Privacy policy

Privacy Policy

Data controller is:
ARUS Vertriebs GmbH
Waldstrasse 11c
85649 Brunnthal

E-Mail: support@arus-vertrieb.de

Thank you for visiting our online shop. Protection of your privacy is very important to us. Below you will find extensive information about how we handle your data. Your data is processed on the basis of the General Data Protection Regulation (GDPR). The storage of information on your device and access to such information (e.g. cookies) is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG), for users from Austria by Section 165 (3) of the Austrian Telecommunications Act 2021 (TKG 2021), and by the corresponding provisions of your Member State.

1. Access data and hosting

You may visit our website without revealing any personal information. With every visit on the website, the web server stores automatically only a so-called server log file which contains e.g. the name of the requested file, your IP address, the date and time of the request, the volume of data transferred and the requesting provider (access data), and documents the request. These access data are analysed exclusively for the purpose of ensuring the smooth operation of the website and improving our offer. This serves according to Art. 6 (1) (f) GDPR the protection of our legitimate interests in the proper presentation of our offer that are overriding in the process of balancing of interests. All access data are deleted no later than seven days after the end of your visit on our website.

Hosting

The services for hosting and displaying the website are partly provided by our service providers on the basis of processing on our behalf. Unless otherwise stated in this privacy policy, all access data and all data collected in forms provided for this purpose on this website are processed on their servers. If you have any questions about our service providers and the basis of our cooperation with them, please use the contact option described in this privacy policy.

Our service providers are located and/or use servers in the following countries, for which the European Commission has established an adequate level of data protection by decision: Canada, New Zealand, Japan, United Kingdom, USA.

The adequacy decision for the USA applies as the basis for third country transfers, provided that the respective service provider is certified. Until certification by our service providers, the data transfer continues to be based on this basis: standard data protection clauses of the European Commission.

Our service providers are located and/or use servers in these countries: Australia, India, Singapore.

There is no adequacy decision for these countries by the European Commission. Our cooperation with them is based on these safeguards: Standard data protection clauses of the European Commission.

Shop platform Shopify

Our online shop is operated on the Shopify e-commerce platform. For users in the EU and EEA, the provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"). Shopify provides the shop system, website hosting, the shopping cart, the ordering process (checkout) and the cookie banner and, as our processor, processes on our behalf the access data (including IP address, device and browser information, pages visited) and the data you enter in the shop (e.g. contact, delivery, order and payment data). The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures and performance of the contract) and Art. 6 (1) (f) GDPR (legitimate interest in the secure, stable and efficient operation of our online shop). Shopify also processes data at Shopify Inc. in Canada and at sub-processors in the USA. For Canada, there is an adequacy decision of the European Commission; transfers to the USA are based on the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise on the standard data protection clauses of the European Commission. Which cookies are used in the shop and how you can manage your consent is explained in sections 6 and 7. For further information, please see Shopify's privacy policy.

Stock availability check (Cloudflare Workers)

So that we only offer colours and variants in the shopping cart that are in stock, your browser retrieves the current stock level from a service we operate on the platform of Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). For technical reasons, your IP address, the requesting website (origin) and standard browser information (e.g. browser type) are processed in this context. We do not permanently store or log your IP address; to prevent abuse (limiting the number of requests per minute), it is only held briefly in the service's memory. No cookies or tracking are used. To monitor the function, we only record anonymous counts (result of the request, country, response time) without an IP address or any other identifier. Cloudflare may process the access data in technical logs (server logs) to ensure security and operation. To ensure functionality, the result is cached briefly (approx. 5 minutes) in your browser's session storage (Section 25 (2) No. 2 TDDDG). Legal basis: Art. 6 (1) (f) GDPR (our interest in a smooth ordering process without unavailable items and in protecting the service against abuse). We have concluded a data processing agreement with Cloudflare; the transfer to the USA is based on the adequacy decision (EU-U.S. Data Privacy Framework) or on standard contractual clauses.

2. Data processing for the purposes of processing the contract, establishing contact

2.1 Data processing for the purposes of performing the contract

For the purpose of performing the contract (including enquiries regarding the processing of any existing warranty and performance fault claims as well as any statutory updating obligations) in accordance with Art. 6 (1) (b) GDPR, we collect personal data if you provide it to us voluntarily as part of your order. Mandatory fields are marked as such, as in these cases we necessarily need the data to process the contract and we cannot send the order without their specification. Which data is collected can be seen from the respective input forms.

Further information on the processing of your data, in particular on the forwarding of the data to our service providers for the purpose of order, payment and shipping, can be found in the following sections of this privacy policy. After complete processing of the contract, your data will be restricted for further processing and deleted after expiry of the retention periods under tax and commercial law in accordance with Art. 6 (1) (c) GDPR, unless you have expressly consented to further use of your data in accordance with Art. 6 (1) (a) GDPR or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this privacy policy.

2.2 Customer account

Insofar as you have given your consent to this in accordance with Art. 6 (1) (a) GDPR by deciding to open a customer account, we will use and store your data for the purpose of opening the customer account as well as for further future orders on our website. Deletion of your customer account is possible at any time and can be done either by sending a message to the contact option described in this privacy policy or via a function provided for this purpose in the customer account. After deletion of your customer account, your data will be deleted unless you have expressly consented to further use of your data in accordance with Art. 6 (1) (a) GDPR or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this privacy policy.

2.3 Establishing contact

As part of our customer communication, we collect personal data in order to process your enquiries in accordance with Art. 6 (1) (b) GDPR if you voluntarily provide us with this data when contacting us (e.g. via contact form or e-mail). Mandatory fields are marked as such, as in these cases we necessarily need the data to process your enquiry. Which data is collected can be seen from the respective input forms. After your enquiry has been fully processed, your data will be deleted unless you have expressly consented to further use of your data in accordance with Art. 6 (1) (a) GDPR or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this privacy policy.

Live-Chat-Tool WhatsApp

For the purposes of customer communication, we use the live chat tool of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("WhatsApp"). This serves to protect our legitimate interests in effective and improved customer communication, which prevail in the context of a balancing of interests pursuant to Art. 6 (1) (f) GDPR. WhatsApp acts as a data processor. The telephone numbers stored by us on our mobile device are automatically processed on servers of Meta companies companies with their main office at 1601 Willow Road, Menlo Park, California 94025, USA. Only telephone numbers of customers who have previously contacted us via WhatsApp and have therefore already accepted WhatsApp's terms of use and privacy policy are stored.

The adequacy decision for the USA applies as the basis for third country transfers, provided that the respective service provider is certified. Certification is available.

Our service providers are located and/or use servers in these countries: Singapore. There is no adequacy decision for these countries by the European Commission. Our cooperation with them is based on these safeguards: Standard data protection clauses of the European Commission.

3. Data processing for the purposes of shipment

We forward your data to the shipping company within the scope required for the delivery of the ordered goods according to Art. 6 (1) (b) GDPR. If you have any questions about our service providers and the basis of our cooperation with them, please use the contact option described in this privacy policy.

Data transmission to a shipping provider for the purpose of shipment notification

Provided that you have given us your explicit consent, during or after your order, we will forward your e-mail address and phone number in accordance with Art. 6 (1) (a) GDPR to the selected shipping provider in order to enable them to contact you for the purpose of shipment notification or coordination prior to shipment.
This consent may be withdrawn at any time by sending a message to the contact information described in this privacy policy or directly to the shipping provider using the contact address listed below. After consent withdrawal, we will delete the data you have provided for this purpose, unless you have expressly consented to further use of your data or we have reserved the right to use your data for other purposes which are permitted by law and about which we inform you in this privacy policy. If you have any questions about our service providers and the basis of our cooperation with them, please use the contact option described in this privacy policy.

DPD Deutschland GmbH
Wailandtstraße 1
63741 Aschaffenburg
Germany

United Parcel Service Deutschland S.à r.l. & Co. OHG
Görlitzer Straße 1
41460 Neuss
Germany

General Logistics Systems Germany GmbH & Co. OHG
GLS Germany-Straße 1 - 7
DE-36286 Neuenstein
Germany

DHL Paket GmbH
Sträßchensweg 10
53113 Bonn
Germany

Hermes Germany GmbH
Essener Straße 89
D-22419 Hamburg
Germany

4. Data processing for the purposes of payment

As part of the payment process in our online shop, we work together with these partners: technical service provider, credit institution, payment service provider.

4.1 Data processing for the purposes of transaction processing

Depending on the selected payment method, we forward the data necessary for processing the payment transaction to our technical service providers, who act for us on the basis of processing on our behalf or to the authorised credit institutions or to the selected payment service provider insofar as this is necessary for the payment process. This serves the fulfilment of the contract according to Art. 6 (1) (b) GDPR. In certain cases, payment service providers collect the data required for processing the payment themselves, e.g. on their own website or via technical solution within the ordering process. In this respect, the privacy policy of the respective payment service provider applies. If you have any questions about our payment processing partners and the basis of our cooperation with them, please use the contact option described in this privacy policy.

4.2 Data processing for the purposes of fraud prevention and optimisation of our payment processes

We may forward other data to our service providers, which they use for the purpose of fraud prevention and to optimise our payment processes (e.g. invoicing, processing of contested payments, accounting support) together with the data necessary to process the payment as our processors.
This serves to safeguard our legitimate interests in fraud prevention or an efficient payment management in accordance with Art. 6 (1) (f) GDPR that are overriding in the process of balancing of interests.

4.3 Identity and credit assessment when selecting Klarna payment services

Klarna Pay now (Direct debit)
Klarna Pay later (Invoice)
Klarna Slice it (Payment by instalments)
If you choose to use the payment services of Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter Klarna), we request your consent that we may forward to Klarna the data necessary for processing the payment and for an identity and credit assessment in accordance with Art. 6 (1) (a) GDPR. In Germany, the credit agencies listed in Klarna's privacy policy can be used for identity and credit assessment. Klarna will use information obtained on the statistical probability of payment default for a balanced decision on the establishment, execution or termination of the contractual relationship.
You can withdraw your consent at any time by sending a message to the contact option specified in this privacy policy. As a result, we may no longer be able to offer you certain payment methods. You may also withdraw your consent to this use of your personal data at any time, also to Klarna.

4.4 Identity and credit assessment when choosing Billpay payment services (provided by Klarna Bank AB)

If you choose to use the payment services of Klarna Bank AB AB (publ.), Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter BillPay), we request your consent that we may transmit to Billpay the data necessary for processing the payment and for an identity and credit assessment in accordance with Art. 6 (1) (a) GDPR. In Germany, the credit agencies listed in Billpay's privacy policy can be used for identity and credit assessment. Billpay will use the information obtained on the statistical probability of payment default for a balanced decision on the establishment, execution or termination of the contractual relationship.
You can withdraw your consent at any time by sending a message to the contact option specified in this privacy policy. As a result, we may no longer be able to offer you certain payment methods. You may also withdraw your consent to this use of your personal data at any time, also to Billpay.

4.5 Identity and credit assessment when choosing purchase on invoice by PayOne

If you choose to use the payment method purchase on invoice by PayOne GmbH, Lyoner Str. 9, 60528 Frankfurt a.M., Germany (hereinafter PayOne), we request your consent that we may forward to Billpay the data necessary for processing the payment and for an identity and credit assessment in accordance with Art. 6 (1) (a) GDPR. In Germany, the credit agencies listed in PayOne's privacy policy can be used for identity and credit assessment. PayOne will use the information obtained on the statistical probability of payment default for a balanced decision on the establishment, execution or termination of the contractual relationship.
You can withdraw your consent at any time by sending a message to the contact option specified in this privacy policy. As a result, we may no longer be able to offer you certain payment methods.

4.6 Identity and credit check when selecting purchase on account via PayPal and Ratepay

If you choose the payment method purchase on account (offered via Ratepay GmbH, Franklinstraße 28-29, 10587 Berlin, Germany (hereinafter referred to as Ratepay) and PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg (hereinafter referred to as PayPal)), we request your consent pursuant to Art. 6 (1) (a) GDPR that we may transmit to Ratepay the data necessary for the processing of the payment and an identity and credit check. In Germany, the credit agencies named in Ratepay's data protection declaration may be used for the identity and credit check. Ratepay uses the information received about the statistical probability of a payment default for a weighed decision about the establishment, implementation or termination of the contractual relationship. You can revoke your consent at any time by sending a message to the contact option mentioned in this privacy policy. This may result in us no longer being able to offer you certain payment options. Additional information on data protection at PayPal can be found here.

4.7 Engagement of debt collection companies

In order to fulfil the contract according to Art. 6 (1) (b) GDPR, we forward your data to an authorised debt collection agency (mediaFinanz GmbH, Weiße Breite 5, 49084 Osnabrück, Germany) if our payment claim has not been settled despite a previous reminder. In this case, the claim will be collected directly by the collection agency. In addition, the transmission of data serves to safeguard our legitimate interests in an effective assertion or enforcement of our payment claim in accordance with Art. 6 (1) (f) GDPR that are overriding in the process of balancing interests.

5. Marketing via E-mail, Telephone

5.1 E-mail newsletter with subscription and newsletter tracking

If you subscribe to our newsletter, we will regularly send you our email newsletter based on your consent according to Art. 6 (1) (a) GDPR, using the data required or disclosed by you separately for this purpose.

You can unsubscribe from the newsletter at any time. This can either be done by sending a message to the contact option described in this privacy policy or via a link provided for this purpose in the newsletter. After unsubscribing, we will delete your e-mail address from the list of recipients, unless you have expressly consented to the further use of your data according to Art. 6 (1) (a) GDPR or we have reserved the right to use your data for other purposes that are permitted by law and about which we inform you in this privacy policy.

We would like to point out that we evaluate your user behaviour when sending the newsletter. For this purpose, we also analyse your interaction with our newsletter by measuring, storing and evaluating opening rates and click-through rates for the purpose of designing future newsletter campaigns ("newsletter tracking").

For this evaluation, the emails sent contain single-pixel technologies (e.g. so-called web beacons, tracking pixels) that are stored on our website. For the evaluations, we link the following "newsletter data" in particular

the page from which the page was requested (so-called referrer URL),
the date and time of the request,
the description of the type of web browser used,
the IP address of the requesting computer,
the e-mail address,
the date and time of registration and confirmation

and the single-pixel technologies with your e-mail address or your IP address and, if applicable, an individual ID. Links contained in the newsletter may also contain this ID.

If you do not wish to receive newsletter tracking, it is possible to unsubscribe from the newsletter at any time - as described above.

The information will be stored as long as you have subscribed to the newsletter.

5.2 E-mails to customers (tips and offers on similar RIWI® products)

If you place an order with us, we, ARUS Vertriebs GmbH, use the e-mail address you provided when ordering – even without a newsletter subscription – for e-mails with tips on the product you purchased and on similar RIWI® products (e.g. care and washing instructions, play and building ideas, colouring pages and requests to review your purchase) as well as for offers of our own RIWI® products that are similar to those you purchased (e.g. building block sets, covers, accessories, extensions). At checkout, we inform you of this directly below the e-mail field (with express payment methods such as Apple Pay, Google Pay, Shop Pay or PayPal, this notice may not be displayed); if the notice is displayed, we store this as an attribute of your order. The legal basis is our legitimate interest in direct marketing (Art. 6 (1) (f) GDPR) in conjunction with § 7 Abs. 3 UWG (Germany), § 174 Abs. 4 TKG 2021 (Austria) or the respective national implementation of Art. 13 (2) of Directive 2002/58/EC. For sending these e-mails, we use Klaviyo, a service of Klaviyo, Inc., Boston, USA; the transfer to the USA is based on the adequacy decision for the EU-U.S. Data Privacy Framework, under which Klaviyo is certified. In this context, we process in particular your e-mail address, your name, the products purchased and the order date, as well as open and click data.

Right to object: You can object to the use of your e-mail address for these purposes at any time (Art. 21 (2) GDPR) – via the unsubscribe link in every e-mail or by e-mail to support@riwi-buildit.com. You will not incur any costs for this other than the transmission costs according to the basic rates. After your objection, we will no longer use your e-mail address for these purposes (Art. 21 (3) GDPR); you will continue to receive e-mails relating to the processing of your order (e.g. order and shipping confirmation, invoice). An unsubscribe link also ends any newsletter subscription you may have. For these purposes, we store your data until you object, but no longer than 3 years after your last order.

5.3 Sending review requests by e-mail

If you have given us your explicit consent to do so during or after placing your order in accordance with Art. 6 (1) (a) GDPR, we will use your e-mail address to request an review of your order via the review system we use. This consent can be withdrawn at any time by sending a message to the contact option described in this privacy policy or via a link provided for this purpose in the review request. After you have withdrawn your consent, we will delete your e-mail address from the recipient list unless you have expressly consented to further use of your data in accordance with Art. 6 (1) (a) GDPR or we have reserved the right to use data beyond this, which is permitted by law and about which we inform you in this declaration. If you have placed an order with us, we will also send you requests to review your purchase without your consent as part of the customer e-mails described in section 5.2 “E-mails to customers (tips and offers on similar RIWI® products)”; your right to object applies accordingly.

5.4 Phone advertising

If you have given your consent in accordance with Art. 6 (1) (a) GDPR, we will use the data required for this purpose or provided separately by you for our own advertising purposes, e.g. to inform you about interesting offers and our products. You can withdraw your consent at any time, either by sending a message to the contact option described in this privacy policy or by verbal notification within each call. After withdrawal, we will delete your telephone number unless you have expressly consented to the further use of your data or we have reserved the right to use your data for other purposes that are permitted by law and about which we inform you in this privacy policy.

6. Cookies, consent and cookie settings

General information

On our website we use cookies and similar technologies (e.g. your browser's local storage or session storage, pixels, third-party scripts; together "cookies"). Cookies are small text files or entries that are stored on or read from your device. Session cookies are deleted when you close your browser; persistent cookies remain on your device for the period stated in each case.

We use cookies that are strictly necessary to provide the service you have expressly requested (e.g. shopping cart, checkout, storing your cookie choice) without consent (Section 25 (2) No. 2 TDDDG or Section 165 (3) TKG 2021). The associated processing of personal data is based on Art. 6 (1) (b) GDPR or on our legitimate interest in a functioning online shop pursuant to Art. 6 (1) (f) GDPR.

We only use all other cookies (statistics, marketing, preferences) if you have given your prior consent (Section 25 (1) TDDDG or Section 165 (3) TKG 2021 in conjunction with Art. 6 (1) (a) GDPR). Without your consent, these services are not loaded or do not store or read any information on your device. If you do not give your consent, you will not suffer any disadvantages; however, some embedded content may then not be displayed.

Consent management with Shopify's cookie banner

To obtain and manage your consent, we use the cookie banner of our shop platform Shopify (section 1). On your first visit, you can accept all categories or reject all of them – both equally with a single click – or make your choice per category (analytics/statistics, marketing, preferences). The pixels and apps we use are only activated via Shopify's interface (Customer Privacy API) once you have consented to the respective category.

Your choice is stored in the cookie "_tracking_consent" in your browser (storage period up to 12 months) so that the banner does not reappear each time you open a page and so that we can respect and prove your decision. This is necessary to fulfil our obligation to demonstrate consent under Art. 7 (1) GDPR (Art. 6 (1) (c) GDPR); storing the cookie is strictly necessary (Section 25 (2) No. 2 TDDDG).

Anonymous counting of your cookie choice

To understand whether visitors accept all, decline all or choose individual categories, your browser sends an anonymous count message after you make your choice in the cookie banner to a service we operate on the Cloudflare platform (Cloudflare, Inc., USA; our processor). The message contains only the shop, the type of your choice (“all accepted”, “all declined” or “individual selection”), the page type (e.g. home page), the language and the text variant of the banner that was displayed. Technically, the service receives your IP address; we derive only the country from it and do not store the IP address. We store only a daily counter per combination of these values. The daily counters are deleted automatically after 13 months. No cookies or identifiers are set, you are not recognized, no profile is created, and the data is not shared with third parties. The legal basis is our legitimate interest in running the consent process lawfully and in a user-friendly way (Art. 6(1)(f) GDPR). Because we cannot identify you from this data, data subject rights are limited in this respect under Art. 11 GDPR. Transfers to the USA are based on the EU-US Data Privacy Framework or standard contractual clauses (see section 7).

Changing or withdrawing your consent

You can withdraw your consent at any time with effect for the future or change your choice – most easily via the "Cookie settings" link in the footer of every page of our shop. Withdrawing consent is as easy as giving it. The lawfulness of the processing carried out until the withdrawal remains unaffected. Alternatively, you can send your withdrawal to the contact details given in this privacy policy.

In addition, you can delete or block cookies in your browser settings at any time. If strictly necessary cookies are also blocked, the functionality of our shop (e.g. the shopping cart) may be restricted.

7. Services and technologies used

Below we inform you about the services used on our website. Unless stated otherwise, they are only used on the basis of your consent (Section 25 (1) TDDDG or Section 165 (3) TKG 2021 in conjunction with Art. 6 (1) (a) GDPR) in the respective category of the cookie banner. You can withdraw your consent at any time via the "Cookie settings" link in the footer. The data collected is deleted as soon as it is no longer required for the respective purpose, you have withdrawn your consent or we no longer use the service, unless statutory retention obligations prevent this. Where data is transferred to countries outside the EU or EEA, this is stated for the respective service. For the USA, the European Commission has adopted an adequacy decision (EU-U.S. Data Privacy Framework); it applies to recipients certified under it. Where a recipient is not certified or is located in another third country without an adequacy decision, we base the transfer on the standard data protection clauses of the European Commission. For personal data concerning Switzerland, the corresponding provisions of Swiss data protection law apply (Swiss-U.S. Data Privacy Framework or standard data protection clauses).

7.1 Functions used without consent (strictly necessary or at your request)

Shopify functional cookies

Shopify sets cookies and browser storage entries that are strictly necessary to operate the shop, e.g. for the shopping cart, checkout, customer account login, language and currency settings, session management as well as security and fraud prevention. Legal basis: Section 25 (2) No. 2 TDDDG or Section 165 (3) TKG 2021; Art. 6 (1) (b) and (f) GDPR. Provider: Shopify (section 1).

Notice about the appropriate country shop or language

If you visit our shop from a country for which we offer a separate shop or another language version, we display a notice. For this purpose, the country is determined by Shopify on the basis of your IP address; your IP address is not transferred to any further third parties in this process. The country determined is stored in your browser's session storage for the duration of the session ("riwi_geo_cc"). If you close the notice or choose a language, we store this decision in your browser ("riwi_geo_dismissed", "riwi_enbar_closed", "riwi_lang_choice") so that the notice does not reappear. Legal basis: Section 25 (2) No. 2 TDDDG or Section 165 (3) TKG 2021; Art. 6 (1) (f) GDPR (legitimate interest in offering you the shop for your country and a language you understand).

Stock availability check

To check availability in the shopping cart, we use our own service on the Cloudflare platform; for details see section 1 ("Stock availability check (Cloudflare Workers)").

Display of customer reviews (Judge.me)

To display customer reviews on product and offer pages, we use the service of Judge.me Ltd, c/o Buckworths, 1-3 Worship Street, London EC2A 2AB, United Kingdom ("Judge.me"), which acts as our processor. When the reviews are loaded, your IP address as well as device and browser information are transferred to Judge.me servers for technical reasons. The legal basis is our legitimate interest in displaying genuine customer reviews (Art. 6 (1) (f) GDPR). There is an adequacy decision of the European Commission for the United Kingdom. Statistical analysis by Judge.me only takes place with your consent (section 7.2). For review requests by e-mail, see section 5.

Notice about instalment payment (Klarna On-Site Messaging)

In the shopping cart, we display a notice about Klarna's payment options. The provider is Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden ("Klarna"). To display it, your IP address, device and browser information, the page visited and the cart amount are transferred to Klarna for technical reasons. According to Klarna, this notice does not set any cookies. The legal basis is our legitimate interest in informing you about available payment methods before you order (Art. 6 (1) (f) GDPR). For data processing when you select a Klarna payment method, see section 4.

Chat (Freshchat)

For our support chat we use Freshchat by Freshworks Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA ("Freshworks"). The chat window is only loaded when you click on the chat icon; before that, no connection to Freshworks is established. After the click, your IP address, device and browser information, the content of your messages and any contact details you provide are processed; to continue the conversation, identifiers are stored in your browser's storage. The legal basis is Art. 6 (1) (b) GDPR insofar as your enquiry relates to a contract, and otherwise our legitimate interest in efficient customer communication (Art. 6 (1) (f) GDPR); storage in the browser takes place at your express request (Section 25 (2) No. 2 TDDDG). Freshworks acts as our processor and processes data in the EU/EEA, the United Kingdom and the USA; transfers to the USA are based on the EU-U.S. Data Privacy Framework and standard data protection clauses.

YouTube videos (two-click solution)

Embedded videos are initially only shown as a preview. Only when you click on "Load video" is a connection established to YouTube, a service of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), in privacy-enhanced mode (youtube-nocookie.com). Your IP address, time of visit, device and browser information and the page visited are transferred to Google; when a video is played, Google may store information on your device. The legal basis is your consent given by the click (Section 25 (1) TDDDG or Section 165 (3) TKG 2021 in conjunction with Art. 6 (1) (a) GDPR). Google may transfer data to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework.

Online withdrawal form ("Submit Withdrawal")

You can declare your withdrawal online using the "Submit Withdrawal" button. The form is provided by the "EU Widerrufsbutton" service of 401layers UG (haftungsbeschränkt), Dorothea-Erxleben-Straße 1a, 40721 Hilden, Germany. Only when you click the button does your browser load the form from the provider's server; technically necessary data (e.g. IP address, browser information, language) is transmitted in the process. The data you enter (e.g. name, email address, order number, content of the withdrawal declaration) is transmitted to us so that we can process your withdrawal. The legal basis is the fulfilment of our legal obligation to provide you with a withdrawal function and to process your withdrawal (Art. 6(1)(c) GDPR) and the performance of the contract (Art. 6(1)(b) GDPR).

Spam protection for forms (hCaptcha)

To protect our contact form and newsletter sign-up against misuse and spam by automated programs, our shop platform Shopify uses the hCaptcha service of Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA. The hCaptcha script is only loaded when you select a field in one of these forms (e.g. by clicking on it) and usually works invisibly in the background. In the process, your IP address, browser and device information and information about your interaction with the page (e.g. mouse, keyboard and touch events) are transmitted to hCaptcha and analysed in order to determine whether the input comes from a human or from an automated program. The legal basis is our legitimate interest in protecting our forms against spam and misuse (Art. 6(1)(f) GDPR); insofar as information is stored on or read from your device in the process, this is strictly necessary for the form submission you have requested (Section 25 (2) No. 2 TDDDG or Section 165 (3) TKG 2021). According to its own information, Intuition Machines, Inc. is certified under the EU-U.S. Data Privacy Framework. Further information can be found in the hCaptcha privacy policy.

7.2 Shopify analytics and Shopify marketing

Only with your consent to the "analytics/statistics" category does Shopify use cookies with which we statistically evaluate visits, page views, visitor origin and completed orders in pseudonymised form, and only with your consent to the "marketing" category cookies with which visits and orders are attributed to our advertising channels and campaigns. Provider: Shopify (section 1). With the same consent, Judge.me (section 7.1) uses a pixel to analyse how visitors interact with the reviews.

7.3 Google services

We use technologies of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), which we integrate via Shopify's Google & YouTube app (Google tag). The information collected is generally transferred to a Google LLC server in the USA and stored there; Google LLC is certified under the EU-U.S. Data Privacy Framework. Unless stated otherwise, data processing is based on an agreement between joint controllers pursuant to Art. 26 GDPR. Further information can be found in Google's privacy policy.

Google Consent Mode

We use Google Consent Mode (version 2). As long as you have not made a choice in the cookie banner or have refused your consent, the Google services named in this section 7.3 (Google tag, Google Analytics, Google Ads) are not loaded on our website, and no data is transmitted to Google via these services. Only after you have consented to the "analytics/statistics" or "marketing" category are the Google services loaded and your consent status passed on to Google via Consent Mode, so that Google takes your choice into account. The legal basis is your consent (Section 25 (1) TDDDG or Section 165 (3) TKG 2021 in conjunction with Art. 6 (1) (a) GDPR), which you can withdraw at any time via the "Cookie settings" link in the footer.

Google Analytics 4 ("analytics/statistics" category)

For the purpose of website analysis, Google Analytics automatically collects and stores data (IP address, time of visit, device and browser information and information on your use of our website), from which usage profiles are created using pseudonyms. Cookies are used for this purpose (e.g. "_ga", "_ga_*"). If you visit our website from the EU, your IP address is used on a server in the EU to derive location data and is then deleted before the data is forwarded to other Google servers. Data processing is based on a data processing agreement with Google. For the purpose of optimised marketing of our website, we have activated the data sharing settings for "Google products and services"; to that extent, data is shared with Google on the basis of an additional controller-to-controller agreement, and we have no influence on the subsequent processing by Google. Through the Google Signals feature, Google creates cross-device statistics if you have activated personalised advertising in your Google account; in this respect we only receive aggregated reports.

Google Ads and Google Merchant Center ("marketing" category)

For advertising purposes in Google search results and on third-party websites, the Google remarketing cookie is set when you visit our website, which enables interest-based advertising by means of a pseudonymous cookie ID and on the basis of the pages you have visited (data: IP address, time of visit, device and browser information, information on your use of our website). Using Google Ads conversion tracking and Google Merchant Center conversion measurement, we measure whether you take certain actions after clicking on one of our ads or product listings (e.g. product view, cart, purchase). As part of enhanced conversions, after an order your e-mail address and, where applicable, your telephone number and address are transmitted to Google in hashed (encrypted) form in order to attribute conversions. If you are logged in to Google and have activated personalised advertising, Google may also use the data for cross-device remarketing. Cookies e.g. "_gcl_au".

Google Tag Manager

We use Google Tag Manager or the Google tag to manage the Google services mentioned. Tag Manager itself does not set any cookies; when it is delivered, Google processes your IP address for technical reasons. Data processing is based on a data processing agreement with Google. The integrated services are only executed in accordance with your consent or as described for Google Consent Mode.

7.4 Meta Pixel and Conversions API ("marketing" category)

We use the Meta Pixel of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"), which we integrate via Shopify's Facebook & Instagram app. The pixel collects data (IP address, time of visit, device and browser information and information on your use of our website based on predefined events such as product view, cart or purchase), from which usage profiles are created using pseudonyms; cookies are set for this purpose (e.g. "_fbp"). As part of advanced matching, contact data (e.g. e-mail address, telephone number, name) is additionally transmitted in hashed form. In addition, we transmit these events server-side from Shopify to Meta (Conversions API) so that they can be measured reliably even if there are technical restrictions in the browser – again only if you have consented to the "marketing" category. Meta uses the data to measure the success of our ads on Facebook and Instagram, to create target groups (Custom Audiences, remarketing) and to show you personalised advertising, and may combine it with data from your Facebook or Instagram account.

We are jointly responsible with Meta for the collection and transmission of the data to Meta (Art. 26 GDPR); the subsequent processing is the sole responsibility of Meta. For the creation of statistics and the matching of contact data, Meta acts as our processor. Meta transfers data to Meta Platforms, Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework, and, where applicable, to other third countries on the basis of standard data protection clauses. Further information: Meta's privacy policy.

7.5 TikTok Pixel ("marketing" category)

We use the TikTok Pixel of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland ("TikTok"), which we integrate via Shopify's TikTok app. It collects data (IP address, time of visit, device and browser information, information on your use of our website based on predefined events such as product view, cart or purchase and, where applicable, hashed contact data) in order to measure the success of our advertising on TikTok, to create target groups and to show you personalised advertising; cookies are set for this purpose (e.g. "_ttp"). We are jointly responsible with TikTok for the collection and transmission of the data to TikTok (Art. 26 GDPR). TikTok may also process data outside the EEA, including in the USA, Singapore, Malaysia and – by way of remote access – China; where there is no adequacy decision, the transfer is based on standard data protection clauses. Further information: TikTok's privacy policy.

7.6 Pinterest Tag ("marketing" category)

For web analysis and advertising purposes on Pinterest and on third-party websites, we use the Pinterest Tag of Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland ("Pinterest"). Data (IP address, time of visit, device and browser information and information on your use of our website based on predefined events) is collected and, by means of a pseudonymous cookie ID, interest-based advertising is enabled and it is measured whether you take certain actions after clicking on an ad on Pinterest. Pinterest may combine this information with data from your Pinterest account. Data processing is based on an agreement between joint controllers pursuant to Art. 26 GDPR. The information is generally transferred to servers of Pinterest, Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework.

7.7 Klaviyo ("marketing" category)

To send our newsletter and automated e-mails, we use Klaviyo by Klaviyo, Inc., USA ("Klaviyo"), which acts as our processor. With your consent to the "marketing" category, Klaviyo uses a pixel to record which products you view and add to the cart. If you have subscribed to our newsletter or are known to us as a customer, Klaviyo links this information to your e-mail address so that – provided you have consented to receiving advertising e-mails (section 5) – we can send you e-mails tailored to your interests (e.g. a reminder about your shopping cart). Data is transferred to the USA on the basis of the EU-U.S. Data Privacy Framework where Klaviyo is certified, and otherwise on the basis of standard data protection clauses.

7.8 Trusted Shops ("preferences" category)

The Trustbadge and the other widgets of Trusted Shops AG (e.g. trust mark and reviews; details in section 8) are only loaded on the pages of our online shop after you have consented to the "preferences" category in the cookie banner. The legal basis is your consent (Section 25 (1) TDDDG or Section 165 (3) TKG 2021 in conjunction with Art. 6 (1) (a) GDPR), which you can withdraw at any time via the "Cookie settings" link in the footer. Information on data processing, joint controllership with Trusted Shops AG (Art. 26 GDPR) and transfers to third countries can be found in section 8.

8. Integration of the Trusted Shops Trustbadge / other widgets

Provided that you have given your consent in accordance with Art. 6 (1) (a) GDPR, Trusted Shops widgets are integrated on this website to display the Trusted Shops services (e.g. Trustmark, collected reviews) and to offer buyers Trusted Shops products after they have placed an order.

The Trustbadge and the services advertised with it are an offer of Trusted Shops AG, Subbelrather Str. 15C, 50823 Cologne ("Trusted Shops"), with whom we are jointly responsible for data protection according to Art. 26 GDPR. Within the scope of this data protection notice, we inform you in the following about the essential contractual contents in accordance with Art. 26 (2) GDPR.

Within the framework of the joint responsibility existing between us and Trusted Shops AG, please preferably contact Trusted Shops using the contact options provided in the privacy policy, if you have any data protection questions and wish to assert your rights. Irrespective of this, however, you can always contact the person responsible of your choice. Your enquiry will then, if necessary, be passed on to the other person responsible for a response.

8.1 Data processing when integrating the Trustbadge/other widgets

The Trustbadge is provided by a US-American CDN provider (content delivery network). An adequate level of data protection is ensured by an adequacy decision of the EU Commission, which can be accessed here for the USA. Service providers from the USA are generally certified under the EU-U.S. Data Privacy Framework (DPF). Further information is available here. Where service providers are not certified under the DPF, standard contractual clauses have been concluded as a suitable guarantee.

When the Trustbadge is called up, the web server automatically saves a so-called server log file, which also contains your IP address, the date and time of the call-up, the amount of data transferred and the requesting provider (access data) and the call-up. Immediately after the data collection the IP address is anonymised so that the stored data cannot be assigned to you personally. The anonymised data are used in particular for statistical purposes and for error analysis.

8.2 Data processing after order completion

Provided you have given your consent, the Trustbadge accesses order information stored in your terminal equipment (order total, order number, product purchased if applicable) and your e-mail address after the order has been completed. Your e-mail address is hashed using a cryptological one-way function. The hash value is then transmitted to Trusted Shops with the order information in accordance with Art. 6 (1) (a) GDPR.

This serves to verify whether you are already registered for Trusted Shops services. If this is the case, further processing will take place in accordance with the contractual agreement between you and Trusted Shops. If you are not yet registered for the services or do not give your consent to automatic recognition via the Trustbadge, you will subsequently be given the opportunity to register manually for the use of the services or to conclude the insurance as part of your possibly already existing user contract.

For this purpose, the Trustbadge accesses the following information stored in the terminal equipment you use after you have completed your order: Order total, order number and email address. This is necessary so that we can offer you buyer protection. The data is only transmitted to Trusted Shops if you explicitly decide to take out buyer protection by clicking on the correspondingly designated button in the so-called Trustcard. If you decide to use the services, further processing is based on the contractual agreement with Trusted Shops in accordance with Art. 6 (1) (b) GDPR, in order to be able to complete your registration for buyer protection and insure the order, as well as to be able to subsequently send you rating invitations by e-mail if necessary.

Trusted Shops uses service providers in the areas of hosting, monitoring and logging. The legal basis is Art. 6 (1) (f) GDPR for the purpose of ensuring trouble-free operation. Processing may take place in third countries (USA and Israel). An adequate level of data protection is ensured in each case by an adequacy decision of the EU Commission, which can be accessed here for the USA and here for Israel. Service providers from the USA are generally certified under the EU-U.S. Data Privacy Framework (DPF). Further information is available here. Where service providers are not certified under the DPF, standard contractual clauses have been concluded as a suitable guarantee.

9. Social Media

9.1 Social buttons by Facebook (by Meta), Instagram (by Meta), Whatsapp

Social buttons by social networks are used on our website. These are only integrated into the page as HTML links, so that no connection to the servers of the respective provider is established when our website is accessed. If you click on one of the buttons, the website of the respective social network will open in a new window of your browser. There you can click e.g. the Like or Share button.

9.2 Our online presence on Facebook (by Meta), Youtube, Instagram (by Meta), Pinterest

If you have given your consent to the respective social media provider in accordance with Art. 6 (1) (a) GDPR, when you visit our online presence on the social media mentioned above, your data will be automatically collected and stored for market research and advertising purposes, from which user profiles are created using pseudonyms. These can be used, for example, to place advertisements within and outside the platforms that presumably correspond to your interests. Cookies are usually used for this purpose. For detailed information on the processing and use of data by the respective social media provider, as well as a contact option and your rights and settings options for the protection of your privacy, please refer to the provider's privacy policies linked below. Should you still require assistance in this regard, please contact us.

Facebook (by Meta) is provided by Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland (hereafter "Meta Platforms Ireland ") The information automatically collected by Meta Platforms Ireland about your use of our online presence on Facebook (by Meta) is usually transferred to a server of Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025, USA and stored there. Data processing in the context of a visit to a Facebook (by Meta) fan page is based on an agreement between joint controllers in accordance with Art. 26 GDPR. Further information (information on Insights data) can be found here.

The adequacy decision for the USA applies as the basis for third country transfers, provided that the respective service provider is certified. Certification is available.

Our service providers are located and/or use servers in these countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Brazil, Mexico.
There is no adequacy decision for these countries by the European Commission. Our cooperation with them is based on these safeguards: Standard data protection clauses of the European Commission.

Instagram (by Meta) is provided by Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland (hereafter "Meta Platforms Ireland ") The information automatically collected by Meta Platforms Ireland about your use of our online presence on Instagram is typically transferred to and stored on a server at Meta Platforms Inc., 1601 Willow Road, Menlo Park, California 94025, USA. Data processing in the context of a visit to an Instagram (by Meta) fan page is based on an agreement between joint controlers in accordance with art. 26 GDPR. Further information (information on Insights data) can be found here.

The adequacy decision for the USA applies as the basis for third country transfers, provided that the respective service provider is certified. Certification is available.

Our service providers are located and/or use servers in these countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Brazil, Mexico:
There is no adequacy decision for these countries by the European Commission. Our cooperation with them is based on these safeguards: Standard data protection clauses of the European Commission.

YouTube is provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (hereafter "Google"). The information automatically collected by Google about your use of our online presence on YouTube is generally transferred to a server of Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA and stored there.

Our service providers are located and/or use servers in countries outside the EU and the EEA for which the European Commission has established by decision an adequate level of data protection.

Our service providers are located and/or use servers in countries outside the EU and the EEA. For these countries there is no adequacy decision by the European Commission. Our cooperation is based on standard data protection clauses adopted by the European Commission.

Pinterest is provided by Pinterest Europe Ltd, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland (hereafter "Pinterest"). The information automatically collected by Pinterest about your use of our online presence on Pinterest is usually transferred to and stored on a server of Pinterest, Inc, 505 Brannan St, San Francisco, CA 94107, USA.

Our service providers are located and/or use servers in countries outside the EU and the EEA for which the European Commission has established by decision an adequate level of data protection.

10. Contact options and your rights

10.1 Your rights

Being the data subject, you have the following rights according to:

art. 15 GDPR, the right to obtain information about your personal data which we process, within the scope described therein;
art. 16 GDPR, the right to immediately demand rectification of incorrect or completion of your personal data stored by us;
art. 17 GDPR, the right to request erasure of your personal data stored with us, unless further processing is required
- to exercise the right of freedom of expression and information;
- for compliance with a legal obligation;
- for reasons of public interest or
- for establishing, exercising or defending legal claims;
art. 18 GDPR, the right to request restriction of processing of your personal data, insofar as
- the accuracy of the data is contested by you;
- the processing is unlawful, but you refuse their erasure;
- we no longer need the data, but you need it to establish, exercise or defend legal claims, or
- you have lodged an objection to the processing in accordance with art. 21 GDPR;
art. 20 GDPR, the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller;
art. 77 GDPR, the right to complain to a supervisory authority . As a rule, you can contact the supervisory authority at your habitual place of residence or workplace or at our company headquarters.

Right to object
If we process personal data as described above to protect our legitimate interests that are overriding in the process of balancing of interests, you may object to such data processing with future effect. If your data are processed for direct marketing purposes, you may exercise this right at any time as described above. If your data are processed for other purposes, you have the right to object only on grounds relating to your particular situation.

After you have exercised your right to object, we will no longer process your personal data for such purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

This does not apply to the processing of personal data for direct marketing purposes. In such a case we will no longer process your personal data for such purposes.

10.2 Contact options

If you have any questions about how we collect, process or use your personal data, want to enquire about, correct, restrict or delete your data, or withdraw any consents you have given, or opt-out of any particular data use, please contact us directly using the contact data provided in our supplier identification.

Withdrawal of consent

Pursuant to Art. 7 (3) GDPR, you have the right to withdraw any consent you have given at any time with effect for the future. The easiest way to withdraw or change your consent to cookies and similar technologies is via the "Cookie settings" link in the footer of every page; otherwise, a message to the contact details given above is sufficient.

Last updated: October 2026