Privacy Policy

1. Introduction and Contact Details of the Data Controller

Offworld Consulting GmbH
Goswinweg 2
44319 Dortmund, Germany
Phone: +49 (0) 162 766 2318
Email: [email protected]

Data Protection Officer: Olivia Link
Goswinweg 2, 44319 Dortmund
Email: [email protected]

1.1 We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about the handling of your personal data when using our website. Personal data is all data with which you can be personally identified.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Offworld Consulting GmbH, Goswinweg 2, 44319 Dortmund, +49 (0) 162 766 2318, [email protected]. The controller responsible for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

1.3 The controller has appointed a data protection officer, who can be contacted as follows: Olivia Link, Offworld Consulting GmbH, Goswinweg 2, 44319 Dortmund, [email protected]

2. Data Collection When Visiting Our Website

2.1 When using our website purely for informational purposes, i.e. if you do not register or otherwise transmit information to us, we only collect the data that your browser transmits to the page server (so-called "server log files"). When you access our website, we collect the following data, which is technically necessary for us to display the website to you: our visited website; date and time of access; amount of data sent in bytes; source/reference from which you reached the page; browser used; operating system used; IP address used (where applicable: in anonymised form). Processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or otherwise used. However, we reserve the right to retrospectively check the server log files should there be concrete indications of unlawful use.

2.2 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the controller). You can recognise an encrypted connection by the character string "https://" and the lock symbol in your browser bar.

3. Hosting & Content Delivery Network

For the hosting of our website and the display of page content, we use a provider that provides its services itself or through selected sub-contractors exclusively on servers within the European Union.

All data collected on our website is processed on these servers.

We have concluded a data processing agreement with the provider that ensures the protection of the data of our site visitors and prohibits unauthorised disclosure to third parties.

4. Cookies

To make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your device. Some of these cookies are automatically deleted after closing the browser (so-called "session cookies"), while others remain on your device for a longer period and allow the storage of page settings (so-called "persistent cookies"). In the latter case, you can determine the storage duration from the overview of the cookie settings of your web browser.

Insofar as personal data is also processed by individual cookies we use, the processing is carried out pursuant to Art. 6(1)(b) GDPR either for the performance of the contract, pursuant to Art. 6(1)(a) GDPR in the case of consent given, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the site visit.

You can set your browser so that you are informed about the setting of cookies and decide individually whether to accept them or exclude the acceptance of cookies for certain cases or in general.

Please note that if cookies are not accepted, the functionality of our website may be limited.

5. Contact

5.1 Userlike — This website uses a live chat system from the following provider: Userlike UG (haftungsbeschrankt), Deisterweg 7, 51109 Cologne, Germany. The processing of personal data transmitted via the chat is carried out either pursuant to Art. 6(1)(b) GDPR, because it is necessary for the initiation or performance of a contract, or pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the effective support of our site visitors. Your data transmitted in this way will be deleted, subject to any conflicting statutory retention periods, once the relevant matter has been conclusively resolved. Additionally, for the purpose of creating pseudonymised usage profiles, further information may be collected and evaluated using cookies, which, however, does not serve your personal identification and is not merged with other data sets. Insofar as this information is personal in nature, processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the statistical analysis of user behaviour for optimisation purposes. The setting of cookies can be prevented by appropriate browser settings. The functionality of our website may be limited in this case. You can object to the collection and storage of data for the purpose of creating a pseudonymised usage profile at any time with effect for the future. We have concluded a data processing agreement with the provider that ensures the protection of the data of our site visitors and prohibits unauthorised disclosure to third parties.

5.2 Calendly — For the provision of an online appointment booking function, we use the services of the following provider: Calendly, LLC, BB&T Tower, 271 17th St NW, Atlanta, GA 30363, USA. For the purpose of scheduling appointments, first and last name as well as email address (and, where applicable, telephone number if a telephone appointment is desired) are collected pursuant to Art. 6(1)(b) GDPR and transmitted to the provider on the basis of our legitimate interest in effective customer management and efficient appointment management pursuant to Art. 6(1)(f) GDPR and stored there for appointment organisation. After the appointment has been held or after the agreed appointment period has elapsed, your data is deleted by the provider. We have concluded a data processing agreement with the provider that ensures the protection of the data of our site visitors and prohibits unauthorised disclosure to third parties. For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

5.3 Price Suggestion Function — On our website, we offer customers the option of submitting a price suggestion for selected items via an electronic form, at which price they would purchase the item. Pursuant to Art. 6(1)(b) GDPR, we collect and store certain personal data of the enquirer (such as name and email address) during the electronic transmission of the form for the processing of the price suggestion and use this data to subsequently inform the enquirer about the rejection or acceptance of the suggestion or to submit a counter-proposal. The data provided via the form is used strictly for the purpose of collecting and assigning the price suggestion and for a decision on its acceptance for the possible preparation of a contract conclusion. After the final processing of a price suggestion enquiry, the personal data is deleted, unless statutory retention periods prevent this.

5.4 In the course of contacting us (e.g. via contact form or email), personal data is processed — exclusively for the purpose of processing and responding to your enquiry and only to the extent required for this purpose. The legal basis for the processing of this data is our legitimate interest in responding to your enquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6(1)(b) GDPR. Your data is deleted once the circumstances indicate that the matter in question has been conclusively resolved and provided no statutory retention obligations apply.

6. Data Processing When Opening a Customer Account

Pursuant to Art. 6(1)(b) GDPR, personal data continues to be collected and processed to the extent required when you provide it to us when opening a customer account. Which data is required for account opening can be found in the input mask of the corresponding form on our website.

Deletion of your customer account is possible at any time and can be carried out by sending a message to the above-mentioned address of the controller. After deletion of your customer account, your data is deleted, provided that all contracts concluded through it have been fully processed, no statutory retention periods apply, and there is no legitimate interest on our part in the continued storage.

7. Use of Customer Data for Direct Marketing

7.1 Registration for our email newsletter — If you register for our email newsletter, we will regularly send you information about our offers. The only mandatory information for sending the newsletter is your email address. The provision of additional data is voluntary and is used to address you personally. We use the so-called double opt-in procedure for sending the newsletter, which ensures that you only receive the newsletter once you have expressly confirmed your consent to receive it by activating a verification link sent to the specified email address. By activating the confirmation link, you give us your consent for the use of your personal data pursuant to Art. 6(1)(a) GDPR. We store the IP address entered by your Internet Service Provider (ISP) as well as the date and time of registration in order to be able to trace any possible misuse of your email address at a later date. The data collected by us during registration for the newsletter is used strictly for the stated purpose. You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending a corresponding message to the controller mentioned at the beginning. After unsubscribing, your email address is immediately deleted from our newsletter distribution list, unless you have expressly consented to further use of your data or we have reserved further use of data that is permitted by law and about which we inform you in this declaration.

7.2 Sending of the email newsletter to existing customers — If you have provided us with your email address when purchasing goods or services, we reserve the right to regularly send you offers for similar goods or services from our range by email. Pursuant to § 7(3) of the German Unfair Competition Act (UWG), we do not need to obtain separate consent from you for this purpose. Data processing in this regard is carried out solely on the basis of our legitimate interest in personalised direct marketing pursuant to Art. 6(1)(f) GDPR. If you have initially objected to the use of your email address for this purpose, no emails will be sent by us. You have the right to object to the use of your email address for the aforementioned advertising purpose at any time with effect for the future by sending a notification to the controller mentioned at the beginning. Only transmission costs at the basic rates apply for this purpose. After receipt of your objection, the use of your email address for advertising purposes will be discontinued immediately.

7.3 CleverReach — The dispatch of our email newsletters is carried out via this provider: CleverReach GmbH & Co. KG, Muhlenstr. 43, 26180 Rastede, Germany. On the basis of our legitimate interest in effective and user-friendly newsletter marketing, we pass on the data you provided during newsletter registration to this provider pursuant to Art. 6(1)(f) GDPR so that the provider can carry out the newsletter dispatch on our behalf. Subject to your express consent pursuant to Art. 6(1)(a) GDPR, the provider additionally conducts a statistical performance analysis of newsletter campaigns using web beacons or tracking pixels in the emails sent, which can measure open rates and specific interactions with the newsletter content. Device information (e.g. time of access, IP address, browser type, and operating system) is also collected and evaluated but not merged with other data sets. You can revoke your consent to newsletter tracking at any time with effect for the future. We have concluded a data processing agreement with the provider that protects the data of our site visitors and prohibits disclosure to third parties.

7.4 Advertising by postal mail — On the basis of our legitimate interest in personalised direct marketing, we reserve the right to store your first and last name, your postal address and — insofar as we have received these additional details from you in the course of the contractual relationship — your title, academic degree, year of birth, and professional, industry, or business designation pursuant to Art. 6(1)(f) GDPR and to use them for the sending of interesting offers and information about our products by postal mail. You can object to the storage and use of your data for this purpose at any time.

8. Payment Service Providers

8.1 Insofar as required for contract processing for delivery and payment purposes, the personal data collected by us is passed on to the commissioned transport company and the commissioned credit institution pursuant to Art. 6(1)(b) GDPR. Insofar as we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we process the contact data you provided during the order to inform you personally within the scope of our statutory information obligations pursuant to Art. 6(1)(c) GDPR. Your contact data is used strictly for the purpose of notifications about updates owed by us and is only processed by us to the extent necessary for the respective notification. To process your order, we also work with the service provider(s) listed below, who support us in whole or in part in the performance of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

8.2 To fulfil our contractual obligations to our customers, we work with external shipping partners. We pass on your name and your delivery address and, insofar as this is required for delivery, your telephone number, exclusively for the purposes of goods delivery pursuant to Art. 6(1)(b) GDPR to a shipping partner selected by us.

8.3 Shipcloud — For order processing, we use the following provider: shipcloud GmbH, Ludmoor 35a, 22175 Hamburg, Germany. Name, address, and where applicable further personal data are passed on to the provider exclusively for the purpose of processing the online order pursuant to Art. 6(1)(b) GDPR. Your data is only passed on insofar as this is actually necessary for the processing of the order.

8.4 Disclosure of personal data to shipping service providers — DHL: As a transport service provider, we use the following provider: DHL Paket GmbH, Strasschensweg 10, 53113 Bonn, Germany. We pass on your email address and/or telephone number to the provider before delivery of the goods for the purpose of coordinating a delivery date or delivery notification pursuant to Art. 6(1)(a) GDPR, provided you have given your express consent for this during the ordering process. Otherwise, we only pass on the name of the recipient and the delivery address to the provider for the purpose of delivery pursuant to Art. 6(1)(b) GDPR. The data is only passed on insofar as this is necessary for the delivery of the goods. In this case, prior coordination of the delivery date with the provider or delivery notification is not possible. Consent can be revoked at any time with effect for the future towards the above-mentioned controller or towards the provider. — DHL Express: As a transport service provider, we use the following provider: DHL Express Germany GmbH, Heinrich-Bruning-Str. 5, 53113 Bonn, Germany. We pass on your email address and/or telephone number to the provider before delivery of the goods for the purpose of coordinating a delivery date or delivery notification pursuant to Art. 6(1)(a) GDPR, provided you have given your express consent for this during the ordering process. Otherwise, we only pass on the name of the recipient and the delivery address to the provider for the purpose of delivery pursuant to Art. 6(1)(b) GDPR. The data is only passed on insofar as this is necessary for the delivery of the goods. Consent can be revoked at any time with effect for the future towards the above-mentioned controller or towards the provider. — GLS: As a transport service provider, we use the following provider: General Logistics Systems Germany GmbH & Co. OHG, GLS Germany-Strasse 1-7, 36286 Neuenstein, Germany. We pass on your email address and/or telephone number to the provider before delivery of the goods for the purpose of coordinating a delivery date or delivery notification pursuant to Art. 6(1)(a) GDPR, provided you have given your express consent for this during the ordering process. Otherwise, we only pass on the name of the recipient and the delivery address to the provider for the purpose of delivery pursuant to Art. 6(1)(b) GDPR. The data is only passed on insofar as this is necessary for the delivery of the goods. Consent can be revoked at any time with effect for the future towards the above-mentioned controller or towards the provider.

8.5 Use of payment service providers — Billie GmbH: One or more online payment methods from the following provider are available on this website: Billie GmbH, Charlottenstrasse 4, 10969 Berlin, Germany. When selecting a payment method from the provider where you pay in advance (e.g. credit card payment), your payment data provided during the ordering process (including name, address, bank and payment card information, currency, and transaction number) as well as information about the content of your order are passed on to the provider pursuant to Art. 6(1)(b) GDPR. Your data is only passed on in this case exclusively for the purpose of payment processing with the provider and only insofar as this is necessary. When selecting a payment method where the provider pays in advance (e.g. purchase on account or by instalments, or direct debit), you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postcode, city, date of birth, email address, telephone number, and where applicable data on an alternative means of payment). To safeguard our legitimate interest in determining the creditworthiness of our customers, this data is forwarded by us to the provider for the purpose of a credit check pursuant to Art. 6(1)(f) GDPR. The provider checks on the basis of your personal data and further data (such as shopping cart, invoice amount, order history, payment experience) whether the payment option you have selected can be granted with regard to payment and/or default risks. For the decision within the scope of the application review, identity and creditworthiness information from the following credit agencies may be used in addition to provider-internal criteria pursuant to Art. 6(1)(f) GDPR: Creditreform Berlin Wolfram KG, Karl-Heinrich-Ulrichs-Strasse 1, 10787 Berlin, Germany; Creditreform Boniversum GmbH, Hammfelddamm 13, 41460 Neuss, Germany; SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden, Germany; Euler Hermes Deutschland, Friedensallee 254, 22763 Hamburg, Germany. The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. The calculation of the score values includes, among other things but not exclusively, address data. You can object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may still be entitled to process your personal data if this is necessary for contractual payment processing. — PayPal: One or more online payment methods from the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. When selecting a payment method from the provider where you pay in advance, your payment data provided during the ordering process (including name, address, bank and payment card information, currency, and transaction number) as well as information about the content of your order are passed on to the provider pursuant to Art. 6(1)(b) GDPR. Your data is only passed on exclusively for the purpose of payment processing with the provider and only insofar as this is necessary. When selecting a payment method where we pay in advance, you will also be asked during the ordering process to provide certain personal data. To safeguard our legitimate interest in determining your creditworthiness, this data is forwarded by us to the provider for the purpose of a credit check pursuant to Art. 6(1)(f) GDPR. The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. You can object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may still be entitled to process your personal data if this is necessary for contractual payment processing.

8.6 Credit check — If we provide advance services (e.g. delivery on account), we reserve the right to carry out a credit check based on mathematical-statistical procedures to safeguard our legitimate interest in determining the creditworthiness of our customers. The personal data required for a credit check is transmitted by us pursuant to Art. 6(1)(f) GDPR to the following service provider: Creditsafe Deutschland GmbH, Schreiberhauer Strasse 30, 10317 Berlin. The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. The calculation of the score values includes, among other things but not exclusively, address data. We use the result of the credit check regarding the statistical probability of payment default for the purpose of deciding on the establishment, performance, or termination of a contractual relationship. You can object to this processing of your data at any time by sending a message to the controller responsible for data processing or to the aforementioned credit agency. However, we may still be entitled to process your personal data if this is necessary for contractual payment processing.

8.7 We reserve the right to pass on your data to the debt collection service provider Tesch Inkasso Finance GmbH, Part of the Lowell Group, Berliner Str. 93, 40880 Ratingen, insofar as our payment claim has not been settled despite a prior reminder. In this case, the claim will be collected directly by the debt collection service provider. The disclosure of your data serves contract fulfilment pursuant to Art. 6(1)(1)(b) GDPR as well as the safeguarding of our predominant legitimate interests in the effective assertion or enforcement of our payment claims pursuant to Art. 6(1)(1)(f) GDPR.

9. Shipping Service Providers

To fulfil our contractual obligations, we work with external shipping partners. We pass on your name and delivery address and, insofar as required for delivery, your telephone number exclusively for the purposes of goods delivery pursuant to Art. 6(1)(b) GDPR to a shipping partner selected by us.

DHL — As a transport service provider, we use DHL Paket GmbH, Strasschensweg 10, 53113 Bonn, Germany. We pass on your email address and/or telephone number pursuant to Art. 6(1)(a) GDPR before delivery of the goods for the purpose of coordinating a delivery date or delivery notification, provided you have given your express consent during the ordering process. Otherwise, we only pass on the recipient's name and delivery address pursuant to Art. 6(1)(b) GDPR for delivery purposes.

DHL Express — As a transport service provider, we use DHL Express Germany GmbH, Heinrich-Bruning-Str. 5, 53113 Bonn, Germany. The same data-sharing conditions apply as described above for DHL.

GLS — As a transport service provider, we use General Logistics Systems Germany GmbH & Co. OHG, GLS Germany-Strasse 1-7, 36286 Neuenstein, Germany. The same data-sharing conditions apply as described above for DHL.

• DHL Paket GmbH
• DHL Express Germany GmbH
• GLS Germany

The sharing of phone numbers or email addresses with shipping service providers requires the explicit consent of the Customer during the ordering process. Consent can be revoked at any time with effect for the future.

10. Online Presence on Social Media

We maintain online presences on social networks and platforms in order to communicate with customers, interested parties, and users active there and to inform them about our services. When accessing the respective networks and platforms, the terms and conditions and data processing policies of their respective operators apply.

Unless otherwise stated in our privacy policy, we process the data of users who communicate with us within the social networks and platforms, e.g. by writing posts on our online presences or sending us messages.

11. Web Analytics Services

11.1 Google (Universal) Analytics — This website uses Google (Universal) Analytics, a web analytics service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which enables an analysis of your use of our website. By default, when you visit the website, Google (Universal) Analytics sets cookies that are stored as small text elements on your device and collect certain information. This information also includes your IP address, which is, however, truncated by Google by the last digits to exclude a direct personal reference. The information is transmitted to Google servers and further processed there. Transmissions to Google LLC based in the USA are also possible. Google uses the collected information on our behalf to evaluate your use of the website, to compile reports on website activities for us, and to provide further services related to website and internet use. The shortened IP address transmitted from your browser within the scope of Google Analytics is not merged with other Google data. The data collected within the scope of using Google (Universal) Analytics is stored for a period of two months and subsequently deleted. All of the above-described processing, in particular the setting of cookies on the device used, only takes place if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. Without your consent, Google (Universal) Analytics will not be used during your visit to the website. You can revoke your consent at any time with effect for the future. To exercise your right of revocation, please deactivate this service via the "Cookie Consent Tool" provided on the website. We have concluded a data processing agreement with Google that ensures the protection of the data of our site visitors and prohibits unauthorised disclosure to third parties. The provider has joined the EU-US Data Privacy Framework.

11.2 Google Analytics 4 — This website uses Google Analytics 4, a web analytics service of Google Ireland Limited ("Google"), which enables an analysis of your use of our website. The same principles regarding cookies, IP truncation, data processing, consent requirements, and data retention (two months) apply as described above for Google (Universal) Analytics. The provider has joined the EU-US Data Privacy Framework.

11.3 Google Tag Manager — This website uses the "Google Tag Manager", a service of Google Ireland Limited ("Google"). The Google Tag Manager provides a technical foundation for bundling various web applications, including tracking and analytics services, and to calibrate, control, and set conditions for them via a unified user interface. The Google Tag Manager itself does not store any information on user devices or read them out. Nor does the service carry out independent data analyses. However, through the Google Tag Manager, your IP address is transmitted to Google when a page is called up and may be stored there. This processing only takes place if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. The provider has joined the EU-US Data Privacy Framework.

11.4 Hotjar — This website uses the web analytics service of the following provider: Hotjar Ltd, Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta. Using cookies and/or comparable technologies (tracking pixels, web beacons, algorithms for reading device and browser information), the service collects and stores pseudonymised visitor data, including information from the device used such as the IP address and browser information, to evaluate them for statistical analyses of user behaviour on our website and to create pseudonymised usage profiles. Among other things, the evaluation of movement patterns (so-called heat maps) is possible, which show the duration of page visits as well as interactions with page content (e.g. text entries, scrolling, clicks, and mouse-overs). Pseudonymisation fundamentally excludes a direct personal reference. A merging with clear data about your person collected in other ways does not take place. All of the above-described processing only takes place if you have given us your express consent pursuant to Art. 6(1)(a) GDPR.

12. Plugins and Embedded Features

12.1 LinkedIn Plugins — Plugins of the social network of the following provider are used on our website: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. These plugins enable direct interactions with content on the social network. To enhance the protection of your data when visiting our website, the plugins are initially deactivated and integrated into the page using a so-called "2-click" or "Shariff" solution. Only when you activate the plugins, thereby giving your consent to data transmission pursuant to Art. 6(1)(a) GDPR, does your browser establish a direct connection to the provider's servers. Data may also be transferred to: LinkedIn Inc., USA.

12.2 Vimeo — This website uses plugins for the display and playback of videos from the following provider: Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA. When you access a page of our website that contains such a plugin, your browser establishes a direct connection to the provider's servers to load the plugin. Certain information, including your IP address, is transmitted to the provider. If video playback is started via the plugin, the provider also uses cookies to collect information about user behaviour, to create playback statistics, and to prevent abusive behaviour. All of the aforementioned processing only takes place if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. The provider has joined the EU-US Data Privacy Framework.

12.3 YouTube — This website uses plugins for the display and playback of videos from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. Data may also be transferred to: Google LLC., USA. When you access a page of our website that contains such a plugin, your browser establishes a direct connection to the provider's servers at the latest at the time of video playback to load the content. The provider also uses cookies when video playback is started. All of the aforementioned processing only takes place if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. The provider has joined the EU-US Data Privacy Framework.

12.4 Google Maps — This website uses an online mapping service from the following provider: Google Maps (API) from Google Ireland Limited ("Google"). Google Maps is a web service for displaying interactive maps to present geographical information visually. By using this service, our location is displayed to you and any journey to us is facilitated. Even when accessing the sub-pages in which the Google Maps map is embedded, information about your use of our website (such as your IP address) is transmitted to and stored on Google servers; this may also involve transmission to Google LLC servers in the USA. The collection, storage, and analysis is carried out pursuant to Art. 6(1)(f) GDPR on the basis of Google's legitimate interest in displaying personalised advertising, market research, and/or the needs-based design of Google websites. Insofar as legally required, we have obtained your consent pursuant to Art. 6(1)(a) GDPR for the above-described processing. The provider has joined the EU-US Data Privacy Framework.

12.5 Google Maps API — To enable the real-time checking of certain entries in the address form of our webshop's ordering process for input errors, we use the services of Google Ireland Limited. Data may also be transferred to: Google LLC., USA. The provider validates the entered address, verifies the spelling, and supplements any missing data where necessary. This processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the proper recording of the correct address data of the Customer for the conscientious fulfilment of our contractual delivery obligations. The provider has joined the EU-US Data Privacy Framework.

12.6 Google Web Fonts — This page uses so-called web fonts from Google Ireland Limited for the uniform display of fonts. When you access a page, your browser loads the required web fonts into your browser cache to display texts and fonts correctly and establishes a direct connection to the provider's servers. Certain browser information, including your IP address, is transmitted to the provider. Data may also be transferred to: Google LLC, USA. Processing only takes place if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. The provider has joined the EU-US Data Privacy Framework.

12.7 Google reCAPTCHA — On this website, we use the CAPTCHA service of Google Ireland Limited. Data may also be transferred to: Google LLC, USA. The service checks whether an input is made by a natural person or abusively through automated processing, and blocks spam, DDoS attacks, and similar automated malicious access. Insofar as the above-described processing is based on cookies, these are only set if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. Where the above-described processing is carried out without the use of cookies, the legal basis is our legitimate interest in determining individual responsibility on the internet and avoiding misuse and spam pursuant to Art. 6(1)(f) GDPR. The provider has joined the EU-US Data Privacy Framework.

12.8 Google Customer Reviews — We work with Google within the scope of the "Google Customer Reviews" programme. The provider is Google Ireland Limited ("Google"). This programme gives us the opportunity to obtain customer reviews from users of our website. After a purchase on our website, you will be asked whether you would like to participate in an email survey from Google. If you give your consent pursuant to Art. 6(1)(a) GDPR, we transmit your email address to Google. The provider has joined the EU-US Data Privacy Framework.

12.9 Microsoft Teams — For conducting online meetings, video conferences, and/or webinars, we use this provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. The provider processes various data, whereby the scope of the processed data depends on which data you provide before or during participation in an online meeting, video conference, or webinar. The legal bases for processing are Art. 6(1)(b) GDPR (contract performance), Art. 6(1)(a) GDPR (consent), and Art. 6(1)(f) GDPR (legitimate interest in effective conduct of meetings). The provider has joined the EU-US Data Privacy Framework.

12.10 Microsoft Forms — For conducting surveys or online forms, we use the services of the following provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. The provider enables us to create and evaluate surveys and online forms. In addition to the respective personal data you enter into the forms, information about your operating system, browser, date and time of your visit, referrer URL, and your IP address are also collected. The storage of the information you enter into the forms is password-protected. The provider has joined the EU-US Data Privacy Framework.

12.11 Job applications by email — On our website, we advertise currently vacant positions in a separate section, to which interested parties can apply by email to the provided contact address. Applicants must provide all personal data required for a thorough assessment. Processing is carried out on the basis of Art. 6(1)(b) GDPR (or § 26(1) BDSG). If a candidate is not selected or withdraws their application early, the data transmitted and all electronic correspondence including the application email are deleted no later than 6 months after notification.

12.12 Online applications via a form — On our website, we advertise currently vacant positions in a separate section, to which interested parties can apply via a corresponding form. During submission of the form, applicant data is transmitted to us in encrypted form in accordance with the state of the art, stored by us, and evaluated exclusively for the purpose of processing the application. The same legal basis and retention period as for email applications apply.

13. Tools and Other Services

13.1 weclapp — For accounting purposes, we use the service of the cloud-based accounting software from the following provider: weclapp GmbH, Friedrich-Ebert-Strasse 28, 97318 Kitzingen. The provider processes incoming and outgoing invoices as well as, where applicable, the bank transactions of our company in order to automatically record invoices, match them to transactions, and create financial accounting in a partially automated process. Insofar as personal data is also processed in this context, processing is carried out on the basis of our legitimate interest in the efficient organisation and documentation of our business processes pursuant to Art. 6(1)(f) GDPR.

13.2 Cookie Consent Tool — This website uses a so-called "Cookie Consent Tool" to obtain effective user consents for cookies and cookie-based applications that require consent. The "Cookie Consent Tool" is displayed to users when they access the site in the form of an interactive user interface, on which consents for certain cookies and/or cookie-based applications can be given by ticking checkboxes. The tool thereby ensures that all cookies/services requiring consent are only loaded when the respective user grants corresponding consents by ticking checkboxes. The tool sets technically necessary cookies to store your cookie preferences. Personal user data is generally not processed in this context. Where, in individual cases, personal data (such as the IP address) is processed for the purpose of storing, assigning, or logging cookie settings, this is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in a legally compliant, user-specific, and user-friendly consent management for cookies and thus in a legally compliant design of our website. A further legal basis for the processing is Art. 6(1)(c) GDPR. As the controller, we are subject to the legal obligation to make the use of technically non-essential cookies dependent on the respective user's consent.

14. Rights of the Data Subject

14.1 Applicable data protection law grants you the following data subject rights (rights of access and intervention) vis-a-vis the controller with regard to the processing of your personal data, whereby the legal basis cited applies to the respective conditions for exercise:

• Right of access pursuant to Art. 15 GDPR
• Right to rectification pursuant to Art. 16 GDPR
• Right to erasure pursuant to Art. 17 GDPR
• Right to restriction of processing pursuant to Art. 18 GDPR
• Right to notification pursuant to Art. 19 GDPR
• Right to data portability pursuant to Art. 20 GDPR
• Right to withdraw given consents pursuant to Art. 7(3) GDPR
• Right to lodge a complaint pursuant to Art. 77 GDPR

14.2 RIGHT TO OBJECT — IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR PREDOMINANT LEGITIMATE INTEREST WITHIN THE SCOPE OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION. IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS, AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE, OR DEFENCE OF LEGAL CLAIMS. IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE. IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES. To exercise your rights, contact: [email protected]

15. Duration of Storage of Personal Data

The duration of the storage of personal data is determined on the basis of the respective legal basis, the processing purpose, and — where applicable — additionally on the basis of the respective statutory retention period (e.g. retention periods under commercial and tax law).

When processing personal data on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the data concerned is stored until you revoke your consent.

Where statutory retention periods exist for data processed within the scope of legal or quasi-legal obligations on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted after the expiry of the retention periods, provided it is no longer necessary for contract fulfilment or contract initiation and/or there is no legitimate interest on our part in continued storage.

When processing personal data on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defence of legal claims.

When processing personal data for the purpose of direct marketing on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(2) GDPR.

Unless otherwise stated in other information in this declaration regarding specific processing situations, stored personal data is otherwise deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.