1 Introduction

​This data protection declaration informs you about the type, scope and purpose of the processing of personal data within our online offering and the websites, functions and content associated with it (hereinafter collectively referred to as the “online offering” or “website”) ) on. The data protection declaration applies regardless of the domains, systems, platforms and devices used (e.g. desktop or mobile) on which the online offering is run.

​

2.Responsible person

The person responsible within the meaning of the General Data Protection Regulation, other data protection laws applicable in the member states of the European Union and other provisions of a data protection nature is:

​

bemberg AG + Co KGaA

Steinhöft 9

20459 Hamburg

​

2.3.Personal data

Personal data is any information that relates to an identified or identifiable natural person (hereinafter “data subject”). A natural person is considered to be identifiable if he or she can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more special characteristics that express the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.

2.3.1. Affected person

Data subject is any identified or identifiable natural person whose personal data is processed by the data controller.

2.3.2. processing

Processing is any operation or series of operations carried out on personal data, whether or not by automated means, such as the collection, recording, organisation, structuring, storage, adaptation or modification, reading, querying, use, disclosure by transmission, distribution or other form of provision, alignment or association, restriction, deletion or destruction.

2.3.3. Restriction of processing

Restriction of processing is the marking of stored personal data with the aim of restricting their future processing.

2.3.4. Profiling

Profiling is any type of automated processing of personal data which consists in using these personal data to evaluate certain personal aspects relating to a natural person, in particular aspects relating to work performance, economic situation, health, personal Analyze or predict the preferences, interests, reliability, behavior, location or movements of that natural person.

2.3.5. Pseudonymization

Pseudonymization is the processing of personal data in such a way that the personal data can no longer be assigned to a specific data subject without the use of additional information, provided that this additional information is kept separately and is subject to technical and organizational measures that ensure that the personal data not be assigned to an identified or identifiable natural person.

2.3.6. Controller or person responsible for processing

The person responsible or responsible for processing is the natural or legal person, public authority, institution or other body which, alone or jointly with others, decides on the purposes and means of processing personal data. If the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

2.3.7.Processor

Processor is a natural or legal person, authority, institution or other body that processes personal data on behalf of the controller.

2.3.8.Recipient

The recipient is a natural or legal person, public authority, institution or other body to which personal data is disclosed, regardless of whether it is a third party or not. However, public authorities which may receive personal data in the context of a specific investigative task under Union or Member State law shall not be considered as recipients.

2.3.9.Third party

Third party is a natural or legal person, public authority, agency or other body other than the data subject, the controller, the processor and the persons authorized to process the personal data under the direct responsibility of the controller or the processor.

2.3.10.Consent

Consent is any voluntary, informed and unambiguous expression of wishes given by the data subject for a specific case, in the form of a statement or other unambiguous confirmatory act, by which the data subject indicates that he or she agrees to the processing of personal data concerning him or her is.

​

3.General information on data processing

3.1.Scope of processing personal data

As a general rule, we only collect and use personal data from our users to the extent that this is necessary to provide a functional website and our content and services. The collection and use of our users’ personal data regularly only takes place with the user’s consent. An exception applies in cases in which obtaining prior consent is not possible for actual reasons and the processing of the data is permitted by legal regulations.

3.2.Legal basis for processing personal data

1. To the extent that we obtain the consent of the data subject for processing personal data, Article 6 Paragraph 1 Letter a of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

2. When processing personal data that is necessary to fulfill a contract to which the data subject is a party, Art. 6 Para. 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.

3. To the extent that processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 Para. 1 lit. c GDPR serves as the legal basis.

4. In the event that the vital interests of the data subject or another natural person require the processing of personal data, Art. 6 Para. 1 lit. d GDPR serves as the legal basis.

5. If the processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 Para. 1 lit. f GDPR serves as the legal basis for this the processing.

3.3.Data deletion and storage period

1. The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Storage can also take place if this has been provided for by the European or national legislator in EU regulations, laws or other regulations to which the person responsible is subject.

2. The data will also be blocked or deleted if a storage period prescribed by the standards mentioned expires, unless there is a need for further storage of the data to conclude or fulfill a contract.

​

4.Technical and organizational measures

4.1. In order to ensure that personal data cannot be read, copied, changed or removed without authorization during electronic transmission, transport or storage on data carriers, we use a state-of-the-art encryption process in accordance with Article 9 of the GDPR.

4.2.This site uses Transport Layer Security (TLS) encryption for security reasons and to protect the transmission of confidential content, such as the requests you send to our system. Data that you transmit to our system cannot easily be read by third parties.

4.3.You can recognize an encrypted connection by the browser address line changing from "http://" to "https://" and by the lock symbol in your browser line.

​

5. Provision of the website and creation of log files

5.1.Description and scope of data processing

1. Every time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.

2. The following data is collected:

• Information about the browser type and version used

• the user's operating system

• the user's Internet service provider

• the date and time of access

• Websites from which the user's system accesses our website

• Websites that are accessed by the user's system via our website

​

The data is also stored in the log files of our system. This does not affect the user's IP addresses or other data that enables the data to be assigned to a user. This data is not stored together with other personal data of the user.

5.2.Legal basis for data processing

1. The legal basis for the temporary storage of the data is Article 6 (1) (f) GDPR.

5.4.Purpose of data processing

1. The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. To do this, the user's IP address must remain stored for the duration of the session.

2. These purposes also include our legitimate interest in data processing in accordance with Art. 6 Para. 1 lit. f GDPR.

5.7. Duration of storage

1. The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. If the data is collected to provide the website, this is the case when the respective session has ended.

5.9. Possibility of objection and removal

The collection of data to provide the website and the storage of the data in log files is absolutely necessary for the operation of the website. There is therefore no possibility for the user to object.

​

6.Use of cookies

6.1.Description and scope of data processing

1. We use so-called cookies on this website based on our legitimate interests. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's computer system. When a user accesses a website, a cookie can be stored on the user's operating system. This cookie contains a characteristic string that allows the browser to be uniquely identified when the website is accessed again.

2. We use cookies to make our website more user-friendly. Some elements of our website require that the accessing browser can be identified even after a page change.

3. The following data is stored and transmitted in the cookies:

• Items in a shopping cart

  1. We also use cookies on our website that enable analysis of users' surfing behavior.

  2. The following data can be transmitted in this way:

• Search terms entered

• Frequency of page views

• Use of website functions

  1. The user data collected in this way is pseudonymized using technical precautions. It is therefore no longer possible to assign the data to the accessing user. The data is not stored together with other personal data of the users.

  2. When accessing our website, users are informed about the use of cookies by an information banner and are referred to this data protection declaration. In this context, there is also a note on how the storage of cookies can be prevented in the browser settings.

  3. When accessing our website, the user is informed about the use of cookies for analysis purposes and his consent to the processing of the personal data used in this context is obtained. In this context, a reference is also made to this data protection declaration.

6.2.Legal basis for data processing

1. The legal basis for the processing of personal data using cookies is Art. 6 Para. 1 lit. f GDPR.

2. The legal basis for the processing of personal data using technically necessary cookies is Art. 6 Para. 1 lit. f GDPR.

3. The legal basis for the processing of personal data using cookies for analysis purposes, if the user has given his consent, is Art. 6 Para. 1 lit. a GDPR.

6.3.Purpose of data processing

1. The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For this it is necessary that the browser is recognized even after a page change.

2. The user data collected through technically necessary cookies is not used to create user profiles.

3. We need cookies for the following applications:

4. shopping cart

5. Remember search terms

6. The analysis cookies are used for the purpose of improving the quality of our website and its content. Through the analysis cookies we learn how the website is used and can therefore continually optimize our offering.

7. For these purposes, our legitimate interest also lies in the processing of personal data in accordance with Art. 6 Para. 1 lit. f GDPR.

6.4. Duration of storage, possibility of objection and removal

1. Cookies are stored on the user's computer and transmitted to our site by the user. Therefore, as a user, you also have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to fully use all functions of the website.

​

7.Newsletter

7.1.Description and scope of data processing

1. Based on our legitimate interests on this website, we offer our users the opportunity to subscribe to a free newsletter.

2. We only send newsletters, emails and other electronic notifications with promotional information (hereinafter “newsletter”) with the consent of the recipient or legal permission. When you register for the newsletter, the data from the input mask is transmitted to us.

3. If the contents are specifically described when registering for the newsletter, they are decisive for the user's consent. Our newsletters also contain information about our products, offers, promotions and our company.

4. The following user data is collected:

• the E-Mail adress

• the first and last name

  1. Your consent will be obtained for the processing of data as part of the registration process and reference will be made to this data protection declaration.

  2. Registration for our newsletter takes place in a so-called double opt-in process. This means that after registering you will receive an email asking you to confirm your registration. This confirmation is necessary so that no one can log in with someone else's email address. Registrations for the newsletter are logged in order to be able to provide evidence of the registration process in accordance with legal requirements. This includes storing the registration and confirmation times as well as the IP address. Changes to your data stored by the shipping service provider are also logged.

  3. If you purchase goods or services on our website and provide your email address, we may subsequently use it to send you a newsletter. In such a case, the newsletter will only be used to send direct advertising for similar goods or services.

  4. In connection with data processing for sending newsletters, the data will not be passed on to third parties. The data is used exclusively for sending the newsletter.

7.2.Legal basis for data processing

1. The legal basis for processing the data after the user has registered for the newsletter is Art. 6 Para. 1 lit. a GDPR if the user has given their consent.

2. The legal basis for sending the newsletter as a result of the sale of goods or services is Section 7 Paragraph 3 UWG.

3. The legal basis for the statistical surveys and analyzes is Article 6 (1) (f) GDPR.

7.3.Purpose of data processing

1. To register for the newsletter, all you need to do is enter your email address. The purpose of collecting the user's email address is to deliver the newsletter. Optionally, we ask you to provide a name so that you can be addressed personally in the newsletter.

2. The collection of other personal data as part of the registration process serves to prevent misuse of the services or the email address used.

3. The purpose of the statistical surveys is to use a user-friendly and secure newsletter system that serves our business interests and meets the expectations of users.

7.4. Duration of storage

1. The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. The user's email address is therefore stored as long as the subscription to the newsletter is active.

7.5. Possibility of objection and removal

1. The subscription to the newsletter can be canceled at any time by the affected user. For this purpose, there is a corresponding link in every newsletter.

2. This also makes it possible to revoke your consent to the storage of personal data collected during the registration process.

3. At the same time, your consent to the statistical analyzes expires. Unfortunately, a separate cancellation of shipping by the shipping service provider or statistical evaluation is not possible.

4. If users have only registered for the newsletter and canceled this registration, their personal data will be deleted.

​

8.Contact form and email contact

8.1.Description and scope of data processing

1. Based on our legitimate interests, we use a contact form on this website, which can be used for electronic contact. If a user takes advantage of this option, the data entered in the input mask will be transmitted to us and stored.

2. This data is:

• the E-Mail adress

• the first and last name

• address

• the telephone number

  1. Your consent will be obtained for the processing of the data as part of the sending process and reference will be made to this data protection declaration.

  2. Alternatively, you can contact us using the email address provided. In this case, the user's personal data transmitted with the email will be stored.

  3. In this context, the data will not be passed on to third parties. The data is used exclusively for processing the conversation.

8.2.Legal basis for data processing

1. The legal basis for processing the data, if the user has given his consent, is Art. 6 Para. 1 lit. a GDPR.

2. The legal basis for the processing of data transmitted in the course of sending an email is Art. 6 Para. 1 lit. f GDPR. If the e-mail contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 Para. 1 lit. b GDPR.

8.3.Purpose of data processing

1. We process the personal data from the input mask solely to process the contact. If you contact us via email, this also represents the necessary legitimate interest in processing the data.

8.4. Duration of storage

1. The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data from the input mask of the contact form and those that were sent by email, this is the case when the respective conversation with the user has ended. The conversation ends when it can be seen from the circumstances that the matter in question has been finally clarified.

8.5. Possibility of objection and removal

1. The user has the option to revoke his consent to the processing of personal data at any time. If the user contacts us by email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot continue.

2. In this case, all personal data that was stored in the course of contacting us will be deleted.

​

9.Google Analytics

9.1.Scope of processing personal data

1. Based on our legitimate interests, we use the web analysis service Google Analytics from Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA, (“Google”). It is used to analyze the surfing behavior of our users.

2. Google uses cookies. The information generated by the cookie about users' use of the online offering is usually transferred to a Google server in the USA and stored there.

3. By setting the cookie, Google is able to analyze the use of our website. Each time you access one of the individual pages of this website, which is operated by the controller and into which a Google Analytics component has been integrated, the Internet browser on the information technology system of the data subject is automatically triggered by the respective Google Analytics component to transmit data to Google for online analysis purposes. As part of this technical process, Google gains knowledge of personal data, such as the IP address of the data subject, which Google uses, among other things, to track the origin of visitors and clicks and subsequently enable commission billing.

4. The cookie is used to store personal information, such as the access time, the location from which access was made and the frequency of visits to our website by the data subject. Each time you visit our website, this personal data, including the IP address of the Internet connection used by the data subject, is transmitted to Google in the United States of America. This personal data is stored by Google in the United States of America. Google may pass on the personal data collected via the technical process to third parties.

5. If individual pages of our website are accessed, the following data is stored:

• Two bytes of the IP address of the user's calling system

• The website accessed

• The website from which the user accessed the website accessed (referrer)

• The subpages that are accessed from the website being accessed

• The time spent on the website

• The frequency of accessing the website

  1. Google is certified under the Privacy Shield Agreement and thereby offers a guarantee that it will comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).

  2. Google will use this information on our behalf to evaluate the use of our online offering by users, to compile reports on the activities within this online offering and to provide us with other services related to the use of this online offering and internet usage. Pseudonymous user profiles can be created from the processed data.

  3. The IP address transmitted by the user's browser is not merged with other Google data.

  4. We use Google Analytics to show the advertisements placed within the advertising services of Google and its partners only to those users who have also shown an interest in our online offering or who have certain characteristics (e.g. interests in certain topics or products) based on the information they visit websites) that we transmit to Google (so-called “remarketing” or “Google Analytics audiences”). With the help of remarketing audiences, we also want to ensure that our ads match the potential interest of users and do not appear annoying.

  5. We only use Google Analytics with IP anonymization activated. This means that the user's IP address is shortened by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there.

9.2.Legal basis for processing personal data

The legal basis for the processing of users' personal data is Article 6 Paragraph 1 Letter f GDPR.

9.3.Purpose of data processing

1. The processing of users' personal data enables us to analyze the surfing behavior of our users. By evaluating the data obtained, we are able to compile information about the use of the individual components of our website. This helps us to continually improve our website and its user-friendliness. For these purposes, we also have a legitimate interest in processing the data in accordance with Article 6 Paragraph 1 Letter f GDPR.

2. By anonymizing the IP address, the user's interest in protecting personal data is sufficiently taken into account.

9.4. Duration of storage

1. The data will be deleted as soon as it is no longer required for our recording purposes.

In our case this is the case after 26 months.

9.5. Possibility of objection and removal

1. Cookies are stored on the user's computer and transmitted to our site and Google. Therefore, as a user, you also have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to fully use all functions of the website.

2. Users can prevent the storage of cookies by setting their browser software accordingly; Users can also prevent Google from collecting the data generated by the cookie and relating to their use of the online offering and from processing this data by Google by downloading and installing the browser plug-in available at the following link:http://tools.google.com/dlpage/gaoptout?hl=de.

This browser plug-in tells Google Analytics via JavaScript that no data or information about website visits may be transmitted to Google Analytics. Installing the browser plugin is viewed by Google as a contradiction. If the data subject's information technology system is deleted, formatted or reinstalled at a later date, the data subject must reinstall the browser plug-in in order to deactivate Google Analytics. If the browser add-on is uninstalled or deactivated by the data subject or another person within their control, it is possible to reinstall or reactivate the browser plug-in.

​

10.Facebook

10.1.Description and scope of data processing

1. Based on our legitimate interests, we use social plugins ("plugins") from the social network facebook.com, which is operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook").

2. The plugins can display interaction elements or content (e.g. videos, graphics or text posts) and can be recognized by one of the Facebook logos (white “f” on a blue tile, the terms “Like”, “Like” or a “thumbs up” sign ) or are marked with the addition “Facebook Social Plugin”. The list and appearance of the Facebook social plugins can be viewed here:https://developers.facebook.com/docs/plugins/.

3. Facebook is certified under the Privacy Shield Agreement and thereby offers a guarantee that it will comply with European data protection law

(https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active).

1. When a user accesses a function of this online offering that contains such a plugin, their device establishes a direct connection to the Facebook servers. The content of the plugin is transmitted by Facebook directly to the user's device and integrated into the online offering. User usage profiles can be created from the processed data. We therefore have no influence on the amount of data that Facebook collects with the help of this plugin and therefore inform users according to our level of knowledge.

2. By integrating the plugins, Facebook receives the information that a user has accessed the corresponding page of the online offering. If the user is logged in to Facebook, Facebook can assign the visit to their Facebook account. When users interact with the plugins, for example by clicking the Like button or leaving a comment, the corresponding information is transmitted from your device directly to Facebook and stored there. If a user is not a member of Facebook, there is still the possibility that Facebook will find out and store their IP address. According to Facebook, only an anonymized IP address is stored in Germany.

10.2.Legal basis for data processing

The legal basis for the processing of users' personal data is Article 6 Paragraph 1 Letter f GDPR.

10.3.Purpose of data processing

1. The data processing is carried out in the interest of the analysis, optimization and economic operation of the online offering.

2. The purpose and scope of data collection and the further processing and use of the data by Facebook as well as the related rights and setting options to protect the privacy of users can be found in Facebook's data protection information:https://www.facebook.com/about/privacy/.

10.4. Duration of storage

1. The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected.

10.5. Possibility of objection and removal

1. If a user is a Facebook member and does not want Facebook to collect data about them via this online offering and link it to their member data stored on Facebook, they must log out of Facebook and delete their cookies before using our online offering.

​

11. Facebook, Custom Audiences and Facebook Marketing Services

11.1.Description and scope of data processing

1. Within our online offering, due to our legitimate interests in the analysis, optimization and economic operation of our online offering and for these purposes, the so-called "Facebook pixel" of the social network Facebook, which is operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025 , USA, or if you are based in the EU, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook") is used.

Facebook is certified under the Privacy Shield Agreement and thereby offers a guarantee that it will comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active).

1. With the help of the Facebook pixel, Facebook is able to determine the visitors to our online offering as a target group for the display of advertisements (so-called “Facebook ads”). Accordingly, we use the Facebook pixel to only show the Facebook ads we place to those Facebook users who have shown an interest in our online offering or who have certain characteristics (e.g. interests in certain topics or products) based on the information they visit websites) that we transmit to Facebook (so-called “Custom Audiences”). With the help of the Facebook pixel, we also want to ensure that our Facebook ads correspond to the potential interest of the users and do not appear annoying. With the help of the Facebook pixel, we can also understand the effectiveness of Facebook advertisements for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook advertisement (so-called “conversion”).

2. The Facebook pixel is integrated directly by Facebook when you access our website and can store a so-called cookie, i.e. a small file, on your device. If you then log in to Facebook or visit Facebook while logged in, your visit to our online offering will be noted in your profile. The data collected about you is anonymous to us, so it does not allow us to draw any conclusions about the identity of the user. However, the data is stored and processed by Facebook so that a connection to the respective user profile is possible and can be used by Facebook and for its own market research and advertising purposes. If we transmit data to Facebook for comparison purposes, it will be encrypted locally in the browser and only then sent to Facebook via a secure https connection. This is done solely for the purpose of comparing data with the same data encrypted by Facebook.

3. Also based on our legitimate interests, we use the “Custom Audiences from File” procedure of the social network Facebook, Inc. In this case, the email addresses of the newsletter recipients are uploaded to Facebook. The upload process is encrypted. The upload is used solely to determine recipients of our Facebook ads. We want to ensure that the ads are only shown to users who are interested in our information and services.

4. The processing of data by Facebook takes place within the framework of Facebook's data usage policy. Accordingly, general information on the display of Facebook ads in Facebook's data usage guidelines:https://www.facebook.com/policy.php. You can find specific information and details about the Facebook Pixel and how it works in the Facebook help section:https://www.facebook.com/business/help/651294705016616.

11.2.Legal basis for data processing

The legal basis for the processing of users' personal data is Article 6 Paragraph 1 Letter f GDPR.

11.3.Purpose of data processing

The data processing is carried out in the interest of the analysis, optimization and economic operation of the online offering.

1. The purpose and scope of data collection and the further processing and use of the data by Facebook as well as the related rights and setting options to protect the privacy of users can be found in Facebook's data protection information:https://www.facebook.com/about/privacy/.

11.4. Duration of storage

1. The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected.

11.5. Possibility of objection and removal

1. You can object to the collection by the Facebook pixel and the use of your data to display Facebook ads. To set which types of advertisements are shown to you within Facebook, you can go to the page set up by Facebook and follow the instructions there on the settings for usage-based advertising:https://www.facebook.com/settings?tab=ads. The settings are platform-independent, i.e. they are applied to all devices, such as desktop computers or mobile devices.

2. You can also opt out of the use of cookies, which are used to measure reach and for advertising purposes, via the deactivation page of the Network Advertising Initiative (http://optout.networkadvertising.org/) and also the US website (http://www.aboutads.info/choices) or the European website (http://www.youronlinechoices.com/uk/your-ad-choices/) contradict.

​

12.PayPal

12.1.Description and scope of data processing

1. Based on our legitimate interests, we use components of the PayPal service from the provider PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg (“PayPal”).

2. PayPal is an online payment service provider. Payments are processed via so-called PayPal accounts, which represent virtual private or business accounts. PayPal also offers the option of processing virtual payments via credit cards if a user does not have a PayPal account. A PayPal account is managed via an email address, which is why there is no traditional account number. PayPal makes it possible to initiate online payments to third parties or to receive payments. PayPal also assumes trustee functions and offers buyer protection services.

3. If the data subject selects “PayPal” as a payment option during the ordering process in our online shop, the data of the data subject is automatically transmitted to PayPal. By selecting this payment option, the data subject consents to the transmission of personal data required for payment processing.

4. The personal data transmitted to PayPal is usually:

• the first and last name

• the E-Mail adress

• the IP address

• the telephone number and/or mobile phone number

or other data necessary for payment processing. In order to process the purchase contract, personal data that is related to the respective order is also necessary.

1. The personal data exchanged between PayPal and the person responsible for processing may be transmitted by PayPal to credit reporting agencies. A list of third parties to whom personal data may be released by PayPal can be found athttps://www.paypal.com/de/webapps/mpp/ua/third-parties-list?locale.x=de_DE can be viewed.

2. PayPal may pass on the personal data to affiliated companies and service providers or subcontractors to the extent that this is necessary to fulfill contractual obligations or the data is to be processed in the order.

12.2.Legal basis for data processing

The legal basis for the processing of users' personal data is Article 6 Paragraph 1 Letter f GDPR.

12.3.Purpose of data processing

1. The data processing is carried out in the interest of the analysis, optimization and economic operation of the online offering.

2. The purpose of transmitting the data to PayPal is to process payments and prevent fraud. The person responsible for processing will transmit personal data to PayPal in particular if there is a legitimate interest in the transmission.

3. The purpose of transmitting data to credit reporting agencies is to check identity and creditworthiness.

4. The purpose and scope of data collection and the further processing and use of the data by PayPal can be found in PayPal's data protection declaration athttps://www.paypal.com/de/webapps/mpp/ua/privacy-full  be removed.

12.4. Duration of storage

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected.

12.5. Possibility of objection and removal

1. The data subject has the option to revoke their consent to the handling of personal data at any time from PayPal.

2. A revocation does not affect personal data that must be processed, used or transmitted for (contractual) payment processing.

​​