Kraft Profil Technik - Your specialist dealer for high-quality garden and forestry equipment

The protection of your personal data is important to us.

We inform you that we collect and store your personal data in electronic form. Your data will be stored and processed in accordance with the relevant provisions of national data protection laws and the General Data Protection Regulation (GDPR).

The responsible party within the meaning of the above regulations is:

Kraft Profil Technik GmbH

St. Wendeler Str. 133a, 66892 Bruchmühlbach-Miesau, Germany

You can also contact us at the email address provided. In this case, the personal data you send us by email will be stored.: support@kraft-profil-technik.eu

I. General Information

1. Terms

To ensure the readability and comprehensibility of our privacy policy, we will inform you in advance of the basic terms used in the GDPR.

Personal Data

Personal data means any information relating to an identified or identifiable natural person (hereinafter referred to as "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Data Subject

A data subject is any identified or identifiable natural person whose personal data is processed by the controller.

Processing

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Restriction of Processing

Restriction of processing means the marking of stored personal data with the aim of limiting their processing in the future.

Profiling

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Pseudonymisation

Pseudonymisation is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

Controller

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Processor

Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Recipient

Recipient means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

Third Party

Third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

Consent

Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Payment Service Provider

Payment service providers are used to process payments in connection with contracts that the data subject concludes with the controller.

2. Type and Scope of Data Collection

When you access our website or download a file hosted on it, data is collected and processed. This processing generally only takes place if it is necessary for the proper functioning of the website and access to its content and services. Furthermore, personal data is only collected and used after obtaining your consent. An exception is made when, for practical reasons, obtaining this prior consent is impossible and the processing of data is permitted by law.

a. Legal Basis for Processing Personal Data

If we obtain consent from the data subject for the processing of personal data, Article 6(1)(a) of the GDPR serves as the legal basis.
If the processing of personal data is necessary for the performance of contracts concluded with us, Article 6(1)(b) of the GDPR serves as the legal basis. This also applies to processing necessary for the implementation of pre-contractual measures.
Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6(1)(c) of the GDPR serves as the legal basis.
In the event that the processing of personal data is necessary to protect the vital interests of the data subject or another natural person, Article 6(1)(d) of the GDPR serves as the legal basis.
If the processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, and the interests or fundamental rights and freedoms of the data subject do not override such interests, then Article 6(1)(f) of the GDPR serves as the legal basis for processing.

b. Data Retention and Deletion Period

The personal data we collect will be deleted as soon as the purpose for which it was stored no longer applies.

Data is retained when this is provided for by law, a Union regulation or other provisions.
Furthermore, data will be deleted upon expiry of the retention period prescribed by the above-mentioned standards, unless its further retention is necessary for the conclusion or performance of a contract.

II. Data Collection via the Website

1. Log Files

a. Description and Scope of Data Processing

When you access our website

Browser type/version
Operating system used
Referrer URL (previously visited website), as well as pages visited on our website
IP address
Date and time of server request
Internet service provider

are logged.

b. Legal Basis for Data Processing

The legal basis for storing data and log files is Article 6(1)(f) of the GDPR.

c. Purpose of Data Processing

Recording data in log files ensures the proper functioning of our website. It also allows us to optimise and secure our systems. This data is not used for marketing purposes.

d. Storage Duration

The data we store is deleted as soon as it is no longer needed for the purposes for which it was collected, at the latest after seven days. Storage beyond this period is possible. In this case, users' IP addresses are deleted or anonymised so that it is no longer possible to identify the requesting client.

e. Right to Object and Request Removal

The collection of the above-mentioned data is essential for the operation of the website. Therefore, users cannot object to it.

2. Technically Necessary Cookies

a. Description and Scope of Data Processing

Our website uses cookies. Cookies are text files stored on the visitor's computer when they access our website. They contain a character string that allows the visitor's browser to be identified on subsequent visits. We use technically necessary cookies to make our website more user-friendly, efficient and secure.

The following data, for example, is stored and transmitted in cookies:

Items in the shopping cart
Login credentials
Language settings

The data collected in this way is pseudonymised by us. It is therefore impossible to link it to a particular visitor. Furthermore, this data is not stored with other personal data.

You can configure your browser to be notified when cookies are being set and thus decide whether to accept them individually or to block them in certain cases or altogether. Please note that disabling cookies may limit the functionality of our website.

b. Legal Basis for Data Processing

The legal basis for processing personal data using necessary cookies is Article 6(1)(f) of the GDPR.

c. Purpose of Data Processing

Technically necessary cookies facilitate navigation on websites. Certain features of the website or online shop cannot be offered without their use. These cookies ensure, in particular, that the browser is recognised even after a page change.

User data collected via technically necessary cookies is not used to create user profiles.

d. Storage Duration, Right to Object and Right to Erasure

Cookies are stored on the user's computer and transmitted from it. The user therefore has full control over the use of cookies. By changing the settings in their internet browser, they can disable or restrict the transmission of cookies. Cookies already stored can be deleted at any time, including automatically. If cookies are disabled for our website, some of its features may no longer be fully available.

3. Contact Form and Email

When you contact us via the contact form or by email, you agree that email communication is encrypted during transmission but not in terms of its content. Please inform yourself about the associated risks, for example here: https://www.bsi-fuer-buerger.de.

a. Description and Scope of Data Processing

We provide visitors to our website with a contact form for quick electronic communication. The data entered in the fields provided is transmitted to us and stored.

In addition, the user's IP address, as well as the date and time of transmission, are recorded at the time of sending.

Your data will not be shared with third parties. It will only be used to process your enquiry.

b. Legal Basis for Data Processing

The legal basis for data processing is Article 6(1)(a) of the GDPR.

The processing of data transmitted by email is based on Article 6(1)(f) of the GDPR. If the email contact aims at the conclusion of a contract, the processing is also based on Article 6(1)(b) of the GDPR.

c. Purpose of Data Processing

The processing of personal data is solely for the purpose of responding to the contact request. In the case of contact by email, this also constitutes the necessary legitimate interest in processing the data.

The other personal data processed during the sending process serves to prevent misuse of the contact form and to ensure the security of our IT systems.

d. Storage Duration

The data will be deleted as soon as it is no longer needed for the purposes for which it was collected. Regarding personal data from the contact form and data transmitted by email, deletion occurs when the conversation with the user has ended. A conversation is considered ended when it is clear from the circumstances that the matter has been resolved.

Additional personal data collected during the sending process will be deleted no later than seven days after collection.

If a business transaction results from the correspondence, we are legally required to retain the correspondence exchanged for 6 years (from the end of the calendar year in which the respective letter was sent).

e. Right to Object and Request Removal

The user has the right to withdraw their consent to the processing of their personal data at any time. To do so, they can contact the data controller via the contact options available on the website. If they contact us by email, they can object to the storage of their personal data at any time. In this case, the conversation cannot continue.

If data retention results from a legal obligation, there is no right to object.

5. Newsletter

a. Description and Scope of Data Processing

Users can subscribe to our newsletter on our website. When registering, the data requested via the form is transmitted to us.

In addition, the following data is collected upon registration:

IP address of the registering computer
Date and time of registration

As part of the registration process, consent is obtained through a so-called double opt-in procedure.

If you have purchased goods or services from us and provided us with your email address, it may be used subsequently to send you a newsletter. In this case, the newsletter will only contain advertising for our own similar goods or services.

b. Legal Basis for Data Processing

The legal basis for data processing after the user subscribes to the newsletter is, if consent has been given, Article 6(1)(a) of the GDPR.

The legal basis for sending the newsletter following the sale of goods or services is Section 7(3) of the German Unfair Competition Act (UWG).

c. Purpose of Data Processing

The collection of the user's email address is for the purpose of sending the newsletter.

The collection of other personal data during the registration process serves to prevent misuse of the services or the email address used.

d. Storage Duration

The data will be deleted as soon as it is no longer needed for the purposes for which it was collected. The user's email address will therefore be stored as long as their newsletter subscription is active.

e. Right to Object and Request Removal

The user can unsubscribe from the newsletter at any time. An unsubscribe link is included in every newsletter.

6. Newsletter Tracking

Klaviyo

To efficiently manage our online shop and conduct personalised marketing campaigns, we use the email tool Klaviyo. Klaviyo allows us to create and send email campaigns to our customers.

a. Description and Scope of Data Processing

When you subscribe to our newsletter or place an order, certain personal data such as your name, email address, order history and any other information you provide to us is transmitted to Klaviyo and stored by them. Klaviyo acts as an email marketing service provider and has access to this data to manage and send our campaigns.

b. Legal Basis for Data Processing

The legal basis for the processing of your personal data by Klaviyo is Article 6(1)(a) of the GDPR, as you have consented to the use of your data to receive marketing communications by subscribing to the newsletter or placing an order.

c. Purpose of Data Processing

Klaviyo processes your data to conduct email marketing campaigns and send personalised marketing communications to our customers. We use Klaviyo to provide you with relevant information about our products, special offers and news.

d. Storage Duration

Your personal data will be stored by Klaviyo as long as your newsletter subscription is active or you are a customer. You can unsubscribe from the newsletter or withdraw your consent to the use of your data for marketing purposes at any time. In this case, your data will be removed from our mailing list and will no longer be used for email marketing campaigns.

e. Right to Object and Request Removal

You can withdraw your consent to the processing of your personal data for marketing purposes at any time. To do so, you can unsubscribe from the newsletter or contact us to inform us of your withdrawal. Upon receipt of your withdrawal request, we will remove your data from our mailing list and stop using it for marketing purposes.

Please note that the withdrawal of your consent to the processing of your data for marketing purposes does not affect the lawfulness of the processing of your data carried out before this withdrawal.

7. Registration During the Order Process or Entry as a Guest

a. Description and Scope of Data Processing

Users have the option to register on our website.

Upon registration, the data requested via the form is transmitted and stored. The same applies to information entered during guest checkout.

Personal data may be transmitted to third parties, such as parcel delivery services, if this is necessary for the performance of the contract. These third parties will use the data transmitted to them exclusively for internal purposes attributable to us. For further details, please refer to Section III of this Privacy Policy.

b. Legal Basis for Data Processing

Registration and guest checkout serve to implement pre-contractual measures and perform a contract to which the user is a party. Therefore, the processing of this data is based on Article 6(1)(b) of the GDPR.

c. Purpose of Data Processing

User registration is necessary to perform contracts concluded with them or to implement pre-contractual measures. The same applies to information entered during guest checkout.

d. Storage Duration

The data will be deleted as soon as it is no longer needed for the purposes for which it was collected.

This applies to data collected during the registration process if registration on our website is cancelled or modified.

This applies to data collected during registration or guest checkout for the performance of a contract or for pre-contractual measures, particularly when this data is no longer necessary for the performance of the contract in question. Even after the contract has been performed, it may be necessary to retain the personal data of the contracting party in order to fulfil contractual or legal obligations.

For legal reasons, we are required to retain correspondence exchanged in connection with the conclusion of a contract for 6 years (from the end of the calendar year in which the respective letter was sent).

e. Right to Object and Request Removal

Users can cancel their registration at any time. They can also modify their stored data themselves or have it modified.

You can enquire with the responsible party about the procedure for deleting your registration.

If the data is necessary for the performance of a contract or the implementation of pre-contractual measures, early deletion is only possible insofar as no contractual or legal obligations preclude it.

III. Data Transfer to Third Parties for Contract Performance

1. General

a. Description and Scope of Data Processing

When you place an order, we collect and use your personal data only to the extent necessary for its processing and the handling of your enquiries. The data you enter during the order process will be shared with our service partners essential for contract performance, or with the service providers we use for order processing, insofar as this is necessary for contract performance or if you have authorised us to do so.

In addition to the recipients mentioned in the respective clauses of this Privacy Policy, these include, in particular, recipients belonging to the following categories:

Shipping service providers, payment service providers, merchandise management service providers, order processing service providers, web hosts, IT service providers and dropshipping merchants.

b. Legal Basis for Data Processing

The processing described above is necessary for the performance of a contract to which the user is a party. The legal basis for this processing is Article 6(1)(b) of the GDPR.

c. Purpose of Data Processing

This transfer is for the purpose of fulfilling our contractual obligations.

d. Storage Duration

Your data will be deleted when it is no longer needed for contract performance, unless contractual or legal retention obligations preclude this.

e. Right to Object and Request Removal

The user has the right to withdraw their consent at any time from the data controller or the provider.

2. Payment Service Providers

a. Description and Scope of Data Processing

If a user selects a payment service provider when placing an order, the data necessary for payment processing is automatically transmitted to this provider. This includes, in particular, their name and address, bank details (account or card numbers), passwords, TANs and checksums, as well as contract details, amounts and beneficiary information. In this case, the data controller does not receive any bank account or credit card information, but only confirmation of a successful transaction. The payment service provider may transmit this data to credit agencies for identity and credit verification purposes. In this regard, please refer to the terms and conditions and privacy policy of the payment service provider, available on their website.

If the use of your payment provider's service requires registration, you will be redirected to their website during payment. In this case, the provider collects the data itself. Their privacy policy then applies.

The payment service providers offered by the controller and additional information about them are available in the payment information.

b. Legal Basis for Data Processing

The legal basis for data processing is Article 6(1)(b) of the GDPR (processing necessary for the performance of pre-contractual measures and the performance of a contract).

c. Purpose of Data Processing

The transfer of data to the selected payment service provider is for the purpose of performing a contract to which the user is a party; it is carried out in particular for payment processing, fraud prevention and identity and credit verification.

d. Storage Duration

Your data will be deleted as soon as it is no longer necessary for our business activities and there is no legal retention obligation to the contrary. We have no control over data storage by the payment service provider; please contact them directly as they are the "controller" under data protection regulations.

e. Right to Object and Rectification

You have the rights mentioned in this Privacy Policy under "III. Rights of Data Subjects", which can be exercised against the respective controller.

3. Data Transfer for Credit Checks

a. Description and Scope of Data Processing

In legally permitted cases, data may be transmitted to credit agencies for credit verification purposes in connection with payment processing. The following companies may be recipients of this data:

Schufa, SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden https://www.schufa.de/de/datenschutz/
Arvato Bertelsmann, Bertelsmann SE & Co. KGaA, Carl-Bertelsmann-Straße 270, 33311 Gütersloh, https://finance.arvato.com/de/ueber-arvato/datenschutz.html
Infoscore Forderungsmanagement GmbH, Gütersloher Str. 123, 33415 Verl, https://www.inkassoportal.de/rechtliches/datenschutz
Creditreform, Association of Creditreform Clubs e.V., Hellersbergstraße 12, 41460 Neuss, https://www.creditreform.de/eu-dsgvo.html
Bürgel, CRIF Bürgel GmbH, Radlkoferstraße 2, 81373 Munich, https://www.crifbuergel.de/sites/default/files/documents/informationsblatt_dsgvo.pdf

b. Legal Basis for Data Processing

The legal basis for data processing is Article 6(1)(b) of the GDPR.

c. Purpose of Data Processing

Data is transmitted for fraud prevention purposes as well as identity and credit verification.

d. Storage Duration

Your data will be deleted as soon as it is no longer necessary for our business activities and there is no legal retention obligation to the contrary. We have no control over the data storage practices of our provider. You can contact them at the above contact details.

e. Right to Object and Request Removal

The user has the right to withdraw their consent at any time by contacting the provider or the data controller. However, it is not possible to withdraw consent for data strictly necessary for payment processing.

4. Data Transfer in Connection with Commercial Leasing

We process your data exclusively in accordance with our Privacy Policy. For the purpose of performing the rental contract for business customers, we transfer your personal data to the ALBIS Leasing Group, which processes it in accordance with its own privacy policy.

I consent to the ALBIS Leasing Group processing my personal data for the purpose of assessing my creditworthiness in connection with (at least partially) automated credit decisions related to commercial leasing contracts. For this purpose, my personal data may be transferred to and processed by credit agencies (Creditreform Hamburg von der Decken & Wall KG, Schufa Holding AG and/or infoscore Consumer Data GmbH). For further details, please refer to the ALBIS Leasing Group's privacy policy.

IV. Data Transfer for Usage Analysis

1. Google Analytics

a. Description and Scope of Data Processing

This website uses the web analytics service Google Analytics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses analytical cookies. The information generated by these cookies about your use of this website is generally transmitted to a Google server in the USA and stored there. We supplement the Google Analytics code with the code "gat._anonymizeIp();". This code ensures that the recorded IP address is shortened by Google within the Member States of the European Union or in other Contracting States of the Agreement on the European Economic Area before transmission. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage. The IP address transmitted by your browser in the context of Google Analytics will not be merged with other Google data. For more information, please visit: https://www.google.com/analytics/terms/de.html or https://policies.google.com/?hl=de .

b. Legal Basis for Data Processing

The legal basis for processing users' personal data is Article 6(1)(a) of the GDPR.

c. Purpose of Data Processing

The processing of users' personal data allows us to analyse their browsing behaviour. The evaluation of the data collected enables us to compile information on the use of the various parts of our website. This helps us to improve our website and its user-friendliness. The anonymisation of the IP address ensures the protection of users' personal data.

d. Storage Duration

Your data will be deleted when it is no longer needed for our business processes and there is no legal retention obligation to the contrary.

We have also stipulated that Google will automatically delete data after 14/26/38/50 months.

e. Right to Object and Request Removal

In addition, you can prevent Google from collecting and processing the data generated by the cookie and related to your use of the website (including your IP address) by downloading and installing the browser extension available at https://tools.google.com/dlpage/gaoptout?hl=de .

To opt out when using mobile devices, the following link Disable Google Analytics must be clicked from each mobile device.

1. Google AdWords

a. Description and Scope of Data Processing

We have integrated Google AdWords on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

By using Google AdWords, we promote our website by displaying targeted advertising on third-party websites and in Google search results, as well as third-party advertising on our own website. When a user clicks on a Google AdWords ad, a conversion cookie is placed on their computer. Conversion cookies do not allow users to be identified. They are used to track pages visited on our website and to determine whether a purchase was made or abandoned. Google stores this personal data in the USA and may share it with third parties.

b. Legal Basis for Data Processing

The legal basis for processing personal data using cookies for analysis purposes is Article 6(1)(a) of the GDPR.

c. Purpose of Data Processing

Google AdWords enables the delivery of online advertising in Google search results and on the Google Display Network. We define keywords in advance, which ensures that an ad is displayed in Google search results only when a user enters a query containing a relevant keyword. On the Google Display Network, ads are displayed on thematically relevant websites through an automated algorithm that takes into account the previously defined keywords. The data collected helps us to optimise our ads.

a. Storage Duration

b. Right to Object and Rectification

Furthermore, the data subject has the option to object to interest-based advertising by Google. To do so, they must access the link www.google.de/settings/ads from each of the internet browsers they use and change the desired settings there.

For more information and the applicable Google privacy policy, please visit: https://www.google.de/intl/de/policies/privacy/.

1. Facebook Pixel

a. Description and Scope of Data Processing

We have integrated Facebook Pixels on our website. The provider is Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. For users residing in the European Union, the provider is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

This service allows visitors to our website who have already shown an interest in our website and our offers, and who are Facebook members, to also see relevant advertising and offers on Facebook. For this purpose, a conversion tracking pixel is integrated into our pages; it informs Facebook of your visit to our website and the elements of our offers that interested you.

For more information, please visit https://www.facebook.com/about/privacy/ .

b. Legal Basis for Data Processing

The legal basis for the use of the Facebook Pixel is Article 6(1)(a) of the GDPR.

c. Purpose of Data Processing

The provider enables the display of internet advertising on Facebook.

d. Storage Duration

e. Right to Object and Rectification

You can change your advertising settings with the provider. You also have the option to block the display of ads from the provider and its partners. You can find these settings at: https://www.facebook.com/ads/website_custom_audiences/ .

1. Two-Click Solution for YouTube Integration

We have integrated YouTube components on our website. YouTube is an online video portal that allows content creators to upload videos for free and users to view, rate and comment on them, also for free. YouTube allows the publication of all types of videos; therefore, complete films and television programmes, as well as music videos, trailers and user-generated videos are available on the platform.

The service on YouTube is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The website does not directly embed YouTube videos. This prevents third parties from creating user profiles.

To view our videos, users must first click on the preview image. The video will only be accessible after consent or login. Data transfer only takes place at this point.

For more information, please visit http://www.youtube.com/t/privacy_guidelines and the YouTube privacy policy at https://www.google.de/intl/de/policies/privacy/. This policy provides information on the collection, processing and use of personal data by Google.

By accessing external content from these providers, you consent, in accordance with Article 49(1)(a) of the GDPR, to the processing of your data in the USA, a country whose level of data protection has been deemed inadequate by the Court of Justice of the European Union. In particular, there is a risk that your data may be processed by US authorities for control and surveillance purposes, without any legal recourse available to you.

The legal basis is, after consent, Article 6(1)(a) of the GDPR.

V. Rights of Data Subjects

1. Right to Information

Any person whose personal data is processed may request confirmation from the controller as to whether personal data concerning them is being processed.

If such processing takes place, you may request the following information from the controller:

Purposes of the processing
Categories of personal data being processed
Recipients or categories of recipients to whom the personal data in question has been or will be disclosed
The envisaged period for which your personal data will be stored or, where this is not possible, the criteria used to determine this period
The existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the controller, or a right to object to such processing
The existence of a right to lodge a complaint with a supervisory authority
Any available information as to the origin of the data, if the personal data is not collected from the data subject
The existence of automated decision-making, including profiling, in accordance with Article 22(1) and (4) of the GDPR and – at least in those cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject

The data subject also has the right to request whether their personal data is transferred to a third country or an international organisation. In this regard, they may request to be informed of the appropriate safeguards provided for in Article 46 of the GDPR concerning such transfer.

When processing data for scientific, historical or statistical research purposes: This right to information may be restricted insofar as it is likely to render impossible or seriously impair the achievement of the research or statistical objectives, and such restriction is necessary for the achievement of those objectives.

2. Right to Rectification

Data subjects have the right to obtain from the controller the rectification and/or completion of personal data concerning them which is inaccurate or incomplete. The controller must carry out the rectification without undue delay.

When processing data for scientific, historical or statistical research purposes: Your right to rectification may be restricted insofar as it is likely to render impossible or seriously impair the achievement of the research or statistical objectives, and such restriction is necessary for the achievement of those objectives.

3. Right to Restriction of Processing

Under the following conditions, data subjects may request the restriction of processing of their personal data:

If the accuracy of the personal data in question is contested, for a period enabling the controller to verify the accuracy of the personal data
The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead
The controller no longer needs the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise or defence of legal claims, or
If the data subject has objected to processing pursuant to Article 21(1) of the GDPR and it is not yet clear whether the legitimate grounds of the controller override those of the data subject

Where the processing of personal data in question has been restricted, such data – other than its storage – may only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If the processing has been restricted in accordance with the above conditions, the data subject will be informed by the controller before the restriction is lifted.

When processing data for scientific, historical or statistical research purposes: The data subject's right to restriction of processing may be restricted insofar as it is likely to render impossible or seriously impair the achievement of the research or statistical objectives, and such restriction is necessary for the achievement of those objectives.

4. Right to Erasure

a. Obligation to Erase

The data subject may request the controller to erase personal data concerning them without undue delay, and the controller shall be obliged to erase such data without undue delay where one of the following grounds applies:

The personal data in question is no longer necessary for the purposes for which it was collected or processed;
The data subject withdraws the consent on which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing;
The data subject objects to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) of the GDPR;
The personal data has been processed unlawfully;
The erasure of the personal data in question is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject;
The personal data in question was collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.

b. Information to Third Parties

Where the controller has made the personal data in question public and is obliged pursuant to Article 17(1) of the GDPR to erase it, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copies or replications of, those personal data.

c. Exceptions

The right to erasure does not apply to the extent that the processing is necessary

For exercising the right of freedom of expression and information;
For compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
For reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) of the GDPR;
For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the GDPR insofar as the right referred to in point (a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
For the establishment, exercise or defence of legal claims

5. Right to Notification

If the data subject has exercised their right to rectification, erasure or restriction of processing with the controller, the controller is obliged to communicate this rectification, erasure or restriction of processing to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves a disproportionate effort.

The data subject has the right to be informed of these recipients by the controller.

6. Right to Data Portability

Data subjects have the right to receive the personal data concerning them, which they have provided to the controller, in a structured, commonly used and machine-readable format. Furthermore, they have the right to transmit this data to another controller without hindrance from the controller to which the personal data was provided, where:

The processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR, or on a contract pursuant to Article 6(1)(b) of the GDPR; and
The processing is carried out by automated means.

In exercising this right, data subjects also have the right to have their personal data transmitted directly from one controller to another, where technically feasible. This must not adversely affect the rights and freedoms of others.

The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to Object

Data subjects have the right to object, on grounds relating to their particular situation, at any time to the processing of personal data concerning them which is based on Article 6(1)(e) or (f) of the GDPR, including profiling based on those provisions.

The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes, data subjects have the right to object at any time to the processing of personal data concerning them for such marketing, including profiling to the extent that it is related to such direct marketing.

When processing data for scientific, historical or statistical research purposes: The data subject also has the right to object, on grounds relating to their particular situation, to the processing of personal data concerning them which is carried out for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the GDPR, unless the processing is necessary for the performance of a task carried out in the public interest.

8. Right to Withdraw Consent Under Data Protection Law

Every data subject has the right to withdraw their consent to the processing of personal data at any time.

9. Automated Decision-Making Including Profiling

Data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. This does not apply where the decision:

Is necessary for entering into or performing a contract between the data subject and a controller;
Is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights, freedoms and legitimate interests; or
Is based on the data subject's explicit consent.

In the cases referred to in points (a) and (c), the controller shall implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express their point of view and to contest the decision.

10. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged infringement, if the data subject considers that the processing of personal data concerning them infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 of the GDPR.

VI. Updates to the Privacy Policy

We reserve the right to modify this Privacy Policy to ensure that it complies with current legal requirements or to reflect changes to our services, for example when introducing new services. Your next visit will be subject to the new Privacy Policy.

Standard Free Shipping

Free shipping on orders over €150.00

Free Returns

30 days to change your mind, simple and free return process

Secure Payment

All your transactions are protected and secured

24/7 Online Customer Service

We are always available for you.