Privacy Policy

1. Controller within the meaning of the GDPR

The controller for the processing of personal data on this website within the meaning of Art. 4(7) GDPR is:

2. Data protection officer

We have not designated a data protection officer because the statutory conditions under § 38 BDSG in conjunction with Art. 37 GDPR are not currently met: fewer than 20 persons are permanently engaged in the automated processing of personal data, and none of the special-case conditions (in particular large-scale core-business processing or mandatory DPIA) apply.

Please direct any data protection enquiries to the postal address listed under Section 1 or to . We handle data protection enquiries internally; for particularly sensitive matters we consult external specialist counsel.

3. General information on data processing

3.1 Scope of processing

We collect and use personal data of our customers only to the extent necessary to provide a functional website and our content and services. Personal data is generally collected and used only with the user's consent, or in cases where prior consent cannot be obtained for actual reasons and processing is permitted by law.

3.2 Legal bases (Art. 6 GDPR)

• Art. 6(1)(a) GDPR (consent) — e.g. newsletter, non-essential cookies, review reminders, marketing tracking.
• Art. 6(1)(b) GDPR (performance of a contract / pre-contractual measures) — order processing, customer account, contract-related contact.
• Art. 6(1)(c) GDPR (legal obligation) — retention of invoices and accounting records under German commercial and tax law (HGB, AO), handling of data subject rights.
• Art. 6(1)(f) GDPR (legitimate interest) — IT security, fraud prevention, server log files, direct marketing to existing customers under § 7(3) UWG (German Act against Unfair Competition).

Where access to end-user devices is involved (cookies, local storage etc.), lawfulness is additionally assessed under § 25 TDDDG. Non-essential access takes place exclusively with prior consent.

3.3 Erasure and retention

Personal data is erased or blocked as soon as the purpose of storage no longer applies. Further storage takes place where required by European or national legislation. Blocking or erasure occurs at the latest after expiry of the applicable retention period, unless further storage is necessary. Specific periods are set out in the sections below.

4. Provision of the website and server log files

Each time our website is accessed, our system automatically records data and information from the accessing device in so-called server log files.

Data processed:

• IP address of the requesting device (truncated where technically possible)
• date and time of access
• URL requested and HTTP status code
• volume of data transferred
• referrer URL
• browser (user agent) and operating system used

Purpose: delivery of the website, ensuring smooth connection establishment, system security, defence against attacks (DoS, brute-force, abuse), technical error analysis.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and functional operation).

Retention period: Server log files are deleted or anonymised after no more than 7 days; in the event of security-relevant incidents they are retained until conclusive investigation. This period is aligned with the recommendations of the German Data Protection Conference (DSK).

Right to object: The recording is strictly necessary for operation of the website, so no objection is possible in principle. Use of the website is not technically possible without such recording.

5. Hosting

This website is hosted on our own servers operated in Germany. Our data centre operator is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with the data centre operator. No further external hosting processing takes place.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the stable and secure provision of our online offer).

6. Cookies, local storage and similar technologies

6.1 General

Our website uses cookies and comparable storage technologies on the user's device. Cookies are small text files stored by the browser. Access to information on the end device is governed by § 25 TDDDG; storage of, or access to, information on the end device is only permitted with consent, except for strictly necessary access.

6.2 Categories

1. Strictly necessary cookies (legal basis: § 25(2)(2) TDDDG; supplemented by Art. 6(1)(f) GDPR / (b) where order-related)
   • session cookies for session maintenance
   • shopping cart cookies (cart persistence)
   • login cookies for the customer account
   • cookie consent cookie (storing your consent decision)
   • CSRF and security tokens
2. Functional cookies (consent — Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG): storage of language, currency, sorting and filter preferences insofar as not classified as strictly necessary.
3. Statistics and audience measurement [OPTIONAL — only if in use]
4. Marketing and retargeting [OPTIONAL — only if in use]

6.3 Consent management

When you first access our website, a cookie consent banner is displayed. You can granularly select which categories to allow. The “Accept all” and “Reject” buttons are presented with equal prominence; there is no pre-selection of non-essential cookies. Until you provide consent, no technologies requiring consent are loaded.

You can withdraw or modify your consent at any time via the “Cookie settings” link in the footer. Withdrawal only takes effect for the future; the lawfulness of processing carried out on the basis of consent up to that point remains unaffected.

6.4 Documentation obligation

We log the giving of your consent (time, categories chosen, version of the consent banner) as evidence pursuant to Art. 7(1) GDPR.

7. Order processing in the online shop

7.1 Data processed

When you place an order we collect:

• salutation, first and last name
• billing and delivery address
• email address and phone number
• payment data (depending on the payment method, see Section 8)
• order data (products, quantities, prices, order date)
• IP address at the time of the order (fraud prevention)
• for business customers additionally: company name, VAT ID, contact person

7.2 Purpose

Contract processing (offer, order conclusion, payment, delivery, complaint and returns handling, customer communication), fulfilment of commercial and tax obligations, fraud prevention.

7.3 Legal bases

• Art. 6(1)(b) GDPR (contract)
• Art. 6(1)(c) GDPR (tax and commercial retention obligations)
• Art. 6(1)(f) GDPR (fraud prevention, IT security)

7.4 Recipients

Your data is passed to:

• the payment service provider you have selected (see Section 8),
• the shipping service provider we have engaged (see Section 9),
• our tax advisor and, where applicable, tax authorities in fulfilment of legal obligations,
• where applicable, debt collection or credit scoring providers as part of the payment method (see Section 8),
• our IT service environment (processors under Art. 28 GDPR) for maintenance, backup and support.

7.5 Retention period

Order and contract data is stored at least for the duration of contract processing. Thereafter, the statutory retention obligations apply:

• 10 years for invoices, accounting records and annual financial statements (§ 147(1)(1),(4), (3) AO; § 257(1)(4), (4) HGB).
• 6 years for commercial letters received and sent (§ 257(1)(2)(3), (4) HGB; § 147(1)(2)(3) AO).
• Data not subject to retention obligations is deleted after expiry of the warranty period and any statute of limitations.

After these periods elapse, deletion is carried out under our deletion concept (based on DIN 66398).

7.6 Guest checkout vs. customer account

• Guest checkout: Only the data necessary for order processing is processed. After completion of the order and expiry of statutory retention obligations, this data is deleted or processing is restricted.
• Customer account: When you create a customer account, your master data and order history are stored permanently to enable access and facilitate repeat orders. You can delete your customer account at any time; the data will then be deleted unless statutory retention obligations require otherwise.

8. Payment service providers

We offer various payment methods. To process payments, we forward the data required to the selected payment service provider. These providers are independent controllers within the meaning of Art. 4(7) GDPR with respect to the processing of your data.

Legal basis for forwarding: Art. 6(1)(b) GDPR (contract performance), supplemented by Art. 6(1)(f) GDPR (fraud prevention).

8.1 PayPal [OPTIONAL — only if activated]

Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.
Data transferred: name, address, email, if applicable phone number, order and payment amount.
Privacy notice: paypal.com/en/webapps/mpp/ua/privacy-full

8.2 Klarna [OPTIONAL — only if activated]

Provider: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden.
Data transferred: contact data, order and invoice data; for purchase on account or instalment purchase additionally a credit check (automated decision as part of the payment eligibility check). You have the right to express your point of view and to contest the decision (Art. 22(3) GDPR).
Privacy notice: klarna.com/international/privacy-notice/

8.3 Stripe [OPTIONAL — only if activated]

Provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.
Data transferred: name, address, email, payment data (credit card, SEPA data).
Privacy notice: stripe.com/privacy

8.4 SEPA direct debit [OPTIONAL — only if activated]

For payment by SEPA direct debit we process account holder, IBAN and BIC. Forwarding takes place via our payment service provider or bank to the payment system of the credit industry.

8.5 Purchase on account / credit check [OPTIONAL — only if activated]

When selecting payment methods involving advance performance by us or our partners (e.g. purchase on account, instalment purchase), a credit and identity check may be performed. Recipients may include: SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden or Creditreform Boniversum GmbH, Hellersbergstraße 11, 41460 Neuss.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting against payment default).

9. Shipping service providers

For delivery of the ordered goods we forward your delivery address, name and — for shipment tracking and delivery notification — your email address and/or phone number to the logistics service provider engaged.

Legal basis: Art. 6(1)(b) GDPR.

The following providers are used (depending on the order):

• DHL — Deutsche Post AG / DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn — Privacy notice
• DPD — DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg — Privacy notice
• GLS — General Logistics Systems Germany GmbH & Co. OHG, GLS Germany-Straße 1–7, 36286 Neuenstein — Privacy notice

For delivery notification by email or phone, contact data is only forwarded with your consent or based on your choice at checkout (Art. 6(1)(a) in conjunction with (b) GDPR).

10. Contact form and email contact

When you contact us via our contact form or email, your information (at least: name, email address, message; optional: any further information you provide) is stored to handle your enquiry.

Legal basis: Art. 6(1)(b) GDPR where the enquiry concerns a contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

Retention period: We delete enquiry data as soon as it is no longer required for the purpose of its collection. Where the enquiry concerns a commercial matter (commercial letter), the retention periods under § 257 HGB / § 147 AO apply (up to 6 or 10 years).

11. Customer account

You can create a password-protected customer account with us. Your master data (name, addresses, email, phone number if applicable, date of birth), order history and stored payment methods (to the extent returned by the payment service provider) are managed there.

Legal basis: Art. 6(1)(b) GDPR (customer account usage agreement), supplemented by Art. 6(1)(f) GDPR (simplified reordering).

Retention period: Until you delete your customer account. You can delete your customer account at any time via your account settings or by informal message to . After deletion, account data is removed without undue delay; completed orders remain subject to statutory retention obligations (see Section 7.5) and are only finally deleted after their expiry.

12. Newsletter

12.1 Registration (double opt-in)

You can subscribe to our newsletter via the corresponding form on our website. We use a double opt-in procedure: after registration, you will receive a confirmation email with an activation link; only after clicking that link will we add you to the distribution list.

At least your email address is required for registration; further information (e.g. name) is voluntary.

Legal basis: Art. 6(1)(a) GDPR in conjunction with § 7(2)(3) UWG (consent).

12.2 Logging

To evidence your consent under Art. 7(1) GDPR, we store the registration time, confirmation time and the IP address used to register.

12.3 Unsubscription / withdrawal

You can withdraw your consent at any time with effect for the future. An unsubscribe link is provided at the end of every newsletter. Alternatively, an informal message to is sufficient. The lawfulness of processing carried out based on consent up to withdrawal remains unaffected.

12.4 Advertising to existing customers (§ 7(3) UWG)

Where you have purchased a good or service from us, we reserve the right to use the email address provided during ordering to send direct marketing for our own similar goods or services (§ 7(3) UWG). You can object to this use of your email address at any time without incurring costs other than transmission costs at basic rates. You will be informed of this right of objection with every marketing email and already upon collection of the email address.

Legal basis: Art. 6(1)(f) GDPR in conjunction with § 7(3) UWG.

12.5 Newsletter service provider [OPTIONAL — only if used]

Where a delivery service provider (e.g. Rapidmail, CleverReach) is used, the provider must be named specifically, with registered office, legal basis of the data processing agreement and, where applicable, third-country transfer and safeguards. Otherwise, remove this subsection.

13. Reviews / Trusted Shops [OPTIONAL — only if used]

The Trustbadge® of Trusted Shops GmbH, Subbelrather Str. 15c, 50823 Cologne, Germany, is embedded on our website.

Purpose: display of the Trusted Shops trust mark, display and collection of customer reviews, buyer protection.

Data processed and workflow: After completion of an order, we transmit your email address, order number and shopping cart data to Trusted Shops GmbH so that it can send you a review request — only where you have expressly consented at checkout (separate consent under § 7(2)(2) UWG in conjunction with Art. 6(1)(a) GDPR).

You can object to the use of your email address for review purposes at any time — e.g. via the unsubscribe link in the review request or by message to service@trustedshops.com or to us.

Trustbadge / Trusted Shops privacy policy: trustedshops.com/legal/privacy

14. Advertising, retargeting and audience measurement [OPTIONAL — only if used]

Where you have consented in the corresponding category in the cookie banner (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG), we use the following services:

14.1 Google Analytics [OPTIONAL]

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, USA.
Purpose: audience measurement, evaluation of user behaviour in aggregated form.
Data transferred: truncated IP address (IP anonymisation enabled), device information, pages accessed, time on page, referrer.
Retention at Google: max. 14 months.
Third-country transfer to USA: safeguarded via the EU-US Data Privacy Framework (adequacy decision of the EU Commission of 10 July 2023, C(2023) 4745 final); supplemented by Standard Contractual Clauses under Art. 46(2)(c) GDPR.
Withdrawal: via the “Cookie settings” link in the footer.

14.2 Google Ads Conversion / Remarketing [OPTIONAL]

Provider: Google Ireland Limited. Purpose: measurement of ad performance, retargeting audiences. Legal basis: consent.

14.3 Meta Pixel (Facebook Pixel) [OPTIONAL]

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland; parent company: Meta Platforms Inc., USA.
Purpose: conversion measurement, retargeting in the Meta advertising network (Facebook, Instagram).
Data transferred: IP address, device and browser data, event data (e.g. page view, add-to-cart, purchase), where applicable hashed contact data (advanced matching).
Joint controllership: For the collection of data, we and Meta are joint controllers within the meaning of Art. 26 GDPR. The Art. 26 GDPR agreement is available at facebook.com/legal/controller_addendum. Meta is solely responsible for the subsequent processing.
Third-country transfer to USA: adequacy decision (EU-US Data Privacy Framework), supplemented by Standard Contractual Clauses.
Meta privacy notice: facebook.com/privacy/policy

14.4 Withdrawal and deactivation

You can withdraw consent at any time via the “Cookie settings” link. For Google Analytics, the browser add-on at tools.google.com/dlpage/gaoptout is additionally available.

15. Google Fonts / web fonts

16. SSL/TLS encryption

This website uses TLS encryption for security and to protect the transmission of confidential content (e.g. orders and account information). You can recognise an encrypted connection by the “https://” in the address bar of your browser and by the padlock symbol.

17. Recipients / categories of recipients and processors

We only pass on personal data where necessary for contract performance, where we are legally obliged, where you have consented or where we make use of legitimate processors.

Typical categories of recipients:

• payment service providers (see Section 8)
• shipping service providers (see Section 9)
• newsletter delivery service providers [OPTIONAL]
• reviews service provider (see Section 13) [OPTIONAL]
• providers of web analytics and marketing tools where consent is given (see Section 14) [OPTIONAL]
• IT service providers for hosting, maintenance, backup, support (processors under Art. 28 GDPR)
• tax advisor, auditors, lawyers (subject to professional confidentiality)
• tax authorities, courts, investigating authorities (where legally obliged)
• credit reference agencies / debt collection providers for relevant payment methods [OPTIONAL]

We have concluded contracts pursuant to Art. 28 GDPR with all processors.

18. Data transfer to third countries

A transfer of personal data to countries outside the European Economic Area (EEA) only takes place to the extent described in this privacy policy. It occurs in particular in connection with the services referred to in Section 8 (payment service providers), Section 13 (reviews) and Section 14 (marketing/analytics), provided and to the extent that you have consented or another legal basis exists.

Safeguards for third-country transfers, in particular to the USA:

• Adequacy decision of the European Commission on the EU-US Data Privacy Framework (Decision C(2023) 4745 final of 10 July 2023) for certified US recipients,
• supplementary/subsidiary: Standard Contractual Clauses under Art. 46(2)(c) GDPR as set out in Implementing Decision (EU) 2021/914,
• where applicable, additional technical and organisational safeguards within the meaning of the ECJ's Schrems II judgment (C-311/18).

A list of US organisations currently certified under the DPF is available at dataprivacyframework.gov/list. On request we will provide you with a copy of the relevant safeguards.

19. Rights of data subjects (Art. 15–22 GDPR)

Where your personal data is processed, you are a “data subject” within the meaning of the GDPR and have the following rights vis-à-vis us:

• Right of access (Art. 15 GDPR): You may request information on whether and what data we process about you, as well as on purposes, categories, recipients, retention periods and further information under Art. 15 GDPR.
• Right to rectification (Art. 16 GDPR): You may request the correction of inaccurate data concerning you or completion of incomplete data.
• Right to erasure (Art. 17 GDPR): You may request the erasure of your data, provided the statutory conditions are met and no statutory retention obligations preclude this.
• Right to restriction of processing (Art. 18 GDPR): You may request restriction under the conditions of Art. 18 GDPR.
• Right to data portability (Art. 20 GDPR): You may receive your data provided to us in a structured, commonly used and machine-readable format, or request its transmission to another controller, where processing is based on consent or contract and is carried out by automated means.
• Right to object (Art. 21 GDPR): You have the right, on grounds relating to your particular situation, to object at any time to processing of data concerning you which is based on Art. 6(1)(e) or (f) GDPR. Where your data is processed for direct marketing, you have the right to object at any time without providing reasons; this also applies to profiling insofar as related to such direct marketing (Art. 21(2) GDPR).
• Right not to be subject to an automated individual decision (Art. 22 GDPR): You have the right not to be subject to a decision based solely on automated processing — including profiling — producing legal effects concerning you, unless one of the exceptions under Art. 22 GDPR applies.
• Withdrawal of consent (Art. 7(3) GDPR): You may withdraw a given consent at any time with effect for the future.

An informal message to or to the postal address given in Section 1 is sufficient to exercise your rights.

20. Right to object (Art. 21 GDPR) — detailed information

21. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority — in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).

The competent supervisory authority for the controller is:

You may equally lodge a complaint with the data protection authority of your Member State of habitual residence, your workplace or the place of the alleged infringement.

22. Obligation to provide data

Providing your personal data is partly required by law (e.g. tax-related mandatory information) or arises from contractual arrangements (e.g. details of the contracting party for an order). Without such data, a contract cannot be concluded with us and proper contract performance is not possible. For purely informational purposes, no personal data is required.

23. Automated individual decision-making including profiling

Automated decision-making within the meaning of Art. 22 GDPR does not generally take place. The exception is the credit check as part of certain payment methods (see Section 8.5), where offered and selected by you. In those cases you will be separately informed and have the right to express your point of view, to contest the decision and to obtain human intervention on the part of the controller (Art. 22(3) GDPR).

24. Changes to this privacy policy

We reserve the right to adapt this privacy policy where the legal situation, our processes or the services used change. The current version is always available at the URL of this page. The date of the current version is shown at the top of this page.