In the following, we, SodaTASTE GmbH, Im Grund 3, D-99897 Tambach-Dietharz, Tel.: +49 36252 460-860, E-Mail: info@sodataste.com (hereinafter referred to as “We”), the responsible party within the meaning of the European Data Protection Regulation (“DSGVO”) and other data protection regulations, inform you, the user, about the processing of personal data when using the Internet pages accessible at https://sodataste.com and https://sodataste.de, including the online store accessible on the Internet pages (“Internet pages”).
1.2 Name and address of the data protection supervisory authority responsible for us
The data protection supervisory authority responsible for us is: Thuringian State Commissioner for Data Protection and Freedom of Information, P.O. Box 90 04 55, D-99107 Erfurt; Häßlerstrasse 8 D-99096 Erfurt
1.3 General information on data processing
Below you will find general information on the processing of personal data by us. Personal data is all data that can be related to the data subject, e.g. name, address, location data, IP address, the device identifier, the SIM card number, address as well as e-mail address, but also your user behavior.
1.3.1 Scope of the processing of personal data
As a matter of principle, we collect and use personal data only insofar as this is necessary for the provision of functional Internet pages and a functional online store as well as for the provision of our services. The collection and use of personal data is generally only carried out with your consent. An exception applies in those cases where it is not possible to obtain prior consent for factual reasons and the processing of the data is permitted or required by legal regulations.
1.3.2 Legal basis for the processing of personal data
Insofar as we obtain the consent of the data subject for processing operations involving personal data, Art. 6 (1) p. 1 lit. a DSGVO serves as the legal basis for the processing of personal data. When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 (1) p. 1 lit. b DSGVO serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures. Insofar as processing of personal data is necessary for compliance with a legal obligation to which we are subject, Art. 6 (1) p. 1 lit. c DSGVO serves as the legal basis. In the event that vital interests of the data subject or another natural person make processing of personal data necessary, Art. 6 (1) p. 1 lit. d DSGVO serves as the legal basis. If the processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not override the former interest, Art. 6 (1) p. 1 lit. f DSGVO serves as the legal basis for the processing.
1.3.3 Period of data storage
We delete your personal data as soon as they are no longer required for the purposes for which we collected or used them according to the. As a rule, we store your personal data for the duration of the usage or contractual relationship concerning the use of the Internet pages. In principle, your data is only stored on our servers in Germany, subject to any transfer that may take place in accordance with the following regulations. However, storage may take place beyond the specified time in the event of a (threatened) legal dispute with you or other legal proceedings. Contractors used by us will store your data on their system for as long as is necessary in connection with the provision of the service for us in accordance with the respective order. Legal requirements for the storage and deletion of personal data remain unaffected by the above (e.g. § 257 of the German Commercial Code (“HGB”) or § 147 of the German Fiscal Code (“AO”). If the storage period prescribed by the statutory provisions expires, the personal data will be blocked or deleted unless further storage by us is necessary and there is a legal basis for this.
1.4 Data processing by third parties
1.4.1 Commissioned data processing
It may happen that commissioned service providers are used for individual functions of our Internet pages. As with any larger company, we also use external domestic and foreign service providers to handle our business transactions (e.g. for IT, logistics, telecommunications, sales and marketing). These are only active according to our instructions and have been contracted iSv. Article 28 DSGVO contractually obligated to comply with the data protection provisions.The following categories of recipients, which are usually processors, may receive access to your personal data:
Service providers for the operation of our websites and the processing of data stored or transmitted by the systems (e.g. for data center services, payment processing, IT security). The legal basis for the transfer is then Art. 6 para. 1 p. 1 lit. b or lit. f DSGVO, insofar as these are not order processors;
Government agencies/authorities, insofar as this is necessary to fulfill a legal obligation. The legal basis for the disclosure is then Art. 6 para. 1 p. 1 lit. c DSGVO;
Persons employed to carry out our business operations (e.g. auditors, banks, insurance companies, legal advisors, supervisory authorities. The legal basis for the disclosure is then Art. 6 para. 1 p. 1 lit. b or lit. f DSGVO.
In addition, we will only disclose your personal data to third parties if you have given your express consent to do so in accordance with Art. 6 para. 1 p. 1 lit. a DSGVO.
1.4.2 Requirements for the transfer of personal data to third countries
1.4.2.1 General
In the course of our business relationships, your personal data may also be passed on or disclosed to third parties. These may also be located outside the European Economic Area (“EEA”), i.e. in so-called third countries. Such processing will only take place in order to fulfill contractual and business obligations and to maintain your business relationship with us. We will inform you about the respective details of the transfer in the relevant places below. Some third countries are certified by the European Commission through so-called adequacy decisions to have data protection comparable to the EEA standard (a list of these countries as well as a copy of the adequacy decisions can be found here: http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.html). However, in other third countries to which personal data may be transferred, there may not be a consistently high level of data protection due to a lack of legal provisions. If this is the case, we ensure that data protection is sufficiently guaranteed. This is possible in particular via standard contractual clauses of the European Commission for the protection of personal data. Please contact our data protection officer if you would like more information on this.
1.4.2.2 Data transfer to the USA
Our websites use analysis and advertising tools from companies with (headquarters) in the USA (e.g. Google). If these tools are active, your personal data may be transferred to the US servers. We would like to point out that the USA is not a safe third country in the sense of EU data protection law. US companies are obliged to hand over personal data to security authorities without you as a data subject being able to take legal action against this. It can therefore not be ruled out that US authorities (e.g. intelligence services) process, evaluate and permanently store your data located on US servers for monitoring purposes. We have no influence on these processing activities.
1.4.3 Legal obligation to transfer certain data
We may be subject to a specific legal or statutory obligation to provide lawfully processed personal data to third parties, in particular public bodies (Art. 6 para. 1 p. 1 lit. c DS-GVO).
1.5 Your rights
You have the following rights with respect to us regarding personal data concerning you:
Right to information,
Right to correction or deletion,
Right to restriction of processing,
Right to object to processing,
Right to data portability.
You also have the right to complain to a data protection supervisory authority about the processing of your personal data by us.
1.6 Objection to or revocation of the processing of your data
1.6.1 Revocability of consent
If you have given your consent to the processing of your data, you may revoke it at any time. Such revocation will affect the permissibility of processing your personal data after you have expressed it to us.
1.6.2 Notice of the possibility to object to data processing in the event of a balance of interests
Insofar as we base the processing of your personal data on the balance of interests, you may object to the processing. This is the case if the processing is not necessary, in particular, for the performance of a contract with you, which is shown by us in each case in the following description of the functions. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data as we have done. In the event of your justified objection, we will examine the merits of the case and either discontinue or adjust the data processing or show you our compelling legitimate grounds on the basis of which we will continue the processing.
1.6.3 Notice of the possibility to object to direct marketing
Of course, you can object to the processing of your personal data for purposes of advertising and data analysis at any time. You can inform us of your advertising objection using the following contact data: SodaTASTE GmbH, Im Grund 3, D-99897 Tambach-Dietharz, Tel.: +49 3622 460-860, e-mail: info@sodataste.com.
1.7 Data security
We use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or against unauthorized access by third parties, taking into account the state of the art, implementation costs and the nature, scope, context and purpose of the processing, as well as the existing risks of a data breach (including its probability and impact) for the data subject. Our security measures are continuously improved in line with technological developments.
2. Processing of personal data when visiting our website
2.1 SSL or TLS encryption
For security reasons and to protect the transmission of confidential content, such as requests that you send to us as the site operator, our website uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser line. If SSL or TLS encryption is activated, the data you transmit cannot be read by third parties.
2.2 Creation of log files
During the mere informational use of our Internet pages, i.e. when you do not transmit any information to us, the system automatically collects data and information from the computer system of the calling end device. The following data is collected:
Internet protocol address (IP address – anonymized)
Time and date of the respective access
Time zone difference to Greenwich Mean Time (GMT)
The specific page accessed
Status of the access / Hypertext Transfer Protocol (http)
Amount of data that was transferred in each case
Website from which our website was accessed (referrer URL)
Internet browser used (incl. language and version)
Operating system used
This data is also stored in the log files of our system. This data is not stored together with other personal data of the user.
2.2.1 Legal basis for data processing
The legal basis for the temporary storage of the data and the log files is Art. 6 para. 1 p. 1 lit. f DSGVO.
2.2.2 Purpose of data processing
The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session. The storage in log files is done to ensure the functionality of the website. In addition, we use the data to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context. These purposes are also our legitimate interest in data processing according to Art. 6 para. 1 p. 1 lit. f DSGVO.
2.2.3 Duration of storage
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the online store, this is the case when the respective session has ended. In the case of storage of data in log files, this is the case after seven (7) days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or alienated, so that an assignment of the calling client is no longer possible.
2.2.4 Possibility of objection and removal
The collection of data for the provision of the Internet pages and the storage of the data in log files is absolutely necessary for the operation of the Internet pages. Consequently, you have no possibility to object.
2.3 Use of cookies
We use cookies when operating our Internet pages. Cookies and similar technologies are very small text documents or pieces of code that often contain a unique identification code. When you visit a website or use a mobile application, a computer asks your computer or mobile device for permission to store this file on your computer or mobile device and access information. Information collected through cookies and similar technologies may include the date and time of your visit and how you use a particular website or mobile application.
2.3.1 What kind of cookies do we use and why?
Cookies ensure that you remain logged into your customer account on the websites and/or that all items in your shopping cart are stored, that you can shop safely and that our websites continue to function smoothly. Cookies also ensure that we can see how our websites are used and how we can improve them. In addition, depending on your preferences, our own cookies may be used to present you with targeted advertising that matches your personal interests.
2.3.1.1 Technically necessary cookies
These cookies are necessary for our Internet pages to function properly. At the same time, they serve to simplify the use of websites for users. Some of the following actions can be performed with these cookies and are necessary for this purpose:
Save items in a shopping cart for online purchases
Save your cookie settings for this website
Sign up for your customer account. We need to verify that you are logged in.
The user data collected through technically necessary cookies are not used to create user profiles.
2.3.1.2 Analysis and marketing cookies; functional cookies
Analysis cookies are used to collect statistical information about the use of our websites. We use this data to improve performance and optimize websites.Marketing cookies are set by external advertising partners and are used to profile and track data across multiple websites. If you accept these cookies, we may display our advertisements on other websites based on your user profile and preferences. These cookies also store data about how many visitors have seen or clicked on our ads in order to optimize advertising campaigns.Functional cookies enable more functionality for our website visitors. These cookies may be set by our external service providers or our own websites, e.g. media control cookies.Analysis, marketing and functional cookies are used to improve the quality of our website and its content. Through analysis and marketing cookies, we learn how our offers are used and can thus constantly optimize them. In these purposes also lies our legitimate interest in the processing of personal data according to Art. 6 para. 1 p. 1 lit. f DSGVO.
2.3.2 Legal basis for the use of cookies
The legal basis for the processing of personal data using technically necessary cookies is our legitimate interest Art. 6 para. 1 p. 1 lit. f DSGVO. Any use of cookies that is not absolutely technically necessary constitutes data processing that is only permitted with your explicit and active consent pursuant to Art. 6 (1) p. 1 lit. a DSGVO. This applies in particular to the use of analysis and marketing cookies. In addition, we will only disclose your personal data processed by cookies to third parties if you have given your express consent to do so pursuant to Art. 6 (1) p. 1 lit. a DSGVO.
2.3.3 Cookie Consent Manager
Our websites use the cookie consent tool from GDPR Legal Cookie to obtain effective user consent for cookies and cookie-based applications that require consent. By integrating this tool, users are shown a banner when they access the page, in which consent for certain cookies and/or cookie-based applications and/or cookie categories can be granted by setting a check mark. The tool blocks the setting of all cookies requiring consent until the respective user grants the corresponding consent by setting a check mark. This ensures that such cookies are only set on your respective end device if you have given your consent. In order for the cookie consent tool to be able to clearly assign page views to individual users and to individually record, log and store the consent settings you have made for a session duration, certain user information (including the IP address) is collected when our Internet pages are called up by the cookie consent tool, transmitted to servers of the provider of the cookie consent tool and stored there. This data processing is carried out in accordance with Art. 6 (1) sentence 1 lit. f DSGVO on the basis of our legitimate interest in a legally compliant, user-specific and user-friendly consent management for cookies and thus in a legally compliant design of our Internet pages. Further legal basis for the described data processing is Art. 6 para. 1 p. 1 lit. c DSGVO. As the responsible party, we are subject to the legal obligation to make the use of technically unnecessary cookies dependent on the respective user consent. Further information on the use of data by the provider of the cookie consent tool can be found in its privacy policy, available at: https://gdpr-legal-cookie.com/pages/datenschutzerklarung.
2.3.4 How can I turn off or remove cookies?
You can opt out of all but the necessary cookies. In the browser settings of your terminal device, you can change the settings to block certain cookies/technologies. However, if you block the cookies/technologies, it is possible that you will not be able to use all the technical functions of our websites.
2.3.5 Duration of storage, possibility of objection and elimination
Cookies are stored on the user’s terminal device and transmitted to our site by the user. Therefore, you as a user also have full control over the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our Internet pages, it may no longer be possible to fully use all functions of the Internet pages.
2.4 Contacting us
2.4.1 Functionality and scope of data processing
When contacting us, personal data is processed – exclusively for the purpose of processing and responding to your request and only to the extent necessary for this purpose. The legal basis for processing this data is our legitimate interest in responding to your request pursuant to Art. 6 (1) lit. f DSGVO. If your contact is aimed at a contract, the additional legal basis for processing is Art. 6 (1) lit. b DSGVO. Your data will be deleted if it can be inferred from the circumstances that the matter concerned has been conclusively clarified and provided that there are no statutory retention obligations to the contrary.
2.4.2 Contact form; e-mail
If we offer you to contact us via electronic contact form, the data entered in the respective input mask will be transmitted to us and stored. These data are: Name E-mail addressYour name and e-mail address are mandatory and are marked as such in the contact form.If you contact us by e-mail, we will store your e-mail address and your request and, if you contact us by contact form, the aforementioned data.At the time of sending the message via contact form and e-mail, the following data will also be stored:
your IP address
Date and time of your request
Under no circumstances will the data be passed on to third parties. The data is used exclusively for processing the conversation.
2.4.3 Telephone contact
If you contact us by telephone, we store the following data communicated to us:
(Full) Name
E-mail address
Telephone number
Under no circumstances will the data be passed on to third parties. The data will be used exclusively for the processing of the conversation.
2.5 Use of our online shop
If you would like to order in our online store, it is necessary for the conclusion of the contract that you provide your personal data, which we need for the processing of your order.
2.5.1 Customer account
2.5.1.1 Functionality and scope of data processing
You can voluntarily create a customer account, through which we can store your data for future purchases. To do this, you enter your data in the relevant input mask, through which the data is transmitted to us and which we store. The following data is collected as part of the registration process:
E-mail address
Self-selected password
Address/contact data
The following data is also stored at the time of registration:
The IP address of the user
Date and time of registration
As part of the registration process, the user’s consent to the processing of this data is obtained.The data is not passed on to third parties.
2.5.1.2 Legal basis and purpose of data processing
The legal basis for the processing of data is Art. 6 (1) lit. a DSGVO if you have given your consent. If your registration serves to place an order in our online store and thus to fulfill the purchase contract with you or to carry out pre-contractual measures, the legal basis for processing the data is Art. 6 (1) lit. b DSGVO.
2.5.1.3 Duration of storage
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is the case for the data collected during the registration process when the registration in our online store is cancelled or modified. This is the case for the data collected during the registration process for the fulfillment of a contract or for the implementation of pre-contractual measures when the data is no longer required for the implementation of the contract. Even after the conclusion of the contract, there may be a need to store personal data of the contractual partner in order to fulfill contractual or legal obligations.
2.5.1.4 Possibility of objection and removal
As a user, you have the option to cancel the customer account at any time. You can have the data stored about you changed at any time. If the data is required for the fulfillment of a contract or for the implementation of pre-contractual measures, early deletion of the data is only possible insofar as contractual or legal obligations or rights do not prevent deletion.
2.5.2 Order processing
Insofar as necessary for the processing of the contract for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned transport company, credit institution, payment service provider in accordance with Art. 6 Para. 1 lit. b DSGVO.
2.5.2.1 DHL
If the goods are delivered by the transport service provider DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn (“DHL”), we will pass on your e-mail address to DHL in accordance with Art. 6 Para. 1 lit. a DSGVO prior to delivery of the goods for the purpose of coordinating a delivery date or for delivery notification, provided that you have given your express consent to this in the ordering process. Otherwise, we will only pass on the name of the recipient and the delivery address to DHL for the purpose of delivery in accordance with Art. 6 Para. 1 lit. b DSGVO. The disclosure is made only to the extent necessary for the delivery of goods. In this case, prior coordination of the delivery date with DHL or delivery notification is not possible. The consent can be revoked at any time with effect for the future towards us or towards DHL.
2.5.2.2 Payment services
2.5.2.2.1 Payment in advance
In the case of payment in advance (prepayment), we will provide you with our bank details in a separate window after the order has been completed and will not deliver the goods until payment has been received.
2.5.2.2.2 Payment by PayPal
When paying via PayPal, we will pass on your payment data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter referred to as “PayPal”) as part of the payment processing. The transfer takes place in accordance with Art. 6 para. 1 p. 1 lit. b DSGVO and only to the extent necessary for payment processing. PayPal reserves the right to conduct a credit check for the payment methods credit card via PayPal, direct debit via PayPal and “purchase on account”. For this purpose, your payment data may be passed on to credit agencies in accordance with Art. 6 para. 1 p. 1 lit. f DSGVO on the basis of PayPal’s legitimate interest in determining your solvency. PayPal uses the result of the credit check with regard to the statistical probability of non-payment for the purpose of deciding on the provision of the respective payment method. The creditworthiness information may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, these have their basis in a scientifically recognized mathematical-statistical procedure. The calculation of the score values includes, but is not limited to, address data. For further information on data protection law, including information on the credit agencies used, please refer to PayPal’s data protection declaration: https://www.paypal.com/de/webapps/mpp/ua/privacy-full. You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for the contractual processing of payments.
2.5.2.3 Payments via Klarna
If you select a Klarna payment service, the payment will be processed by Klarna Bank AB (publ), https://www.klarna.com/de/, Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter “Klarna”). In order to enable the processing of the payment, your personal data (first and last name, street, house number, zip code, city, gender, email address, phone number and IP address, if necessary additionally the date of birth and your bank details) as well as data related to the order (e.g. invoice amount, article, delivery type) will be passed on to Klarna for the purpose of identity and credit checks, provided that you have expressly consented to this in accordance with Art. 6 para. 1 lit. a DSGVO during the ordering process. You can see which credit agencies your data may be forwarded to here: https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies The credit report may contain probability values (so-called score values). If score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of the score values includes, but is not limited to, address data. Klarna uses the information obtained about the statistical probability of non-payment for a weighed decision on the establishment, implementation or termination of the contractual relationship. You can revoke your consent at any time by sending a message to the data controller or to Klarna. However, Klarna may still be entitled to process your personal data if this is necessary for the contractual processing of payments. Your personal data will be handled in accordance with the applicable data protection regulations and as specified in Klarna’s Privacy Policy for Data Subjects located in Germany https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/privacy and for Data Subjects located in Austria https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_at/privacy.
2.5.2.2.4 Payment by credit card
In the case of payment by credit card, we will arrange for your account to be debited following your orderWe offer payment by credit card via the “Shopify Payments” payment service of Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (hereinafter “Shopify”), which uses the payment service provider Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (hereinafter “Stripe”) for payment processing. For the processing of payments, Stripe may use other payment services, for which special payment conditions may apply, to which you may be informed separately. Further information on “Shopify Payments” is available on the Internet at https://www.shopify.com/legal/terms-payments-de. When paying by credit card, the payment data you enter will be collected by Shopify/Stripe pursuant to Art. 6 (1) p. 1 lit. b) DSGVO, stored and only passed on to the companies involved in the payment process. With the credit card payment you accept the terms and conditions of the payment provider. A collection or storage of payment data by us does not occur in this case. When paying by credit card, the following data will be processed:
Card type
Name of the cardholder
card number
check digit
Validity period
2.5.2.2.5 Purchase on account via Santander Consumer Bank AG
If you choose the payment method purchase on account, the transaction will be made via Santander Consumer Bank AG, Santander- Platz 1, 41061 Mönchengladbach (“Santander”). In this case, you will be asked to provide your personal data (title, name, address, date of birth, billing and shipping address of the customer, invoice amount, composition of the shopping cart) during the ordering process. Santander’s special conditions for purchase on account apply, available at: https://www.santander.de/content/pdf/agb-sonderbedingungen/bedingungen-fuer-den-rechnungskauf.pdf. In order to protect our legitimate interest in determining your ability to pay, this data is forwarded by us to Santander pursuant to Art. 6 (1) lit. f DSGVO for the purpose of a credit check and to verify the issuance of a payment guarantee to the merchant. Santander checks on the basis of the personal data provided by you as well as other data (such as shopping cart, invoice amount, order history, payment experience) whether the payment option selected by you can be granted with regard to statistical payment and/or bad debt risks. For the decision in the context of the application check, identity and creditworthiness information from the following credit agencies may be included in addition to Santander -internal criteria pursuant to Art. 6 (1) lit. f DSGVO: CRIF GmbH, Leopoldstraße 244, 80807 Munich; SCHUFA Holding AG, Kormoranweg 5, D-65201 Wiesbaden. The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they have their basis in a scientifically recognized mathematical-statistical procedure; address data, among other things, are included in the calculation of the score values. You can obtain more information about Santander’s privacy policy for installment and invoice purchases at the following Internet address: https://www.santander.de/content/pdf/datenschutzhinweise/datenschutzhinweise-rechnungs-und-ratenkauf.pdf. You can object to this processing of your data at any time by sending a message to us or to Santander. However, Santander may still be entitled to process your personal data to the extent necessary to process payments in accordance with the contract. However, Santander may still be entitled to process your personal data if this is necessary to process payments in accordance with the contract.
2.5.2.6 Direct payment via Santander
When paying by direct payment via Santander, the payment processing is carried out by Santander. In order to be able to pay the invoice amount by direct payment, you must have an online banking account that has been appropriately activated for participation, identify yourself accordingly during the payment process and confirm the payment instruction to Santander. The payment transaction will be carried out immediately afterwards by the latter and your bank account there will be debited. For further information, please refer to Santander’s privacy policy for direct bank transfers, available at: https://www.santander.de/content/pdf/datenschutzhinweise/datenschutzhinweise-direktueberweisung.pdf.
2.5.2.2.7 Disclosure to collection service providers for the purpose of debt collection
We reserve the right, in the event that you default on a debt owed to us against you, to transfer your following personal data to collection agencies for the purpose of collecting the debt. The legal basis for this is our legitimate interest in this pursuant to Art. 6 (1) p. 1 lit f DSGVO, which is that the outstanding debt against you is settled by you. In this respect, it is necessary that the collection agency receives the information that establishes the claim and that enables collection by the collection agency. This also applies if the existence or the amount of the claim is disputed between us. Since the purpose of the data transfer is to settle the claim, it is generally not to be assumed that interests or fundamental rights and freedoms of the data subject that require the protection of personal data prevail. Therefore, you cannot request deletion of your personal data from the debt collection agency prior to clarification under civil law as to whether a claim actually exists and, if so, for what amount.
2.5.2.3 Online store hosting with Shopify
We host our online store with Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”). Shopify a tool for creating and hosting websites. When you visit our online store, Shopify collects your IP address and information about the device and browser you are using. Shopify also analyzes the number of visitors, the sources of visitors, customer behavior and creates user statistics. When you make a purchase from our online store, Shopify also collects your name, email address, shipping and billing addresses, payment information, and other data related to the purchase (e.g., phone number, amount of sales made, and the like). For analytics, Shopify stores cookies in your browser. For details, see Shopify’s privacy policy: https://www.shopify.de/legal/datenschutz. The use of Shopify is based on Art. 6 para. 1 p. 1 lit. f DSGVO. We have a legitimate interest in the most reliable presentation of our online store. Insofar as a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 p. 1 lit. a DSGVO; the consent can be revoked at any time. We have concluded an order processing agreement in accordance with Art. 28 DSGVO with Shopify. This ensures that Shopify processes your personal data on our behalf and only according to our instructions.
2.6 Special technologies
2.6.1 Analysis, tracking, marketing
2.6.1.1 Google (Universal) Analytics
Our internet pages use Google (Universal) Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). Our websites use Google (Universal) Analytics exclusively without the use of cookies, which means that the service does not set cookies on your terminal device at any time. Instead, the local memory of your browser is used to store an individual ID assigned by Google (Universal) Analytics, which enables an analysis of your use of the website. For this purpose, certain user information is processed via the ID. The information generated by the ID about your use of our website (including the shortened IP address) is usually transmitted to a Google server and stored there; this may also involve transmission to the servers of Google LLC. in the USA. Our Internet pages use Google (Universal) Analytics exclusively with the extension “_anonymizeIp()”, which ensures anonymization of the IP address by shortening and excludes a direct personal reference. Through the extension, your IP address is shortened beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google LLC. server in the USA and shortened there. On our behalf, Google will use this information for the purpose of evaluating your use of our website, compiling reports on website activity and providing other services relating to website activity and internet usage. In this context, the IP address transmitted by your browser as part of Google (Universal) Analytics will not be merged with other Google data.Google Analytics also enables the creation of statistics with statements about the age, gender and interests of site visitors on the basis of an evaluation of interest-based advertising and with the inclusion of third-party information via a special function, the so-called “demographic characteristics”. This allows the definition and differentiation of user groups of our websites for the purpose of targeting marketing measures. However, data records collected via “demographic characteristics” cannot be assigned to a specific person. Details on the processing triggered by Google Analytics and Google’s handling of website data can be found here: https://policies.google.com/technologies/partner-sites. All processing described above will only be carried out if you have given us your express consent to do so in accordance with Art. 6 (1) a DSGVO. Without this consent, Google Analytics will not be used during your visit to our website. You can revoke your consent at any time with effect for the future. To exercise your revocation, you can download and install the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de As an alternative to the browser plugin or within browsers on mobile devices, you can revoke your consent by clicking on the following link to set an opt-out cookie that will prevent the collection by Google Analytics within this website in the future (this opt-out cookie only works in this browser and only for this domain. If you delete your cookies in this browser, you must click this link again):Google Analytics deactivateWe have entered into an order processing agreement with Google for the use of Google Analytics, which obliges Google to protect the data of our site visitors and not to pass it on to third parties. For the transfer of data from the EU to the USA, Google refers to so-called standard data protection clauses of the European Commission, which are intended to ensure compliance with the European level of data protection in the USA. Further information on Google (Universal) Analytics can be found here: https://policies.google.com/privacy?hl=de&gl=de.
2.6.1.2 Google Analytics Remarketing
Our internet pages use the functions of Google Ads Remarketing. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics Remarketing allows us to assign persons who interact with our online offer to specific target groups in order to subsequently display interest-based advertising to them in the Google advertising network (remarketing or retargeting).Furthermore, the advertising target groups created with Google Analytics Remarketing can be linked to Google’s cross-device functions. In this way, interest-based, personalized advertising messages that have been adapted to you depending on your previous usage and surfing behavior on one end device (e.g. cell phone) can also be displayed on another of your end devices (e.g. tablet or PC). The use of this service is based on your consent according to Art. 6 para. 1 p. 1 lit. a DSGVO and § 25 para. 1 TTDSG. You can revoke your consent at any time.If you have a Google account, you can also object to personalized advertising at the following link: https://www.google.com/settings/ads/onweb/. Further information and the data protection provisions can be found in Google’s privacy policy at: https://policies.google.com/technologies/ads?hl=de.
2.6.1.3 DoubleClick
These web pages use the online marketing tool DoubleClick by Google. DoubleClick uses cookies to display ads that are relevant to users, to improve campaign performance reports or to prevent a user from seeing the same ads more than once. Via a cookie ID, Google records which ads are displayed in which browser and can thus prevent them from being displayed more than once. In addition, DoubleClick can use cookie IDs to record so-called conversions that are related to ad requests. This is the case, for example, when a user sees a DoubleClick ad and later calls up the advertiser’s website with the same browser and buys something there. According to Google, DoubleClick cookies do not contain any personal information. Due to the marketing tools used, your browser automatically establishes a direct connection with Google’s server. We have no influence on the scope and further use of the data collected by Google through the use of this tool and therefore inform you according to our state of knowledge: Through the integration of DoubleClick, Google receives the information that you have called up the corresponding part of our website or clicked on an advertisement from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, there is a possibility that the provider learns your IP address and stores it. You can prevent participation in this tracking process in various ways: a) by making appropriate settings in your browser software, in particular the suppression of third-party cookies will result in you not receiving ads from third-party providers; b) by disabling cookies for conversion tracking by setting your browser to block cookies from the domain “www.googleadservices.com”, https://www.google. de/settings/ads, in which case this setting will be deleted when you delete your cookies; c) by disabling the interest-based ads of the providers that are part of the self-regulatory campaign “About Ads” via the link http://www.aboutads.info/choices, in which case this setting will be deleted when you delete your cookies; d) by permanently disabling them in your Firefox, Internetexplorer or Google Chrome browsers at the link http://www.google.com/settings/ads/plugin. We would like to point out that in this case you may not be able to use all functions of this offer to their full extent. We have a legitimate interest in the use of the aforementioned functionalities for advertising purposes in order to make the Internet pages more user-friendly. In this respect, the legal basis for the processing of your data is Art. 6 para. 1 p. 1 lit. f) DSGVO. In case of your consent, the processing is based on Art. 6 para. 1 p. 1 lit. a) DSGVO. You can revoke your consent at any time. For more information on DoubleClick by Google, please visit https://www.google.de/doubleclick and http://support.google.com/adsense/answer/2839090, and on data protection at Google in general: https://www.google.de/intl/en/policies/privacy.
2.6.1.4 Google Tag Manager
On these web pages, we also use the Google Tag Manager from Google. The Google Tag Manager is a solution that marketers can use to manage website tags via an interface. The Tag Manager tool itself (which implements the tags) is a cookie-less domain and does not collect any personal data. The tool takes care of triggering other tags, which in turn may collect data. Google Tag Manager does not access this data. If a deactivation has been made at the domain or cookie level, this remains in place for all tracking tags implemented with Google Tag Manager. The legal basis for the processing of your data is Art. 6 para. 1 p. 1 lit. f DSGVO. You can obtain further information from Google at the link: https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/.
2.6.1.5 Google Ads
Our internet pages use Google Ads. Google Ads is an online advertising program of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.Google Ads enables us to display advertisements in the Google search engine or on third-party websites when the user enters certain search terms on Google (keyword targeting). Furthermore, targeted advertisements can be played on the basis of user data available at Google (e.g. location data and interests) (target group targeting). This may also result in data transfer to the USA. As the operator of the websites, we can evaluate this data quantitatively by analyzing, for example, which search terms have led to the display of our advertisements and how many advertisements have led to corresponding clicks.The use of this service is based on your consent in accordance with Art. 6 Para. 1 lit. a DSGVO and § 25 Para. 1 TTDSG. You can revoke your consent at any time.The data transfer to the USA is based on the standard contractual clauses of the EU Commission, which we have concluded with Google. Details can be found here: https://policies.google.com/privacy/frameworks and https://privacy.google.com/businesses/controllerterms/mccs/.
2.6.1.6 Facebook Pixel
Our websites use the visitor action pixel from Facebook for conversion measurement. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. However, according to Facebook, the data collected is also transferred to the USA and other third countries.This allows the behavior of page visitors to be tracked after they have been redirected to the provider’s website by clicking on a Facebook ad. This allows the effectiveness of the Facebook ads to be evaluated for statistical and market research purposes and future advertising measures to be optimized.The collected data is anonymous for us as the operator of this website, we cannot draw any conclusions about the identity of the users. However, the data is stored and processed by Facebook, so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes, according to the Facebook data usage policy. This allows Facebook to enable the placement of advertisements on Facebook pages as well as outside of Facebook. This use of the data cannot be influenced by us as the site operator.The use of this service is based on your consent according to Art. 6 para. 1 p. 1 lit. a DSGVO and § 25 para. 1 TTDSG. You can revoke your consent at any time. The data transfer to the USA is based on the standard contractual clauses of the EU Commission, which we have concluded with Facebook. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.Insofar as personal data is collected on our websites with the help of the tool described here and forwarded to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art. 26 DSGVO). The joint responsibility is limited exclusively to the collection of the data and its forwarding to Facebook. The processing by Facebook that takes place after the onward transfer is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in a joint processing agreement. The text of the agreement can be found at: https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for providing the privacy information when using the Facebook tool and for the privacy-secure implementation of the tool on our websites. Facebook is responsible for the data security of the Facebook products. You can assert data subject rights (e.g., requests for information) regarding data processed by Facebook directly with Facebook. If you assert the data subject rights with us, we are obliged to forward them to Facebook.You can find further information on protecting your privacy in Facebook’s data protection notices: https://de-de.facebook.com/about/privacy/.You can also disable the Custom Audiences remarketing feature in the Ad Settings section at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. To do this, you must be logged into Facebook. If you do not have a Facebook account, you can disable usage-based advertising from Facebook on the European Interactive Digital Advertising Alliance website: http://www.youronlinechoices.com/de/praferenzmanagement/.
2.6.2 Content Delivery Networks; Website Optimization; Other
2.6.2.1 Shopify
We host our online store with Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”). Shopify a tool for creating and hosting websites. When you visit our online store, Shopify collects your IP address and information about the device and browser you are using. Shopify also analyzes the number of visitors, the sources of visitors, customer behavior and creates user statistics. When you make a purchase from our online store, Shopify also collects your name, email address, shipping and billing addresses, payment information, and other data related to the purchase (e.g., phone number, amount of sales made, and the like). For analytics, Shopify stores cookies in your browser. For details, see Shopify’s privacy policy: https://www.shopify.de/legal/datenschutz. The use of Shopify is based on Art. 6 para. 1 p. 1 lit. f DSGVO. We have a legitimate interest in the most reliable presentation of our online store. Insofar as a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 p. 1 lit. a DSGVO; the consent can be revoked at any time. We have concluded an order processing agreement in accordance with Art. 28 DSGVO with Shopify. This ensures that Shopify processes your personal data on our behalf and only according to our instructions. As part of Shopify’s aforementioned services, data may also be transferred to Shopify Inc, 150 Elgin St, Ottawa, ON K2P 1L4, Canada, Shopify Data Processing (USA) Inc, Shopify Payments (USA) Inc or Shopify (USA) Inc as part of further processing on our behalf. In the event that data is transferred to Shopify Inc. in Canada, the appropriate level of data protection is guaranteed by adequacy decision of the European Commission. Further information on Shopify’s data protection can be found at the following website: https://www.shopify.de/legal/datenschutz.
2.6.2.2 Google Fonts
Google Fonts are implemented on our Internet pages. Google Fonts enable us to provide you with a uniform appearance of our internet pages, regardless of which fonts are installed on your local system. The Google Fonts are loaded from a server of Google Inc. (“Google”) in the USA, unless your browser has access to a local copy in the cache, i.e. Google is theoretically aware of the offer usage. We have a legitimate interest in the use of these functionalities in order to make our internet pages more user-friendly. The legal basis for the processing of your data in this respect is Art. 6 para. 1 p. 1 lit. f DSGVO. In case of your consent, the processing is based on Art. 6 para. 1 p. 1 lit. a DSGVO. You can revoke your consent at any time, which can be accessed via our homepage at any time. For more information, please contact Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. User terms and conditions: http://www.google.com/analytics/terms/de.html, Overview of data protection: http://www.google.com/intl/de/analytics/learn/privacy.html, and Privacy policy: http://www.google.de/intl/de/policies/privacy.
2.6.2.3 jQuery
We use the Javascript library “jQuery”. To increase the loading speed of our web pages and thus provide you with a better user experience, we use Google’s CDN (content delivery network) to load this library. There is a very good chance that you have already used jQuery on another page from the Google CDN. In that case, your browser can access the cached copy and it doesn’t need to be downloaded again. If your browser does not have a cached copy or for some other reason downloads the file from the Google CDN, again data is transferred from your browser to Google. The legal basis for the use of Google Analytics is Art. 6 para. 1 p. 1 lit. f DSGVO. Information of the third party provider: Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. User conditions: http://www.google.com/analytics/terms/de.html, overview of data protection: http://www.google.com/intl/de/analytics/learn/privacy.html, as well as the data protection declaration: http://www.google.de/intl/de/policies/privacy.
2.6.2.4 Cloudflare
We use functions of the CloudFlare content delivery network of CloudFlare Germany GmbH, Rosental 7, 80331 Munich, Germany on our Internet pages. A Content Delivery Network (CDN) is a network of regionally distributed servers connected via the Internet that is used to deliver content – especially large media files such as videos. CloudFlare provides web optimization and security services that we use to improve the load times of our website and to protect it from misuse. When you visit our website, a connection to CloudFlare’s servers is established, e.g. to retrieve content. Personal data may be stored and analyzed in server log files, especially the activity of the user (in particular, which pages have been visited) and device and browser information (in particular, the IP address and operating system). Further information on the collection and storage of data by CloudFlare can be found here: https://www.cloudflare.com/de-de/privacypolicy/. The use of CloudFlare’s functions serves to deliver and accelerate online applications and content. The collection of this data is based on Art. 6 para. 1 p. 1 lit. f DSGVO. The website operator has a legitimate interest in the technically error-free presentation and optimization of its websites – for this purpose, the server log files must be collected. Your personal information will be stored for as long as necessary to fulfill the purposes described in this privacy policy or as required by law. Information on objection and removal options vis-à-vis CloudFlare can be found at: https://www.cloudflare.com/de-de/privacypolicy/.
2.6.3 Links on Instagram, Facebook
On our websites, we advertise our presence on the social networks listed below. The integration takes place via a linked graphic of the respective network. The use of this linked graphic prevents the automatic establishment of a connection to the respective server of the social network when calling up a website that has a social media advertisement, in order to display a graphic of the respective network itself. Only by clicking on the corresponding graphic will the user be redirected to the service of the respective social network. After the user has been forwarded, information about the user is collected by the respective network. It cannot be ruled out here that processing of the data collected in this way takes place in the USA. This is initially data such as IP address, date, time and page visited. If the user is logged into his user account of the respective network during this time, the network operator may be able to assign the collected information of the specific visit of the user to the personal account of the user. If the user interacts via a “Share” button of the respective network, this information can be stored in the user’s personal user account and may be published. If the user wants to prevent the collected information from being directly assigned to his user account, he must log out before clicking on the graphic. In addition, it is possible to configure the respective user account accordingly. We have integrated on our Internet pages by linking: Facebook and Instagram of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, Facebook privacy policy: https://www.facebook.com/policy.php, Instagram privacy policy: https://instagram.com/about/legal/privacy/
3. Our social media presences
3.1 Platforms
We have presences on the following social media platforms:
We use the technical platform and services of the providers for these information services. We would like to point out that you use our appearances on social media platforms and their functions on your own responsibility. This applies in particular to the use of interactive functions (e.g. commenting, sharing, rating). When you visit our websites, the providers of the social media platforms collect, among other things, your IP address and other information that is stored in the form of cookies on your terminal device. This information is used to provide us, as operators of the accounts, with statistical information about interaction with us. The data collected about you in this context is processed by the platforms and may be transferred to countries outside the European Union, in particular the USA. According to their own statements, all of the aforementioned providers maintain an adequate level of data protection equivalent to that of the former EU-US Privacy Shield and we have concluded the standard data protection clauses with the companies. The following agreements are authoritative:Facebook: Facebook’s Terms of Service, the other terms and policies listed there at the end, and the Shared Responsibility Agreement,Instagram: Instagram Terms of Use, Instagram Data Policy, and, because Instagram is a Facebook offering, also the Facebook policies and agreements described above.We are not aware of how the social media platforms use the data from your visit to our account and interaction with our posts for their own purposes, how long this data is stored and whether data is passed on to third parties. Data processing may differ depending on whether you are registered and logged in to the social network or visit the site as a non-registered and/or non-logged-in user. When you access a post or the account, the IP address assigned to your terminal device is transmitted to the provider of the social media platform. If you are currently logged in as a user, a cookie on your end device can be used to track how you have moved around the network. Buttons embedded in websites enable the platforms to record your visits to these website pages and assign them to your respective profile. Based on this data, content or advertising can be offered tailored to you. If you wish to avoid this, you should log out or deactivate the “stay logged in” function, delete the cookies present on your device and restart your browser.
We, as the provider of the information service, also only process the data from your use of our service that you provide to us and that requires interaction. For example, if you ask a question that we can only answer by email, we will store your information in accordance with the general principles of our data processing, which we describe in this Privacy Policy. The legal basis for processing your data on the social media platform is Art. 6 (1) p. 1 lit. f DS-GVO.
To exercise your data subject rights, you can contact both us or the provider of the social media platform. Insofar as one party is not responsible for responding or must receive the information from the other party, we or the provider will then forward your request to the respective partner. Please contact the operator of the social media platform directly for questions about profiling, processing of your data when using the website. For questions about the processing of your interaction with us on our site, write to the contact details provided by us above.What information the social media platform receives and how it is used, the providers describe in their privacy statements (link see in the table above). There you will also find information on contact options as well as on the setting options for advertisements. You can also find more information about social networks and how to protect your data at www.youngdata.de.
