Privacy Policy

General Information on the Legal Basis for Data Processing on This Website
If you have given your consent to data processing, we process your personal data on the basis of Article 6(1)(a) GDPR or, where special categories of personal data pursuant to Article 9(1) GDPR are processed, on the basis of Article 9(2)(a) GDPR. If you have expressly consented to the transfer of personal data to third countries, such processing is also based on Article 49(1)(a) GDPR. If you have consented to the storage of cookies or to access information on your end device (e.g., via device fingerprinting), data processing is additionally based on Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). You may withdraw your consent at any time with effect for the future.

Where your data is required for the performance of a contract or to carry out pre-contractual measures, we process your data on the basis of Article 6(1)(b) GDPR. Furthermore, we process your data where necessary to comply with a legal obligation pursuant to Article 6(1)(c) GDPR. Data processing may also be carried out on the basis of our legitimate interests pursuant to Article 6(1)(f) GDPR. The specific legal basis applicable in each individual case is explained in the relevant sections of this Privacy Policy.

Information on Data Transfers to Third Countries and Non-DPF-Certified U.S. Companies
Among other things, we use tools provided by companies located in third countries that do not provide an adequate level of data protection under applicable data protection laws, as well as U.S.-based service providers whose providers are not certified under the EU-U.S. Data Privacy Framework (DPF). If these tools are active, your personal data may be transferred to and processed in these countries.

Please note that an adequate level of data protection comparable to that of the European Union cannot be guaranteed in third countries that do not provide adequate protection. We also note that the United States is generally considered to provide an adequate level of protection where the recipient is certified under the EU-U.S. Data Privacy Framework (DPF) or provides other appropriate safeguards. Further information on international data transfers, including the recipients of your data, can be found in this Privacy Policy.

Recipients of Personal Data
As part of our business operations, we cooperate with various external service providers. In some cases, this requires the transfer of personal data to these external parties.

We only disclose personal data where this is necessary for the performance of a contract, where we are legally required to do so (e.g., disclosure to tax authorities), where we have a legitimate interest pursuant to Article 6(1)(f) GDPR, or where another legal basis permits such disclosure.

When using data processors, we only transfer our customers’ personal data on the basis of a valid Data Processing Agreement (DPA). Where processing is carried out jointly with another controller, a Joint Controller Agreement is concluded.

Withdrawal of Your Consent to Data Processing
Many data processing operations are only possible with your explicit consent. You may withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Right to Object to Data Processing in Certain Cases and to Direct Marketing (Article 21 GDPR)
Where your personal data is processed on the basis of Article 6(1)(e) or Article 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data. This also applies to profiling based on these provisions. The applicable legal basis for the processing can be found in this Privacy Policy.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or unless the processing serves the establishment, exercise, or defence of legal claims (Article 21(1) GDPR).

Where your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes. This also applies to profiling to the extent that it is related to such direct marketing. If you object, your personal data will no longer be used for direct marketing purposes (Article 21(2) GDPR).

Right to Lodge a Complaint with the Supervisory Authority
In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, particularly in the Member State of their habitual residence, place of work, or the place of the alleged infringement. This right exists without prejudice to any other administrative or judicial remedies.

Right to Data Portability
You have the right to receive the personal data that we process automatically on the basis of your consent or in the performance of a contract in a structured, commonly used, and machine-readable format. Where technically feasible, you also have the right to request that these data be transmitted directly to another controller.

Right of Access, Rectification and Erasure
Within the framework of the applicable legal provisions, you have the right at any time to obtain free information about your stored personal data, its origin, the recipients of the data, and the purpose of the processing. You also have the right to request the rectification or erasure of your personal data where applicable. You may contact us at any time if you have further questions regarding personal data.

SSL/TLS Encryption
For security reasons and to protect the transmission of confidential content, such as orders or inquiries that you send to us as the website operator, this website uses SSL/TLS encryption. You can recognize an encrypted connection by the fact that your browser’s address bar changes from “http://” to “https://” and displays a padlock icon.

When SSL/TLS encryption is enabled, the data you transmit to us cannot be read by unauthorized third parties.

Right to Restriction of Processing
You have the right to request the restriction of the processing of your personal data. You may contact us at any time to exercise this right.

The right to restriction of processing applies in the following situations:

• If you contest the accuracy of your personal data stored by us, we generally require time to verify the accuracy. During the verification period, you have the right to request restriction of processing.

• If the processing of your personal data is or has been unlawful, you may request restriction of processing instead of erasure.

• If we no longer need your personal data, but you require it for the establishment, exercise, or defence of legal claims, you have the right to request restriction of processing instead of erasure.

• If you have objected to processing pursuant to Article 21(1) GDPR, a balancing of interests must be carried out. Until it has been determined whose interests prevail, you have the right to request restriction of processing.

Where the processing of your personal data has been restricted, such data may—apart from being stored—only be processed with your consent, for the establishment, exercise, or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State.