Privacy policy

The controller for data processing on this website within the meaning of Art. 4(7) GDPR is:

Email: [email protected]

No data protection officer has been appointed, as the conditions of Art. 37 GDPR in conjunction with § 38 BDSG are not met. Please address data protection enquiries to the address above.

We process personal data only where the law permits it. The following may apply:

• Art. 6 Abs. 1 lit. a DSGVO — your consent, e.g. for statistics cookies or the newsletter.
• Art. 6 Abs. 1 lit. b DSGVO — performance of a contract or pre-contractual measures, e.g. processing your order.
• Art. 6 Abs. 1 lit. c DSGVO — compliance with legal obligations, e.g. retention periods under commercial and tax law.
• Art. 6 Abs. 1 lit. f DSGVO — legitimate interests, e.g. the secure and trouble-free operation of the website.

When you access this website, the hosting provider automatically collects information transmitted by your browser. This comprises: IP address, date and time of the request, page requested, volume of data transferred, HTTP status code, referrer URL, and browser and operating system identifiers.

Purpose: delivering the website, ensuring system security and investigating misuse.
Legal basis: Art. 6(1)(f) GDPR; legitimate interest in secure operation.
Retention period: 7 days, then automatic deletion. Where there are specific indications of an attack, until the matter is resolved.

To process an order we handle your name, your billing and delivery address, your email address, the items ordered and payment data. Optional details such as a telephone number are marked as such and are voluntary.

Purpose: performance of the purchase contract, shipping, invoicing, handling enquiries and returns.
Legal basis: Art. 6(1)(b) GDPR.
Retention period: Order and invoice data are subject to the retention periods under commercial and tax law (§ 257 HGB and § 147 AO) and are kept for 6 or 10 years respectively. The data is deleted once those periods expire. Data not subject to a retention obligation is deleted as soon as the purpose ceases to apply.

Providing this data is necessary to conclude the contract. Without it we cannot fulfil your order.

You can create a customer account, but you do not have to — ordering as a guest is possible. In the account we store your login details (email address and a cryptographically hashed password), your addresses and your order history.

Legal basis: Art. 6(1)(b) GDPR.
Retention period: until you delete the account. Order data is unaffected by account deletion where statutory retention periods apply.

Payments are handled by a payment service provider. Payment data such as full card numbers is entered and processed exclusively at the payment service provider; we do not receive full card details, only the transaction status and the last digits for reconciliation.

Legal basis: Art. 6(1)(b) GDPR. Payment service providers process data for fraud prevention and to meet their own legal obligations, partly as independent controllers.

For delivery we transmit your name and delivery address to the shipping company engaged. If you have consented to email notifications, we additionally transmit your email address for the purpose of parcel tracking.

Legal basis: Art. 6(1)(b) GDPR; for the shipping notification, Art. 6(1)(a) GDPR.

We use technically necessary cookies that are required for the shop to operate — in particular for the cart, the login session and the region selection. The legal basis is § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR.

All non-essential services are loaded only after your active consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Before you decide, no statistics or marketing script is executed and no corresponding cookie is set.

Your decision is recorded in your browser with a timestamp and the version number of the consent configuration. You can change or withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer. Withdrawal does not affect the lawfulness of processing carried out up to that point.

If you have consented to the “Statistics” category, we use Google Analytics, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses cookies to analyse how the website is used. IP anonymisation is enabled, so your IP address is truncated by Google within the EU or the EEA. Ad personalisation signals are disabled. Transfer to the USA cannot be ruled out; it is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework and, additionally, on standard contractual clauses.

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG.
Retention period: the cookies set by Google are deleted after at most 14 months.

You can withdraw your consent at any time via the cookie settings in the footer. On withdrawal we delete the analytics cookies under our control immediately.

For the newsletter we use the double opt-in procedure: after signing up you receive an email with a confirmation link. You are only added to the mailing list once you click it. Your address is not stored by us before that confirmation. Sign-up and confirmation are logged so that consent can be demonstrated. Brevo (Sendinblue SAS, Paris, France) acts as our processor for managing and sending the newsletter; processing takes place within the EU.

Legal basis: Art. 6(1)(a) GDPR.
Retention period: until withdrawal. Every newsletter email contains an unsubscribe link.

We engage service providers that process personal data on our behalf. Data processing agreements pursuant to Art. 28 GDPR are in place with these providers.

The website and the database run on a server in Nuremberg, Germany. Processing therefore takes place within the European Union in principle.

You have the following rights in relation to us:

• Access (Art. 15 GDPR) — which data we process about you.
• Rectification (Art. 16 GDPR) — correction of inaccurate data.
• Erasure (Art. 17 GDPR) — insofar as no statutory retention obligation stands in the way.
• Restriction of processing (Art. 18 DSGVO).
• Data portability (Art. 20 GDPR) — receiving your data in a structured, commonly used format.
• Objection (Art. 21 GDPR) — against processing based on legitimate interests.
• Withdrawal of consent (Art. 7(3) GDPR) — at any time with effect for the future.

An informal message to the address above is sufficient to exercise your rights. Signed-in customers will also find a direct route to request data access or deletion in the account area .

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

This website is served exclusively over a TLS-encrypted connection (HTTPS). Passwords are stored only as hashes. Access to personal data is limited to those people who need it to process orders.

We update this privacy policy whenever the processing changes or new service providers are added. The version published on this page applies in each case.