Privacy policy

Thank you for your interest in our offer and for your trust in us. Protecting your privacy when using our website is very important to us. We always treat your data confidentially and, of course, comply with all relevant data protection regulations.

The person responsible and data protection officer is:

Lukas Meyer
VITALOVE GmbH
Unterhof 11
CH-8595 Altnau
info@vitalove.ch

Please do not contact Mr Meyer regarding requests for information, deletion requests, or the status of your orders. As an external data protection officer, Mr Meyer is not involved in daily operations. For such requests, please always contact VITALOVE directly via the known communication channels (Here is the link: https://vitilove.com/pages/kontakt-support). Please understand that Mr Meyer cannot process or forward emails or phone calls in this matter.

Privacy Policy

In this Privacy Policy, we inform you about the processing of your personal data when using our website.

Personal data is information that relates to an identified or identifiable person. This particularly includes details such as your name, telephone number, address, or email address. Statistical data collected when visiting our website that cannot be linked to you personally does not fall under the term personal data.

You can print or save this Privacy Policy using the usual functions of your browser.

1. Contact Person

VITALOVE GmbH, Unterhof 11, CH-8595 Altnau, is the controller responsible for processing your personal data within the meaning of the Swiss Data Protection Act (DSG) and the EU General Data Protection Regulation (GDPR). You can reach us by phone at +41 (0)58 519 94 14 or by email at: info@vitalove.ch.

Questions about data protection in connection with the use of our website may also be addressed to our data protection officer. He can be reached at the address stated above and via the email address with the subject line “Attn. Data Protection Officer”. Please note that the contents sent to this email address are not viewed exclusively by the data protection officer. If you wish to exchange confidential information, please first request direct contact via this email address.

2. Data Processing on Our Website

2.1 Accessing Our Website / Access Data

Each time you visit our website, we automatically collect the access data transmitted by your browser in order to enable your visit to the website. This access data particularly includes:

IP address of the requesting device
Date and time of the request
Address of the accessed website and the requesting website
Information about the browser and operating system used
Online identifiers, such as device identifiers and session IDs

The processing of this access data is necessary to enable visits to the website, to ensure the long-term functionality and security of our systems, and to administer the website. The access data is also temporarily stored in internal log files in order to determine the cause of repeated or potentially harmful access to our website and to take action against it. The legal basis for this processing is Art. 6 para. 1 sentence 1 lit. b GDPR if the website visit takes place in connection with the initiation or performance of a contract, and otherwise Art. 6 para. 1 sentence 1 lit. f GDPR based on our legitimate interest in providing the website and ensuring the security of our systems.

The information stored in the log files does not allow direct identification of you personally; in particular, we store IP addresses only in shortened and anonymised form. The log files are stored for 30 days and archived after anonymisation.

2.2 Contacting Us

You have various ways to contact us. We process the data you provide when contacting us exclusively for the purpose of communicating with you. The legal basis for this processing is Art. 6 para. 1 lit. b GDPR, insofar as your details are required to answer your inquiry or to initiate or perform a contract, and otherwise Art. 6 para. 1 sentence 1 lit. f GDPR based on our legitimate interest in making contact and answering your inquiry. The data collected by us during contact will be automatically deleted as soon as your inquiry has been fully processed, unless we must retain your inquiry to fulfil contractual or legal obligations; see the section “Storage Period”.

2.3 Registration

You can register for our login area in order to use the full range of functions on our website, for example for orders in our online shop, excluding guest orders. The mandatory fields you must complete for registration are marked. Registration is not possible without this data. The legal basis for this processing is Art. 6 para. 1 lit. b GDPR.

2.4 Orders

When placing an order, we collect the mandatory information required for contract processing:

First and last name;
Date of birth, only for certain payment methods;
Email address;
Password;
Billing and shipping address;
Payment information and payment data.

Optional information such as telephone and fax number may be provided so that we can contact you via these channels if we have questions. The legal basis for the processing is Art. 6 para. 1 sentence 1 lit. b GDPR.

2.5 Payment Options and Payment Service Providers

Common online payment methods are available for orders in our online shop, including PayPal, invoice, instant bank transfer, and credit card. We work with various payment service providers from whom we receive your payment data or to whom we transmit your payment data. Providing this payment data and cooperating with the payment service providers is necessary to enable payment and contract fulfilment. The legal basis for this data processing is Art. 6 para. 1 sentence 1 lit. b GDPR.

Our payment service providers include in particular:

For payments via TWINT: TWINT AG, Stauffacherstrasse 41, CH-8004 Zurich (https://www.twint.ch/)
For payments via PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A, 22-24 Boulevard Royal, L-2449 Luxembourg (https://www.paypal.com).
For payments via PostFinance / PostFinance Card: PostFinance AG, Mingerstrasse 20, 3030 Bern (https://www.postfinance.ch/de/)
For payments by invoice: PowerPay - MF Group AG, Kornhausstrasse 25, 9001 St. Gallen (https://www.mfgroup.ch/de).

In order to offer you the PowerPay payment options — purchase on invoice (MF Group AG) — personal data such as contact details and order data are transmitted to PowerPay (MF Group AG). PowerPay (MF Group AG) uses this data to determine whether you can use the payment options offered by PowerPay and to adapt the payment options to your needs. PowerPay (MF Group AG) treats your personal data in accordance with the applicable data protection regulations and PowerPay’s privacy policies.

For payments by debit card: Shopify Payments (USA) Inc., 150 Elgin St 8th Fl, Ottawa, ON, K2P 1L4, USA (https://www.shopify.de/payments).

For the use of payment options from Shopify Payments (USA) Inc., personal data such as contact details and order data are transmitted to Shopify Payments (USA) Inc. Shopify Payments (USA) Inc. uses this data to check whether you can use the payment options they offer and to adapt them to your needs. Shopify Payments (USA) Inc. treats your personal data in accordance with the applicable data protection regulations and its privacy policies.

Please note that data protection inquiries should most efficiently be addressed directly to the respective payment service providers, as only they have access to the relevant data and can take the corresponding measures.

2.6 Newsletter and Promotional Emails

You have the option to subscribe to our newsletter, in which we regularly inform you about new products and promotions. We use the double opt-in procedure, meaning that we will only send you the newsletter once you confirm, by clicking a link in a confirmation email, that you are the owner of the email address provided. We store your email address, the time of registration, and the IP address used for registration for as long as you are subscribed to the newsletter. This storage serves solely the purpose of sending you the newsletter and being able to prove your registration.

In addition, we send promotional emails in which we ask you for feedback on your order or inform you about products that match your purchase. The legal basis for this data processing is Art. 6 para. 1 lit. f GDPR.

You can unsubscribe from the newsletter and promotional emails or object to receiving them at any time by using the unsubscribe link in each newsletter and promotional email. You can also contact us by email at info@vitalove.ch . The legal basis for this processing is your consent pursuant to Art. 6 para. 1 lit. a GDPR.

In our newsletters and promotional emails, we use common technologies to measure interactions with them, such as opening the email and clicked links. We use this data in pseudonymised form for statistical evaluations and to optimise our content and customer communication. For this purpose, we use small graphics embedded in the messages, known as pixels. This data is collected exclusively in pseudonymised form and is not linked to your personal data. The legal basis for this is our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR. Our aim is to share relevant content with our customers and better understand what interests our readers. If you do not want your usage behaviour to be analysed, you can unsubscribe from the newsletter or disable the display of graphics in your email program by default. Interaction data from our newsletters is stored in pseudonymised form for 30 days and then fully anonymised.

Customer Satisfaction Surveys

We regularly conduct email surveys among our customers in order to continuously improve our service and adapt it to our customers’ needs. These surveys are sent regardless of whether you have subscribed to a newsletter. The data is collected in pseudonymised form by our service provider:

JUDGE.ME LTD
C/O Buckworths 2nd Floor,
1-3 Worship Street,
London, England,

and used exclusively for market research and opinion surveys for VITALOVE. In addition, after placing an order you will receive a request asking you to review your ordered products by email.

Only VITALOVE can link the collected information with personal data and, where applicable, contact you. You have the right to object to the survey at any time. To do so, simply click the unsubscribe link found in every email we send.

(Legal bases: Article 6 paragraph 1 sentence 1 letter f of the General Data Protection Regulation (GDPR), paragraph 1 sentence 1 letter f of the GDPR)

Email Advertising to Existing Customers

If you register with us or make a purchase, we also use your contact details to send you relevant information about our products and services by email (“existing customer advertising”). This may include, in particular, news, promotions, offers, as well as feedback and other surveys.

The legal basis for this data processing is Article 6 paragraph 1 letter f GDPR in conjunction with Section 7 paragraph 3 of the German Act Against Unfair Competition (UWG). According to this provision, the processing of data to protect legitimate interests is permissible insofar as it concerns the storage and further use of data for advertising purposes. Within the framework of the statutory permission under Section 7 paragraph 3 UWG, VITALOVE GmbH is entitled to use the email address provided during registration or the purchase of a paid service for direct advertising of its own similar products or services. This may include, in particular, news, promotions, offers, as well as feedback and other surveys.

If you no longer wish to receive advertising for similar products or services, you may object to the use of your email address at any time without incurring any costs other than transmission costs according to the basic rates. You can do this easily by clicking the unsubscribe link contained in every email we send or by sending us an email at info@vitalove.ch to unsubscribe from product recommendation emails.

2.7 Surveys and Competitions

If you participate in one of our surveys, we use your data for market research and opinion surveys. The data is generally evaluated anonymously for internal purposes. If, by way of exception, surveys are not evaluated anonymously, data collection will only take place with your express consent. In the case of anonymous surveys, the GDPR does not apply, and in the case of occasional personal evaluations, processing is carried out pursuant to Article 6 paragraph 1 sentence 1 letter a GDPR.

In competitions, we use your data to conduct the competition and notify the winners. Detailed information can be found, where applicable, in the terms and conditions of participation for the respective competition. The legal basis for data processing is the competition contract pursuant to Article 6 paragraph 1 sentence 1 letter b GDPR.

2.8 Applications

You may apply to us for open positions at any time. The purpose of data collection is to conduct applicant selection procedures for possible employment relationships. When receiving and processing your application, we collect in particular the following data: first and last name, email address, application documents, such as certificates and CV, date of your earliest possible start of work, and salary expectations. The legal basis for processing your application documents results from Article 6 paragraph 1 sentence 1 letter b and Article 88 paragraph 1 GDPR in conjunction with Section 26 paragraph 1 sentence 1 of the German Federal Data Protection Act (BDSG).

2.9 Use of Cookies and Similar Technologies

This website uses cookies and comparable technologies, hereinafter collectively referred to as “Tools”, which are provided either by us or by third parties.

A cookie is a small text file that is stored by the browser on your device. Cookies are not used to run programs or transmit viruses to your computer. Comparable technologies particularly include web storage, such as local storage and session storage, fingerprints, tags, or pixels. Most browsers are set by default to accept cookies and similar technologies. However, you can generally adjust your browser settings to reject cookies or similar technologies or to store them only after prior consent. If you reject cookies or similar technologies, not all of our offers may function smoothly.

Below, the tools we use are listed by category. In particular, we inform you about the providers of the tools, the storage period of the cookies, and the disclosure of data to third parties. We also explain when we obtain your voluntary consent to use the tools and how you can withdraw it.

2.9.1 Legal Basis and Withdrawal

2.9.1.1 Legal Basis

We use necessary tools for the operation of the website on the basis of our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, in order to make the use of our website more convenient and individual and to make its use as time-saving as possible. In certain cases, these tools may also be required for the performance of a contract or for carrying out pre-contractual measures; in such cases, processing is carried out pursuant to Art. 6 para. 1 sentence 1 lit. b GDPR.

All other tools, particularly those for marketing purposes, are used on the basis of your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR and pursuant to Section 15 paragraph 3 sentence 1 of the German Telemedia Act (TMG), insofar as usage profiles are created for advertising or market research purposes. Data processing using these tools only takes place if we have received your prior consent for this.

Where personal data is transferred to third countries, we refer, also with regard to any associated risks, to Section 4, “Data Transfer to Third Countries”. We will inform you if we have concluded standard contractual clauses or other safeguards with the providers of certain tools. If you have consented to the use of certain tools, we transfer the data processed when using the tools to third countries also on the basis of this consent.

2.9.1.2 Obtaining Your Consent

To obtain and manage your consent, we use a cookie consent management tool. This creates a banner that informs you about data processing on our website and gives you the option to consent to all, individual, or no data processing by optional tools. This banner appears when you first visit our website and when you reopen the selection of your settings to change them or withdraw consent. The banner also appears on subsequent visits to our website if you have disabled the storage of cookies or if the cookies or information in local storage have been deleted or have expired.

As part of your website visit, we record your consent or withdrawals, your IP address, information about your browser and device, and the time of your visit. We also store necessary information on your device in order to retain your granted consent and withdrawals. If you delete your cookies or information in local storage, we will ask you for your consent again during a later page view.

The data processing is necessary to provide you with the legally required consent management and to comply with our documentation obligations. The legal basis for using the cookie consent management tool is Art. 6 para. 1 sentence 1 lit. f GDPR, based on our interest in fulfilling the legal requirements for cookie consent management.

2.9.1.3 Withdrawal of Your Consent or Change of Your Selection

You may withdraw your consent for certain tools at any time. To do so, click the “Cookie Settings” link in the footer of our shops. There, you can also change the selection of tools to whose use you wish to consent and view additional information about the cookies and their respective storage periods. Alternatively, you can assert your withdrawal directly with the provider of certain tools.

2.9.2 Necessary Tools

We use certain tools to enable the basic functions of our website (“necessary tools”). Without these tools, we could not provide our service. Therefore, necessary tools are used without consent on the basis of our legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR or for the performance of a contract or to carry out pre-contractual measures pursuant to Art. 6 para. 1 sentence 1 lit. b GDPR.

2.9.2.1 Use of Our Own Cookies

We use our own necessary cookies in particular

for login authentication,
for load balancing,
to store your shopping cart across sessions,
to note that information placed on our website has been shown to you so that it is not shown again the next time you visit the website.

Through this, we aim to provide you with a more convenient and individual use of our website. These services are based on our aforementioned legitimate interests; the legal basis is Art. 6 para.

2.9.2.2 Google Tag Manager

Our website uses Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for users from the European Economic Area and Switzerland, and by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, for all other users.

Google Tag Manager is used exclusively to manage website tools by integrating so-called website tags. A tag is an element in the source code of our website that is used to execute a tool such as scripts. Optional tools are only integrated via Google Tag Manager with your consent.

Google Tag Manager sets the following cookies for technical debugging purposes: “gtm”, “gtm_auth”, “gtm_debug”, “gtm_preview”, “gtm_mt”.

The legal basis for this data processing is Art. 6 para. 1 sentence 1 lit. f GDPR and results from our legitimate interest in integrating and managing tags on our website in a simple way.

Google collects information about which tags are integrated on our website but generally does not collect personal data such as user behaviour, IP addresses, or pages visited.

We have concluded a data processing agreement with Google and use standard contractual clauses pursuant to Art. 46 para. 2 lit. c GDPR if personal data is transferred to the USA or other third countries. Further information on data transfer to third countries can be found in Section 4, “Data Transfer to Third Countries”, of our Privacy Policy.

Further information about Google Tag Manager can be found in Google’s information about Tag Manager.

2.9.3 Use of Cookies and Comparable Technologies for Analysis Purposes

In order to improve our website, we use cookies and similar technologies, such as web beacons, for the statistical recording and analysis of general usage behaviour based on access data. We also use analytics services to evaluate the use of our various marketing channels.

The legal basis for the data processing described in this section is, unless otherwise stated, your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. For withdrawal of your consent, see Section 2.9.1, “Withdrawal of Your Consent or Change of Your Selection”. If personal data is transferred to the USA or other third countries, your consent also expressly extends to the data transfer pursuant to Art. 49 para. 1 sentence 1 lit. a GDPR. Please refer to Section 4, “Data Transfer to Third Countries”, for the associated risks.

The following section contains information about the technologies we use as well as information on the option to object to our analytics measures by using a so-called opt-out cookie. Please note that after deleting all cookies in your browser or later using a different browser and/or profile, an opt-out cookie must be set again.

2.9.3.1 Google Analytics

Our website uses Google Analytics, provided for users from Europe, the Middle East, and Africa (EMEA) by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and for all other users by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, hereinafter “Google”.

Google Analytics uses cookies and similar technologies to analyse and improve user behaviour on our website. The data generated in this process may be transferred by Google to a server in the USA and stored there for evaluation. However, your IP address is shortened before the usage statistics are analysed, so that no direct conclusions can be drawn about your identity. We have added the code “anonymizeIP” to Google Analytics on our website to ensure the anonymisation of IP addresses.

Google will use the information obtained through cookies to analyse the use of the website, compile reports on website activity for website operators, and provide other services related to website and internet usage.

Our privacy settings for Google Analytics include:

IP anonymisation, meaning shortening of the IP address before evaluation so that no conclusions can be drawn about your identity.
Automatic deletion of old logs / limitation of storage period.
Disabled personalised ads.
Disabled Measurement Protocol.
Disabled data sharing with other Google products and services.

The data processed by Google Analytics includes:

Anonymised IP address.
Referrer URL, meaning the previously visited page.
Accessed pages, including date, time, URL, title, and length of stay.
Downloaded files.
Clicked links to other websites.
Achievement of certain goals, such as conversions.
Activated advertising functions, including audience remarketing through GA Audience.
Activated cross-device and cross-page tracking, Google Signals.
Technical information: operating system; browser type, version, and language; device type, brand, model, and resolution; approximate location, such as country and possibly city, based on anonymised IP address.

Google Analytics sets the following cookies for the stated purposes and respective storage periods:

“_ga” for 2 years and “_gid” for 24 hours, both to identify and distinguish website visitors using a user ID.
“_gat” for 1 minute, to reduce requests to Google servers.
“IDE” for 13 months, a third-party cookie to identify and distinguish website visitors using a user ID, to record interactions with advertising, and to provide personalised advertising.
“__utma” for 2 years, to distinguish visitors and sessions.
“__utmb” for 30 minutes, to determine new sessions and the duration of visits.
“__utmc” for one session, to determine new sessions and the duration of visits.
“__utmt” for 10 minutes, to throttle requests.
“__utmz” for 6 months, to store campaign information or the source from which the visitor came.
“__utmv” for 2 years, to store a custom variable.

We have concluded a data processing agreement with Google for the use of Google Analytics.

You can configure your browser to reject cookies, or you can prevent the collection of data generated by cookies about your use of this website, including your IP address, and the processing of this data by Google by downloading and installing the browser add-on provided by Google. Alternatively, if you visit our website from a mobile device, you can use this opt-out link. This will block collection by Google Analytics on this website in the future. The opt-out link only works in this browser and only for this domain. Please note, however, that you must click this link again if you delete your cookies in this browser.

Further information can be found in Google’s Privacy Policy.

2.9.3.2 Hotjar

Our website uses Hotjar, a web analytics service of Hotjar Ltd., Elia Zammit Street 3, St Julians STJ 1000, Malta, hereinafter “Hotjar”. Hotjar creates so-called heat maps, which graphically display statistics about mouse movements and clicks on our website. This allows us to identify frequently used functions on our website and further improve the site. Hotjar uses cookies and similar technologies to analyse user behaviour on our website. However, your IP address is shortened before the usage statistics are analysed, so that no conclusions can be drawn about your identity. In addition to mouse movements and clicks, information about the operating system, browser, incoming and outgoing references or links, geographical origin, as well as resolution and type of device are evaluated for statistical purposes. This information is pseudonymous and is not passed on to third parties by us or Hotjar. Data that you enter in form fields on our website is masked and not collected via Hotjar.

Hotjar sets the following cookies, each used for the stated duration:

“_hjid” for 1 year, for usage analysis and storage of the visitor ID.
“_hjFirstSeen” for the session, for storing the first page view in a session of a new visitor.
“_hjAbsoluteSessionInProgress” for 30 minutes, for storing the first page view in a session.
“_hjIncludedInSessionSample” for 30 minutes, for usage analysis in connection with the defined session limit.
“_hjIncludedInPageviewSample” for 30 minutes, for usage analysis in connection with the defined page view limit.

Data collection by Hotjar can be disabled on all websites that use Hotjar by using a so-called opt-out. Further information and the option to object can be found on Hotjar’s objection page. Hotjar also supports your browser’s “Do Not Track” function. If you activate this function in your browser, Hotjar will not collect any data. Instructions for various browsers can be found on Hotjar’s website.

Further information can also be found in Hotjar’s privacy policy.

2.9.4 Use of Cookies and Comparable Technologies for Online Advertising

We also use cookies and similar technologies for advertising purposes. Some of the access data generated when using our website is used for interest-based advertising. By analysing and evaluating this access data, we are able to display personalised advertising on our website and on third-party websites that corresponds to your actual interests and needs.

These tools also serve to create profiles in order to display targeted advertising for products that match your preferences. Another purpose is to improve the user experience by showing you products of interest or similar products when you visit our website. These cookies also allow us to use our commercial offer on other affiliated websites, known as retargeting. We have no control over the information provided by third-party cookies and no access to the data. The third-party providers we use assure us that they do not combine user profiles they receive from our website with other user profiles created on third-party websites.

The legal basis for the use of marketing tools is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. In the case of the transfer of personal data to the USA or other third countries, your consent also expressly extends to the data transfer pursuant to Art. 49 para. 1 sentence 1 lit. a GDPR. You can find the associated risks in Section 4, “Data Transfer to Third Countries”.

In the following section, we would like to explain these technologies and the providers used for them in more detail.

The data collected includes in particular:

the IP address of the device,
the date and time of access,
the identification number of a cookie,
the device identifier of mobile devices,
technical information about the browser and operating system.

However, the collected data is stored exclusively in pseudonymised form, so that no direct conclusions can be drawn about individual persons.

Below, we explain the technologies and providers we use in detail:

2.9.4.1 Facebook Conversion and Retargeting Tags (“Facebook Pixel”)

Our websites use the “Facebook Pixel” service of the social network Facebook for marketing purposes. The service is offered to users outside the USA and Canada by Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, and to all other users by Facebook Inc., 1601 Willow Road, Menlo Park, California 94025, USA, hereinafter “Facebook”.

We use Facebook Pixel to analyse the general use of our websites and to monitor the effectiveness of Facebook advertising, known as “conversion”. We also use Facebook Pixel to display personalised advertising messages for our products based on your interest, known as “retargeting”. Facebook processes data that the service collects on our websites using cookies and similar technologies.

The following cookies are set by Facebook Pixel for the stated purpose and respective storage periods:

“_fbp” for 3 months, for usage analysis and retargeting.
“fr” for 3 months.

The data generated as part of this processing may be transferred by Facebook to a server in the USA and stored there for evaluation. In the event that personal data is transferred to the USA, we have concluded standard contractual clauses with Facebook.

If you have a Facebook account and have allowed this in your account’s privacy settings, Facebook may link the information collected during your visit to our websites with your Facebook account and use it for targeted ads. You can view and change the privacy settings of your Facebook profile at any time. If you are not a Facebook member, you can prevent data processing by Facebook by activating the disable switch for the provider “Facebook” on the previously mentioned TRUSTe website. Data processing can also be disabled by clicking the following link: CUSTOM OPT-OUT.

If you disable data processing by Facebook, only general Facebook ads will be displayed that are not based on the information collected about you.

Further information can be found in Facebook’s privacy policy.

2.9.4.2 Google Ads Conversion Tracking and Remarketing, formerly AdWords

Our websites use the services “Google Ads Conversion Tracking” and “Google Ads Remarketing”, which are offered to users from the European Economic Area and Switzerland by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and to all other users by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, hereinafter “Google”.

Using “Google Ads Conversion Tracking”, user actions defined by us, such as clicking on ads, page views, or downloads, are recorded and analysed. We use “Google Ads Remarketing” to display individualised advertising messages for our products on Google partner websites. Both services use cookies and similar technologies for this purpose. The data generated as part of this processing may be transferred by Google to a server in the USA and stored there for evaluation. In the event that personal data is transferred to the USA, we have concluded standard contractual clauses with Google.

If you use a Google account, Google may, depending on the settings in your Google account, link your web and app browsing history with your Google account and use information from your Google account to personalise ads. If you do not wish this linking to occur, you should log out of Google before visiting our contact page.

You can configure your browser as described above to reject cookies. In addition, you can disable the “Personalised Advertising” option in Google’s ad settings. In this case, Google will only display general advertising that is not tailored to you.

The following cookies are set by Google:

“_gcl_au” for 90 days.
“_gcl_aw” for 90 days.

Further information can be found in the information on data use in Google’s Privacy Policy.

2.9.4.3 Microsoft Advertising, formerly Bing Ads

We use Microsoft Advertising for remarketing and conversion tracking in our online offering. This service is provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052 - 6399, USA, hereinafter “Microsoft”, and uses Universal Event Tracking (UET). Microsoft uses cookies and similar technologies to display relevant advertisements to you. The use of these technologies enables Microsoft and its partner websites to display ads based on your previous visits to our website or other websites on the internet.

If you click on an ad placed by us on the “Bing” internet search engine, Microsoft stores a cookie in your internet browser on your device to enable tracking functions. This tracking cookie remains valid for 180 days and does not serve to personally identify you. If you visit certain pages on our website and the cookie has not yet expired, both Microsoft and we can recognise that you clicked on one of our Bing ads and were redirected from there to our website.

The information collected through the tracking cookie is used by Microsoft to compile visit statistics for us. This gives us information about the number of accesses to the ads we place on Bing and about the web pages of our website that were subsequently visited. However, we do not receive any information that allows us to personally identify you.

Furthermore, Microsoft may be able to track your user behaviour across several of your devices through so-called cross-device tracking. This enables Microsoft to display personalised advertising to you across devices.

Microsoft Advertising sets the following cookies for the above purposes with the specified storage periods:

“_uetsid” for 24 hours, session ID.
“_uetvid” for 16 days, visitor recognition, usage analysis, and personalised advertising.
“MUID” for 1 year, visitor recognition, usage analysis, and personalised advertising.

The following information is stored by Microsoft Advertising in local storage:

“_uetsid” and “_uetvid”, for the same purposes as the corresponding cookies.
“_uetsid_exp” and “_uetvid_exp”, information about the expiration date of the cookies.

If you do not agree to this processing, you have the option to prevent the installation of cookies by adjusting the settings in your internet browser. Further details can be found in the “Cookies” section above.

If you have a Microsoft account, you can also change your settings for personalised advertising on the website http://choice.microsoft.com/de-de/opt-out .

The information generated in connection with this data processing may be transferred by Microsoft to a server in the USA and stored there for analysis purposes.

Further information about Bing Ads and the collection and use of data can be found at the following links:

Further information is available on the Microsoft Advertising help pages and in Microsoft’s privacy policy.

2.9.5 Social Media Plugins and External Media

We also use tools from social networks that allow you to log in to the website using your existing user accounts or to share posts and content via these networks, known as “social media plugins”, as well as other external media such as embedded videos or maps.

The legal basis for this is, unless otherwise stated, your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR, which you provide via the cookie banner or for the respective tool itself by allowing its use individually through an overlaid banner. For withdrawal of your consent, see Section 2.9.1, “Withdrawal of Your Consent or Change of Your Selection”. If personal data is transferred to the USA or other third countries, your consent also expressly extends to the data transfer pursuant to Art. 49 para. 1 sentence 1 lit. a GDPR. Please refer to Section 4, “Data Transfer to Third Countries”, for the associated risks.

2.9.5.1 Social Media Plugins

Our website uses social media plugins, such as the Like button, from the following social networks:

Facebook, which is offered by Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, for users outside the USA and Canada, and by Facebook Inc., 1601 Willow Road, Menlo Park, California 94025, USA, for all other users, jointly “Facebook”.
Twitter, which is offered by Twitter International Company, Attn: Data Protection Officer, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland, for users in the European Union, EFTA states, and Great Britain, and by Twitter Inc., 1355 Market St, Suite 900, San Francisco, California 94103, USA, for all other users, jointly “Twitter”.
Google+, which is offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for users from the European Economic Area and Switzerland, and by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, for all other users, jointly “Google”.

For data protection reasons, no personal data is initially transferred to the social network when you visit our website. Only after your consent is the plugin activated and a direct connection between your browser and the social network may be established. This prevents data from being transmitted to the network and stored there without your knowledge. If you have consented, your data will be processed as follows:

Facebook / Twitter / Google receives the information that you have accessed the corresponding subpage of our online offering, regardless of whether you have an account with Facebook / Twitter / Google and are logged in there. If you are logged in to Facebook / Twitter / Google, this data is directly assigned to your account. If you use the activated plugin and, for example, share the page, Facebook / Twitter / Google also stores this information, including date and time, in your user account and publicly shares it with your contacts and followers. If you do not want this information assigned to your Facebook / Twitter / Google profile, you must log out before activating the plugin.

Facebook / Twitter / Google stores this data as user profiles and uses it for advertising purposes, market research, and/or adapting its website. Such evaluation is carried out in particular, including for users who are not logged in, in order to display personalised advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles. As a member of Facebook / Twitter / Google, you can deactivate advertising based on your social actions, for example in Facebook’s advertising preferences. You can also completely prevent the loading of Facebook / Twitter / Google social media plugins, for example with a Facebook blocker.

It is possible that the information generated in connection with this data processing may be transferred by Facebook to a server in the USA and stored there. In the event that personal data is transferred to the USA or other third countries, we have concluded standard contractual clauses with Facebook / Twitter / Google.

Further information can be found in Facebook’s privacy notices, Twitter’s privacy notices, and Google’s Privacy Policy.

2.9.5.2 Online Presences on Social Networks

We maintain online presences on social networks in order to communicate with customers and interested parties and to provide information about our products and services.

The data of users is generally processed by the relevant social networks for market research and advertising purposes. Usage profiles can be created based on users’ interests, and cookies and other identifiers are stored on users’ devices for this purpose. These usage profiles are used to display targeted advertising both within the social networks and on third-party websites.

During the operation of our online presences, we may have access to statistical information about the use of our online presences, which is provided by the social networks. These statistics are aggregated and may include information such as demographic data and data on interaction with our online presences and the posts and content distributed through them. Details and links to the data of the social networks to which we as operators of online presences may have access can be found in the following list.

The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. f GDPR, based on our legitimate interest in effectively informing users, communicating with users, selling and promoting our products and services, as well as Art. 6 para. 1 sentence 1 lit. b GDPR, in order to stay in contact with our customers and inform them, and to carry out pre-contractual measures with future customers and interested parties.

The legal basis may also be the user’s consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR given to the platform operator. The user may withdraw this consent at any time for the future by notifying the platform operator pursuant to Art. 7 para. 3 GDPR.

The processing of data carried out by the social networks on their own responsibility is subject to the privacy policies of the respective social networks. Further information about data processing and your objection options can be found in the privacy notices of the social networks.

Please note that data protection inquiries can be asserted most efficiently directly with the respective provider of the social network, as only these providers have access to the data and can take corresponding measures. Below is a list of the social networks on which we operate online presences:

Pinterest

We operate an online presence on Pinterest in order to present our company and services and to communicate with customers and interested parties. Pinterest is an online pinboard for graphics and photographs, offered by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland, for users within the European Economic Area. For all other users, Pinterest is operated by Pinterest Inc., 651 Brannan Street, San Francisco, California 94107, USA, jointly “Pinterest”.

We would like to point out that it is possible for users’ data to be processed outside the European Union, particularly in the USA. This may entail increased risks for users, as access to user data may be restricted. We have no access to this user data; access is exclusively with Pinterest.

You can view Pinterest’s privacy notices at the following link:

https://policy.pinterest.com/de/privacy-policy

YouTube

We operate an online presence on YouTube in order to present our company and services and to communicate with customers and interested parties. YouTube is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

You can view YouTube’s privacy notices at the following link:

https://policies.google.com/privacy

Facebook

To promote our products and services and to communicate with interested parties or customers, we operate a company presence on the Facebook platform.

On this social media platform, we are jointly responsible with Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, and, for users from the USA and Canada, with Facebook Inc., 1601 Willow Road, Menlo Park, California 94025, USA.

Facebook’s data protection officer can be reached via a contact form:

https://www.facebook.com/help/contact/540977946302970

We have regulated joint responsibility in an agreement regarding the respective obligations within the meaning of the GDPR. This agreement, which sets out the mutual obligations, can be accessed at the following link:

https://www.facebook.com/legal/terms/page_controller_addendum

When accessing our online presence on the Facebook platform, Facebook Ireland Ltd., as the operator of the platform in the EU, processes user data, such as personal information and IP address.

This user data is used to provide statistical information about the use of our company presence on Facebook. Facebook Ireland Ltd. uses this data for market research and advertising purposes as well as to create user profiles. Based on these profiles, Facebook Ireland Ltd. can, for example, target users inside and outside Facebook. If the user is logged into their Facebook account at the time of access, Facebook Ireland Ltd. can also link the data to the respective user account.

If the user contacts us via Facebook, the personal data entered by the user on that occasion is used to process the inquiry. The user’s data is deleted once the user’s inquiry has been conclusively answered and no statutory retention obligations, such as in the case of subsequent contract processing, prevent deletion.

Facebook may also set cookies to process the data.

If the user does not agree to this processing, there is the option to prevent the installation of cookies by making the corresponding browser settings. Cookies that have already been stored can also be deleted at any time. The settings for this depend on the respective browser. Flash cookies cannot be blocked via browser settings but require a corresponding setting in the Flash Player. Preventing or restricting the installation of cookies may mean that not all Facebook functions are fully usable.

Further information about processing activities, how to prevent them, and deletion of data processed by Facebook can be found in Facebook’s privacy policy:

https://www.facebook.com/privacy/explanation

It cannot be ruled out that processing also takes place via Facebook Inc., 1601 Willow Road, Menlo Park, California 94025, USA.

Instagram

To promote our products and services and to interact with interested parties and customers, we maintain a business profile on the Instagram platform.

On this social platform, we share responsibility with Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Instagram’s data protection officer can be reached via a contact form:

https://www.facebook.com/help/contact/540977946302970

Joint responsibility is regulated in an agreement that sets out our respective obligations pursuant to the General Data Protection Regulation (GDPR). You can view this agreement, which sets out our mutual obligations, at the following link:

https://www.facebook.com/legal/terms/page_controller_addendum

The legal basis for the processing of personal data described below is Article 6 paragraph 1 letter f GDPR. Our legitimate interest is to analyse, communicate, and promote our products and services.

The legal basis may also be the consent of the user pursuant to Article 6 paragraph 1 letter a GDPR given to the platform operator. The user may withdraw this consent at any time for the future pursuant to Article 7 paragraph 3 GDPR by contacting the platform operator.

When you access our online presence on the Instagram platform, Facebook Ireland Ltd., as the operator of the platform in the EU, processes user data, such as personal information and IP address.

This user data is used to obtain statistical information about the use of our company presence on Instagram. Facebook Ireland Ltd. uses this data for market research and advertising purposes as well as to create user profiles. With the help of these profiles, Facebook Ireland Ltd. can target users both inside and outside Instagram. If the user is logged into their Instagram account at the time of access, Facebook Ireland Ltd. can also link the data to the corresponding user account.

If the user contacts us via Instagram, the personal data entered by the user is used to process the inquiry. This data is deleted once the inquiry has been conclusively answered and no statutory retention obligations, for example in the case of subsequent contract processing, prevent deletion.

Facebook Ireland Ltd. may also set cookies for data processing.

If the user does not agree to this processing, there is the option to prevent the installation of cookies by adjusting the browser settings accordingly. Cookies that have already been stored can also be deleted at any time. The settings for this vary depending on the browser. Flash cookies cannot be blocked via browser settings but require a corresponding setting in the Flash Player. Preventing or restricting the installation of cookies may mean that not all Instagram functions are fully usable.

Further information about processing operations, how to prevent them, and deletion of data processed by Instagram can be found in Instagram’s privacy policy:

https://help.instagram.com/519522125107875

It cannot be ruled out that data processing by Facebook Ireland Ltd. also takes place via Facebook Inc., 1601 Willow Road, Menlo Park, California, 94025, USA.

3. Disclosure of Data

Disclosure of the data we collect generally only takes place in the following cases:

You have expressly given your consent pursuant to Article 6 paragraph 1 sentence 1 letter a of the General Data Protection Regulation (GDPR).
The disclosure is necessary pursuant to Article 6 paragraph 1 sentence 1 letter f GDPR for the establishment, exercise, or defence of legal claims, and there are no overriding legitimate interests on your part that oppose the disclosure.
We are legally obliged to disclose the data pursuant to Article 6 paragraph 1 sentence 1 letter c GDPR.
The disclosure is legally permissible and necessary pursuant to Article 6 paragraph 1 sentence 1 letter b GDPR for the processing of contractual relationships with you or for carrying out pre-contractual measures at your request.

Part of the data processing may be carried out by our service providers. These include, in particular, data centres that host our website and databases, IT service providers that maintain our systems, as well as delivery and logistics service providers. If we disclose data to our service providers, they may use the data exclusively to fulfil your tasks. The service providers have been carefully selected and commissioned by us. They are contractually bound by our instructions, have appropriate technical and organisational measures to protect the rights of the data subjects, and are regularly monitored by us.

In addition, disclosure may take place in connection with official requests, court orders, and legal proceedings if this is necessary to enforce or defend rights.

3.1 Swiss Post Ltd

For the shipment of goods, we use the service provider Swiss Post Ltd to send shipping notifications to our customers and to inform them of the shipping status and tracking number of their shipment. For this purpose, the personal data necessary for shipment information, such as name, address, order number, etc., is disclosed to Swiss Post Ltd. Further information can be found in the privacy policy of Swiss Post Ltd: https://www.post.ch/de/pages/footer/datenschutz-und-rechtliches

Swiss Post Ltd, Wankdorfallee 4, 3030 Bern

3.2 Xentral

For the processing and storage of our goods, we use the software service provider Xentral ERP Software GmbH to process shipping labels and delivery notes and to transmit the tracking number of your shipment to our shop system. For this purpose, the personal data necessary for shipment information, such as name, address, order number, etc., is disclosed to Xentral. Further information can be found in the privacy policy of Xentral: https://xentral.com/legal/datenschutz

Xentral ERP Software GmbH, Fuggerstrasse 11, 86150 Augsburg (kontakt@xentral.com)

3.3 Shop Provider

The processing of personal data is carried out by Shopify International Limited.

For the operation of our online shop, we use Shopify, a service of Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, “Shopify Limited”. Shopify is an e-commerce platform through which we offer our goods for sale.

When you use our online shop, Shopify Limited processes the data you provide, including your name, email address, shipping and billing address, payment information, where applicable the name of your company, and your telephone number. In addition, the IP address used, information about orders you have placed, information about online shops you have visited that are based on the Shopify platform, and information about your device and browser used are processed.

The processing is carried out on our behalf in order to provide you with the online shop. The data collection is based on the legal basis of Article 6 paragraph 1 letters b and f GDPR and is carried out to fulfil the contract concluded with you and on the basis of our overriding legitimate interest in making the use of the online shop as simple and efficient as possible and ensuring its functionality and security. We may disclose the data to our processor Shopify in accordance with the provisions of Article 28 GDPR.

Insofar as the processed data is transferred to Shopify Inc., based in Canada, 150 Elgin St., 8th Fl, Ottawa, ON K2P 1L4, Canada, the European Commission has determined, in accordance with Article 45 GDPR, that the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) provides an adequate level of data protection. You can find the adequacy decision at https://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELEX:32002D0002&from=EN.

Further information on data processing by Shopify Limited can be found at: https://www.shopify.com/legal/privacy.

4. Data Transfer to Third Countries

As explained in this Privacy Policy, we use services from providers that are partly based in so-called third countries, outside the European Union or the European Economic Area, or process personal data there. These are countries whose level of data protection does not correspond to that of the European Union. Where this is the case and the European Commission has not issued an adequacy decision pursuant to Article 45 GDPR for these countries, we have taken appropriate measures to ensure an adequate level of data protection for data transfers. These include, among other things, the use of European Union standard contractual clauses or binding internal data protection rules.

If such a measure is not possible, we base the data transfer on exceptions pursuant to Article 49 GDPR, in particular your express consent or the necessity of the transfer for the performance of a contract or for carrying out pre-contractual measures.

There is a possibility and risk that authorities in the respective third countries, such as intelligence services, may gain access to the transmitted data in order to collect and analyse it. In such cases, the enforceability of your data subject rights may not be guaranteed. If we obtain your consent via the cookie banner, we will also inform you about this.

5. Storage Period

In principle, we store personal data only for as long as is necessary to fulfil contractual or legal obligations for which we collected the data. After that, we delete the data immediately, unless we still need the data until the expiry of the statutory limitation period for evidentiary purposes in civil law matters or due to statutory retention obligations.

For evidentiary purposes, we must retain contractual data for three years after the end of the year in which the business relationship with you ends. Any claims become time-barred under the statutory standard limitation period at the earliest at this point.

Even after that, we must partially store your data for accounting reasons. This is done due to statutory documentation obligations that may arise from the German Commercial Code, the German Fiscal Code, the German Banking Act, the German Money Laundering Act, and the German Securities Trading Act. The retention periods specified there for documents are two to ten years.

6. Your Rights

You have the right at any time to request information about the processing of your personal data by us. As part of this request, we will explain the data processing to you and provide you with a summary of the data stored about you.

If data stored by us is incorrect or no longer up to date, you have the right to have this data corrected. You can also request the deletion of your data. If deletion is not possible due to other legal provisions, the data will be blocked so that it is only available for this statutory purpose.

You also have the right to restrict the processing of your data, particularly if you believe that the data stored by us is not correct.

In addition, you have the right to data portability, meaning that upon request we will provide you with a digital copy of the personal data you have provided.

To exercise your rights described above, you may contact us at any time using the contact details provided above. This also applies if you wish to receive copies of safeguards for an adequate level of data protection.

You also have the right to object to the processing of your data pursuant to Article 6 paragraph 1 letter e or f GDPR. Finally, you have the right to lodge a complaint with the competent data protection supervisory authority. You can exercise this right in the member state of your place of residence, your workplace, or the place of the alleged infringement. In Berlin, our registered office, the competent supervisory authority is: Berlin Commissioner for Data Protection and Freedom of Information, Friedrichstr. 219, 10969 Berlin.

7. Right of Withdrawal and Objection

Pursuant to Article 7 paragraph 2 GDPR, you have the right to withdraw consent once given to us at any time. As a result, we will no longer continue the data processing based on this consent in the future. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

If we process your data pursuant to Article 6 paragraph 1 letter e or f GDPR, you have the right under Article 21 GDPR to object to the processing of your data and to provide us with reasons arising from your particular situation that, in your opinion, justify the overriding of your legitimate interests. If the objection concerns data processing for marketing purposes, you have a general right of objection, which we will implement even without stating reasons.

If you wish to exercise your right of withdrawal or objection, an informal notification to the contact details provided above is sufficient.

8. Data Security

We continuously take current technical measures to ensure the security of your data, particularly to protect your personal data against risks during data transmission and against unauthorised access by third parties. These measures are adapted according to the current state of the art. To secure the personal data provided on our website, we use Transport Layer Security (TLS) to encrypt the information you enter.

9. Changes to the Privacy Policy

We occasionally update this Privacy Policy, for example when we adapt our website or when legal or regulatory requirements change.