Privacy Policy

Information on data processing for this website in accordance with Article 13 of the EU General Data Protection Regulation (GDPR) when personal data is collected from the data subject

Version: GDPR 3.0 of 19.06.2026

HEINE Optotechnik GmbH is responsible for this website and, as a provider of a teleservice, must inform you at the beginning of your visit about the type, scope and purposes of the collection and use of personal data in a precise, transparent, understandable and easily accessible form in clear and simple language. This content must be available to you at all times. We attach great importance to the security of your data and compliance with data protection regulations. The processing of personal data is subject to the provisions of the European and national laws currently in force. We would like to use the following data protection information to show you how we handle your personal data and how you can contact us:

HEINE Optotechnik GmbH & Co. KG
Dornierstr. 6
82205 Gilching
Germany
Phone: +49 8105 7728 0
E-mail: info@heine.com

Our Data Protection Officer
Sven Lenz
Datenschutzkanzlei Lenz GmbH & Co. KG
Bahnhofstraße 50
87435 Kempten
Germany

If you have any questions about data protection or other data protection concerns, please feel free to send an e-mail to the data protection team: dsb@heine.com.

A. General

For better comprehensibility, we do not differentiate between gender. In the spirit of equal treatment, corresponding terms apply to all genders. What the terms used, such as "personal data" or their "processing", mean, can be found in Art. 4 GDPR. The personal data processed in the context of this website includes

Inventory data (e.g. names and addresses of customers),
Contract data (e.g. services used, payment information),
Usage data (e.g. pages visited on our website) and
Content data (e.g. entries in online forms).

B. Specific

We guarantee that we will only process your data in connection with the processing of your enquiries and for internal purposes as well as to provide services or content requested by you.

Basics of data processing

We will only process your personal data in compliance with the relevant data protection regulations and on the following legal bases:

Processing for the performance of our services and execution of contractual measures in accordance with Art. 6 para. 1 lit. b) GDPR (e.g. for the execution of the order in the webshop)
Processing to fulfil our legal obligations in accordance with Art. 6 para. 1 lit. c) GDPR
Consent in accordance with Art. 6 para. 1 lit. a) and Art. 7 GDPR (e.g. consent to send our newsletter)
Processing to protect our legitimate interests in accordance with Art. 6 (1) (f) GDPR (e.g. sending advertising to existing customers).

Data transmission to recipients

We would like to point out that data is transmitted to third parties. Your data will only be passed on to third parties within the framework of the legal requirements . We only pass on your data if this is necessary, for example, for contractual purposes or on the basis of legitimate interests in the economic and effective operation of our business operations. Where we use subcontractors to provide our services, we take appropriate legal precautions as well as appropriate technical and organizational measures to ensure the protection of personal data in accordance with the relevant legal requirements. The specific transmissions are described below and the recipients are named.

Data transfer to a third country or an international organization

A third country is to be understood as countries in which the GDPR is not directly applicable law. In principle, this includes all countries outside the EU or the European Economic Area. Through the use of various services on our website/in our webshop (see description below), data is transferred to a third country or an international organization. The EU Commission's adequacy decision is taken into account here. This states that it is a safe third country or a safe international organization that offers an adequate level of protection. For data transfers to the USA, the following applies: Since July 2023, the EU Commission has had an adequacy decision (Data Privacy Framework), which designates the USA as a third country with a level of data protection comparable to that of the EU. The adequacy decision can now serve as the basis for data transfers to certified organizations in the USA. The US services used have been certified under the Data Privacy Framework. Details can be found under the individual services. There is a risk that your data will be processed by US authorities for control and surveillance purposes. Currently, there are no legal remedies to take action against this practice.

Retention period of your personal data

We adhere to the principles of data economy and data avoidance. This means that we only store your data for as long as necessary to fulfil the aforementioned purposes or as stipulated by the various storage periods provided for by law. If the respective purpose does not apply or after the expiry of the corresponding periods, your data will be routinely blocked or deleted in accordance with the legal regulations. For this purpose, we have created an internal company concept to ensure this approach.

Contact us

Personal data is processed as part of the electronic contact with us (e.g. via contact form or e-mail). The information you provide will be stored exclusively for the purpose of processing the enquiry and for possible follow-up questions. We would like to give you the legal basis for this:

Processing for the performance of our services and implementation of contractual measures

Art. 6 (1) (b) GDPR We would like to point out that e-mails can be read or changed during transmission without authorization and without being noticed. Furthermore, we would like to draw your attention to the fact that we use software to filter unsolicited e-mails (spam filters). The spam filter can reject e-mails if they have been incorrectly identified as spam by certain characteristics.

What rights do you have?

Right to information

You have the right to obtain information about your stored data free of charge. Upon request, we will inform you in writing which personal data we have stored about you. This also includes the origin and recipients of your data as well as the purpose of the data processing.

Right to rectification

You have the right to have your data stored by us corrected if it is inaccurate. You can request a restriction of processing, e.g. if the accuracy of your personal data is disputed.

Right to block

You can also have your data blocked. In order for your data to be blocked at any time, this data must be kept in a blocking file for control purposes.

Right to erasure

You can request the deletion of your personal data, provided that there are no statutory retention obligations. If such an obligation exists, we will block your data on request. If the relevant legal requirements are met, we will delete your personal data even without your request.

Right to data portability

You have the right to request that we provide the personal data you have provided to us in a format that allows it to be transmitted to another entity.

Right to lodge a complaint with a supervisory authority

You have the option of making a complaint to one of the data protection supervisory authorities. The data protection authority responsible for us: Bavarian State Office for Data Protection Supervision (BayLDA)Promenade 27, D-91522 AnsbachPhone: +49 981 53-1300Fax: +49 981 53-981300 You can open the complaint form of the Bavarian State Office for Data Protection Supervision via the following link: https://www.lda.bayern.de/de/beschwerde.html Note: A complaint can also be addressed to any data protection supervisory authority within the EU.

Right to object

You have the right to object at any time, for reasons relating to your particular situation, to the processing of your data in accordance with art. 6 para. 1 letters e) and f); this also applies to profiling based on these provisions. We will then no longer process your personal data unless it can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. If personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to profiling, insofar as it is related to such direct advertising. In the event of such an objection, we will no longer process your personal data for the purposes of direct marketing. To do this, it is sufficient to send us a corresponding e-mail. h) Right of withdrawal You have the option of revoking your consent to the processing of your data at any time with effect for the future without giving reasons. You will not suffer any disadvantages as a result of the withdrawal. To do this, it is sufficient to send us a corresponding e-mail. However, such a revocation does not affect the lawfulness of the processing carried out up to the time of the revocation on the legal basis of Art. 6 (1) (a) GDPR. To assert your rights as a data subject, please send us an e-mail to one of the e-mail addresses mentioned above.

Protection of your personal data

We take contractual, technical and organizational security measures according to the state of the art to ensure that data protection laws are complied with and thus to protect the processed data against accidental or intentional manipulation, loss, destruction or access by unauthorized persons. The security measures include, in particular, the encrypted transmission of data between your browser and our server. For this purpose, a 256-bit SSL (AES 256) encryption technology is used.

Your personal data will be protected within the framework of the following points (excerpt):

Maintaining the confidentiality of your personal data

In order to maintain the confidentiality of your data stored by us, we have taken various measures to control access, access and access.

Maintaining the integrity of your personal data

In order to maintain the integrity of your data stored by us, we have taken various measures to control the transfer and input.

Maintaining the availability of your personal data

In order to maintain the availability of your data stored by us, we have taken various measures to monitor orders and availability. The security measures in use are continuously improved in line with technological developments. Despite these precautions, due to the insecure nature of the Internet, we cannot guarantee the security of your data transmission to our website. As a result, any data transmission by you is at your own risk.

Protection of minors

Persons under the age of 16 may only provide us with personal information with the express consent of their legal guardians. This data will be processed in accordance with this privacy policy.

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

Browser type and version
operating system used
Referrer URL
Hostname of the accessing computer
Time of the server request
IP address

This data is not merged with other data sources. The basis for data processing is our legitimate interest in accordance with Art. 6 (1) (f) GDPR.

Cookies

Cookies are small text files that are stored locally in the cache of your internet browser. The cookies make it possible, for example, to recognize the Internet browser. The files are used to help the browser navigate through the website and to take full advantage of all functions. Cookies that are necessary to carry out the electronic communication process or to provide certain functions desired by you (e.g. shopping cart function) are stored on the basis of Art. 6 para. 1 lit. f) GDPR. The website operator has a legitimate interest in the storage of cookies for the technically error-free and optimal provision of its services. Insofar as other cookies (e.g. cookies for the analysis of your surfing behaviour) are stored, these are treated separately in this data protection notice. We may therefore store cookies on your device if they are strictly necessary for the operation of our website. For all other types of cookies, we need your permission. Our website uses different types of cookies. Some cookies are placed by third parties that are used on our sites. You can change or withdraw your consent at any time on our website. Please include your consent ID and date when contacting us about your consent.

Cookie-Consent-Tool

On our website, we use the Cookiebot service of Usercentrics A/S (Havnegade 39, 1058 Copenhagen, Denmark) to inform you about the use of cookies and to manage your consents in a legally compliant manner. Cookies are set for this purpose in order to record and store your consent. The following data is processed:

Your IP address (in anonymized form)
Date and time of your consent
Browser Information
An anonymous, random identifier
The consent status data (which cookies you have accepted or declined).

The processing of this data is carried out on the basis of Art. 6 para. 1 lit. c GDPR (fulfilment of a legal obligation) and Art. 6 para. 1 lit. f GDPR (legitimate interest in user-friendly and legally compliant cookie management). Your consent data will be stored for 12 months and then automatically deleted. Cookiebot stores your data within the European Union and does not share it with third parties. You can change or withdraw your consent to the services used on the website at any time by adjusting your cookie settings here. Further information on data processing by Cookiebot can be found in the privacy policy of Usercentrics A/S: https://www.cookiebot.com/de/privacy-policy/ .

Website-Hosting

For the hosting of our website and the presentation of the page content, we use the system of the following provider: SaSG GmbH & Co. KG Kapplweg 12D - 86511 Schmiechen All data collected on our website is processed on the provider's servers. We have concluded a data processing agreement with the provider, which ensures the protection of the data of our site visitors and prohibits unauthorized disclosure to third parties.

Use of Google services on our site

We use the services of Google Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland on our website. All described processing in the context of the use of Google services is carried out exclusively on the basis of your express consent in accordance with Art. 6 (1) (a) GDPR in conjunction with § 25 TDDDG. You can revoke your consent at any time with effect for the future. To exercise your withdrawal, please disable these services via the "Cookie Consent Tool" provided on the Website. We have concluded a so-called data processing agreement with Google, which obliges Google to protect the data of our website users and not to pass it on to third parties. In order to ensure compliance with the European level of data protection, even in the case of the possible transfer of data from the EU or the EEA to the USA and the possible further processing there, Google refers to the so-called standard contractual clauses of the European Commission, which we have contractually agreed with Google. Since July 2023, the EU Commission has had an adequacy decision (Data Privacy Framework), which identifies the USA as a third country with a level of data protection comparable to that of the EU. The adequacy decision can now serve as the basis for data transfers to certified organizations in the USA. According to the list of certified companies published by the US Department of Commerce, Google LLC is listed as a certified company. For additional legal notices about Google, including a copy of the Standard Contractual Clauses mentioned, see https://policies.google.com/privacy?hl=de&gl=de and https://policies.google.com/technologies/partner-sites . The following Google services are used on our website:

Google Marketing Platform

GMP uses cookies to serve ads that are relevant to users, to improve campaign performance reports, or to prevent a user from seeing the same ads multiple times. Google uses a cookie ID to record which ads are displayed in which browser and can thus prevent them from being displayed multiple times. In addition, GMP can use cookie IDs to record conversions related to ad requests. This is the case, for example, if a user sees a GMP ad and later, using the same browser, calls up the advertiser's website and makes a purchase via this website. According to Google, GMP cookies do not contain any personal information. Due to the marketing tools used, your browser automatically establishes a direct connection with Google's server. We have no influence on the scope and further use of the data collected by Google through the use of this tool and therefore inform you as follows, according to our state of knowledge: Through the integration of GMP, Google receives the information that you have accessed the relevant part of our website or clicked on an advertisement from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, there is a possibility that the provider will learn and store your IP address. As part of the use of GMP, personal data may also be transmitted to the servers of Google LLC. in the USA. You can find more information about GMP by Google's privacy policy at the following internet address: https://www.google.de/policies/privacy/.

Google Ads Conversion-Tracking

We use the online advertising program "Google Ads" on this website and conversion tracking as part of Google Ads. By using Google Ads, we can draw attention to our offers on external websites with the help of advertising materials (so-called Google Adwords) and also measure the success of this advertising campaign. We do this in order to be able to show you advertising tailored to you. If a user clicks on an ads ad placed by Google, a cookie (small text file) is placed on their device for conversion tracking. These cookies usually expire after 30 days and are not used for personal identification. With the help of Google, the cookie allows us to recognize that the user has been redirected to our site by clicking on the ad. Cookies cannot be tracked beyond the websites of Google Ads customers. The information collected is used to compile conversion statistics that provide us with information about the total number of users who clicked on our ad and were redirected to a page with a conversion tracking tag. However, we do not receive any information that can be used to personally identify users.

Google Ads Remarketing

Our website uses the functions of Google Ads Remarketing. We use it to advertise this website in Google search results, as well as on third-party websites. For this purpose, Google places a cookie in the browser of your device, which automatically enables interest-based advertising by means of a pseudonymous cookie ID and based on the pages you visit. Any further data processing will only take place if you have given Google's consent to Google linking your internet and app browsing history to your Google account and to use information from your Google account to personalise ads you view on the web. In this case, if you are logged in to Google while visiting our website, Google will use your data together with Google Analytics data to create and define target group lists for cross-device remarketing. For this purpose, your personal data is temporarily linked by Google to Google Analytics data in order to form target groups. Details on the processing initiated by Google Ads Remarketing and Google's handling of data from websites can be found here: https://policies.google.com/technologies/partner-sites .

Google AdSense

Google AdSense uses so-called cookies. In addition, Google AdSense also uses so-called "web beacons" (small invisible graphics) to collect information, through the use of which simple actions such as visitor traffic on the website can be recorded, collected and evaluated. The information generated by the cookie and/or web beacon (including your IP address) about your use of this website is usually transmitted to and stored on a Google server. This may also result in a transfer to the servers of Google LLC. in the USA. Google uses the information obtained in this way to evaluate your usage behavior with regard to the AdSense ads. The IP address transmitted by your browser as part of Google AdSense will not be merged with other data held by Google. The information collected by Google may be transferred to third parties if required to do so by law and/or if third parties process this data on Google's behalf.

Use of videos from YouTube

We use the YouTube implementation function to display and play videos from the provider "YouTube". According to information from "YouTube", cookies are set that serve, among other things, to collect video statistics, improve user-friendliness and prevent abusive practices. If you are logged in to Google, your data will be directly associated with your account when you click on a video. If you do not want to be assigned to your YouTube profile, you must log out before activating the button. Google stores your data (even for users who are not logged in) as usage profiles and evaluates them. You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this. Regardless of whether the embedded videos are played, a connection to the Google network is established every time this website is accessed, which can trigger further data processing processes without our influence. Further information on data protection at "YouTube" can be found in the provider's privacy policy at: https://www.google.de/intl/de/policies/privacy.

Google Tag Manager

We use the service called Google Tag Manager. This is an auxiliary service and processes even personal data only for technically necessary purposes. The Google Tag Manager ensures that other components are loaded, which in turn may collect data. The Google Tag Manager does not access this data.

Use of web analysis tools from social media providers:

We use tools from social media service providers on our website for evaluation purposes. All processing described below, in particular the setting of cookies to read information on the end device used, will only be carried out if you have given us your express consent to do so in accordance with Art. 6 (1) (a) GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website. Data transmission to the USA may occur as part of the use of the services. For data transfers to the USA, all of the providers we use have joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection standard on the basis of an adequacy decision by the European Commission.

Meta pixels for creating Custom Audiences with advanced data matching

Within our online offer, the so-called "meta-pixel" of the social network Facebook is used in the mode of extended data synchronization, which is operated by Meta Platforms Ireland Ltd., 4 Grand Canal Quare, Dublin 2, Ireland ("Facebook"). When a user clicks on an ad displayed on Facebook, the meta pixel adds an addition to the URL of our linked page. After being redirected to the user's browser, this URL parameter is then supplemented by setting a cookie from our website. In addition, this cookie collects specific customer data, such as the e-mail address that we collect on our website linked to the Facebook ad during processes such as purchases, account registrations or registrations (extended data comparison). The cookie is read by the Meta pixel and thus enables the data, including the specific customer data, to be forwarded to Meta. With the help of the Meta pixel with extended data comparison, Meta is able to precisely determine the visitors of our online offer as the target group for the display of ads (so-called "Facebook ads"). As a result, we can only display the Facebook ads placed by us to those Facebook users who have also shown an interest in our online offering or who have certain characteristics (e.g. interests in certain topics or products that are determined on the basis of the websites visited) that we transmit to Meta (so-called "Custom Audiences"). By using the pixel, we also want to ensure that our Facebook ads correspond to the potential interest of the users and do not have a harassing effect. This allows us to further evaluate the effectiveness of Facebook ads for statistical and market research purposes by understanding whether users were redirected to our website after clicking on a Facebook ad (so-called "conversion"). This allows us to better measure the effectiveness of our advertising campaigns by tracking more attributed conversions. All transmitted data is stored and processed by Meta so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes, in accordance with the Facebook Data Use Policy (https://www.facebook.com/about/privacy/). The data can enable Facebook and its partners to place advertisements on and off Facebook. For this purpose, we have concluded a joint controller agreement with Meta in accordance with Art. 26 GDPR. These processing operations are carried out exclusively upon the granting of explicit consent in accordance with Art. 6 para. 1 lit. a) GDPR in conjunction with § 25 TDDDG. You can object to the storage and evaluation of the data by Meta at any time. Simply click on Cookie settings and slide the slider of the cookie category "Marketing" to the left in the cookie banner. Then click on the "Accept selection" button.

LinkedIn Insight

This website uses retargeting technology from the following provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. This makes it possible to address visitors to our website with personalized, interest-based advertising who have already been interested in our shop and our products. The display of the advertising material is based on a cookie-based analysis of past and current user behaviour, but no personal data is stored. In the case of retargeting technology, a cookie is stored on your computer or mobile device in order to collect pseudonymised data about your interests and thus tailor advertising to the information stored. These cookies are small text files that are stored on your computer or mobile device. This will show you advertising that is highly likely to match your product and information interests. MatomoWe use the web analysis service of InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand, ("Matomo") on our website. To protect site visitors, Matomo uses a so-called "config_id" to enable various analyses of site usage within a short time window of up to 24 hours. The "config_id" is a randomly set, time-limited hash of a limited set of settings and attributes of the visitor. The config_id or config hash is a string of characters calculated for a visitor based on their operating system, browser, browser plugins, IP address, and browser language. Matomo does not use device fingerprinting and uses an anonymized IP address of the site visitor to create the "config_id". If the information processed in this way includes personal user data, the processing is carried out in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in the statistical analysis of user behaviour for optimisation and marketing purposes. In order to object to the processing of your visitor data in the future, we provide you with a separate objection option on our website. If data collected with the Matomo technology (including your pseudonymised IP address) is transmitted to Matomo's servers in New Zealand and processed for usage analysis purposes, we would like to inform you that the European Commission has issued a so-called adequacy decision for New Zealand, which certifies compliance with European data protection standards for international data transfers.

Newsletter/Existing Customer Acquisition

If you subscribe to our e-mail newsletter, we will regularly send you information about our offers. Personal data is collected for this purpose.The only mandatory information for sending the newsletter is your e-mail address. The provision of any further data is voluntary and will be used to address you personally. This data will be used by us for our own advertising purposes in the form of the e-mail newsletter, provided that you have expressly consented to this. We use the so-called double opt-in procedure to send the newsletter. This means that we will only send you an e-mail newsletter if you have expressly confirmed to us that you consent to the sending of the newsletter. We will then send you a confirmation e-mail asking you to confirm that you wish to receive the newsletter in the future by clicking on the corresponding link. By activating the confirmation link, you give us your consent for the use of your personal data in accordance with Art. 6 (1) (a) GDPR. When you register for the newsletter, we store your IP address entered by the Internet Service Provider (ISP) as well as the date and time of registration in order to be able to trace possible misuse of your email address at a later date. You can request@heine the newsletter at any time via the link provided in the newsletter or by sending us a corresponding message, e-mail . com. After unsubscribing, your e-mail address will be deleted immediately from our newsletter distribution list and included in a blocking file to ensure revocation. We use the contact details of our existing customers (e.g. name, address, e-mail address) to provide information about our products and services by means of e-mail or postal advertising. This processing is carried out on the basis of Article 6 (1) sentence 1 (f) GDPR (legitimate interest) and – in the case of advertising measures by e-mail – in accordance with the requirements of Section 7 (3) UWG. Our legitimate interest is to make relevant offers and maintain a long-term customer relationship. The personal data will only be stored for as long as it is necessary for the stated purpose (existence of the customer relationship) or you have not objected to its use. You have the right to object to the use of your data for advertising purposes at any time. You can do this informally by contacting us using the contact options mentioned above. Once we have received your objection, we will no longer use your data for advertising purposes. Our e-mail newsletters are sent to existing customers as well as to persons who have given us their consent for this purpose via the provider "Brevo" of Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. On the basis of our legitimate interest in effective and user-friendly newsletter marketing, we pass on the data you provide when registering for the newsletter to this provider in accordance with Art. 6 (1) (f) GDPR so that it can send the newsletter on our behalf. In addition, the provider carries out a statistical evaluation of the success of newsletter campaigns using web beacons or tracking pixels in the emails sent, which can measure opening rates and specific interactions with the content of the newsletter. Device information (e.g. time of access, IP address, browser type and operating system) is also collected and evaluated, but is not merged with other databases. HEINE does not send out a newsletter without this newsletter tracking. Persons who do not agree to the tracking cannot subscribe to the newsletter or, in the case of existing customers, must object to this. We have concluded a data processing agreement with the provider that protects the data of our site visitors and prohibits them from being passed on to third parties.

Social Networks

In addition to this online offer, we also maintain presences in various social media, which you can reach via corresponding buttons on our website. If you visit such a presence, personal data may be transmitted to the provider of the social network. It is possible that, in addition to the storage of the specific data you enter in this social media, other information is also processed by the provider of the social network. For more information, please see our Privacy Policy Social Media

Processing of your data in our online shop

Our website uses the Shopware 6 shop system from shopware AG (Ebbinghoff 10, 48624 Schöppingen, Germany). In the following, we explain the specific processing of personal data by Shopware 6 when using our online store. When you visit our webshop, Shopware 6 automatically processes technical information to ensure the functionality and security of the website:

IP address (in anonymized form)
Browser type and version
Operating System
Referrer URL (the previously visited page)
Date and time of the request
Session IDs and Session Management Cookies

The legal basis for this is Art. 6 (1) (f) GDPR (legitimate interest in the security and functionality of the shop). The following personal data is processed for the purpose of processing orders and managing customer accounts:

Last name, first name
E-mail address
Billing and delivery address
Phone number (if provided)
Payment Information
Bestell history

Shopware 6 also processes payment data as part of the execution of orders in order to process purchase contracts. For this purpose, your payment information will be transmitted to the payment service provider you have chosen. Depending on the payment method, this may include:

Bank details (IBAN, BIC) or credit card details
Transaction data (payment status, reference number, amount)
Beneficial owner (tax data can be requested for corporate customers).

Payment providers involved can be (depending on selection and integration):

PayPal (PayPal (Europe) S.à r.l. et Cie, Luxembourg)
Klarna (Klarna Bank AB, Sweden)
Stripe (Stripe Payments Europe Ltd., Irland)

The legal basis for this is Art. 6 (1) (b) GDPR (performance of a contract) and, if applicable, Art. 6 (1) (f) GDPR (interest in fraud protection and abuse detection). Shopware 6 stores session information to manage the shopping cart and current user actions. To do this, Shopware uses the following types of cookies:

Essential cookies: Stores the login and shopping cart contents
Session IDs: To identify recurring sessions

Data transfer:

Payment processing: Forwarding to the selected payment provider (see section Payment processing)
Shipping processing: Transmission of shipping data to logistics service providers (e.g. DHL, DPD, UPS)
Tax and accounting: Legally required disclosure to tax and tax authorities
Marketing & Analytics (only with consent): Sharing anonymized/aggregated data for shop optimization

Legal basis: Art. 6 para. 1 lit. b and c GDPR (performance of contract and legal obligation). No data transfer to third countries will take place without your knowledge and express consent. We only store your data for as long as is necessary for the respective purposes, in particular these may be: After the storage period has expired, your data will be securely deleted or anonymized.

Right of withdrawal – withdrawal from a contract

If you make use of the option to withdraw from a contract, as offered on our website, we will process your personal data in accordance with Section 355 of the German Civil Code (BGB) in conjunction with Section 312g German Civil Code (BGB) when you exercise your right of withdrawal, to the extent that this is necessary for the processing of the withdrawal procedure. When using the withdrawal function via our website, the following data is collected:

Personal details: Surname*, first name*, address, email address*, telephone number
Contract details: Order number*, order date, goods/services ordered, purchase price
Communication data: Content of the cancellation notice, correspondence regarding the cancellation
Payment data: Bank details (for the refund), payment information

The data marked with an asterisk (*) is requested via the web form and is used to identify the contract. The other data is necessary for processing the withdrawal and is held by us in connection with the contractual relationship. The processing of the aforementioned data is carried out solely for the purpose of handling your request to withdraw from the contract. In particular, we use your data for:

Receiving and processing your notice of withdrawal
Identifying the relevant contractual relationship
Reviewing and implementing the reversal of the contract in accordance with Section 357 of the German Civil Code (BGB)
Communicating with you regarding the withdrawal process, in particular to send you a confirmation of receipt on a durable medium (by email)
Complying with statutory retention obligations

Once you have successfully submitted your withdrawal, we will immediately send you a confirmation of receipt on a durable medium (email). This confirmation will include the content of your withdrawal notice, as well as the date and time we received it. Data processing is carried out on the following legal bases in accordance with Article 6 of the GDPR:

Article 6(1)(b) of the GDPR: For the performance of a contract or pre-contractual measures, including the handling of the withdrawal procedure.
Article 6(1)(c) GDPR: To comply with legal obligations, in particular retention obligations under commercial and tax law.
Article 6(1)(f) GDPR: To safeguard our company’s legitimate interests in the proper performance of the contract and the pursuit of legal claims.

Your data will be transferred to the following recipients as part of the returns process, insofar as this is necessary for its processing:

Internal departments: Customer Service, Accounting, Legal Affairs
Service providers: Payment service providers, delivery service providers (for returns)
Public authorities: Tax authorities, courts (in the event of legal disputes)

The data collected as part of the withdrawal process will be stored for as long as is necessary to process the withdrawal and rescind the contract. Once the withdrawal process has been completed, the data will be deleted, provided there are no legal obligations to retain it (e.g. under commercial or tax law).

Disclosure of your data to shipping service providers

The personal data collected by us will be passed on to the transport company commissioned with the delivery as part of the contract processing, insofar as this is necessary for the delivery of the goods. The delivery of the goods is carried out by the transport service provider (e.g. DHL (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn), DPD or UPS). If you have given us your consent during the ordering process, we will pass on your e-mail address to DHL in accordance with Art. 6 para. 1 lit. a GDPR before delivery of the goods for the purpose of coordinating a delivery date or for announcing delivery. Otherwise, we will only pass on the name of the recipient and the delivery address to DHL for the purpose of delivery in accordance with Art. 6 (1) (b) GDPR. The transfer will only take place if this is necessary for the delivery of the goods. In this case, it is not possible to coordinate the delivery date with DHL in advance or to announce the delivery. The consent can be revoked at any time with effect for the future vis-à-vis us or the transport service provider DHL.

Customer account

In order to enable you to use our webshop comfortably, we offer you the option of creating a personal customer account. When registering, we collect the following personal data:

First and last name
E-mail address
Billing and delivery address
Phone number (optional)
Encrypted access data (password)
Date of registration

After registration, we also store:

Bestell history
Payment methods (no full payment details unless required)
Wishlists or bookmarked items (if available)
Communication history with our customer service

Purpose of processing

To provide and manage your customer account
To simplify recurring orders
To view your order history
To personalize your shopping experience.

You can delete your customer account at any time, and we will no longer store your data.

Product Reviews

We offer you the opportunity to rate products or our webshop and to leave comments when you are logged in to your customer account. The following data will be collected or processed from you:

Your name
Date and time of assessment
Content of the review or comment
Rating in the form of stars or score

However, only the reviews without naming the reviewers are visible on the website. The reviews help other customers make a purchase decision and allow us to improve our offer. Please note that your reviews (without names) will be publicly displayed in the webshop. We reserve the right to remove inappropriate or illegal content. If you would like to remove or change a review you have submitted, please contact us using the contact details provided.

Changes to our privacy policy

We reserve the right to adapt our data protection information at short notice so that it always meets the current legal requirements or to implement changes to our services. This can be done, for example. the introduction of new services. The new data protection information will then apply to your return visit.