Privacy Policy
Disclaimer regarding English translations
The English translations of our legal documents (including but not limited to our Terms and Conditions, Privacy Policy, and Return Policy) are provided for convenience and informational purposes only. They do not constitute legally binding documents. In the event of any discrepancies or inconsistencies between the English version and the original German version, the German version shall prevail and is legally binding under applicable laws. We accept no liability for errors, omissions, or misunderstandings resulting from the translation.
1) Introduction and Contact Details of the Controller
1.1 We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about how we handle your personal data when you use our website. Personal data means any information relating to an identified or identifiable natural person.
1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Luméa UG (haftungsbeschränkt), Am Hauptbahnhof 16, 60329 Frankfurt am Main, Germany, Phone: +496924746032, Email: info@lumeafragrances.com. The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.
2) Data Collection When Visiting Our Website
2.1 When you visit our website for informational purposes only, meaning without registering or otherwise transmitting information to us, we only collect the data that your browser transmits to our server (so-called „server log files“). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:
- Our visited website
- Date and time of access
- Amount of data sent in bytes
- Source/referrer from which you accessed the page
- Browser used
- Operating system used
- IP address used (possibly in anonymized form)
The processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. This data is not disclosed or used in any other way. However, we reserve the right to subsequently review the server log files if there are specific indications of unlawful use.
2.2 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries). You can recognize an encrypted connection by the character string „https://“ and the lock symbol in your browser's address bar.
3) Hosting & Content Delivery Network
3.1 Shopify
For hosting our website and displaying the content, we use the services of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland („Shopify“).
Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.
All data collected on our website is processed on the provider’s servers. We have entered into a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.
In the event of data transfer to Canada, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.
3.2 Cloudflare
We use a content delivery network (CDN) provided by: Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA
This service helps us deliver large media files such as graphics, page content, or scripts more quickly via a network of regionally distributed servers. Processing is based on our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6(1)(f) GDPR. We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.
For data transfers to the USA, the provider is certified under the EU-U.S. Data Privacy Framework, which ensures compliance with the European level of data protection based on an adequacy decision by the European Commission.
3.3 Shopify
We use a content delivery network (CDN) provided by: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”)
Data may also be transferred to:
- Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada
- Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA
This service helps us deliver large media files such as graphics, page content, or scripts more quickly via a network of regionally distributed servers. Processing is based on our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6(1)(f) GDPR. We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.
For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision by the European Commission.
For data transfers to the USA, the provider is certified under the EU-U.S. Data Privacy Framework, which ensures compliance with the European level of data protection based on an adequacy decision by the European Commission.
4) Cookies
To make your visit to our website attractive and to enable the use of certain functions, we use cookies—small text files that are stored on your device. Some of these cookies are deleted automatically after you close your browser (so-called „session cookies“), while others remain on your device for a longer period and enable the saving of page settings (so-called „persistent cookies“). You can find the storage duration in your browser's cookie settings overview.
If personal data is also processed by individual cookies we use, the processing takes place in accordance with Art. 6(1)(b) GDPR for contract execution, in accordance with Art. 6(1)(a) GDPR if consent has been given, or in accordance with Art. 6(1)(f) GDPR to safeguard our legitimate interest in the best possible functionality of the website and a user-friendly and effective design of the site visit.
You can configure your browser so that you are informed about the setting of cookies and can decide individually on their acceptance or exclude the acceptance of cookies for certain cases or in general.
Please note that if cookies are not accepted, the functionality of our website may be limited.
5) Contact
5.1 Shopify Inbox
This website uses the live chat system provided by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.
Personal data transmitted via the chat is processed either pursuant to Art. 6(1)(b) GDPR, where such processing is necessary for the initiation or performance of a contract, or pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in providing effective support to visitors to our website. Data transmitted in this context will be deleted once the relevant matter has been conclusively resolved, unless statutory retention obligations require otherwise.
In addition, further information may be collected and analysed for the purpose of creating pseudonymised usage profiles using cookies. This information is not used to personally identify you and will not be merged with any other data sets. To the extent that such information constitutes personal data, processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the statistical analysis of user behaviour for optimisation purposes.
The placement of cookies may be prevented by adjusting your browser settings accordingly; however, this may result in limited functionality of our website. You may object at any time, with effect for the future, to the collection and storage of data for the purpose of creating a pseudonymised usage profile.
Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.
We have entered into a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits any unauthorised disclosure to third parties.
With regard to data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.
5.2 Judge.me
For review reminders, we use the services of the following provider: Judge.me Ltd., c/o Buckworths, 2nd Floor, 1-3 Worship Street, London, England, EC2A 2AB, United Kingdom
Based solely on your express consent pursuant to Art. 6(1)(a) GDPR, we transmit your email address and, if applicable, other customer data to the provider so that they may contact you via email with a review reminder.
You may revoke your consent at any time with future effect, either by informing us or by contacting the provider directly.
We have entered into a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.
In the event of data transfer to the provider’s location, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.
5.3 When contacting us (e.g., via contact form or email), personal data is collected solely for the purpose of processing and responding to your inquiry and only to the extent necessary for that purpose.
The legal basis for processing this data is our legitimate interest in responding to your request pursuant to Art. 6(1)(f) GDPR. If your inquiry is aimed at concluding a contract, the additional legal basis for the processing is Art. 6(1)(b) GDPR. Your data will be deleted once it is evident that the relevant issue has been conclusively resolved and provided there are no statutory retention obligations.
6) Data Processing When Opening a Customer Account
In accordance with Art. 6(1)(b) GDPR, personal data is collected and processed to the extent necessary when you provide it to us for the purpose of opening a customer account. The specific data required for account creation is indicated in the input fields of the relevant form on our website.
You may delete your customer account at any time by sending a message to the controller using the contact details provided above. After your customer account is deleted, your data will also be deleted—provided that all contracts concluded through the account have been fully processed, no legal retention obligations apply, and there is no legitimate interest on our part in continuing to store the data.
7) Use of Customer Data for Direct Advertising
7.1 Subscription to Our Email Newsletter
When you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information required for sending the newsletter is your email address. Providing additional data is voluntary and will be used to address you personally. We use the so-called double opt-in procedure to ensure that you only receive the newsletter once you have explicitly confirmed your consent via a verification link sent to the provided email address.
By activating the confirmation link, you give us your consent to use your personal data pursuant to Art. 6(1)(a) GDPR. As part of this process, we store your IP address as entered by your internet service provider (ISP), as well as the date and time of registration, in order to trace any possible misuse of your email address at a later date. The data collected when registering for the newsletter is used strictly for the intended purpose.
You may unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending a corresponding message to the controller mentioned above. After unsubscribing, your email address will be immediately deleted from our newsletter distribution list unless you have expressly consented to further use of your data, or we reserve the right to use your data beyond this, where legally permitted and as informed in this statement.
7.2 Klaviyo
We send our email newsletters via the following provider: Klaviyo, Inc., 125 Summer St., Ste 600, Boston, MA 02110, USA.
Based on our legitimate interest in effective and user-friendly newsletter marketing, we transmit the data you provided during newsletter registration to this provider pursuant to Art. 6(1)(f) GDPR so that they can send the newsletter on our behalf.
Provided you have given your express consent pursuant to Art. 6(1)(a) GDPR, the provider also conducts statistical evaluation of newsletter campaigns via web beacons or tracking pixels embedded in the emails. These allow us to measure open rates and specific user interactions with newsletter content. Device information (e.g., time of access, IP address, browser type, operating system) may also be collected and analyzed, but not combined with other datasets.
You may withdraw your consent to this tracking at any time with future effect.
We have entered into a data processing agreement with the provider, ensuring the protection of our website visitors' data and prohibiting unauthorized disclosure to third parties.
For data transfers to the USA, the provider is certified under the EU-U.S. Data Privacy Framework, which guarantees compliance with the European level of data protection based on an adequacy decision by the European Commission.
7.3 Abandoned Cart Email Reminders
If you begin but do not complete a purchase in our online shop, you may receive a one-time email reminder about the contents of your virtual shopping cart.
Only your email address is required for sending this reminder. Providing additional data is voluntary and may be used to address you personally. We use the double opt-in method to ensure that you receive the reminder only after explicitly confirming your consent via a link sent to your email address.
By activating the confirmation link, you give us your consent to use your personal data pursuant to Art. 6(1)(a) GDPR to send you a cart reminder. As part of this process, we store your IP address (as assigned by your ISP) and the date and time of registration to trace any potential misuse of your email address.
You can unsubscribe from cart reminders at any time by contacting the controller as indicated above. After unsubscribing, your email address will be immediately removed from the cart reminder list unless you have expressly consented to further use of your data, or we reserve the right to use your data beyond this, where legally permitted and as described in this statement.
8) Data Processing for Order Fulfillment
8.1 To the extent necessary for the performance of the contract for delivery and payment purposes, we pass on the personal data collected by us to the commissioned transport company and the commissioned credit institution pursuant to Art. 6(1)(b) GDPR.
If, based on a corresponding contract, we owe you updates for goods with digital elements or for digital products, we will use the contact details you provided when placing the order (name, address, email address) to inform you personally about upcoming updates within the legally prescribed period via an appropriate communication channel (e.g., by post or email), in accordance with our legal information obligations pursuant to Art. 6(1)(c) GDPR. Your contact details will be used strictly for notifications about updates owed by us and will only be processed to the extent necessary for this purpose.
To process your order, we also work with the following service provider(s) who support us in fulfilling the concluded contracts in whole or in part. Certain personal data will be transmitted to these service providers in accordance with the following information.
8.2 Disclosure of Personal Data to Shipping Providers
- DHL
We use the following shipping service provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany
We may pass on your email address and/or telephone number to the provider prior to delivery in accordance with Art. 6(1)(a) GDPR for the purpose of coordinating a delivery date or delivery notification, provided that you have given your express consent during the ordering process. Otherwise, we will only share the name of the recipient and the delivery address with the provider for the purpose of delivery in accordance with Art. 6(1)(b) GDPR. The disclosure only takes place to the extent necessary for the delivery of the goods. In this case, prior coordination of the delivery date or delivery notification with the provider is not possible.
You may withdraw your consent at any time with future effect by notifying either the controller or the shipping provider.
8.3 Use of Payment Service Providers (Payment Services)
Apple Pay
If you choose the payment method "Apple Pay" from Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, the payment process is handled via the "Apple Pay" function of your iOS, watchOS, or macOS device using a payment card stored in "Apple Pay". Apple Pay uses security features integrated into your device’s hardware and software to protect your transactions. To authorize a payment, you must enter a code you have previously set and verify using your device's Face ID or Touch ID functionality.
For the purpose of payment processing, the information you provide during the checkout process, along with information about your order, is transmitted in encrypted form to Apple. Apple then re-encrypts the data with a developer-specific key before transmitting it to the payment service provider associated with your stored Apple Pay card. This encryption ensures that only the website through which the purchase was made can access the payment data. After the payment, Apple sends your device account number and a transaction-specific dynamic security code to the originating website to confirm the payment success.
Where personal data is processed in the course of these transmissions, processing is carried out solely for the purpose of payment processing pursuant to Art. 6(1)(b) GDPR.
Apple stores anonymized transaction data, such as the approximate purchase amount, date and time, and whether the transaction was successful. These anonymized data cannot be traced back to any individual and are used by Apple to improve „Apple Pay“ and other Apple products and services.
If you use Apple Pay on your iPhone or Apple Watch to complete a purchase on Safari using your Mac, your Mac and the authorization device communicate via an encrypted channel on Apple’s servers. Apple does not process or store any of this information in a personally identifiable format. You can disable the ability to use Apple Pay on your Mac in your iPhone settings under "Wallet & Apple Pay" by turning off "Allow Payments on Mac."
More information on Apple Pay's privacy practices can be found here: https://support.apple.com
Google Pay
If you choose the payment method "Google Pay" by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), the payment is processed via the "Google Pay" app on your mobile device running at least Android 4.4 ("KitKat") with NFC functionality. It charges a payment card stored in Google Pay or a verified payment system (e.g., PayPal). To authorize a payment over 25 €, your device must be unlocked using a verification method (e.g., face recognition, password, fingerprint, or pattern).
For the purpose of payment processing, the data you provide during checkout, along with information about your order, is transmitted to Google. Google then transmits your stored payment data as a one-time transaction number to the website to confirm the payment. This number does not include real card details but is instead a one-time numerical token.
If personal data is processed in connection with the aforementioned transmissions, such processing is carried out solely for the purpose of payment processing in accordance with Art. 6(1)(b) GDPR.
Google reserves the right to collect, store, and evaluate certain transaction-specific information for every transaction made via Google Pay. This may include the date, time, and amount of the transaction, the merchant's location and description, a description of the goods or services purchased provided by the merchant, photos you have attached to the transaction, the names and email addresses of the seller and buyer or sender and recipient, the payment method used, your description of the transaction purpose, and any offers associated with the transaction.
According to Google, this processing is carried out solely on the basis of Art. 6(1)(f) GDPR, based on the legitimate interest in proper billing, verifying transaction data, and maintaining and optimizing the functionality of the Google Pay service.
Google also reserves the right to combine the processed transaction data with other information collected and stored when using other Google services.
You can find the Google Pay Terms of Service here:
https://payments.google.com
Further information about data protection in connection with Google Pay can be found here:
https://payments.google.com
Klarna
This website offers one or more online payment methods from the following provider: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden.
If you choose a Klarna payment method that involves an upfront payment (e.g., credit card), the payment data you provide during the order process (including name, address, bank and card information, currency, and transaction number), as well as information about your order, will be transmitted to the provider pursuant to Art. 6(1)(b) GDPR. Your data will only be shared to the extent necessary for the purpose of processing the payment.
If you select a Klarna payment method where Klarna provides upfront service (e.g., invoice purchase, installment purchase, or direct debit), you will be asked during the checkout process to provide certain personal data (full name, street, house number, postal code, city, date of birth, email address, phone number, and potentially information about an alternative payment method).
To safeguard our legitimate interest in assessing the creditworthiness of our customers, this data is forwarded to Klarna for the purpose of a credit check, pursuant to Art. 6(1)(f) GDPR. Klarna evaluates whether the payment option selected can be granted based on your personal data and other information (such as the shopping cart, invoice amount, order history, and previous payment experiences).
In addition to Klarna’s internal criteria, identity and creditworthiness information from the following credit agencies may also be used in the assessment process, pursuant to Art. 6(1)(f) GDPR:
https://cdn.klarna.com
The credit report may include score values (so-called "score values"). Where score values are included in the result of the credit check, they are based on a scientifically recognized mathematical-statistical procedure. Address data, among other things, may be included in the score calculation.
You may object to this processing of your data at any time by contacting us or Klarna. However, Klarna may still process your personal data if it is necessary to carry out the contractual payment process.
Paypal
This website offers one or more online payment methods from the following provider: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.
If you choose a payment method from the provider in which you make an advance payment, the payment data you provide during the ordering process (including name, address, bank and card information, currency, and transaction number), as well as details of your order, will be transferred to the provider pursuant to Art. 6(1)(b) GDPR. The data is transmitted solely for the purpose of payment processing and only to the extent necessary.
If you choose a payment method in which we make an advance payment (e.g., invoice purchase), you will also be asked during the checkout process to provide certain personal information (full name, street, house number, postal code, city, date of birth, email address, phone number, and, where applicable, data relating to an alternative payment method).
To safeguard our legitimate interest in assessing your creditworthiness in such cases, this data is transmitted to the provider for the purpose of a credit check pursuant to Art. 6(1)(f) GDPR. The provider assesses, based on your submitted personal data and additional data (such as shopping cart content, invoice amount, order history, and previous payment experiences), whether the payment option selected can be granted with regard to payment and/or default risks.
The credit report may include probability values (so-called "score values"). If score values are included in the credit check result, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of score values may include, among other things, address data.
You may object to this data processing at any time by notifying us or the provider. However, the provider may still be entitled to process your personal data if it is necessary for contractual payment processing.
Shopify Payments
This website offers one or more online payment methods via the following provider: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.
If you select a payment method offered by this provider in which you make an advance payment (e.g., credit card payment), the payment data you provide during the order process (including name, address, bank and card information, currency, and transaction number), as well as information about the content of your order, will be transmitted to the provider pursuant to Art. 6(1)(b) GDPR. This data is transmitted solely for the purpose of payment processing and only to the extent necessary for this purpose.
8.4 Electronic Withdrawal Function for Distance Contracts
Consumers who conclude contracts on this website that are subject to a statutory right of withdrawal have the option to declare their withdrawal via an electronic withdrawal function in accordance with the applicable withdrawal provisions.
When using the withdrawal function, in addition to details identifying the contract to be withdrawn, further personal information such as the consumer's first and last name as well as their email address must be provided or confirmed.
The collection of this information and its transmission to us is carried out in accordance with Art. 6(1)(b) GDPR and only to the extent necessary for the proper processing of the withdrawal. Also on the basis of Art. 6(1)(b) GDPR, the personal data provided is used to confirm receipt of the withdrawal declaration by email. A further legal basis for the processing is Art. 6(1)(c) GDPR. We are legally obliged to maintain an electronic withdrawal function for paid consumer distance contracts.
9) Online-Marketing
Goaffpro
We participate in the affiliate program of the following provider: Oxybit Enterprises Pvt Ltd, 16, Sector 20, Part 1, HUDA, Sirsa, Haryana -125055, India
In this context, we have placed links on our website that lead to offers on websites of the provider or third parties („partner sites“).
To track the success of an affiliate link, analyze orders generated via such links, and manage corresponding commission payments, the provider uses cookies and/or comparable technologies. These are typically placed on the partner sites and are not within our responsibility under data protection law. As part of this process, the provider may process your IP address and, if applicable, additional device information.
All processing activities described above—particularly the reading or storage of information on the device you are using—are carried out only if you have given your explicit consent in accordance with Art. 6(1)(a) GDPR. You may revoke your consent at any time with effect for the future by using the cookie consent management options provided on the respective partner sites.
10) Web Analytics Services
10.1 Google Analytics 4
Our website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which enables analysis of your use of our website.
By default, when you visit the website, cookies are set by Google Analytics 4. These are small text modules placed on your device that collect certain information. This includes your IP address, which is shortened by Google before being stored to exclude direct personal reference.
The information is transmitted to Google's servers and further processed there. Transfers to Google LLC in the USA are also possible.
Google uses the collected information on our behalf to evaluate your use of the website, to compile reports on website activity for us, and to provide further services related to website usage and internet usage. The IP address transmitted by your browser as part of Google Analytics and shortened is not merged with other Google data. Data collected using Google Analytics 4 is stored for two months and then deleted.
All of the processing described above, particularly the placement of cookies on your device, is carried out only with your express consent pursuant to Art. 6(1)(a) GDPR. Without your consent, Google Analytics 4 will not be used during your visit. You can revoke your consent at any time with effect for the future by deactivating this service via the "cookie consent tool" provided on the website.
We have concluded a data processing agreement with Google to ensure the protection of our website visitors’ data and to prohibit unauthorized data sharing with third parties.
Further legal information about Google Analytics 4 can be found at https://business.safety.google
Demographic Features
Google Analytics 4 uses the special "demographic features" function and can create statistics about the age, gender, and interests of website visitors. This is done through the analysis of advertising and third-party information. This allows marketing target groups to be identified. The collected data cannot be assigned to any specific person and is deleted after two months.
Google Signals
As an extension to Google Analytics 4, this website may use Google Signals to create cross-device reports. If you have enabled personalized ads and linked your devices to your Google account, Google may analyze your usage behavior across devices and create database models for cross-device conversions with your consent under Art. 6(1)(a) GDPR. We do not receive personal data from Google, only statistics. You can deactivate cross-device analysis by turning off "personalized advertising" in your Google account settings: https://support.google.com
UserIDs
As an extension to Google Analytics 4, the "UserIDs" feature may be used on this website. If you have consented under Art. 6(1)(a) GDPR, created an account on this site, and logged in from multiple devices, your activities—including conversions—can be analyzed across devices.
User-Provided Data Collection
To improve analytics for users whose contact details we have obtained from business relationships, we use the "user-provided data collection" feature. Subject to your consent under Art. 6(1)(a) GDPR, we electronically transmit one or more files with aggregated customer data (mainly email and phone number) to Google. Google encrypts this information automatically using a special algorithm and can only assign it to existing Google accounts. This improves cross-device tracking and supports ad personalization and conversion tracking in Google Ads. You can withdraw your consent at any time. More information: https://support.google.com
For data transfers to the USA, the provider is certified under the EU-US Data Privacy Framework, ensuring an adequate level of data protection.
10.2 Shopify Analytics
This website uses the analytics service provided by: Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland.
Data may also be transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.
Using cookies and/or similar technologies (tracking pixels, web beacons, algorithms to read device/browser information), the service collects and stores pseudonymized visitor data, including device information such as IP address and browser info, for statistical analysis of user behavior and to create pseudonymized user profiles. Movement patterns (e.g., heatmaps), page visit durations, and interactions with content (e.g., form inputs, scrolling, clicks, mouseovers) may be evaluated. Direct identification of individuals is excluded. No merging with other data takes place.
All processing described above, including accessing or storing information on your device, is only carried out with your express consent pursuant to Art. 6(1)(a) GDPR. Consent can be revoked at any time via the cookie consent tool.
We have concluded a data processing agreement with the provider to protect visitor data and prevent unauthorized sharing.
For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.
11) Retargeting/Remarketing and Conversion Tracking
11.1 Meta Pixel with Enhanced Data Matching
Within our online offering, we use the "Meta Pixel" service in enhanced data matching mode, provided by the following provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Meta").
If you click on one of our ads on Facebook or Instagram, the URL of our linked page is extended by a parameter via "Meta Pixel". After redirection, this URL parameter is entered into your browser through a cookie set by our linked page. This cookie also captures specific customer data such as your email address, which we collect on our website linked with the Facebook or Instagram ad during actions like purchases, account logins, or registrations (enhanced data matching). The cookie is then read and allows the transmission of data, including your specific customer data, to Meta.
We use "Meta Pixel" with enhanced data matching to make our ads on Facebook and/or Instagram more effective and to ensure they align with your interests or contain certain characteristics (e.g., interests in specific topics or products determined from visited websites) that we share with Meta (so-called "Custom Audiences").
Furthermore, we analyze the effectiveness of our ads by tracking whether users are redirected to our website after clicking an ad (conversion). Compared to the standard version of "Meta Pixel", the enhanced data matching feature helps us better measure the effectiveness of our campaigns by capturing more attributed conversions.
All transmitted data is stored and processed by Meta, making it possible to associate the data with individual user profiles. Meta may use the data for its own advertising purposes according to Meta's Data Policy (https://www.facebook.com
All processing described above, especially setting cookies to read information on the device used, only occurs if you have given us your express consent under Art. 6(1)(a) GDPR. You can revoke your consent at any time with future effect by deactivating this service via the "cookie consent tool" provided on the website.
We have concluded a data processing agreement with the provider to ensure the protection of our website visitors’ data and to prohibit unauthorized disclosure to third parties.
The information generated by Meta is usually transmitted to a Meta server and stored there; in this context, data transfers to Meta Platforms Inc. in the USA may also occur.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with European data protection standards based on an adequacy decision by the European Commission.
11.2 Google Ads Conversion-Tracking
This website uses the online advertising program "Google Ads" and, within that framework, the conversion tracking service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").
We use Google Ads to promote our attractive offers on external websites through advertising (so-called Google Ads). By analyzing the data from our ad campaigns, we can assess how successful each advertising measure is. Our goal is to show you ads that are relevant to your interests, make our website more appealing, and ensure fair billing of advertising costs.
A conversion tracking cookie is set when you click on a Google Ads ad. Cookies are small text files stored on your device. These cookies usually expire after 30 days and do not serve to personally identify you. If you visit certain pages on our site and the cookie is still valid, Google and we can recognize that you clicked on the ad and were redirected to our page. Each Google Ads customer receives a different cookie, so cookies cannot be tracked across the websites of different Google Ads customers. The information collected using the conversion cookie is used to generate conversion statistics for Google Ads customers who have opted in to conversion tracking. Customers receive information such as the total number of users who clicked on their ad and were redirected to a page tagged with a conversion tracking pixel. However, they do not receive any information that personally identifies users.
In the context of using Google Ads, personal data may also be transferred to the servers of Google LLC in the United States.
Details about the data processing triggered by Google Ads Conversion Tracking and Google’s handling of data from websites can be found here: https://policies.google.com
All processing described above – particularly the setting of cookies to read information on your device – will only take place if you have given us your express consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with future effect by deactivating this service via the “Cookie Consent Tool” provided on our website.
You can also permanently opt out of cookies being set by Google Ads Conversion Tracking by downloading and installing the browser plug-in available at the following link: https://www.google.com
To target users whose contact details we have received through business or similar relationships with more relevant advertising, we use the Google Ads “Customer Match” feature. For this purpose, we transmit one or more files with aggregated customer data (mainly email addresses and phone numbers) electronically to Google. Google does not receive access to plain-text data but encrypts the information automatically during the transmission process using a special algorithm. These encrypted data can only be used by Google to match them to existing Google accounts. This enables the display of personalized advertising across all Google services linked to the respective Google account.
Customer data is only transmitted to Google if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. You can withdraw this consent at any time with future effect. More information about Google’s privacy measures regarding Customer Match can be found here: https://support.google.com
For data transfers to the United States, Google is certified under the EU-US Data Privacy Framework, which ensures compliance with European data protection standards based on an adequacy decision by the European Commission.
11.3 TikTok Pixel
This website uses the conversion tracking technology of the following provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.
If you arrived on our website via an advertisement displayed on TikTok’s domain, cookies and/or similar technologies (such as tracking pixels, web beacons, pings, or HTTP requests) may be used to evaluate the success of the advertisement.
The tracking technology collects certain device and browser information, which may include your IP address, to record and analyze predefined user actions on our website (e.g., completed transactions, leads, search queries, or views of product pages). This allows us to generate statistics about user behavior on our site following an ad referral, helping us optimize our offering.
All processing described above – particularly the setting of cookies to read information from your device – is carried out only if you have given us your express consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with future effect by disabling this service via the "Cookie Consent Tool" provided on our website.
We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.
12) Seitenfunktionalitäten
12.1 Judge.me
Our website integrates graphic elements from the following provider to display external customer reviews and/or an externally issued trust seal: Judge.me Ltd., c/o Buckworths, 2nd Floor, 1–3 Worship Street, London, England, EC2A 2AB, United Kingdom.
When you access a page on our website that contains such graphic elements, your browser establishes a direct connection to the provider’s servers in order to properly load the content. Certain browser information, including your IP address, is transmitted to the provider.
If personal data is processed during this connection, it is done pursuant to Art. 6(1)(f) GDPR based on our legitimate interest in optimal marketing and a visually appealing presentation of our online presence.
We have concluded a data processing agreement with the provider to ensure the protection of our website visitors' data and to prohibit unauthorized data sharing with third parties.
In the case of data transfer to the provider’s location, an adequate level of data protection is ensured by an adequacy decision of the European Commission.
12.2 hCaptcha
We use the CAPTCHA service provided by the following provider: Intuition Machines, Inc., 350 Alabama St, San Francisco, CA 94110, USA.
This service checks whether input is made by a human or abusively through automated, machine-based processing, helping to block spam, DDoS attacks, and other automated threats. To verify human interaction, the provider collects the IP address of the device used, browser and operating system identification data, and the date and duration of the visit, and transmits this data to the provider’s servers for analysis.
The legal basis is our legitimate interest in ensuring individual responsibility on the internet and preventing misuse and spam pursuant to Art. 6(1)(f) GDPR.
We have concluded a data processing agreement with the provider to ensure the protection of our website visitors' data and to prohibit unauthorized data sharing with third parties.
For data transfers to the USA, the provider relies on the European Commission’s Standard Contractual Clauses to ensure an adequate level of data protection.
13) Tools and Miscellaneous
13.1 Lexware Office
We also use the cloud-based accounting software provided by: Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany.
The provider processes incoming and outgoing invoices and, where applicable, our company's banking transactions in order to automatically capture invoices, match them with transactions, and generate financial accounting records through a semi-automated process.
If personal data is processed in this context, processing takes place on the basis of our legitimate interest in the efficient organization and documentation of our business processes pursuant to Art. 6(1)(f) GDPR.
13.2 Cookie-Consent-Tool
This website uses a so-called “Cookie Consent Tool” to obtain valid user consents for the use of cookies and cookie-based applications requiring consent. The “Cookie Consent Tool” is displayed as an interactive interface when you visit our website, allowing you to give consent by checking boxes for specific cookies and/or cookie-based applications. Only if you provide your consent by checking the corresponding box will the respective cookies/services be loaded. This ensures that such cookies are only stored on your device with your explicit consent.
The tool sets technically necessary cookies to save your cookie preferences. No personal user data is processed in the general use of this tool.
If, in individual cases, personal data (such as the IP address) is processed for the purpose of storing, assigning, or logging cookie settings, this is done pursuant to Art. 6(1)(f) GDPR based on our legitimate interest in legally compliant, user-specific, and user-friendly cookie consent management.
An additional legal basis is Art. 6(1)(c) GDPR, as we are legally obligated to make the use of non-essential cookies dependent on the user's consent.
Where necessary, we have concluded a data processing agreement with the provider to ensure the protection of our website visitors' data and prevent unauthorized data sharing with third parties.
Further information about the provider and your cookie settings can be found directly in the consent interface on our website.
13.3 Judge.me
To verify and publish customer reviews, we use the services of the following provider: Judge.me Ltd., c/o Buckworths, 2nd Floor, 1–3 Worship Street, London, England, EC2A 2AB, United Kingdom.
If you submit a review on our website, the following data may be collected and transmitted to the provider for verification: your first and last name, email address, order date and number, as well as product name and international references (GTIN/ISDNF). The provider uses this data to determine whether a review is legitimately linked to an actual order. This processing is carried out pursuant to Art. 6(1)(f) GDPR based on our legitimate interest in ensuring the authenticity of reviews by verifying their transactional nature and preventing abuse. Once the review has been checked and approved, the data is deleted by the provider.
In case of data transfer to the provider’s location, an adequate level of data protection is ensured through an adequacy decision by the European Commission.
14) Rights of the Data Subject
14.1 Applicable data protection law grants you the following data subject rights with respect to the processing of your personal data by us as the data controller. The legal basis for each right is specified below:
- Right of access pursuant to Art. 15 GDPR;
- Right to rectification pursuant to Art. 16 GDPR;
- Right to erasure pursuant to Art. 17 GDPR;
- Right to restriction of processing pursuant to Art. 18 GDPR;
- Right to notification pursuant to Art. 19 GDPR;
- Right to data portability pursuant to Art. 20 GDPR;
- Right to withdraw consent pursuant to Art. 7(3) GDPR;
- Right to lodge a complaint pursuant to Art. 77 GDPR.
14.2 Right to Object
If we process your personal data on the basis of our overriding legitimate interest as part of a balancing of interests, you have the right to object at any time to this processing with effect for the future, on grounds relating to your particular situation.
If you exercise your right to object, we will stop processing the affected data. However, further processing remains reserved if we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing serves the establishment, exercise, or defense of legal claims.
If your personal data is processed by us for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes. You may exercise your right to object as described above.
If you exercise your right to object, we will immediately stop processing the affected data for direct marketing purposes.
15) Duration of Storage of Personal Data
The duration of the storage of personal data depends on the applicable legal basis, the purpose of processing, and—if relevant—also on the applicable statutory retention period (e.g. commercial and tax law retention periods).
If the processing of personal data is based on an explicit consent pursuant to Art. 6(1)(a) GDPR, the data concerned will be stored until you revoke your consent.
If there are statutory retention periods for data that are processed within the scope of contractual or quasi-contractual obligations pursuant to Art. 6(1)(b) GDPR, such data will be routinely deleted after the retention periods have expired, provided that they are no longer required for the performance or initiation of a contract and/or there is no legitimate interest on our part in continued storage.
When personal data is processed on the basis of Art. 6(1)(f) GDPR, it will be stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.
When personal data is processed for the purpose of direct advertising on the basis of Art. 6(1)(f) GDPR, such data will be stored until you exercise your right to object pursuant to Art. 21(2) GDPR.
Unless otherwise stated in the specific processing situations described in this privacy policy, personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.