Privacy Policy

§1 Responsible party & general information

The controller within the meaning of Art. 4 para. 7 GDPR for the processing of personal data in connection with this online shop is the above-named person or company.

The protection of your personal data is a central concern for us. In the following, we inform you in detail about which personal data we process for which purposes, on which legal basis this takes place, how long the data is stored and what rights you have as a data subject.

Personal data is any information relating to an identified or identifiable natural person (Art. 4 No. 1 GDPR). This includes, for example, your name, e-mail address, postal address or usage behaviour.

§2 Access data and hosting

Each time our website is accessed, our web server automatically collects data and information from the computer system of the accessing computer. The following access data is recorded:

• IP-Adresse des anfragenden Endgeräts (ggf. anonymisiert)
• Datum und Uhrzeit des Zugriffs (Zeitstempel)
• Name and URL of the file or page accessed
• Übertragene Datenmenge
• HTTP-Statuscode (z.B. 200, 404)
• Browsertyp und -version (User-Agent)
• Verwendetes Betriebssystem
• Referrer-URL (zuvor besuchte Seite)
• Hostname des zugreifenden Rechners

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest). The processing is necessary to ensure technical functionality, system security and to defend against attacks.

Storage period: The access data is stored in server log files and automatically deleted after no more than seven (7) days, unless further retention for evidentiary purposes in the case of security incidents is required.

Hosting: Our web server is operated by a professional hosting provider with server locations in the European Union. A data processing agreement pursuant to Art. 28 GDPR has been concluded with the provider.

§3 Contract processing

3.1 Bestellungen

To process your order, we process the following personal data: name, company name, address (delivery and billing address), e-mail address, telephone number and order data (article selection, quantity, price). This processing is necessary for the performance of the purchase contract concluded between you and us.

Legal basis: Art. 6 para. 1 lit. b GDPR (performance of contract).

3.2 Kontaktaufnahme

If you contact us by e-mail, contact form or telephone, the data you provide (e.g. name, e-mail address, content of the message) will be processed and stored exclusively for the purpose of handling your enquiry.

Legal basis: Art. 6 para. 1 lit. b GDPR (pre-contractual measures or performance of contract) or Art. 6 para. 1 lit. f GDPR (legitimate interest in answering your enquiry).

Your enquiry data will be deleted as soon as the enquiry has been finally processed and no statutory retention obligations stand in the way.

3.3 Kundenkonto

You have the option to open a customer account with which you can conveniently manage your orders, invoices and delivery addresses. Setting up the account is voluntary. Master data (name, company, billing address, e-mail, telephone) and order history are stored in the customer account.

In addition, you can optionally store several alternative delivery addresses (residential addresses or parcel stations/post office branches) in your customer account in order to be able to select them more quickly for future orders. These are used exclusively for selection in the checkout and, if desired, are saved upon completion of the order. You can view, mark as default or delete individual stored delivery addresses on your own at any time in the area "My Account → Profile".

Storage location: All account and address data are stored exclusively on our own servers in Germany (EU) in a local database. No transfer to third countries takes place.

Legal basis: Art. 6 para. 1 lit. b GDPR (performance of contract — address for shipping) in conjunction with Art. 6 para. 1 lit. a GDPR (consent — storage of additional delivery addresses via the explicit checkbox "Save in customer account" in the checkout).

You can have your customer account deleted at any time. Please contact the contact address given above. After deletion of the customer account, your data, including all stored delivery addresses, will be deleted, unless there are statutory retention obligations.

§4 Shipping processing

For the delivery of the goods you have ordered, we forward your delivery address and, if applicable, your e-mail address and telephone number to the shipping service provider commissioned by us. The transfer is made exclusively for the purpose of delivering the goods.

Shipping service providers used:

• DHL (Deutsche Post DHL Group, 53250 Bonn)
• GLS (General Logistics Systems Germany GmbH & Co. OHG, 36286 Neuenstein)
• UPS (United Parcel Service Deutschland S.a r.l. & Co. OHG, 41460 Neuss)

Legal basis: Art. 6 para. 1 lit. b GDPR (performance of contract). Insofar as you have consented to the transmission of your e-mail address or telephone number for shipment tracking or delivery notification, this is additionally based on Art. 6 para. 1 lit. a GDPR.

§5 Payment processing

Depending on the payment method chosen, different data will be transmitted to the respective payment service provider for the processing of your payment.

5.1 Zahlung auf Rechnung

In the case of payment on account, your invoice data (name, company, address) are processed internally. As a rule, no transfer to third parties takes place.

Rechtsgrundlage: Art. 6 Abs. 1 lit. b DSGVO.

5.2 PayPal

In the case of payment via PayPal, your payment data are transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. On the checkout pages we embed the PayPal JavaScript SDK (www.paypal.com, www.paypalobjects.com), which on loading transmits your IP address, browser identifier and cookie data to PayPal — even if you do not actively use PayPal. This is required for fraud detection.

PayPal's privacy policy applies in addition: paypal.com/de/webapps/mpp/ua/privacy-full.

Legal basis: Art. 6 para. 1 lit. b GDPR (initiation/performance of contract); for fraud detection Art. 6 para. 1 lit. f GDPR.

5.3 Kreditkartenzahlung über Stripe

We process credit card payments via Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. On the checkout page we load js.stripe.com/v3/, which on loading transmits your IP address as well as device and browser characteristics to Stripe (even if you do not pay by card). Stripe uses this data for fraud prevention (Stripe Radar).

For a card payment, card number, expiry date and verification number are processed exclusively on Stripe servers — they never reach our systems (PCI-DSS Level 1). Transfer to the USA cannot be excluded; Stripe LLC is certified under the EU-US Data Privacy Framework, Stripe Payments Europe Ltd. uses EU standard contractual clauses.

Stripe's privacy policy: stripe.com/de/privacy.

Legal basis: Art. 6 para. 1 lit. b GDPR (performance of contract); for fraud detection Art. 6 para. 1 lit. f GDPR.

5.4 Vorkasse / Überweisung

If you pay in advance, you will receive our bank details. The processing of your bank transfer data takes place via your bank. We only receive the information that payment has been received.

Rechtsgrundlage: Art. 6 Abs. 1 lit. b DSGVO.

§6 Use of cookies and similar technologies

Our online shop uses cookies and comparable technologies (e.g. local storage). Cookies are small text files that are stored on your end device and that your browser sends back to our server on your next visit.

On your first visit you will be asked via a consent banner which cookie categories you want to allow. Non-essential cookies will only be set after your express consent. You can change your selection at any time via the link "Cookie settings" in the footer.

6.1 Technisch notwendige Cookies (immer aktiv)

These cookies are strictly necessary for the operation of the shop and, in accordance with § 25 para. 2 No. 2 TDDDG, do not require consent.

Name	Zweck	Laufzeit	Anbieter
sf_session	Sitzungs-ID für Warenkorb und Login	30 Tage	Diese Website
sf_cart_n	Warenkorb-Zähler für Header-Anzeige	30 Tage	Diese Website
sf_cookie_consent	Speichert Ihre Cookie-Einwilligung	12 Monate	Diese Website
sf_vat	Speichert Ihre Brutto/Netto-Preisanzeige	12 Monate	Diese Website

Rechtsgrundlage: § 25 Abs. 2 Nr. 2 TDDDG i.V.m. Art. 6 Abs. 1 lit. f DSGVO.

6.2 Funktionale Cookies (nur mit Einwilligung)

Cookies in this category improve the user experience (e.g. recently viewed items, language/currency preferences). They are only set if you activate this category in the consent banner.

Rechtsgrundlage: Art. 6 Abs. 1 lit. a DSGVO & § 25 Abs. 1 TDDDG (Einwilligung).

6.3 Statistik-Cookies (nur mit Einwilligung)

With your consent, we use Google Analytics 4 (provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) for statistical analysis of the use of our shop. Google Analytics sets cookies (in particular _ga, _ga_*) which allow an analysis of your use of the website. The IP address is anonymised before storage (IP anonymisation is active).

We use Google Consent Mode v2: without your consent no analysis cookies are set and no personal measurement data is transmitted to Google.

A transfer to the USA cannot be excluded. Google LLC is certified under the EU-US Data Privacy Framework; Google Ireland Ltd. uses EU standard contractual clauses (Art. 46 para. 2 lit. c GDPR) as an additional safeguard.

Legal basis: Art. 6 para. 1 lit. a GDPR & § 25 para. 1 TDDDG (consent). You can revoke your consent at any time via the cookie settings.

6.4 Marketing-Cookies (nur mit Einwilligung)

With your consent, Google Tag Manager (provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) can deliver further marketing and remarketing tags, in particular Google Ads conversion tracking and remarketing lists (cookies/domains: doubleclick.net, googleadservices.com). The Tag Manager itself does not set tracking cookies, but loads other services if consent is given.

A transfer to the USA cannot be excluded. Google LLC is certified under the EU-US Data Privacy Framework; Google Ireland Ltd. uses EU standard contractual clauses (Art. 46 para. 2 lit. c GDPR) as an additional safeguard.

Rechtsgrundlage: Art. 6 Abs. 1 lit. a DSGVO & § 25 Abs. 1 TDDDG (Einwilligung).

6.6 Adressvorschläge (Google Maps Places API)

During registration we offer an address autocomplete via Google Maps Places API (provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). As you type an address, your input is transmitted to Google to display matching suggestions. In doing so, your IP address and the characters entered are processed.

The address autocomplete is loaded only if you have consented to the "Functional cookies" category. Without consent, you can enter your address manually without any data transmission to Google taking place.

A transfer to the USA cannot be excluded. Google LLC is certified under the EU-US Data Privacy Framework; Google Ireland Ltd. uses EU standard contractual clauses (Art. 46 para. 2 lit. c GDPR).

Rechtsgrundlage: Art. 6 Abs. 1 lit. a DSGVO & § 25 Abs. 1 TDDDG (Einwilligung).

6.5 Nachweis Ihrer Entscheidung

We log your cookie decision in pseudonymised form (HMAC hash over IP + user agent) together with a timestamp and the selected categories in order to comply with the obligation of proof under Art. 7 para. 1 GDPR. The log file does not contain any directly personally identifiable data in plain text and is deleted after 24 months.

§7 Analytics & statistics

Insofar as you have given consent, we use Google Analytics 4 for statistical analysis of usage. Details, provider, cookies, transmitted data and safeguards for third-country transfers are set out under §6.3.

Independently of this, we collect aggregated statistics internally (e.g. top product views for the "Currently in demand" section), which do not allow any conclusions to be drawn about individuals and take place without consent.

Legal basis: Art. 6 para. 1 lit. a GDPR (consent) for Google Analytics; Art. 6 para. 1 lit. f GDPR (legitimate interest) for the anonymous internal statistics.

§8 Content Delivery Network (CDN)

For the fast and secure delivery of static content (e.g. images, stylesheets, fonts) we use a Content Delivery Network (CDN). When such content is accessed, your browser establishes a connection to the CDN provider's servers, in the course of which your IP address is transmitted for technical reasons.

Server location: The CDN servers we use are located in the European Union.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in the secure and efficient provision of our online offering).

A data processing agreement pursuant to Art. 28 GDPR has been concluded with the CDN provider.

§9 Security & SSL/TLS encryption

For security reasons and to protect the transmission of personal data, our online shop uses SSL or TLS encryption. You can recognise an encrypted connection by the prefix "https://" in the address bar of your browser and by the padlock symbol.

When SSL or TLS encryption is activated, the data you transmit to us (e.g. order data, login data, payment information) cannot be read by third parties.

Legal basis: Art. 6 para. 1 lit. f GDPR and Art. 32 GDPR (security of processing).

§10 Advertising by email

Newsletter with sign-up: If you sign up for our newsletter, we use your e-mail address to regularly send you information about our product range and offers. Sign-up takes place via the double opt-in procedure. You can unsubscribe from the newsletter at any time; an unsubscribe link is included in every issue.

Rechtsgrundlage: Art. 6 Abs. 1 lit. a DSGVO (Einwilligung).

Advertising to existing customers: As an existing customer, we reserve the right to send you e-mails about similar goods or services, unless you have objected to this (§ 7 para. 3 UWG). You can object to the use of your e-mail address for advertising purposes at any time without stating reasons.

Rechtsgrundlage: Art. 6 Abs. 1 lit. f DSGVO (berechtigtes Interesse).

§11 Order processing (data processors)

For the operation of our online shop, we use various service providers who process personal data on our behalf. Data processing agreements pursuant to Art. 28 GDPR have been concluded with all service providers, which ensure data protection-compliant processing.

Categories of processors:

• Hosting-Anbieter (Webserver, Datenbanken)
• Shipping service providers (DHL, GLS, UPS)
• Payment service providers (PayPal, credit card processing)
• CDN-Anbieter (Bereitstellung statischer Inhalte)

As a matter of principle, no transfer of personal data to third countries (outside the EEA) takes place. Should this be necessary in individual cases, the transfer will only take place on the basis of an adequacy decision by the EU Commission (Art. 45 GDPR) or under the agreement of EU standard contractual clauses (Art. 46 para. 2 lit. c GDPR).

§12 Storage duration

We generally store your personal data only for as long as is necessary for the respective processing purposes or as required by the statutory retention periods.

Statutory retention periods:

• 10 years – Tax retention obligation for accounting vouchers, invoices, commercial letters and contract documents pursuant to § 147 AO (German Fiscal Code) and § 257 HGB.
• 6 years – Commercial letters and other business correspondence pursuant to § 257 HGB.

After expiry of these periods, the corresponding data is routinely deleted, unless it is still needed for the performance of the contract or for the assertion, exercise or defence of legal claims.

Server log files are, as set out under §2, deleted after no more than seven days.

§13 Rights of data subjects

As a data subject you have the following rights vis-à-vis the controller:

Recht auf Auskunft (Art. 15 DSGVO)

You have the right to request confirmation as to whether personal data concerning you is being processed. If this is the case, you have the right to information about this data and to further information in accordance with Art. 15 para. 1 GDPR (processing purposes, categories, recipients, storage period, etc.).

Recht auf Berichtigung (Art. 16 DSGVO)

You have the right to request the immediate rectification of inaccurate personal data. Taking into account the purposes of the processing, you also have the right to request the completion of incomplete data.

Recht auf Löschung (Art. 17 DSGVO)

You have the right to request the immediate deletion of your personal data, provided that one of the reasons stated in Art. 17 para. 1 GDPR applies (e.g. data no longer necessary for the original purpose, withdrawal of consent, unlawful processing). The right to deletion does not exist insofar as the processing is necessary to fulfil statutory retention obligations.

Recht auf Einschränkung der Verarbeitung (Art. 18 DSGVO)

You have the right to request the restriction of processing if one of the conditions set out in Art. 18 para. 1 GDPR is met (e.g. contestation of accuracy, unlawful processing combined with refusal of deletion, objection under Art. 21 GDPR).

Recht auf Datenübertragbarkeit (Art. 20 DSGVO)

You have the right to receive the personal data concerning you which you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance, provided that the processing is based on consent or on a contract and is carried out by automated means.

Widerspruchsrecht (Art. 21 DSGVO)

You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6 para. 1 lit. f GDPR (legitimate interest). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests.

Objection to direct marketing: Insofar as we use your data for direct marketing, you can object at any time without stating reasons. We will then immediately cease to use your data for advertising purposes.

Recht auf Widerruf erteilter Einwilligungen (Art. 7 Abs. 3 DSGVO)

Insofar as the processing is based on your consent, you have the right to withdraw this consent at any time with effect for the future. The lawfulness of the processing carried out on the basis of the consent up to the withdrawal remains unaffected.

§14 Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data violates the GDPR (Art. 77 GDPR).

Competent supervisory authority:

The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Str. 22, 7th floor
20459 Hamburg
Telephone: 040 / 428 54 - 4040
E-mail: mailbox@datenschutz.hamburg.de
Web: https://datenschutz-hamburg.de

Alternatively, you can also contact the supervisory authority at your usual place of residence or workplace.

§15 No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 para. 1 and 4 GDPR. This means that no decision producing legal effects concerning you or similarly significantly affecting you is based solely on automated processing.

§16 Changes to this Privacy Policy

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or in order to implement changes to our services in the privacy policy. The new privacy policy will then apply on your next visit. We recommend that you visit this page regularly to inform yourself of the current status.

Last updated: 01.05.2026