Data protection

We attach great importance to data protection. Your personal data is collected and processed in compliance with the applicable data protection regulations, in particular the EU General Data Protection Regulation (GDPR). We collect and process your personal data in order to be able to offer you our website and our services. In accordance with Art. 13 GDPR, in this policy we describe which data we use, in what manner, for what purpose and to what extent, and which choices and rights you have in connection with the use of your personal data.

1. Controller

hey sleepy GmbH, represented by its managing director Theresa Schabert, Mühlenstraße 8A, 14167 Berlin, is responsible for compliance with data protection on our website. We have not appointed a data protection officer.

We are happy to assist you with any data protection inquiries. For this purpose, you have the following contact options:

Email: info@lottili.de

2. Data collection on our website

Server log files

When you access our website, information is automatically transmitted by your browser to the server of our website. This information is stored only briefly in a so-called log file and is deleted automatically.

This includes the following data:

your IP address,
date and time of access,
name and URL of the file you accessed,
website from which the access is made (referrer URL),
information about the browser and operating system you use,
name of your access provider.

This data is used for the purpose of ensuring a smooth connection setup and convenient use of our website, as well as for evaluating system security and stability.

The legal basis for the data processing is Art. 6(1) sentence 1 (f) GDPR, as we have a legitimate interest in collecting the data for the aforementioned purposes. In addition, a legal basis for processing data for the performance of a contract or for pre-contractual measures also arises from Art. 6(1)(b) GDPR.

The data is not used to draw conclusions about your person.

Website hosting via Shopify

Our website was created with Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (hereinafter "Shopify") and is hosted on Shopify's servers. This is done on the basis of a data processing agreement between Shopify and us pursuant to Art. 28 GDPR and on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR in creating and operating our website.

Further information can be found at:

https://www.shopify.de/legal/datenschutz.

Contact form / communication by email

Our website contains a contact form. With it, we want to give our customers the opportunity to contact us easily. You can also write to us directly by email. If you wish to use our contact form, you must provide your name and a valid email address. If you write to us by email, we receive your email address. All other data provided is optional. The data is collected for the purpose of initiating or performing contractual relationships pursuant to Art. 6(1)(b) GDPR. If your inquiry is not aimed at initiating or performing a contract, we nevertheless have a legitimate interest in processing and answering your inquiry. In that case, the use of the personal data for this purpose is governed by Art. 6(1)(f) GDPR.

We use the data you provide exclusively to process your inquiry. If your inquiry relates to the initiation or performance of business, we delete your data in accordance with our internally defined deletion periods.

If your inquiry relates to another purpose, we delete your data after it has been processed, unless there is another legal basis for storing the data.

Processing of customer and contract data

For the purpose of initiating business, concluding a contract and performing the contract, we use the personal data necessary for this pursuant to Art. 6(1)(b) GDPR.

Data is transferred to third parties only if this is necessary for the performance of the contract, e.g. if a company has been engaged for production or transport services or a credit institution has been engaged for payment processing.

This personal data is deleted after expiry of the statutory warranty periods or after the end of the statutory retention periods.

You can also create a user account with us. To do so, you must provide the data requested during registration. In the user account, you can then view the profile data you have provided and stored as well as information on orders or on products you have saved. The user account is not publicly accessible. If you delete your user account, all data will be deleted, except for data that we are obliged to retain under commercial and tax law pursuant to Art. 6(1)(c) GDPR.

With every login, registration, order or other binding action, we store your IP address as well as the date and time. This is done for your protection and, pursuant to Art. 6(1)(f) GDPR, on the basis of our legitimate interest in being able to prove that a claim has arisen and in preventing misuse or unauthorized use of our system.

Furthermore, within the scope of your consent pursuant to Art. 6(1)(a) GDPR, a cookie may be set that stores your data so that it is entered automatically on your next visit.

Processing by payment service providers

For services subject to a charge, we process your personal data, in particular payment data (account, credit card and other bank data), on the basis of Art. 6(1)(b) GDPR. This is done for the purpose of performing the contract (payment processing/accounting). Insofar as necessary, your payment data is transmitted to service providers (credit institutions, payment providers, accounting service providers) for the payment transaction and for billing, or is processed directly by them.

Your payment data is stored for the duration of the contractual relationship and is deleted after the contractual relationship has been fully terminated (until all mutual contractual obligations have been fulfilled), unless there is another legal basis for storing the data.

We use the following payment providers:

PayPal

PayPal privacy policy: https://www.paypal.com/de/smarthelp/article/datenschutz-und-sicherheit-faq3712

Klarna

Klarna privacy policy: https://www.klarna.com/de/datenschutz/

Apple Pay

Further information on Apple Pay can be found at: https://www.apple.com/de/apple-pay/

Shopify Payments

Shopify Payments privacy policy https://www.shopify.de/legal/datenschutz

Stripe

Payments in the rental checkout are processed via Stripe, a service of Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe may also transfer data to Stripe, Inc. in the USA. Stripe privacy policy: https://stripe.com/privacy

Mollie Payments

Mollie Payments privacy policy https://www.mollie.com/de/privacy

Review reminder by Reviews.io

During or after your order, you can give your consent pursuant to Art. 6(1)(a) GDPR to our sending you a review reminder by email. For this purpose, we use the tool of REVIEWS.io 2020 GmbH, Stralauer Allee 6, 10245 Berlin. In this context, your data is passed on to REVIEWS.io 2020 GmbH under a data processing agreement. You can withdraw your consent to this at any time by sending a notice to the controllers responsible for the data processing or by contacting REVIEWS.io 2020 GmbH directly.

SendCloud

The delivery of your order is handled via the shipping portal "SendCloud" (SendCloud GmbH, Kanalstr. 10, 80538 München). In accordance with Article 6(1)(b) of the General Data Protection Regulation (GDPR), we transmit your data to SendCloud exclusively for the purpose of processing your online order. Your data is passed on only if this is actually necessary to carry out the shipping process.

Further information on data protection at SendCloud can be found on their website at www.sendcloud.de/datenschutz/.

Shipping via easyDHL

For the purpose of processing shipments via DHL, we use the service "easyDHL" of 247APPS, Stefan Neuser Dipl. Ing. IT (FH), Langenaustraße, 116, 56070 Koblenz, on our website. The data processing is carried out pursuant to Art. 6(1)(b) of the General Data Protection Regulation (GDPR). The app enables an interface between our shop and DHL. Via easyDHL, the first and last name, company name, address, email address and telephone number of the person placing the order are processed by 247APPS and transmitted to DHL, insofar as shipping is carried out via DHL. Once the data transfer to the DHL shipping interface has been completed successfully, the data is automatically deleted in the easyDHL app. 247APPS processes the data only for the aforementioned purpose. We have concluded a data processing agreement with 247APPS for this purpose.

Rental checkout and subscription management via Circuly

On this website, we use circuly for our checkout and subscription management. circuly is a software company from Germany with its headquarters in Germany, 33602 Bielefeld, Obernstr. 50, phone: +49 176 552 884 77. This is an integrated software solution with which we cover various aspects of our subscription management. These include, among others: checkout, customer login, invoices and payment processing, communication, returns management and reporting. This information is stored on servers of our software partner circuly. It may be used by us to contact our customers and to provide our subscription services. All information collected by us is subject to this privacy policy. We use all information collected exclusively for processing the (subscription) order.

Legal basis

The legal basis for using the services of circuly is Art. 6(1)(f) GDPR (legitimate interest). Our legitimate interest in using this service is the efficient and customer-friendly processing of subscription contracts.

Recipient

The recipient is circuly GmbH, Obernstr. 50, 33602 Bielefeld, Deutschland.

Transfer to third countries

The use of the service may result in personal data being transferred to a third country. In the event of a transfer of personal data, the provider ensures the level of protection of the GDPR by complying with Art. 44 et seq. GDPR. If there is no adequacy decision for the third country in which the data importer is established, the transfer is made subject to appropriate safeguards. If you have any questions, please feel free to contact us.

Duration of data storage

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. In addition, the data will be deleted if you withdraw your consent or request the erasure of the personal data.

Right to object

Pursuant to Art. 21(1) GDPR, you have the right to object to the processing of your personal data at any time. If you exercise this right, processing for this purpose will no longer take place. Further information on this can be found above in our privacy policy under “Rights of data subjects”.

Contractual or statutory obligation

There is no contractual or statutory obligation to provide the data.

Further privacy information via link

https://www.circuly.io/data-privacy
https://www.circuly.io/data-processing-agreement

Credit check via CRIF

Within the framework of this contractual relationship, we transmit personal data collected about the application for this business relationship to CRIF GmbH, Leopoldstraße 244, 80807 München.

The legal bases for this transmission are Article 6(1) sentence 1 point (b) and point (f) of the General Data Protection Regulation (GDPR). The data exchange with CRIF GmbH also serves to fulfill statutory obligations to carry out creditworthiness checks (§§ 505a and 506 of the Bürgerliches Gesetzbuch, the German Civil Code).

CRIF GmbH processes the data received and also uses it for the purpose of profiling (scoring) in order to provide its contractual partners in the European Economic Area and in Switzerland and, where applicable, others with information, among other things for assessing the creditworthiness of natural persons. The transfer of personal data to countries outside the European Economic Area takes place in accordance with the requirements of the European Commission. More detailed information on the activities of CRIF GmbH can be found in its information sheet or viewed online at www.crif.de/datenschutz .

Newsletter

On our website, you have the option of subscribing to a free newsletter for the purpose of direct advertising. When you register for the newsletter, your name and email address from the input form are transmitted to us. In addition, your IP address and the date and time of registration are used. The collection of other personal data during the registration process serves to prevent misuse of the services or of the email address used.

Your consent to the processing of the data is obtained during the registration process, and reference is made to this privacy policy. The legal basis for the processing of the data after the user has registered for the newsletter is, where the user has given consent, Art. 6(1)(a) GDPR.

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. Accordingly, the user’s email address is stored for as long as the newsletter subscription is active.

If you have entered into a contractual relationship with us on our website and provided your email address in the process, we may subsequently use it to send a newsletter for the purpose of direct advertising. In such a case, the newsletter will be used exclusively to send direct advertising for our own similar goods or services. The legal basis for sending the newsletter as a result of the sale of goods or services is § 7(3) UWG.

The user concerned can cancel the newsletter subscription at any time. For this purpose, each newsletter contains a corresponding link.

Emails are sent subject to officially recognized special contractual obligations (so-called “standard contractual clauses”) within the framework of a data processing agreement using Klaviyo, a mailing tool (Klaviyo, 125 Summer Street, Floor 6, Boston, MA 02110, USA). Klaviyo has submitted to European data protection law.

Further information on data protection can be found at: https://www.klaviyo.com/privacy

Use of data for advertising purposes

On our website, you can also give your consent to be contacted by us for the purpose of direct advertising. When you give your consent, your data from the input form is transmitted to us. In addition, your IP address and the date and time of consent are used. The collection of other personal data during the registration process serves to prevent misuse of the services or of the email address used.

Your consent to the processing of the data is obtained during the registration process, and reference is made to this privacy policy. The legal basis for the processing of the data is, where the user has given consent, Art. 6(1)(a) GDPR.

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. Accordingly, the user’s email address is stored for as long as you have not withdrawn your consent.

If you have entered into a contractual relationship with us on our website and provided your email address in the process, we may subsequently use it to send a newsletter for the purpose of direct advertising. In such a case, the newsletter will be used exclusively to send direct advertising for our own similar goods or services. The legal basis for sending direct advertising as a result of the sale of goods or services is Art. 6(1)(f) in conjunction with § 7(3) UWG.

The user concerned can cancel the receipt of advertising at any time. For this purpose, the user can send us an email using the contact details stated above.

Our website uses cookies. Cookies are small text files that are stored on your device. They help us make it easier for you to navigate our offering and enable the website to be displayed correctly. They are intended to enhance the user-friendliness of the website and are, of course, completely harmless to your device. In this way, information relating to the device you use and the software you use is collected temporarily. No conclusions about your identity are drawn from this.

For example, we use so-called “session cookies”. These cookies are automatically deleted after your visit. We also use cookies that are stored on your device in order, for example, to make it easier for you to use our site on a subsequent visit and to recognize your browser on your next visit (“permanent cookies”). You can, of course, delete these cookies manually at any time.

We also use cookies to statistically record and evaluate the use of our website. This is done for the purpose of further optimizing our offering for you.

We also use cookies for pseudonymized reach measurement. You will find further information on this below.

We use the cookies that are strictly necessary for the operation of our website, i.e. without which our website cannot be displayed, for this purpose to safeguard our legitimate interests pursuant to Art. 6(1) sentence 1 point (f) GDPR and § 25(2) no. 2 TDDDG. These are automatically deleted after a defined period in each case.

We use the cookies that are required for the performance of contracts or for the contractually agreed use of our website on the basis of Art. 6(1) sentence 1 point (b) GDPR. These are automatically deleted after a defined period in each case.

Cookies other than the necessary cookies described above are used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time with effect for the future by opening the cookie settings on our website again and changing your selection. You can also delete stored cookies at any time in your browser settings.

Cookie banner (Pandectes GDPR Compliance)

To manage your consents, we use the app "Pandectes GDPR Compliance" from Pandectes, Männimäe/1, Pudisoo küla, 74626 Kuusalu vald, Estonia. With the cookie banner, we inform you about the technologies used on our website, obtain your consent and document it. You can change or withdraw your selection at any time via the cookie settings on our website.

When you give or change your consent, your anonymized IP address, the date and time, the URL on which you gave your consent, an anonymous, random and encrypted key and your consent status are logged. This data is not passed on to other third parties.

The key and your consent status are stored in a cookie (_pandectes_gdpr) on your device so that your selection is taken into account on later visits. This cookie is deleted automatically after 12 months.

The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR, as we are required to demonstrate the consents given. Storing the cookie is strictly necessary pursuant to § 25(2) no. 2 TDDDG.

Further information on data protection at Pandectes can be found at https://pandectes.io/privacy-policy/

Google Analytics

If you have given your consent in our cookie banner, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. We use Google Analytics to evaluate how our website is used and to keep improving it. For this purpose, Google Analytics sets cookies and creates pseudonymous usage profiles. Google evaluates the data on our behalf and compiles reports on the use of our website for us.

The data collected includes in particular the pages you visit and your interactions (e.g. clicks, cart and orders), the date and time of access, the website you came from (referrer URL), browser, operating system and device type, and your approximate location (country, region, city). Google Analytics 4 does not store IP addresses. Your IP address is used only briefly to determine your approximate location and is then discarded.

The data is deleted automatically when the retention period set in Google Analytics expires, after 14 months at the latest.

You can withdraw your consent at any time with effect for the future by opening the cookie settings on our website again and changing your selection. You can also install the browser add-on that deactivates Google Analytics: https://tools.google.com/dlpage/gaoptout?hl=en

Google may also transfer the data to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). In addition, the transfer is based on the European Commission's standard contractual clauses.

Further information on data protection at Google Analytics can be found in the Google Analytics Help (https://support.google.com/analytics/answer/6004245?hl=en) and in Google's privacy policy (https://policies.google.com/privacy).

Google marketing and remarketing services

On the basis of your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG), we use Google marketing and remarketing services (hereinafter "Google Marketing Services") of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter "Google") on our site. The Google Marketing Services are used for the needs-based design and continuous optimization of our site as well as for analysis purposes and for the economic improvement of our online offering.

If you have given your consent, we can use the Google Marketing Services to have targeted advertisements displayed on our site and for our site on third-party sites in such a way that they are tailored to the potential interests of users. The advertisements can be tailored to the extent that the user receives offers on other sites that the user viewed on our site but did not purchase (remarketing). For this purpose, a (re)marketing tag, i.e. a corresponding code from Google, is executed on our site and on sites on which Google Marketing Services are activated, and is embedded in the websites. This code creates a cookie on your end device in which it is recorded which websites you as a user have visited,

which content you are interested in and which offers you have concluded or merely viewed. Technical data such as browser, visit times and information on the other sites visited are also stored in it. In addition, your IP address is transmitted to Google in anonymized form. It is also possible for Google to combine the data with data from other sources.

Within the scope of these Google Marketing Services, we use the Google Ads service. By using Google Ads, we can see what happens after a user clicks on the corresponding advertisement. This may be, for example, the purchase of a product, the registration for a newsletter or the viewing/download of a file. Such customer actions that we have defined are referred to as conversions. The conversion cookie is tailored specifically to us and cannot be tracked by other Google Ads customers. These conversion cookies are important to us because they allow us to compile statistics on the use by all customers in order to optimize our offering even further. No information is used that could identify an individual user.

For conversion measurement and remarketing, Google also sets cookies of the Google Marketing Platform (formerly DoubleClick) under the domain doubleclick.net.

In addition, the services Google Tag Manager, Looker Studio (formerly Google Data Studio) and Search Console are used. We use these services to manage Google's marketing and analytics services on our website.

As already described above, you can prevent cookies from being stored on your computer. In addition, you can prevent Google from using the data collected by the cookies by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en

You can also use the settings and opt-out options provided by Google if you wish to object to this processing.

You can find a corresponding link at: https://adssettings.google.com/authenticated

Further information on the marketing services can be found on Google's overview page: https://policies.google.com/technologies/ads

Google's privacy policy can be found at: https://policies.google.com/privacy

Shopify Analytics

On the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG, we use the analytics tool Shopify Analytics of Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Cookies collect information on the use of our website, which is transferred to Shopify under a data processing agreement and evaluated there in aggregated form. Shopify may pass this information on to third parties where this is required by law or where third parties process the data on behalf of Shopify.

The parent company of Shopify International Limited is a Canadian company headquartered in the capital, Ottawa. In the processing and protection of the data, in addition to European data protection law (GDPR), the Canadian data protection law (PIPEDA) also applies here, which has been declared adequate by the European Commission. Further information on data protection can be found at: https://www.shopify.com/legal/privacy.

Further information on Shopify Analytics can be found at https://help.shopify.com/de/manual/reports-and-analytics/shopify-reports. Shopify's privacy policy can be found at: https://www.shopify.de/legal/datenschutz.

Google Webfonts (stored locally)

On the basis of Art. 6(1) sentence 1 (f) GDPR, for the purpose of a customer-friendly and appealing presentation of our website, we use Google Ajax & jQuery libraries and Google Webfonts of the company Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter "Google". In this process, fonts are retrieved by your browser from our server and loaded into the browser cache in order to display content, texts and fonts correctly. In this process, information about your provider, operating system and browser as well as your IP address may be transmitted to our server. Since the web fonts are stored locally on our server, no data is transmitted to Google.

Meta Pixel

On the basis of your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG), we use "Meta Pixel" of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, hereinafter "Meta", on our website. Meta Pixel is used for the needs-based design and the continuous optimization and analysis of our website and of our commercial offering. Meta Pixel enables us to display targeted advertising to those Facebook users who also show or might show an interest in our offering. In this way, our advertising reaches the users who are interested in it and is not perceived as a nuisance. It also enables us to carry out a statistical evaluation for market research purposes. Further information on how Meta Pixel works is available here: https://de-de.facebook.com/business/help/742478679120153

The processing of the data collected by Meta Pixel is also carried out within the framework of Facebook's data use policy: https://www.facebook.com/privacy/policy/

You have a right to object to the data collection by Meta Pixel. To exercise it, please use Facebook's settings for usage-based advertising: https://www.facebook.com/settings?tab=ads. The settings you make are not limited to one device but are applied to all devices you use.

As already described above, you can prevent cookies from being stored on your computer.

Facebook Conversion API

We have integrated the Facebook Conversion API on our website. The service provider is Meta Platforms Ireland Limited, based at 4 Grand Canal Square, Dublin 2, Ireland. According to Facebook, the collected data may also be transferred to the USA and other third countries.

The Facebook Conversion API enables us to track website visitors' interactions with our website and to transmit them to Facebook in order to improve the performance of our advertising on Facebook. The information collected primarily includes the time of the website visit, the web page accessed, your IP address, your user agent and possibly also other specific data such as the value of the shopping cart, the currency used or the products purchased. A detailed list of the data collected can be found here: Link to the data collected.

This service is used on the basis of your consent pursuant to Article 6(1)(a) of the General Data Protection Regulation (GDPR) and § 25(1) of the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG). You have the right to withdraw your consent at any time.

If personal data is collected on our website using this tool and passed on to Facebook, we and Meta Platforms Ireland Limited are joint controllers pursuant to Article 26 GDPR. Our joint responsibility extends exclusively to the collection of the data and its transfer to Facebook. The processing of the data by Facebook after the transfer is not covered by our joint responsibility. The obligations incumbent on us jointly are set out in an agreement on joint processing. The exact wording of this agreement can be found here: Link to the agreement on joint processing. Under this agreement, we are responsible for providing data protection information when the Facebook tool is used and for the implementation of the tool on our website in compliance with data protection law. Facebook is responsible for the data security of the Facebook products. If you wish to exercise your data subject rights (e.g. requests for access) with regard to the data processed by Facebook, you can contact Facebook directly. If you assert your data subject rights with us, we are obliged to forward them to Facebook.

Data may be transferred to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). In addition, the transfer is based on the standard contractual clauses of the European Commission. Further information can be found here: Link to the EU standard contractual clauses and Link to the Facebook privacy policy contains further information on the protection of your privacy.

Facebook Custom Audiences

We use Facebook Custom Audiences. The service provider of this tool is Meta Platforms Ireland Limited, with its registered office at 4 Grand Canal Square, Dublin 2, Ireland.

If you have consented to the use of Facebook Custom Audiences, we collect your personal data when you visit or use our website or interact with our company's Facebook content and transfer it to Facebook so that Facebook can show you suitable advertising. In addition, your data may be used to define target groups (Lookalike Audiences).

Facebook processes this data as our processor. Further information can be found in Facebook's terms of use at: Link to the terms of use of Facebook Custom Audiences.

Data may be transferred to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). In addition, the transfer is based on the standard contractual clauses of the European Commission. Further information can be found here: Link to the EU standard contractual clauses for Facebook Custom Audiences and Link to the Facebook data processing terms.

Propel Replays

On our website, we use the web analytics service "Propel Replays" of Alcaris Inc 170-422 Richards St, Vancouver, BC V6B 2Z4, Canada. The tool "Propel Replays" uses cookies and/or similar technologies such as tracking pixels, web beacons and algorithms to collect and store device and browser information (IP address and browser details). This is done with the visitor data in pseudonymized form. The collected data is used for statistical analyses of user behavior on our website and serves to create pseudonymized usage profiles. Among other things, it enables the evaluation of movement patterns, such as heatmaps, which show the duration of page visits as well as interactions with page content, such as text input, scrolling, clicking and mouse-overs. Pseudonymization ensures that no direct conclusions about individuals can be drawn, and no link is made to personal data collected elsewhere.

The processing operations described are carried out only if you have given us your express consent pursuant to Article 6(1)(a) of the General Data Protection Regulation (GDPR). You have the right to withdraw your consent at any time with effect for the future by deactivating the service via the "cookie consent tool" provided on the website.

We have concluded a data processing agreement with the provider which safeguards the data protection interests of our website visitors and prohibits the unauthorized disclosure of data to third parties. Where data is transferred to the provider's location, an adequate level of data protection pursuant to Article 45 GDPR is ensured by a decision of the European Commission.

Microsoft Clarity

If you have given your consent in our cookie banner, we use Microsoft Clarity, an analytics service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland ("Microsoft"). Clarity records how visitors use our website, for example mouse movements, clicks, scrolling and the pages viewed, and creates session recordings and heatmaps from this. For this purpose, Clarity uses information about your device and browser, your approximate location and the cookies _clck and _clsk. We use these evaluations to find usability problems and to improve our website.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time with effect for the future by opening the cookie settings on our website again and changing your selection. By default, Clarity stores session recordings for 30 days. Microsoft may also transfer the data to Microsoft Corporation in the USA. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). Further information can be found at https://clarity.microsoft.com/terms and https://privacy.microsoft.com/en-us/privacystatement

TikTok Pixel

If you have given your consent in our cookie banner, we use the TikTok Pixel of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland ("TikTok"). It allows us to measure how successful our advertisements on TikTok are and to show advertising on TikTok to users who are interested in our products. For this purpose, your actions on our website (for example pages viewed, cart and orders), your IP address, information about your browser and device and cookie identifiers are transmitted to TikTok.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time with effect for the future by opening the cookie settings on our website again and changing your selection. TikTok may also transfer data to countries outside the EU and relies on the European Commission's standard contractual clauses for this. Further information can be found at https://www.tiktok.com/legal/privacy-policy-eea

Pinterest Tag

If you have given your consent in our cookie banner, we use the Pinterest Tag of Pinterest Europe Limited, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland ("Pinterest"). It allows us to measure the success of our advertisements on Pinterest and to show suitable advertising to users on Pinterest. For this purpose, your actions on our website, your IP address, information about your browser and device and cookie identifiers are transmitted to Pinterest.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time with effect for the future by opening the cookie settings on our website again and changing your selection. Pinterest may also transfer data to Pinterest, Inc. in the USA. Further information can be found at https://policy.pinterest.com/en/privacy-policy

Awin

If you have given your consent in our cookie banner, the tracking of the affiliate network Awin of AWIN AG, Eichhornstraße 3, 10785 Berlin, Germany, is integrated on our website. If you come to us via a link on an Awin partner website, a cookie stores an identifier for this click. If you then place an order, we transmit the order number, order value, time and this identifier to Awin so that the order can be attributed to the partner.

Customer surveys with Zigpoll

For short surveys on our website, for example after an order, we use Zigpoll, a service of Argonautic Labs LLC (doing business as Zigpoll), New York, USA. Zigpoll processes your answers, technical data such as browser and device information and, for surveys after an order, information about the order. Participation is voluntary. We use the answers to improve our offering.

The legal basis is our legitimate interest in feedback on our offering (Art. 6(1)(f) GDPR). Zigpoll processes the data on our behalf under a data processing agreement. The data is processed in the USA. The transfer is based on the European Commission's standard contractual clauses, which form part of this agreement. Further information can be found at https://www.zigpoll.com/privacy-policy

Instagram feed (Instafeed)

On our website, we display posts from our Instagram profile. For this we use the Instafeed app of Mintt Studio, Rua Parque da República 116, 4430-164 Vila Nova de Gaia, Portugal. When you open the page, your browser loads the posts and images from Mintt Studio's servers. In the process, your IP address and information about your browser are transmitted. The legal basis is our legitimate interest in an appealing presentation of our offering (Art. 6(1)(f) GDPR). Further information can be found at https://minttstudio.com/privacy-policy

3. Social media channels

Facebook

We have created a fan page on the social network Facebook (address: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland), hereinafter referred to as Facebook, and, as the operator of this fan page, are considered joint controllers together with Facebook within the meaning of Art. 26 GDPR. Facebook offers us, as the operator of a fan page, the option of creating anonymous statistics in the form of so-called Page Insights on the usage behavior of our fan page. For this purpose, Facebook installs and reads cookies on the user's device.

We have agreed with Facebook that Facebook assumes primary responsibility under the GDPR for the processing of Insights data and fulfills all obligations under the GDPR with regard to the processing of Insights data (including Articles 12 and 13 GDPR, Articles 15 to 22 GDPR and Articles 32 to 34 GDPR). In addition, Meta Platforms Ireland Ltd. will make the essence of this Page Insights Addendum available to the data subjects.

This addendum can be viewed here:

https://www.facebook.com/legal/terms/page_controller_addendum

We process the data collected via Facebook Insights on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. Our legitimate interest consists in increasing our level of recognition by also providing information about our services and our company on the widely used social media. In particular, the modern and up-to-date presentation of our company achieved in this way is important to us.

All further information on Facebook Insights is available here:

https://www.facebook.com/legal/terms/information_about_page_insights_data

Instagram

We have created a business profile on the social network Instagram (operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland), hereinafter referred to as Facebook, and, as the operator of this profile, are considered joint controllers together with Facebook within the meaning of Art. 26 GDPR. Facebook offers us, as the operator of an Instagram profile, the option of creating anonymous statistics in the form of so-called Page Insights on the usage behavior of our profile. For this purpose, Facebook installs and reads cookies on the user's device.

We have agreed with Facebook that Facebook assumes primary responsibility under the GDPR for the processing of Insights data and fulfills all obligations under the GDPR with regard to the processing of Insights data (including Articles 12 and 13 GDPR, Articles 15 to 22 GDPR and Articles 32 to 34 GDPR). In addition, Facebook will make the essence of this Page Insights Addendum available to the data subjects.

This addendum can be viewed here:

https://www.facebook.com/legal/terms/page_controller_addendum

We process the data collected by means of Facebook Insights on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. Our legitimate interest consists in also providing information about our services and our company on widely used social media in order to increase our level of recognition. In particular, the modern and contemporary presentation of our company that this enables is important to us.

You can find all further information on Facebook Insights here:

https://www.facebook.com/legal/terms/information_about_page_insights_data

4. Disclosure of data

As a rule, your personal data is not transferred to third parties. However, data may be transferred by way of exception for the following reasons:

insofar as you have given your express consent pursuant to Art. 6(1) sentence 1(a) GDPR
insofar as the disclosure is necessary pursuant to Art. 6(1) sentence 1(f) GDPR and there is no overriding interest worthy of protection in your data not being disclosed
insofar as we are legally obliged to disclose the data pursuant to Art. 6(1) sentence 1(c) GDPR
insofar as a disclosure pursuant to Art. 6(1) sentence 1(b) GDPR is permissible and necessary for the performance of contractual relationships with you

Where your data is processed by third parties commissioned by us, e.g. in the case of external hosting, this is done on the basis of Art. 28 GDPR by means of a data processing agreement.

5. Transfers to third countries

If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or if this occurs in the context of using third-party services or disclosing or transferring data to third parties, this only takes place if it is done to fulfill our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests.

Subject to statutory or contractual permissions, we process data in a third country, or have it processed there, only if the special requirements of Art. 44 et seq. GDPR are met. This means, for example, that the processing takes place on the basis of special guarantees, such as the officially recognized determination of a level of data protection corresponding to that of the EU, or compliance with officially recognized special contractual obligations (so-called “standard contractual clauses”).

Your data collected on this website may be transferred to the USA by Google, Meta (Facebook), Microsoft (Clarity), Pinterest, Stripe, Zigpoll and Klaviyo, and to Canada by Propel Replays. TikTok may also transfer data to other countries outside the EU.

By accepting additional cookies or subscribing to newsletters, you consent pursuant to Art. 49(1) sentence 1(a) GDPR to your data being processed in the USA.

6. Rights of data subjects

Right of access, Art. 15 GDPR

You have the right to request confirmation from us as to whether we are processing personal data concerning you. If this is the case, you may request access to this personal data and to the following information:

the purposes of the processing
the categories of personal data being processed
the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organizations
where possible, the envisaged period for which the personal data will be stored; if this is not possible, the criteria used to determine that period
the existence of a right to rectification or erasure of the personal data concerning you, to restriction of processing, or of a right to object to such processing
the existence of a right to lodge a complaint with a supervisory authority
where the personal data is not collected from you, any available information as to the source of the data
the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject

Right to rectification, Art. 16 GDPR

You may request without undue delay the rectification of inaccurate personal data concerning you stored by us or the completion of such data.

Right to erasure (right to be forgotten) of your data, Art. 17 GDPR

You may request the erasure of your data stored by us insofar as

the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
you withdraw your consent on which the processing is based pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR, and there is consequently no other legal ground for the processing;
you object to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) GDPR;
the personal data has been unlawfully processed;
the erasure of the personal data is required for compliance with a legal obligation under Union or Member State law to which we are subject;
the personal data has been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

If the requirements are met, we are obliged to erase the data unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims.

Right to restriction of processing, Art. 18 GDPR

You have the right to request that we restrict processing insofar as

you contest the accuracy of the personal data, but only for a period enabling us to verify the accuracy of the data
the processing is unlawful and you do not want your personal data to be erased right away but instead request the restriction of the use of the personal data
we no longer need the personal data for the purposes of the processing, but you require it for the establishment, exercise or defense of legal claims
you have objected to the processing pursuant to Article 21(1) GDPR, as long as it has not yet been determined whether our legitimate grounds override yours.

Insofar as processing has been restricted, we may, with the exception of storage, process your personal data only with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

You will be informed again before the restriction is lifted.

Right to data portability, Art. 20 GDPR

You have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller.

Right to object, Art. 21 GDPR

You have the right, pursuant to Art. 21 GDPR, to object to the processing of your personal data if it is processed on the basis of our legitimate interest pursuant to Art. 6(1) sentence 1(f) GDPR. However, this applies only if there are grounds arising from your particular situation or if the objection is directed against direct marketing.

Right to withdraw consent, Art. 7(3) GDPR

You have the right, pursuant to Art. 7(3) GDPR, to withdraw the consent you have given us at any time. This withdrawal applies exclusively to future use.

Right to lodge a complaint with supervisory authorities

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or our registered office, if you consider that the processing of personal data concerning you infringes the General Data Protection Regulation.

If you wish to exercise your rights as a data subject, you can also do so by email to the email address stated above.

7. Data security

For security reasons and to protect the transmission of confidential content, such as inquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognize this by the fact that the address line of the browser changes from "http://" to "https://". In addition, a lock symbol is visible in the browser bar.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

In addition, we have taken precautions in the form of technical and organizational measures that protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorized access by third parties.

8. Current version and amendment of this privacy policy

This privacy policy is currently valid and is dated November 1, 2026.

To ensure that our privacy policy always complies with current legal requirements, we reserve the right to make changes at any time. This also applies in the event that the privacy policy has to be adapted due to new or revised services, e.g. new service offerings. The new privacy policy will then apply the next time you visit our online offering.

Our privacy policy is available for you to view and print on our website at any time.

9. Complaints and cease-and-desist letters

Should you consider that your rights have been infringed or that you have otherwise been disadvantaged, we ask you to notify us of this yourself. You will then receive a personal, individual response. With regard to your duty to mitigate damages, we point out that we will not bear the costs of a lawyer engaged by you out of court (without first contacting us). We expressly have no wish for you to instruct a lawyer to issue a demand to cease and desist and/or to demand the submission of a cease-and-desist declaration subject to a contractual penalty.

Consequently, no reliance can be placed on any presumed intention.