your enquiry relates to a contract, otherwise Article 6(1)(f) GDPR (legitimate interest in an easily reachable advice channel).
13. Newsletter
We only send newsletters containing information about our products, promotions and our company to recipients who have consented to receiving them.
Sign-up uses a double opt-in procedure: after registering you receive an email asking you to confirm your registration. This ensures that nobody can sign up using someone else's email address. We log the registration, the confirmation and the IP address used, so that we can demonstrate the sign-up process. Only your email address is required. Any further details such as your name are voluntary and are used to address you personally.
We use Mailchimp to send our newsletters, a distribution platform operated by The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA (https://mailchimp.com/, privacy notice: https://mailchimp.com/legal/). Mailchimp processes the data on our behalf as a processor under Article 28 GDPR. Data is transferred to the USA in this context. Intuit Inc., which Mailchimp belongs to, is certified under the EU-US Data Privacy Framework, for which the European Commission has confirmed an adequate level of data protection. Standard contractual clauses have additionally been agreed.
Our newsletters contain a tracking pixel, a pixel-sized file retrieved from the distribution provider's server when the message is opened. This tells us whether and when a message was opened and which links were clicked, along with technical details about your browser and system and your IP address, from which the place of access can be roughly determined. We use these statistics to tailor our newsletters to our readers' interests. It is not our intention to monitor individual recipients.
You may withdraw your consent at any time with effect for the future. Every newsletter contains an unsubscribe link at the end; an informal message to the contact details given in section 1 is equally sufficient. After you unsubscribe we retain your email address for up to three years in order to demonstrate the consent previously given; processing is limited to that purpose. You may request earlier deletion if you confirm at the same time that consent existed.
Legal basis: Article 6(1)(a) GDPR (consent) for sending the newsletter and measuring its performance; Article 6(1)(f) GDPR (legitimate interest in demonstrating consent) for logging the sign-up.
14. Training courses
If you book a training course through our shop or register in writing, we process the data required to organise the course (in particular your name, contact details and, where applicable, information about your business). This data is used solely to carry out the course and to handle the contractual relationship.
Legal basis: Article 6(1)(b) GDPR.
15. Web analytics and marketing
The following services are used only after you have given your consent via our consent banner, unless expressly stated otherwise. You may withdraw your consent at any time with effect for the future via the consent settings in the footer of our website.
15.1 Google Analytics 4
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").
We use Google Analytics to analyse how our shop is used, in order to improve it. Google Analytics uses cookies and processes in particular information about your device and browser, the pages you visit, and events such as products viewed, items added to the cart and completed purchases. IP addresses of users in the European Union are discarded by Google before storage and are not logged. Google Signals and advertising features are only activated if you have given your consent. Your consent decision is transmitted to Google via Google Consent Mode and controls the extent to which Google may process data.
Data may be transferred to Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework; the European Commission has decided that this framework provides an adequate level of data protection. In addition, standard contractual clauses have been agreed with Google.
We retain the event and user data collected in Google Analytics for 14 months; Google then deletes it automatically.
Further information: https://policies.google.com/privacy
Legal basis: Article 6(1)(a) GDPR (consent), section 25(1) TDDDG.
15.2 Google Ads
Provider: Google Ireland Limited (address as above).
We use Google Ads to advertise our products. In this context, conversion tracking and remarketing are used: cookies allow us to see whether a purchase was made after you clicked one of our ads, and to display our ads to you on other websites. For conversion tracking, we only receive aggregated statistics from Google which do not allow any conclusions to be drawn about individual persons. Your consent decision is transmitted to Google via Google Consent Mode and controls the extent to which Google may process data. Transfers to the United States take place on the basis described in section 15.1.
Legal basis: Article 6(1)(a) GDPR (consent), section 25(1) TDDDG.
15.3 Meta Pixel and Conversions API
Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.
We use the Meta Pixel to measure the effectiveness of our advertising on Facebook and Instagram and to show ads to people who have visited our shop. In addition, we use the Meta Conversions API, in which the relevant events (for example a completed purchase) are transmitted to Meta from our server. Via the Conversions API, hashed contact details (for example email address, telephone number, name and address) are also transmitted in order to be able to attribute events to your user account. Both are only activated after you have given your consent; if you do not consent, no data is transmitted through either channel.
Data may be transferred to Meta Platforms, Inc. in the United States. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework; in addition, standard contractual clauses have been agreed. We and Meta are joint controllers for the collection and transmission of this data within the meaning of Article 26 GDPR; the essential content of this arrangement is available at https://www.facebook.com/legal/controller_addendum You may assert your rights as a data subject both against us and against Meta.
Further information: https://www.facebook.com/privacy/policy
Legal basis: Article 6(1)(a) GDPR (consent), section 25(1) TDDDG.
15.4 Matomo (cookie-free)
We use the open-source web analytics software Matomo to obtain statistics about the use of our shop. We run Matomo ourselves on our own server in a data centre of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The hosting provider processes the data as a processor pursuant to Art. 28 GDPR; the data collected does not leave Germany and is not transmitted to Matomo itself.
We have configured Matomo in such a way that no cookies are stored on your device, that your IP address is truncated before it is stored, and that your device is not recognised across websites. The data is neither merged with other data sources nor passed on to third parties. Since, beyond the information transmitted in any event in order to deliver the website, no information is stored on or read from your device, we base this analysis on our legitimate interest in a needs-based and statistically sound design of our shop and not on your consent. You may object to this analysis at any time without giving reasons, informally, using the contact details given in section 1. Your objection takes effect immediately for the future. We store the usage data collected for 14 months.
Legal basis: Article 6(1)(f) GDPR (legitimate interest).
15.5 TikTok Pixel
(1) We also use our online offering for advertising measures by TikTok. By integrating the so-called “TikTok Pixel,” we can display our advertising measures to users of our online offering and the social network TikTok and measure and evaluate their success. This connection between TikTok and our online offering is technically established via the “TikTok Pixel.” The legal basis for the processing of user data is Art. 6 (1) sentence 1 lit. a) GDPR, i.e., integration only takes place with the user’s consent. In addition, § 25 (1) TDDDG applies to the storage of information on the user’s terminal equipment and to access to information already stored there.
(2) Due to the marketing tool used, the user’s browser automatically establishes a direct connection to TikTok’s server when visiting our online offering. We have no influence on the scope and further use of the data collected by TikTok through the use of this tool. According to TikTok, integration of the pixel provides TikTok with information that the user has accessed the corresponding page of our online offering or clicked on an advertisement from us.
(3) Revocation of user consent is possible at any time without affecting the lawfulness of processing carried out prior to revocation. Revocation can be carried out via the consent settings in the footer of our website.
(4) Service provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland and TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London, United Kingdom, EC1A 9HP; website: https://www.tiktok.com; privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en.
(5) When the TikTok pixel is used, users' personal data may also be processed outside the European Economic Area. According to the provider's privacy policy linked under (4), the data is stored in particular on servers in the United States, Malaysia and Singapore; group companies outside the European Economic Area are additionally granted limited remote access. Where an adequacy decision of the European Commission exists for the recipient country, the transfer takes place on that basis (Art. 45 GDPR). Otherwise the transfer relies on the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914) pursuant to Art. 46 (2) (c) GDPR; these are available via the service provider's privacy policy named under (4). Where neither an adequacy decision nor appropriate safeguards exist, the transfer takes place on the basis of your consent pursuant to Art. 49 (1) (a) GDPR; you are hereby informed that such countries do not guarantee a level of data protection equivalent to the GDPR, that access by state authorities is possible in particular and that enforcing your data subject rights may be more difficult.
15.6 Microsoft Ads
(1) We use the service Microsoft Advertising for our online offering. Microsoft Advertising is an online marketing service that supports us via the Universal Event Tracking (UET) tool in displaying advertisements via the Microsoft Bing search engine in a targeted manner and analyzing subsequent user behavior when users reach our online offering via a Microsoft Advertising advertisement. This is done for the purpose of optimizing the placement of advertisements. The legal basis for processing user data is Art. 6 (1) sentence 1 lit. a) GDPR, i.e., integration only takes place with user consent. In addition, § 25 (1) TDDDG applies to the storage of information on the user’s terminal equipment and to access to information already stored there.
(2) When using Microsoft Advertising, cookies may be used and data (IP address, time of visit, device and browser information, and information about the use of our online offering) may be collected, from which usage profiles are created under pseudonyms. If the user is registered with a Microsoft service and the “interest-based advertising” setting is not disabled in their Microsoft account, Microsoft may create reports on usage behavior (in particular cross-device user numbers). From Microsoft we ourselves only receive statistics generated on the basis of Microsoft UET. However, by integrating the UET tag into our online offering we cause the above data to be collected; this therefore only takes place with the user’s consent.
(3) Revocation of consent is possible at any time without affecting the lawfulness of processing prior to revocation. Revocation can be carried out via the consent settings in the footer of our website.
(4) Service provider: Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; website: https://about.ads.microsoft.com/en-us/h/a/microsoft-advertising; privacy policy: https://privacy.microsoft.com/en-us/privacystatement.
(5) When Microsoft Advertising is used, users' personal data may also be transferred to Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA, and thus to the United States. Where an adequacy decision of the European Commission exists for the recipient country, the transfer takes place on that basis (Art. 45 GDPR). Otherwise the transfer relies on the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914) pursuant to Art. 46 (2) (c) GDPR; these are available via the service provider's privacy policy named under (4). Where neither an adequacy decision nor appropriate safeguards exist, the transfer takes place on the basis of your consent pursuant to Art. 49 (1) (a) GDPR; you are hereby informed that such countries do not guarantee a level of data protection equivalent to the GDPR, that access by state authorities is possible in particular and that enforcing your data subject rights may be more difficult.
15.7 Trusted Shops Trustbadge and review invitations
(1) To display our Trusted Shops seal of approval and to offer Trusted Shops products to buyers after an order, the Trusted Shops Trustbadge is integrated into our online offering. The legal basis for the associated processing of user data is Art. 6 (1) sentence 1 lit. a) GDPR, i.e., integration only takes place with user consent. In addition, § 25 (1) TDDDG applies to the storage of information on the user’s terminal equipment and to access to information already stored there.
(2) The Trustbadge and the services advertised with it are an offer of Trusted Shops SE (“Trusted Shops”), with which we are jointly responsible under Art. 26 GDPR. Below we inform you about the essential contractual content pursuant to Art. 26 (2) GDPR.
(3) Within the framework of joint responsibility between us and Trusted Shops SE, please direct data protection inquiries and the assertion of your rights preferably to Trusted Shops using the contact options provided in the privacy information (https://www.trustedshops.de/impressum-datenschutz/#datenschutz). Regardless of this, you may always contact the controller of your choice. Your request will then be forwarded to the other controller if necessary.
(4) The Trustbadge is provided by a US-based CDN provider (content delivery network). An adequate level of data protection is ensured through standard contractual clauses (Implementing Decision (EU) 2021/914) and other contractual measures. Please note that despite these safeguards US authorities may gain access to personal data and that enforcing your rights may be more difficult than within the European Union. When the Trustbadge is accessed, the web server automatically stores a so-called server log file, which also contains the IP address, date and time of access, transferred data volume, and requesting provider (access data). The IP address is anonymized immediately after collection so that the stored data cannot be assigned to the user. The anonymized data is used in particular for statistical purposes and error analysis.
(5) After order completion, the Trustbadge accesses order information stored on the user’s device (order total, order number, possibly purchased product) as well as the email address, which is hashed using a cryptographic one-way function. The hash value is then transmitted together with the order information to Trusted Shops in accordance with Art. 6 (1) sentence 1 lit. a) GDPR. This serves to verify whether the user is already registered for Trusted Shops services. If this is the case, further processing takes place according to the contractual agreement between the user and Trusted Shops pursuant to Art. 6 (1) sentence 1 lit. b) GDPR. If the user is not yet registered or has not given consent for automatic recognition via the Trustbadge, they will subsequently be given the option to register manually or to conclude buyer protection within an existing contract. The Trustbadge accesses the following information stored on the user’s device after order completion: order total, order number, and email address. This is necessary in order to offer buyer protection. Data is transmitted to Trusted Shops only if the user actively chooses buyer protection by clicking the corresponding button in the Trustcard. If the user chooses to use the services, further processing is governed by the contractual agreement with Trusted Shops pursuant to Art. 6 (1) sentence 1 lit. b) GDPR, in order to complete the registration for buyer protection, to secure the order and, where applicable, to send the user review invitations by email afterwards.
(6) Service provider: Trusted Shops SE, Subbelrather Str. 15C, 50823 Cologne; website: https://www.trustedshops.de; privacy policy: https://www.trustedshops.de/impressum-datenschutz/#datenschutz.
15.8 YouTube videos
Provider: Google Ireland Limited (address as above).
Where we embed videos from YouTube in our shop, we embed them in the extended data protection mode. A video is only loaded once you have consented to the connection to YouTube. Before that you only see a preview image. By clicking the preview image or by your choice in the consent banner you consent to that connection. Clicking the preview image applies to that one video only; a general refusal in the consent banner remains unaffected. If you start a video, YouTube processes in particular your IP address, information about your device and browser and information about which video you watched. If you are signed in to Google at the time, Google may associate this information with your account. Transfers to the United States are covered by the basis described in section 15.1.
Further information: https://policies.google.com/privacy
Legal basis: Article 6(1)(a) GDPR (consent), section 25(1) TDDDG.
16. Online Presences in Social Networks
(1) We maintain online presences in the social networks Facebook, Instagram, TikTok and YouTube in order to communicate with our users and to present ourselves and our services.
(2) There is a possibility that user data may be processed outside the European Union, which may involve risks, e.g. in enforcing user rights.
(3) Through the pages within social networks, user data may be processed for analysis and advertising purposes. It is possible to create usage profiles based on user behaviour and the resulting interests, which are then used to display advertisements within and outside the social network that correspond to presumed user interests. For these purposes, cookies are generally used and stored on users' devices containing information about usage behaviour and interests. In addition, device-independent data may also be stored in usage profiles, especially if users are members of the respective social network and logged in.
(4) The operation of our online presences in social networks and the associated data processing is based on our legitimate interests (provision of interesting information outside our online offering, further communication options with users and interested parties) pursuant to Art. 6 (1) sentence 1 lit. f) GDPR.
(5) For a detailed description of the respective processing operations and the opt-out options, we refer users to the information provided by the operators of the respective social networks below.
(6) Facebook pages: Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; website: https://www.facebook.com; privacy policy: https://www.facebook.com/about/privacy; basis for third-country transfer: EU-US Data Privacy Framework. We are jointly responsible with Meta Platforms Ireland Limited for the collection (but not for the further processing) of data of visitors to our Facebook page. This includes information about the types of content users view or interact with, or the actions they take, as well as technical data. Facebook also collects and uses this data to provide analytics services, so-called “Page Insights”, to the operators of Facebook pages and therefore to us, so that they gain insights into how people interact with their pages and the content associated with them. A special agreement exists between us and Facebook (“Page Insights Information”, https://www.facebook.com/legal/terms/page_controller_addendum) which governs in particular the security measures Facebook must observe and in which Facebook has agreed to fulfil data subject rights, meaning that users may contact Facebook directly regarding their rights, for example to access or erasure. This does not restrict the rights users have against us. Further information is available in the “Page Insights Information” (https://www.facebook.com/legal/terms/information_about_page_insights_data).
(7) Instagram: Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; website: https://www.instagram.com; privacy policy: https://privacycenter.instagram.com/policy/.
(8) TikTok pages: Service provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland and TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London, United Kingdom, EC1A 9HP; website: https://www.tiktok.com; privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en.
(9) YouTube: Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; website: https://www.youtube.com/; privacy policy: https://business.safety.google/privacy/; opt-out: https://myadcenter.google.com/.
17. Provision of Personal Data
The provision of personal data for the use of our online offering is neither legally nor contractually required. You are also not obliged to provide us with personal data within the scope of this online offering. However, for the conclusion of a contract with us, it is necessary that the user provides personal data that must subsequently be processed by us. Failure to provide the personal data would result in a contract not being concluded with the user.
18. Automated Decision-Making
No automated decision-making or profiling pursuant to Art. 22 GDPR is carried out by us.
19. Retention periods
We delete personal data as soon as the purpose for which it was collected no longer applies and no statutory retention obligations prevent deletion. We retain invoices and other accounting vouchers for eight years and business correspondence relating to orders for six years; ten years apply to commercial books and annual accounts (section 257 HGB, section 147 AO). Consent records are retained for the duration of the consent and for three years thereafter in order to provide evidence. Usage data collected with Matomo is stored for 14 months.
For the remaining areas the following applies: we delete customer account data as soon as you close your account, unless a retention obligation prevents this. Registration data for training courses is kept until the applicable warranty and limitation periods have expired. For the analytics and marketing services listed in section 15, the retention periods stated there apply. Any further retention by the respective provider follows from the privacy notice linked at each service.
20. Security Measures
(1) We take appropriate technical and organizational measures in accordance with Art. 32 GDPR, taking into account the state of the art, implementation costs, and the nature, scope, circumstances, and purposes of processing, as well as the varying likelihood and severity of risk to the rights and freedoms of natural persons, in order to ensure an appropriate level of protection. This is intended in particular to protect the data we process against accidental or intentional manipulation, loss, deletion, or unauthorized access by third parties. Security measures also include encrypted transmission of data between your browser and our server.
(2) In addition, we have established procedures that ensure the exercise of data subject rights, the deletion of data, and responses to risks to data.
21. Your Rights
Where the respective legal requirements are met, you have the following rights:
(1) You have the right to request confirmation from us as to whether personal data concerning you is being processed; if this is the case, you have the right to access such personal data and the information listed in detail in Art. 15 GDPR.
(2) You have the right to request the rectification of inaccurate personal data concerning you without undue delay and, where applicable, the completion of incomplete personal data (Art. 16 GDPR).
(3) You have the right to request the deletion of personal data concerning you without undue delay, provided that one of the reasons listed in Art. 17 GDPR applies, for example if the data is no longer necessary for the purposes pursued (right to erasure).
(4) You have the right to request restriction of processing if one of the conditions listed in Art. 18 GDPR is met, for example if you have objected to processing for the duration of the review.
(5) You have the right to object at any time to processing of personal data concerning you for direct marketing purposes. You also have the right to object to processing based on Art. 6 (1) sentence 1 lit. e or f GDPR on grounds relating to your particular situation (Art. 21 GDPR). A supplementary notice on your right to object follows this list.
(6) You have the right to withdraw consent at any time with effect for the future (right of withdrawal).
(7) You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format and to transmit those data to another controller (right to data portability).
(8) To exercise your rights, please contact us using the contact details given in section 1.
Right to object, please pay particular attention to this notice.
(1) You have the right to object at any time to processing of personal data concerning you for direct marketing purposes. You also have the right to object to processing based on Art. 6 (1) sentence 1 lit. e or f GDPR on grounds relating to your particular situation (Art. 21 GDPR).
(2) We will then no longer process the personal data for direct marketing purposes and otherwise only process it if we can demonstrate compelling legitimate grounds which override your interests, rights, and freedoms, or if processing serves the establishment, exercise, or defense of legal claims.
This applies in particular to the processing described in sections 4, 5, 9 and 15.4. An informal message to the contact details given in section 1 is sufficient to object.
22. Right to lodge a complaint
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes data protection law (Art. 77 GDPR). You may address the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority responsible for us is:
Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Commissioner for Data Protection and Transparency)
Maternistraße 17, 01067 Dresden, Germany
Postal address: Postfach 11 01 32, 01330 Dresden, Germany
Telephone: +49 351 85471-101
https://www.datenschutz.sachsen.de
23. Changes to the Privacy Policy
Users are requested to regularly inform themselves about the content of our privacy policy. We adapt the privacy policy as soon as changes in data processing carried out by us or changes in legal regulations make this necessary. We will inform you as soon as changes require your cooperation (e.g. consent) or other individual notification.