Privacy policy

Privacy Policy

The data controller is:

Kreutzers Steakkultur GmbH

Bismarckstraße 144

66121 Saarbrücken

Email: info@kreutzers.eu

We appreciate your interest in our website. Protecting your privacy is very important to us. Below, we provide detailed information about how we handle your data.

1. Access Data and Hosting

You can visit our website without providing any personal information. Each time you access a webpage, the web server automatically stores a so-called server log file that contains, for example, the name of the requested file, your IP address, the date and time of access, the amount of data transferred, and the requesting provider (access data), and documents the access. This access data is evaluated exclusively for the purpose of ensuring the smooth operation of the site and improving our offerings. This serves to safeguard our legitimate interests—which prevail following a balancing of interests—in the proper presentation of our offerings in accordance with Article 6(1)(f) of the GDPR. All access data is deleted no later than seven days after the end of your visit to the site. All access data is processed only for as long as is necessary to achieve the aforementioned processing purposes.

2. Data Processing for Contract Fulfilment and Establishing Contact

2.1 Data Processing for Contract Fulfilment

For the purpose of contract fulfillment (including inquiries regarding and the handling of any existing claims arising from warranty rights, rights arising from breach of contract, and the right of withdrawal, as well as any statutory obligations to update information) in accordance with Article 6(1), first sentence, (b) of the GDPR, we collect personal data when you voluntarily provide it to us as part of your order. Required fields are marked as such because, in these cases, we absolutely need the data to process the contract, and we cannot ship the order without this information. The data collected is indicated on the respective input forms.

Further information regarding the processing of your data—in particular regarding its disclosure to our service providers for the purposes of order, payment, and shipping processing—can be found in the following sections of this Privacy Policy. Once the contract has been fully fulfilled, your data will be restricted for further processing and deleted after the expiration of the retention periods under tax and commercial law in accordance with Art. 6(1), sentence 1, lit. c GDPR, unless you have expressly consented to further use of your data in accordance with Article 6(1), first sentence, (a) of the GDPR, or we reserve the right to use your data beyond this scope, provided such use is permitted by law and we inform you of it in this policy.

 Data Transfer for Age Verification

If your order includes goods whose sale is subject to age restrictions, we use a reliable procedure involving a personal identity and age verification to ensure that the person placing the order has reached the required minimum age. For this purpose, the SCHUFA Identity Check is used on our website. This service is operated by SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden, Germany (hereinafter: SCHUFA).
To verify the required minimum age, certain personal data (e.g., name, address, and date of birth) are transmitted to SCHUFA Holding AG as part of this process. A so-called identity check using Q-Bit is then performed, which has been positively evaluated by the Commission for the Protection of Minors in the Media (KJM) for age verification purposes. The transfer of data to SCHUFA serves, in accordance with Art. 6(1)(f) of the GDPR, to safeguard our legitimate interests—which prevail following a balancing of interests—in ensuring that our service complies with youth protection laws, as well as to comply with statutory provisions regarding the protection of minors. No credit check is conducted in this regard.

2.2 Customer Account

To the extent that you have given your consent pursuant to Article 6(1)(a) of the GDPR by deciding to open a customer account, we use your data for the purpose of opening the customer account and for storing your data for future orders on our website. You may delete your customer account at any time by either sending a message using the contact information provided in this Privacy Policy or by using the function provided for this purpose within your customer account. After your customer account is deleted, your data will be deleted unless you have expressly consented to the continued use of your data in accordance with Article 6(1), first sentence, letter a of the GDPR, or unless we reserve the right to use your data for other purposes that are permitted by law and about which we inform you in this policy.

 Contact

As part of our customer communications, we collect personal data to process your inquiries in accordance with Article 6(1)(b) of the GDPR if you voluntarily provide this data to us when contacting us (e.g., via a contact form, live chat tool, or email). Required fields are marked as such, as we absolutely need this data in these cases to process your inquiry. The specific data collected is indicated in the respective input forms. Once your inquiry has been fully processed, your data will be deleted unless you have expressly consented to further use of your data in accordance with Article 6(1)(a) of the GDPR, or we reserve the right to use your data for other purposes that are permitted by law and about which we inform you in this statement.

3. Data Processing for Shipping Purposes

To fulfill the contract in accordance with Article 6(1)(b) of the GDPR, we share your data with the shipping service provider responsible for delivery, to the extent necessary to deliver the ordered goods. If you have any questions about our service providers and the basis of our collaboration with them, please contact us using the contact information provided in this Privacy Policy.

The same applies to the transfer of data to our manufacturers or wholesalers in cases where they handle shipping on our behalf (drop shipping). These parties are considered shipping service providers within the meaning of this Privacy Policy.

 Data Transfer to Shipping Service Providers for the Purpose of Shipping Notifications

If you have given us your explicit consent for this during or after placing your order, we will, on the basis of this consent pursuant to Art. 6(1)(a) of the GDPR, share your email address with the selected shipping service provider so that it can contact you prior to delivery for the purpose of notifying you of the delivery or coordinating delivery details.
You may revoke your consent at any time by sending a message to the contact information provided in this Privacy Policy. Upon revocation, we will delete the data you provided for this purpose, unless you have expressly consented to further use of your data or we reserve the right to use your data for other purposes that are permitted by law and about which we inform you in this policy. If you have any questions about our service providers and the basis of our collaboration with them, please contact us using the contact information provided in this Privacy Policy.

4. Data Processing for Payment Processing

When processing payments in our online store, we work with the following partners: technical service providers, financial institutions, and payment service providers.

4.1 Data Processing for Transaction Processing

Depending on the selected payment method, we transfer the data necessary for processing the payment transaction to our technical service providers, the designated financial institutions, or the selected payment service provider, to the extent necessary to process the payment. This serves the purpose of fulfilling the contract in accordance with Article 6(1)(b) of the GDPR. In some cases, the payment service providers collect the data required to process the payment themselves, e.g., on their own website or through technical integration into the ordering process. In such cases, the privacy policy of the respective payment service provider applies.

Depending on the selected payment method, data may be transferred to third countries outside the EU/EEA for which the European Commission has determined, by means of a decision, that an adequate level of data protection exists. To the extent that data is transferred to third countries outside the EU/EEA for which the European Commission has not issued a decision on an adequate level of data protection, our cooperation is based on the European Commission’s Standard Data Protection Clauses.

If you have any questions about our payment processing partners or the basis of our cooperation with them, please contact us using the contact information provided in this Privacy Policy.

4.2 Data Processing for the Purpose of Fraud Prevention and Optimizing Our Payment Processes

Where applicable, we provide the aforementioned service providers with additional data, which they use—together with the data necessary for processing the payment—for the purposes of fraud prevention and optimizing our payment processes (e.g., invoicing, handling disputed payments, and supporting accounting). This serves, in accordance with Art. 6(1)(f) of the GDPR, to safeguard our legitimate interests—which prevail following a balancing of interests—in protecting ourselves against fraud and in ensuring efficient payment management.

4.3 Identity and Creditworthiness Verification When Selecting Klarna Payment Services

Klarna Direct Debit, Purchase on Account via Klarna, Klarna Installment Purchase
If you choose to use the payment services of Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter “Klarna”), we ask for your consent pursuant to Article 6(1)(a) of the GDPR to allow us to transfer to Klarna the data necessary for processing the payment and conducting an identity and creditworthiness check. In Germany, the credit bureaus listed in Klarna’s privacy policy may be used for identity and credit checks. Klarna uses the information received regarding the statistical probability of default to make a balanced decision regarding the establishment, execution, or termination of the contractual relationship. You may revoke your consent at any time by sending a message to the contact information provided in this Privacy Policy. This may result in us no longer being able to offer you certain payment options. You may also revoke your consent to this use of personal data at any time by contacting Klarna directly.

4.4 Identity and Credit Check When Selecting “Purchase on Account” via PayOne

If you choose the “Purchase on Account” payment method (offered by PayOne GmbH, Lyoner Str. 9, 60528 Frankfurt am Main, Germany (hereinafter “PayOne”)), we ask for your consent pursuant to Article 6(1)(a) of the GDPR to allow us to transfer the data necessary for processing the payment and conducting an identity and credit check to PayOne. In Germany, the credit reporting agencies listed in PayOne’s privacy policy may be used for identity and creditworthiness checks. PayOne uses the information received regarding the statistical probability of payment default to make a balanced decision regarding the establishment, execution, or termination of the contractual relationship. You may revoke your consent at any time by sending a message to the contact information provided in this Privacy Policy. This may result in us no longer being able to offer you certain payment options.

4.5 Identity and Credit Checks When Selecting “Purchase on Account” via PayPal and Ratepay

If you choose the “Purchase on Account” payment method (offered by Ratepay GmbH, Franklinstraße 28-29, 10587 Berlin (hereinafter “Ratepay”) and PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg (hereinafter “PayPal”)), we ask for your consent pursuant to Art. 6(1)(a) of the GDPR to allow us to transfer the data necessary for processing the payment and conducting an identity and credit check to Ratepay. In Germany, the credit bureaus listed in Ratepay’s privacy policy may be used for identity and creditworthiness checks. Ratepay uses the information received regarding the statistical probability of default to make a balanced decision regarding the establishment, execution, or termination of the contractual relationship. You may revoke your consent at any time by sending a message to the contact information provided in this Privacy Policy. This may result in us no longer being able to offer you certain payment options. Additional information on data protection at PayPal can be found here.

4.6 Engagement of Debt Collection Service Providers

We will transfer your data to our contracted debt collection service provider, Intrum Hanseatische Inkasso-Treuhand GmbH, Eiffestraße 76, 20537 Hamburg, Germany, if our payment claim has not been settled despite a prior reminder. In this case, the claim will be collected directly by the debt collection service provider. This serves to fulfill the contract in accordance with Art. 6(1), sentence 1, lit. b of the GDPR, as well as to safeguard our legitimate interests—which prevail following a balancing of interests—in the effective assertion and enforcement of our payment claim in accordance with Art. 6(1), sentence 1, lit. f of the GDPR.

5. Advertising via Email

5.1 Email Newsletter Subscription, Newsletter Tracking with Separate Consent

If you subscribe to our newsletter, we use the data required for this purpose or data you have provided separately to send you our email newsletter on a regular basis based on your consent pursuant to Article 6(1), first sentence, subparagraph (a) of the GDPR. You may unsubscribe from the newsletter at any time by either sending a message to the contact information provided below or by clicking a link provided for this purpose in the newsletter. After you unsubscribe, we will delete your email address from the recipient list, unless you have expressly consented to further use of your data in accordance with Article 6(1)(a) of the GDPR or we reserve the right to use your data for other purposes that are permitted by law and about which we inform you in this statement.

If you have additionally given us your consent pursuant to Article 6(1)(a) of the GDPR to analyze our newsletters, we will also analyze your interaction with our newsletter by measuring, storing, and evaluating open rates and click-through rates for the purpose of designing future newsletter campaigns (“newsletter tracking”).

For this analysis, the emails we send contain single-pixel technologies (e.g., so-called web beacons, tracking pixels) that are stored on our website. For the analyses, we specifically link the following “newsletter data”:

• the page from which the page was requested (so-called referrer URL),
• the date and time of the request,
• the description of the type of web browser used,
• the IP address of the requesting computer,
• the email address,
• the date and time of registration and confirmation,

and single-pixel technologies that include your email address or your IP address and, if applicable, a unique ID. Links included in the newsletter may also contain this ID.

You can opt out of newsletter tracking at any time by either sending a message to the contact address provided or by clicking a link in the newsletter designated for this purpose.

The information will be stored for as long as you remain subscribed to the newsletter.

5.2 Newsletter Distribution

The newsletter and the newsletter tracking described above may also be sent by our service providers as part of processing carried out on our behalf. If you have any questions about our service providers or the basis of our collaboration with them, please contact us using the contact information provided in this Privacy Policy.

Our service providers are located in and/or use servers in the following countries, for which the European Commission has determined, by decision, that an adequate level of data protection exists: the United States, the United Kingdom.

The adequacy decision for the U.S. serves as the basis for transfers to third countries, provided that the respective service provider is certified. Such certification is in place.

Our service providers are based in and/or use servers in the following countries: Australia, Singapore. There is no adequacy decision by the European Commission for these countries. Our collaboration with them is based on the following safeguards: the European Commission’s Standard Data Protection Clauses.

5.3 Sending Review Requests via Email

Provided that you have given us your explicit consent for this purpose during or after your order in accordance with Art. 6(1)(a) of the GDPR, we will use your email address to request that you submit a review of your order via the review system we use. This consent may be revoked at any time by sending a message to the contact information provided in this Privacy Policy or via a link provided for this purpose in the review request. Once you have revoked your consent, we will delete your email address from the recipient list, unless you have expressly consented to further use of your data in accordance with Article 6(1)(a) of the GDPR or we reserve the right to use your data for other purposes that are permitted by law and about which we inform you in this policy.

Review requests may also be sent by our service provider, Trusted Shops SE, Subbelrather Str. 15C, 50823 Cologne (“Trusted Shops”).

In connection with the sending of review requests, we receive information from Trusted Shops regarding the respective status (e.g., whether the review request was sent and whether it was received). This is done in accordance with Article 6(1)(f) of the GDPR to fulfill our legitimate interest in receiving information about the review invitations in order to make optimizations based on this information, if necessary, as well as to fulfill Trusted Shops’ legitimate interest in being able to offer this service.

We are jointly responsible with Trusted Shops for sending review requests and for collecting and displaying review and status information.

Within the framework of the joint responsibility between us and Trusted Shops, please contact Trusted Shops directly for data protection questions and to exercise your rights; you can find their contact information here. You can find further information on data protection by clicking the following link here. Regardless of this, you can always contact us using the contact information provided in this Privacy Policy. Your inquiry will then be forwarded to the other data controller, if necessary, for a response.

6. Cookies and Other Technologies

6.1 General Information

To make your visit to our website more engaging and to enable the use of certain features, we use various technologies on different pages, including so-called cookies. Cookies are small text files that are automatically stored on your device. Some of the cookies we use are deleted at the end of the browser session—that is, when you close your browser (so-called session cookies). Other cookies remain on your device and allow us to recognize your browser the next time you visit (persistent cookies). You can find the storage duration in the overview within your web browser’s cookie settings.

Privacy Protection on Devices

When you use our online services, we employ technologies that are strictly necessary to provide the digital service you have expressly requested. The storage of information on your device or access to information already stored on your device does not require your consent in this regard.

For functions that are not strictly necessary, the storage of information on your device or access to information already stored on your device requires your consent. Please note that if you do not grant your consent, certain parts of the website may not be fully usable. Any consent you have granted remains in effect until you adjust or reset the respective settings on your device.

Any subsequent data processing via cookies and other technologies

We use technologies that are strictly necessary for the use of certain features of our website. These technologies collect and process your IP address, the time of your visit, device and browser information, as well as information regarding your use of our website. This is based on a balancing of interests, where our overriding legitimate interests in optimizing the presentation of our services prevail, in accordance with Article 6(1)(f) of the GDPR.

In addition, we use technologies to comply with the legal obligations to which we are subject (e.g., to be able to demonstrate consent to the processing of your personal data) as well as for web analytics and online marketing. Further information on this, including the respective legal basis for data processing, can be found in the following sections of this Privacy Policy. Where applicable, we may also use technologies that are not listed individually in this Privacy Policy. You can find more detailed information about these technologies, including the respective legal basis for data processing, on the Usercentrics platform. You can access this by clicking the fingerprint button in the lower right or lower left corner of the page.

Cookie Settings

You can find the cookie settings for your browser at the following links: Microsoft Edge™ / Safari™ / Chrome™ / Firefox™ / Opera™

If you have consented to the use of these technologies in accordance with Article 6(1)(a) of the GDPR, you may revoke your consent at any time by sending a message via the contact options described in the Privacy Policy. Alternatively, you can click the fingerprint button in the lower right or lower left corner of the page. If you do not accept cookies, the functionality of our website may be limited.

6.2 Use of the Usercentrics Consent Management Platform to Manage Consent

On our website, we use the Usercentrics Consent Management Platform (“Usercentrics”) to inform you about the cookies and other technologies we use on our website, as well as to obtain, manage, and document your consent—where required by law—to the processing of your personal data by these technologies. This is necessary pursuant to Article 6(1)(c) of the GDPR to fulfill our legal obligation under Article 7(1) of the GDPR to be able to demonstrate your consent to the processing of your personal data, to which we are subject. Usercentrics is a service provided by Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany, which processes your data on our behalf. When you visit our website, the Usercentrics web server stores a so-called server log file that also contains your anonymized IP address, the date and time of your visit, device and browser information, and information regarding your consent behavior. Your data will be deleted after three years, unless you have expressly consented to further use of your data in accordance with Art. 6(1)(a) of the GDPR or we reserve the right to use your data beyond this period in a manner that is permitted by law and about which we inform you in this statement.

Our service providers are located in and/or use servers in the following countries, for which the European Commission has determined, by decision, that an adequate level of data protection exists: the United States.

The adequacy decision for the United States serves as the basis for transfers to third countries, provided that the respective service provider is certified. Certification has been obtained.

6.3 Information on Transfers to Third Countries (Data Transfers to Third Countries)

We use technologies from service providers on our website whose headquarters and/or server locations may be in third countries, outside the EU or the EEA. If there is no adequacy decision by the European Commission for that country, an adequate level of data protection must be ensured through other suitable safeguards.

Appropriate safeguards in the form of contractually agreed Standard Contractual Clauses of the European Commission or Binding Corporate Rules are generally possible; however, they require prior review by the contracting parties to determine whether an adequate level of protection can be ensured. According to the case law of the European Court of Justice, it may be necessary to implement additional protective measures for this purpose.

We have generally agreed to the Standard Data Protection Clauses issued by the European Commission with the technology providers we use who process personal data in a third country. Where possible, we also agree to additional safeguards designed to ensure that adequate data protection is guaranteed in third countries without an adequacy decision.

Notwithstanding this, it may happen that, despite all contractual and technical measures, the level of data protection in the third country does not correspond to that of the EU. In such cases, we ask you, if necessary, as part of the cookie consent process, to provide your consent pursuant to Article 49(1)(a) of the GDPR for the transfer of your personal data to a third country.
In particular, there is a risk that local authorities in the third country may, from a European data protection perspective, be granted access rights to your personal data that are not sufficiently restricted; that we, as the data exporter, or you, as the data subject, may not be aware of this; and/or that you may not have sufficient legal remedies available to prevent this and/or to take action against such access.

In particular, the following countries are currently classified as third countries without an adequacy decision from the European Commission (examples only):

• China
• Russia
• Taiwan

You can find out to which third countries we transfer data in the privacy notices for the respective tool used and/or the consent management service we use (Consent Manager Platform, CMP).

7. Use of Cookies and Other Technologies

We use the following cookies and other third-party technologies on our website. Unless otherwise specified for individual technologies, this is based on your consent pursuant to Article 6(1)(a) of the GDPR. Once the purpose no longer applies and we cease using the respective technology, the data collected in this context will be deleted. You may withdraw your consent at any time with future effect. For more information on your options for withdrawal, please see the section “Cookies and Other Technologies.” Further information, including the legal basis for our collaboration with the individual providers, can be found in the descriptions of the individual technologies. If you have any questions about the providers or the legal basis for our collaboration with them, please contact us using the contact information provided in this Privacy Policy.

7.1 Use of Google Services

We use the technologies described below from Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The information automatically collected by Google’s technologies regarding your use of our website is generally transmitted to a server operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and stored there. Unless otherwise specified for individual technologies, data processing is based on an agreement concluded between joint controllers for the respective technology in accordance with Article 26 of the GDPR. Further information about data processing by Google can be found in Google’s Privacy Policy.

Our service providers are located in and/or use servers in countries outside the EU and the EEA for which the European Commission has determined, by decision, that an adequate level of data protection exists.

Our service providers are located in and/or use servers in countries outside the EU and the EEA. No adequacy decision has been issued by the European Commission for these countries. Our collaboration with them is based on the European Commission’s Standard Data Protection Clauses. 

 Google Analytics

For the purpose of website analysis, Google Analytics automatically collects and stores data (IP address, time of visit, device and browser information, and information about your use of our website), from which usage profiles are created using pseudonyms. Cookies may be used for this purpose. If you visit our website from within the EU, your IP address is stored on a server located in the EU to derive location data and is then immediately deleted before the traffic is forwarded to other Google servers for processing. Data processing is carried out on the basis of a data processing agreement with Google.

 Google Tag Manager

Google Tag Manager allows us to manage various codes and services on our website. When implementing individual tags, Google may also process personal data (e.g., IP address, online identifiers (including cookies)). Data processing is carried out on the basis of a data processing agreement with Google.

Using Google Tag Manager allows us to integrate various services and technologies. If
you do not wish to use certain tracking services and have therefore disabled them, this disabling will apply to all affected tracking tags integrated via Google Tag Manager.

 YouTube Video Plugin

To embed third-party content, the YouTube Video Plugin collects data (IP address, time of visit, device and browser information) in the enhanced privacy mode we use, transmits it to Google, and Google then processes it—but only if you play a video.

7.2 Use of Meta Services

 Use of Meta Pixel

We use the Meta Pixel as part of the technologies described below from Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland (“Facebook (by Meta)” or “Meta Platforms Ireland”). The Meta Pixel automatically collects and stores data (IP address, time of visit, device and browser information, as well as information about your use of our website based on events specified by us, such as visiting a webpage or subscribing to a newsletter), from which usage profiles are created using pseudonyms. To this end, when you visit our website, the Meta Pixel automatically sets a cookie that enables your browser to be recognized when you visit other websites using a pseudonymous cookie ID. Meta Platforms Ireland will combine this information with additional data from your Facebook account and use it to compile reports on website activity and to provide other services related to website usage, in particular personalized and group-based advertising.
The information automatically collected by Meta Platforms Ireland’s technologies regarding your use of our website is generally transmitted to and stored on a server operated by Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025, USA. Further information regarding data processing by Meta Platforms Ireland can be found in Meta Platforms Ireland’s Privacy Policy.

Our service providers are located in and/or use servers in the following countries for which the European Commission has determined, by decision, that an adequate level of data protection exists: Brazil, the United States, Canada, Japan, South Korea, New Zealand, the United Kingdom, and Argentina.

The adequacy decision for the United States serves as the basis for transfers to third countries, provided that the respective service provider is certified. Certification is in place.

Our service providers are located in and/or use servers in the following countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, and Mexico. There is no adequacy decision by the European Commission for these countries. Our collaboration with them is based on the following safeguards: the European Commission’s Standard Data Protection Clauses.

 Meta Ads Manager

We use Meta Ads Manager to advertise this website on Facebook (by Meta) and other platforms. We determine the parameters of each advertising campaign. Meta Platforms Ireland is responsible for the actual implementation, particularly the decision regarding the placement of ads for individual users. Unless otherwise specified for the individual technologies, data processing is based on an agreement between joint controllers pursuant to Article 26 of the GDPR. Joint controllership is limited to the collection of data and its transfer to Meta Platforms Ireland. Subsequent data processing by Meta Platforms Ireland is not covered by this provision.

7.3 Other Providers of Web Analytics and Online Marketing Services

 Use of Hotjar for Web Analytics

For the purpose of website analysis, data (IP address, time of visit, device and browser information, and information regarding your use of our website) is automatically collected and stored using technologies provided by Hotjar Ltd., Dragonara Business Centre 5th Floor, Dragonara Road, Paceville St Julian’s STJ 3141, Malta (“Hotjar”), from which usage profiles are created using pseudonyms. Cookies may be used for this purpose. The pseudonymized usage profiles will not be merged with personal data regarding the holder of the pseudonym without separate, explicit consent. Hotjar acts on our behalf.

Our service providers are located in and/or use servers in countries outside the EU and the EEA for which the European Commission has determined, by decision, that an adequate level of data protection exists.

Our service providers are located in and/or use servers in countries outside the EU and the EEA. No adequacy decision has been issued by the European Commission for these countries. Our collaboration with them is based on the European Commission’s Standard Data Protection Clauses. 

8. Integration of the Trusted Shops Trustbadge and Other Widgets

Provided that you have given your consent in accordance with Art. 6(1)(a) of the GDPR, Trusted Shops widgets are integrated into this website to display Trusted Shops services (e.g., quality seals, collected reviews) and to offer Trusted Shops products to buyers after they place an order.

The Trustbadge and the services advertised through it are provided by Trusted Shops SE, Subbelrather Str. 15C, 50823 Cologne (“Trusted Shops”), with whom we are joint controllers under Article 26 of the GDPR. In this Privacy Notice, we provide you with the following information regarding the essential terms of the agreement pursuant to Article 26(2) of the GDPR.

Within the framework of the joint responsibility existing between us and Trusted Shops SE, please contact Trusted Shops as your preferred point of contact for data protection questions and to exercise your rights, using the contact options provided in the privacy policy. Regardless of this, however, you may always contact the controller of your choice. Your inquiry will then be forwarded to the other controller, if necessary, for a response.

 Data Processing When the Trustbadge or Other Widgets Are Integrated

The Trustbadge is provided by a U.S.-based CDN (Content Delivery Network) provider. An adequate level of data protection is ensured in each case by an adequacy decision of the EU Commission, which is available here for the U.S. Service providers from the U.S. are generally certified under the EU-U.S. Data Privacy Framework (DPF). Further information is available here. If service providers used are not certified under the DPF, standard contractual clauses have been agreed upon as an appropriate safeguard.

When you access the Trustbadge, the web server automatically stores a so-called server log file that contains your IP address, the date and time of access, the amount of data transferred, and the requesting provider (access data), and documents the access. The IP address is anonymized immediately after collection, so that the stored data cannot be linked to you personally. The anonymized data is used primarily for statistical purposes and for error analysis.

 Data Processing After Order Completion

If you have given your consent, the Trustbadge accesses order information stored on your device (order total, order number, and, if applicable, the product purchased) as well as your email address after the order is completed, and your email address is hashed using a cryptographic one-way function. The hash value is then transmitted to Trusted Shops along with the order information in accordance with Art. 6(1)(a) of the GDPR.
This is used to verify whether you are already registered for Trusted Shops’ services. If this is the case, further processing takes place in accordance with the contractual agreement between you and Trusted Shops. If you are not yet registered for the services or do not give your consent to automatic recognition via the Trustbadge, you will then have the option to manually register for the services or to complete the verification process under the terms of any existing user agreement you may have.

For this purpose, after you complete your order, the Trustbadge accesses the following information stored on the device you are using: order total, order number, and email address. This is necessary so that we can offer you buyer protection. The data is not transmitted to Trusted Shops until you actively decide to complete the buyer protection process by clicking the button labeled accordingly in the so-called Trustcard. If you decide to use the services, further processing is governed by the contractual agreement with Trusted Shops pursuant to Art. 6(1)(b) GDPR in order to complete your registration for buyer protection, secure the order, and, if applicable, subsequently send you review invitations via email.

Trusted Shops uses service providers for hosting, monitoring, and logging. The legal basis is Article 6(1)(f) of the GDPR for the purpose of ensuring trouble-free operation. In this context, processing may take place in third countries (the U.S., the U.K., and Israel). An adequate level of data protection is ensured in each case by an adequacy decision of the European Commission, which is available here for the U.S., here for the United Kingdom, and here for Israel. Service providers from the U.S. are generally certified under the EU-U.S. Data Privacy Framework (DPF). Further information is available here. If service providers used are not certified under the DPF, standard contractual clauses have been entered into as an appropriate safeguard.

9. Social Media

 Our online presence on Facebook (by Meta), Instagram (by Meta), and YouTube

To the extent that you have given your consent pursuant to Art. 6(1)(a) of the GDPR to the respective social media operator, when you visit our online presences on the aforementioned social media platforms, your data will be automatically collected and stored for market research and advertising purposes, from which usage profiles are created using pseudonyms. These profiles may be used, for example, to display advertisements—both on and off the platforms—that are presumed to match your interests. Cookies are generally used for this purpose. For detailed information on the processing and use of your data by the respective social media operator, as well as contact information, your rights in this regard, and settings to protect your privacy, please refer to the providers’ privacy policies linked below. If you still need assistance with this, please contact us.

Facebook (by Meta) is a service provided by Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland (“Meta Platforms Ireland”). The information automatically collected by Meta Platforms Ireland regarding your use of our online presence on Facebook (by Meta) is generally transmitted to and stored on a server operated by Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025, USA. Data processing in connection with a visit to a Facebook (by Meta) fan page is based on an agreement between joint controllers pursuant to Article 26 of the GDPR. Further information (including information on Insights data) can be found here.

Our service providers are located in and/or use servers in the following countries for which the European Commission has determined, by decision, that an adequate level of data protection exists: Brazil, the United States, Canada, Japan, South Korea, New Zealand, the United Kingdom, and Argentina.

The adequacy decision for the United States serves as the basis for transfers to third countries, provided that the respective service provider is certified. Certification is in place.

Our service providers are located in and/or use servers in the following countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, and Mexico.
There is no adequacy decision by the European Commission for these countries. Our cooperation with them is based on the following safeguards: the European Commission’s Standard Data Protection Clauses.

Instagram (by Meta) is a service provided by Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland (“Meta Platforms Ireland”). The information automatically collected by Meta Platforms Ireland regarding your use of our online presence on Instagram is generally transferred to a server operated by Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA, and stored there. Data processing in connection with a visit to an Instagram (by Meta) fan page is based on an agreement between joint controllers pursuant to Art. 26 of the GDPR. Further information (including information on Insights data) can be found here.

Our service providers are located in and/or use servers in the following countries for which the European Commission has determined, by decision, that an adequate level of data protection exists: Brazil, the United States, Canada, Japan, South Korea, New Zealand, the United Kingdom, and Argentina.

The adequacy decision for the United States serves as the basis for transfers to third countries, provided that the respective service provider is certified. Certification is in place.

Our service providers are located in and/or use servers in the following countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, and Mexico.
There is no adequacy decision by the European Commission for these countries. Our cooperation with you is based on the following safeguards: the European Commission’s Standard Data Protection Clauses.

YouTube is a service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The information automatically collected by Google regarding your use of our online presence on YouTube is generally transmitted to and stored on a server operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Our service providers are located in and/or use servers in countries outside the EU and the EEA for which the European Commission has determined, by decision, that an adequate level of data protection exists.

Our service providers are located in and/or use servers in countries outside the EU and the EEA. No adequacy decision has been issued by the European Commission for these countries. Our cooperation with them is based on the European Commission’s Standard Data Protection Clauses. 

10. Contact Information and Your Rights

10.1 Your Rights

As a data subject, you have the following rights:

• pursuant to Art. 15 of the GDPR, the right to request information about your personal data processed by us to the extent specified therein;
• pursuant to Article 16 of the GDPR, the right to request, without undue delay, the rectification of inaccurate personal data or the completion of your personal data stored by us;
• pursuant to Article 17 of the GDPR, the right to request the erasure of your personal data stored by us, unless further processing
  • for the exercise of the right to freedom of expression and information;
  • to comply with a legal obligation;
  • for reasons of public interest; or
  • for the establishment, exercise, or defense of legal claims;
• Under Article 18 of the GDPR, you have the right to request the restriction of the processing of your personal data, provided that
  • you contest the accuracy of the data;
  • the processing is unlawful, but you oppose its erasure;
  • we no longer need the data, but you need it to assert, exercise, or defend legal claims; or
  • you have objected to the processing pursuant to Article 21 of the GDPR;
• pursuant to Article 20 of the GDPR, the right to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format, or to request that it be transmitted to another controller;
• pursuant to Article 77 of the GDPR, the right to lodge a complaint with a supervisory authority. As a general rule, you may contact the supervisory authority at your usual place of residence, your place of work, or our corporate headquarters.

10.2 Contact Information

If you have any questions regarding the collection, processing, or use of your personal data, or if you wish to request information, correction, restriction, or erasure of data, or to withdraw your consent or object to a specific use of your data, please contact us directly using the contact information provided in our legal notice.