Privacy policy

Last updated: July 2nd, 2026

Cookie settings:

Cookie Settings

Privacy Policy

Scope

This Privacy Policy applies to all pages of https://miracledeparis.com/. It does not apply to any linked websites or online presences operated by other providers.

Data Protection Questions

Should you have any questions regarding data protection in connection with our company or our website, you may contact us using the contact details provided in the “Controller” section.

Security

We have implemented comprehensive technical and organisational measures to protect your personal data against unauthorised access, misuse, loss and other external interference. We regularly review our security measures and adapt them to the current state of the art.

Your Rights

You have the following rights concerning your personal data, which you may exercise against us:

Right of access: In accordance with Article 15 GDPR, you may request information about the personal data concerning you that we process.

Right to rectification: If the information concerning you is no longer, or is not, accurate, you may request its rectification in accordance with Article 16 GDPR. If your data is incomplete, you may request that it be completed.

Right to erasure: In accordance with Article 17 GDPR, you may request the erasure of your personal data.

Right to restriction of processing: In accordance with Article 18 GDPR, you have the right to request the restriction of the processing of your personal data.

Right to object to processing: Pursuant to Article 21(1) GDPR, you have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data carried out on the basis of Article 6(1), first sentence, point (e) or point (f) GDPR.

In such a case, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms. Processing may also continue where it is necessary for the establishment, exercise or defence of legal claims pursuant to Article 21(1) GDPR.

Furthermore, pursuant to Article 21(2) GDPR, you have the right to object at any time to the processing of your personal data for direct-marketing purposes. This also applies to any profiling to the extent that it is related to such direct marketing. We inform you of this right to object in this Privacy Policy in connection with the respective processing activity.

Right to withdraw your consent: Where you have given your consent to processing, you have the right to withdraw that consent pursuant to Article 7(3) GDPR.

Right to data portability: You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and to transmit those data to another controller, provided that the requirements of Article 20(1), points (a) and (b), GDPR are satisfied pursuant to Article 20 GDPR.

You may exercise your rights by contacting us using the contact details provided in the “Controller” section.

If you believe that the processing of your personal data infringes applicable data-protection law, you also have the right, pursuant to Article 77 GDPR, to lodge a complaint with a data-protection supervisory authority of your choice.

Accessing Our Website

When you access our website, your browser transmits information to the server in order to establish a connection and to display the content securely, quickly, reliably and in the correct format on your device.

The following data may be processed:

browser type and browser version;
operating system used;
language and version of the browser software;
date and time of access;
hostname of the accessing device;
IP address;
content of the request, meaning the specific webpage requested;
access status or HTTP status code;
websites accessed through the website;
referrer URL, meaning the website previously visited;
information indicating whether the request was successful;
volume of data transmitted; and
difference between the applicable time zone and GMT.

These data may also be stored in order to ensure the proper functioning of the website and the security of our information-technology systems.

The legal basis for this processing is Article 6(1), first sentence, point (f) GDPR. Our legitimate interests consist of ensuring the proper functioning of the website and maintaining its integrity and security.

The storage of access data, particularly the IP address, enables us to identify and prevent misuse. This includes, for example, defending the service against excessive requests or possible bot activity.

Upon request, we will provide you with information concerning our legitimate-interest assessment free of charge.

Access data are erased once they are no longer required for the purposes for which they were processed. Where the data are collected for the purpose of providing the website, this is generally the case when you end your visit to the website.

Log data are erased no later than seven days after collection. Backups through which the log data may remain indirectly available after the expiry of the aforementioned period are erased no later than four weeks thereafter.

You may object to this processing. Your right to object applies where there are grounds relating to your particular situation. You may submit your objection using the contact details provided in the “Controller” section.

Device Information

In addition to the access data described above, technologies are used when you visit the website that store information on your terminal device, such as a desktop computer, laptop, tablet or smartphone, or access information already stored on your terminal device.

These technologies may include cookies, pixels, LocalStorage, SessionStorage, IndexedDB or browser-fingerprinting technologies. They may be used to recognise you across devices and websites.

Under Section 25(1) TDDDG, we generally require your consent before using these technologies. Pursuant to Section 25(2) TDDDG, consent is not required only where the technologies either enable the transmission of a communication through a public telecommunications network or are strictly necessary to provide a telemedia service expressly requested by you.

Technically Necessary Device Information

Certain elements of our website serve solely to transmit a communication pursuant to Section 25(2), no. 1 TDDDG or are strictly necessary to provide you with our website or individual website functions pursuant to Section 25(2), no. 2 TDDDG. These include:

language settings;
items placed in the shopping cart; and
login information.

These elements are deleted once their storage is no longer necessary.

You can prevent this processing by configuring the appropriate settings in your browser software. Where the storage period of an element is not limited to the duration of the session, you may delete the element through your browser settings after the end of your session.

Technically Non-Essential Device Information

We also use elements on the website that are not technically necessary. In accordance with applicable legal requirements, we use these technologies only with your consent.

Information concerning the individual technologies and functions can be found in the consent-management platform, or “cookie banner,” and in the following information, organised according to the respective functions.

Consent-Management Platform

We use a consent tool on our websites to request your consent to the processing of device information and personal data through cookies or other tracking technologies.

This tool allows you either to consent to or reject the processing of your device information and personal data through cookies or other tracking technologies for the purposes listed in the consent tool.

Such purposes may include:

the integration of external elements;
the integration of streaming content;
statistical analysis;
audience measurement;
personalised product recommendations; and
personalised advertising.

You may consent to or reject all processing purposes or grant or refuse consent separately for individual purposes. You may also change your settings at a later date.

The purpose of incorporating the consent tool is to allow users of our websites to decide whether cookies and similar functions may be used and, during subsequent use of our websites, to provide them with an opportunity to change settings they have previously selected.

When the consent tool is used, we process personal data and information concerning the devices used. Information concerning the settings you select is also stored on your device.

The legal basis for processing is Article 6(1), first sentence, point (c) GDPR in conjunction with Article 7(1) GDPR where the processing is required to fulfil the statutory obligation to document consent.

In all other respects, the applicable legal basis is Article 6(1), first sentence, point (f) GDPR. Our legitimate interests consist of storing users’ settings and preferences regarding the use of cookies and evaluating consent rates.

Upon request, we will provide you with information concerning our legitimate-interest assessment free of charge.

The settings selected by users are stored for as long as they remain necessary for the purposes for which they were collected, unless you delete the information concerning your settings from the relevant storage areas of your device beforehand.

You may object to the processing to the extent that it is based on Article 6(1), first sentence, point (f) GDPR. Your right to object applies where there are grounds relating to your particular situation. You may submit your objection using the contact details provided in the “Controller” section.

The recipient of the personal data processed in this context is the provider of the consent-management platform we use:

Shopify, Inc.
150 Elgin Street
Ottawa, Ontario
Canada
“Shopify”

Shopify processes your personal data on our behalf as a processor pursuant to a data-processing agreement under Article 28 GDPR.

Shopify also processes personal data in Canada. An adequacy decision of the European Commission applies to transfers of data to Canada.

Contacting Our Company

When you contact our company, for example by email or through the contact form on the website, we process the personal data you provide in order to respond to your enquiry.

To process enquiries submitted through the contact form, it is mandatory to provide a first name, surname and valid email address. At the time the message is sent to us, your IP address and the date and time of the submission are also processed.

The legal basis for processing is Article 6(1), first sentence, point (f) GDPR or Article 6(1), first sentence, point (b) GDPR where the contact is intended to result in the conclusion of a contract.

Where the enquiry concerns the conclusion of a contract, the provision of your data is necessary and mandatory. If the data are not provided, it will not be possible to conclude or perform the contract or process the enquiry.

The other data processed during the submission process are used to prevent misuse of the contact form and ensure the security of our information-technology systems.

Upon request, we will provide you with information concerning our legitimate-interest assessment free of charge.

We erase the data generated in this context once the processing is no longer necessary or, where applicable, restrict the processing to compliance with mandatory statutory retention requirements.

You may object to the processing where it is based on Article 6(1), first sentence, point (f) GDPR. Your right to object applies where there are grounds relating to your particular situation. You may submit your objection using the contact details provided in the “Controller” section.

Online Shop

If you wish to place an order through our online shop, it is necessary and mandatory for the initiation and conclusion of the contract that you provide personal data such as your first name, surname, address, email address and telephone number.

The mandatory information required for processing the order and performing the contract is marked separately. Any additional information is provided voluntarily.

We process your data for the purpose of handling your order and, in particular, will transmit payment data to the payment service provider selected by you or to our principal bank for this purpose.

The legal basis for processing is Article 6(1), first sentence, point (b) GDPR. The provision of your data is necessary and mandatory for the conclusion and performance of the contract. If you do not provide your data, it will not be possible to conclude and/or perform the contract.

We transmit your personal data to the shipping service provider selected by us for the purpose of delivering your order to the delivery address specified by you.

We erase the data generated in this context once their storage is no longer necessary or restrict the processing where statutory retention obligations apply.

Due to mandatory commercial and tax-law requirements, we are required to retain your address, payment and order data for a period of up to ten years.

You may voluntarily create a customer account in which we store your data for future visits to the website. When a customer account is created, the data you provide are processed.

After successfully logging in, you may independently edit or delete all additional data in your customer account.

The data generated in this context are erased once their storage is no longer necessary, or their processing is restricted where statutory retention or documentation obligations apply.

For the internal processing and administration of your order and its shipment, we use the following external service provider:

Shopify
Shopify, Inc.
150 Elgin Street
Ottawa, Ontario
Canada

Hereinafter referred to as “Shopify.”

Shopify processes your personal data on our behalf as a processor pursuant to a data-processing agreement under Article 28 GDPR.

Shopify also processes your personal data in Canada. An adequacy decision of the European Commission applies to transfers of data to Canada.

Withdrawal Button

When you place an order through our online shop, you are legally entitled to a right of withdrawal.

To allow you to exercise this right, we are required to provide a withdrawal button on our website through which you may notify us of your withdrawal.

In connection with this function, we process the information you provide, including your first name, surname, order number and contact details, particularly your email address, as well as the data listed under “Accessing Our Website.”

The legal basis for processing in connection with the withdrawal button is Article 6(1), first sentence, point (c) GDPR.

To provide the withdrawal button, we use the following external service provider:

401layers UG (haftungsbeschränkt)
Dorothea-Erxleben-Straße 1a
40721 Hilden
Germany

The provider processes your personal data on our behalf as a processor pursuant to a data-processing agreement under Article 28 GDPR.

Post-Purchase Survey

After you have placed an order through our online shop, you may be redirected to a voluntary survey concerning your ordering experience and our products.

In connection with this survey, we process, in particular, the information you provide in your survey responses as well as the data listed under “Accessing Our Website.”

The legal basis for processing in connection with the survey is Article 6(1), first sentence, point (f) GDPR.

Our legitimate interests consist of improving our product offering. Upon request, we will provide you with information concerning our legitimate-interest assessment free of charge.

The data generated in this context are erased once their storage is no longer necessary, or their processing is restricted where statutory retention or documentation obligations apply.

For the purpose of conducting the survey, we use the following external service provider:

Fairing, Inc.
228 Park Avenue South
PMB 38031
New York, NY 10003
USA

Hereinafter referred to as “Fairing.”

You may object to this processing. Your right to object applies where there are grounds relating to your particular situation.

You may submit your objection using the contact details provided in the “Controller” section.

Customer Account

To create a customer account independently of placing an order through our online shop, you must register by providing the following information:

first name and surname;
username;
address;
email address; and
a password chosen by you.

You are not required to use your real name and may use the service under a pseudonym.

At the time of registration, your IP address and the date and time of registration are also processed.

We use two-factor authentication for registration. After you have submitted the data required for registration, you will receive an email containing an access code.

Your customer account will only be created, and registration successfully completed, once you have entered this code on the website.

For subsequent logins, you must enter the email address provided during your initial registration. An access code will then be sent to that email address. You will be logged in once you have successfully entered the code on the website.

If the transmitted code is not entered within 24 hours, we will block the information submitted to us and automatically erase it no later than one month thereafter.

In all other respects, your data will be erased once they are no longer required for the purposes for which they were processed. In the case of data collected during the registration process, this will occur when the registration on the website is cancelled or modified.

For registration and login to the customer account, we use the following external service provider:

Shopify
Shopify, Inc.
150 Elgin Street
Ottawa, Ontario
Canada

Hereinafter referred to as “Shopify.”

Shopify processes your personal data on our behalf as a processor pursuant to a data-processing agreement under Article 28 GDPR.

Shopify also processes your personal data in Canada. An adequacy decision of the European Commission applies to transfers of data to Canada.

The following functions are available to you in the login area:

changing your profile data; and
viewing orders or bookings you have made.

Where you use the login area of the website, for example to view previous orders, we also process the personal data required for the initiation or performance of the contract, particularly address data and information concerning the selected payment method.

The legal basis for processing is Article 6(1), first sentence, point (b) GDPR.

The provision of your data is necessary and mandatory for the conclusion and performance of the contract. If you do not provide your data, you will not be able to register or use the login area, meaning that it will not be possible to conclude and/or perform the contract.

Your data will be erased once they are no longer required for the purposes of processing. This will be the case after the customer account has been deleted, unless we are required by law to retain the data.

Where statutory retention obligations apply, we will restrict the processing of the data.

Due to mandatory commercial and tax-law requirements, we are required to retain your address, payment and order data for a period of up to ten years.

Shop Pay Login

To allow you to register on our website using your Shop Pay account, provided by Shopify, Inc., 150 Elgin Street, Ottawa, Ontario, Canada, hereinafter referred to as “Shopify,” we have implemented a Shop Pay login function in addition to the email login option described above.

The purpose of the processing is to simplify order processing and payment.

When you use the login function provided on our website, you may log in to your Shop Pay account through Shop Pay.

When you use the Shop Pay function, Shopify transmits personal data concerning you to us, particularly your first name, surname and email address.

Shopify also processes information concerning your user activity after you have logged in.

With regard to the storage of information on, and access to information stored on, your terminal device, the legal basis is your consent pursuant to Section 25(1) TDDDG.

For the further processing of your personal data, the legal basis is also your consent pursuant to Article 6(1), first sentence, point (a) GDPR.

Shopify also processes your data in Canada. An adequacy decision of the European Commission applies to transfers of data to Canada.

You may withdraw your consent to the processing at any time by rejecting the use of cookies and similar tracking technologies in our consent tool: The Cookie Settings can be accessed through the link in the top part of the privacy policy..

The lawfulness of the processing carried out before the withdrawal of your consent remains unaffected.

Comment Function

You may leave comments and reviews concerning our products on our website.

When you use the comment function, we process the name or pseudonym you provide as well as your email address.

The legal basis for processing your personal data is Article 6(1), first sentence, point (f) GDPR.

Our legitimate interests consist of obtaining feedback from our customers in order to improve our products and services.

Upon request, we will provide you with information concerning our legitimate-interest assessment free of charge.

Your data will not be published on our website and will only be stored internally.

The data generated in this context will be erased once their storage is no longer necessary, or their processing will be restricted where statutory retention or documentation obligations apply.

You may object to the processing. Your right to object applies where there are grounds relating to your particular situation.

You may submit your objection using the contact details provided in the “Controller” section.

Email Marketing

Advertising to Existing Customers

We reserve the right, in accordance with applicable legal requirements, to use the email address you provided when placing an order to send you the following content by email during or after the ordering process, unless you have already objected to such processing of your email address:

interesting offers from our product range, particularly cosmetic products;
special offers and limited-time offers; and
customer-satisfaction surveys.

The legal basis for this processing is Article 6(1), first sentence, point (f) GDPR.

Our legitimate interests in this processing consist of increasing and optimising our services, sending direct marketing communications and ensuring customer satisfaction.

Upon request, we will provide you with information concerning our legitimate-interest assessment free of charge.

The data generated in this context will be erased once their storage is no longer necessary, or their processing will be restricted where statutory retention or documentation obligations apply.

Please note that you may object at any time to receiving direct marketing communications and to the processing of your personal data for direct-marketing purposes, without incurring any costs other than the transmission costs charged at the basic rates.

You have a general right to object without being required to provide reasons pursuant to Article 21(2) GDPR.

To exercise this right, click the unsubscribe link contained in the relevant email or send your objection to us using the contact details provided in the “Controller” section.

For the purpose of sending customer-satisfaction emails, we use the external customer-feedback, opinion-research and market-research provider:

Loox
Loox Online Ltd.
Rehov Har Sinai 2
6581602 Tel Aviv-Yafo
Israel

Loox processes your personal data on our behalf as a processor pursuant to a data-processing agreement under Article 28 GDPR.

Loox may also process your personal data in Israel. An adequacy decision of the European Commission applies to transfers of data to Israel.

You may subscribe to our email newsletter through our website. Through the newsletter, we regularly inform you about the following content:

interesting offers from our product range, particularly cosmetic products; and
special offers and limited-time offers.

A valid email address is required in order to receive the newsletter.

We process your email address for the purpose of sending the newsletter and for as long as you remain subscribed.

At the time you subscribe to the newsletter, we also process your IP address and the date and time of registration.

The legal basis for this processing is Article 6(1), first sentence, point (a) GDPR.

We process your data until you withdraw your consent.

You may withdraw your consent to the processing of your email address for the purpose of receiving the newsletter at any time, either by clicking the unsubscribe link contained in the newsletter or by contacting us using the contact details provided in the “Controller” section.

The withdrawal of your consent does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal.

For the purpose of sending the newsletter, we use the following external provider:

Klaviyo Inc.
120 Summer Street
Boston, Massachusetts
USA

Hereinafter referred to as “Klaviyo.”

Klaviyo processes your personal data on our behalf as a processor pursuant to a data-processing agreement under Article 28 GDPR.

Klaviyo also processes some of the data in the United States.

An adequacy decision of the European Commission applies to transfers of data to the United States. Klaviyo is certified under the relevant framework.

Newsletter Tracking

We also statistically analyse:

newsletter opening rates;
the number of clicks on links contained in the newsletter;
reading duration; and
the reach of our newsletters.

We use these analyses to adapt the offers and information sent to you to your personal interests.

For this purpose, user behaviour on our websites and within the newsletters we send is evaluated using device-specific information, such as the email client used and applicable software settings.

For this analysis, the emails sent contain web beacons or tracking pixels. These are one-pixel image files that may also be embedded on our website.

For the purpose of measuring reach, we measure the number of visitors who reach our websites by clicking links and who subsequently perform certain actions, such as redeeming vouchers or purchasing products through the online shop.

Depending on your reading behaviour, we may also create target groups to which we send newsletter content tailored to the identified user interests.

To tailor our newsletter more closely to your interests, we associate your email address or user profile in our database with other usage profiles.

The legal basis for this processing is Article 6(1), first sentence, point (a) GDPR.

You may withdraw your consent at any time by sending us a message using the contact details provided in the “Controller” section or by clicking the unsubscribe link contained in the newsletter.

The withdrawal of your consent does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal.

Unsubscribing From the Newsletter or Objecting to Advertising to Existing Customers

Where you unsubscribe by withdrawing your consent or exercise your right to object to advertising directed at existing customers, we process your data, particularly your email address, to ensure that you no longer receive newsletters from us.

For this purpose, we record your withdrawal or objection and suppress your email address in our internal customer mailing list so that you do not receive any further newsletters or advertising directed at existing customers.

The legal basis for processing is Article 6(1), first sentence, point (c) GDPR, insofar as processing is required to comply with our legal documentation obligations.

In all other cases, the legal basis is Article 6(1), first sentence, point (f) GDPR.

Our legitimate interests in this case consist of complying with our legal obligations and reliably ensuring that no further newsletters are sent to you.

Upon request, we will provide you with information concerning our legitimate-interest assessment free of charge.

You may object to this processing. Your right to object applies where there are grounds relating to your particular situation.

You may submit your objection using the contact details provided in the “Controller” section.

Payment Processing

We offer various payment methods on our website.

After you select one of the available payment methods, the payment data provided by you, for example during the ordering or bank-transfer process, are processed together with information concerning your order and the following information for the purpose of processing the payment:

first name and surname;
payment reference;
order or customer number;
delivery and billing address;
email address; and
selected payment method.

Where data required for payment processing are transmitted, they are transferred using the secure SSL protocol.

We also use external payment service providers for some payment transactions. Further information concerning these payment service providers can be found in the “Payment Service Providers” section.

The legal basis for processing is Article 6(1), first sentence, point (b) GDPR.

The provision of your payment data is necessary and mandatory for the conclusion and performance of the contract. If you do not provide the payment data, it will not be possible to conclude and/or perform the contract using the selected payment method.

We erase the data generated in this context once their storage is no longer necessary or restrict their processing where statutory retention obligations apply.

Due to mandatory commercial and tax-law requirements, we are required to retain your address, payment and order data for a period of up to ten years.

Payment Service Providers

Klarna

Purchase on Account Through Klarna

If you select the “Invoice” payment method offered by Klarna, we transmit the data you provide to the following provider for the purpose of processing your payment:

Klarna Bank AB (publ)
Sveavägen 46
111 34 Stockholm
Sweden

Hereinafter referred to as “Klarna” and, in connection with this payment method, “Invoice.”

You must pay the invoice within 14 days of the invoice date. Registration with Klarna is not required.

The legal basis for processing is Article 6(1), first sentence, point (b) GDPR.

Klarna carries out identity and creditworthiness checks to verify that the information provided is accurate. Klarna also seeks to ensure that the order was actually placed by you.

The legal basis for the creditworthiness check is Article 6(1), first sentence, point (f) GDPR.

Our legitimate interests consist of preventing fraud and avoiding payment-default risks, as we provide the goods or services in advance when payment is made by invoice.

Upon request, we will provide you with information concerning our legitimate-interest assessment free of charge.

We erase the data generated in this context once their storage is no longer necessary or restrict their processing where statutory retention obligations apply.

Due to mandatory commercial and tax-law requirements, we are required to retain your address, payment and order data for a period of up to ten years.

Further information concerning Klarna’s terms, data protection and retention periods is available at:

You may object to the processing. Your right to object applies where there are grounds relating to your particular situation.

You may submit your objection using the contact details provided in the “Controller” section.

Direct Debit Through Klarna

We also offer you the option of paying for our products by direct debit through Klarna.

For this purpose, we transmit the data you provide to the following provider for payment processing:

Klarna Bank AB (publ)
Sveavägen 46
111 34 Stockholm
Sweden

Hereinafter referred to as “Klarna” and, in connection with this payment method, “Direct Debit.”

After completing your purchase, you will receive an order confirmation and the SEPA direct-debit mandate by email.

If the direct debit is unsuccessful, the purchase will automatically be converted into a purchase on account. Please refer to the section “Purchase on Account Through Klarna.”

The legal basis for processing is Article 6(1), first sentence, point (b) GDPR.

We erase the data generated in this context once their storage is no longer necessary or restrict their processing where statutory retention obligations apply.

Due to mandatory commercial and tax-law requirements, we are required to retain your address, payment and order data for a period of up to ten years.

Further information concerning Klarna’s terms, data protection and retention periods is available at:

Instalment Payments Through Klarna

If you wish to pay for our products in instalments, you may select Klarna’s “Instalment Purchase” payment method.

For this purpose, we transmit the data you provide to the following provider for payment processing:

Klarna Bank AB (publ)
Sveavägen 46
111 34 Stockholm
Sweden

Hereinafter referred to as “Klarna” and, in connection with this payment method, “Instalment Purchase.”

After completing your purchase, you will receive an order confirmation and an email containing your instalment-purchase agreement, the withdrawal instructions and the applicable terms and conditions.

If you wish to pay an amount of EUR 200 or more by instalments, the relevant documents will be sent to you by post.

Once the instalment-purchase agreement has been successfully concluded, Klarna will send you a monthly invoice specifying the amount payable.

Where you have entered into a flexible instalment-payment arrangement, you may also pay the outstanding invoice balance in full at any time.

If amounts remain unpaid over several months, Klarna may terminate the instalment-purchase agreement and transfer the outstanding claim to a debt-collection agency.

The legal basis for processing is Article 6(1), first sentence, point (b) GDPR.

Klarna carries out identity and creditworthiness checks to verify that the information provided is accurate. Klarna also seeks to ensure that the order was actually placed by you.

The legal basis for the creditworthiness check is Article 6(1), first sentence, point (f) GDPR.

Our legitimate interests consist of preventing fraud and avoiding payment-default risks, as we provide the goods or services in advance when payment is made by instalments.

Upon request, we will provide you with information concerning our legitimate-interest assessment free of charge.

We erase the data generated in this context once their storage is no longer necessary or restrict their processing where statutory retention obligations apply.

Due to mandatory commercial and tax-law requirements, we are required to retain your address, payment and order data for a period of up to ten years.

Further information concerning Klarna’s terms, data protection and retention periods is available at:

You may object to the processing. Your right to object applies where there are grounds relating to your particular situation.

You may submit your objection using the contact details provided in the “Controller” section.

Klarna Instant Bank Transfer

If you select “Klarna Instant Bank Transfer” when placing your order, we transmit the data you provide to the following provider for the purpose of payment processing:

Sofort GmbH
Theresienhöhe 12
80339 Munich
Germany

Hereinafter referred to as “Klarna” and, in connection with this payment method, “Instant Bank Transfer.”

Instant Bank Transfer is a direct bank-transfer procedure through which a bank transfer can be completed and executed in real time during the ordering process.

For this purpose, you will be redirected to the payment service provider’s website.

Sofort GmbH processes personal data concerning you, including:

your name;
account number or IBAN;
bank sort code or BIC;
payment reference;
payment amount; and
payment date.

Sofort GmbH also provides these data to us by way of payment confirmation.

The legal basis for processing is Article 6(1), first sentence, point (b) GDPR.

The data required for payment processing are transmitted securely through SSL and are processed exclusively for the purpose of processing the payment.

We erase the data generated in this context once their storage is no longer necessary or restrict their processing where statutory retention obligations apply.

Due to mandatory commercial and tax-law requirements, we are required to retain your address, payment and order data for a period of up to ten years.

Further information concerning Klarna’s processing of your data is available at:

Integration of Payment Service Providers

The payment methods “Apple Pay” and “Google Pay” are integrated through:

Shopify Inc.
151 O’Connor Street, Ground Floor
Ottawa, Ontario K2P 2L8
Canada

Hereinafter referred to as “Shopify.”

If you select one of these payment methods, the payment data you provide during the booking process, together with information concerning your booking, will be transmitted to Shopify for the purpose of processing the payment.

The legal basis for processing is Article 6(1), first sentence, point (b) GDPR.

The provision of your payment data is necessary and mandatory for the conclusion and performance of the contract. If you do not provide your payment data, it will not be possible to conclude and/or perform the contract using these payment methods.

Shopify processes your personal data on our behalf as a processor pursuant to a data-processing agreement under Article 28 GDPR.

Shopify also processes your data in Canada. An adequacy decision of the European Commission applies to transfers of data to Canada.

You may object to the processing. Your right to object applies where there are grounds relating to your particular situation.

You may submit your objection using the contact details provided in the “Controller” section.

Apple Pay and Google Pay

On our website, we offer you the option of making payments through:

Apple Pay
Apple Inc.
1 Infinite Loop
Cupertino, CA 95014
USA

Hereinafter referred to as “Apple” and “Apple Pay.”

and

Google Pay
Google Ireland Ltd.
Gordon House
Barrow Street
Dublin 4
Ireland

Hereinafter referred to as “Google” and “Google Pay.”

If you select one of these payment methods, the payment will be processed through Apple Pay or Google Pay.

We do not have access to your payment data.

The processing is carried out for the purpose of performing the contract.

The legal basis for processing is Article 6(1), first sentence, point (b) GDPR.

The provision of your payment data to Google or Apple is necessary for the performance of the purchase agreement. You are therefore required to provide the relevant payment data.

If you do not provide your payment data, it will not be possible to conclude and/or perform the contract using these payment methods.

Apple and Google may also process your data in the United States.

An adequacy decision of the European Commission applies to transfers of data to the United States, under which Google is certified.

We have also entered into Standard Contractual Clauses with Apple and Google. Upon request, we will provide you with a copy.

Further information concerning data protection, particularly applicable retention periods, is available from Apple at:

https://www.apple.com/legal/privacy/de-ww/

and from Google at:

https://policies.google.com/privacy?hl=de&gl=de

Credit-Card Payments

For the purpose of processing credit-card payments, we transmit the payment data required for the credit-card transaction to the financial institution responsible for the payment or, where applicable, to the payment or invoicing service provider engaged by us.

The processing is carried out on the basis of Article 6(1), first sentence, point (b) GDPR.

The provision of your payment data is necessary and mandatory for the conclusion and performance of the contract.

If you do not provide the payment data, it will not be possible to conclude and/or perform the contract using a credit-card payment.

The data required for payment processing are securely transmitted using SSL and are processed exclusively for the purpose of processing the payment.

We erase the data generated in this context once their storage is no longer necessary or restrict their processing where statutory retention obligations apply.

Due to mandatory commercial and tax-law requirements, we are required to retain your address, payment and order data for a period of up to ten years.

Legal Enforcement / Address Tracing / Debt Collection

In the event of non-payment, we reserve the right to transmit the data provided when the order was placed to a lawyer and/or external companies for the purposes of tracing an address and/or enforcing legal claims.

Such external companies may include:

Verband der Vereine Creditreform e.V.
Hellersbergstraße 12
D-41460 Neuss
Germany

The legal basis for processing is Article 6(1), first sentence, point (f) GDPR.

Our legitimate interests consist of preventing fraud and avoiding payment-default risks.

Upon request, we will provide you with information concerning our legitimate-interest assessment free of charge.

We may also disclose your data where necessary to protect or enforce our rights and the rights of:

companies affiliated with us;
our cooperation partners;
our employees; and/or
users of our website.

Under no circumstances will we sell or rent your data to third parties.

The legal basis for processing is Article 6(1), first sentence, point (f) GDPR.

We have a legitimate interest in processing the data for the purpose of enforcing legal claims.

Upon request, we will provide you with information concerning our legitimate-interest assessment free of charge.

We erase the data generated in this context once their storage is no longer necessary or restrict their processing where statutory retention obligations apply.

You may object to the processing. Your right to object applies where there are grounds relating to your particular situation.

You may submit your objection using the contact details provided in the “Controller” section.

Hosting

We use external hosting services provided by:

Shopify Inc.
151 O’Connor Street, Ground Floor
Ottawa, Ontario K2P 2L8
Canada

Hereinafter referred to as “Shopify.”

These services are used to provide the following:

infrastructure and platform services;
computing capacity;
storage resources;
database services;
security services; and
technical maintenance services.

For these purposes, all data required for the operation and use of our website are processed, including the access data described in the section “Use of Our Website.”

Shopify processes your personal data on our behalf as a processor pursuant to a data-processing agreement under Article 28 GDPR.

Shopify also processes your data in Canada.

An adequacy decision of the European Commission applies to transfers of data to Canada.

Content Delivery Network

To ensure that you can access our online content quickly, we use a content delivery network, hereinafter referred to as a “CDN.”

When you visit our website, a library is loaded from our CDN and temporarily stored on your device in order to provide the content more quickly and avoid the need to load it again.

Some of the data described in the section “Use of Our Website” may also be transmitted to the CDN.

We use the following service providers for our CDN:

Cloudflare Germany GmbH
Rosental 7
80331 Munich
Germany

and

Cloudflare, Inc.
101 Townsend Street
San Francisco, CA 94107
USA

Cloudflare may process some of your data in the United States.

An adequacy decision of the European Commission applies to transfers of data to the United States. Cloudflare, Inc. is certified under the relevant framework.

We have also entered into Standard Contractual Clauses with Cloudflare, Inc. in order to require Cloudflare to maintain an appropriate level of data protection.

A copy of the Standard Contractual Clauses is available at:

https://www.cloudflare.com/de-de/cloudflare-customer-dpa/

Further information concerning data protection and retention periods is available at:

https://www.cloudflare.com/de-de/privacypolicy/

The service provider processes your personal data on our behalf as a processor pursuant to a data-processing agreement under Article 28 GDPR.

Services for Statistical, Analytical and Marketing Purposes

We use third-party services for statistical, analytical and marketing purposes.

These services enable us to provide you with a user-friendly and optimised website experience.

The third-party providers use cookies, pixels, browser-fingerprinting technologies or other tracking technologies to operate their services.

Below, we provide information about the external services currently used on our website, the processing carried out in each individual case and the options available to you for withdrawing your consent.

Google Ads Conversions

We use Google Ads, provided by:

Google Ireland Ltd.
Gordon House
Barrow Street
Dublin 4
Ireland

and

Google LLC
1600 Amphitheatre Parkway
Mountain View, CA 94043
USA

Hereinafter referred to as “Google” and “Google Ads.”

We use Google Ads to draw attention to our products and services on external websites through advertising materials, formerly known as Google AdWords.

By comparing the data generated through advertising campaigns, we can determine how successful individual advertising measures are.

Google delivers these advertisements through advertising servers.

For this purpose, we use advertising-server cookies through which certain parameters relating to audience measurement may be recorded, such as:

the display of advertisements; and
clicks by users.

If you reach our website through a Google advertisement, Google Ads stores a cookie on your terminal device.

Using these cookies, Google processes information generated by your device concerning your interactions with our advertising materials, including:

access to a particular webpage;
clicks on advertising materials;
your IP address;
browser information;
the website previously visited; and
the date and time of the server request.

These data are processed for the purpose of analysing and displaying the reach of our advertisements.

For this purpose, Google may also determine whether different terminal devices belong to you or to your household.

Due to the marketing tools used, your browser automatically establishes a direct connection with Google’s servers.

If you are registered with a Google service, Google may associate your visit with your Google account.

Even if you are not registered with Google or are not logged in, Google may obtain and process your IP address.

We receive only statistical analyses from Google for the purpose of measuring the success of our advertising materials.

With regard to the storage of information on, and access to information stored on, your terminal device, the legal basis is Section 25(1) TDDDG.

The legal basis for the further processing of your personal data is your consent pursuant to Article 6(1), first sentence, point (a) GDPR.

Google also processes some of the data in the United States.

An adequacy decision of the European Commission applies to transfers of data to the United States.

We have also entered into Standard Contractual Clauses with Google in order to require Google to maintain an appropriate level of data protection.

A copy of the Standard Contractual Clauses is available at:

https://cloud.google.com/terms/sccs

Google stores the data for no longer than 90 days.

Further information concerning data protection and retention periods at Google is available at:

https://policies.google.com/privacy

The lawfulness of processing carried out before the withdrawal of your consent remains unaffected.

Google Ads Enhanced Conversions

To optimise the success of our advertising campaigns and to improve our ability to measure them, we use the “Google Enhanced Conversions” function of Google Ads, provided by:

Google Ireland Ltd.
Gordon House
Barrow Street
Dublin 4
Ireland

and

Google LLC
1600 Amphitheatre Parkway
Mountain View, CA 94043
USA

Hereinafter referred to as “Google.”

In connection with this function, Google processes personal data previously provided by our customers or users during the ordering process or when subscribing to the newsletter.

These data are recorded by conversion-tracking tags and transmitted to Google and may include:

first name and surname; and
email address.

Before being transmitted to Google, the information is converted into hashed checksums, or “hash values,” using the cryptographic Secure Hashing Algorithm 256, or SHA-256.

These pseudonymised customer data are then automatically matched by Google against available information from Google accounts.

This enables conversions generated through our campaign to be attributed to advertising events such as clicks or views.

With regard to the storage of information on, and access to information stored on, your terminal device, as well as the hashing of your personal data, the legal basis is your consent pursuant to Section 25(1) TDDDG.

The legal basis for the further processing is also your consent pursuant to Article 6(1), first sentence, point (a) GDPR.

Google also processes some of the data in the United States.

An adequacy decision of the European Commission applies to transfers of data to the United States. Google is certified under the relevant framework.

We have also entered into Standard Contractual Clauses with Google in order to require Google to maintain an appropriate level of data protection.

A copy of the Standard Contractual Clauses is available at:

https://cloud.google.com/terms/sccs

Google stores the data for no longer than 14 months.

Further information concerning data protection and retention periods at Google is available at:

https://policies.google.com/privacy

The lawfulness of processing carried out before the withdrawal of your consent remains unaffected.

Google Ads Customer Match

We use the “Customer Match” function of Google Ads, provided by:

Google Ireland Ltd.
Gordon House
Barrow Street
Dublin 4
Ireland

and

Google LLC
1600 Amphitheatre Parkway
Mountain View, CA 94043
USA

Hereinafter referred to as “Google” and “Customer Match.”

We use this function to deliver targeted advertising and to reach existing customers again.

In connection with this function, Google processes personal data previously provided by our customers or users during the ordering process or when subscribing to the newsletter.

These data are collected through the relevant tags and subsequently transmitted to Google and may include:

first name and surname; and
email address.

Before being transmitted to Google, the information is converted into checksums, or “hash values,” using the cryptographic Secure Hashing Algorithm 256, or SHA-256.

After transmission, Google automatically compares and evaluates these pseudonymised customer data against information available from Google accounts.

Where the comparison produces a match, the information is used to create audience segments for targeted advertising within the Google Display Network or Google Search Network.

Where the comparison does not produce a match, the hash values are deleted.

The legal basis for the further processing is also your consent pursuant to Article 6(1), first sentence, point (a) GDPR.

Google also processes some of the data in the United States.

An adequacy decision of the European Commission applies to transfers of data to the United States. Google is certified under the relevant framework.

We have also entered into Standard Contractual Clauses with Google in order to require Google to maintain an appropriate level of data protection.

A copy of the Standard Contractual Clauses is available at:

https://cloud.google.com/terms/sccs

We regularly delete the audience segments created, depending on the duration of the relevant advertising campaign. The audience segments are automatically deleted after 540 days.

Further information concerning data protection and retention periods at Google is available at:

https://policies.google.com/privacy

The lawfulness of processing carried out before the withdrawal of your consent remains unaffected.

Google Ads Audience Expansion

We use the “Audience Expansion” function of Google Ads, provided by:

Google Ireland Ltd.
Gordon House
Barrow Street
Dublin 4
Ireland

and

Google LLC
1600 Amphitheatre Parkway
Mountain View, CA 94043
USA

Hereinafter referred to as “Google” and “Audience Expansion.”

We use Audience Expansion to reach new customers who have characteristics similar to the audience segments previously created through Customer Match.

These audience segments serve as the basis for Audience Expansion.

Expanded audiences consist of groups of individuals who share characteristics with our existing customers or contacts.

This allows us to deliver relevant content to individuals who are considered likely to be interested in our products or services.

To create expanded audiences, Google analyses the characteristics of the original audience, including:

demographic data;
interests; and
patterns of behaviour.

On the basis of this analysis, Google may identify other users who resemble the original audience and group them into an expanded audience.

This new audience can then be targeted with advertising, thereby increasing the likelihood of reaching individuals who may be interested in our products or services.

The legal basis for the further processing carried out to create expanded audiences is also your consent pursuant to Article 6(1), first sentence, point (a) GDPR.

The lawfulness of processing carried out before the withdrawal of your consent remains unaffected.

Irrespective of any consent granted to Google for the creation of expanded audiences, overriding legitimate interests serve as the legal basis for the processing of your personal data pursuant to Article 6(1), point (f) GDPR where you have not previously visited our websites or application.

Our legitimate interests consist of:

expanding our audiences to include potential customers;
improving the relevance and effectiveness of our marketing activities;
reducing advertising expenditure; and
improving the individual user experience.

Upon request, we will provide you with information concerning our legitimate-interest assessment free of charge.

We regularly delete the audience segments created, depending on the duration of the relevant advertising campaign. The audience segments are automatically deleted after 540 days.

Upon request, we will provide further information concerning the legitimate-interest assessment.

Further information concerning data protection and retention periods at Google is available at:

https://policies.google.com/privacy

You may object to this processing. Your right to object applies where there are grounds relating to your particular situation.

You may submit your objection using the contact details provided in this Privacy Policy.

Meta Pixel — Custom Audiences and Lookalike Audiences

We use functions provided by Meta on our websites. The providers are:

Meta Platforms Ireland Limited
4 Grand Canal Square
Dublin 2
Ireland

and

Meta Platforms, Inc.
1601 Willow Road
Menlo Park, California
USA

Hereinafter referred to as “Meta.”

For this purpose, we use the Meta Pixel to:

analyse the use of our websites and online presences, including our presences on social networks such as Facebook and Instagram;
analyse users’ interactions with our websites and online presences;
display personalised advertisements based on your usage behaviour; and
measure the reach of our advertisements.

Meta Pixels are graphics embedded in our websites that are automatically loaded when our websites are accessed and enable user behaviour to be tracked.

Through the integration of the Meta Pixel, your browser automatically establishes a direct connection with Meta’s servers.

Meta processes information generated by your terminal device concerning your use of our websites, for example that you have accessed a particular webpage.

Meta processes, in particular:

your IP address;
browser information;
your Meta ID;
device ID;
language settings;
the date and time of the server request; and
event data, such as webpage views, button clicks and other interactions.

These data are processed for the purposes of:

analysing our websites and online presences;
analysing user interactions;
displaying user-specific advertisements; and
measuring the reach of our advertisements.

For these purposes, Meta may also determine whether different terminal devices belong to you or to your household.

If you are registered with a Meta service, Meta may associate the information collected with your account or with you as a user.

Even where a user is not registered with Meta or is not logged in, Meta may obtain and process the user’s IP address and other identifying characteristics.

We also use Meta’s “Custom Audience from Your Website” function for advertising targeting.

Through the Meta Pixel, information concerning your usage behaviour on our website is collected on the basis of your user ID and processed by Meta.

Before being transmitted to Meta, the information processed is converted into checksums, or “hash values,” using the cryptographic Secure Hashing Algorithm 256, or SHA-256.

After transmission, Meta automatically compares and evaluates these pseudonymised customer data against information available from Meta accounts.

Where this comparison produces a match, Meta uses the information to create audience segments for targeted advertising on the Facebook and Instagram social networks.

Where the comparison does not produce a match, the hash values are deleted.

This allows interest-based advertisements, or Meta Ads, to be displayed when users of our website and Meta users belonging to a comparable audience visit Facebook or Instagram. It also allows their interactions with our website to be analysed.

We use the Meta Pixel in Advanced Matching Mode.

In addition to standard events, such as webpage views and completed purchases, additional data may be transmitted to Meta where available, including:

email address;
telephone number;
first name and surname;
city;
postal code;
country; and
external user ID.

Before transmission, these data are also converted into checksums, or “hash values,” using the cryptographic Secure Hashing Algorithm 256, or SHA-256.

After transmission, Meta automatically compares and evaluates these pseudonymised customer data against information available from Meta accounts.

Where the comparison produces a match, Meta uses the information to create audience segments for targeted advertising on Facebook and Instagram.

Where the comparison does not produce a match, the hash values are deleted.

With regard to the storage of information on, and access to information stored on, your terminal device, the legal basis is your consent pursuant to Section 25(1) TDDDG.

The legal basis for the further processing is your consent pursuant to Article 6(1), first sentence, point (a) GDPR.

Meta also processes some of the data in the United States.

An adequacy decision of the European Commission applies to transfers of data to the United States. Meta is certified under the relevant framework.

We have also entered into Standard Contractual Clauses with Meta in order to require Meta to maintain an appropriate level of data protection.

You may request a copy of the Standard Contractual Clauses from Meta at:

https://www.facebook.com/help/contact/341705720996035

Information stored in Meta cookies is retained for 90 days.

Further information concerning data protection and retention periods at Meta is available at:

https://www.facebook.com/privacy/explanation

and

https://www.facebook.com/policies/cookies/

The lawfulness of processing carried out before the withdrawal of your consent remains unaffected.

Joint Controllership for Meta Business Tools

When Meta Business Tools are used, your personal data, referred to as “Business Tool Data,” are processed both by us and by Meta.

The processing of personal data described above in connection with the use of Meta Business Tools, particularly the processing of hashed contact information and event data generated through the analysis of your interactions with our websites and online presences, is carried out under joint controllership pursuant to Article 26 GDPR.

Responsibility for complying with the applicable data-protection obligations under the GDPR may vary depending on the relevant phase of processing.

The purposes of the processing consist of optimising the relevant marketing campaigns and analyses, particularly by matching data against Meta user IDs in order to deliver targeted advertising. We use Meta Business Tools as the means of carrying out this processing.

We have entered into a joint-controllership agreement with Meta pursuant to Article 26(1), second sentence, GDPR. This agreement specifies which party is responsible for complying with the applicable GDPR obligations during each phase of processing.

You may exercise your rights as a data subject against either us or Meta.

We and Meta will inform one another without undue delay of any data-subject rights exercised against either party.

We will provide one another with all information required to respond to the relevant data-subject requests.

Irrespective of which party is responsible for a particular phase of processing in connection with Meta Business Tools, we provide data subjects with the information required under Articles 13 and 14 GDPR through this Privacy Policy.

Upon separate request submitted using the contact details provided by us, we will also provide information concerning the joint-controllership arrangement pursuant to Article 26(2), second sentence, GDPR.

For this purpose, we and Meta will provide one another with all necessary information from our respective areas of responsibility.

The legal basis for the joint processing is your consent pursuant to Section 25(1) TDDDG and, with regard to the further processing, Article 6(1), first sentence, point (a) GDPR.

Further information concerning the processing, particularly the joint controllership with Meta, is available at:

https://www.facebook.com/legal/terms/businesstools_jointprocessing

https://www.facebook.com/legal/terms/businesstools/preview?_rdr

and

https://www.facebook.com/about/privacy

The joint-controllership agreement entered into with Meta in connection with Meta Business Tools is available at:

https://www.facebook.com/legal/controller_addendum

Meta Conversions API

We use measurement functions provided by Meta on our websites. The providers are:

Meta Platforms Ireland Limited
4 Grand Canal Square
Dublin 2
Ireland

and

Meta Platforms, Inc.
1601 Willow Road
Menlo Park, California
USA

Hereinafter referred to as “Meta.”

For this purpose, we use the Meta Conversions API to measure the reach and success of our advertisements.

The Meta Conversions API is an application programming interface that enables us to transmit marketing information and parameters relating to website visitors’ interactions with our website directly to Meta’s servers and to evaluate those data.

We use the resulting information to optimise our marketing and advertising campaigns and to create audiences, particularly audiences consisting of Meta users, to whom we can display advertisements tailored to their interests.

When you access our websites, your browser automatically establishes a direct connection with Meta’s servers.

Through the integration of the Conversions API, Meta processes information generated by your terminal device concerning your use of our websites, for example that you accessed a particular webpage.

Meta processes, in particular:

your IP address;
browser information;
your Meta ID;
device ID;
language settings;
the date and time of the server request; and
event data, such as webpage views, button clicks and other interactions.

These data are processed for the purposes of:

analysing our websites and online presences;
analysing user interactions; and
measuring the reach of our advertisements.

For these purposes, Meta may also determine whether different terminal devices belong to you or to your household.

Meta also processes personal data previously provided by our customers or users during the ordering process or when subscribing to the newsletter, which are collected through the Meta Conversions API and subsequently transmitted to Meta.

These data may include:

first name and surname; and
email address.

Before being transmitted to Meta, the information is converted into hashed checksums, or “hash values,” using the cryptographic Secure Hashing Algorithm 256, or SHA-256.

After transmission, Meta automatically compares these pseudonymised customer data against information available from Meta accounts.

This enables conversions generated through our advertising campaigns to be attributed to advertising events such as clicks or views.

The information obtained through the Meta Conversions API is transmitted to us by Meta in anonymised statistical form and does not allow us to identify the individual user.

If you are registered with a Meta service, Meta may associate the information collected with your account or with you as a user.

Even where a user is not registered with Meta or is not logged in, Meta may obtain and process the user’s IP address and other identifying characteristics.

With regard to the storage of information on, and access to information stored on, your terminal device, the legal basis is your consent pursuant to Section 25(1) TDDDG.

The legal basis for the further processing is also your consent pursuant to Article 6(1), first sentence, point (a) GDPR.

Meta also processes some of the data in the United States.

An adequacy decision of the European Commission applies to transfers of data to the United States. Meta is certified under the relevant framework.

We have also entered into Standard Contractual Clauses with Meta in order to require Meta to maintain an appropriate level of data protection.

You may request a copy of the Standard Contractual Clauses from Meta at:

https://www.facebook.com/help/contact/341705720996035

Further information concerning data protection and retention periods at Meta is available at:

https://www.facebook.com/privacy/explanation

and

https://www.facebook.com/policies/cookies/

The lawfulness of processing carried out before the withdrawal of your consent remains unaffected.

Joint Controllership for Meta Business Tools

When Meta Business Tools are used, your personal data, referred to as “Business Tool Data,” are processed both by us and by Meta.

Responsibility for complying with the applicable data-protection obligations under the GDPR may vary depending on the relevant phase of processing.

You may exercise your rights as a data subject against either us or Meta.

We and Meta will inform one another without undue delay of any data-subject rights exercised against either party.

We will provide one another with all information required to respond to the relevant data-subject requests.

Upon separate request submitted using the contact details provided by us, we will also provide information concerning the joint-controllership arrangement pursuant to Article 26(2) GDPR.

For this purpose, we and Meta will provide one another with all necessary information from our respective areas of responsibility.

The legal basis for the joint processing is your consent pursuant to Section 25(1) TDDDG and, with regard to the further processing, Article 6(1), first sentence, point (a) GDPR.

Further information concerning the processing, particularly the joint controllership with Meta, is available at:

https://www.facebook.com/legal/terms/businesstools_jointprocessing

https://www.facebook.com/legal/terms/businesstools/preview?_rdr

and

https://www.facebook.com/about/privacy

The joint-controllership agreement entered into with Meta in connection with Meta Business Tools is available at:

https://www.facebook.com/legal/controller_addendum

Microsoft Clarity

To optimise our website in line with users’ interests, we use “Microsoft Clarity,” a web-analytics service provided by:

Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18
Ireland

and

Microsoft Corporation
One Microsoft Way
Redmond, WA 98052-6399
USA

Hereinafter referred to as “Microsoft” and “Microsoft Clarity.”

Microsoft Clarity uses cookies that are stored on your terminal device for recognition purposes.

For this purpose, a randomly generated identification number, or user ID, is assigned to your terminal device.

Using this technology, Microsoft processes information generated concerning the use of our website by your terminal device, as well as access data, for the purposes of analysing user behaviour and optimising the usability of our website.

The information processed may include, for example:

access to a particular webpage;
time spent on the website;
entry and exit pages;
clicking behaviour;
swiping behaviour;
scrolling behaviour; and
similar user interactions.

The access data include, in particular:

your IP address;
browser information;
device information; and
the date and time of the server request.

For these purposes, Microsoft Clarity uses the following first-party cookies:

“_clck”

This cookie has a lifetime of one year. It contains a randomly generated user ID and is used to recognise your terminal device across multiple sessions.

“_clsk”

This cookie has a lifetime of one day. It combines individual webpage views into a continuous session recording.

A central feature of Microsoft Clarity is the use of session recordings. These are recordings of individual user sessions that document interactions such as mouse movements, clicks and scrolling behaviour in anonymised form.

Microsoft Clarity also generates heatmaps that visually display, in aggregated form, which areas of a webpage users interact with most frequently.

Entries made in form fields and other content classified as sensitive are automatically masked by Microsoft before transmission.

Microsoft also automatically derives usability metrics from the data collected, including:

rage clicks, meaning repeated clicks on an element without the expected response; and
dead clicks, meaning clicks on non-interactive elements.

These metrics may indicate problems affecting the usability of the website.

With regard to the storage of information on, and access to information stored on, your terminal device, the legal basis is Section 25(1) TDDDG.

The legal basis for the further processing is your consent pursuant to Article 6(1), first sentence, point (a) GDPR.

Microsoft also processes some of the data in the United States.

An adequacy decision of the European Commission based on the EU–US Data Privacy Framework applies to transfers of data to the United States. Microsoft Corporation is certified under that framework.

We have also entered into Standard Contractual Clauses with Microsoft in order to require Microsoft to maintain an appropriate level of data protection.

Upon request, we will provide the Standard Contractual Clauses.

Session recordings are stored for 30 days by default. Recordings marked as favourites may be retained for up to 13 months.

Further information concerning data protection at Microsoft is available at:

https://privacy.microsoft.com/de-de/privacystatement

The lawfulness of processing carried out before the withdrawal of your consent remains unaffected.

Taboola Tracking Pixel

We use tracking functions provided by:

Taboola.com Ltd.
16 Madison Square West, 7th Floor
New York, NY 10010
USA

Hereinafter referred to as “Taboola.”

We use Taboola on our websites to:

measure actions taken by visitors to our website;
optimise our advertising campaigns; and
display personalised advertising.

For this purpose, Taboola stores a cookie on users’ terminal devices in order to measure the reach of our advertisements and attribute the success of particular advertising materials.

Using these cookies, Taboola processes information generated by your terminal device concerning your interactions with our advertising materials, including:

access to a particular webpage;
clicks on advertising materials;
time spent on the website;
scrolling behaviour;
your IP address;
location information;
browser information;
operating-system information; and
the date and time of the server request.

These data are processed for the purpose of analysing and visually presenting the measured reach of our advertisements.

With regard to the storage of information on, and access to information stored on, your terminal device, the legal basis is Section 25(1) TDDDG.

The legal basis for the further processing is your consent pursuant to Article 6(1), first sentence, point (a) GDPR.

Taboola may also process data in:

the United States;
the United Kingdom;
Israel;
Singapore; and
Hong Kong.

Adequacy decisions of the European Commission apply to transfers of data to the United Kingdom and Israel.

For transfers to the other countries, Taboola uses Standard Contractual Clauses.

Taboola stores the data for no longer than 13 months.

Further information concerning data protection and retention periods at Taboola is available at:

https://policies.taboola.com/de/privacy-policy/

The lawfulness of processing carried out before the withdrawal of your consent remains unaffected.

Octane AI

We use tracking functions provided by:

Octane AI, Inc.
1266 Harrison Street
San Francisco, California
USA

Hereinafter referred to as “Octane AI.”

We use Octane AI on our websites to display personalised advertising to our customers and to measure actions taken by visitors to our website.

For this purpose, Octane AI stores a cookie on users’ terminal devices in order to measure the reach of our advertisements and attribute the success of particular advertising materials.

Using these cookies, Octane AI processes your quiz and survey data, particularly:

answers provided in product quizzes;
your stated interests; and
information generated by your terminal device concerning interactions with our advertising materials.

The information concerning your interactions may include:

clicking behaviour;
time spent on the website;
URL clickstreams;
your IP address;
browser information;
device information; and
the date and time of the server request.

These data are processed for the purposes of analysing and improving our advertisements.

With regard to the storage of information on, and access to information stored on, your terminal device, the legal basis is Section 25(1) TDDDG.

The legal basis for the further processing is your consent pursuant to Article 6(1), first sentence, point (a) GDPR.

Octane AI also processes some of the data in the United States and in other countries outside the European Union.

Where data are transferred to a country for which no adequacy decision of the European Commission exists, Octane AI has entered into Standard Contractual Clauses with the relevant recipient, unless that recipient is subject to Binding Corporate Rules approved by a data-protection supervisory authority.

The data generated in this context are erased once their storage is no longer necessary, or their processing is restricted where statutory retention or documentation obligations apply.