Version: 12 June 2026
1. Introduction and Scope
We are delighted by your interest in our company and our online shop. Data protection is a matter of particularly high priority for the management of Worst Behavior GmbH. This privacy policy informs you about the nature, scope and purposes of the processing of personal data (hereinafter usually referred to simply as "data") across our entire online offering.
This includes our primary website, the associated online shop, the customer account requiring registration, our communication channels (such as e-mail, contact forms and messenger services), the handling of orders and returns, the distribution of our newsletter, and our accompanying marketing and advertising activities. Your data is always processed in accordance with the General Data Protection Regulation (GDPR), the German Telecommunications Digital Services Data Protection Act (TDDDG) and the state-specific data protection provisions applicable to us.
With this policy we wish to inform you transparently and comprehensively about which data we collect from you when you use our services, how and why we use it, and what far-reaching rights you have in relation to your personal data.
2. Controller
The controller for data processing within the meaning of the GDPR, other data protection laws applicable in the member states of the European Union and other provisions of a data protection nature is:
Worst Behavior GmbH
Franklinstraße 12-14
10587 Berlin
Germany
E-mail: support@worst-behavior.com
Managing Director: Janek Feldmann
Legal notice: https://worst-behavior.com/en-eu/policies/legal-notice
3. Categories of Data Subjects
In the course of our business activities and the operation of our online shop, we process personal data relating to various groups of people. Data subjects include, in particular:
- Visitors and users: All persons who access and browse our website and online shop purely for informational purposes.
- Customers and purchasers: Persons who purchase products in our shop as a guest or via a registered customer account.
- Prospective customers: Persons who are interested in our products, place items in the shopping cart or contact us via forms.
- Communication partners: Persons who contact us by e-mail, telephone, contact form or messenger services (e.g. WhatsApp).
- Newsletter recipients: Persons who have actively subscribed to our e-mail newsletter.
- Participants in customer loyalty programmes: Users who have registered for special bonus, loyalty or reward schemes (such as LoyaltyLion).
4. Types of Data Processed
Depending on how you interact with our online shop, we process different types of personal data. These can be divided into the following categories:
- Master data: First and last name, billing and delivery addresses, title, company name (where provided).
- Contact data: E-mail addresses, landline or mobile telephone numbers, social media profiles or messenger identifiers.
- Content data: Text you enter in contact forms, e-mails, chat messages, product reviews, comments, photographs or videos that you send us in the context of customer service.
- Contract data: Details of the items you order (products, sizes, colours), customer number, order number, subject matter of the contract, term of subscriptions (if applicable), customer category.
- Payment data: Chosen payment method, payment history, bank details, transaction IDs, payment status. (Please note that we do not process complete credit card details; this is handled by the external payment service providers).
- Usage data: Information about your interaction with our website, product pages viewed, time spent, clicks, interest in particular content, abandoned shopping carts, access times.
- Meta and communication data: IP addresses (often anonymised/truncated), device information (e.g. smartphone model, operating system), browser type and version, referrer URL (the previously visited website), cookie IDs, pixel identifiers, location data (at regional level).
5. Purposes of Processing
We do not collect and use your personal data without purpose; we always pursue clearly defined objectives in order to offer you an optimal shopping experience. Processing takes place for the following purposes:
- Provision of the online offering: Ensuring the technical functionality, stability and user-friendly presentation of our website and online shop.
- Contract processing and shop operation: Receiving orders, handling the shopping cart, processing payment, delivering the goods, handling returns, cancellations and warranty claims.
- Customer administration: Creating and maintaining customer accounts, providing order histories and administering loyalty programmes.
- Communication and customer service: Responding to enquiries via contact forms, e-mail, telephone or messenger in order to ensure fast and efficient support.
- Marketing and direct advertising: Sending newsletters, e-mail marketing with product recommendations, personalised communication, provision of discount campaigns.
- Reach measurement and analysis: Evaluating user behaviour in order to optimise our web offering, our product range and our business processes.
- Advertising tracking and remarketing: Delivering audience-appropriate advertisements on third-party platforms (e.g. social media, search engines) and measuring the effectiveness of our advertising campaigns (conversion tracking).
- Security and protection: Preventing fraud attempts (fraud prevention), defending against cyberattacks, ensuring IT security.
- Legal obligations: Fulfilling documentation and retention obligations under tax law, commercial law and other statutory provisions.
6. Relevant Legal Bases
In accordance with Art. 13 GDPR, we inform you of the legal bases for our data processing. Each processing operation is based on at least one of the following statutory grounds:
- Consent (Art. 6(1)(a) GDPR): Where legally required, we obtain your voluntary and informed consent prior to certain processing operations. This applies in particular to the use of cookies that are not technically necessary as well as tracking and marketing technologies, the sending of newsletters, or participation in loyalty and bonus programmes.
- Performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR): Processing your master, contract and payment data is strictly necessary in order to handle your purchase in our online shop, deliver the goods, process payment and answer contract-related customer enquiries.
- Legal obligation (Art. 6(1)(c) GDPR): We are subject to various legal obligations, such as the retention periods under tax and commercial law for invoices and accounting records. In addition, we are obliged to be able to demonstrate the granting and withdrawal of consent to the extent necessary.
- Legitimate interest (Art. 6(1)(f) GDPR): Where processing is necessary to safeguard our legitimate interests or those of a third party and your interests, fundamental rights and freedoms do not override them, we rely on this basis. This concerns in particular ensuring the secure and stable operation of our website (e.g. hosting and server log files), preventing and investigating fraud, asserting or defending legal claims, and handling general enquiries.
7. Recipients and Processors / Disclosure to Third Parties
Within our company, only those departments that need your data in order to fulfil our contractual and legal obligations have access to it. Data is disclosed to third parties exclusively within the framework of statutory requirements.
Where we disclose data to other persons and companies in the course of our processing, we only do so if an appropriate legal basis exists (such as your consent, a contractual necessity or our legitimate interest). We work closely with specialised service providers in order to operate our online shop.
Typical recipients include:
- IT and web hosting providers: For the secure provision of our infrastructure and servers.
- Payment service providers and banks: For the secure processing of transactions.
- Logistics and shipping companies: For the delivery of the products you have ordered.
- Marketing and advertising partners: Agencies and platform operators (e.g. search engines, social media networks) that support us in placing and evaluating advertising.
- Analytics and software service providers: Providers of consent management platforms, newsletter software, ERP systems and analytics tools.
- Tax advisers and public authorities: For the fulfilment of our documentation obligations under tax and commercial law.
Where external service providers process personal data on our behalf, we conclude data processing agreements with them in accordance with Art. 28 GDPR. Where recipients process the data under their own data protection responsibility, the transfer takes place exclusively on the basis of a statutory permission or your consent.
8. Transfers to Third Countries
Some of our service providers (e.g. Google, Meta, Klaviyo, Microsoft) are based in countries outside the European Union (EU) or the European Economic Area (EEA) – so-called third countries – in particular in the USA. Where we transfer personal data to such a third country, we first ensure that an adequate level of data protection prevails there or that appropriate safeguards are in place.
For the USA, an adequacy decision of the EU Commission exists, the EU-U.S. Data Privacy Framework (DPF). Where our service providers are certified under this framework, the data transfer takes place on the basis of this adequacy decision (Art. 45 GDPR), since a level of protection comparable to that of the EU is ensured.
For service providers in countries without an adequacy decision (e.g. possible server locations in Asia for certain services) or for non-certified US companies, we conclude the Standard Contractual Clauses (SCC) approved by the EU Commission. These contractual safeguards (Art. 46 GDPR) oblige the recipients to respect the European level of data protection locally as well. For certain services (e.g. in the United Kingdom / UK), separate adequacy decisions of the EU Commission likewise apply.
9. Retention Period and Data Erasure
We process and store your personal data only for the period necessary to achieve the purpose of storage, or where this has been provided for by European or national directives, laws or regulations to which we are subject.
If the purpose of storage ceases to apply or a statutory retention period expires, the personal data is routinely erased or its processing restricted in accordance with the statutory provisions (Art. 17 and Art. 18 GDPR).
The statutory retention obligations under German law are particularly relevant in the context of our online shop:
- 6 years pursuant to Section 257(1) nos. 2 and 3, (4) of the German Commercial Code (HGB) for commercial correspondence (e.g. business e-mail correspondence, support tickets relevant to the contract).
- 10 years pursuant to Section 147(1) of the German Fiscal Code (AO) and Section 257(1) nos. 1 and 4, (4) HGB for books, records, accounting vouchers, invoices, delivery notes and documents of tax relevance.
Data that we process on the basis of your consent (e.g. newsletter distribution, cookie tracking) is stored until the point at which you withdraw your consent, unless a legal obligation requires us to retain it for longer in a restricted archive.
10. Security Measures
In accordance with Art. 32 GDPR, and taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take extensive technical and organisational measures to ensure a level of protection appropriate to the risk.
These security measures include in particular:
- Encryption: All data traffic between your browser and our servers (in particular during the checkout process and when using contact forms) is secured by modern SSL/TLS encryption (recognisable by the "https://" and the padlock symbol in the browser bar).
- Access controls: Only authorised employees who strictly require access in order to carry out their specific duties (e.g. customer service or accounting) have access to your personal data.
- Pseudonymisation and data minimisation: Where possible, we employ measures for pseudonymisation and data minimisation in order to reduce the identifiability of individuals. This may include, for example, hash-based processing of e-mail addresses in the context of marketing activities as well as measures for IP anonymisation.
11. Rights of Data Subjects
Applicable data protection law grants you comprehensive data subject rights vis-à-vis us as the controller with regard to the processing of your personal data. To exercise these rights you may contact us at any time using the contact details stated above (e.g. by e-mail).
Right of access (Art. 15 GDPR)
You have the right to obtain confirmation as to whether data concerning you is being processed and to comprehensive information about that data, the purposes of processing, the categories of data, the recipients and the envisaged storage period. You are also entitled to a free copy of your data.
Right to rectification (Art. 16 GDPR)
You have the right to obtain, without undue delay, the rectification of inaccurate personal data or the completion of incomplete personal data. You can also adjust much of this data yourself in your customer account.
Right to erasure / right to be forgotten (Art. 17 GDPR)
You may request the erasure of your data where the statutory requirements are met, for example where the data is no longer necessary for the purposes pursued, where you have withdrawn your consent or where you have objected. This does not apply, however, where processing is necessary for compliance with a legal obligation (e.g. retention of invoices) or for the establishment of legal claims.
Right to restriction of processing (Art. 18 GDPR)
You have the right to request the restriction of the processing of your data where you contest the accuracy of the data, where the processing is unlawful but you oppose erasure, or where we no longer need the data but you require it for the establishment of legal claims.
Right to data portability (Art. 20 GDPR)
You have the right to receive the data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller, provided that the processing is based on consent or a contract and is carried out by automated means.
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
If you consider that the processing of personal data relating to you infringes the GDPR, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement.
12. Right to Withdraw Consent
Many data processing operations, particularly in the area of marketing and in the use of analytics cookies, are only possible with your express consent. In accordance with Art. 7(3) GDPR, you have the right to withdraw consent already given at any time with effect for the future.
Withdrawal may be made informally (e.g. by e-mail to us) or via the technical interfaces (for instance by unsubscribing from the newsletter using the link in the e-mail, or by changing your cookie preferences in our consent manager). The lawfulness of the data processing carried out up to the point of withdrawal remains unaffected by the withdrawal.
13. Right to Object under Art. 21 GDPR
Where we process your personal data on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object at any time to such processing on grounds relating to your particular situation.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Where your objection is directed against data processing for the purposes of direct marketing (e.g. postal advertising or profiling measures without explicit consent), you have a general right to object. In this case we will implement the objection without undue delay and without requiring a particular situation to be stated.
14. Cookies, Consent Management and Section 25 TDDDG
Our online shop uses cookies and comparable technologies (e.g. pixel tags, web beacons, local storage) in order to ensure the smooth technical functioning of the website, to optimise the user experience and to manage advertising activities. Cookies are small text files that your browser stores on your device.
Technically necessary technologies
Some cookies are strictly necessary to enable you to move around the website and use basic functions (e.g. the shopping cart, logging in to the customer account or the security of navigation). Access to your device and the storage of these cookies takes place pursuant to Section 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act). The subsequent data processing is based on our legitimate interest (Art. 6(1)(f) GDPR) in providing a functioning online shop, or is necessary for the initiation or performance of a contract (Art. 6(1)(b) GDPR). Consent is not required for these essential cookies; they are necessary for the operation of the website and cannot be deactivated via the consent manager..
Technologies requiring consent (tracking, analytics, marketing)
For all other cookies and trackers that are not strictly technically necessary (in particular those used for reach measurement, analysis of browsing behaviour and personalised advertising), we obtain your express and informed consent before they are set or before your device is accessed. The legal basis for this is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. The relevant tools are only loaded if you actively consent via our cookie banner. You may adjust your selection at any time and withdraw any consent given.
15. Hosting and Server Log Files
In order to make our online shop available on the internet securely, quickly and reliably, we make use of the services of professional web hosting providers. In this context, master data, contact data, content data, contract data, usage data as well as meta and communication data of our website visitors are processed on the host's servers.
The use of hosting services takes place on the basis of our legitimate interests in the efficient and secure provision of our online offering pursuant to Art. 6(1)(f) GDPR in conjunction with Art. 28 GDPR (data processing agreement with the hosting provider).
Collection of access data and log files
On the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR, we – or our hosting provider – collect data on every access to the server (so-called server log files). Access data includes:
- Name of the web page or file accessed
- Date and time of access
- Volume of data transferred and notification of successful retrieval
- Browser type and version and the user's operating system
- Referrer URL (the previously visited page)
- IP address and the requesting provider
Log file information is stored for a short period (usually 7 to 14 days) for security reasons (e.g. to investigate misuse or fraudulent activity, to defend against DDoS attacks) and is then automatically erased or anonymised. Data whose further retention is necessary for evidentiary purposes is exempt from erasure until the incident in question has been finally resolved.
16. Contacting Us
When you contact us – whether via the contact form on the website, by e-mail, by telephone or via social media – we process the information you voluntarily provide in order to respond to and deal with your request. This generally includes your name, your e-mail address and the content of your message.
This data is processed on the basis of Art. 6(1)(b) GDPR where your enquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures (e.g. questions about products before purchase). In all other cases we base the processing on our legitimate interest in the effective handling of enquiries addressed to us pursuant to Art. 6(1)(f) GDPR, or on your consent (Art. 6(1)(a) GDPR) where this has been expressly requested.
Your contact enquiries are stored in our customer relationship management system (CRM) or support ticket system and are erased as soon as they are no longer required. We review the necessity at regular intervals; statutory archiving obligations also apply.
Note: Special conditions apply to communication via the WhatsApp messenger service, which we address in detail in the separate section "WhatsApp Business" below.
17. Business-Related Processing
In addition to purely online tracking data, in the course of our regular business operations we naturally also process business-related data of our customers, prospective customers and business partners (B2B/B2C). This includes in particular:
- Contract data: Subject matter of the contract, terms, customer category, discount levels.
- Payment data: Bank details, payment history, dunning procedures.
We process this data for the purpose of providing contractual services, for general customer service, for maintaining contact, for administrative purposes, for accounting, and for internal analysis to optimise business processes. Processing takes place on the basis of Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (statutory retention obligations).
18. Order Processing in the Online Shop
The online shop is a central element of our online offering. When you order items from us, we process the data you enter during the checkout process (in particular first and last name, delivery and billing address, e-mail address, items ordered, payment method) in order to receive and process your order and to dispatch the parcel.
The data processing takes place for the purpose of establishing and performing the contract on the indispensable legal basis of Art. 6(1)(b) GDPR. Without this mandatory information we cannot process your order technically or legally.
For this purpose we use session cookies to ensure smooth functioning and to store the contents of the shopping cart, as well as – if you have an account – permanent cookies to store your login status. We securely retain the order data collected for the fulfilment of statutory warranty claims and on account of archiving obligations under commercial and tax law pursuant to Art. 6(1)(c) GDPR, generally for 10 years.
19. Customer Account
We offer you the option of registering voluntarily in our online shop and creating a personal customer account. In this non-public, password-protected area you can view your current and past orders, manage your address details, register returns and manage your newsletter preferences.
During registration, the necessary mandatory information (such as e-mail address and password) is requested. This data is processed on the basis of Art. 6(1)(b) GDPR in order to make the customer account functions available to you in accordance with the contract. In the background, we also store your IP address and the time of registration/login on the basis of our legitimate interests (Art. 6(1)(f) GDPR) for IT security and to prevent misuse.
You may terminate and delete your customer account at any time via your profile settings or by sending us a message. Upon deletion of the account, the data contained therein is blocked from active use or erased, subject to data that we are legally required to retain for commercial and tax law reasons.
20. Payment Processing with External Payment Service Providers
As part of order processing, we offer you various secure payment options at checkout. For this purpose we integrate external payment service providers (depending on the checkout, these may include, for example, PayPal, Klarna, Skrill, giropay, Visa, Mastercard, American Express or comparable providers). If you select one of these payment methods, you generally enter your payment-related data (such as bank details, credit card number, CVC code) directly into a secured input field or on the redirect page of the relevant provider.
We ourselves do not collect or store your complete credit card or bank details on our own servers. The payment service providers are independent controllers within the meaning of the GDPR in this respect. The providers process this data under their own responsibility and merely transmit to us an encrypted confirmation of receipt or rejection of payment so that we can dispatch your goods.
The transfer of your order data to the selected payment service provider is strictly necessary for the performance of the purchase contract and is therefore based on Art. 6(1)(b) GDPR. For certain payment methods (e.g. purchase on account or instalment purchase), providers such as Klarna reserve the right to carry out a credit check. In this case we expressly refer you to the separate privacy policies and general terms and conditions of the respective payment service providers, where you can find details on credit checks and data processing.
21. Shipping, Delivery, Returns and Customer Service
In order to deliver the goods you have ordered, we work with established shipping service providers (such as DHL, DPD, UPS or comparable logistics partners). We transmit to these providers only the data that is strictly necessary for delivery – that is, your name, your delivery address and, where desired/necessary for parcel notification, your e-mail address or telephone number.
This data is transmitted for the performance of the contract (Art. 6(1)(b) GDPR). Where we pass e-mail addresses directly to the shipping service provider for detailed tracking notifications, we generally rely on our legitimate interest in a smooth shipping process and good customer service (Art. 6(1)(f) GDPR) or on the consent you gave at checkout (Art. 6(1)(a) GDPR).
In the event of a return or use of customer service, we process your case data (e.g. reason for return, condition of the goods, bank details for the refund) in order to unwind the contract pursuant to Art. 6(1)(b) GDPR.
22. Newsletter and E-Mail Marketing
We offer you the opportunity to subscribe to our e-mail newsletter in order to receive regular information about new collections, exclusive discount campaigns and company news.
Subscription and double opt-in
Our newsletter is generally sent only with your express consent on the basis of Art. 6(1)(a) GDPR. Subscription takes place using a so-called double opt-in procedure. This means that after entering your e-mail address you receive a confirmation e-mail asking you to verify your subscription. This procedure ensures that no one can subscribe using someone else's e-mail address. In order to fulfil our obligations of proof (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR), we log the subscription process including the time of subscription and the IP address.
Success measurement and personalisation
Our newsletters sometimes contain small, invisible image files (web beacons or counting pixels) which allow us to record – anonymised or, where corresponding consent has been given via Klaviyo, also on a user-related basis – whether and when an e-mail was opened and which links in the e-mail were clicked. This success measurement serves the ongoing technical and editorial optimisation of our e-mail campaigns. We do not send a newsletter without your express consent; any matching of this click data to build more detailed personal profiles takes place in accordance with the policies of the service provider we use (see the section "Klaviyo").
Unsubscribing and withdrawal
You may cancel receipt of our newsletter at any time, i.e. withdraw your consent. A corresponding unsubscribe link can be found at the very bottom of each of our newsletters. Alternatively, you may also send us an informal message. After you unsubscribe, your e-mail address is stored on an internal blocking list (blacklist) in order to prevent future unwanted mailings, and is blocked for active distribution.
23. Tools Used
Consent management platform: Usercentrics
Nature and scope of processing
On our website we use the consent management platform (CMP) "Usercentrics" provided by Usercentrics GmbH (Sendlinger Str. 7, 80331 Munich, Germany).
This tool enables us to obtain and document the legally required consent of website visitors for the storage of certain cookies and the use of certain services. When you visit our website, a connection is established to the Usercentrics servers in order to retrieve your consent settings. In doing so, a cookie is stored in your browser in order to document the consent you have given (or its withdrawal).
The following data is processed in this context:
- Your declaration of consent or the withdrawal of your consent
- Your IP address
- Information about your browser and your device
- The time of your visit
Purpose of processing
The purpose of processing is to fulfil our legal obligation to obtain and document consent for tracking and the use of cookies in accordance with the GDPR and the TDDDG.
Legal basis
Processing takes place in order to fulfil a legal obligation pursuant to Art. 6(1)(c) GDPR. We are legally obliged to manage consent to data processing in a demonstrable manner.
Retention period
The data is stored for as long as is necessary to document consent and provided that no statutory retention obligations conflict with erasure. The declaration of consent is generally stored for a period of one year, unless you delete it beforehand.
Data processing agreement
We have concluded a data processing agreement with Usercentrics GmbH which ensures the protection of your data in accordance with statutory requirements.
Further information on data protection at Usercentrics can be found at: usercentrics.com.
Meta Pixel and Custom Audiences
On our web pages we use the Meta Pixel service, a service for enabling personalised advertising provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter: "Meta"). In this service relationship, Meta acts as a third party.
Scope of processing
If you have consented to the use of Meta Pixel and Custom Audiences, a connection to Meta's servers is established when you access our website in order to load the script required for the Meta Pixel. In doing so, your IP address, the address of the page visited and information about the browser and operating system used are transmitted. At the time the Meta Pixel is initialised, cookies containing unique identifiers are stored, by means of which your browser can be recognised. The cookie is valid only for our site and cannot be used to track your activities on third-party sites. Each time you access a page of our website on which the Meta Pixel is used, the following data is then transmitted to a Meta server in the USA and stored there:
- Address of the page from which you arrived at a page of our website
- Address of the page accessed
- Date and time of access
- Browser and operating system
- IP address
- the Pixel ID assigned by Meta for our website
- identifier from the Meta cookie
- "button click data" (information about buttons the user has clicked and the page to which the user was redirected)
The pixel we use is not operated in the "advanced matching" variant, i.e. we do not transmit any further personal data to Meta.
If you have a Meta user account and a Meta cookie containing your user identifier is stored in your browser, Meta can associate the data we transmit with your Meta user account and therefore with you personally. On the basis of the data collected – irrespective of whether you have a user account – Meta creates interest profiles which serve as the basis for creating target groups ("Custom Audiences"). Meta may add you to such a target group and display personalised advertisements to you when you access pages belonging to Meta. For us, the data on visitors and target groups is available only in the form of anonymised statistics.
You can find further information on Meta's pages:
a) Storage of and access to data in the browser
The following cookies may be stored in and read from your browser for the Meta Pixel and Custom Audiences. For further information, please refer to Meta's information on the cookies used[TK4] .
|
Name
|
Duration
|
Third-party access
|
Domain
|
Type
|
|
_fbp
|
3 months
|
yes
|
|
First-party cookie
|
Legal basis for processing
The legal basis for the processing operations is Art. 6(1)(a) GDPR.
Purpose of processing
We use the Meta Pixel in order to advertise our offering to relevant audiences on Meta's pages. By having Meta assign data subjects to an audience relevant to us, we can deploy our advertising resources effectively. By using the Meta Pixel we aim to ensure that our advertisements on Meta's pages correspond to a user's potential interests and are not perceived as intrusive.
Transfer of data to third countries
Where Meta also processes your data in third countries, this takes place – according to Meta – either on the basis of adequacy decisions of the EU Commission within the meaning of Art. 45(1) GDPR or on the basis of Standard Contractual Clauses with the recipient, which oblige the latter to ensure compliance with European data protection law in the third country as well, thereby providing an appropriate safeguard for the protection of personal data within the meaning of Art. 46(2)(c) GDPR.
Retention period
Data subjects who have been added to a Custom Audience are removed from the target group after 180 days, provided they have not been re-included in the meantime through further site visits. No personal data is stored on our side. In all other respects, the storage of personal data is governed by Meta's privacy provisions.
Objection and removal options
You can view the status of your consent via our consent manager and withdraw consent given at any time. Withdrawal of consent does not affect the lawfulness of processing carried out up to the point of withdrawal. Your decision regarding the use of the service is stored in a cookie. It applies only to this browser and must be renewed after the stated period of validity has expired.
Registered users of the Facebook platform can deactivate the Custom Audiences function at https://www.facebook.com/settings?tab=ads. Further settings for registered users are explained at https://www.facebook.com/help/568137493302217.
Communication via WhatsApp Business
Nature and scope of processing
If you contact us via the WhatsApp messenger service, we process your mobile telephone number and the content of your message. The provider is WhatsApp Ireland Limited (Merrion Road, Dublin 4, D04 X2K1, Ireland), a subsidiary of Meta Platforms Inc.
The following data is processed:
· Mobile telephone number
· Profile name (where stored on WhatsApp)
· Message content (text, images, videos, voice messages)
· Metadata of the communication (e.g. time stamps)
Communication takes place via end-to-end encryption, so that third parties (including WhatsApp itself) have no access to the content of the messages. WhatsApp may, however, use metadata for marketing purposes and profiling.
Purpose of processing
Processing takes place in order to respond quickly and efficiently to your enquiries as well as for customer support and communication within the framework of our business relationship.
Legal basis
Where contact is made in the context of a contract or in order to initiate a contract, Art. 6(1)(b) GDPR is the legal basis. In all other cases, processing is based on our legitimate interest in rapid communication (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR), which you give us by actively contacting us.
Transfer of data to third countries
Data may be transferred to servers of Meta Platforms Inc. in the USA. The transfer takes place on the basis of the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses of the EU Commission.
Retention period
We delete the messages as soon as they are no longer required for handling your enquiry and no statutory retention obligations (e.g. under commercial or tax law) remain.
Further information can be found in WhatsApp's privacy policy: whatsapp.com.
Privacy policy: TikTok Pixel & Conversion API
On our website we use the TikTok Pixel and the TikTok Conversion API provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland ("TikTok").
1. Purpose of the data processing
The TikTok Pixel is a code snippet that enables us to analyse user behaviour on our website. The Conversion API (server-side tracking) transmits these events directly from our server to TikTok. This serves to:
· Measure the performance of our advertising campaigns (TikTok Ads).
· Define audiences for remarketing ("Custom Audiences").
· Optimise our website content and advertisements.
2. Type of data processed
Through the pixel and the API, personal data is collected and transmitted to TikTok, including:
· User data: IP address, information about the device and browser (user agent), TikTok cookie ID (where available).
· Event data: Pages visited, time stamps, clicks, purchase transactions, shopping cart actions.
· Where applicable, customer data: E-mail address or telephone number (encrypted/hashed) if you enter these on our site.
3. Legal basis for the processing
The TikTok Pixel and the Conversion API are used only with your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time via our cookie banner. [1]
4. Transfer of data to third countries
TikTok may transfer data to affiliated companies in countries outside the EU/EEA (in particular China). We point out that a level of data protection comparable to that of the EU may not exist there.
5. Retention period
The data collected is stored by TikTok for a limited period (usually up to 180 days for remarketing purposes).
6. Data processing by TikTok
TikTok processes the data under its own responsibility. Further information can be found in TikTok's privacy policy
Google Ads
Nature and scope of processing
On our website we use the online advertising programme "Google Ads" provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). In this context we use the following functions:
· Conversion tracking: If you reach our website via a Google advertisement, a cookie is set for conversion tracking. This enables us to recognise whether you have carried out a particular action (e.g. a purchase or a registration).
· Enhanced conversions: In this case, self-provided data (such as your e-mail address or telephone number) is transmitted to Google in hashed (encrypted) form when a conversion occurs (e.g. a purchase). Google matches these hashes against its own user data in order to increase the accuracy of conversion measurement without permanently storing data in plain text.
· Google Consent Mode: This function ensures that Google tags respect the status of your consent (given via our cookie banner). If you do not give consent, no cookies are set; instead, only anonymised signals (pings) are sent to Google in order to enable a modelled estimate of conversions.
Data processed: IP address, device information, referrer URL, conversion events and, where applicable, hashed order data.
Purpose of processing
The purpose is to optimise our advertising campaigns, to measure the effectiveness of advertisements and to deliver targeted advertising within the Google network.
Legal basis
Processing takes place exclusively on the basis of your express consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time via our cookie settings (Usercentrics).
Transfer of data to third countries
Data may be transferred to Google LLC in the USA. The transfer takes place on the basis of the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses of the EU Commission.
Retention period
The conversion cookies set by Google generally expire after 30 to 90 days.
Further information can be found in Google's privacy policy: google.com.
Microsoft Advertising
Nature and scope of processing
On our website we use the conversion and remarketing tool "Microsoft Advertising" provided by Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland).
By means of so-called Universal Event Tracking (UET), a cookie is stored in your browser or a counting pixel is used if you have reached our website via a Microsoft advertisement. In this context, data about the use of our website (e.g. time spent, pages visited, purchases made) is collected and processed. Microsoft may store this information across devices, enabling us to address you with targeted advertising across various devices.
The following data is processed, among other things:
· IP address (generally anonymised)
· Microsoft cookie ID
· Browser type and settings
· Referrer URL (the page you came from)
· Interaction data (e.g. clicks on advertisements or button clicks)
Purpose of processing
The tool is used for the purpose of analysing website usage, measuring the success of advertisements (conversion tracking) and delivering personalised advertising (remarketing) within the Microsoft advertising network.
Legal basis
Your data is processed exclusively on the basis of your express consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future via our cookie settings.
Retention period
The data collected is erased as soon as it is no longer required for the stated purposes. Microsoft generally stores the data for a maximum of 180 days.
Transfer of data to third countries
Microsoft is a globally operating company. Data may therefore be transferred to Microsoft Corp. in the USA. The transfer takes place on the basis of the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses of the EU Commission.
Right to object (opt-out)
You may additionally object to collection by Microsoft Advertising by using Microsoft's opt-out page at the following link: microsoft.com.
Further information on data protection at Microsoft can be found in Microsoft's privacy statement: microsoft.com.
Klaviyo
Nature and scope of processing
For sending our newsletters and marketing e-mails we use the platform "Klaviyo" provided by Klaviyo Inc. (125 Binney St, Cambridge, MA 02142, USA).
When you subscribe to our newsletter, the data you enter in the input form (generally e-mail address, optionally name) is transmitted to Klaviyo and stored there. Klaviyo offers extensive analysis functions regarding how our newsletters are opened and used. The following data, among other things, is collected in this context:
· Recipient data (e-mail, name, IP address)
· Time the e-mail was opened
· Clicks on links within the e-mail
· Technical data (e.g. browser used, operating system)
Klaviyo also enables a so-called "predictive analytics" procedure in order to send you suitable product recommendations based on your previous purchasing or click behaviour.
Purpose of processing
Processing takes place for the purpose of sending newsletters, analysing the reach of our marketing campaigns and personalising and optimising our e-mail communication.
Legal basis
Your data is processed on the basis of your express consent pursuant to Art. 6(1)(a) GDPR (double opt-in procedure). You may withdraw this consent at any time using the unsubscribe link at the end of every e-mail or by sending us a message.
Transfer of data to third countries (USA)
Klaviyo is a provider based in the USA. The data transfer takes place on the basis of the EU Standard Contractual Clauses (SCC), which ensure that the European level of data protection is maintained even where processing takes place in the USA. We have also concluded a data processing agreement (Data Processing Addendum) with Klaviyo.
Retention period
Your data is stored for as long as the newsletter subscription is active. After you unsubscribe, the data is blocked for distribution and erased once statutory retention periods have expired.
Further information can be found in Klaviyo's privacy policy at: klaviyo.com.
Google Analytics 4
Nature and scope of processing
On this website we use "Google Analytics 4", a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).
Google Analytics uses technologies such as cookies or device IDs in order to analyse your user behaviour on our website (e.g. pages viewed, time spent, clicks or scrolling). With Google Analytics 4, the anonymisation of IP addresses takes place by default. This means that your IP address is truncated by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area before it is transferred to servers in the USA.
We have also activated the Google Signals function (provided you have consented to personalised advertising in your Google account) in order to obtain cross-device reports.
Purpose of processing
The analysis serves to continuously improve our website, optimise the user experience and measure the success of marketing campaigns.
Legal basis
Processing takes place only on the basis of your express consent pursuant to Art. 6(1)(a) GDPR. You may withdraw this consent at any time via the cookie settings (Usercentrics) on our website.
Transfer of data to third countries
The data collected may be transferred to servers of Google LLC in the USA. The transfer takes place on the basis of the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses of the EU Commission.
Retention period
The retention period for user-level and event-level data in Google Analytics 4 has been set by us to 2 months . After this period has expired, the data is automatically erased.
Further information can be found in Google's privacy policy: google.com.
Klar Insights
Nature and scope of processing
On our website we use the e-commerce analytics tool "Klar Insights" provided by Klar Insights GmbH (Marktstr. 18, 80802 Munich, Germany).
Klar Insights helps us to analyse and optimise our marketing channels and sales data. The tool consolidates data from various sources (e.g. shop system, advertising platforms). The following data, among other things, is processed in this context:
· Order data (e.g. revenue, products purchased)
· Customer data (e.g. e-mail address in pseudonymised form)
· Marketing data (e.g. clicks on advertisements)
· Technical data (e.g. anonymised IP addresses)
Purpose of processing
The purpose lies in the business evaluation of our sales activities, the optimisation of our product range and the measurement of the efficiency of our marketing activities.
Legal basis
Processing takes place on the basis of our legitimate interest in the efficient design and optimisation of our online offering pursuant to Art. 6(1)(f) GDPR. Where consent has been requested (e.g. via the cookie banner), Art. 6(1)(a) GDPR is the legal basis.
Data processing agreement
We have concluded a data processing agreement (DPA) with Klar Insights GmbH. This ensures that Klar Insights processes the data only in accordance with our instructions and in compliance with the GDPR. Data is held on servers within the European Union (e.g. Hetzner in Germany).
Retention period
The data is stored for as long as is necessary for the analytical purposes or until the legitimate interest ceases to apply. Statutory retention periods remain unaffected.
Further information on data protection at Klar can be found here: https://getklar.com/data-protection.
LoyaltyLion
Nature and scope of processing
On our website we use the service "LoyaltyLion" provided by LoyaltyLion Ltd. (72-75 Marylebone High St, Marylebone, London W1U 5JW, United Kingdom) in order to offer you a loyalty programme.
If you participate in our loyalty programme (e.g. by creating a customer account or making purchases), LoyaltyLion collects data in order to manage the points you have collected, your rewards and your interactions. The following data, among other things, is processed in this context:
· Master data (e-mail address, name)
· Transaction data (order history, purchase amounts)
· Activity data (e.g. newsletter subscription, interactions on social media)
· Technical data (IP address, browser type)
Purpose of processing
Processing takes place in order to provide and administer our loyalty and reward scheme, to personalise offers and to analyse customer retention.
Legal basis
Your data is processed on the basis of your express consent pursuant to Art. 6(1)(a) GDPR. You generally give this consent by registering for the loyalty programme or via our cookie consent banner.
Transfer of data to third countries
LoyaltyLion is based in the United Kingdom. An adequacy decision of the European Commission exists for the United Kingdom, confirming an adequate level of data protection. In addition, LoyaltyLion partly uses sub-processors in third countries (e.g. the USA). In these cases the transfer takes place on the basis of EU Standard Contractual Clauses.
Retention period
The data is stored for as long as your customer account in our loyalty programme is active or for as long as it is necessary for the fulfilment of the purposes.
Further details can be found in LoyaltyLion's privacy policy at: loyaltylion.com.
