Privacy policy

Privacy Policy

Note: This English translation is provided for convenience only. In case of discrepancies, the original German version shall prevail.

1. Introduction and contact details of the controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below we inform you about how we handle your personal data when you use our website. Personal data means any information relating to an identified or identifiable natural person.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Our Sake Company GmbH, Reichenberger Straße 36, 10999 Berlin, Germany, Tel.: +493099284357, Email: info@oursake.club. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2. Data collection when visiting our website

2.1 When you use our website purely for information purposes, i.e. if you do not register or otherwise transmit information to us, we only collect the data that your browser transmits to the server of our pages (so-called “server log files”). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

• The website visited
• Date and time at the moment of access
• Amount of data sent in bytes
• Source/referrer from which you came to the page
• Browser used
• Operating system used
• IP address used (where applicable in anonymised form)

Processing takes place pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be disclosed or otherwise used. However, we reserve the right to subsequently check the server log files if there are concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string “https://” and the lock symbol in your browser bar.

3. Hosting & content delivery network

3.1 Shopify

We use the system of the following provider for hosting our website and displaying page content: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”)

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada

All data collected on our website is processed on the provider’s servers. We have concluded a data processing agreement with the provider, which ensures the protection of our site visitors’ data and prohibits unauthorised disclosure to third parties.

For data transfers to Canada, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

3.2 Shopify (Content Delivery Network)

We use a content delivery network (CDN) from the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”)

Data may also be transferred to:

• Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada
• Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA

This service enables us to deliver large media files such as graphics, page content or scripts more quickly via a network of regionally distributed servers. Processing is carried out to safeguard our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6(1)(f) GDPR. We have concluded a data processing agreement with the provider, which ensures the protection of our site visitors’ data and prohibits unauthorised disclosure to third parties.

For data transfers to Canada, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

For data transfers to the USA, the data recipient participates in the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

4. Cookies

To make your visit to our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files stored on your device. Some cookies are deleted automatically after closing the browser (so-called “session cookies”), while others remain on your device for a longer period and allow site settings to be saved (so-called“persistent cookies”). In the latter case, you can find the storage duration in your web browser’s cookie settings.

Where personal data is also processed by individual cookies we use, processing is carried out pursuant to Art. 6(1)(b) GDPR either for the performance of a contract, pursuant to Art. 6(1)(a) GDPR in the case of consent, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the site visit.

You can set your browser to inform you about the setting of cookies and decide individually on their acceptance or exclude the acceptance of cookies for certain cases or in general.

Please note that if you do not accept cookies, the functionality of our website may be limited.

5. Contact

5.1 Shopify Inbox

This website uses the live chat system of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

Personal data transmitted via the chat is processed either pursuant to Art. 6(1)(b) GDPR because it is necessary for contract initiation or performance, or pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the effective support of our site visitors. Your data transmitted in this way will be deleted, subject to statutory retention periods, once the matter concerned has been conclusively clarified.

In addition, for the purpose of creating pseudonymised usage profiles, further information may be collected and evaluated using cookies, which does not serve to identify you personally and is not merged with other data sets. Insofar as this information relates to individuals, processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the statistical analysis of user behaviour for optimisation purposes.

The setting of cookies can be prevented by the appropriate browser settings. Functionality of our website may be restricted in this case. You may object to the collection and storage of data for the purpose of creating a pseudonymised usage profile at any time with effect for the future.

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada

We have concluded a data processing agreement with the provider, which ensures the protection of our site visitors’ data and prohibits unauthorised disclosure to third parties.

For data transfers to Canada, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

5.2 Trusted Shops

For review reminders, we use the services of: Trusted Shops AG, Subbelrather Str. 15c, 50823 Cologne, Germany

Exclusively on the basis of your express consent pursuant to Art. 6(1)(a) GDPR, we transmit your email address and, where applicable, further customer data to the provider so that they can contact you by email with a review reminder.

You may withdraw your consent at any time with effect for the future, either to us or to the provider.

We are jointly responsible with the provider for the processing described above pursuant to Art. 26 GDPR. The joint controller agreement can be viewed here:
https://help.etrusted.com/hc/de/articles/4402587369105-Vertrag-%C3%BCber-die-gemeinsame-Verantwortlichkeit-nach-DSGVO

5.3 When contacting us (e.g. via contact form or email), personal data is processed solely for the purpose of handling and responding to your enquiry and only to the extent necessary forthat purpose.

The legal basis for processing these data is our legitimate interest in responding to your enquiry pursuant to Art. 6(1)(f) GDPR. If your contact aims at concluding a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted when it can be inferred from the circumstances that the matter in question has been conclusively clarified and provided there are no legal retention obligations to the contrary.

6. Data processing when opening a customer account

Pursuant to Art. 6(1)(b) GDPR, personal data will continue to be collected and processed to the extent necessary if you provide it to us when opening a customer account. The data required for opening the account can be seen from the input mask of the corresponding form on our website.

You can delete your customer account at any time by sending a message to the above address of the controller. After deletion of your customer account, your data will be deleted provided that all contracts concluded via it have been fully processed, there are no legal retention periods to the contrary, and we have no legitimate interest in continued storage.

7. Use of customer data for direct marketing

7.1 Subscription to our email newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information for sending the newsletter is your email address. Providing additional data is voluntary and is used to address you personally. We use the so-called doubleopt-in procedure to ensure that you only receive the newsletter once you have expressly confirmed your consent to receive newsletters by clicking on a verification link sent to the email address provided.

By activating the confirmation link, you give us your consent to use your personal data pursuant to Art. 6(1)(a) GDPR. We store the IP address entered by your internet service provider (ISP) as well as the date and time of registration in order to trace possible misuse of your email address at a later date. The data collected by us when registering for the newsletter is used strictly for the intended purpose.

You can unsubscribe at any time via the link provided in the newsletter or by sending a corresponding message to the controller named at the beginning. After successful unsubscription, your email address will be immediately deleted from our newsletter distribution list unless you have expressly consented to further use of your data or we reserve the right to use data beyond this which is permitted by law and about which we inform you in this policy.

7.2 Sending email newsletters to existing customers

If you have provided us with your email address when purchasing goods or services, we reserve the right to regularly send you offers by email for similar goods or services from our range to those already purchased. For this, we do not need to obtain separate consent from you pursuant to § 7(3) UWG (German Act Against Unfair Competition). Data processing is carried out solely on the basis of our legitimate interest in personalised direct advertising pursuant to Art. 6(1)(f) GDPR. If you initially objected to the use of your email address for this purpose, no emails will be sent by us.

You are entitled to object at any time to the use of your email address for the above advertising purpose with effect for the future by notifying the controller named at the beginning. You will only incur transmission costs according to the basic rates. Upon receipt of your objection, the use ofyour email address for advertising purposes will be stopped immediately.

7.3 Klaviyo

Our email newsletters are sent via: Klaviyo, Inc., 125 Summer St., Ste 600, Boston, MA 02110, USA

Based on our legitimate interest in effective and user-friendly newsletter marketing, we pass on the data you provide when registering for the newsletter to this provider in accordance with Art. 6(1)(f) GDPR so that they can send the newsletters on our behalf. Subject to your express consent pursuant to Art. 6(1)(a) GDPR, the provider also performs statistical success analysis of newsletter campaigns using web beacons or tracking pixels in the emails sent, which can measure open rates and specific interactions with newsletter content. Device information (e.g. time of access, IP address, browser type and operating system) is also collected and evaluated, but not merged with other data sets.

You can withdraw your consent to newsletter tracking at any time with effect for the future.

We have concluded a data processing agreement with the provider that protects our site visitors’ data and prohibits disclosure to third parties.

For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

7.4 Back-in-stock email notifications

For temporarily unavailable items, you can sign up to receive back-in-stock email notifications. We will then send you a one-off email about the availability of the item you selected. The only mandatory information for sending this notification is your email address. Providing additional data is voluntary and may be used to address you personally. We use the double opt-in procedure to ensure that you only receive a notification once you have expressly confirmed your consent by clicking a verification link sent to the specified email address.

By activating the confirmation link, you consent to the use of your personal data pursuant to Art. 6(1)(a) GDPR. We store the IP address entered by your ISP as well as the date and time of registration to trace possible misuse of your email address at a later date. The data collected when you register for our back-in-stock email notification service is used strictly for the intended purpose.

You can unsubscribe at any time by sending a message to the controller named at the beginning. After successful unsubscription, your email address will be immediately deleted from our distribution list for this purpose, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this which is permitted by law and about which we inform you in this policy.

7.5 Cart reminder emails

If you abandon your purchase with us before completing the order, you have the option of receiving a one-off reminder of the contents of your virtual shopping cart by email.

The only mandatory information for sending this reminder is your email address. Providing additional data is voluntary and may be used to address you personally. We use the double opt-in procedure to ensure that you only receive a notification once you have expressly confirmed your consent by clicking a verification link sent to the specified email address.

By activating the confirmation link, you consent to the use of your personal data pursuant to Art. 6(1)(a) GDPR for the sending of a cart reminder. We store the IP address entered by your ISP as well as the date and time of registration to trace possible misuse of your email address at a later date. The data collected is used strictly for the intended purpose.You can unsubscribe at any time by sending a message to the controller named at the beginning. After successful unsubscription, your email address will be immediately deleted from our distribution list for this purpose unless you have expressly consented to further use of your data or we reserve the right to use data beyond this which is permitted by law and about which we inform you in this policy.

7.6 Advertising by postal mail

On the basis of our legitimate interest in personalised direct advertising, we reserve the right to store your first and last name, your postal address and—if we have received this additional information from you in the context of the contractual relationship—your title, academic degree, year of birth and your professional, industry or business designation pursuant to Art. 6(1)(f) GDPR and to use them for sending interesting offers and information about our products by post. You can object to the storage and use of your data for this purpose at any time.

8. Data processing for order handling

8.1 Insofar as this is necessary for contract processing for delivery and payment purposes, the personal data we collect will be passed on to the transport company and the credit institution commissioned pursuant to Art. 6(1)(b) GDPR.

If, on the basis of a corresponding contract, we owe you updates for goods with digital elements or for digital products, we process the contact data you provided when placing the order to inform you personally within the scope of our legal information obligations pursuant to Art. 6(1)(c) GDPR. Your contact data will be used strictly for the purpose of communications about updates owed by us and will only be processed by us to the extent necessary for the respective information.

For the processing of your order, we also work with the following service provider(s) who support us in whole or in part in the execution of concluded contracts. Certain personal data is transmitted to these service providers as set out below.

8.2 Transfer of personal data to shipping service providers

- Deutsche Post

Transport service provider: Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany

We will transmit your email address and/or telephone number to the provider prior to delivery of the goods for the purpose of coordinating a delivery date and/or delivery notification pursuant to Art. 6(1)(a) GDPR, provided you have expressly consented to this during the ordering process.

Otherwise, we will only pass on the name of the recipient and the delivery address to the provider for the purpose of delivery pursuant to Art. 6(1)(b) GDPR. The data will only be passed on to the extent necessary for delivery of the goods. In this case, prior coordination of the delivery date and/or delivery notification is not possible.

Consent can be withdrawn at any time with effect for the future to the controller named above or to the provider.
- DHL

Transport service provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany

[Same conditions as above apply.]

• DHL Express

Transport service provider: DHL Express Germany GmbH, Heinrich-Brüning-Str. 5, 53113, Bonn, Germany

[Same conditions as above apply.]

• DHL Express Austria

Transport service provider: DHL Express (Austria) GmbH, Am Europlatz 2 (Objekt G), 1120, Vienna, Austria

[Same conditions as above apply.]

• DHL Freight

Transport service provider: DHL Freight GmbH, Godesberger Allee 102-104, 53175 Bonn, Germany

[Same conditions as above apply.]

8.3 Use of payment service providers

- Apple Pay

If you choose the payment method “Apple Pay” of Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment processing is carried out via the “Apple Pay” function of your device running iOS, watchOS or macOS by charging a payment card stored with “Apple Pay”. Apple Pay uses security features integrated into your device’s hardware and software to protect your transactions. To authorise a payment, you must enter a code previously set by you and verify via the “Face ID” or “Touch ID” function of your device.

For the purpose of processing the payment, the information you provide during the ordering process along with information about your order will be transmitted to Apple in encrypted form. Apple then re-encrypts this data with a developer-specific key before the data is transmitted to the payment service provider of the payment card stored in Apple Pay to execute the payment. The encryption ensures that only the website through which the purchase was made can access the payment data. After the payment is made, Apple sends your device account number as well as a transaction-specific, dynamic security code to the originating website to confirm the success of the payment.

Where personal data is processed in the course of the transmissions described, processing is carried out exclusively for the purpose of payment processing pursuant to Art. 6(1)(b) GDPR.

Apple stores anonymised transaction data, including the approximate purchase amount, the approximate date and time and an indication of whether the transaction was successfully completed. Due to anonymisation, a personal reference is completely excluded. Apple uses the anonymised data to improve “Apple Pay” and other Apple products and services.

If you use Apple Pay on the iPhone or Apple Watch to complete a purchase you made via Safari on the Mac, the Mac and the authorising device communicate over an encrypted channel via Apple’s servers. Apple does not process or store any of this information in a format that can identify you. You can disable the ability to use Apple Pay on your Mac in your iPhone settings under “Wallet & Apple Pay” by deactivating “Allow Payments on Mac”.

Further privacy information on Apple Pay: https://support.apple.com/de-de/HT203027
- bancontact

Available via: Bancontact Payconiq Company, Rue d'Arlon 82, 1040 Brussels, Belgium

[Processing of payment data pursuant to Art. 6(1)(b) GDPR, to the extent necessary for payment processing.]

• EPS transfer

[As above.]

Available via: PSA Payment Services Austria GmbH, Handelskai 92, Gate 2, 1200 Vienna, Austria

• Google Pay

Provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

(“Google”)

[Tokenised processing, legal basis Art. 6(1)(b) GDPR; Google’s further processing on the basis of Art. 6(1)(f) GDPR for accounting/verification/service optimisation. Links as provided in the German text.]

• iDEAL

[As above.]

Provider: Currence Holding BV, Beethovenstraat 300, Amsterdam, Netherlands

• PayPal

Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

[Forwarding of payment data pursuant to Art. 6(1)(b) GDPR; credit check where applicable pursuant to Art. 6(1)(f) GDPR; information on score values as described.]

• PayPal Checkout

This website uses PayPal Checkout (combining PayPal methods and local third-party methods).[Processing with PayPal and, where applicable, Ratepay GmbH; customer matching; legal bases as detailed in the German text, including links.]

• Shopify Payments

Provider: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

[Forwarding of payment data pursuant to Art. 6(1)(b) GDPR.]

• Stripe

Provider: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland

[Forwarding/payment processing pursuant to Art. 6(1)(b) GDPR; credit check under Art. 6(1)(f) GDPR; objection rights as described.]

9. Web analytics services

9.1 Google Analytics 4

This website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), which enables analysis of your use of our website.

By default, cookies are set by Google Analytics 4 when visiting the website. Your IP address is truncated by Google to exclude direct identifiability. Information is transferred to Google servers; transfers to Google LLC in the USA are possible. Google processes the data on our behalf to evaluate usage, compile reports and provide other services related to website and internet use. The truncated IP address transmitted by your browser will not be merged with other Google data. Data collected via Google Analytics 4 is stored for two months and then deleted.

All processing described above, in particular the setting of cookies on the device, takes place only if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. Without your consent, Google Analytics 4 will not be used during your visit. You can withdraw your consent at any time with effect for the future via the cookie consent tool on the website.

We have concluded a data processing agreement with Google. Further legal information and links are identical to those in the German text. Demographics, Google Signals, UserIDs, and “Collection of user-provided data” are used as described in the German text, with the same legal bases and links. For transfers to the USA, Google participates in the EU-US Data Privacy Framework.

9.2 Shopify Analytics

Provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road,Dublin 4, D04 XN32, Ireland Data may also be transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada Using cookies and/or comparable technologies, the service collects and stores pseudonymised visitor data for statistical analysis and pseudonymised usage profiles (including heatmaps and interaction data). No merging with clear-text personal data occurs. Processing only with consent pursuant to Art. 6(1)(a) GDPR via the cookie consent tool. We have a data processing agreement with Shopify. Transfers to Canada are covered by the EU adequacy decision.

10. Retargeting/remarketing and conversion tracking

10.1 Meta Pixel with Advanced Matching

Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Meta”)

We use Meta Pixel with advanced matching for more effective ads on Facebook/Instagram and for conversion measurement. Data may be transferred to Meta Platforms Inc. in the USA. All processing (in particular cookies) only with your consent pursuant to Art. 6(1)(a) GDPR via the cookie consent tool. We have a data processing agreement with Meta. Meta participates in the EU-US Data Privacy Framework.

10.2 Google Ads Remarketing

Provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland Cookie-based interest advertising; possible linkage with your Google account if you have consented to such linkage. Transfers to Google LLC in the USA may occur. Use only with your consent via the cookie consent tool. Google participates in the EU-US Data Privacy Framework. Further policy links as in the German text.

10.3 Google Ads Conversion Tracking

Provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

We use Google Ads and conversion tracking to measure campaign success. Cookies are typically valid for 30 days and do not personally identify users. Transfers to Google LLC in the USA may occur. Use only with your consent via the cookie consent tool. You can also object permanently via Google’s browser plug-in (link as in the German text). Customer match features only with your express consent pursuant to Art. 6(1)(a) GDPR. Further links as in the German text. Google participates in the EU-US Data Privacy Framework.

10.4 Google Marketing Platform (GMP)

Provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland GMP uses cookies to serve relevant ads, improve campaign reports and avoid duplicate displays. Your browser establishes a direct connection to Google. Transfers to Google LLC in the USA may occur. Use only with your consent via the cookie consent tool. Google participates in the EU-US Data Privacy Framework. Privacy links as in the German text.

11. Site functionalities

11.1 Vimeo

Provider: Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA

When you access a page with such a plugin, your browser connects directly to the provider to load the plugin and certain information including your IP address is transmitted. Cookies may be set for analytics and abuse prevention. If logged into an account, clicks may be attributed to your account. All such processing (especially cookies) only with your consent via the cookie consent tool. The provider participates in the EU-US Data Privacy Framework.

11.2 YouTube

Provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland; data may also be transferred to Google LLC, USA.

When the video playback starts, a connection to Google’s servers is established and cookies may be set. If logged in, interactions may be attributed to your account. Processing (especially cookies) only with your consent via the cookie consent tool. Google participates in the EU-US Data Privacy Framework.

11.3 Google Maps

Provider: Google Maps (API) by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

On subpages with embedded maps, information including your IP address is transmitted to Google; transfers to Google LLC in the USA may occur. If logged in, attribution to your account is possible. Processing pursuant to Art. 6(1)(f) GDPR (Google’s legitimate interests). You have a right to object; you can also disable JavaScript to prevent the service. Where legally required, we obtain your consent pursuant to Art. 6(1)(a) GDPR via the cookie consent tool. Google participates in the EU-US Data Privacy Framework. Further privacy links as in the German text.

11.4 Google Web Fonts

Provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland; data may also be transferred to Google LLC, USA.

Your browser connects to Google to load fonts; certain browser information including your IP address is transmitted. Processing only with your consent via the cookie consent tool. If your browser does not support web fonts, a standard font will be used. Google participates in the EU-US Data Privacy Framework. Further privacy links as in the German text.

11.5 hCaptcha

Provider: Intuition Machines, Inc., 350 Alabama St, San Francisco, CA 94110, USA

The service checks whether an entry is made by a natural person or by automated processing and blocks spam, DDoS attacks and similar automated access. The provider collects the IP address, browser/OS identifiers, date and duration of visit and transmits them to its servers.Legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR. We have a data processing agreement with the provider. For transfers to the USA, the provider relies on the EU Standard Contractual Clauses.

12. Tools and other services

12.1 DATEV

We use the cloud-based accounting software service of: DATEV eG, Paumgartnerstr. 6-14, 90429 Nuremberg, Germany

The provider processes incoming and outgoing invoices and, if applicable, our company’s bank transactions to automatically capture invoices, match them to transactions and create financial accounting in a partially automated process. Where personal data is processed, this is based on our legitimate interest in efficient organisation and documentation of our business processes pursuant to Art. 6(1)(f) GDPR.

12.2 Cookie-consent tool

We use a cookie-consent tool to obtain valid user consent for cookies and cookie-based applications. The tool is displayed as an interactive interface on page load and allows users to grant consent via checkboxes. Consent-requiring cookies/services are only loaded if corresponding consent is given. The tool sets technically necessary cookies to store your preferences. Personal data is generally not processed. If, in individual cases, personal data (such as IP address) is processed for storage, assignment or logging of settings, this is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR. Another legal basis is Art. 6(1)(c) GDPR (legal obligation to make non-essential cookies dependent on consent). Where required, we have concluded a data processing agreement with the provider. Further information is available directly in the tool’s interface on our website.

13. Data subject rights

13.1 Under applicable data protection law, you have the following rights vis-à-vis the controller with regard to the processing of your personal data (for the respective conditions, please refer to the cited legal basis):

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to notification (Art. 19 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent given (Art. 7(3) GDPR)
• Right to lodge a complaint (Art. 77 GDPR)

13.2 Right to object

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTERESTS FOLLOWING A BALANCING OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO SUCH PROCESSING WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING IS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING. YOU MAY EXERCISE THE RIGHT TO OBJECT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

14. Duration of storage of personal data

The duration of the storage of personal data is determined by the relevant legal basis, the processing purpose and—where applicable—by statutory retention periods (e.g. commercial and tax law retention periods).

When processing personal data on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the data will be stored until you withdraw your consent.

If statutory retention periods exist for data processed within the scope of legal or quasi-legal obligations pursuant to Art. 6(1)(b) GDPR, such data will be routinely deleted after expiry of the retention periods, insofar as they are no longer necessary for contract performance or contract initiation and/or we have no legitimate interest in further storage.

When processing personal data pursuant to Art. 6(1)(f) GDPR, such data will be stored until you exercise your right to object under Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

When processing personal data for direct marketing purposes pursuant to Art. 6(1)(f) GDPR, such data will be stored until you exercise your right to object under Art. 21(2) GDPR.

Unless otherwise stated in the other information in this policy about specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.