Thank you for your interest in our online shop. Protecting your privacy is very important to us. Below, we provide detailed information on how we handle your data.

You can visit our website without providing any personal details. Each time you access a page, the web server automatically stores a so-called server log file, which contains, for example, the name of the file requested, your IP address, the date and time of access, the amount of data transferred and the requesting provider (access data), and documents the access.

This access data is analysed solely for the purpose of ensuring the smooth operation of the website and improving our service. In accordance with Article 6(1)(f) of the GDPR, this serves to safeguard our legitimate interests – which, following a balancing of interests, take precedence – in the correct presentation of our service. All access data is deleted no later than seven days after the end of your visit to the site.

Hosting services provided by a third-party provider
As part of processing carried out on our behalf, a third-party provider provides us with services for hosting and displaying the website. This serves to safeguard our legitimate interests, which, following a balancing of interests, take precedence, in ensuring the correct presentation of our website. All data collected whilst using this website or via the forms provided for this purpose in the online shop, as described below, is processed on their servers. Processing on other servers takes place only within the scope explained here.

This service provider is based in a country within the European Union or the European Economic Area.

We collect personal data when you voluntarily provide it to us as part of your order, when contacting us (e.g. via the contact form or by email) or when opening a customer account. Mandatory fields are marked as such, as in these cases we require the data to fulfil the contract, to process your enquiry or to open a customer account; without providing this information, you will not be able to complete your order and/or open an account, or submit your enquiry. The data collected is specified in the relevant input forms. We use the data you provide in accordance with Article 6(1)(b) of the GDPR for the performance of the contract and to process your enquiries. Once the contract has been fully processed or your customer account has been deleted, your data will be restricted from further processing and deleted once the retention periods under tax and commercial law have expired, unless you have expressly consented to the continued use of your data or we reserve the right to use your data beyond this, which is permitted by law and about which we inform you in this policy. You may delete your customer account at any time, either by sending a message via the contact details provided below or by using the function provided for this purpose within your customer account.

To fulfil the contract in accordance with Article 6(1)(b) of the GDPR, we pass on your data to the delivery company commissioned to carry out the delivery, insofar as this is necessary for the delivery of the goods ordered. Depending on which payment service provider you select during the ordering process, we will pass on the payment details collected for this purpose to the bank responsible for processing the payment and, where applicable, to payment service providers commissioned by us or to the selected payment service, for the purpose of processing payments. In some cases, the selected payment service providers also collect this data themselves, provided you create an account with them. In this case, you must log in to the payment service provider using your login details during the ordering process. In this respect, the privacy policy of the respective payment service provider applies.

Email marketing upon subscription to the newsletter
If you subscribe to our newsletter, we will use the data required for this purpose or provided separately by you to send you our email newsletter on a regular basis, based on your consent in accordance with Article 6(1)(a) of the GDPR.

You may unsubscribe from the newsletter at any time, either by sending a message via the contact details provided below or by clicking on the link provided for this purpose in the newsletter. Once you have unsubscribed, we will delete your email address, unless you have expressly consented to the further use of your data or we reserve the right to use your data for other purposes that are permitted by law and about which we inform you in this policy.

The newsletter is sent as part of data processing carried out on our behalf by a service provider to whom we pass on your email address for this purpose.

This service provider is based in a country within the European Union or the European Economic Area.

Identity and credit checks when selecting Heidelpay payment methods
If you choose one of the payment options offered by our partner Heidelpay GmbH, you will be asked during the ordering process to consent to the transfer of the data required for payment processing and for an identity and credit check to Heidelpay, in accordance with Article 6(1)(a) of the GDPR. If you give your consent, your data (first name and surname, street, house number, postcode, town, date of birth, telephone number and, in the case of purchase by direct debit, the specified bank account details) as well as the data relating to your order will be transmitted to Heidelpay.
For the purpose of conducting its own identity and creditworthiness checks, Heidelpay or partner companies commissioned by Heidelpay transmit data to credit reference agencies and receive information from them, including, where applicable, creditworthiness information based on mathematical and statistical methods, the calculation of which incorporates, amongst other things, address data. Detailed information on this and on the credit reference agencies used can be found in the data protection policy of Heidelpay GmbH. Heidelpay GmbH uses the information received regarding the statistical probability of a payment default to make a balanced decision on whether to establish, fulfil or terminate the contractual relationship.
Furthermore, Heidelpay may use third-party tools to detect and prevent fraud. Data obtained using these tools may be stored in encrypted form by third parties, so that it is only readable by Heidelpay. This data is only used if you select a payment method offered by our partner Heidelpay; otherwise, the data expires automatically after 30 minutes.
You may withdraw your consent from Heidelpay at any time. However, Heidelpay may still be entitled to process, use and transfer your personal data where this is necessary for the contractual processing of payments, required by law, or ordered by a court or public authority.

To make your visit to our website more engaging and to enable the use of certain functions, to display relevant products or for market research purposes, we use so-called cookies on various pages. This serves to safeguard our legitimate interests, which prevail following a balancing of interests, in optimising the presentation of our offering in accordance with Article 6(1)( 1(f) of the GDPR. Cookies are small text files that are automatically stored on your device. Some of the cookies we use are deleted at the end of the browser session, i.e. once you close your browser (so-called session cookies). Other cookies remain on your device and enable us to recognise your browser the next time you visit (persistent cookies). You can find the storage duration in the overview within your web browser’s cookie settings. You can configure your browser so that you are notified when cookies are set and can decide on a case-by-case basis whether to accept them, or you can block the acceptance of cookies in specific cases or generally. Each browser manages its cookie settings differently. This is described in each browser’s help menu, which explains how you can change your cookie settings. You can find these for the respective browsers via the following links:
Internet Explorer™: http://windows.microsoft.com/de-DE/windows-vista/Block-or-allow-cookies
Safari™: https://support.apple.com/kb/ph21411?locale=de_DE
Chrome™: http://support.google.com/chrome/bin/answer.py?hl=de&hlrm=en&answer=95647
Firefox™ https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Opera™ : http://help.opera.com/Windows/10.20/de/cookies.html

If you do not accept cookies, the functionality of our website may be limited.

Use of Google (Universal) Analytics for web analytics
This website uses Google (Universal) Analytics, a web analytics service provided by Google LLC (www.google.de), for website analysis. This serves to safeguard our legitimate interests, which prevail following a balancing of interests, in optimising the presentation of our website in accordance with Article 6(1)(f) of the GDPR. Google (Universal) Analytics uses methods that enable an analysis of your use of the website, such as cookies. The information collected automatically about your use of this website is generally transmitted to a Google server in the USA and stored there. By activating IP anonymisation on this website, the IP address is truncated within the Member States of the European Union or in other contracting states to the Agreement on the European Economic Area prior to transmission. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. The anonymised IP address transmitted by your browser as part of Google Analytics is generally not merged with other data held by Google. Once the purpose has ceased to apply and we have stopped using Google Analytics, the data collected in this context will be deleted.

Google LLC is headquartered in the USA and is certified under the EU-US Privacy Shield. A current certificate can be viewed here. Under this agreement between the US and the European Commission, the latter has determined that companies certified under the Privacy Shield offer an adequate level of data protection.

You can prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address), as well as from processing this data, by downloading and installing the browser plug-in available via the following link: http://tools.google.com/dlpage/gaoptout?hl=de

As an alternative to the browser plug-in, you can click this link to prevent Google Analytics from collecting data on this website in future. This will place an opt-out cookie on your device. If you delete your cookies, you will need to click the link again.

Google AdWords Remarketing
We use Google AdWords to advertise this website in Google search results and on third-party websites. To this end, when you visit our website, Google sets a so-called remarketing cookie, which automatically enables interest-based advertising using a pseudonymous cookie ID and based on the pages you have visited. This serves to safeguard our legitimate interests, which prevail following a balancing of interests, in the optimal marketing of our website in accordance with Article 6(1)(f) of the GDPR. Once the purpose has ceased to apply and we have stopped using Google AdWords Remarketing, the data collected in this context will be deleted.

Any further data processing will only take place if you have consented to Google linking your web and app browsing history to your Google Account and using information from your Google Account to personalise the adverts you see on the web. In this case, if you are logged into Google whilst visiting our website, Google will use your data in conjunction with Google Analytics data to create and define audience lists for cross-device remarketing. To this end, your personal data will be temporarily linked by Google with Google Analytics data in order to form audiences.

Google AdWords Remarketing is a service provided by Google LLC (www.google.de). Google LLC is headquartered in the USA and is certified under the EU-US Privacy Shield. A current certificate can be viewed here. Under this agreement between the US and the European Commission, the latter has determined that companies certified under the Privacy Shield offer an adequate level of data protection.

You can disable the remarketing cookie via this link. You can also find out more about the use of cookies and adjust your settings via the Digital Advertising Alliance.

Use of Facebook social plugins
Our website uses so-called social plugins (“plugins”) from social networks.
When you visit a page on our website that contains such a plugin, your browser establishes a direct connection to the servers of Facebook, Google, Twitter or Instagram. The content of the plugin is transmitted directly from the respective provider to your browser and integrated into the page. By embedding the plugins, the providers receive information that your browser has accessed the relevant page on our website, even if you do not have a profile or are not currently logged in. This information (including your IP address) is transmitted directly from your browser to a server belonging to the respective provider (possibly in the USA) and stored there. If you are logged in to one of these services, the providers can directly link your visit to our website to your profile on the relevant social network. If you interact with the plugins – for example, by clicking the ‘Like’ or ‘Share’ button – the relevant information is also transmitted directly to a server operated by the providers and stored there. The information is also published on the social network and displayed there to your contacts. This serves to safeguard our legitimate interests, which prevail following a balancing of interests, in the optimal marketing of our services in accordance with Article 6(1)(f) of the GDPR.
For details of the purpose and scope of data collection, as well as the further processing and use of the data by the providers, contact details, your rights in this regard and settings options to protect your privacy, please refer to the providers’ privacy policies.
http://www.facebook.com/policy.php

If you do not wish the social networks to directly link the data collected via our website to your profile on the respective service, you must log out of the relevant service before visiting our website. You can also completely prevent the plugins from loading by using add-ons for your browser, e.g. the script blocker ‘NoScript’ (http://noscript.net/).

YouTube video plugins
Content from third-party providers is embedded on this website. This content is provided by Google LLC (‘the provider’).
YouTube is operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).

For YouTube videos embedded on our site, the enhanced privacy settings are enabled. This means that no information about website visitors is collected or stored by YouTube unless they play the video. The embedding of the videos serves to safeguard our legitimate interests, which prevail following a balancing of interests, in the optimal marketing of our services in accordance with Article 6(1)(f) of the GDPR.
For details of the purpose and scope of data collection, as well as the further processing and use of the data by the providers, and your rights in this regard and the options available to protect your privacy, please refer to Google’s privacy policy http://www.google.com/intl/de/+/policy/+1button.html.

Provided that you have given us your explicit consent in accordance with Article 6(1)(a) of the GDPR during or after placing your order, we will use your email address to send you a reminder to submit a review of your order via the review system we use.
This consent may be withdrawn at any time by sending a message via the contact details provided below.

As a data subject, you have the following rights:

• pursuant to Article 15 of the GDPR, the right to request information, to the extent specified therein, about your personal data processed by us;
• pursuant to Article 16 of the GDPR, the right to request, without delay, the rectification of inaccurate personal data or the completion of your personal data stored by us;
• pursuant to Article 17 of the GDPR, the right to request the erasure of your personal data stored by us, unless further processing is
  - necessary for the exercise of the right to freedom of expression and information;
  - necessary for compliance with a legal obligation;
  - for reasons of public interest; or
  - for the establishment, exercise or defence of legal claims
  ;
• in accordance with Article 18 of the GDPR, the right to request the restriction of the processing of your personal data, provided that
  - you contest the accuracy of the data;
  - the processing is unlawful, but you object to its erasure;
  - we no longer require the data, but you require it for the establishment, exercise or defence of legal claims; or
  - you have objected to the processing pursuant to Article 21 of the GDPR;
• in accordance with Article 20 of the GDPR, the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to request that it be transmitted to another controller;
• the right, under Article 77 of the GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority for your usual place of residence or work, or for the location of our registered office.

If you have any questions regarding the collection, processing or use of your personal data, or if you wish to request information, rectification, restriction or erasure of data, or to withdraw your consent or object to a specific use of your data, please contact us directly using the contact details in our legal notice.