Privacy Policy

This privacy statement was last updated on 23. September 2026 and applies to citizens and legal permanent residents of the European Economic Area and Switzerland.

In this privacy statement, we explain what we do with the data we obtain about you via https://www.stadtansichten-wernigerode.de/en/. We recommend you carefully read this statement. In our processing we comply with the requirements of privacy legislation. That means, among other things, that:

  • we clearly state the purposes for which we process personal data. We do this by means of this privacy statement;
  • we aim to limit our collection of personal data to only the personal data required for legitimate purposes;
  • we first request your explicit consent to process your personal data in cases requiring your consent;
  • we take appropriate security measures to protect your personal data and also require this from parties that process personal data on our behalf;
  • we respect your right to access your personal data or have it corrected or deleted, at your request.

If you have any questions, or want to know exactly what data we keep of you, please contact us.

1. Purpose, data and retention period

We may collect or receive personal information for a number of purposes connected with our business operations which may include the following: (click to expand)

1.1 Contact – Through phone, mail, email and/or webforms

For this purpose we use the following data:

  • A first and last name
  • A home or other physical address, including street name and name of a city or town
  • An email address
  • IP Address
  • A telephone number

The basis on which we may process these data is:

It is necessary for the execution of a contract or preliminary procedures related to a contract to which the data subject is a party.

Retention period

We retain this data until the service is terminated.

1.2 Payments

For this purpose we use the following data:

  • A first and last name
  • A home or other physical address, including street name and name of a city or town
  • An email address
  • Financial information such as bank account number or credit card number
  • IP Address
  • A telephone number

The basis on which we may process these data is:

It is necessary for the execution of a contract or preliminary procedures related to a contract to which the data subject is a party.

Retention period

We retain this data until the service is terminated.

1.3 Registering an account

For this purpose we use the following data:

  • A first and last name
  • A home or other physical address, including street name and name of a city or town
  • An email address
  • IP Address
  • A telephone number

The basis on which we may process these data is:

Upon the provision of consent.

Retention period

We retain this data until the service is terminated.

1.4 Newsletters

For this purpose we use the following data:

  • An email address

The basis on which we may process these data is:

Upon the provision of consent.

Retention period

We retain this data until the service is terminated.

1.5 To support services or products that a customer wants to buy or has purchased

For this purpose we use the following data:

  • A first and last name
  • A home or other physical address, including street name and name of a city or town
  • An email address
  • Financial information such as bank account number or credit card number
  • IP Address
  • A telephone number

The basis on which we may process these data is:

Upon the provision of consent.

Retention period

We retain this data until the service is terminated.

1.6 Deliveries

For this purpose we use the following data:

  • A first and last name
  • A home or other physical address, including street name and name of a city or town
  • An email address
  • A telephone number

The basis on which we may process these data is:

It is necessary for the execution of a contract or preliminary procedures related to a contract to which the data subject is a party.

Retention period

We retain this data until the service is terminated.

2. Sharing with other parties

We only share or disclose this data to processors for the following purposes:

3. Cookies

Our website uses cookies. For more information about cookies, please refer to our Cookie Policy. 

4. Disclosure practices

We disclose personal information if we are required by law or by a court order, in response to a law enforcement agency, to the extent permitted under other provisions of law, to provide information, or for an investigation on a matter related to public safety.

If our website or organisation is taken over, sold, or involved in a merger or acquisition, your details may be disclosed to our advisers and any prospective purchasers and will be passed on to the new owners.

5. Security

We are committed to the security of personal data. We take appropriate security measures to limit abuse of and unauthorized access to personal data. This ensures that only the necessary persons have access to your data, that access to the data is protected, and that our security measures are regularly reviewed.

6. Third-party websites

This privacy statement does not apply to third-party websites connected by links on our website. We cannot guarantee that these third parties handle your personal data in a reliable or secure manner. We recommend you read the privacy statements of these websites prior to making use of these websites.

7. Amendments to this privacy statement

We reserve the right to make amendments to this privacy statement. It is recommended that you consult this privacy statement regularly in order to be aware of any changes. In addition, we will actively inform you wherever possible.

8. Accessing and modifying your data

If you have any questions or want to know which personal data we have about you, please contact us. You can contact us by using the information below. You have the following rights:

  • You have the right to know why your personal data is needed, what will happen to it, and how long it will be retained for.
  • Right of access: You have the right to access your personal data that is known to us.
  • Right to rectification: you have the right to supplement, correct, have deleted or blocked your personal data whenever you wish.
  • If you give us your consent to process your data, you have the right to revoke that consent and to have your personal data deleted.
  • Right to transfer your data: you have the right to request all your personal data from the controller and transfer it in its entirety to another controller.
  • Right to object: you may object to the processing of your data. We comply with this, unless there are justified grounds for processing.

Please make sure to always clearly state who you are, so that we can be certain that we do not modify or delete any data of the wrong person.

9. Submitting a complaint

If you are not satisfied with the way in which we handle (a complaint about) the processing of your personal data, you have the right to submit a complaint to the Data Protection Authority.

10. Contact details

Torsten WagnerwagnergraphicsBüchtingenstraße 2038855 WernigerodeGermanyWebsite: https://www.stadtansichten-wernigerode.de/en/Email: info@ex.comwagnergraphics.dePhone number: 03943 / 238 75-14

Annex

Complianz | The Privacy Suite for WordPress

This website uses the Privacy Suite for WordPress by Complianz to collect records of consent. For this functionality, your IP address is anonymized and stored in our database. You can find more information in the Complianz privacy statement.

 

MailPoet newsletters and emails

If you have subscribed to our newsletter, are a member of our website or have made a purchase on our website, it is very likely that you will receive emails from us. We will only send you emails if you have consented to this or if they concern our services that we have offered to you. To send you emails, we use the name and email address you have provided to us. Our website records the IP address you used when signing up for the service in order to prevent abuse. The website may send emails via the MailPoet Sending Service. This service allows us to record opens and clicks on our emails. We use this information to improve the content of our newsletters. Apart from the email address, no identifiable information is recorded outside this website. MailPoet creates and stores two cookies if you use WooCommerce and MailPoet together. These cookies are: Cookie name: mailpoet_revenue_tracking Cookie expiry: 14 days. Cookie description: The purpose of this cookie is to record which newsletters sent from our website have triggered click-throughs and a subsequent purchase in our WooCommerce store. Cookie name: mailpoet_abandoned_cart_tracking Cookie expiry: 3,650 days. Cookie description: The purpose of this cookie is to record a user who has abandoned their shopping cart in our WooCommerce store, in order to be able to send that user a targeted abandoned cart newsletter from MailPoet. Abandoned cart emails are only sent to users who have subscribed (opt-in) and confirmed their subscription. 

 

WP Compress (image and performance optimization)

On our website we use the WP Compress service to optimize images and other static media files (e.g. JavaScript or CSS) and to deliver them faster. This significantly improves the loading times of our website.

As the technical infrastructure for its content delivery network (CDN), WP Compress uses the provider BunnyWay d.o.o. (BunnyCDN) from Slovenia (EU).

Data protection and GDPR compliance through “Strict EU Routing”

We have configured WP Compress so that the “Strict EU Routing” option is active. This guarantees that both the processing (optimization of the images) and the delivery to site visitors take place exclusively via server locations within the European Union. No data transfer to third countries (such as the USA) takes place in this context.

Other important data protection aspects:

  • Transient processing of IP addresses: In order to deliver the content to your browser, brief technical processing of your IP address by the CDN is necessary. However, these IP addresses are not stored permanently. They are anonymized immediately after delivery or for internal logs (e.g. for security analysis), so that they can no longer be traced back to you personally.
  • No profiling: Only anonymized technical data required for delivery is processed (e.g. browser type, device type for the appropriate image size, approximate location for server selection). This data is not used to identify users.
  • No use of tracking cookies: WP Compress and the CDN used generally do not set any cookies that serve to identify or track users across websites.
  • Data storage exclusively in the EU: The activated EU routing option ensures that data processing and temporary storage (caching) remain on servers within the EU.

Legal basis for processing

WP Compress is used on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR in providing our website in a technically error-free, fast and high-performance manner.

Data processing

We have concluded a data processing agreement (DPA) with the provider of WP Compress, which guarantees the protection of your data and ensures that the provider processes the data only in accordance with our instructions. WP Compress uses BunnyCDN as a contractually bound sub-processor.

Further information

You can find further details in the WP Compress privacy policy and, in addition, in the information provided by BunnyCDN.

 

Independent Analytics

On our website we use the Independent Analytics plugin to analyze visitor behavior in a privacy-compliant manner. This plugin enables us to track interactions on our site without using cookies or storing personally identifiable information (PII).

Data protection and compliance:

  • Cookieless tracking: The plugin records data about visits to our website without setting cookies. This means that no consent is required for the use of cookies, which makes it easier to comply with the General Data Protection Regulation (GDPR).
  • No storage of personally identifiable information: 
  • No data is stored that could be used to identify a person. Name, address, email address, telephone number, date of birth, social security number
  • In this way, we respect the privacy of our users and act in accordance with the applicable data protection regulations.
  • No external data sharing: All collected data is stored securely on our own server and is not passed on to third parties. This ensures that we have full control over our analytics data.

By using the Independent Analytics plugin, we can gain valuable insights into user behavior while ensuring that we respect the privacy of our visitors. You can find more information on data protection and on how the plugin works in our detailed privacy statement.

 

Instagram posts / Facebook posts

The images from the Instagram posts are retrieved from the CDN server of Instagram / facebook (meta). The other content is stored locally on the server, so that displaying the content does not involve any further interaction with Instagram.Only when you click on the post may the original post on Instagram be opened in a new tab or browser window.

 

Web hosting and technical administration

Nature and purpose of the processing

This website is hosted by an external service provider (host). The personal data collected on this website is stored on the host’s servers. This may include, in particular, IP addresses, meta and communication data, contact details, names, website access data and other data generated via a website.

The host is used for the purpose of fulfilling contracts with our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of a secure, fast and efficient provision of our online offering by a professional provider (Art. 6(1)(f) GDPR).

 

Insofar as we also handle our email communication via this provider’s servers, the content of the email correspondence and the associated metadata (sender, recipient, timestamp) are also processed on its servers for the purpose of contract fulfillment and business communication (Art. 6(1)(b) and (f) GDPR).”

 

Host used:

ALL-INKL.COM – Neue Medien Münnich

Owner: René Münnich

Hauptstraße 68, 02742 Friedersdorf

Phone : +49 35872 353-10

Email: info@all-inkl.com

all-inkl.com

Privacy policy: https://all-inkl.com/datenschutzinformationen/

 

Data processing

We have concluded data processing agreements (DPA) pursuant to Art. 28 GDPR with the above-mentioned host. These are contracts required under data protection law which guarantee that the host processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

 

 

 

WooCommerce

 

We collect information about you during the checkout process in our shop.

 

What we collect and store

 

While you visit our website, we record:

Products viewed: We use this to show you products you have recently viewed (as a reminder).

Location, IP address and browser type: We use this for purposes such as estimating taxes and shipping costs.

Shipping address: We will ask you to provide this so that we can, for example, determine the shipping costs before you place an order, and send the order to you.

We also use cookies to keep track of the contents of your shopping cart while you are browsing our website. You can find details in our Cookie Policy.

When you make a purchase from us, we will ask you to provide information such as your name, your billing and shipping address, your email address and your telephone number, as well as optional account information such as username and password. We use this information for the following purposes:

Sending you information about your account and order.

Responding to your requests, including refunds and complaints.

Processing payments and preventing fraud.

Setting up your customer account for our shop.

Complying with all legal obligations, such as calculating taxes.

Improving our shop offerings.

Sending marketing messages, if you choose to receive them.

If you create an account with us, we store your name, your address, your email address and your telephone number. This information is used to fill in the payment details for future orders.

We generally store information about you for as long as we need it for the purposes for which it was collected and used and are obliged to store it. For example, we store order information for at least 10 years for tax and accounting reasons. This includes your name, your email address and your billing and shipping address.

We also store comments or reviews if you choose to leave them.

 

Who on our team has access

 

Members of our team have access to the information you provide to us. For example, both administrators and shop managers can access the following:

Order information such as the products purchased, the time of purchase and the shipping address, and

Customer information such as your name, email address, and billing and shipping information.

Our team members have access to this information in order to process orders, issue refunds and support you.

 

What we share with others (third-party providers)

 

We share information with third parties who help us provide our orders and services to you. These include:

 

1. Payment processing (WooCommerce Payments/Stripe, PayPal, Klarna, Google Pay, Apple Pay)

 

To process your payments, we use the WooCommerce Payments plugin, which is operated by Stripe and enables various payment methods such as PayPal, Klarna, Google Pay and Apple Pay.

During payment processing, some of your data is passed on to the respective payment service provider. Only information required for processing or carrying out the payment is passed on, such as the total purchase price, billing address and payment information.

Stripe (WooCommerce Payments): Stripe is our main service provider for payment processing. The data is passed on for the purpose of carrying out the payment, preventing fraud and risk analysis. You can find Stripe’s privacy policy here: https://stripe.com/de/privacy.

PayPal: If you choose this method, the necessary data is passed on directly to PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.). You can find PayPal’s privacy policy here: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Klarna: If you choose a Klarna payment option, the necessary data is passed on directly to Klarna Bank AB (publ). You can find Klarna’s privacy policy here: https://www.klarna.com/de/datenschutz/.

Google Pay: If you choose Google Pay, information necessary to process your payment is passed on to Google Payments, a subsidiary of Google LLC. You can find the privacy notice here: Google Payments privacy notice and https://policies.google.com/privacy.

Apple Pay: When you pay with Apple Pay, the necessary data is passed on to Apple Inc. You can find the privacy policy for Apple Pay here: https://www.apple.com/de/legal/privacy/data/de/apple-pay/.

 

2. Shipping service providers

 

In order to deliver your order, we share your shipping address as well as your name and, where applicable, your telephone number and email address (for shipment tracking) with the shipping service provider you have chosen (e.g. DHL, Hermes). The data is passed on for the performance of the purchase contract.

 

Google for WooCommerce

We use the “Google for WooCommerce” extension to provide our products in the Google Merchant Center and display them in Google services such as Google Shopping. In doing so, product data (e.g. title, price, availability, images) is transmitted to Google. Your visit is only measured via Google services (e.g. conversion tracking) if you have given your consent in the cookie banner (Art. 6(1)(a) GDPR). Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://policies.google.com/privacy

Pinterest for WooCommerce

We use the “Pinterest for WooCommerce” extension to provide our products as a product catalog on Pinterest. In doing so, only product data (e.g. title, description, price, availability, images) is transmitted to Pinterest, and no data about you as a visitor. In addition, our product pages contain so-called Rich Pin information in the source code so that price and availability are displayed when someone saves a page on Pinterest. We do not use a Pinterest tag or conversion tracking. Provider: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. Privacy policy: https://policy.pinterest.com/de/privacy-policy

 

Use of external communication and collaboration tools

Our social media presences

External links and social media presences

We maintain profiles or fan pages on various social media and platforms. These profiles serve to communicate with our customers, prospective customers and users who are active there and to inform them about our services.

  • Links: Links to our social media profiles on our website are integrated merely as static links. No data is transmitted to the platform operators as long as you visit our website and do not click on the link.
  • Data collection on the platform: After you click on the link and visit our profiles, the terms and conditions and data processing policies of the respective operator apply. There, your data is generally processed for market research and advertising purposes. This may result in the creation of usage profiles.

Joint controllership (Art. 26 GDPR)

We are jointly responsible with the respective operator for the collection of the so-called Insights data (statistics on visitors, likes, reach) that arises when our profiles are visited. We have concluded the agreements required under Art. 26 GDPR with the operators.

Responsible operators and privacy policies:

Your rights:

If you wish to request information or exercise your rights (e.g. to erasure), you can contact both us and the respective platform operator directly. However, the platform operator has primary responsibility for the processing of the Insights data and for fulfilling the rights of data subjects.

——————————————————

 

Use of the WhatsApp communication service

We use the messenger service WhatsApp Business provided by Meta Platforms Ireland Ltd. (Ireland) to get in touch and communicate with prospective customers and customers.

Purpose of processing: The service is used for quick and easy communication, e.g. to answer questions, arrange appointments or send brief information.

Legal basis: The service is used on the basis of your voluntarily given consent (Art. 6(1)(a) GDPR) or for the initiation or performance of a contract (Art. 6(1)(b) GDPR), insofar as the communication is relevant to the contract.

Data processing: If you contact us via WhatsApp using a link or button on our website, you leave our website. The terms of use and privacy policy of WhatsApp then apply.

  • Transmission: By using WhatsApp, you agree that Meta, as the operator, processes your telephone number, usage data and the metadata of the communication.
  • Contact information: We store the contact details you have transmitted to us (telephone number) exclusively in order to be able to reply to you via WhatsApp. We ensure that we only transmit contacts to WhatsApp from whom we have consent to use the service or who have actively contacted us.

Special notes:

  • Not an emergency contact: Please note that WhatsApp is not a secure communication channel for sensitive data or emergency messages.
  • Withdrawal: You can withdraw your consent to communication via WhatsApp at any time by contacting us via an alternative communication channel (e.g. email).

Further information: You can find WhatsApp’s privacy policy here: https://www.whatsapp.com/legal/privacy-policy

 

Website security (Security Ninja)

To protect the website against attacks and misuse, we use the WordPress plugin Security Ninja. In doing so, technical data such as IP address, time, page accessed and browser identifier are processed during accesses and login attempts and stored in logs on our server in order to detect and ward off attacks. The logs are automatically deleted after 7 days. IP addresses that have been blocked due to repeated failed attempts or attacks are stored by us for the duration of the block. The legal basis is our legitimate interest in the secure operation of the website (Art. 6(1)(f) GDPR).

 

Spam protection (Antispam Bee)

To protect against spam in comments and forms, we use the plugin Antispam Bee. The check takes place locally on our server; no data is transmitted to external services and no cookies are set. The legal basis is our legitimate interest in operating the website free of spam (Art. 6(1)(f) GDPR).

Appendix: WooCommerce online shop

Types of data processed

  • Master data (e.g. names, addresses).
  • Content data (e.g. entries in online forms).
  • Contact data (e.g. email, telephone numbers).
  • Meta/communication data (e.g. device information, IP addresses).
  • Usage data (e.g. websites visited, interest in content, access times).
  • Location data (information on the geographical position of a device or a person).
  • Contract data (e.g. subject matter of the contract, term, customer category).
  • Payment data (e.g. bank details, invoices, payment history).

Categories of data subjects

  • Business and contractual partners.
  • Prospective customers.
  • Communication partners.
  • Customers.
  • Users (e.g. website visitors, users of online services).

Purposes of processing

  • Assessment of creditworthiness and credit standing.
  • Provision of our online services and user-friendliness.
  • Evaluation of visitor campaigns.
  • Office and organisational procedures.
  • Cross-device tracking (cross-device processing of user data for marketing purposes).
  • Direct marketing (e.g. by email or post).
  • Interest-based and behavioural marketing.
  • Contact requests and communication.
  • Conversion tracking (measuring the effectiveness of marketing measures).
  • Profiling (creating user profiles).
  • Remarketing.
  • Reach measurement (e.g. access statistics, recognition of returning visitors).
  • Security measures.
  • Tracking (e.g. interest-/behaviour-based profiling, use of cookies).
  • Provision of contractual services and customer service.
  • Management and answering of enquiries.
  • Target group formation (determining target groups relevant for marketing purposes or other delivery of content).

Relevant legal bases

Below we inform you of the legal bases of the General Data Protection Regulation (GDPR) on the basis of which we process personal data. Please note that, in addition to the provisions of the GDPR, the national data protection requirements in your or our country of residence or registered office may apply. Furthermore, should more specific legal bases be relevant in individual cases, we will inform you of these in the privacy policy.

  • Consent (Art. 6(1)(a) GDPR) – The data subject has given consent to the processing of personal data concerning him or her for one specific purpose or several specific purposes.
  • Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legal obligation (Art. 6(1)(c) GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Art. 6(1)(f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

Use of cookies

Cookies are small text files or other storage records that store information on end devices and read information from end devices. For example, to store the login status in a user account, the contents of a shopping cart in an e-shop, the content accessed or the functions used in an online service. Cookies can also be used for various purposes, e.g. for the functionality, security and convenience of online services and for creating analyses of visitor flows.

Information on consent: We use cookies in accordance with the statutory provisions. We therefore obtain prior consent from users, unless this is not required by law. In particular, consent is not necessary if the storage and reading of information, including cookies, is strictly necessary in order to provide users with a telemedia service (i.e. our online service) that they have expressly requested. The revocable consent is clearly communicated to users and contains the information on the respective use of cookies.

Information on legal bases under data protection law: The legal basis under data protection law on which we process users’ personal data with the help of cookies depends on whether we ask users for consent. If users consent, the legal basis for processing your data is the declared consent. Otherwise, the data processed with the help of cookies is processed on the basis of our legitimate interests (e.g. in the commercial operation of our online service and the improvement of its usability) or, if this takes place in the context of fulfilling our contractual obligations, where the use of cookies is necessary to fulfil our contractual obligations. We explain the purposes for which we process cookies in the course of this privacy policy or as part of our consent and processing procedures.

Storage period: With regard to the storage period, the following types of cookies are distinguished:

  • Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online service and closed their end device (e.g. browser or mobile application).
  • Permanent cookies: Permanent cookies remain stored even after the end device has been closed. For example, the login status can be saved or preferred content can be displayed directly when the user visits a website again. Likewise, user data collected with the help of cookies can be used for reach measurement. Unless we provide users with explicit information on the type and storage period of cookies (e.g. when obtaining consent), users should assume that cookies are permanent and that the storage period can be up to two years.

General information on revocation and objection (opt-out): Depending on whether the processing is based on consent or a legal permission, you have the option at any time to revoke any consent you have given or to object to the processing of your data by cookie technologies (collectively referred to as “opt-out”). You can initially declare your objection via your browser settings, e.g. by deactivating the use of cookies (although this may also restrict the functionality of our online service). An objection to the use of cookies for online marketing purposes can also be declared for a large number of services, especially in the case of tracking, via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/. In addition, you can receive further information on objections in the information on the service providers and cookies used.

Processing of cookie data on the basis of consent: We use a cookie consent management procedure within the framework of which users’ consent to the use of cookies, or to the processing operations and providers named within the cookie consent management procedure, is obtained and can be managed and revoked by users. The declaration of consent is stored so that it does not have to be requested again and so that consent can be proven in accordance with the legal obligation. Storage can take place on the server side and/or in a cookie (so-called opt-in cookie, or with the help of comparable technologies) in order to be able to assign the consent to a user or their device. Subject to individual information on the providers of cookie management services, the following information applies: The consent may be stored for up to two years. A pseudonymous user identifier is created and stored together with the time of consent, information on the scope of consent (e.g. which categories of cookies and/or service providers) as well as the browser, system and end device used.

Cookie settings/option to object:

You can change or revoke your consent to cookies here at any time:

Commercial and business services

We process data of our contractual and business partners, e.g. customers and prospective customers (collectively referred to as “contractual partners”), in the context of contractual and comparable legal relationships and associated measures and in the context of communication with the contractual partners (or pre-contractually), e.g. to answer enquiries.

We process this data to fulfil our contractual obligations, to safeguard our rights and for the purposes of the administrative tasks associated with this information and of business organisation. We only pass on the data of contractual partners to third parties within the scope of applicable law to the extent that this is necessary for the aforementioned purposes or to fulfil legal obligations or takes place with the consent of the data subjects (e.g. to participating telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Contractual partners are informed about other forms of processing, e.g. for marketing purposes, within the scope of this privacy policy.

We inform contractual partners which data is required for the aforementioned purposes before or during data collection, e.g. in online forms, by special marking (e.g. colours) or symbols (e.g. asterisks or similar), or in person.

We delete the data after expiry of statutory warranty and comparable obligations, i.e. generally after 4 years, unless the data is stored in a customer account, e.g. as long as it must be retained for legal archiving reasons (e.g. for tax purposes, generally 10 years). We delete data disclosed to us by the contractual partner in the context of an order in accordance with the specifications of the order, generally after the end of the order.

Insofar as we use third-party providers or platforms to provide our services, the terms and conditions and privacy notices of the respective third-party providers or platforms apply in the relationship between the users and the providers.

Customer account: Contractual partners can create an account within our online service (e.g. customer or user account, “customer account” for short). If the registration of a customer account is required, contractual partners will be informed of this as well as of the information required for registration. Customer accounts are not public and cannot be indexed by search engines. In the course of registration and subsequent logins and use of the customer account, we store the customers’ IP addresses together with the access times in order to be able to prove the registration and prevent any misuse of the customer account.

If customers have terminated their customer account, the data relating to the customer account will be deleted, unless its retention is required for legal reasons. It is the customers’ responsibility to back up their data when the customer account is terminated.

Economic analyses and market research: For business reasons and in order to be able to identify market trends and the wishes of contractual partners and users, we analyse the data available to us on business transactions, contracts, enquiries, etc., whereby the group of data subjects may include contractual partners, prospective customers, customers, visitors and users of our online service.

The analyses are carried out for the purpose of business evaluations, marketing and market research (e.g. to determine customer groups with different characteristics). In doing so, we may, if available, take into account the profiles of registered users together with their information, e.g. on services used. The analyses serve us alone and are not disclosed externally, unless they are anonymous analyses with aggregated, i.e. anonymised, values. Furthermore, we respect the privacy of users and process the data for analysis purposes as pseudonymously as possible and, where feasible, anonymously (e.g. as aggregated data).

Shop and e-commerce: We process our customers’ data in order to enable them to select, acquire or order the chosen products, goods and associated services, as well as to pay for them and have them delivered or performed. If necessary for the execution of an order, we use service providers, in particular postal, freight forwarding and shipping companies, to carry out the delivery or performance for our customers. We use the services of banks and payment service providers to process payment transactions. The required information is marked as such during the order or comparable purchase process and includes the information needed for delivery, provision and invoicing as well as contact information in order to be able to hold any consultations.

  • Types of data processed: Master data (e.g. names, addresses), payment data (e.g. bank details, invoices, payment history), contact data (e.g. email, telephone numbers), contract data (e.g. subject matter of the contract, term, customer category), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Prospective customers, business and contractual partners, customers.
  • Purposes of processing: Provision of contractual services and customer service, contact requests and communication, office and organisational procedures, management and answering of enquiries, security measures, evaluation of visitor campaigns, interest-based and behavioural marketing, profiling (creating user profiles).
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR), legal obligation (Art. 6(1)(c) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Payment service providers

In the context of contractual and other legal relationships, on the basis of legal obligations or otherwise on the basis of our legitimate interests, we offer data subjects efficient and secure payment options and, in addition to banks and credit institutions, use other payment service providers for this purpose (collectively “payment service providers”).

The data processed by the payment service providers includes master data, such as name and address, bank data, such as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract, amount and recipient-related information. The information is required to carry out the transactions. However, the data entered is only processed by the payment service providers and stored with them. This means that we do not receive any account- or credit-card-related information, but only information confirming or declining the payment. Under certain circumstances, the data may be transmitted by the payment service providers to credit agencies. The purpose of this transmission is to check identity and creditworthiness. In this regard, we refer to the terms and conditions and the privacy notices of the payment service providers.

The payment transactions are subject to the terms and conditions and the privacy notices of the respective payment service providers, which can be accessed on the respective websites or transaction applications. We also refer to these for further information and for asserting rights of revocation, access and other data subject rights.

  • Types of data processed: Master data (e.g. names, addresses), payment data (e.g. bank details, invoices, payment history), contract data (e.g. subject matter of the contract, term, customer category), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Customers, prospective customers.
  • Purposes of processing: Provision of contractual services and customer service.
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Services and service providers used: