Data protection

Privacy Policy

1) Introduction and contact details of the controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we provide information about how we handle your personal data when you use our website. Personal data includes all data that can be used to identify you personally.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Jakob Spering, Mönchsgüterweg 4, 50999 Cologne, Germany, Tel.: 015174586006, Email: jus.kontakt@gmail.com. The controller responsible for processing personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

2) Data collection when visiting our website

When you use our website for informational purposes only, i.e. if you do not register or otherwise provide us with information, we collect only the data that your browser transmits to the page server (so-called “server log files”). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

  • Our website visited
  • Date and time of access
  • Amount of data sent in bytes
  • Source/referrer from which you accessed the page
  • Browser used
  • Operating system used
  • IP address used (if applicable, in anonymized form)

Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not disclosed or otherwise used. However, we reserve the right to review the server log files retrospectively if there are concrete indications of unlawful use.

3) Hosting & content delivery network

Shopify

We use the following provider’s system to host our website and display its content: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”)

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada

All data collected on our website is processed on the provider’s servers. We have entered into a data processing agreement with the provider, which ensures the protection of our visitors’ data and prohibits unauthorized disclosure to third parties.

When data is transferred to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

4) Cookies

To make visiting our website attractive and enable the use of certain functions, we use cookies, which are small text files stored on your device. Some of these cookies are automatically deleted when you close your browser (so-called “session cookies”), while others remain on your device for longer and enable page settings to be saved (so-called “persistent cookies”). In the latter case, you can find the storage duration in your web browser’s overview of cookie settings.

If personal data is also processed by individual cookies that we use, the processing is carried out pursuant to Art. 6(1)(b) GDPR for the performance of the contract, pursuant to Art. 6(1)(a) GDPR if consent has been given, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in ensuring the best possible functionality of the website and a customer-friendly and effective browsing experience.

You can configure your browser to notify you when cookies are set and to let you decide individually whether to accept them, or to exclude the acceptance of cookies in certain cases or generally.

Please note that rejecting cookies may limit the functionality of our website.

5) Contact

5.1 Review Reminder

Solely on the basis of your express consent pursuant to Art. 6(1)(a) GDPR, we use your email address to send a one-time reminder to submit a review of your order. You may withdraw your consent at any time by sending a message to the data controller.

5.2 When you contact us (e.g., by contact form or email), personal data is processed exclusively for the purpose of handling and responding to your request and only to the extent necessary for that purpose.

The legal basis for processing this data is our legitimate interest in responding to your request pursuant to Art. 6(1)(f) GDPR. If your contact is in connection with a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted when the circumstances indicate that the matter in question has been conclusively resolved and provided no statutory retention obligations apply.

6) Data Processing for Order Fulfillment

6.1 Where necessary for the performance of the contract for delivery and payment purposes, the personal data we collect will be disclosed to the commissioned transport company and the commissioned credit institution in accordance with Art. 6(1)(b) GDPR.

If, under a relevant contract, we owe you updates for goods with digital elements or for digital products, we process the contact details you provided when placing your order (name, address, email address) to personally inform you of upcoming updates within the legally prescribed period, using an appropriate means of communication (such as by post or email), as part of our statutory information obligations under Art. 6(1)(c) GDPR. Your contact details are used strictly for the purpose of notifying you about updates we owe you and are processed by us only to the extent necessary for the relevant notification.

We also work with the service provider(s) listed below to process your order, who assist us in whole or in part with the performance of the contracts concluded. Certain personal data is transferred to these service providers in accordance with the following information.

6.2 Use of payment service providers (payment services)

- PayPal

One or more online payment methods from the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method from the provider for which you pay in advance, your payment data provided during the ordering process (including your name, address, bank and payment card details, currency and transaction number) and information about the contents of your order will be shared with the provider in accordance with Art. 6(1)(b) GDPR. In this case, your data will be shared solely for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.

If you select a payment method for which we pay in advance, you will also be asked during checkout to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, telephone number and, where applicable, details of an alternative payment method).

To protect our legitimate interest in determining your creditworthiness in such cases, we forward this data to the provider for a credit check in accordance with Art. 6(1)(f) GDPR. Based on the personal data you provide and other data (such as your shopping cart, invoice amount, order history and payment history), the provider checks whether the payment option you selected can be granted in view of the risks of non-payment and/or default on receivables.

The credit check may contain probability values (so-called score values). Where score values are included in the results of the credit check, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of score values includes, among other things, but is not limited to, address data.

You may object to this processing of your data at any time by notifying us or the provider. However, the provider may still be entitled to process your personal data if this is necessary to process payments in accordance with the contract.
- PayPal Checkout

This website uses PayPal Checkout, an online payment system from PayPal comprising PayPal’s own payment methods and local payment methods from third-party providers.

When you pay via PayPal, credit card via PayPal, direct debit via PayPal or - if offered - “Pay Later” via PayPal, we forward your payment data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal") as part of payment processing. The data is forwarded in accordance with Art. 6(1)(b) GDPR and only to the extent necessary to process the payment.

For the payment methods credit card via PayPal, direct debit via PayPal or - if offered - “Pay Later” via PayPal, PayPal reserves the right to conduct a credit check. For this purpose, your payment data may be forwarded to credit reference agencies in accordance with Art. 6(1)(f) GDPR, based on PayPal’s legitimate interest in determining your ability to pay. PayPal uses the results of the credit check relating to the statistical probability of payment default to decide whether to provide the relevant payment method. The credit check may contain probability values (so-called score values). Where score values are included in the results of the credit check, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of score values includes, among other things, but is not limited to, address data. You may object to this processing of your data at any time by notifying PayPal. However, PayPal may still be entitled to process your personal data if this is necessary to process payments in accordance with the contract.

If the PayPal payment method “Pay by Invoice” is available and selected, your payment details are first transmitted to PayPal to prepare the payment, after which PayPal forwards them to Ratepay GmbH, Franklinstraße 28-29, 10587 Berlin ("Ratepay") to process the payment. The legal basis in each case is Art. 6(1)(b) GDPR. In this case, RatePay conducts an identity and creditworthiness check in its own name to determine your ability to pay, in accordance with the principle already mentioned above, and discloses your payment details to credit reference agencies based on its legitimate interest in determining your ability to pay, pursuant to Art. 6(1)(f) GDPR. A list of the credit reference agencies that Ratepay may use can be found here: https://www.ratepay.com/legal-payment-creditagencies/

When using a local third-party payment method, your payment details are first transferred to PayPal to prepare the payment in accordance with Art. 6(1)(b) GDPR. Depending on your selection of an available local payment method, PayPal then transfers your payment details to the relevant provider to process the payment in accordance with Art. 6(1)(b) GDPR:

- Apple Pay (Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
- Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)
- iDeal (Currence Holding BV, Beethovenstraat 300 Amsterdam, Netherlands)
- bancontact (Bancontact Payconiq Company, Rue d'Arlon 82, 1040 Brussels, Belgium)
- blik (Polski Standard Płatności sp. z o.o., ul. Czerniakowska 87A, 00-718 Warsaw, Poland)
- eps (PSA Payment Services Austria GmbH, Handelskai 92, Gate 2
1200 Vienna, Austria)
- MyBank (PRETA S.A.S, 40 Rue de Courcelles, F-75008 Paris, France)
- Przelewy24 (PayPro SA, Kanclerska 15A, 60-326 Poznań, Poland)

For further information on data protection, please see PayPal's privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
- Shopify Payments

One or more online payment methods from the following provider are available on this website: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

When you select a payment method offered by the provider that requires you to pay in advance (such as credit card payment), your payment details provided during the ordering process (including your name, address, bank and payment card details, currency, and transaction number) as well as information about the contents of your order are shared with the provider in accordance with Art. 6(1)(b) GDPR. In this case, your data is shared exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.

7) Retargeting/Remarketing and conversion tracking

Meta Pixel with advanced matching

Within our online offering, we use the "Meta Pixel" service in advanced matching mode, provided by: Meta Platforms Ireland Limited, 4 Grand Canal Quare, Dublin 2, Ireland ("Meta")

If a user clicks on an ad we have placed on Facebook or Instagram, "Meta Pixel" adds a parameter to the URL of our linked page. After redirection, this URL parameter is entered into the user's browser by a cookie set by our linked page itself. In addition, this cookie collects specific customer data, such as the email address we collect on the website linked to our Facebook or Instagram ad when users make purchases, sign in to their account, or register (advanced matching). The cookie is then read and enables the data, including specific customer data, to be transmitted to Meta.

We use "Meta Pixel" with advanced matching to make our ads on Facebook and/or Instagram more effective and ensure that they match users' interests or have certain characteristics (e.g., interests in specific topics or products determined based on the websites they visit), which we transmit to Meta (so-called "Custom Audiences").

In addition, we analyze the effectiveness of our advertisements by tracking whether users are redirected to our website after clicking on an ad (conversion). Compared with the standard version of “Meta Pixel,” the enhanced data matching feature helps us better measure the effectiveness of our advertising campaigns by recording more attributed conversions.

All data transmitted is stored and processed by Meta, making it possible to associate it with the respective user profile, and allowing Meta to use the data for its own advertising purposes in accordance with Meta’s data policy (https://www.facebook.com/about/privacy/) may use. The data may enable Meta and its partners to place ads on and outside Facebook.

All processing described above, in particular the setting of cookies to read information on the device used, is carried out only if you have given us your express consent in accordance with Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future by disabling this service in the “Cookie Consent Tool” provided on the website.

We have concluded a data processing agreement with the provider that protects the data of our website visitors and prohibits its unauthorized disclosure to third parties.

The information generated by Meta is generally transferred to a Meta server and stored there; in this context, it may also be transferred to servers of Meta Platforms Inc. in the USA.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

8) Page features

8.1 Facebook plugins

Plugins from the following provider’s social network are used on our website: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

These plugins enable direct interactions with content on the social network.

To increase the protection of your data when visiting our website, the plugins are initially integrated into the page in a deactivated state using a so-called “2-click” or “Shariff” solution.

This integration ensures that no connection to the provider’s servers is established when you visit a page on our website that contains such plugins.

Only when you activate the plugins and thereby consent to the transfer of data in accordance with Art. 6(1)(a) GDPR will your browser establish a direct connection to the provider’s servers. Regardless of whether you are logged into an existing user profile, certain information about the device you are using (including your IP address), your browser, and your browsing history will be transferred to the provider and may be further processed there.

If you are logged into an existing user profile on the provider’s social network, information about interactions carried out through the plugins will also be published there and shown to your contacts.
You can withdraw your consent at any time by deactivating the enabled plugin by clicking it again. However, withdrawal does not affect data that has already been transferred to the provider.

Data may also be transferred to: Meta Platforms Inc., USA

We have concluded a data processing agreement with the provider that protects the data of our website visitors and prohibits its unauthorized disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

8.2 Instagram plugins

Plugins from the following provider’s social network are used on our website: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

These plugins enable direct interactions with content on the social network.

To increase the protection of your data when visiting our website, the plugins are initially integrated into the page in a deactivated state using a so-called “2-click” or “Shariff” solution.

This integration ensures that no connection to the provider’s servers is established when you visit a page on our website that contains such plugins.

Only when you activate the plugins and thereby consent to the transfer of data in accordance with Art. 6(1)(a) GDPR will your browser establish a direct connection to the provider’s servers. Regardless of whether you are logged into an existing user profile, certain information about the device you are using (including your IP address), your browser, and your browsing history will be transferred to the provider and may be further processed there.

If you are logged into an existing user profile on the provider’s social network, information about interactions carried out through the plugins will also be published there and shown to your contacts.
You can withdraw your consent at any time by deactivating the enabled plugin by clicking it again. However, withdrawal does not affect data that has already been transferred to the provider.

Data may also be transferred to: Meta Platforms Inc., USA

We have concluded a data processing agreement with the provider that protects the data of our website visitors and prohibits its unauthorized disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with European data protection standards.

9) Tools and other items

Cookie Consent Tool

This website uses a so-called “Cookie Consent Tool” to obtain effective user consent for cookies and cookie-based applications that require consent. When users visit the site, the “Cookie Consent Tool” is displayed as an interactive user interface where they can consent to specific cookies and/or cookie-based applications by ticking a box. With this tool, all cookies/services requiring consent are only loaded if the user has given the relevant consent by ticking a box. This ensures that such cookies are only placed on the user’s device if consent has been given.

The tool sets technically necessary cookies to store your cookie preferences. As a rule, no personal user data is processed in this process.

If personal data (such as the IP address) is processed in an individual case for the purpose of storing, assigning or logging cookie settings, this is done pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in compliant, user-specific and user-friendly cookie consent management and, consequently, in ensuring that our website is designed in compliance with the law.

Art. 6(1)(c) GDPR also provides a legal basis for processing. As the controller, we are legally required to make the use of non-essential cookies conditional on the user's consent.

Where necessary, we have entered into a data processing agreement with the provider to ensure the protection of our website visitors' data and prohibit its unauthorized disclosure to third parties.

Further information about the operator and the configuration options of the cookie consent tool can be found directly in the corresponding user interface on our website.

10) Data subject rights

10.1 The applicable data protection law grants you the following data subject rights (rights of access and intervention) with respect to the controller regarding the processing of your personal data. The legal basis cited below applies to the respective requirements for exercising these rights:

  • Right of access pursuant to Art. 15 GDPR;
  • Right to rectification pursuant to Art. 16 GDPR;
  • Right to erasure pursuant to Art. 17 GDPR;
  • Right to restriction of processing pursuant to Art. 18 GDPR;
  • Right to be informed pursuant to Art. 19 GDPR;
  • Right to data portability pursuant to Art. 20 GDPR;
  • Right to withdraw consent pursuant to Art. 7(3) GDPR;
  • Right to lodge a complaint pursuant to Art. 77 GDPR.

10.2 RIGHT TO OBJECT

IF, AS PART OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE AFFECTED DATA. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSES OF SUCH MARKETING. YOU MAY EXERCISE YOUR RIGHT TO OBJECT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE RELEVANT DATA FOR DIRECT MARKETING PURPOSES.

11) Retention period for personal data

The retention period for personal data is determined by the applicable legal basis, the purpose of processing and, where applicable, additionally by the relevant statutory retention period (e.g. commercial and tax retention periods).

When personal data is processed on the basis of your explicit consent pursuant to Art. 6(1)(a) GDPR, the relevant data is stored until you withdraw your consent.

If statutory retention periods apply to data processed in connection with contractual or quasi-contractual obligations on the basis of Art. 6(1)(b) GDPR, that data will routinely be deleted once the retention periods have expired, provided it is no longer required for the performance or initiation of a contract and/or we have no legitimate interest in continuing to store it.

When personal data is processed on the basis of Art. 6(1)(f) GDPR, that data is stored until you exercise your right to object under Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

When personal data is processed for direct marketing purposes on the basis of Art. 6(1)(f) GDPR, that data is stored until you exercise your right to object under Art. 21(2) GDPR.

Unless anything else follows from the other information in this statement about specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.