Privacy Policy

Privacy Policy

We have written this privacy policy (version 29.09.2021-111841162) in order to explain to you, in accordance with the provisions of the General Data Protection Regulation (EU) 2016/679 and applicable national laws, which personal data (data for short) we as the controller – and the processors commissioned by us (e.g. providers) – process, will process in the future and what legal options you have. The terms used are to be considered as gender-neutral.
In short: We provide you with comprehensive information about any personal data we process about you.

Privacy policies usually sound very technical and use legal terminology. However, this privacy policy is intended to describe the most important things to you as simply and transparently as possible. So long as it aids transparency, technical terms are explained in a reader-friendly manner, links to further information are provided and graphics are used. We are thus informing in clear and simple language that we only process personal data in the context of our business activities if there is a legal basis for it. This is certainly not possible with brief, unclear and legal-technical statements, as is often standard on the Internet when it comes to data protection. We hope you find the following explanations interesting and informative. Maybe you will also find some information that you have not been familiar with.
If you still have questions, we would like to ask you to contact the responsible body named below or in the imprint, to follow the existing links and to look at further information on third-party sites. You can of course also find our contact details in the imprint.

Scope

This privacy policy applies to all personal data processed by our company and to all personal data processed by companies commissioned by us (processors). With the term personal data, we refer to information within the meaning of Article 4 No. 1 GDPR, such as the name, email address and postal address of a person. The processing of personal data ensures that we can offer and invoice our services and products, be it online or offline. The scope of this privacy policy includes:

• all online presences (websites, online shops) that we operate
• Social media presences and email communication
• mobile apps for smartphones and other devices

In short: This privacy policy applies to all areas in which personal data is processed in a structured manner by the company via the channels mentioned. Should we enter into legal relations with you outside of these channels, we will inform you separately if necessary.

Legal bases

In the following privacy policy, we provide you with transparent information on the legal principles and regulations, i.e. the legal bases of the General Data Protection Regulation, which enable us to process personal data.
Whenever EU law is concerned, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016. You can of course access the General Data Protection Regulation of the EU online at EUR-Lex, the gateway to EU law, at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679.

We only process your data if at least one of the following conditions applies:

1. Consent (Article 6 Paragraph 1 lit. a GDPR): You have given us your consent to process data for a specific purpose. An example would be the storage of data you entered into a contact form.
2. Contract (Article 6 Paragraph 1 lit. b GDPR): We process your data in order to fulfill a contract or pre-contractual obligations with you. For example, if we conclude a sales contract with you, we need personal information in advance.
3. Legal obligation (Article 6 Paragraph 1 lit. c GDPR): If we are subject to a legal obligation, we will process your data. For example, we are legally required to keep invoices for our bookkeeping. These usually contain personal data.
4. Legitimate interests (Article 6 Paragraph 1 lit. f GDPR): In the case of legitimate interests that do not restrict your basic rights, we reserve the right to process personal data. For example, we have to process certain data in order to be able to operate our website securely and economically. Therefore, the processing is a legitimate interest.

Other conditions such as making recordings in the interest of the public, the exercise of official authority as well as the protection of vital interests do not usually occur with us. Should such a legal basis be relevant, it will be disclosed in the appropriate place.

In addition to the EU regulation, national laws also apply:

• In Austria this is the Austrian Data Protection Act (Datenschutzgesetz), in short DSG.

Should other regional or national laws apply, we will inform you about them in the following sections.

Storage Period

It is a general criterion for us to store personal data only for as long as it is necessary for the provision of our services and products. This means that we delete personal data as soon as any reason for the data processing no longer exists. In some cases, we are legally obliged to keep certain data stored even after the original purpose no longer exists, such as for accounting purposes.

If you want your data to be deleted or if you want to revoke your consent to data processing, the data will be deleted as soon as possible, provided there is no obligation to continue its storage.

We will inform you below about the specific duration of the respective data processing, provided we have further information.

Rights in accordance with the General Data Protection Regulation

You are granted the following rights in accordance with the provisions of the GDPR (General Data Protection Regulation) and the Austrian Data Protection Act (DSG):

• right to rectification (article 16 GDPR)
• right to erasure (“right to be forgotten“) (article 17 GDPR)
• right to restrict processing (article 18 GDPR)
• righ to notification – notification obligation regarding rectification or erasure of personal data or restriction of processing (article 19 GDPR)
• right to data portability (article 20 GDPR)
• Right to object (article 21 GDPR)
• right not to be subject to a decision based solely on automated processing – including profiling – (article 22 GDPR)

If you think that the processing of your data violates the data protection law, or that your data protection rights have been infringed in any other way, you can lodge a complaint with your respective regulatory authority. For Austria this is the data protection authority, whose website you can access at https://www.data-protection-authority.gv.at/.

Austria Data protection authority

Manager: Mag. Dr. Andrea Jelinek
Address: Barichgasse 40-42, 1030 Wien
Phone number.: +43 1 52 152-0
E-mail address: [email protected]
Website: https://www.dsb.gv.at/

Communications

If you contact us and communicate with us via phone, email or online form, your personal data may be processed.

The data will be processed for handling and processing your request and for the related business transaction. The data is stored for this period of time or for as long as is legally required.

Affected persons

The above-mentioned processes affect all those who seek contact with us via the communication channels we provide.

Telephone

When you call us, the call data is stored in a pseudonymised form on the respective terminal device, as well as by the telecommunications provider that is being used. In addition, data such as your name and telephone number may be sent via email and stored for answering your inquiries. The data will be erased as soon as the business case has ended and the legal requirements allow for its erasure.

Email

If you communicate with us via email, your data is stored on the respective terminal device (computer, laptop, smartphone, …) as well as on the email server. The data will be deleted as soon as the business case has ended and the legal requirements allow for its erasure.

Online forms

If you communicate with us using an online form, your data is stored on our web server and, if necessary, forwarded to our email address. The data will be erased as soon as the business case has ended and the legal requirements allow for its erasure.

Legal bases

Data processing is based on the following legal bases:

• Art. 6 para. 1 lit. a GDPR (consent): You give us your consent to store your data and to continue to use it for the purposes of the business case;
• Art. 6 para. 1 lit. b GDPR (contract): For the performance of a contract with you or a processor such as a telephone provider, or if we have to process the data for pre-contractual activities, such as preparing an offer;
• Art. 6 para. 1 lit. f GDPR (legitimate interests): We want to conduct our customer inquiries and business communication in a professional manner. Thus, certain technical facilities such email programs, Exchange servers and mobile network operators are necessary to efficiently operate our communications.

Web hosting

What is web hosting?

Every time you visit a website nowadays, certain information – including personal data – is automatically created and stored, including on this website. This data should be processed as sparingly as possible, and only with good reason. By website, we mean the entirety of all websites on your domain, i.e. everything from the homepage to the very last subpage (like this one here). By domain we mean example.uk or examplepage.com.

When you want to view a website on a screen, you use a program called a web browser. You probably know the names of some web browsers: Google Chrome, Microsoft Edge, Mozilla Firefox, and Apple Safari.

The web browser has to connect to another computer which stores the website’s code: the web server. Operating a web server is complicated and time-consuming, which is why this is usually done by professional providers. They offer web hosting and thus ensure the reliable and flawless storage of website data.

Whenever the browser on your computer establishes a connection (desktop, laptop, smartphone) and whenever data is being transferred to and from the web server, personal data may be processed. After all, your computer stores data, and the web server also has to retain the data for a period of time in order to ensure it can operate properly.

Why do we process personal data?

The purposes of data processing are:

1. Professional hosting of the website and operational security
2. To maintain the operational as well as IT security
3. Anonymous evaluation of access patterns to improve our offer, and if necessary, for prosecution or the pursuit of claims.li>

Which data are processed?

Even while you are visiting our website, our web server, that is the computer on which this website is saved, usually automatically saves data such as

• the full address (URL) of the accessed website (e. g. https://www.examplepage.uk/examplesubpage.html?tid=111841162)
• browser and browser version (e.g. Chrome 87)
• the operating system used (e.g. Windows 10)
• the address (URL) of the previously visited page (referrer URL) (e. g. https://www.examplepage.uk/icamefromhere.html/)
• the host name and the IP address of the device from the website is being accessed from (e.g. COMPUTERNAME and 194.23.43.121)
• date and time
• in so-called web server log files

How long is the data stored?

Generally, the data mentioned above are stored for two weeks and are then automatically deleted. We do not pass these data on to others, but we cannot rule out the possibility that this data may be viewed by the authorities in the event of illegal conduct.

In short: Your visit is logged by our provider (company that runs our website on special computers (servers)), but we do not pass on your data without your consent!

Legal basis

The lawfulness of processing personal data in the context of web hosting is justified in Art. 6 para. 1 lit. f GDPR (safeguarding of legitimate interests), as the use of professional hosting with a provider is necessary to present the company in a safe and user-friendly manner on the internet, as well as to have the ability to track any attacks and claims, if necessary.

Email-Marketing

What is Email-Marketing?

We use email marketing to keep you up to date. If you have agreed to receive our emails or newsletters, your data will be processed and stored. Email marketing is a part of online marketing. In this type of marketing, news or general information about a company, product or service are emailed to a specific group of people who are interested in it.

If you want to participate in our email marketing (usually via newsletter), you usually just have to register with your email address. To do this, you have to fill in and submit an online form. However, we may also ask you for your title and name, so we can address you personally in our emails.

The registration for newsletters generally works with the help of the so-called “double opt-in procedure”. After you have registered for our newsletter on our website, you will receive an email, via which you can confirm the newsletter registration. This ensures that you own the email address you signed up with, and prevents anyone to register with a third-party email address. We or a notification tool we use, will log every single registration. This is necessary so we can ensure and prove, that registration processes are done legally and correctly. In general, the time of registration and registration confirmation are stored, as well as your IP address. Moreover, any change you make to your data that we have on file is also logged.

Why do we use Email-Marketing?

Of course, we want to stay in contact with you and keep you in the loop of the most important news about our company. For this, we use email marketing – often just referred to as “newsletters” – as an essential part of our online marketing. If you agree to this or if it is permitted by law, we will send you newsletters, system emails or other notifications via email. Whenever the term “newsletter” is used in the following text, it mainly refers to emails that are sent regularly. We of course don’t want to bother you with our newsletter in any way. Thus, we genuinely strive to offer only relevant and interesting content. In our emails you can e.g. find out more about our company and our services or products. Since we are continuously improving our offer, our newsletter will always give you the latest news, or special, lucrative promotions. Should we commission a service provider for our email marketing, who offers a professional mailing tool, we do this in order to offer you fast and secure newsletters. The purpose of our email marketing is to inform you about new offers and also to get closer to our business goals.

Which data are processed?

If you subscribe to our newsletter via our website, you then have to confirm your membership in our email list via an email that we will send to you. In addition to your IP and email address, your name, address and telephone number may also be stored. However, this will only be done if you agree to this data retention. Any data marked as such are necessary so you can participate in the offered service. Giving this information is voluntary, but failure to provide it will prevent you from using this service. Moreover, information about your device or the type of content you prefer on our website may also be stored. In the section “Automatic data storage” you can find out more about how your data is stored when you visit a website. We record your informed consent, so we can always prove that it complies with our laws.

Duration of data processing

If you unsubscribe from our e-mail/newsletter distribution list, we may store your address for up to three years on the basis of our legitimate interests, so we can keep proof your consent at the time. We are only allowed to process this data if we have to defend ourselves against any claims.

However, if you confirm that you have given us your consent to subscribe to the newsletter, you can submit an individual request for erasure at any time. Furthermore, if you permanently object to your consent, we reserve the right to store your email address in a blacklist. But as long as you have voluntarily subscribed to our newsletter, we will of course keep your email address on file.

Withdrawal – how can I cancel my subscription?

You have the option to cancel your newsletter subscription at any time. All you have to do is revoke your consent to the newsletter subscription. This usually only takes a few seconds or a few clicks. Most of the time you will find a link at the end of every email, via which you will be able to cancel the subscription. Should you not be able to find the link in the newsletter, you can contact us by email and we will immediately cancel your newsletter subscription for you.

Legal basis

Our newsletter is sent on the basis of your consent (Article 6 (1) (a) GDPR). This means that we are only allowed to send you a newsletter if you have actively registered for it beforehand. Moreover, we may also send you advertising messages on the basis of Section 7 (3) UWG (Unfair Competition Act), provided you have become our customer and have not objected to the use of your email address for direct mail.

If available – you can find information on special email marketing services and how they process personal data, in the following sections.

MailChimp Privacy Policy

What is MailChimp?

Like many other websites, we use the services of the newsletter company MailChimp on our website. The operator of MailChimp is the company The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA. With the aid of MailChimp we can easily send you interesting news via newsletter. For the use of the service we do not have to install anything but can still access a pool of very efficient features. In the following we will give more details on this email marketing service and will inform you about the most important data protection aspects.

MailChimp is a cloud-based newsletter management service. “Cloud-based“ means that we do not need to install MailChimp on our own computer or server. Instead, we use the service on an external server, or more specifically via an IT infrastructure, which is available via the internet. Using a software this way is also called SaaS (software as a service).

What data is stored by MailChimp?

Rocket Science Group LLC (MailChimp) operate online platforms which enable us to get in contact with you, provided you subscribed to our newsletter. If you become a subscriber of our newsletter via our website, by email you agree to become a member of a MailChimp email list. Then, MailChimp saves your subscription data and your IP address, so it can verify your entry into the list provider. Moreover, MailChimp stores your email address, your name, your physical address and demographic information, such as language or location.

This information is used to send emails to you and to allow certain other MailChimp functions (e.g. the evaluation of newsletters).

MailChimp also shares information with third parties to improve its services. Moreover, MailChimp shares certain data with advertising partners of third parties to get a better understanding of its clients’ interests, in order to provide relevant contents and target-oriented advertising.

With so-called “web beacons” (small graphics in HTML emails), MailChimp can determine if an email has arrived, has been opened or if links have been clicked. This information is then stored on MailChimp’s servers. That way we receive statistical evaluations and can see how you liked our newsletter. Therefore, we can tailor our offer better to your wishes and improve our service.

Moreover, MailChimp are allowed to use this data for improving their own service. Thus, they can for example technically optimize the distribution or determine the location (or the country) of the recipient.

For better display you might sometimes open our newsletter via a specified link. This can be the case if your email program does not work or if the newsletter is not displayed correctly. The newsletter will then be shown via a MailChimp website. MailChimp also uses cookies on its websites (small text files which save data on your browser).
Personal data can be processed by MailChimp and their partners (e.g. Google Analytics). MailChimp is responsible for the collection of this data and we have no influence on it. MailChimp’s “Cookie Statement” (at: https://mailchimp.com/legal/cookies/) tells you exactly how and why the company uses cookies.

How long and where is the data stored?

Since MailChimp is an American company, all retained data is stored on American servers.

Generally, the data stays permanently stored on MailChimp’s servers and is deleted only when you request it. You can have your contact information with us deleted. This permanently removes all your personal data for us and anonymises you in MailChimp’s reports. However, you can also request the erasure of your data permanently at MailChimp. Then all your data are removed from there and we receive a notification from MailChimp. After we receive the email we have 30 days to delete your contact details from all integrations.

How can I erase my data or prevent data retention?

You can withdraw your approval for the receipt of our newsletters anytime, by clicking the link in the lower area of the received newsletter email. When you click on the unsubscribe link, your data with MailChimp gets deleted.

When you land on a MailChimp website via a link in our newsletter and cookies are consequently set in your browser, you can delete or deactivate these cookies anytime.

Depending on the browser, the deactivation or deletion differs slightly. The following instructions show how to manage cookies in your browser:

Chrome: Clear, enable and manage cookies in Chrome

Safari: Manage cookies and website data in Safari

Firefox: Clear cookies and site data in Firefox

Internet Explorer: Delete and manage cookies

Microsoft Edge: Delete cookies in Microsoft Edge

If you generally do not want to allow any cookies, you can set up your browser in a way so it would notify you whenever a potential cookie is about to be set. This lets you decide upon the placement of every single cookie.

Legal basis

MailChimp sends our newsletter on the basis of your consent (Article 6 (1) (a) GDPR). This means that we are only allowed to mail you a newsletter if you have actively registered for it beforehand. If consent is not required, the newsletter is sent on the basis of legitimate interest in direct marketing (Article 6 (1) (f)), provided this is legally permitted. We record your registration process so we can keep proof of compliance with our laws.

MailChimp also processes data in the USA, among other countries. We would like to note, that according to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This can be associated with various risks to the legality and security of data processing.

MailChimp uses standard contractual clauses approved by the EU Commission as basis for data processing by recipients based in third countries (outside the European Union, Iceland, Liechtenstein, Norway and especially in the USA) or data transfer there (= Art. 46, paragraphs 2 and 3 of the GDPR). These clauses oblige MailChimp to comply with the EU‘s level of data protection when processing relevant data outside the EU. These clauses are based on an implementing order by the EU Commission. You can find the order and the clauses here: https://ec.europa.eu/commission/presscorner/detail/en/ip_21_2847

You can find out more on MailChimp’s use of cookies at https://mailchimp.com/legal/cookies/. Furthermore, at https://mailchimp.com/legal/privacy/ you can find more information on data protection at MailChimp (Privacy).

Cookie Consent Management Platform

What is a cookie consent management platform?

We use a Consent Management Platform (CMP) software on our website that makes it easier for us and you to handle the scripts and cookies used correctly and securely. The software automatically creates a cookie pop-up, scans and controls all scripts and cookies, provides you with the cookie consent required under data protection law and helps you and us to keep track of all cookies. Most cookie consent management tools identify and categorize all existing cookies. As a website visitor, you then decide for yourself whether and which scripts and cookies you allow or not. The following graphic shows the relationship between browser, web server and CMP.

Why do we use a cookie management tool?

Our goal is to offer you the best possible transparency in the area of data protection. We are also legally obliged to do so. We want to inform you as well as possible about all tools and all cookies that can save and process your data. It is also your right to decide for yourself which cookies you accept and which you do not. In order to grant you this right, we first need to know exactly which cookies actually landed on our website. Thanks to a cookie management tool, which regularly scans the website for all cookies present, we know about all cookies and can provide you with GDPR-compliant information. You can then use the consent system to accept or reject cookies.

Which data are processed?

As part of our cookie management tool, you can manage each individual cookie yourself and have complete control over the storage and processing of your data. The declaration of your consent is stored so that we do not have to ask you every time you visit our website and we can also prove your consent if required by law. This is saved either in an opt-in cookie or on a server. The storage time of your cookie consent varies depending on the provider of the cookie management tool. Usually this data (e.g. pseudonymous user ID, time of consent, detailed information on the cookie categories or tools, browser, device information) is stored for up to two years.

Duration of data processing

We will inform you below about the duration of the data processing if we have further information. In general, we only process personal data for as long as is absolutely necessary for the provision of our services and products. Data stored in cookies are stored for different lengths of time. Some cookies are deleted after you leave the website, others may be stored in your browser for a few years. The exact duration of the data processing depends on the tool used, in most cases you should be prepared for a storage period of several years. In the respective data protection declarations of the individual providers, you will usually receive precise information about the duration of the data processing.

Right of objection

You also have the right and the option to revoke your consent to the use of cookies at any time. This works either via our cookie management tool or via other opt-out functions. For example, you can also prevent data collection by cookies by managing, deactivating or deleting cookies in your browser.

Information on special cookie management tools can be found – if available – in the following sections.

Legal basis

If you agree to cookies, your personal data will be processed and stored via these cookies. If we are allowed to use cookies with your consent (Article 6 paragraph 1 lit. a GDPR), this consent is also the legal basis for the use of cookies and the processing of your data. In order to be able to manage the consent to cookies and to enable you to give your consent, a cookie consent management platform software is used. The use of this software enables us to operate the website in an efficient and legally compliant manner, which is a legitimate interest (Article 6 paragraph 1 lit. f GDPR).

Payment providers

What is a payment provider?

On our website we use online payment systems, which enable us as well as you to have a secure and smooth payment process available. Among other things, personal data may also be sent to the respective payment provider, where it may also be stored and processed. Payment providers are online payment systems that enable you to place an order via online banking. The payment processing is carried out by the payment provider of your choice. We will then receive information about the payment. This method can be used by any user who has an active online banking account with a PIN and TAN. There are hardly any banks that do not offer or accept such payment methods.

Why do we use payment providers on our website?

With both our website and our embedded online shop, we of course want to offer you the best possible service, so you can feel comfortable on our site and take advantage of our offers. We know that your time is valuable and that payment processing in particular has to work quickly and smoothly. Thus, we offer various payment providers. You can choose your preferred payment provider and pay in the usual way.

Which data are processed?

What exact data that is processed of course depends on the respective payment provider. However, generally data such as name, address, bank details (account number, credit card number, passwords, TANs, etc.) do get stored. This data is necessary for carrying out any transactions. In addition, any contract data and user data, such as when you have visited our website, what content you are interested in or which sub-pages you have clicked, may also be stored. Most payment providers also store your IP address and information about the computer you are using.

Your data is usually stored and processed on the payment providers’ servers. We, so the website operator, do not receive this data. We only get information on whether the payment has gone through or not. For identity and credit checks, it may happen for payment providers to forward data to the appropriate body. The business and privacy policy principles of the respective provider always apply to all payment transactions. Therefore, please always take a look at the general terms and conditions and the privacy policy of the payment provider. You e.g. also have the right to have data erased or rectified at any time. Please contact the respective service provider regarding your rights (right to withdraw, right of access and individual rights).

Duration of data processing

Provided we have further information on this, we will inform you below about the duration of the processing of your data. In general, we only process personal data for as long as is absolutely necessary for providing our services and products. This storage period may be exceeded however, if it is required by law, for example for accounting purposes. We keep any accounting documents of contracts (invoices, contract documents, account statements, etc.) for 10 years (Section 147 AO) and other relevant business documents for 6 years (Section 247 HGB).

Right to object

You always have the right to information, rectification and erasure of your personal data. If you have any questions, you can always contact the person that is responsible for the respective payment provider. You can find contact details for them either in our respective privacy policy or on the relevant payment provider’s website.

You can erase, deactivate or manage cookies in your browser, that payment providers use for their functions. How this works differs a little depending on which browser you are using. Please note, however, that the payment process may then no longer work.

Legal basis

For the processing of contractual or legal relationships (Art. 6 para. 1 lit. b GDPR), we offer other payment service providers in addition to the conventional banking/credit institutions. In the privacy policy of the individual payment providers (such as Amazon Payments, Apple Pay or Discover) you will find a detailed overview of data processing and data storage. In addition, you can always contact the responsible parties should you have any questions about data protection issues.

Provided it is available, you can find information on the special payment providers in the following sections.

eps-Überweisung Privacy Policy

On our website we use eps-Überweisung, which is a service for online payment methods. The provider of this service is the Austrian company Stuzza GmbH, Frankgasse 10/8, 1090 Vienna, Austria. You can find out more about the data that is processed by using eps-Überweisung in their privacy policy at https://eservice.stuzza.at/de/datenschutzerklaerung.html.

Mastercard Privacy Policy

We use the payment service provider Mastercard on our website. The provider of this service is the American company Mastercard Inc. The responsible entity for the European region is the company Mastercard Europe SA (Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium).

Mastercard also processes data in the USA, among other countries. We would like to note, that according to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This can be associated with various risks to the legality and security of data processing.

Mastercard uses standard contractual clauses approved by the EU Commission as basis for data processing by recipients based in third countries (outside the European Union, Iceland, Liechtenstein, Norway and especially in the USA) or data transfer there (= Art. 46, paragraphs 2 and 3 of the GDPR). These clauses oblige Mastercard to comply with the EU‘s level of data protection when processing relevant data outside the EU. These clauses are based on an implementing order by the EU Commission. You can find the order and the clauses here: https://ec.europa.eu/commission/presscorner/detail/en/ip_21_2847

You can find out more about the data processed by using Mastercard in their Privacy Policy at https://www.mastercard.com/global/en/vision/corp-responsibility/commitment-to-privacy/privacy.html.

PayPal Privacy Policy

On our website we use the online payment service PayPal. The provider of this service is the American company PayPal Inc. The responsible entity for the European region is the company PayPal Europe (S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg).

PayPal also processes data in the USA, among other countries. We would like to note, that according to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This can be associated with various risks to the legality and security of data processing.

PayPal uses standard contractual clauses approved by the EU Commission as basis for data processing by recipients based in third countries (outside the European Union, Iceland, Liechtenstein, Norway and especially in the USA) or data transfer there (= Art. 46, paragraphs 2 and 3 of the GDPR). These clauses oblige PayPal to comply with the EU‘s level of data protection when processing relevant data outside the EU. These clauses are based on an implementing order by the EU Commission. You can find the order and the clauses here: https://ec.europa.eu/commission/presscorner/detail/en/ip_21_2847

You can find out more about the data processed by using PayPal in the Privacy Policy at https://https://www.paypal.com/webapps/mpp/ua/privacy-full.

Visa Privacy Policy

On our website we use Visa which is a global payment provider. The provider of this service is the American company Visa Inc. The responsible entity for the European region is the company Visa Europe Services Inc. (1 Sheldon Square, London W2 6TT, United Kingdom).

Visa also processes data in the USA, among other countries. We would like to note, that according to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This can be associated with various risks to the legality and security of data processing.

Visa uses standard contractual clauses approved by the EU Commission as basis for data processing by recipients based in third countries (outside the European Union, Iceland, Liechtenstein, Norway and especially in the USA) or data transfer there (= Art. 46, paragraphs 2 and 3 of the GDPR). These clauses oblige Visa to comply with the EU‘s level of data protection when processing relevant data outside the EU. These clauses are based on an implementing order by the EU Commission. You can find the order and the clauses here: https://ec.europa.eu/commission/presscorner/detail/en/ip_21_2847

You can find out more about the data processed through the use of Visa in the Privacy Policy at https://www.visa.co.uk/legal/privacy-policy.html.

Sofortüberweisung Privacy Policy

What is “Sofortüberweisung”?

On our website we offer the payment method “Sofortüberweisung” from Sofort GmbH for cashless payment. Sofort GmbH has been part of the Swedish company Klarna since 2014, but is based in Germany, Theresienhöhe 12, 80339 Munich.

If you choose this payment method, your personal data will also be transmitted to Sofort GmbH or Klarna, where it will be stored and processed. In this privacy policy we will give you an overview of Sofort GmbH’s data processing.

Sofortüberweisung is an online payment system that enables you to place an order via online banking. The payment is processed by Sofort GmbH, while we immediately receive information about your payment. Anyone who has an active online banking account with a PIN and TAN can use this method. Only a few banks do not yet support this payment option.

Why do we use “Sofortüberweisung” on our website?

It is our goal to offer you the best possible service with our website and our integrated online shop. Next to the overall experience of the website and offers, this also includes smooth, fast, and secure payment processing of your orders. To ensure this, we use “Sofortüberweisung” as a payment system.

What data is stored by “Sofortüberweisung”?

If you make an immediate transfer via the Sofort/Klarna service, data such as your name, account number, sort code, payment reference, amount and date are stored on the company’s servers. We then also receive this information via the payment confirmation.

As part of the check for sufficient account coverage, Sofort GmbH reviews whether your account balance and overdraft can cover the payment amount. In some cases, it is also reviewed whether any instant transfers have been successfully carried out within the last 30 days. Furthermore, a shortened (“hashed”) form of your user identification (such as your signatory or contract number) as well as your IP address will be stored. For SEPA transfers your BIC and IBAN will also be stored.

According to Sofort GmbH, no other personal data (such as account balances, sales data, transaction limits, account lists, mobile phone numbers, authentication certificates, security codes or PIN/TAN) are collected, stored or passed on to third parties.

Sofortüberweisung also uses cookies to make our service more user-friendly. When you order a product, you will be redirected to the Sofort or Klarna website. After successful payment you will be redirected to our thank-you page.

How long and where are the data stored?

All gathered data are stored within the legal storage obligations. This obligation can last between three and ten years.

Klarna/Sofort GmbH try to only save data within the EU or the European Economic Area (EEA). If data is transferred outside the EU/EEA, data protection must comply with the GDPR. Also, the country the data is transferred to must be subject to the EU’s adequacy decision or have the US Privacy Shield certificate.

How can I delete my data or prevent data retention?

You can withdraw your consent for Klarna to process your personal data at any time. You also always have the right for information, rectification and deletion of your personal data. For this, you can simply email the company’s data protection team at [email protected].

In your browser, you can manage, delete, or deactivate Sofortüberweisung’s possible cookies. The settings vary a bit depending on what browser you use. The following instructions will show you how to manage cookies in the most common browsers:

Chrome: Clear, enable and manage cookies in Chrome

Safari: Manage cookies and website data in Safari

Firefox: Clear cookies and site data in Firefox

Internet Explorer: Delete and manage cookies

Microsoft Edge: Delete cookies in Microsoft Edge

Legal basis

For the processing of contractual or legal relationships (Art. 6 para. 1 lit. b GDPR), we  offer the payment service provider Sofortüberweisung in addition to the conventional bank/credit institutions. Successful use of the service also requires your consent (Art. 6 para. 1 lit. a GDPR), provided the use of cookies is necessary.

If you want to know more about Sofort GmbH’s data processing, we recommend the privacy policy at https://cdn.klarna.com/1.0/shared/content/legal/terms/0/en_gb/privacy.

All texts are copyrighted.

Source: Created with the Impressum Generator by AdSimple.