Privacy Policy

I. General Information

If you have any questions or concerns regarding data protection, you can contact us as the data controller or our data protection officer at any time.

1. Name and address of the controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) is

Model Car World GmbH
Boettgerstraße 14
65439 Flörsheim
Germany

Phone: +49 (0) 6145 3501-0
Email: [email protected]

and its subsidiaries, the …

BB Services GmbH
Boettgerstraße 14
65439 Flörsheim
Germany

Phone: +49 (0) 6145 3501-100
Email: [email protected]

BREKINA Model Toys GmbH
Zeppelinstr. 8
79331 Teningen
Germany

Phone: +49 7663 93270
Email: [email protected]

Speidel Replicars GmbH
Hafnerstr. 59
72131 Ofterdingen
Germany

Phone: +49 (0) 74 73 - 922 209 0
Email: [email protected]

hereinafter referred to as the Group.

2. Contact Information for the Data Protection Officer

For questions regarding data protection, inquiries, and/or further information about the Group's data processing, please contact our Data Protection Officer:

TÜV SÜD Akademie GmbH
Data Protection Consulting Services Division
Westendstraße 160
80339 Munich

Email: [email protected], [email protected]

3. Supervisory Authority

If you believe that the processing of your personal data by the corporate group has not been carried out properly, you have the right to contact a supervisory authority in the Member State of your residence, your workplace, or the location of the alleged infringement. The competent supervisory authority pursuant to Art. 55 of the GDPR is …

The Hessian Commissioner for Data Protection and Freedom of Information

Prof. Dr. Alexander Roßnagel

P.O. Box 31 63
65021 Wiesbaden

Gustav-Stresemann-Ring 1
65189 Wiesbaden

Phone: 06 11/140 80
Email: [email protected]
Website: https://www.datenschutz.hessen.de

II. General Information on Data Processing

1. General Information on Data Processing and Scope of Application

In general, the Group processes your personal data in order to provide the content and services necessary for the proper functioning of the website. We collect your personal data when you create an account with us. This Privacy Policy applies to all pages of our website.

2. Definitions

a) Definitions pursuant to Art. 4 GDPR:

Personal data: any information relating to an identified or identifiable natural person; A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. Examples include contact data, communication data, and billing data.

Processing: any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or any other form of making available, alignment or combination, restriction, erasure, or destruction

Controller: the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Recipient: a natural or legal person, public authority, agency, or other body to whom personal data is disclosed, regardless of whether or not they are a third party.

Third party: a natural or legal person, public authority, agency, or other body, other than the data subject, the controller, the processor, and the persons who, under the direct responsibility of the controller or the processor, are authorized to process the personal data.

Profiling: any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person. In particular, to analyze or predict aspects concerning that natural person's work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

Restriction of processing: the marking of stored personal data with the aim of restricting its future processing.

b) „Need-to-know principle":

· Every employee who processes data should only be able to access those data sets and run those programs that they actually need for their tasks

3. Legal Basis for the Processing of Your Data

The legal basis for the processing of your personal data is derived from Article 6(1) of the EU General Data Protection Regulation (GDPR).

a) In cases where your consent is required for the processing of your personal data, this is based on Article 6(1)(a) of the GDPR.

b) If the processing of your personal data is necessary for the performance of a contract or for pre-contractual measures, Article 6(1)(b) of the GDPR serves as the legal basis.

c) Article 6(1)(c) of the GDPR serves as the legal basis for the processing of your personal data to fulfill legal obligations on the part of the corporate group.

d) To protect vital interests, Article 6(1)(d) of the GDPR serves as the legal basis;

e) and Article 6(1)(e) of the GDPR applies to public interests.

f) If the processing of personal data is necessary to safeguard the legitimate interests of the corporate group or other third parties, and the interests, fundamental rights, and freedoms of the data subjects do not override those interests, Article 6(1)(f) of the GDPR serves as the legal basis.

The existence of legitimate interests may arise in the context of providing the service; this includes direct marketing measures, direct communication with website users, and technical support provided as needed.

Furthermore, these may also arise in the context of internal processes such as the handling of administrative tasks or ensuring the proper operation of the websites

Finally, these also arise from efforts within the corporate group to achieve synergy effects by providing various services centrally

g) If you are applying for a position as an employee, the legal basis is Article 88(1) of the General Data Protection Regulation (GDPR) in conjunction with Section 26(1), first sentence, of the Federal Data Protection Act (BDSG). To the extent that the data constitutes special categories of personal data (such as data regarding your health) that you provide to us yourself (for example, information regarding a severe disability), processing is carried out on the legal basis of Article 9(2)(b) of the GDPR in conjunction with Section 26(3) of the BDSG.

4. Categories of Recipients

Employees of the corporate group in accordance with the "need-to-know" principle
Service providers who support the corporate group in all areas (Assurance, Business Development, IT, Operations, HR, and Finance)
Social networks, if applicable

5. Description of the data and the purpose of processing

We process the following personal data:

Data for access management (login credentials)
e.g., email address, password [in encrypted form, so that no employee has access to your personal password]

Purpose:

To use and operate the website

Provision of customer support, regardless of the chosen form of contact (email correspondence, telephone contact, etc.).

Legal basis: Art. 6(1)(b) GDPR

User data
such as your display name, email address

Purpose:

To use and operate the website.

Providing customer support, regardless of the chosen contact method (email correspondence, telephone contact, etc.).

To comply with legal provisions, regulatory obligations, or to respond to inquiries from government agencies. Primarily financial law-related inquiries.

To protect the corporate group and the rights of this company, as well as the rights of affiliated parties. Furthermore, the recording and disclosure of data may be necessary to: (a) protect your and public safety and privacy; (b) protect our legal rights, our security, or our property; or (c) minimize our risk or that of affiliated parties.

Also for your and our security, to improve the services and functionality of the website. This includes surveys, your voluntary feedback, the reporting of potential malfunctions, or information from service providers and partners.

For the purpose of conducting marketing communications by the corporate group, which is based on your voluntary consent to the transmission of registration or login data. Marketing communications include communication via email, telephone, or postal mail.

Legal basis: Art. 6(1)(b), (c), (f) GDPR

Registration data
such as whether you have registered your phone number for SMS communication

Purpose:

Compliance with the Terms and Conditions for this platform.

To comply with legal provisions, regulatory obligations, or to respond to inquiries from government agencies. Primarily financial law-related inquiries.

Also for your and our security, to improve the services and functionality of the website. This includes surveys, your voluntary feedback, reporting potential malfunctions, and training our employees or service providers and partners.

For the purpose of transferring assets, in the event that we sell and/or merge the company or assets, in whole or in part.

Legal basis: Art. 6(1)(b), (c), (f) GDPR

Device data
such as device ID, operating system

Purpose:

Providing customer support, regardless of the chosen method of contact (email, phone, etc.).

Legal basis: Art. 6(1)(b), (f) GDPR

Network data
such as IP address, referrer (the originating website through which the user arrived at the current website or file)

Purpose:

For the use and operation of the website

To comply with legal provisions, regulatory obligations, or to respond to inquiries from government agencies. Primarily financial law-related inquiries.

For the purpose of conducting marketing communications for the corporate group, which is based on voluntary consent or agreement to the transmission of registration or login data. This may be general in nature or tailored to the customer based on user behavior and activity data. Marketing communications include communication via email, SMS, and telephone, or via chat messages, possibly also through messaging services of third-party providers, or by mail.

Legal basis: Art. 6(1)(b), (c), (f) GDPR

Location data
such as country of origin, language

Purpose:

To use and operate the website

Providing customer support, regardless of the chosen contact method (email correspondence, telephone contact, etc.).

Legal basis: Art. 6(1)(b), (c), (f) GDPR

Personally identifiable data
such as address, date of birth

Purpose:

To enable order processing

Assignment of a customer number

For the use and operation of the website

For the purpose of age verification, fraud prevention, and anti-money laundering.

Compliance with the Terms and Conditions for this platform.

Provision of customer support, regardless of the chosen form of contact (email correspondence, telephone contact, etc.).

To comply with legal provisions, regulatory obligations, or to respond to inquiries from government agencies. Primarily financial law inquiries.

To protect the corporate group and the rights of this company, as well as the rights of affiliated parties. Furthermore, the recording and disclosure of data may be necessary to: (a) protect your safety and privacy as well as public safety and privacy; (b) protect our legal rights, our safety, or our property; or (c) minimize our risk or that of affiliated parties.

For the purpose of conducting marketing communications for the corporate group, which is based on your voluntary consent to the transmission of registration or login data. Marketing communications include communication via email, SMS, and telephone, or via chat messages, possibly also through third-party messaging services, or by mail.

To conduct the application process and establish an employment relationship

Legal basis: Art. 6(1)(b), (c), (f) GDPR; in the case of a job application, Art. 88(1) GDPR in conjunction with § 26(1) sentence 1 BDSG

Partner information
such as advertising banners that you clicked on to reach us

Purpose:

Also for your and our security, to improve the services and functionality of the website. This includes surveys, your voluntary feedback, the reporting of potential malfunctions, and training for our employees or service providers and partners.

For the purpose of conducting marketing communications for the corporate group, which is based on voluntary consent or agreement to the transmission of registration or login data. This may be of a general nature or tailored to the customer based on user behavior and activity data. Marketing communications include communication via email and telephone or by mail.

Legal basis: Art. 6(1)(f) GDPR

6. Data Retention Period and Data Deletion

The Group generally deletes your personal data once the purpose for which it was stored no longer applies. The data mentioned above is mandatory for the use and operation of the website, as well as for compliance with the Terms and Conditions. However, it is possible that further storage may be required under European or national laws, regulations, or other provisions to which the Group is subject. Such data will only be deleted once the applicable retention periods, as determined by the aforementioned legal sources, have expired. The only exception to this is if the stored data is necessary for the performance of a contract or the conclusion of a contract. For example, retention periods of up to ten years are legally required for certain data due to tax law provisions.

7. Where is the data processed?

In the case of Model Car World, your data is processed in data centers located within the European Union.

In the case of BB Services, the server is located in the United States (Silicon Valley, California) until the end of September 2024. After that, this data will also be migrated to a server within the European Union

III. Information on the necessary data processing and transfer

1. Group

All collected and personal data is made available within the Group as well as to partner companies in accordance with the "need-to-know" principle.

a) Description and scope of data processing
All data processed, including during website visits, and listed in the relevant sections of this privacy policy is made available to both companies within the group for the purposes described below:

b) Legal basis for data processing
Article 6(1)(f) of the GDPR and, consequently, our legitimate interest in being able to offer you our services in full, on an ongoing basis, and in line with the latest trends, constitutes the legal basis for data processing.

c) Purpose of data processing
The website itself and the products offered are provided through collaboration within the corporate group. For this purpose, it is necessary that all personal data, as well as data collected via cookies, for example, be available to all companies at all times. Only in this way is it possible to carry out necessary work, e.g., on the website's programming code, and to ensure it functions smoothly for all customers. For example, information regarding the number of customers logged in and active at any given time is relevant to the corporate group so that adjustments can be made to current server capacities if necessary. Furthermore, information such as the browser types that prospects and customers prefer to use when accessing our offerings is also important so that, if necessary, the relevant employees can make programming adjustments in anticipation of upcoming browser updates.

d) Duration of storage
As soon as certain stored data must be deleted at or at a group company, it will also be permanently removed from the other company.

e) Right to withdraw consent, object, and request erasure
For personal data processed in connection with Art. 6(1)(a) GDPR and thus based on the customer's consent, a withdrawal of consent is sufficient to prohibit further processing. For data processed in connection with Art. 6(1)(b) GDPR and thus on a contractual basis, termination of the usage agreement concluded with the company to terminate data processing. To terminate the processing of data carried out in accordance with Article 6(1)(f) of the GDPR, the customer must object with future effect.

2. Hosting of Our Website

When you visit the website, certain information is automatically generated and stored, including on the pages of the corporate group.

When you visit our website, our web server (the computer on which this website is hosted) automatically stores data such as

the address (URL) of the accessed webpage
browser and browser version
the operating system used
the address (URL) of the previously visited page (referrer URL)
the hostname and IP address of the device from which the site is accessed
Date and time

in files (web server log files).

We generally delete the data in web server log files at regular intervals—the exact time depends on the respective configuration rules. These may be time- or size-based.

We do not share this data, but cannot rule out the possibility that it may be accessed in the event of unlawful conduct.

3. Contact Form and Email Contact

a) Description and scope of data processing
The Group's websites contain contact forms. When a customer uses this method to contact us, entering data into the form results in the transmission and storage of this data not only by the contacted company but also by the partner company. This initially includes contact details (email, first and last name, phone number), the inquiry (subject and message), and the IP address.

Alternatively, you can contact us via email. In this case as well, the customer's personal data transmitted via email will be stored.

In both cases, the data is not disclosed to third parties. The data is used by the corporate group exclusively for communication with the customer.

b) Legal basis for data processing
The data sent via the contact form or by email is stored and used for the purpose of processing customer inquiries or for establishing contact and the associated technical administration. The legal basis for processing this data is the corporate group's legitimate interest in responding to customer inquiries pursuant to Art. 6(1)(f) GDPR.

If the customer's contact is aimed at concluding a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR.

c) Purpose of data processing
The purpose of both the contact form and the use of the email address is to offer visitors, prospective customers, or customers a simple and convenient way to establish direct contact with the corporate group. The initial aim is to answer questions or, if necessary, to initiate pre-contractual measures.

d) Duration of storage
As soon as the dialogue with the customer is concluded—i.e., when it is clear to both parties that there is no longer a need for clarification and the purpose of the collection has thus been achieved—the data will be deleted. Deletion will only be withheld if statutory retention periods preclude it.

e) Right to withdraw consent, object, and request erasure
The customer may revoke their consent to the processing of their data at any time. To do so, they may also use the contact form or the email address provided. In this case, the dialogue will be terminated immediately.

4. Service Providers

Description and scope of data processing
The Group works with a number of external service providers who perform services or process data on its behalf (data processing). They carry out processing activities in all departments (Assurance, Business Development, IT, Operations, HR, and Finance). These service providers or data processors are listed in a regularly updated list, which is available upon reasonable request.

1. Legal basis for data processing
Article 6(1)(b) of the GDPR, and thus the fulfillment of the contracts existing between the customers, the Group, and the listed service providers or processors, constitutes the legal basis for data processing.

2. Purpose of data processing
It is only possible to provide the individual services to customers through the transmission of personal data.

3. Duration of storage
The listed service providers, as well as the corporate group, will delete your personal data after the successful completion of the agreed-upon service, provided that no legal obligations require a longer retention period.

5. Google Fonts

a) Description and scope of data processing
Google Fonts is integrated into some of the Group's websites. When these websites are loaded, a connection to Google's servers may be established, causing the browser of the user visiting the site to transmit various data to Google. This includes, among other things, browser and device data, as well as the user's IP address, which constitutes personal data. Consequently, the integration of Google Fonts may result in the transmission of personal data to Google's servers in the United States.

b) Legal basis for data processing
Art. 6(1)(f) GDPR and thus our legitimate interest in search engine optimization, improved loading times, reduced administrative effort, and a consistent cross-device display.

c) Purpose of data processing
The processing serves to enable the simple and consistent integration of a large number of fonts on the website. Additionally, we aim to achieve a visually appealing presentation for you.

6. Google Tag Manager

a) Description and scope of data processing
Google Tag Manager is integrated into the Group's websites. When you access our website via this service, additional personal data is processed. Categories of data processed: technical connection data related to server access (IP address, date, time, page accessed, browser information). Purpose of processing: to trigger, control, and manage additional services on our website. Data is transferred to: the data processor Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This may also involve the transfer of personal data to a country outside the European Union. The transfer of data to the U.S. is based on Art. 45 GDPR in conjunction with the European Commission's Adequacy Decision C(2023) 4745, as the data recipient has committed to complying with the data processing principles of the Data Privacy Framework (DPF).

b) Legal basis for data processing
Article 6(1)(f) of the GDPR and thus our legitimate interest in the secure and functional operation of technical systems, as well as compliance with legal and contractual obligations.

c) Purpose of data processing
The purpose of the processing is to trigger, control, and manage additional services on our website.

7. Google Analytics / Google Analytics E-Commerce Measurement

a) Description and scope of data processing
Google Analytics is integrated into the websites of the corporate group. When accessing our website via this service, additional personal data is processed. Data categories processed in this context: technical connection data from server access (IP address, date, time, page accessed, browser information) and data regarding website usage, as well as the logging of clicks on individual elements. In connection with Google Analytics, we also use the "E-commerce Tracking" feature. With the help of E-commerce Tracking, the website operator can analyze the purchasing behavior of website visitors to improve their online marketing campaigns. This involves collecting information such as orders placed, average order values, shipping costs, and the time from viewing to purchasing a product. Google may aggregate this data under a transaction ID assigned to the respective user or their device. Data is transferred to: the independent data controller Google LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA. The legal basis for the data transfer to Google LLC is [...]. A transfer of personal data to a country outside the European Union is also conceivable. The transfer of data to the U.S. is based on Art. 45 GDPR in conjunction with the European Commission's Adequacy Decision C(2023) 4745, as the data recipient has committed to complying with the data processing principles of the Data Privacy Framework (DPF).

b) Legal basis for data processing
Your consent pursuant to Art. 6(1)(a) GDPR.

c) Purpose of data processing
The purpose of the processing is to analyze user behavior and optimize content.

8. Google Ads

a) Description and scope of data processing
Google Ads is integrated into the Group's websites. Google Ads enables the corporate group to display advertisements in the Google search engine or on third-party websites when the user enters specific search terms into Google (keyword targeting). Furthermore, targeted advertisements can be displayed based on user data available to Google (e.g., location data and interests) (audience targeting). To enable companies to measure the success of their Ads campaigns, Google places a cookie on their website. This cookie reads and stores the IP address as well as the interactions of users who have arrived at the company's site via an ad.

b) Legal basis for data processing
Your consent pursuant to Art. 6(1)(a) GDPR.

c) Purpose of data processing
Google Ads is Google's online advertising program. It allows you to create online ads to reach users at the exact moment they show interest in your products or services. As the website operator, the corporate group can quantitatively evaluate this data by, for example, analyzing which search terms led to the display of the ads and how many ads resulted in corresponding clicks.

9. Google Ads Remarketing

a) Description and Scope of Data Processing
The Group's websites use the features of Google Ads Remarketing. With Google Ads Remarketing, we can assign individuals who interact with our online offerings to specific target groups in order to subsequently display interest-based advertising to them on the Google advertising network (remarketing or retargeting). It should be noted that remarketing differs from web tracking (e.g., Google Analytics, see above). With web tracking, a user's activity on a single website can be tracked (first-party tracking). With remarketing, a user's activity can be tracked across various websites (third-party tracking).

b) Legal basis for data processing
Your consent pursuant to Art. 6(1)(a) GDPR.

c) Purpose of data processing
With Google Ads Remarketing, we can assign individuals who interact with our online offering to specific target groups in order to subsequently display interest-based advertising to them on the Google Display Network (remarketing or retargeting).

10. Google Conversion Tracking

a) Description and scope of data processing
The websites of the corporate group use Google Conversion Tracking. With the help of Google Conversion Tracking, Google and the corporate group can determine whether the user has performed certain actions. For example, the corporate group can evaluate which buttons on the website are clicked and how often, and which products were viewed or purchased particularly frequently.

b) Legal basis for data processing
Your consent pursuant to Art. 6(1)(a) GDPR.

c) Purpose of data processing
This information is used to generate conversion statistics. The corporate group learns the total number of users who clicked on the corporate group's ads and what actions they performed.

11. Meta Pixel (formerly Facebook Pixel)

a) Description and scope of data processing
Meta Pixel is integrated into the Group's websites. When you access our website via this service, additional personal data is processed. The categories of data processed include data regarding website usage and the logging of clicks on individual elements.

b) Legal basis for data processing
Your consent pursuant to Art. 6(1)(a) GDPR.

c) Purpose of data processing
The purpose of the processing is to examine usage behavior, analyze the effectiveness of online marketing measures, and select online advertisements on other platforms, which are automatically selected via real-time bidding based on usage behavior.

12. Klar

a) Description and scope of data processing
We use the services of Klar (Klar Insights GmbH, Marktstr. 18, 80802 Munich, Germany) on our website. Klar collects, processes, and stores data on this website and its subpages for statistical analysis on our behalf.

b) Legal basis for data processing
Your consent pursuant to Art. 6(1)(a) of the GDPR.

c) Purpose of data processing
We use Klar to evaluate your use of the website, to compile reports on activities within this website, and to provide other services related to website usage, thereby improving user-friendliness.

13. Newsletter distribution via Klaviyo

a) Description and scope of data processing
You have the option to subscribe to a newsletter on the corporate group's website; upon entering your information in the form, your data will be transmitted to the data controller. This includes the following data: last name, first name, email address, IP address of the subscriber's computer, date and time of registration. When you subscribe to the newsletter, your email address is stored and used for our own advertising purposes until you unsubscribe from the newsletter. You can unsubscribe at any time by clicking the unsubscribe button in the newsletter. Subscription to our newsletter is handled via a so-called double opt-in procedure. This means that after signing up, you will receive an email asking you to confirm your subscription. This confirmation is necessary to ensure that no one can sign up using someone else's email address. When you subscribe to the newsletter, the user's IP address as well as the date and time of registration are stored. This is done to prevent misuse of the services or the data subject's email address. The Group's email newsletters are sent via the technical service provider Klaviyo, to which the Group forwards the data you provided when signing up for the newsletter. Please note that your data is generally transferred to a Klaviyo server in the U.S. and stored there. Klaviyo uses this information to send the newsletters on behalf of the corporate group. Klaviyo does not use the data of the corporate group's newsletter recipients to contact them directly or to pass it on to third parties.

b) Legal basis for data processing
The legal basis, provided the user has given consent, is Article 6(1)(a) of the GDPR. This consent must be present not only at the time of the user's registration but also during the processing of the data following registration for the newsletter. This means that the measurement of open rates and click-through rates, as well as the storage of the measurement results in user profiles and their further processing, are also based on the user's consent.

c) Purpose of data processing
The processing of personal data is carried out for the purpose of sending our regular newsletter as well as for our own marketing purposes.

14. Direct email marketing for existing customers

a) Description and scope of data processing
If you have placed an order with us, we process the email address you provided during registration to recommend products that complement the products you have purchased. However, such a newsletter will be sent without your express consent "only" if

we have received your email address as a customer in connection with the sale of a product or service,
we are advertising only our own similar goods or services,
you, as a customer, have not objected to this use, and
you, as a customer, were informed of your right to object when your address was collected and each time it was used.

The email newsletters of the corporate group are also sent via the technical service provider Klaviyo (see above).

b) Legal basis for data processing
For existing customers, direct marketing may be based on a legitimate interest of the controller or a third party pursuant to Art. 6(1)(f) GDPR, as Recital 47, sentence 7 explicitly cites direct marketing as a legitimate interest. The advertising must then be necessary in the interest of the company or a third party, and no interests of the recipient of the advertising may conflict with this interest to the extent that they outweigh it. In this balancing of interests, consideration must be given to what a reasonable recipient can and typically expects.

c) Purpose of Data Processing
The processing of personal data is carried out for the purpose of sending our regular newsletters as well as for our own marketing purposes.

15. Microsoft Ads

a) Description and scope of data processing
Microsoft Ads is integrated into the Group's websites. Microsoft Ads enables the Group to display advertisements in Microsoft search engines or on third-party websites when the user enters specific search terms into Microsoft (keyword targeting). Furthermore, targeted advertisements can be displayed based on user data available to Microsoft (e.g., location data and interests) (target group targeting). To enable us to measure the success of the ad campaign, Microsoft sets cookies when you arrive on our website by clicking on an advertisement. This cookie reads and stores the IP address as well as the interactions (e.g., product views or saving a product to a wish list) of users who have arrived at the company's website via an advertisement. This also allows us to track whether the user has performed certain actions, such as making a purchase.

b) Legal basis for data processing
Your consent pursuant to Art. 6(1)(a) GDPR.

c) Purpose of data processing
Microsoft Ads is Microsoft's online advertising program. It is used to create online ads to reach users at the exact moment they show interest in our products or services. The corporate group, as the website operator, can quantitatively evaluate this data by, for example, analyzing which search terms led to the display of the ads and how many ads resulted in corresponding clicks and purchases.

16. Microsoft Clarity

a) Description and Scope of Data Processing
Microsoft Clarity is integrated into the Group's websites. Microsoft Clarity enables the Group to record (with input fields masked) and analyze user sessions. To do this, Microsoft Clarity uses cookies and enables an analysis of user behavior using a pseudonymous user ID. In the process, pseudonymous data such as mouse movements and performance data are analyzed. The data processed includes usage data (pages visited in our web shop, interests, access times), meta/communication data (device information, IP addresses), location data (geographic position of devices or individuals), and movement data (mouse and scroll movements) in pseudonymized form. Data collection is already performed in a pseudonymized manner by Microsoft, in particular through IP masking. This data processing affects all users of our web shop who have consented to its use via our cookie consent service.

b) Legal basis for data processing
Your consent pursuant to Article 6(1)(a) of the GDPR.

c) Purpose of data processing
Microsoft Clarity is used on the website for optimization and analysis purposes. The corporate group may evaluate recorded sessions to identify and correct errors on the website and to improve the user experience.

17. consentmanager.net

a) Description and scope of data processing
This website uses consentmanager.net (Eppendorfer Weg 183, 20253 Hamburg, Germany) to manage your consent. A cookie is set to store your consent or its revocation. This processing is based on a legal obligation to provide evidence of your consent to certain cookies and tracking measures. This ensures that cookies and services, as well as related analytics and tracking tools, are activated in accordance with your preferences. These settings can be adjusted at any time via the "Cookie Settings" option at the bottom of the website. The data processed includes, among other things, the cookie ID, your consent status, your IP address, and the time.

b) Legal basis for data processing
The legal basis for the processing is Article 6(1)(c) of the GDPR in conjunction with Article 7(1) of the GDPR, insofar as the processing serves to fulfill the legally prescribed obligations to provide evidence of consent. In all other cases, Article 6(1)(f) of the GDPR is the applicable legal basis. Our legitimate interests in the processing lie in the storage of user settings and preferences regarding the use of cookies and the evaluation of consent rates.

c) Purpose of data processing
In order to provide the essential function of a consent banner on the website, the corporate group uses the provider consentmanager.net. This technology ensures that users can configure individual settings and that only the accepted services are activated.

18. Amira

a) Description and scope of data processing
We use Amira AI to support our customer communication. It is used for clearly defined service purposes and supports the handling of inquiries via various communication channels. Amira AI is used in customer service in three clearly defined ways: chat/text, text/email support, and outbound calls. In the chat and text area, Amira AI automatically answers recurring customer inquiries based on predefined content. In text and email support, Amira AI analyzes incoming inquiries, classifies them, and generates structured response suggestions. Outbound telephony enables automated information sharing, appointment inquiries, or structured pre-qualification.

b) Legal basis for data processing
Your consent pursuant to Art. 6(1)(a) GDPR.

c) Purpose of data processing
The aim is, on the one hand, to process customer inquiries quickly, efficiently, and in a structured manner and, on the other hand, to specifically reduce the workload on employees.

19. Trustpilot widget

a) Description and scope of data processing
We use a widget from the review service "Trustpilot" (hereinafter "Trustpilot") on our website, provided by Trustpilot A/S, Pilestræde 58, 1112 Copenhagen, Denmark. The Trustpilot widget allows us to display customer reviews and give users the opportunity to submit their own reviews. When you visit a page that contains a Trustpilot widget, a connection is established with Trustpilot's servers. In doing so, technically necessary data is transmitted to Trustpilot, in particular the IP address, information about the device used, browser type, and, if applicable, other access data. If you have a Trustpilot account and are logged in to Trustpilot while visiting our website, Trustpilot can associate your visit with your user account. In addition, Trustpilot may use cookies or similar technologies to ensure the functionality of the widget, evaluate user interactions, and control the display of reviews. Any Trustpilot-related cookies are listed separately in our general cookie notice.

b) Legal basis for data processing
Your consent pursuant to Art. 6(1)(a) GDPR.

c) Purpose of data processing
The Trustpilot widget is integrated to:

display customer reviews transparently on our website, strengthen trust in our company and our offerings,
improve the quality of our products and services based on customer feedback, and
promote our public image and our economic success.

20. ABlyft

a) Description and Scope of Data Processing
We use the A/B testing service "ABlyft" (hereinafter "ABlyft") on our website. With the help of ABlyft, we present different versions of our website (e.g., different texts, buttons, or page layouts) to various visitor groups and then evaluate which version is better received by users. The goal is to continuously optimize our website and its user-friendliness. To this end, a script provided by ABlyft is loaded when our website is accessed. It is important to note that, for technical reasons, a visitor's IP address is transmitted. It should be emphasized that this information is neither stored by ABlyft nor used for any purpose, but is simply ignored or discarded. The data stored by ABlyft is evaluated exclusively in aggregated or statistical form. In particular, no permanent personal identifiers such as full IP addresses or directly assignable user IDs are stored; no individual user profiles are created. To the extent that cookies or comparable technologies are used in the context of A/B tests (e.g., to ensure that a visitor always sees the same variant during the duration of a test), this is done exclusively to the extent of the information technically required for this purpose. Any cookies related to ABlyft are listed separately in our general cookie notice.

b) Legal basis for data processing
Your consent pursuant to Art. 6(1)(a) GDPR.

c) Purpose of data processing
The purpose of the processing is to conduct A/B tests and statistically analyze user behavior on our website in order to:

continuously improve the user experience, content, and design of our website,
increase the usability and performance of the website,
better tailor our offerings and content to users' needs, and
optimize the conversion rate (e.g., orders, inquiries, newsletter sign-ups) and thereby the economic operation of our online offering.

21. Google Ads Customer Match

a) Description and scope of data processing
We use Google Ads Customer Match lists as part of our Google advertising activities. To use Customer Match, lists containing encrypted user data (e.g., names, email addresses, physical addresses, customer-specific identifiers) are uploaded to Google. Google then compares the submitted user data to see if it matches existing Google customers. Once the Customer Match lists have been created, the encrypted customer data is automatically deleted. This means that providers do not gain access to new addresses.

b) Legal basis for data processing
Your consent pursuant to Art. 6(1)(a) GDPR.

c) Purpose of data processing
Target groups are created to help you tailor your ads and campaigns more precisely.

22. Endereco

a) Description and scope of data processing
We use the "Endereco" plugin in our online stores, which allows users to check certain entries in the address forms for errors in real time (address validation). In addition to the address, the email address and phone number are also processed.

b) Legal basis for data processing
The legal basis for the transmission, processing, and temporary storage of data by the service provider is Article 6(1)(b) of the GDPR, as it is strictly necessary for the performance of the contract or for the implementation of pre-contractual measures that some of the data you enter into the input form be checked for accuracy.

c) Purpose of data processing
This is intended to prevent problems with the delivery of the products you have ordered due to incorrect information. Furthermore, we wish to ensure that your contact information remains valid for sending information regarding your order or for any necessary follow-up inquiries.

IV. Information about the protection of your data and your rights

1. Your rights as a data subject

a) Right of access (Art. 15 GDPR): You have the right to be informed whether and which of your personal data we process. In accordance with the GDPR, we will provide you with a summary of your personal data upon request. Under the GDPR, we have a 30-day period to respond to your request for information.
b) Right to rectification (Art. 16 GDPR): If you inform us that the data we process about you is incorrect or incomplete, we will correct it immediately upon verification.
c) Right to erasure (Art. 17 GDPR): We will erase personal data immediately upon request, provided that none of the grounds listed in Art. 17 GDPR prevent us from doing so. Erasure can only take effect for the future.
d) Right to restriction of processing (Art. 18 GDPR): If you so desire, we will restrict the processing of your data provided that one of the conditions specified in this provision applies.
e) Right to Notification (Art. 19 GDPR): We will notify recipients (e.g., data processors) of personal data of any requests received, provided that we have received a request to correct, restrict, or delete your personal data.
f) Right to data portability (Art. 20 GDPR): Upon request, we will provide your data in a commonly used, machine-readable format and transfer your personal data to another controller upon request.
g) Right to Object (Art. 21 GDPR): You may also object to the processing of your personal data if it is based on specific legal grounds (e.g., Art. 6(1)(e) or (f) GDPR), provided there is a justification within the meaning of this provision.
h) Right to Withdraw Consent (Art. 7 GDPR): You have the right to withdraw the consent(s) you have given at any time pursuant to Art. 6(1)(a) GDPR with effect for the future.
i) Right regarding automated decision-making (Art. 22 GDPR): You have the right not to be subject to a decision based solely on automated processing—including profiling.
j) Right to lodge a complaint with supervisory authorities (Art. 77 GDPR): If you believe that the processing of your data violates the provisions of the GDPR or that your data protection rights have otherwise been infringed, you may contact your competent data protection authority (see Section I 3 above) or another supervisory authority at any time. - An overview of supervisory authorities in the Federal Republic of Germany can be found at:
https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html

2. International Data Transfer

In principle, recipients of personal data must be located in the European Union (EU) or the European Economic Area (EEA). In certain exceptional cases, it is permissible to transfer personal data to a third country. Third countries are states outside the European Economic Area, i.e., outside the European Union and outside Iceland, Liechtenstein, and Norway. Personal data may generally only be transferred to a country outside the European Union if an adequate level of data protection is ensured there. Unless the European Commission has determined adequacy through a corresponding decision, a transfer may only take place if appropriate safeguards are in place. Adequacy decisions within the meaning of Art. 45 GDPR certify that third countries have an adequate level of data protection. In such cases, personal data may be transferred to that country on the basis of a legal basis without further measures.

As described above (Section II 7), data is transferred both within the EU and to the United States.

V. Information on Cookies and Social Media Plugins

Detailed information about the cookies and plugins used on the Group's websites, as well as their use and storage and/or how you can object to them, can be found in our Cookie Policy.

VI. Changes to this Privacy Policy

This Privacy Policy may be amended due to new legal requirements. Therefore, the Group recommends that users review this Privacy Policy regularly for any changes and/or additions.