Privacy policy
PRIVACY POLICY
This Privacy Policy explains the nature, scope, and purpose of the processing of personal data (hereinafter referred to as “Data”) within our online offering and the associated websites, features, and content, as well as external online presences, such as our social media profiles (hereinafter collectively referred to as the “Online Offering”). With regard to the terms used, such as “processing” or “controller,” we refer to the definitions in Article 4 of the General Data Protection Regulation (GDPR).
PERSON IN CHARGE
Time for Nature GmbH
Autokaderstraße 33/11.3
1210 Vienna
Email address: hallo@holzkern.com
Managing Director: Georg Holzer
Link to the Legal Notice: https://holzkern.com/policies/legal-notice
Data protection officer: dpo@holzkern.com
TYPES OF DATA PROCESSED:
- Master data (e.g., names, addresses).
- Contact information (e.g., email, phone numbers).
- Content data (e.g., text entries, photographs, videos).
- Usage data (e.g., websites visited, content interests, access times).
- Meta/communication data (e.g., device information, IP addresses).
CATEGORIES OF AFFECTED INDIVIDUALS
Visitors and users of the online service (hereinafter, we collectively refer to the data subjects as “users”).
PURPOSE OF DATA PROCESSING
- Providing the online service, its features, and content.
- Responding to contact requests and communicating with users.
- Safety measures.
- Reach measurement/marketing
TERMS USED
“Personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”); a natural person is considered identifiable if they can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier (e.g., a cookie), or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
“Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and encompasses virtually any handling of data.
“Pseudonymization” is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that this additional information is kept separately and is subject to technical and organizational measures that ensure the personal data is not attributed to an identified or identifiable natural person.
“Profiling” means any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
The term “controller” refers to the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data.
“Data processor”: a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the data controller.
APPLICABLE LEGAL BASIS
In accordance with Article 13 of the GDPR, we are informing you of the legal bases for our data processing activities. Unless the legal basis is specified in the Privacy Policy, the following applies: The legal basis for obtaining consent is Article 6(1)(a) and Article 7 of the GDPR; the legal basis for processing to fulfill our services, carry out contractual obligations, and respond to inquiries is Article 6(1)(b) of the GDPR; the legal basis for processing to fulfill our legal obligations is Article 6(1)(c) of the GDPR, and the legal basis for processing to protect our legitimate interests is Article 6(1)(f) of the GDPR. In the event that the vital interests of the data subject or another natural person require the processing of personal data, Article 6(1)(d) of the GDPR serves as the legal basis.
SAFETY MEASURES
In accordance with Article 32 of the GDPR, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical access to the data, as well as access to, input of, and disclosure of the data, ensuring its availability, and maintaining its separation. Furthermore, we have established procedures that guarantee the exercise of data subjects’ rights, the deletion of data, and a response to data breaches. Furthermore, we take the protection of personal data into account from the very beginning of the development and selection of hardware, software, and procedures, in accordance with the principle of data protection by design and by default (Art. 25 GDPR).
USE OF CUSTOMER DATA IN THE EVENT OF AN UNCOMPLETED ORDER PROCESS, ABORTED PURCHASE, OR TECHNICAL PROBLEMS
If you provide an email address during the Secure Checkout process but do not complete the purchase, we reserve the right to store these email addresses in order to fulfill our commitment to customer service: That is, to send emails to customers to remind them of abandoned shopping carts and to provide additional information as a helpful service and reminder if the purchase process was not completed. Your data is processed pursuant to Article 6(1)(f) of the GDPR, based on our legitimate interest in offering this service and reminding customers of their purchase intent. If you do not wish this to occur, you may object to the processing of your data at any time by contacting us (hallo@holzkern.com). The information you provide when placing an order may also be used to verify whether an atypical ordering process is taking place (e.g., attempts to place multiple orders using the same email address or similar contact information) or, in the event of a technical problem, to ensure that our commitment to customer service is maintained. We have a legitimate interest in conducting such a verification. The legal basis for this data processing is Article 6(1)(f) of the GDPR.
COLLABORATION WITH CONTRACTORS AND THIRD PARTIES
To the extent that we disclose data to other individuals or companies (processors or third parties) in the course of our data processing, transfer it to them, or otherwise grant them access to the data, this is done only on the basis of a legal authorization (e.g., if the transfer of data to third parties, such as payment service providers, is necessary for the performance of a contract pursuant to Art. 6(1)(b) GDPR), you have given your consent, a legal obligation requires it, or on the basis of your consent (Article 6(1)(a) of the GDPR in conjunction with Section 165(3) of the TKG 2021).
If we engage third parties to process data on the basis of a so-called “data processing agreement,” this is done in accordance with Article 28 of the GDPR.
For shipping and delivery purposes, as well as for tracking, the necessary customer data (name, shipping address, email address, etc.) will be transmitted to the respective shipping provider.
AFTERSHIP
We use AfterShip for shipment tracking and shipping notifications (provider: AfterShip Group; data protection contact: Automizely Pte Ltd, 120 Robinson Road #13-01, Singapore 068913). We process your name, shipping/contact address, email address, as well as order and tracking data to inform you about the status of your shipment. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR) as well as our legitimate interest in transparent shipment tracking (Art. 6(1)(f) GDPR). Since processing takes place outside the EU/EEA (including Singapore and Hong Kong), the transfer is based on the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914) along with supplementary safeguards. For more details, see: https://www.aftership.com/legal/privacy.
TRANSFERS TO THIRD COUNTRIES
If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)), or if this occurs in connection with the use of third-party services or the disclosure or transfer of data to third parties, this will only take place if it is necessary to fulfill our (pre)contractual obligations, based on your consent, due to a legal obligation, or based on our legitimate interests. Subject to statutory or contractual permissions, we process data in a third country—or have it processed there—only if the specific requirements of Articles 44 et seq. of the GDPR are met. This means that processing takes place, for example, on the basis of specific safeguards, such as an officially recognized determination that the level of data protection in that country is equivalent to that of the EU. For transfers to the United States, provided the respective recipient is appropriately certified, we rely on the EU-U.S. Data Privacy Framework (EU Commission Adequacy Decision of July 10, 2023, Implementing Decision (EU) 2023/1795). In all other cases, the transfer is based on the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914) as well as, where applicable, supplementary safeguards.
RIGHTS OF DATA SUBJECTS
You have the right to request confirmation as to whether your personal data is being processed, as well as access to that data, further information, and a copy of the data in accordance with Article 15 of the GDPR. Pursuant to Article 16 of the GDPR, you have the right to request that data concerning you be completed or that inaccurate data concerning you be corrected. Pursuant to Article 17 of the GDPR, you have the right to request that the relevant data be erased without delay; alternatively, pursuant to Article 18 of the GDPR, you have the right to request a restriction on the processing of the data. You have the right to request, in accordance with Article 20 of the GDPR, to receive the data concerning you that you have provided to us and to request that it be transmitted to other data controllers. Furthermore, pursuant to Article 77 of the GDPR, you have the right to lodge a complaint with the competent supervisory authority.
RIGHT OF WITHDRAWAL
You have the right to withdraw any consent you have given in accordance with Article 7(3) of the GDPR with future effect.
RIGHT TO OBJECT
No decision based solely on automated processing—including profiling—that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR) will be made. To the extent that we use profiling for marketing, analysis, and recommendation purposes (see the sections on the individual services), this is done without such legal or comparably significant effects.
You may object at any time to the future processing of your personal data in accordance with Article 21 of the GDPR. In particular, you may object to processing for direct marketing purposes.
COOKIES AND THE RIGHT TO OPT OUT OF DIRECT MARKETING
“Cookies” are small files that are stored on users’ computers. Various types of information can be stored in cookies. A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during or after their visit to a website. Temporary cookies—also known as “session cookies” or “transient cookies”—are cookies that are deleted after a user leaves an online service and closes their browser. Such a cookie can, for example, store the contents of a shopping cart in an online store or a login status. Cookies that remain stored even after the browser is closed are referred to as “permanent” or “persistent.” For example, a user’s login status may be stored so that it remains active when the user returns to the site several days later. Similarly, such a cookie may store the user’s interests, which are used for audience measurement or marketing purposes. “Third-party cookies” are cookies provided by parties other than the controller operating the online service (in contrast, when only the controller’s own cookies are used, they are referred to as “first-party cookies”).
We may use temporary and permanent cookies, and we provide information about this in our Privacy Policy.
If users do not want cookies to be stored on their computers, they are asked to disable the corresponding option in their browser’s settings. Stored cookies can be deleted in the browser’s settings. Disabling cookies may result in limited functionality of this website.
To obtain and manage your consent regarding the use of cookies and similar technologies, we use the consent management tool “Consentmo GDPR Compliance.” The provider is iSenseLabs (Prof. Georgi Bradistilov St. 4, Sofia, Bulgaria). The following data is processed: the date and time the page was accessed, information about the browser and device, the IP address, and a record of your decisions to consent or decline. The purpose is the legally compliant collection, documentation, and management of consents. The legal basis is compliance with a legal obligation (Art. 6(1)(c) GDPR) as well as our legitimate interest in verifiable consent management (Art. 6(1)(f) GDPR). Processing takes place within the EU. You can change or withdraw your consents at any time with effect for the future via the cookie settings on our Privacy requests page (linked in the footer of every page).
General Opt-Out: A general objection to the use of cookies for online marketing purposes can be submitted for a wide range of services—especially in the case of tracking—via the U.S. website https://www.aboutads.info/ or the EU website https://www.youronlinechoices.com/. Furthermore, you can prevent cookies from being stored by disabling them in your browser settings. Please note that, in this case, you may not be able to use all features of this website.
DELETION OF DATA
The data we process will be deleted or its processing restricted in accordance with Articles 17 and 18 of the GDPR. Unless expressly stated in this Privacy Policy, the data we store will be deleted as soon as it is no longer necessary for its intended purpose and no legal retention obligations prevent its deletion. If the data is not deleted because it is required for other, legally permissible purposes, its processing will be restricted. This means the data will be blocked and not processed for any other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.
In accordance with Austrian legal requirements, records must be retained for 7 years pursuant to § 132(1) of the Federal Tax Code (BAO) (books, receipts, invoices, accounts, business documents, and statements of income and expenses), for 22 years in connection with real estate, and for 10 years for documents related to electronically provided services, as well as telecommunications, radio, and television services provided to non-business customers in EU member states for which the One-Stop-Shop (OSS) is utilized.
BUSINESS-RELATED PROCESSING
In addition, we process
- Contract details (e.g., subject matter of the contract, term, customer category).
- Payment information (e.g., bank account details, payment history)
from our customers, prospective customers, and business partners for the purpose of providing contractual services, customer service and support, marketing, advertising, and market research.
ORDER PROCESSING IN THE ONLINE STORE AND CUSTOMER ACCOUNT
We process our customers’ data as part of the ordering process in our online store to enable them to select and order the Products and services of their choice, as well as to facilitate payment, delivery, and fulfillment.
The data processed includes inventory data, communication data, contract data, and payment data; the individuals affected by this processing include our customers, prospective customers, and other business partners. The processing is carried out for the purpose of providing contractual services in connection with the operation of an online store, billing, shipping, and customer service. In doing so, we use session cookies to store the contents of the shopping cart and persistent cookies to store the login status.
Data processing is based on Article 6(1)(b) (fulfillment of order processes) and (c) (legally required archiving) of the GDPR. The information marked as required is necessary for the establishment and fulfillment of the contract. We disclose the data to third parties only in connection with delivery, payment, or as permitted or required by law in relation to legal advisors and government authorities. The data is processed in third countries only if this is necessary for the performance of the contract (e.g., at the customer’s request for delivery or payment).
Users have the option to create a user account, which allows them, in particular, to view their orders. During registration, users are informed of the required mandatory information. User accounts are not public and cannot be indexed by search engines. Once users have canceled their user accounts, their data associated with the account will be deleted, unless retention is necessary for commercial or tax law reasons in accordance with Art. 6(1)(c) of the GDPR. Information in the customer account remains there until it is deleted, after which it is archived if required by law. It is the users’ responsibility to back up their data upon termination prior to the end of the contract.
As part of the registration process, subsequent logins, and the use of our online services, we store the IP address and the time of each user action. This data is stored based on our legitimate interests, as well as the users’ interest in protection against misuse and other unauthorized use. This data is generally not disclosed to third parties, unless it is necessary to pursue our claims or there is a legal obligation to do so pursuant to Art. 6(1)(c) of the GDPR.
Data will be deleted upon the expiration of statutory warranty obligations and comparable obligations; the necessity of retaining the data is reviewed every three years; in the case of statutory archiving obligations, deletion occurs upon their expiration (in particular, upon the expiration of the seven-year retention period pursuant to § 132(1) BAO).
RIVO (LOYALTY & REFERRALS)
We use Rivo (Rivo, Inc., USA) for our customer loyalty, bonus, and referral program. The data processed includes account and contact information, order details, and point balances, as well as—in the case of referrals—information about the referred individuals. The purpose is to operate and manage the bonus/referral program. The legal basis is the performance of the contractual relationship (Art. 6(1)(b) GDPR) or your consent (Art. 6(1)(a) GDPR). Data is transferred to the U.S. based on the EU-U.S. Data Privacy Framework (to the extent certified) or the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914).
EXTERNAL PAYMENT SERVICE PROVIDERS
We use external payment service providers whose platforms allow users and us to process payment transactions (e.g., each with a link to the privacy policy),
Stripe (https://stripe.com/at/privacy)
PayPal (https://www.paypal.com/de/webapps/mpp/ua/privacy-full)
Klarna (https://www.klarna.com/de/datenschutz/)
Visa (https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html)
Mastercard (https://www.mastercard.de/de-de/datenschutz.html)
American Express (https://www.americanexpress.com/de/content/privacy-policy-statement.html)
In connection with the fulfillment of contracts, we use payment service providers on the basis of Article 6(1)(b) of the GDPR. In addition, we use external payment service providers on the basis of our legitimate interests pursuant to Article 6(1)(f) of the GDPR in order to offer our users effective and secure payment options.
The data processed by the payment service providers includes personal information, such as name and address; banking information, such as account numbers or credit card numbers; passwords, TANs, and checksums; as well as details related to the contract, transaction amounts, and recipients. This information is required to process the transactions. However, the data entered is processed and stored solely by the payment service providers. This means we do not receive any account- or credit card-related information, but only information confirming or rejecting the payment. In some cases, the payment service providers may transmit the data to credit bureaus. The purpose of this transmission is to verify identity and creditworthiness. For more information, please refer to the terms and conditions and privacy policies of the payment service providers.
Payment transactions are subject to the terms and conditions and privacy policies of the respective payment service providers, which are available on their respective websites or within the transaction applications. We also refer you to these documents for further information and to exercise your rights of withdrawal, access, and other data subject rights.
In order to offer you Klarna’s payment options, we will share personal data—such as contact information and order details—with Klarna. This allows Klarna to determine whether you are eligible to use the payment options offered through Klarna and to tailor those options to your needs. General information about Klarna is available here. Your personal information will be processed by Klarna in accordance with applicable data protection regulations and as described in Klarna’s Privacy Policy.
ADMINISTRATION, FINANCIAL ACCOUNTING, OFFICE ORGANIZATION, CONTACT MANAGEMENT
We process data in connection with administrative tasks, the organization of our operations, financial accounting, and compliance with legal obligations, such as archiving. In doing so, we process the same data that we process in connection with the provision of our contractual services. The legal bases for processing are Article 6(1)(c) of the GDPR and Article 6(1)(f) of the GDPR. This processing affects customers, prospective customers, business partners, and website visitors. The purpose and our interest in the processing lie in administration, financial accounting, office organization, and data archiving—that is, tasks that serve to maintain our business operations, fulfill our responsibilities, and provide our services. The deletion of data related to contractual services and contractual communication is in accordance with the information provided regarding these processing activities.
In doing so, we disclose or transmit data to tax authorities, advisors—such as tax consultants or auditors—as well as other billing agencies and payment service providers.
Furthermore, based on our business interests, we store information about suppliers, event organizers, and other business partners—for example, for the purpose of contacting them at a later date. We generally store this data, which is primarily business-related, on a permanent basis.
BUSINESS ANALYSIS AND MARKET RESEARCH
In order to operate our business efficiently and to identify market trends as well as the needs of our contractual partners and users, we analyze the data available to us regarding business transactions, contracts, inquiries, etc. In doing so, we process inventory data, communication data, contract data, payment data, usage data, and metadata on the basis of Article 6(1)(f) of the GDPR, whereby the data subjects include contractual partners, prospective customers, customers, visitors, and users of our online services.
The analyses are conducted for the purposes of business evaluations, marketing, and market research. In doing so, we may take into account the profiles of registered users, including information such as the services they have used. These analyses help us improve user-friendliness, optimize our offerings, and enhance operational efficiency. The analyses are used solely by us and are not disclosed externally, unless they consist of anonymous analyses with aggregated data.
If these analyses or profiles contain personal data, they will be deleted or anonymized upon termination of the user’s account; otherwise, they will be deleted or anonymized two years after the contract is concluded. In all other cases, overall business analyses and general trend assessments are prepared anonymously whenever possible.
KNO COMMERCE
After a purchase, we survey customers using the KNO Commerce survey tool (KnoCommerce, Inc., USA) to improve our offerings and services. We process your survey responses as well as associated order and usage data. The legal basis is your consent through voluntary participation (Art. 6(1)(a) GDPR) as well as our legitimate interest in market research and improving our offerings (Art. 6(1)(f) GDPR). Data is transferred to the U.S. based on the EU-U.S. Data Privacy Framework (where certified) or the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914).
REGISTRATION FUNCTION
Users can create a user account. During registration, users are informed of the required information, which is processed pursuant to Article 6(1)(b) of the GDPR for the purpose of providing the user account. The data processed includes, in particular, login information (name, password, and email address). The data entered during registration is used for the purposes of using the user account and fulfilling its intended function.
Users may be notified via email about information relevant to their user account, such as technical changes. If users have canceled their user account, their data related to that account will be deleted, subject to any legal retention requirements. It is the users’ responsibility to back up their data prior to the end of the contract term following cancellation. We are entitled to irrevocably delete all user data stored during the term of the contract.
When you use our registration and login functions, as well as your user account, we store your IP address and the time of each user action. This data is stored based on our legitimate interests, as well as the users’ interest in protection against misuse and other unauthorized use. This data is generally not disclosed to third parties, unless it is necessary to pursue our claims or there is a legal obligation to do so pursuant to Art. 6(1)(c) of the GDPR. IP addresses are anonymized or deleted after 7 days at the latest.
CONTACT US
When you contact us (e.g., via the contact form, email, phone, or social media), your information will be processed in accordance with Article 6(1)(b) of the GDPR for the purpose of handling your inquiry and processing it. Your information may be stored in a customer relationship management system (“CRM system”) or a comparable inquiry management system.
We delete inquiries once they are no longer necessary. We review their necessity every two years; furthermore, statutory archiving requirements apply.
MAIL ADVERTISING
We generally have an interest in using certain information for marketing purposes so that we can provide you with relevant offers. For direct mail advertising, we process the following information for our own marketing purposes as well as for the marketing purposes of third parties: first name, last name, mailing address, and year of birth.
We are also authorized to store additional personal information collected about you in compliance with legal requirements, in addition to the data mentioned above, for our own marketing purposes as well as for the marketing purposes of third parties. The goal is to provide you with advertising tailored solely to your actual or presumed needs and interests and, accordingly, to avoid bothering you with advertising that is not relevant to you.
Notice Regarding the Right to Object
You may object to the use of your personal information for the aforementioned marketing purposes at any time, free of charge and with future effect, by contacting us at hallo@holzkern.com.
If you object, your data will be blocked from further processing for advertising purposes. Please note that, in exceptional cases, you may still temporarily receive promotional material even after we have received your objection. This is due to technical reasons related to the necessary lead time for the selection process and does not mean that we have not implemented your objection.
PRODUCT AND PROMOTION RECOMMENDATIONS VIA EMAIL
As an existing customer, you’ll regularly receive product and promotional recommendations from us via email. You’ll receive these recommendations regardless of whether you’ve subscribed to a newsletter. We use the email address you provided during the purchase process to promote our own products, promotions, and/or services that are similar to those you’ve previously purchased from us. To select these recommendations, we take into account your previous orders and, if you have consented, how you use our website (see the section “Netcore Cloud (email marketing and product recommendations)”).
Notice Regarding the Right to Object
You may object to these recommendations at any time, free of charge, with future effect, by sending a notice to hallo@holzkern.com.
NEWSLETTER
The following information details the content of our newsletter, as well as our subscription, distribution, and statistical analysis procedures, and your rights to object. By subscribing to our newsletter, you agree to receive it and to the procedures described herein.
Newsletter Content: We send newsletters, emails, and other electronic notifications containing promotional information (hereinafter “newsletters”) only with the recipients’ consent or when permitted by law. If the newsletter’s content is specifically described during the subscription process, that description is decisive for the users’ consent. In addition, our newsletters contain information about our services and our company.
Double Opt-In and Logging: Signing up for our newsletter is done through a so-called double opt-in process. This means that after signing up, you will receive an email asking you to confirm your subscription. This confirmation is necessary to ensure that no one can sign up using someone else’s email address. Newsletter subscriptions are logged so that we can verify the subscription process in accordance with legal requirements. This includes storing the time of subscription and confirmation, as well as the IP address. Changes to your data stored with the email service provider are also logged.
Subscription Information: To subscribe to the newsletter, simply provide your email address. Optionally, we ask that you provide a name so we can address you personally in the newsletter.
The distribution of the newsletter and the associated performance measurement are based on the recipients’ consent pursuant to Art. 6(1)(a), Article 7 of the GDPR in conjunction with Section 174(3) of the TKG 2021; or, if consent is not required, based on our legitimate interests in direct marketing pursuant to Article 6(1)(f) of the GDPR in conjunction with Section 174(4) of the TKG 2021.
The registration process is logged based on our legitimate interests pursuant to Article 6(1)(f) of the GDPR. Our interest lies in using a user-friendly and secure newsletter system that serves both our business interests and meets users’ expectations, while also allowing us to maintain a record of consent.
Unsubscribe/Withdrawal—You can unsubscribe from our newsletter at any time, i.e., withdraw your consent. You’ll find a link to unsubscribe at the bottom of every newsletter. We may store unsubscribed email addresses for up to three years based on our legitimate interests before deleting them, in order to be able to prove that consent was previously given. The processing of this data is limited to the purpose of potentially defending against claims. An individual request for deletion is possible at any time, provided that the prior existence of consent is confirmed at the same time.
EMAIL DISPATCH
We use Netcore Cloud (Netcore Solutions UK Limited, United Kingdom) to send and evaluate our emails. Details on the data processed, the legal bases and transfers can be found in the section “Netcore Cloud (email marketing and product recommendations)”.
NEWSLETTER – MEASURING SUCCESS
The newsletters contain a so-called “web beacon,” i.e., a pixel-sized file that is retrieved from our server—or, if we use a mailing service provider, from their server—when the newsletter is opened. As part of this retrieval, technical information—such as details about your browser and system—as well as your IP address and the time of retrieval are collected.
This information is used to improve our services technically based on technical data or to analyze target groups and their reading behavior based on their locations (which can be determined using IP addresses) or access times. Statistical analyses also include determining whether newsletters are opened, when they are opened, and which links are clicked. For technical reasons, this information can be traced back to individual newsletter recipients. However, it is neither our intention nor—if used—that of the mailing service provider to monitor individual users. Rather, the analyses serve to help us identify our users’ reading habits and tailor our content accordingly, or to send different content based on our users’ interests.
Unfortunately, it is not possible to cancel the performance tracking separately; in this case, the entire newsletter subscription must be canceled.
HOSTING AND EMAIL DELIVERY
The hosting services we use are intended to provide the following: infrastructure and platform services, computing capacity, storage space, and database services, email delivery, security services, and technical maintenance services, which we utilize for the purpose of operating this online offering.
In doing so, we—or rather, our hosting provider—process inventory data, contact data, content data, contract data, usage data, meta data, and communication data from customers, prospective customers, and visitors to this online service based on our legitimate interests in providing this online service efficiently and securely, in accordance with Art. 6(1)(f) of the GDPR in conjunction with Article 28 of the GDPR (conclusion of a data processing agreement).
SHOPIFY
Shop System: We operate our online store via the Shopify platform. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (for users outside North America). As part of its operations, Shopify, acting as our data processor (Art. 28 GDPR), processes inventory, contact, contract, payment, and usage data. To the extent that data is transferred to the U.S. in this context, this is done on the basis of the EU-U.S. Data Privacy Framework or the Standard Contractual Clauses.
REBUY (PRODUCT RECOMMENDATIONS IN THE SHOP)
We use Rebuy (Rebuy, Inc., USA) for product recommendations and add-on suggestions in our online shop, for example on product pages and in the shopping cart. We process viewed products, shopping cart contents and order data as well as technical information such as a pseudonymous identifier, the IP address and browser information. Rebuy is part of our shop’s functions. For recommendations based on the products you are viewing and your shopping cart, the legal basis is our legitimate interest (Art. 6(1)(f) GDPR); no consent is required for this. Recognising you across visits only happens with your consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021); without consent, Rebuy records interactions with recommendations anonymously only. Rebuy processes the data on our behalf as a processor (Art. 28 GDPR) on servers in the USA; the transfer is based on the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914).
ADDRESS NINJA (ADDRESS VALIDATION AT CHECKOUT)
To make sure orders can be delivered, we check shipping and billing addresses at checkout with the Address Ninja app (Magical Apps, Toronto, Canada) against set rules, for example for missing house numbers, PO boxes or invalid special characters. We process the address data entered at checkout. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in deliverable addresses (Art. 6(1)(f) GDPR). Where data is transferred to Canada, this is based on the European Commission’s adequacy decision for Canada (Art. 45 GDPR).
AVALARA (TAX CALCULATION)
We use Avalara (Avalara, Inc., USA, or Avalara Europe Ltd., United Kingdom) to calculate taxes at checkout and to meet our tax reporting and payment obligations. We process the shipping address, ordered products, prices and order number. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and compliance with our tax obligations (Art. 6(1)(c) GDPR). Avalara processes the data on our behalf as a processor (Art. 28 GDPR). Transfers to the USA are based on the EU-US Data Privacy Framework (to the extent certified) or the European Commission’s Standard Contractual Clauses; for the United Kingdom, an adequacy decision of the European Commission exists.
GOOGLE TAG MANAGER
Google Tag Manager is a solution that allows us to manage so-called website tags via a user interface (and thus, for example, integrate Google Analytics and other Google marketing services into our online offerings). Tag Manager itself (which implements the tags) does not process any of the users’ personal data. With regard to the processing of users’ personal data, please refer to the following information about Google’s services. Terms of Service: https://www.google.com/intl/de/tagmanager/use-policy.html.
GOOGLE ANALYTICS
Based on your consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021), we use Google Analytics, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google uses cookies. The information generated by the cookie regarding users’ use of the online service is generally transmitted to a Google server in the United States and stored there.
Data transfers to the U.S. are based on the EU-U.S. Data Privacy Framework (EU Commission Adequacy Decision of July 10, 2023) or—where applicable—on the EU Commission’s Standard Contractual Clauses.
Google will use this information on our behalf to evaluate how users use our online service, to compile reports on activity within this online service, and to provide us with other services related to the use of this online service and Internet usage. In doing so, pseudonymous user profiles may be created from the processed data.
We use Google Analytics in its “Google Analytics 4” configuration. Google does not log or store IP addresses. Users’ IP addresses are used solely to derive approximate location information and are deleted immediately afterward; data collection from users in the EU or the EEA is initially carried out via servers located within the European Union.
The IP address transmitted by the user’s browser is not combined with other data held by Google. Users can prevent cookies from being stored by adjusting their browser settings accordingly or by using the cookie settings on our website. Without your consent, Google Analytics does not set any cookies. Google then only receives cookieless signals without a user identifier (Google Consent Mode), which are used exclusively for aggregated measurement and modelling; the legal basis for this is our legitimate interest in data-minimising audience measurement (Art. 6(1)(f) GDPR).
Opt-Out: For more information about Google’s use of data, as well as options for settings and opting out, please see Google’s Privacy Policy (https://policies.google.com/technologies/ads) and the settings for Google’s ad display (https://adssettings.google.com/authenticated). Here you can find information about Google’s use of personal data: https://business.safety.google/privacy. Users’ personal data is deleted or anonymized after 14 months.
Google Analytics 4
We use Google Analytics in its “Google Analytics 4” configuration. “Google Analytics 4” refers to a Google Analytics method in which user analysis is based on a pseudonymous user ID, thereby creating a pseudonymous user profile with information from the use of various devices (so-called “cross-device tracking”).
TARGET AUDIENCE SEGMENTATION WITH GOOGLE ANALYTICS
We use Google Analytics to display ads—placed through Google’s advertising services and those of its partners—only to users who have shown an interest in our online offerings or who exhibit certain characteristics (e.g., interests in specific topics or products, determined based on the websites they have visited), which we transmit to Google (so-called “Remarketing” or “Google Analytics Audiences”). With the help of Remarketing Audiences, we also aim to ensure that our ads align with users’ potential interests.
GOOGLE ADWORDS AND CONVERSION TRACKING
Based on your consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021), we use the services of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).
Data transfers to the U.S. are based on the EU-U.S. Data Privacy Framework (EU Commission Adequacy Decision of July 10, 2023) or—where applicable—on the EU Commission’s Standard Contractual Clauses.
We use Google’s “AdWords” online marketing service to place ads on the Google Display Network (e.g., in search results, in videos, on websites, etc.) so that they are shown to users who are likely to be interested in the ads. This allows us to display ads for and within our online platform in a more targeted manner, so that users are shown only ads that potentially match their interests. For example, if a user is shown ads for Products they have previously shown interest in on other websites, this is referred to as “remarketing.” For these purposes, when our website or other websites where the Google Display Network is active are accessed, a Google Code is executed directly by Google, and so-called (re)marketing tags (invisible graphics or Code, also known as “web beacons”) are embedded in the website. With their help, an individual cookie—that is, a small file—is stored on the user’s device (comparable technologies may also be used instead of cookies). This file records which websites the user has visited, what content the user is interested in, and which offers the user has clicked on, as well as technical information about the browser and operating system, referring websites, time of visit, and other details regarding the use of the online service. Please note, among other things, that YouTube is a Google product that may use the Google AdWords cookies that have been set.
In addition, we receive a unique “conversion cookie.” Google uses the information collected via this cookie to generate conversion statistics for us. However, we only receive the anonymous total number of users who clicked on our ad and were redirected to a page tagged with a conversion tracking tag. We do not receive any information that can be used to personally identify users.
User data is processed pseudonymously within the Google advertising network. This means that Google does not, for example, store or process users’ names or email addresses, but rather processes the relevant data on a cookie-by-cookie basis within pseudonymous user profiles. This means that, from Google’s perspective, ads are not managed and displayed for a specifically identified individual, but rather for the cookie holder, regardless of who that cookie holder is. This does not apply if a user has expressly permitted Google to process the data without this pseudonymization. The information collected about users is transmitted to Google and stored on Google’s servers in the United States. Without your consent, Google Ads does not set any cookies. Google then only receives cookieless signals without a user identifier (Google Consent Mode), which are used exclusively for the aggregated measurement and modelling of conversions; the legal basis for this is our legitimate interest in measuring the success of our advertising (Art. 6(1)(f) GDPR).
Opt-Out: For more information about Google’s use of data, as well as options for settings and opting out, please see Google’s Privacy Policy (https://policies.google.com/technologies/ads) and the settings for Google’s ad display (https://adssettings.google.com/authenticated).
GOOGLE DOUBLECLICK
Based on your consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021), we use the services of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).
Data transfers to the U.S. are based on the EU-U.S. Data Privacy Framework (EU Commission Adequacy Decision of July 10, 2023) or—where applicable—on the EU Commission’s Standard Contractual Clauses.
We use Google’s “DoubleClick” online marketing service to place ads on the Google Display Network (e.g., in search results, in videos, on websites, etc.). DoubleClick is characterized by the fact that ads are displayed in real time based on users’ presumed interests. This allows us to display ads for and within our online platform in a more targeted manner, so that users are presented only with ads that potentially match their interests. For example, if a user is shown ads for Products they have previously shown interest in on other online platforms, this is referred to as “remarketing.” For these purposes, when our website or other websites where the Google Display Network is active are accessed, a Google Code is executed directly by Google, and so-called (re)marketing tags (invisible graphics or Code, also known as “web beacons”) are embedded in the website. With their help, an individual cookie—that is, a small file—is stored on the user’s device (comparable technologies may also be used instead of cookies). This file records which websites the user has visited, what content the user is interested in, and which offers the user has clicked on, as well as technical information about the browser and operating system, referring websites, time of visit, and other details regarding the use of the online service.
Users’ IP addresses are also collected; within member states of the European Union or in other signatory states to the Agreement on the European Economic Area, these addresses are truncated, and only in exceptional cases are they transmitted in full to a Google server in the United States, where they are truncated. Google may also combine the information mentioned above with information from other sources. When the user subsequently visits other websites, ads tailored to the user may be displayed based on their presumed interests, as determined by their user profile.
User data is processed pseudonymously within the Google advertising network. This means that Google does not, for example, store or process users’ names or email addresses, but rather processes the relevant data on a cookie-by-cookie basis within pseudonymous user profiles. This means that, from Google’s perspective, ads are not managed and displayed for a specifically identified individual, but rather for the cookie holder, regardless of who that cookie holder is. This does not apply if a user has expressly permitted Google to process the data without this pseudonymization. The information collected by Google Marketing Services about users is transmitted to Google and stored on Google’s servers in the United States.
Opt-Out: For more information about Google’s use of data, as well as options for settings and opting out, please see Google’s Privacy Policy (https://policies.google.com/technologies/ads) and the settings for Google’s ad display (https://adssettings.google.com/authenticated).
Using Google Forms
We use Google Forms, a service provided by Google LLC, to create and manage surveys, forms, and data collection. The data you enter is used by us exclusively for the purpose for which you filled out the form (e.g., surveys, registrations). You have the right to access, correct, or delete your personal data at any time. For the European region, GOOGLE Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is responsible for GOOGLE services. The data you enter (e.g., name, email address, answers to questions) is processed by GOOGLE in accordance with its privacy policy. Please note that GOOGLE may also process data outside the European Economic Area. GOOGLE is a participant in the EU-U.S. Data Privacy Framework, which governs the secure transfer of personal data from EU citizens to the U.S. As a result, GOOGLE commits to adhering to European data protection standards when processing data, even if the data is stored, processed, or managed in the United States. Please note that GOOGLE Forms may use tracking technologies to analyze the use of the forms. By using GOOGLE Forms, you consent to this processing. If you have any questions or would like more information regarding the processing of your data by GOOGLE, you can contact GOOGLE directly. GOOGLE uses so-called standard contractual clauses. These are model clauses provided by the European Commission and ensure that data is processed in accordance with European data protection standards, even in the United States.
For more information on the EU’s Standard Contractual Clauses: https://eur-lex.europa.eu/TodayOJ/.
For more information: https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.
For more information about data processing by GOOGLE: https://policies.google.com/privacy?tid=139526774.
GOOGLE Ads Data Processing Terms: https://business.safety.google/adsprocessorterms/.
GOOGLE CLOUD (INFRASTRUCTURE AND DATA PROCESSING)
For hosting, computing capacity, database, and analytics services, we use Google Cloud Platform services, including Google Cloud Run, Google Firestore, and Google BigQuery. The provider for users in the EEA is Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland (with Google Ireland and Google LLC as additional entities involved). Google processes the data generated in connection with our online offering (including inventory, contact, contract, usage, and metadata) on our behalf as a data processor (Art. 28 GDPR) to enable technical provision, storage, and analysis. The legal basis is our legitimate interest in secure and efficient operation (Art. 6(1)(f) GDPR) in conjunction with Art. 28 GDPR. To the extent that data is transferred to the United States in this context, this is done on the basis of the EU-U.S. Data Privacy Framework or the Standard Contractual Clauses of the European Commission (Implementing Decision (EU) 2021/914).
KAMELEOON
To optimize our online offering, we conduct A/B tests and personalization using Kameleoon. The provider is Kameleoon SAS, 12 rue de la Chaussée d’Antin, 75009 Paris, France. In this process, usage data (e.g., pages visited, interactions, device/browser information, pseudonymous identifiers) is processed using cookies or similar technologies to test and display different versions of our offering. The legal basis is your consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021). Processing takes place within the EU. For more details: https://www.kameleoon.com/de/datenschutz.
BING ADS
Within our online offering, based on your consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021), we use the conversion and tracking tool “Bing Ads” from Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. In doing so, Microsoft stores cookies on users’ devices to enable an analysis of how users use our online service, provided that users have accessed our online service via a Microsoft Bing ad (so-called “conversion tracking”). In this way, Microsoft and we can determine that someone clicked on an ad, was redirected to our online service, and reached a predefined landing page (so-called “conversion page”). We only receive the total number of users who clicked on a Bing ad and were then redirected to the conversion page. No IP addresses are stored. No personal information regarding the users’ identities is disclosed.
Data transfers to the U.S. are based on the EU-U.S. Data Privacy Framework (EU Commission Adequacy Decision of July 10, 2023) or—where applicable—on the EU Commission’s Standard Contractual Clauses. The legal basis is your consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021).
Opt-Out: If users do not wish to participate in Bing Ads’ tracking process, they can disable the cookie required for this purpose via their browser settings or use Microsoft’s opt-out page: https://choice.microsoft.com/de-DE/opt-out.
Users can find more information about data protection and the cookies used by Microsoft Bing Ads in Microsoft’s Privacy Statement: https://privacy.microsoft.com/de-de/privacystatement.
FACEBOOK-PIXEL, CUSTOM AUDIENCES UND FACEBOOK-CONVERSION
Within our online service, based on your consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021) and for the purposes of analyzing, optimizing, and ensuring the economic operation of our online service, we use the so-called “Facebook Pixel” from the social network Facebook, which is operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, or, if you are located in the EU, Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”), is used.
Data transfers to the U.S. are based on the EU-U.S. Data Privacy Framework (EU Commission Adequacy Decision of July 10, 2023) or—where applicable—on the EU Commission’s Standard Contractual Clauses.
With the help of the Facebook Pixel, Facebook is able to identify visitors to our website as a target audience for displaying ads (so-called “Facebook Ads”). Accordingly, we use the Facebook Pixel to display the Facebook Ads we place only to those Facebook users who have shown an interest in our online offering or who exhibit certain characteristics (e.g., interests in specific topics or products, determined based on the websites they have visited), which we transmit to Facebook (so-called “Custom Audiences”). We also use the Facebook Pixel to ensure that our Facebook Ads align with users’ potential interests and do not come across as intrusive. Furthermore, using the Facebook Pixel, we can track the effectiveness of Facebook ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook ad (so-called “conversion”).
Facebook processes data in accordance with Facebook’s Data Use Policy. Accordingly, general information regarding the display of Facebook ads can be found in Facebook’s Data Use Policy: https://www.facebook.com/policy.php. Specific information and details about the Facebook Pixel and how it works are available in Facebook’s Help Center: https://www.facebook.com/business/help/651294705016616.
You can opt out of data collection via the Facebook Pixel and the use of your data to display Facebook ads. To control the types of ads you see on Facebook, visit the page set up by Facebook and follow the instructions for usage-based ad settings: https://www.facebook.com/settings?tab=ads. These settings apply across all platforms, meaning they are applied to all devices, such as desktop computers or mobile devices.
We match your user ID with the services of Meta Platforms, Inc. to obtain additional information about your user behavior relevant to ad delivery. The legal basis for this is your consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021).
Opt-Out: You can also opt out of cookies used for audience measurement and advertising purposes via the Network Advertising Initiative’s opt-out page (https://networkadvertising.org/), as well as the U.S. website (https://www.aboutads.info) or the European website (https://www.youronlinechoices.com).
ONLINE PRESENCE ON SOCIAL MEDIA
We maintain an online presence on social media networks and platforms to communicate with customers, prospective customers, and users active there and to inform them about our services. When accessing these networks and platforms, the terms and conditions and data processing policies of their respective operators apply.
Unless otherwise specified in our Privacy Policy, we process users’ data when they communicate with us on social networks and platforms, such as by posting on our online presence or sending us messages.
INTEGRATION OF THIRD-PARTY SERVICES AND CONTENT
Within our online offering, we rely on our legitimate interests (i.e., our interest in the analysis, optimization, and economic operation of our online offering within the meaning of Art. 6(1)(f) of the GDPR) to integrate content or services from third-party providers in order to incorporate their content and services, such as videos or fonts (hereinafter collectively referred to as “Content”).
This always requires that the third-party providers of this content collect users’ IP addresses, since without the IP address they would not be able to send the content to users’ browsers. The IP address is therefore necessary for displaying this content. We make every effort to use only content whose respective providers use the IP address solely for the purpose of delivering the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. These “pixel tags” allow information—such as visitor traffic on the pages of this website—to be analyzed. This pseudonymous information may also be stored in cookies on the user’s device and may include, among other things, technical information about the browser and operating system, referring websites, time of visit, and other details regarding the use of our online service; it may also be linked to such information from other sources. Where third-party providers use cookies or pixel tags for statistical or marketing purposes, this only happens with your consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021).
Our online service may incorporate features and content from Instagram, a service provided by Meta Platforms Ireland Limited. This may include, for example, content such as images, videos, or text, as well as buttons that allow users to share content from this online service on Instagram. If users are members of the Instagram platform, Instagram may associate their access to the aforementioned content and features with their Instagram profiles. The legal basis is your consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021).
Opt-Out: Instagram Privacy Policy: https://instagram.com/about/legal/privacy/.
X (formerly TWITTER)
Through the remarketing feature provided by X (X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA) used on our website, we can target visitors with interest-based advertising on X. To do this, X uses so-called “tags.” This tag tracks visits to the website as well as data regarding website usage. When a user visits a webpage containing such a tag, X places a cookie in the user’s browser. The unique ID of this cookie is recorded, and the user is included in the remarketing audience on X. If you subsequently visit X, you will be shown ads based on your interests. No personal data is collected or stored from you in this process, and you therefore cannot be identified by us on X.
Opt-Out: If you do not want X to show you targeted ads, you can disable this feature on X at https://help.x.com/de/safety-and-security/privacy-controls-for-tailored-ads.Weitere. Information about X’s privacy policy and X’s ads can be found here: https://business.x.com/de/help/troubleshooting/how-twitter-ads-work
NETCORE CLOUD (EMAIL MARKETING AND PRODUCT RECOMMENDATIONS)
We use the Netcore Cloud platform to send our emails (e.g. newsletters and product and promotion recommendations) and to personalize their content. Our contractual partner is Netcore Solutions UK Limited, T Bromley, Third Floor, 15-17 London Road, Bromley BR1 1DE, United Kingdom. For product recommendations, Netcore uses its Unbxd solution (Netcore Unbxd). Netcore processes the data on our behalf as a processor (Art. 28 GDPR).
We process your email address, your name, customer and order data from our online shop (e.g. products purchased, order value, shipping and cancellation status, started and uncompleted checkouts) and information about how you use our emails (e.g. opens and clicks).
If you have consented to the use of marketing cookies, we also record how you use our website (e.g. pages and products viewed, searches, actions in the shopping cart and on the wishlist). For this purpose, Netcore uses cookies and similar technologies (e.g. local storage). If we know your email address, for example after you have logged in to your customer account, signed up for our newsletter or opened a link from one of our emails, we link this usage behavior to your contact at Netcore. For product recommendations, our server sends product views, shopping cart actions and orders to Unbxd, using pseudonymous identifiers (a visitor ID derived from our web analytics and a hash value of your email address), a shortened IP address and information about your browser. This is used to create recommendations, such as recently viewed products or products matching your interests, which we show in our emails (profiling, see the section “Right to object”).
The legal basis for recording your usage behavior, linking it to your email address and transmitting it to Unbxd is your consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021). We use your customer and order data to select and personalize the content of our emails on the basis of our legitimate interest in relevant direct marketing (Art. 6(1)(f) GDPR). The sending of the emails themselves is based on the legal grounds stated in the sections “Newsletter” and “Product and promotion recommendations via email”.
The data is also processed in the United Kingdom, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). Where companies of the Netcore group outside the EEA and the United Kingdom, in particular in India, access the data, this is based on the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914). Netcore deletes the usage data of unidentified visitors after three months and that of identified contacts after twelve months. Contact data, orders and clicks in our emails are kept for as long as your contact exists. At your request, we delete your data at Netcore and Unbxd unless statutory retention obligations apply. More information: https://netcorecloud.com/privacy.
Withdrawal and objection: You can withdraw your consent at any time with effect for the future via the cookie settings on our Privacy requests page (linked in the footer of every page). You can object to processing for direct marketing purposes at any time and unsubscribe from our emails via the unsubscribe link in every email or by writing to hallo@holzkern.com.
We use the pixel (Pinterest Tag) provided by Pinterest Europe Ltd. (Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland). This pixel transmits information about usage (e.g., information about viewed items) to Pinterest Europe Limited. Pinterest Europe Limited is solely responsible under data protection law for the further processing of the data transmitted to it. Based on the information collected via the pixel, interest-based advertisements may be displayed to you in your Pinterest account (retargeting). The information collected via the pixel may also be aggregated by Pinterest Europe Limited, and the aggregated information may be used by Pinterest Europe Limited for its own advertising purposes as well as for the advertising purposes of third parties. For example, Pinterest Europe Limited may infer certain interests based on your browsing behavior on this website and use this information to promote third-party offers. Pinterest Europe Limited may also combine the information collected via the pixel with other information that Pinterest Europe Limited has collected about you through other websites and/or in connection with your use of the “Pinterest” social network, so that a profile about you can be stored by Pinterest Europe Limited. The legal basis is your consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021).
For more information on Pinterest Europe Limited’s privacy policy, please visit: https://policy.pinterest.com/de/privacy-policy.
Here, you can also exercise your rights as a data subject (e.g., the right to erasure) with regard to the data processed by Pinterest Europe Limited as the data controller.
CRITEO
On our websites, technology provided by Criteo GmbH (Criteo GmbH, Lehel Carré, Gewürzmühlstraße 11, 80538 Munich, Germany) collects and stores aggregated and, in any case, pseudonymized information about website visitors’ browsing behavior for marketing purposes. This data is stored in cookies on the visitor’s computer. Criteo GmbH uses an algorithm to analyze the browsing behavior recorded in this way and can then display targeted product recommendations as personalized advertising banners on other websites (so-called “publishers”). The data is pseudonymized for us and is not used by us to personally identify you as a visitor to our websites. The collected data is passed on to Criteo GmbH solely for the purpose of retargeting. The legal basis is your consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021).
We store the data for a period of 13 months.
Opt-Out: You can learn more about Criteo’s privacy policy and data protection guidelines in general, and opt out of the pseudonymous analysis of your browsing behavior at https://www.criteo.com/de/privacy/.
TRUSTED SHOPS
On our website, we integrate services provided by Trusted Shops SE, Subbelrather Str. 15C, 50823 Cologne. We are jointly responsible with Trusted Shops for the display of the Trustbadge and the associated rating function, in accordance with Article 26 of the GDPR.
Trust Badge and Review Widgets: When you visit our website, the Trust Badge is loaded to display the trust badge and existing customer reviews. The legal basis is our legitimate interest in optimal marketing by enabling a secure shopping experience in accordance with Article 6(1)(f) of the GDPR or, where consent has been given, Article 6(1)(a) of the GDPR.
Review Reminder and Customer Reviews: To solicit reviews, after your order is complete, we transmit the order total, the order number, your email address (hashed using a cryptographic one-way function), and, optionally, the product purchased to Trusted Shops so that they can email you a request for a review. The legal basis for this is your consent pursuant to Art. 6(1)(a) of the GDPR, which you may revoke at any time with future effect.
For more information, please see the Trusted Shops Privacy Policy: https://www.trustedshops.de/legal/protection-of-data-subjects/.
CND
To measure the impact of our TV commercials on our websites, we use Motion Media Analytics from CND (CND Motion Media GmbH, Holzstr. 2, 80469 Munich). For this purpose, we have implemented the CND tracking script on our websites. The service generally operates without cookies. If you have given your consent, CND sets a session cookie on our behalf to record page views, as well as a cookie containing the date and time of your first visit, which is deleted after 28 days. As part of this data collection, users are treated as purely statistical Size, and visitor events are recorded for purely statistical purposes. IP addresses processed in this context are anonymized. While you are using our website, CND does not collect or permanently store any personal data. It is therefore not possible to draw conclusions about individual households or individuals. We have entered into a data processing agreement with CND. The legal basis for the use of CND is Article 6(1)(f) of the GDPR and Article 6(1)(a) of the GDPR for cookies based on consent. For more information about the service provider, please visit: www.cnd-motionmedia.de
If, while visiting our website, you wish to prevent CND from collecting data, you can disable CND directly with the provider here: analytics.cnd-motionmedia.de/web/function/optout
Microsoft Clarity
Within our online offering, we use the web analytics tool Microsoft Clarity based on your consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021). The service provider is Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. When you visit this website, personal data is processed. Categories of data processed: data used to generate usage statistics. Purpose of processing: anonymization, generation of statistics, and analysis of usage behavior. Legal basis for processing: your consent pursuant to Article 6(1)(a) of the GDPR. Data is transferred to: the independent data controller Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. The legal basis for the transfer of data to Microsoft Ireland Operations Ltd. is your consent pursuant to Article 6(1)(a) of the GDPR. This may also involve the transfer of personal data to a country outside the European Union. The transfer of data to the United States is based on Article 45 of the GDPR in conjunction with the European Commission’s Adequacy Decision C(2023) 4745, as the data recipient has committed to complying with the data processing principles of the Data Privacy Framework (DPF). To contact the Data Protection Officer of Microsoft Ireland Operations Ltd. via email: www.microsoft.com/de-de/concern/privacy. The Privacy Statement of Microsoft Ireland Operations Ltd.: privacy.microsoft.com/de-de/privacystatement
GORGIAS
We use Gorgias to process customer inquiries (live chat, ticketing, help desk). The provider is Gorgias, Inc., San Francisco, California, USA. The data transmitted as part of the inquiry—such as name, email address, message/chat content, and associated order and contact information—is processed. The purpose is to respond to and manage service inquiries. The legal basis is Article 6(1)(b) of the GDPR (processing of the inquiry/pre-contractual measures) as well as our legitimate interest in providing efficient customer service pursuant to Article 6(1)(f) of the GDPR. Data is transferred to the U.S. based on the EU-U.S. Data Privacy Framework (if certified) or the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914).
Klar! Insights - Attribution
We use the services of Klar Insights GmbH, Marktstr. 18, 80802 Munich, Germany, a SaaS provider of business intelligence solutions for e-commerce companies. Klar Insights GmbH collects, processes, and stores data (user and session IDs, email addresses, IP addresses, and online identifiers (cookie IDs, device IDs)) on this website and its subpages on our behalf for the purposes of audience measurement and statistical analysis. To this end, we have entered into a data processing agreement with Klar Insights GmbH.
The collection of personal data is based on the legal basis of consent pursuant to Art. 6(1)(a) of the GDPR.
If the user grants consent, the data to be processed will be collected on a user-specific basis in accordance with Section 165(3) of the TKG 2021.
The following cookies are used for the various types of data collection mentioned above to ensure that each type of data collection functions properly:
september_id
september_has_consent
september_do_not_track (if you object)
Cookie - Objection
To opt out of using Klar! Insights, please use this link. This will set a cookie named “september_do_not_track” from the domain “holzkern.com.” Please do not delete this cookie, as otherwise we cannot guarantee that you will not be tracked by Klar.
You can find information about data protection and data usage by Klar on the following website: https://app.getklar.com/legal/data-protection
CHANGES TO THIS PRIVACY POLICY
We reserve the right to amend this Privacy Policy when we update our website or change our data processing procedures. We therefore recommend that you review our Privacy Policy regularly to stay informed of any changes. This Privacy Policy was last updated on November 5, 2026.
