Privacy Policy

2. Reasons for Data Processing

We collect and process your data to provide our website and to offer you the best possible service by giving you convenient access to our services.

 

3. Collection, Processing, and Use of Personal Data

3.1 Visiting Our Website

When you access our websites, our servers automatically collect general information, primarily for the purposes of establishing a connection, ensuring functionality, and maintaining system security. This includes the type of browser used, the operating system, the domain name of the Internet service provider, the connection data of the computer used (IP address), the website from which you visit us (referrer URL), the pages you visit on our site, as well as the date and duration of your visit. Due to pseudonymization, we are unable to use this data to identify specific individuals. This data is not combined with other data sources.

The legal basis for the processing is our legitimate interest in making our website available to interested individuals, as provided for in Article 6(1), first sentence, subparagraph (f) of the GDPR.

 

3.2 Accessibility with OneTap

To improve and enhance the accessibility of our website, we use the OneTap tool. This tool runs locally on our server and is delivered to your browser, where you can configure individual settings. No data is transmitted to the tool’s provider. Your settings are stored in the browser’s local storage and are not transmitted to other devices or to us. We do not receive any information about the settings you have chosen. You can delete the data from local storage at any time. You can find information on how to do this on your browser’s help pages. Alternatively, you can access the settings via the button in the lower-right corner of the browser window and select the “Reset settings” option there.

The legal basis for using this tool is our legal obligation to implement the Act on Strengthening Accessibility (BFSG) in conjunction with Article 6(1), sentence 1, letter c) of the GDPR. To the extent that we or parts of our website are not directly subject to the BFSG, it is our legitimate interest to provide all users of our website with the simplest and most uninterrupted user experience possible. In these cases, the legal basis is Article 6(1), sentence 1, subparagraph (f) of the GDPR.

 

3.3 Contact Form

If you contact us via the contact form, you must provide your name and email address, as well as your message to us. The data is stored for the purpose of processing your inquiry. We will delete the data collected in this context once storage is no longer necessary, or restrict its processing if there are legal retention requirements.

The legal basis for the processing of your personal data is Article 6(1), first sentence, subparagraph (b) of the GDPR if we contact you in connection with the conclusion of a contract, due to an interest in concluding a contract, or in connection with the performance of a concluded contract. Furthermore, it is in our legitimate interest to respond to your inquiries; therefore, in this case, the legal basis is Article 6(1)(f) of the GDPR.

 

3.4 Applications

We offer you the opportunity to apply for a position with us (for example, by email, mail, or through our online application form). Below, we provide information regarding the scope, purpose, and use of your personal data collected as part of the application process. We assure you that the collection, processing, and use of your data are carried out in accordance with applicable data protection laws and all other legal requirements, and that your data will be treated as strictly confidential.

If you submit an application to us, we will process your related personal data (for example, contact and communication information, application materials, notes taken during job interviews, etc.) to the extent necessary to make a decision regarding the establishment of an employment relationship.

The legal basis for this is the initiation of an employment relationship under Section 26 of the German Federal Data Protection Act (BDSG) or Article 6(1), sentence 1, subparagraph (b) of the GDPR. If you have given your consent—for example, to the permanent storage of your application and its inclusion in the applicant pool—the legal basis may also be your consent pursuant to Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect.

Your personal data will be shared within our company exclusively with individuals and departments involved in processing your application. If your application is successful, the data you submitted will be stored in our data processing systems pursuant to Section 26 of the German Federal Data Protection Act (BDSG) and Article 6(1)(b) of the General Data Protection Regulation (GDPR) for the purpose of carrying out the employment relationship.

If we are unable to offer you a position, if you decline a job offer, or if you withdraw your application, we reserve the right to retain the data you have submitted based on our legitimate interests within the meaning of Article 6(1)(f) of the GDPR for up to 6 months from the conclusion of the application process. Thereafter, the data will be deleted and the physical application documents will be destroyed. The retention of this data serves, in particular, as evidence in the event of a legal dispute. If it becomes apparent that the data will be required after the retention period has expired (in particular due to an impending or pending legal dispute), the data will not be deleted until the purpose for continued retention no longer applies. Data may also be retained for a longer period if statutory retention requirements preclude deletion.

We wish to evaluate all applicants solely on the basis of their qualifications and therefore ask that you refrain as much as possible from including information regarding racial or ethnic origin, political opinions, religious or philosophical beliefs, union membership, genetic data, biometric data used to uniquely identify a natural person, health data, or data regarding sex life or sexual orientation.

 

3.5 Contests

From time to time, you will have the opportunity to participate in sweepstakes on our website. As part of these sweepstakes, personal data (email address, name, mailing address, and, if applicable, other information necessary for the sweepstakes) may also be collected and stored for the purpose of administering the sweepstakes. The personal information you provide to us will be used exclusively for the administration of the sweepstakes (e.g., to determine the winner, notify the winner, and deliver the prize). In some cases, the data may be transferred to the merchant you specified when participating in the sweepstakes, who will be responsible for awarding the prizes. We will inform participants specifically about any data processing related to the particular sweepstakes as it occurs. Once our sweepstakes have ended, participants’ data will be deleted.

The legal basis for data processing is the contract for conducting the sweepstakes within the meaning of Article 6(1)(b) of the GDPR. If, in connection with the sweepstakes, you consent to the disclosure or other use of your personal data, the legal basis is your consent within the meaning of Article 6(1), first sentence, (a) of the GDPR. You may revoke your consent at any time with future effect by contacting us or our Data Protection Officer. Any data processing that took place prior to revocation remains lawful.

 

3.6 Scheduling Appointments Through Our Website

You can book or request a consultation appointment directly through our website. When you do so, the information you enter in the form will be transmitted and stored. This typically includes the date and time of your desired consultation appointment, your name, and your email address, so that we can provide you with feedback regarding your appointment request. Providing a phone number for any follow-up questions is optional.

The data is stored and processed for the purpose of handling your inquiry. The legal basis for the processing of your personal data is Article 6(1)(b) of the GDPR if we contact you in connection with the conclusion of a contract or the initiation of contract negotiations. In all other cases, the legal basis is our legitimate interest in responding to your inquiry pursuant to Article 6(1), first sentence, subparagraph (f) of the GDPR.

We delete the data collected in this context as soon as storage is no longer necessary. If statutory retention requirements apply, we will restrict processing as soon as the data is no longer necessary for the purpose for which it was originally collected and will delete the data once the statutory retention periods have expired.

 

3.7 Consultation Request (“Start Planning Your Kitchen Purchase—From the Comfort of Your Own Home”)

Using the “Start Your Kitchen Purchase—From Home” feature, you can share your ideas and needs regarding your desired kitchen with our consultants directly through our website in advance. The data you enter in the form will be transmitted. This typically includes the kitchen layout, your preferred kitchen style and color, details about the room, your preferences regarding functionality, information about household size, the timeframe and reason for the kitchen planning, as well as your budget. For follow-up purposes, we also ask for your name and email address. Providing a phone number, additional comments, and submitting documents relevant to the planning process is optional.

The data is stored and processed for the purpose of handling your inquiry and preparing for a consultation. The legal basis for the processing of your personal data is Article 6(1), first sentence, subparagraph (b) of the GDPR, if we contact you in connection with the conclusion of a contract or the initiation of contract negotiations. In all other cases, the legal basis is our legitimate interest in responding to your inquiry pursuant to Article 6(1), first sentence, subparagraph (f) of the GDPR.

We delete the data stored in this context as soon as storage is no longer necessary. If statutory retention requirements apply, we will restrict the processing of the data as soon as it is no longer necessary for the purpose for which it was originally collected, and we will delete the data once the statutory retention periods have expired.

 

3.8 Comments on Our Blog

On our blog, where we publish various posts on topics related to our activities, you can post public comments. Your comment will be published alongside the post under the username you provide. We recommend using a pseudonym instead of your real name. Providing a username and an email address is required; all other information is optional. When you post a comment, we also store your IP address, which we delete after one week. This storage is necessary to enable us to defend ourselves against liability claims in the event of the publication of unlawful content. We need your email address to contact you in the event that a third party reports your comment as unlawful.

The legal basis for the storage of your comment is Article 6(1), sentence 1, subparagraph (b) of the GDPR, insofar as it concerns the initial storage and public display of your comment; the basis is then the contract entered into for the use of the comment function. With regard to the storage of additional data, the legal basis is our legitimate interest in informing you if third parties have commented on your post, in accordance with Article 6(1), sentence 1, subparagraph (f) of the GDPR.

Comments are not moderated before publication. We reserve the right to delete comments if third parties report them as unlawful.

 

3.9 Third-Party Services

Below, we list the specific third-party services that may be used on this website.

 

3.9.1 Google Tag Manager

We use the “Google Tag Manager” service on our website, which is provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, or, if your company is headquartered or you reside in the EU, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

The service allows us to manage website tags via an online interface. This enables us to centrally manage and configure other services mentioned in this Privacy Policy, as well as integrate them or modify their settings without making any changes to our website’s source code. The service is hosted on a domain that does not collect any personal data itself. Although the service facilitates the integration of other services, it does not have access to this data.

The legal basis for using the Tag Manager is our legitimate interest in the simple and efficient management of services integrated into our website (in particular, with your consent as described in this Privacy Policy). The legal basis for data processing is therefore Article 6(1)(f) of the GDPR.

The legal basis for the transfer of personal data to the United States is either standard data protection clauses entered into with Google pursuant to Article 46(2)(c) GDPR, or an adequacy decision by the European Commission pursuant to Article 45 of the GDPR, which is based on the EU-U.S. Data Privacy Framework (DPF), for which Google is certified and which can therefore serve as the legal basis for data transfers to the United States. For further information on this matter, please refer to the contact details provided in Section 1.

You can find Google’s privacy policy at the following link:

https://policies.google.com/privacy?hl=de

You can find Google’s Cookie Policy at this link:

https://policies.google.com/technologies/cookies?hl=de

 

3.9.2 Google Maps

On this website, we use the “Google Maps” service, operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).

This allows us to display interactive maps directly on the website and enables you to conveniently use the map feature. When you visit the website, Google receives the information that you have accessed the corresponding subpage of our website. In addition, the IP address, the date and time of the request, the time zone difference from Greenwich Mean Time (GMT), the content of the request (specific page), the access status/HTTP status code, the amount of data transferred, the website from which the request originated (known as the referrer), the type and version of the browser used along with the language version, and the type and version of the operating system along with the user interface used. This information (including your IP address) is transmitted directly from your browser to a Google server in the United States and stored there.

This data is transmitted regardless of whether you are logged into a Google user account or do not have a user account. If you are logged into Google, your data will be directly associated with your account. If you do not wish for your data to be associated with your Google profile, you must log out of your Google account before using our website. Google stores your data as usage profiles and uses them for advertising, market research, and/or to tailor its website to user needs. Such analysis is carried out in particular (even for users who are not signed in) to deliver personalized advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles; to exercise this right, you must contact Google.

For more information on the purpose and scope of data collection and its processing by YouTube, please refer to the privacy policy. There you will also find additional information about your rights and the settings available to protect your privacy:

https://policies.google.com/privacy?hl=de&gl=de

The legal basis for the collection and processing of data is your consent within the meaning of Article 6(1), first sentence, letter a) of the GDPR, which you may have provided to us during your first visit to our website. You may revoke the consent you have given for data processing at any time with future effect. To do so, please contact our Data Protection Officer using the contact information provided or use the link to manage your consents, which you will find in this Privacy Policy under the “Cookies” section. Withdrawing your consent does not affect the lawfulness of any data processing that took place prior to the withdrawal.

The legal basis for the transfer of personal data to the United States is either the Standard Data Protection Clauses entered into with Google pursuant to Article 46(2)(c) GDPR or an adequacy decision by the European Commission pursuant to Article 45 of the GDPR, specifically the EU-U.S. Data Privacy Framework (DPF), for which Google is certified and which can therefore serve as the legal basis for data transfers to the United States. For further information on this matter, please refer to the contact details provided in Section 1.

You can find Google’s privacy policy at the following link:

https://policies.google.com/privacy?hl=de

You can find Google’s Cookie Policy at this link:

https://policies.google.com/technologies/cookies?hl=de

 

3.9.3 YouTube Videos

On our website, we use the “YouTube” service, operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; or, if your company’s registered office or your place of residence is in the EU, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

YouTube videos are integrated into our website in such a way that the content stored on https://www.youtube.com can be played directly from our website. No data will be transmitted to YouTube if you have not consented to the display of videos. When you visit the website, YouTube receives the information that you have accessed the corresponding page of our website. The IP address,

Date and time of the request, time zone difference from Greenwich Mean Time (GMT), content of the request (specific page), access status/HTTP status code, the amount of data transferred, the website from which the request originates (known as the referrer), type and version of the browser used, along with the language version, as well as the type and version of the operating system and the user interface used.

This occurs regardless of whether YouTube provides a user account through which you are logged in or whether you do not have a user account. If you are logged in to Google, your data will be directly associated with your account. If you do not want this data to be associated with your YouTube profile, you must log out of YouTube and Google before playing the video on our website.

YouTube stores your data as usage profiles and uses it for advertising, market research, and/or to tailor its website to your needs. Such analysis is carried out in particular (including for users who are not logged in) to deliver targeted advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles; to exercise this right, you must contact Google.

The legal basis for the collection and processing of data is your consent within the meaning of Article 6(1), sentence 1, letter a) of the GDPR, which you may have provided to us during your first visit to our website. You may revoke your consent to data processing at any time with future effect. To do so, please contact our Data Protection Officer using the contact information provided or use the link to manage your consents, which you will find in this Privacy Policy under the section titled “Cookies.” Withdrawal of consent does not affect the lawfulness of data processing carried out prior to the withdrawal.

The legal basis for the transfer of personal data to the United States is either the Standard Data Protection Clauses entered into with Google pursuant to Article 46(2)(c) GDPR, or an adequacy decision by the European Commission pursuant to Article 45 of the GDPR, specifically the EU-U.S. Data Privacy Framework (DPF), for which Google is certified and which can therefore serve as the legal basis for data transfers to the United States. For further information on this matter, please refer to the contact details provided in Section 1.

You can find Google’s privacy policy at the following link:

https://policies.google.com/privacy?hl=de

You can find Google’s Cookie Policy at this link:

https://policies.google.com/technologies/cookies?hl=de

 

3.9.4 Vimeo Videos

On our website, we use the video service “Vimeo,” which is operated by Vimeo LLC, 555 West 18th Street, New York, New York 10011, USA (“Vimeo”).

This service allows us to embed videos on our website that are stored on Vimeo’s servers rather than on our own, which ensures more efficient and effective display and streaming of the video files, as well as the ability to store videos centrally. When you access a video stored on Vimeo, your browser immediately connects to Vimeo’s services or pages and downloads content from their servers. Vimeo videos are not embedded or activated until you have given your consent to the use of Vimeo.

When you access or play videos on Vimeo, metadata regarding the connection between your device and Vimeo’s servers is collected. The data collected includes your IP address, browser type, and other information (such as language), information about the device used, the website from which Vimeo was accessed (known as the referrer URL), pages visited on Vimeo, the operating system of the device used, search queries on Vimeo, and information that you provide or enter on the website.

The legal basis for the collection and processing of data (with the exception of the data mentioned immediately above) is your consent within the meaning of Article 6(1), first sentence, letter a) of the GDPR, which you may have provided to us during your first visit to our website. You may revoke the consent you have given for data processing at any time with future effect. To do so, please contact our Data Protection Officer using the contact information provided or use the link to manage your consents, which you will find in this Privacy Policy under the “Cookies” section. Withdrawing your consent does not affect the lawfulness of the data processing that took place prior to the withdrawal.

The legal basis for the transfer of personal data to the United States is the Standard Data Protection Clauses entered into with Vimeo pursuant to Article 46(2)(c) of the GDPR. For further information on this matter, please contact us using the contact information provided in Section 1.

You can find Vimeo’s privacy policy at the following link:

https://vimeo.com/privacy

You can find Vimeo’s Cookie Policy at the following link:

https://vimeo.com/cookie_policy

 

 

3.9.5 Instagram Feed

On our website, we use the “Instagram Feed” from the social network Instagram, operated by Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or, if your company is headquartered or you reside in the EU or the EEA, Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Dublin, Ireland (collectively “Meta”).

By integrating the Instagram feed, we are able to display posts that we publish on the social network on our website as well. This helps us showcase our services and the products we sell. The Instagram feed will not be integrated until you have given your consent.

When the Instagram feed is loaded, metadata regarding the connection between your device and Meta’s servers is collected. The data collected includes the IP address, browser type, and other information (such as language), information about the device used, the website on which the Instagram feed is embedded (known as the referrer URL), posts viewed on Instagram, and the operating system of the device used.

The legal basis for using the Instagram feed on our website is Article 6(1)(a) of the GDPR, provided that you gave us your consent to do so when you first visited the site. You may revoke your consent to data processing at any time with future effect. To do so, please contact our Data Protection Officer using the contact information provided or use the link to manage your consents, which you will find in this Privacy Policy under the “Cookies” section. Withdrawal of consent does not affect the lawfulness of data processing carried out prior to the withdrawal.

With regard to data processing, we are jointly responsible with Meta. We have therefore entered into a joint controller agreement with Meta pursuant to Article 26 of the GDPR, in which Meta also commits to protecting your personal data and not sharing it with third parties for purposes other than those mentioned above. The agreement can be viewed at the following link:

https://de-de.facebook.com/legal/terms/page_controller_addendum

The legal basis for the transfer of personal data to the United States is either standard data protection clauses entered into with Meta pursuant to Art. 46(2)(c) GDPR, or an adequacy decision by the European Commission pursuant to Article 45 of the GDPR, specifically the EU-U.S. Data Privacy Framework (DPF), for which Meta is certified and which can therefore serve as the legal basis for data transfers to the U.S. For more information on this, please refer to the contact details provided in Section 1.

You can find the option to opt out of personalized advertising as follows; please note that you must be logged in to your Facebook account to use this option:

https://www.facebook.com/settings?tab=ads

You can find Meta’s privacy policy at the following link:

https://www.facebook.com/about/privacy/

 

 

3.9.6 ProvenExpert.com Widget

On our website, we use “Proven Expert,” which is provided by Expert Systems AG, Quedlinburger Straße 1, 10589 Berlin (“Expert Systems”).

Using Proven Expert, we can directly embed customer reviews on our website. As a customer, this gives you the opportunity to rate our services on our website. When you submit a review, Expert Systems collects and stores your email address, as well as technical data—such as your IP address and information about the web browser you are using—in an associated log file. In addition, Expert Systems also stores any other voluntary information you provide.

We use Proven Expert to give you the opportunity to rate services on our website. At the same time, Proven Expert is used for quality assurance and optimization purposes. To ensure the authenticity of a review and to prevent misuse of the review system—such as through spam or multiple reviews by the same user—it is necessary for Expert Systems to process and store the aforementioned data; in this respect, the use of Proven Expert therefore serves to safeguard the security and integrity of our IT systems. This also constitutes our legitimate interest in processing the aforementioned information, so that in this case, the legal basis is Article 6(1), sentence 1, letter f) of the GDPR.

The legal basis for the collection and processing of data (with the exception of the data mentioned immediately above) is your consent within the meaning of Article 6(1), first sentence, letter a) of the GDPR, which you may have provided to us during your first visit to our website. You may revoke the consent you have given for data processing at any time with future effect. To do so, please contact our Data Protection Officer using the contact information provided or use the link to manage your consents, which you will find in this Privacy Policy under the “Cookies” section. Withdrawing your consent does not affect the lawfulness of data processing carried out prior to the withdrawal.

For information on data protection at Expert Systems, please visit the following link:

https://www.provenexpert.com/de-de/datenschutzbestimmungen/

 

3.9.7 Issuu Media

On our website, we use the “Issuu Media” service, which is operated by Issuu Inc., 131 Lytton Ave, Palo Alto, CA 94301, USA (Issuu).

This service allows us to publish and distribute magazines and catalogs. To this end, Issuu provides a so-called “page-turning catalog” or “e-paper” that replicates the feel of a paper catalog on your device. The magazines and magazine excerpts we host on Issuu are displayed exclusively on the Issuu website. As soon as you visit one of our web pages linked to Issuu, you will be automatically redirected to the Issuu website. As soon as you view the e-papers we provide, data indicating the time and duration of use is transmitted to the Issuu server. When you visit one of our pages equipped with an Issuu plugin, a connection is established with Issuu’s servers. In particular, the following data is transmitted to Issuu’s servers: IP address, pages visited, referrer URL (i.e., the URL from which you accessed Issuu), downloads, date and time of the visit, as well as data regarding the browser, device, and operating system used.

When you are logged into your Issuu account, you allow Issuu to associate your usage behavior directly with your personal profile. You can prevent this by logging out of your Issuu account. The legal basis for this association with your profile is any consent you may have provided to Issuu; to revoke this consent, you must contact Issuu directly.

We use Issuu only with your prior consent, which you may have provided to us upon your first visit to this website via our consent management tool. The legal basis for data processing is therefore Article 6(1)(a) of the GDPR. Consent that has been given may be withdrawn at any time with future effect. To do so, please contact our Data Protection Officer using the contact information provided or use the link to manage your consents, which you will find in the “Cookies” section of this Privacy Policy. The revocation of consent does not affect the lawfulness of data processing carried out prior to the revocation.

The legal basis for the transfer of personal data to the United States is the standard data protection clauses entered into with Issuu pursuant to Article 46(2)(c) of the GDPR. For more information on this, please contact us using the contact information provided in Section 1.

You can find Issuu’s privacy policy at the following link:

https://issuu.com/legal/privacy

You can find Issuu’s information regarding its use of cookies at the following link:

https://issuu.com/legal/cookies

 

3.9.8 Google Analytics

On this website, we use “Google Analytics,” a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, or, if your company is headquartered or you reside in the EU, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Analytics uses so-called “cookies.” Cookies are text files that are stored on your computer and make it possible to distinguish between individual users and individual sessions of a user. During your visit to the website, your user behavior is tracked and stored by Google Analytics in the form of “events.” The events stored may include: page views, first-time visits to the website, session start, interactions with the website (including scrolling on the page), clicks on external links, internal search queries, interactions with videos, file downloads, ads viewed or clicked, and language settings. In addition to these events, Google Analytics stores your approximate location (region), IP address (in anonymized form), technical information about the browser and device you are using (such as language settings and screen resolution), as well as your Internet service provider and the referrer URL.

Based on the data mentioned above, Google analyzes your use of our website and compiles reports on website activity, which we use to analyze website usage.

We use Google Analytics only after obtaining your prior consent, which you may have provided to us during your first visit to this website via our consent management tool. The legal basis for data processing is therefore Article 6(1), first sentence, letter a) of the GDPR. Consent that has been given may be revoked at any time with future effect. To do so, please contact our Data Protection Officer using the contact information provided or use the link to manage your consent, which you can find in this Privacy Policy under the “Cookies” section. The revocation of consent does not affect the lawfulness of the data processing carried out prior to the revocation.

You can prevent cookies from being stored by adjusting the settings in your browser. In that case, you may not be able to take full advantage of all the features of our website.

You can disable the “personalized ads” feature in your Google Account settings to stop cross-device tracking. To do so, follow the instructions on this page:

https://support.google.com/ads/answer/2662922?hl=de

The legal basis for the transfer of personal data to the United States is either the Standard Data Protection Clauses entered into with Google pursuant to Article 46(2)(c) GDPR, or an adequacy decision by the European Commission pursuant to Article 45 of the GDPR, which is based on the EU-U.S. Data Privacy Framework (DPF), for which Google is certified and which can therefore serve as the legal basis for data transfers to the United States. For further information on this matter, please refer to the contact details provided in Section 1.

You can find Google’s privacy policy at the following link:

https://policies.google.com/privacy?hl=de

You can find Google’s Cookie Policy at this link:

https://policies.google.com/technologies/cookies?hl=de

 

3.9.9 Facebook Pixel

On our website, we use the so-called “Facebook Pixel” from the social network Facebook, operated by Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or, if your company is headquartered or you reside in the EU or the EEA, Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Dublin, Ireland (collectively “Meta”).

The Facebook Pixel enables Facebook, on the one hand, to identify you—as a visitor to our online store—as a target audience for displaying ads (“Facebook Ads”). Therefore, we use the Facebook Pixel to ensure that the Facebook Ads we place are shown only to those Facebook users who have expressed a potential interest in our services or products. This information is forwarded to Meta and is used to create so-called “Custom Audiences.” Additionally, we use the Facebook Pixel to ensure that our Facebook Ads align with your presumed interests. In addition, we can use the Facebook Pixel to evaluate the effectiveness of our Facebook Ads for statistical and market research purposes by tracking whether you, as a user, were redirected to our website after clicking on a Facebook Ad (known as a “conversion”).

The legal basis for the use of the Facebook Pixel with “Custom Audiences” and for the storage of “conversion cookies” is Article 6(1)(a) of the GDPR, provided that you gave us your consent to do so when you first visited the site. You may revoke your consent to data processing at any time with future effect. To do so, please contact our Data Protection Officer using the contact information provided or use the link to manage your consents, which you can find in the “Cookies” section of this Privacy Policy. Withdrawing your consent does not affect the lawfulness of the data processing carried out prior to the withdrawal.

With regard to data processing, we are jointly responsible with Meta. We have therefore entered into a joint controller agreement with Meta pursuant to Article 26 of the GDPR, in which Meta also commits to protecting your personal data and not disclosing it to third parties for purposes other than those mentioned above. The agreement can be viewed at the following link:

https://de-de.facebook.com/legal/terms/page_controller_addendum

The legal basis for the transfer of personal data to the United States is either standard data protection clauses entered into with Meta pursuant to Article 46(2)(c) GDPR, or an adequacy decision by the European Commission pursuant to Article 45 of the GDPR, specifically the EU-U.S. Data Privacy Framework (DPF), for which Meta is certified and which can therefore serve as the legal basis for data transfers to the United States. For further information on this matter, please refer to the contact details provided in Section 1.

You can find Meta’s privacy policy at the following link:

https://www.facebook.com/about/privacy/

You can find the option to opt out of personalized advertising as follows; please note that you must be logged in to your Facebook account to use the opt-out option:

https://www.facebook.com/settings?tab=ads

 

3.9.10 Pinterest Day

On our website, we use the “Pinterest Tag,” a service jointly provided by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland, and Pinterest, Inc., 651 Brannan St., San Francisco, CA 94107, USA.

The Pinterest tag allows us to measure the impact of the ads we place and to ensure that relevant ads are shown only to people who may be interested in our services or products. This information is shared with Pinterest. In addition, the Pinterest tag allows us to evaluate the effectiveness of our ads on Pinterest for statistical and market research purposes by tracking whether you, as a user, were redirected to our website after clicking on an ad displayed there (known as a “conversion”).

The legal basis for the use of the Pinterest tag is Article 6(1)(a) of the GDPR, provided that you have given us your consent to do so when you first visited the site. You may revoke your consent to data processing at any time with future effect. To do so, please contact our Data Protection Officer using the contact information provided or use the link to manage your consents, which you can find in this Privacy Policy under the “Cookies” section. Withdrawing your consent does not affect the lawfulness of the data processing that took place prior to the withdrawal.

The legal basis for the transfer of personal data to the United States is the Standard Data Protection Clauses entered into with Issuu pursuant to Article 46(2)(c) of the GDPR. For more information on this, please contact us using the contact information provided in Section 1.

You can find Pinterest’s privacy policy at the following link:

https://policy.pinterest.com/de/privacy-policy

 

4. Cookies and Third-Party Services / Consent Management Tool (CMT)

To ensure that our websites are an enjoyable experience for all visitors, we use cookies and third-party services, as described above.

Cookies are text files that are stored on your hard drive to enable your browser to be identified when you revisit our website or during a session. Cookies are used, for example, to save your language selection. Certain cookies are technically necessary for the proper functioning of our site, while other cookies enable specific features or make our offerings more appealing to you.

For cookies and services that are not technically necessary, we ask for your permission via our Consent Management Tool (CMT) when you visit our site. You may revoke your permission at any time with future effect. Any data processing and data transfers that took place prior to revocation remain lawful. For more information about the types of cookies and web services we use, please refer to this Privacy Policy and our CMT, which you can access at any time via the corresponding link in the website footer.

You can prevent cookies from being stored on your hard drive by adjusting your browser settings accordingly. Cookies that have already been set can be deleted at any time. Please refer to your browser’s instructions for information on how to delete cookies or prevent them from being stored. If you do not accept cookies, this may impair your ability to use our website.

 

4.1 Consent Management Tool

To manage your consents, we use the “Real Cookie Banner” (RCB) tool, which is installed exclusively on our own systems or on systems operated on our behalf. RCB is a so-called “consent management tool” because it allows users to grant and revoke consent for the transfer of data to third parties. There are various types of services, which we describe below. If consent that was initially granted is revoked, it is technically necessary to reload the webpage so that the service for which consent was revoked is no longer active.

The Consent Management Tool itself stores your settings and the consents you have provided on our servers. Your device is identified via a unique identifier (UUID), which is stored in a cookie on your device. Additional data is also stored, such as the time of the last change, whether a content blocker was used (automatic denial of consent), the truncated IP address for the purpose of detecting and preventing mass requests, as well as a record of past and potentially modified consents and the exact nature of the consent. If our server is unable to receive the data, it will also be stored in your device’s “local storage” until it can be sent to our server again. This is done to ensure that you always have the option to manage your consents. Therefore, the aforementioned consent-related data may also be stored here.

The legal basis for the use of RCB is our legal obligation to document and appropriately comply with your consents pursuant to Article 6(1), sentence 1, subparagraph (c) of the GDPR (in conjunction with our accountability obligation under Article 5(2) of the GDPR). Furthermore, the legal basis is our legitimate interest in ensuring the most convenient possible use of our website and the necessary storage of your consents until your next visit to the website, in accordance with Article 6(1), first sentence, subparagraph (f) of the GDPR. We also use the collected data in anonymized form to compile statistics on the consents granted. The legal basis for this use is Article 6(1), first sentence, (f) of the GDPR and our legitimate interest in gaining general insight into the use of our website, as well as in identifying which services are of particular interest to our customers and prospective customers.

We consider your consents to be revoked if you delete the data stored on your device (cookies and local storage) and no existing consents can be identified the next time you visit the website. In that case, the consent management tool will be displayed again, and you will be asked to provide new consent. The consent granted in each instance therefore applies only to the specific device being used at that time, as there is no technical means of cross-device identification based on the information we use.

You can also access the Consent Management Tool and the privacy settings available there by clicking the “Custom Privacy Settings” link in the footer of our website.

 

4.2 Essential (technically necessary)

Essential services are required to enable the basic functions of our website, such as the provision of our consent management tool and content delivery networks. The legal basis for this use is therefore our legitimate interest pursuant to Article 6(1)(f) of the GDPR. This interest lies in the technically sound and efficient provision of our website.

 

4.3 External Media

These services and media are used to display external content to you, such as map services or externally embedded videos. Content in this category is blocked by default. If you have consented to the use of external media, access to this content no longer requires manual consent on a case-by-case basis. The legal basis for the integration of external media and services is Art. 6(1)(a) of the GDPR, provided that you have given your consent to the use of cookies and services. You may revoke your consent at any time with future effect; to do so, simply send an email to the contact address listed in Section 1, delete the information stored in your device’s browser, or make the appropriate selection via our Consent Management Tool. Data processing carried out prior to revocation remains lawful.

 

4.4 Statistics and Analysis (Marketing)

These services and cookies allow us to analyze the use of our website in order to evaluate and improve our services. They may also be used to provide a better customer experience on our website. Furthermore, this category includes services related to marketing activities. The legal basis for this use is Article 6(1)(a) of the GDPR, provided that you have given your consent to the use of cookies and services. If consent has not been given, these services will not be used. You may revoke your consent at any time with future effect. To do so, simply send an email to the contact information provided in Section 1, delete the information stored in the browser on your device, or make the appropriate selection via our Consent Management Tool. Any data processing that took place prior to revocation remains lawful.

 

5. Facebook Page

The social network Facebook is operated by Meta Platforms Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or, if your registered office or place of residence is in the EU, by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Facebook”).

When you visit our social media pages, your data may be automatically collected and stored for market research and advertising purposes. Using pseudonyms, this data is used to create so-called user profiles. These profiles may be used, for example, to display advertisements—both on and off the platforms—that are presumed to match your interests. Cookies are generally used on your device for this purpose. The function of cookies is explained in our Privacy Policy; please refer to that document for the relevant information. These cookies store information about user behavior and interests.

The legal basis for the collection and processing of data is your consent within the meaning of Article 6(1)(a) of the GDPR, which you may have provided to Facebook when accessing its websites. You may revoke the consent you have given for data processing at any time with future effect; to do so, please contact Facebook directly. The revocation of consent does not affect the lawfulness of the data processing that took place prior to the revocation.

For detailed information on how Facebook processes and uses data, as well as contact information, your rights in this regard, and privacy settings—including, in particular, options to opt out—please refer to Facebook’s privacy policy at:

https://www.facebook.com/about/privacy/

You can find the option to opt out of personalized advertising as follows; please note that you must be logged in to your Facebook account to use the opt-out option:

https://www.facebook.com/settings?tab=ads

Statistics are also generated from the data collected by Facebook, which give us insight into which groups of people are interested in our Facebook page and, by extension, presumably in the services we offer (Page Insights). Facebook provides us with this data only in aggregated or anonymized form, so that it is not possible to identify individual persons. Data processing for Page Insights is based on an agreement between joint controllers pursuant to Article 26 of the GDPR, which you can view at the following link:

https://www.facebook.com/legal/terms/page_controller_addendum

When using Facebook, data may also be transferred to the United States. The legal basis for this data transfer may be the EU Commission’s Standard Data Protection Clauses pursuant to Article 46(2)(c) of the GDPR, which you can obtain from our Data Protection Officer. Furthermore, Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework (DPF), which constitutes an adequacy decision by the European Commission pursuant to Article 45(3) of the GDPR.

 

6. Transfer of Personal Data to Third Countries

We use various service providers who supply us with technologies and/or products. Many of them use servers in third countries—that is, outside the European Union or the European Economic Area—for which the European Commission has determined, through an adequacy decision, that the level of data protection is, in principle, equivalent to that required by European data protection law. The resulting transfer of personal data must be permitted under Art. 44 et seq. of the GDPR. To ensure compliance with the requirements for transfers to third countries, we agree with service providers who process personal data in a third country for which the European Commission has not determined that data protection laws are sufficiently equivalent to adopt the Standard Data Protection Clauses issued by the European Commission.

In addition, some service providers have adopted so-called Binding Corporate Rules (BCR), which ensure that the company complies with European data protection standards. Where these are in place, we do not enter into separate standard contractual clauses with service providers subject to the respective BCRs. The BCRs are reviewed by one of the European data protection supervisory authorities and approved on a case-by-case basis.

Nevertheless, it may happen that, despite contractual and technical safeguards, the level of data protection in the third country does not correspond to that in the European Union. In such cases, we ask for your consent—if necessary—when you visit our website or access individual services on our website, to transfer personal data to that third country in accordance with Article 49(1)(a) of the GDPR.

This is particularly relevant when data processing is intended to take place in the United States or when data is accessible from the United States: There, government agencies and intelligence services such as the National Security Agency (NSA) may have access rights and the ability to read personal data without us, as the data exporter, or you, as the data subject, being aware of it, and without effective legal remedies being available to prevent or challenge such access. However, some of our service providers have committed to exercising and exhausting the legal remedies available to you under U.S. law against any government access to your data. Some of them also publish transparency reports in which—to the extent legally possible—government requests and responses are listed. In July 2023, the European Commission also issued a new adequacy decision for data transfers to the U.S. under the “EU-U.S. Data Privacy Framework” (DPF), a new adequacy decision for data transfers to the U.S., which, however, applies only to service providers that, through self-certification, submit to specific rules and legal remedies for data subjects. You can check whether a provider has certified itself under the DPF on the DPF website at https://www.dataprivacyframework.gov/s/participant-search.

In this Privacy Policy, we indicate for each service whether we base the transfer of data to a third country on Standard Contractual Clauses, BCRs, the DPF, or other legal bases.

In our consent management tool, which is linked in the “Cookies” section of this Privacy Policy, you will find further information about the third-country service providers we use, as well as the legal basis and purpose of the data transfer.

 

7. Deletion

Personal data will be deleted or blocked as soon as the purpose for which it was stored no longer applies or you request its deletion. Data will also be deleted when a retention period prescribed by the aforementioned regulation expires, unless further storage of the data is necessary for the conclusion or fulfillment of a contract, or you have given your consent in this regard.

 

8. Data Security

We protect our website and other systems against the loss, destruction, unauthorized access, alteration, or disclosure of your data by unauthorized persons through technical and organizational measures. Depending on the browser used, data is transmitted using SSL encryption ranging from 128-bit to 256-bit. Despite regular checks and continuous improvements to our security measures, it is not possible to provide complete protection against all risks.

 

9. Rights of the Data Subject

If your personal data is processed, you are a data subject within the meaning of the GDPR, and you have the following rights with respect to the controller:

 

9.1 Right to Access Information

You may request confirmation from the data controller as to whether we are processing personal data concerning you. If such processing is taking place, you may request information from the data controller regarding:

• the purposes for which the personal data is processed;
• the categories of personal data that are processed;
• the recipients or categories of recipients to whom your personal data has been or will be disclosed;
• the planned duration of the storage of your personal data or, if it is not possible to provide specific details, the criteria used to determine the storage period;
• the existence of a right to have personal data concerning you corrected or erased, a right to restrict processing by the controller, or a right to object to such processing;
• the existence of a right to file a complaint with a supervisory authority;
• all available information regarding the source of the data, if the personal data is not collected directly from the data subject.

 

9.2 Right to Rectification

You have the right to request that the data controller correct and/or complete your personal data if the processed personal data concerning you is inaccurate or incomplete. The data controller must make the correction without delay.

 

9.3 Right to Restriction of Processing

Under the following conditions, you may request that the processing of your personal data be restricted if

• You may contest the accuracy of the personal data concerning you for a period that allows the controller to verify the accuracy of the personal data;
• the processing is unlawful, and you object to the erasure of the personal data and instead request that the use of the personal data be restricted;
• the controller no longer needs the personal data for the purposes of processing, but you need it to assert, exercise, or defend legal claims, or
• You have objected to the processing pursuant to Article 21(1) of the GDPR, and it has not yet been determined whether the controller’s legitimate grounds override your interests.

If the processing of your personal data has been restricted, such data—with the exception of its storage—may be processed only with your consent or for the purpose of asserting, exercise, or defense of legal claims; to protect the rights of another natural or legal person; or for reasons of a substantial public interest of the Union or a Member State. If the restriction on processing has been imposed in accordance with the conditions set forth above, you will be notified by the controller before the restriction is lifted.

 

9.4 Right to Erasure

9.4.1 Obligation to Delete

You may request that the controller delete your personal data without delay, and the controller is obligated to delete such data without delay if any of the following grounds apply:

• The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
• You withdraw your consent, on which the processing was based pursuant to Article 6(1), first sentence, subparagraph (a), or Article 9(2), subparagraph (a), of the GDPR, and there is no other legal basis for the processing.
• You object to the processing pursuant to Article 21(1) of the GDPR, and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.
• The personal data concerning you was processed unlawfully.
• The erasure of your personal data is necessary to comply with a legal obligation under Union law or the law of the Member States to which the controller is subject.
• The personal data concerning you was collected in connection with the information society services offered, in accordance with Article 8(1) of the GDPR.

 

9.4.2 Disclosure to Third Parties

If the controller has made the personal data concerning you public and is obligated to erase it pursuant to Article 17(1) of the GDPR, it shall take appropriate measures, including technical measures, taking into account the state of the art and the cost of implementation, to inform the controllers that process the personal data that you, as the data subject, have requested that they erase all links to such personal data or any copies or replicas of such personal data.

 

9.4.3 Exceptions

The right to erasure does not apply if the processing is necessary

• to exercise the right to freedom of expression and information;
• to comply with a legal obligation that requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• for reasons of public interest in the area of public health pursuant to Article 9(2)(h) and (i) and Article 9(3) of the GDPR;
• to assert, exercise, or defend legal claims.

 

9.5 Right to Information

If you have exercised your right to rectification, erasure, or restriction of processing with the controller, the controller is obligated to notify all recipients to whom your personal data has been disclosed of the rectification or erasure of the data or the restriction of processing, unless this proves impossible or involves a disproportionate effort. You have the right to request information from the controller regarding these recipients.

 

9.6 Right to Data Portability

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that

• the processing is based on consent pursuant to Article 6(1), first sentence, subparagraph (a) of the GDPR or Article 9(2), subparagraph (a) of the GDPR, or on a contract pursuant to Article 6(1), first sentence, subparagraph (b) of the GDPR, and
• the processing is carried out using automated means.

In exercising this right, you also have the right to have your personal data transmitted directly from one data controller to another, provided that this is technically feasible. This must not infringe upon the freedoms and rights of others.

 

9.7 Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out pursuant to Article 6(1), first sentence, subparagraph (e) and/or (f) of the GDPR; this also applies to profiling based on these provisions. The controller will no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for those purposes.

You have the option, in connection with the use of information society services—notwithstanding Directive 2002/58/EC—to exercise your right to object through automated procedures that use technical specifications.

 

9.8 Automated Decision-Making in Individual Cases, Including Profiling

You have the right not to be subject to a decision based solely on automated processing—including profiling—that produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

• is necessary for the conclusion or performance of a contract between you and the data controller,
• is permitted under Union or Member State law to which the controller is subject, and such law provides for appropriate safeguards to protect your rights, freedoms, and legitimate interests; or
• is done with your express consent.

However, these decisions may not be based on special categories of personal data as defined in Article 9(1) of the GDPR, unless Article 9(2)(a) and/or (g) of the GDPR apply and appropriate measures have been taken to protect your rights and freedoms as well as your legitimate interests.

 

9.9 Right to File a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, your workplace, or the location of the alleged infringement, if you believe that the processing of your personal data violates the GDPR.

The supervisory authority to which the complaint was submitted shall inform the complainant of the status and outcome of the complaint, including the possibility of seeking judicial remedy under Article 78 of the GDPR.

 

10. Updates to This Privacy Policy

Our website is subject to technical changes from time to time. As a result, the purpose of data processing may also change. Therefore, it is advisable to review this Privacy Policy periodically. You can tell if a new version of the Privacy Policy is available by checking the date listed below.

 

 

As of: August 27, 2025