Adatvédelmi irányelvek
Last updated: July 2026
Unless otherwise stated below, the provision of your personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are not obliged to provide the data. Failure to provide it has no consequences. This only applies insofar as no other information is given in the processing operations described below.
"Personal data" means any information relating to an identified or identifiable natural person.
1. Controller
The controller responsible for data processing on this website is:
ÉCLAT GmbH
represented by the managing directors Dascha Caly, Paul Caly
Ruhberg 9
35463 Fernwald
Germany
Phone: +49 641 201075
E-mail: info@eclat.de
Where this privacy policy refers to the GDPR, this also includes the UK GDPR for customers in the United Kingdom, where applicable. References to § 25 TDDDG concern the German Telecommunications Digital Services Data Protection Act, which applies to us as the operator of this website; it implements the European ePrivacy requirements for the storage of and access to information on end devices (e.g. cookies).
2. Hosting, Server Log Files and Content Delivery Network
2.1 Server Log Files
You can visit our website without providing any personal information. Each time you access our website, usage data is transmitted by your internet browser to us or our web host/IT service provider and stored in log data (so-called server log files). This stored data includes, for example, the name of the page accessed, the date and time of access, the IP address, the amount of data transferred and the requesting provider.
The processing is carried out on the basis of Art. 6 (1) (f) GDPR due to our overriding legitimate interest in ensuring the trouble-free operation of our website and in improving our services.
2.2 Shopify
Our website is operated on the e-commerce platform of Shopify International Limited (Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland; "Shopify"). Shopify is a company affiliated with Shopify Inc. (151 O'Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada). The processing takes place within the scope of a data processing agreement.
Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. An adequacy decision of the EU Commission exists for Canada. For the USA, an adequacy decision of the EU Commission is in place, the Trans-Atlantic Data Privacy Framework (TADPF). Insofar as the respective recipient is not certified under the TADPF, the data transfer is based on the standard contractual clauses of the EU Commission or comparable contractual guarantees.
Further information on data protection at Shopify can be found at https://www.shopify.com/legal/privacy and on the data processing agreement at https://www.shopify.com/legal/dpa.
2.3 Cloudflare
We use the content delivery network Cloudflare CDN of Cloudflare Inc. (101 Townsend St, San Francisco, CA 94107, USA; "Cloudflare") on our website. This is a transregional network of servers in various data centres to which our web server connects and through which certain content of our website is delivered.
The data processing serves the purpose of optimising the loading times of our website and making our services more user-friendly. The following information, among others, may be collected: IP address, system configuration information, information about traffic to and from customer websites (so-called server log files).
Your data may be transferred to the USA. For the USA, an adequacy decision of the EU Commission is in place, the Trans-Atlantic Data Privacy Framework (TADPF). Cloudflare is certified under the TADPF.
The processing of your personal data is carried out on the basis of Art. 6 (1) (f) GDPR due to our overriding legitimate interest in a needs-based and targeted design of the website. You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you.
Further information: https://www.cloudflare.com/privacypolicy/
3. Cookies and Consent Management
Our website uses cookies. Cookies are small text files that are stored in or by the internet browser on a user's device. When a user accesses a website, a cookie may be stored on the user's device. This cookie contains a characteristic character string that enables the browser to be uniquely identified when the website is accessed again.
Cookies are stored on your device. You therefore have full control over the use of cookies. Via the technical settings of your internet browser, you can be notified before cookies are set, decide individually on their acceptance and prevent the storage of cookies and the transmission of the data they contain. Cookies that have already been stored can be deleted at any time. Please note that you may then not be able to use all functions of this website to their full extent.
Instructions for the most common browsers:
- Chrome: https://support.google.com/accounts/answer/61416
- Microsoft Edge: https://support.microsoft.com/en-us/microsoft-edge
- Mozilla Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences
- Safari: https://support.apple.com/en-gb/guide/safari/sfri11471/mac
3.1 Technically Necessary Cookies
Unless otherwise stated below in this privacy policy, we only use technically necessary cookies for the purpose of making our services more user-friendly, effective and secure. Cookies also enable our systems to recognise your browser after a page change and to offer you services (e.g. shopping cart). Some functions of our website cannot be offered without the use of cookies.
The use of technically necessary cookies or comparable technologies is based on § 25 (2) TDDDG. The processing of your personal data is carried out on the basis of Art. 6 (1) (f) GDPR due to our overriding legitimate interest in ensuring the optimal functionality of the website and a user-friendly and effective design of our services. You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you.
3.2 Cookies Requiring Consent
We only use cookies and comparable technologies that are not technically necessary (e.g. for analysis and marketing, see below) with your consent, which you can give via our consent banner. The legal basis is § 25 (1) sentence 1 TDDDG in conjunction with Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future without affecting the lawfulness of the processing carried out on the basis of the consent until withdrawal. You can access and adjust your cookie settings at any time via the "Cookie Settings" link on our website.
3.3 Cookie Consent Manager CCM19
We use the cookie consent manager CCM19 of Papoo Software & Media GmbH (Auguststr. 4, 53229 Bonn, Germany; "CCM19") on our website.
The tool enables you to give consent to data processing via the website, in particular the setting of cookies, and to exercise your right to withdraw consent already given. The data processing serves the purpose of obtaining and documenting the required consents and thus complying with legal obligations. Cookies are used for this purpose. The following information, among others, may be collected, stored and, where applicable, transmitted to CCM19: randomly assigned ID, consent status, date and time of consent/refusal. The data is stored for one year and one month and then deleted. This data is not passed on to any other third parties.
The data processing is carried out to fulfil a legal obligation on the basis of Art. 6 (1) (c) GDPR.
Further information: https://www.ccm19.de/en/privacy-policy.html
4. Contact
4.1 Contacting Us by E-mail
If you contact us on your own initiative by e-mail, we collect your personal data (name, e-mail address, message text) only to the extent provided by you. The data processing serves the purpose of processing and answering your contact request.
If the contact serves the implementation of pre-contractual measures (e.g. advice in the event of purchase interest, preparation of an offer) or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 (1) (b) GDPR. If the contact is made for other reasons, the data processing is carried out on the basis of Art. 6 (1) (f) GDPR due to our overriding legitimate interest in processing and answering your request. In this case, you have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you based on Art. 6 (1) (f) GDPR.
We only use your e-mail address to process your request. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.
4.2 Contact Form
When you use the contact form, we collect your personal data (name, e-mail address, message text) only to the extent provided by you. The data processing serves the purpose of establishing contact. The legal bases and the right to object as described in 4.1 apply. Your data will be deleted after your request has been processed, in compliance with statutory retention periods, unless you have consented to further processing.
4.3 WhatsApp Business
If you contact us via WhatsApp, we use the WhatsApp Business version of WhatsApp Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; "WhatsApp"). If you are located outside the European Economic Area, this service is provided by WhatsApp LLC (1601 Willow Road, Menlo Park, CA 94025, USA).
The data processing serves the purpose of processing and answering your contact request. For this purpose, we collect and process the mobile phone number stored with WhatsApp, your name if provided, and further data to the extent provided by you. We use a device for this service whose address book only contains data of users who have contacted us via WhatsApp. Personal data is therefore not passed on to WhatsApp without you having already consented to this vis-à-vis WhatsApp.
Your data is transmitted by WhatsApp to servers of Meta Platforms Inc. in the USA. For the USA, an adequacy decision of the EU Commission is in place, the Trans-Atlantic Data Privacy Framework (TADPF). Meta Platforms Inc. is certified under the TADPF.
If the contact serves the implementation of pre-contractual measures or concerns a contract already concluded, the data processing is carried out on the basis of Art. 6 (1) (b) GDPR. If the contact is made for other reasons, it is carried out on the basis of Art. 6 (1) (f) GDPR due to our overriding legitimate interest in a quick and easy contact option and in answering your request. In this case, you have the right to object to this processing at any time on grounds relating to your particular situation.
Further information: https://www.whatsapp.com/legal/#privacy-policy
4.4 Live Chat System Userlike
We use the live chat system of Userlike UG (haftungsbeschränkt) (Probsteigasse 44–46, 50670 Cologne, Germany; "Userlike") on our website within the scope of a data processing agreement.
The data processing serves the purpose of direct and efficient communication between you and us. When you access our website, the chat widget is loaded as a JavaScript file, which technically enables the chat. Cookies are used to operate the live chat system, which enable the browser to be recognised. The following information, among others, may be collected and processed: date and time of access, browser type/version, IP address, information about the operating system and device used, URL of the previously visited website, number of page views, and any further information you provide in the course of the chat.
The use of cookies or comparable technologies is based on your consent pursuant to § 25 (1) sentence 1 TDDDG in conjunction with Art. 6 (1) (a) GDPR. The processing of your personal data is based on your consent pursuant to Art. 6 (1) (a) GDPR. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out until withdrawal.
Further information: https://www.userlike.com/en/data-privacy
5. Customer Account, Orders and Contract Processing
5.1 Customer Account
When you open a customer account, we collect your personal data to the extent specified there. The data processing serves the purpose of improving your shopping experience and simplifying order processing. The processing is carried out on the basis of Art. 6 (1) (a) GDPR with your consent. You can withdraw your consent at any time by notifying us, without affecting the lawfulness of the processing carried out until withdrawal. Your customer account will then be deleted.
5.2 Collection, Processing and Disclosure of Personal Data for Orders
When you place an order, we collect and process your personal data only insofar as this is necessary for the fulfilment and processing of your order and for handling your enquiries. The provision of the data is necessary for the conclusion of the contract. Failure to provide it means that no contract can be concluded. The processing is carried out on the basis of Art. 6 (1) (b) GDPR.
Your data is passed on, for example, to the shipping companies you have chosen, payment service providers, service providers for order processing and IT service providers. In all cases, we strictly observe the legal requirements. The scope of data transmission is limited to a minimum.
Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA (see section 2.2).
5.3 Disclosure of Your E-mail Address to Shipping Companies for Information on Shipping Status
We pass on your e-mail address to the transport company as part of contract processing, provided you have expressly consented to this during the ordering process. The purpose of this disclosure is to inform you by e-mail about the shipping status. The processing is carried out on the basis of Art. 6 (1) (a) GDPR with your consent. You can withdraw your consent at any time by notifying us or the transport company.
5.4 External Merchandise Management System (JTL)
We use a merchandise management system for contract processing within the scope of a data processing agreement. For this purpose, your personal data collected as part of the order is transmitted to JTL-Software-GmbH (Rheinstr. 7, 41836 Hückelhoven, Germany). The processing serves the purpose of fulfilling the contract concluded with you and is carried out on the basis of Art. 6 (1) (b) GDPR.
5.5 Returns Processing via Returnless
For processing returns, we use the returns portal of Returnless B.V. (Schiedamse Vest 154, 3011 BH Rotterdam, Netherlands; "Returnless") within the scope of a data processing agreement. If you register a return via our returns portal, the data required for this (e.g. name, e-mail address, order number, details of the return) is processed.
The data processing serves the purpose of handling your return and thus fulfilling the contract concluded with you or handling statutory warranty and withdrawal rights. The processing is carried out on the basis of Art. 6 (1) (b) GDPR.
Further information: https://www.returnless.com/privacy
5.6 Wishlist (Swym)
We offer a wishlist function on our website provided by Swym Corporation (16192 Coastal Highway, Lewes, DE 19958, USA; "Swym") within the scope of a data processing agreement. If you add products to your wishlist, information is processed for this purpose (e.g. saved products, device/browser identifier, and for logged-in users the assignment to the customer account) in order to provide you with your wishlist across devices.
Your data may be transferred to the USA. For the USA, an adequacy decision of the EU Commission is in place, the Trans-Atlantic Data Privacy Framework (TADPF). Insofar as no TADPF certification exists, the transfer is based on the standard contractual clauses of the EU Commission.
The use of cookies or comparable technologies is based on your consent pursuant to § 25 (1) sentence 1 TDDDG in conjunction with Art. 6 (1) (a) GDPR. The processing of your personal data is based on your consent pursuant to Art. 6 (1) (a) GDPR. You can withdraw your consent at any time.
Further information: https://swym.it/privacy-policy/
6. Payment Service Providers and Credit Checks
6.1 Shopify Payments / Shop Pay
We offer payment processing via Shopify Payments and Shop Pay, a service of Shopify International Limited (Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, Ireland; "Shopify"). Shopify Payments processes, among others, payments by credit card (Visa, Mastercard, American Express, Maestro, Union Pay), Apple Pay, Google Pay and local payment methods (e.g. Bancontact, iDEAL, EPS, BLIK, Wero, MobilePay). The actual payment processing is carried out by payment processors integrated by Shopify (including Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland).
When you select and use a payment method offered via Shopify Payments, the data required for payment processing (e.g. name, address, payment data, order data, IP address) is transmitted to Shopify or the respective payment processor in order to fulfil the contract with you using the chosen payment method. This processing is carried out on the basis of Art. 6 (1) (b) GDPR.
When using Apple Pay or Google Pay, data is additionally transmitted to Apple Inc. (One Apple Park Way, Cupertino, CA 95014, USA) or Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); in this respect, the privacy policy of the respective provider applies.
Your data may be transferred to third countries outside the EU, in particular Canada and the USA (see section 2.2).
Further information: https://www.shopify.com/legal/privacy and https://stripe.com/privacy
6.2 PayPal (PayPal Checkout / PayPal Express)
We use the payment services PayPal Checkout and PayPal Express of PayPal (Europe) S.à r.l. et Cie, S.C.A. (22–24 Boulevard Royal, L-2449 Luxembourg; "PayPal") on our website. The data processing serves the purpose of offering you payment via PayPal.
To integrate this payment service, it is necessary for PayPal to collect, store and analyse data (e.g. IP address, device type, operating system, browser type, location of your device) when the website is accessed. Cookies may also be used for this purpose, which enable your browser to be recognised. This data processing is carried out on the basis of Art. 6 (1) (f) GDPR due to our overriding legitimate interest in offering a customer-oriented range of payment methods. You have the right to object to this processing at any time on grounds relating to your particular situation.
When you select and use payment via PayPal, credit card via PayPal, direct debit via PayPal or "Pay Later" via PayPal, the data required for payment processing is transmitted to PayPal in order to fulfil the contract with you using the chosen payment method. This processing is carried out on the basis of Art. 6 (1) (b) GDPR.
Credit check: For certain payment methods (credit card via PayPal, direct debit via PayPal, "Pay Later" via PayPal), PayPal reserves the right to obtain a credit report based on mathematical-statistical procedures using credit agencies. For this purpose, PayPal transmits the personal data required for a credit check to a credit agency and uses the information received on the statistical probability of payment default for a balanced decision on the establishment, implementation or termination of the contractual relationship. The credit report may contain probability values (score values) calculated on the basis of scientifically recognised mathematical-statistical procedures, the calculation of which includes, among other things, address data. Your interests worthy of protection are taken into account in accordance with the statutory provisions. The processing is carried out on the basis of Art. 6 (1) (f) GDPR due to our overriding legitimate interest in protection against payment default when PayPal provides advance performance. You have the right to object to this processing at any time on grounds relating to your particular situation by notifying PayPal. The provision of the data is necessary for the conclusion of the contract with your desired payment method.
Purchase on account via PayPal: When paying via purchase on account, the data required for payment processing is first transmitted to PayPal and then to Ratepay GmbH (Franklinstraße 28–29, 10587 Berlin, Germany; "Ratepay") in order to fulfil the contract with the chosen payment method (Art. 6 (1) (b) GDPR). Ratepay may carry out a credit check following the procedure described above (Art. 6 (1) (f) GDPR). Further information: https://www.ratepay.com/en/legal-payment-dataprivacy/ and https://www.ratepay.com/en/legal-payment-creditagencies/
Further information on data processing at PayPal: https://www.paypal.com/uk/legalhub/privacy-full
6.3 Klarna
We use the payment service of Klarna Bank AB (publ) (Sveavägen 46, 111 34 Stockholm, Sweden; "Klarna") on our website. When you select and use payment via Klarna, the data required for payment processing is transmitted to Klarna in order to fulfil the contract with you using the chosen payment method. This processing is carried out on the basis of Art. 6 (1) (b) GDPR.
Cookies may be stored in this context, which enable your browser to be recognised. This data processing is carried out on the basis of Art. 6 (1) (f) GDPR due to our overriding legitimate interest in offering a customer-oriented range of payment methods. You have the right to object to this processing at any time on grounds relating to your particular situation.
Credit check: For certain payment methods such as "Pay Later" (invoice), "Pay Now" (direct debit) and "Financing" (instalment purchase), Klarna reserves the right to obtain a credit report based on mathematical-statistical procedures using credit agencies. For this purpose, Klarna transmits the personal data required for a credit check (e.g. first and last name, address, gender, e-mail address, IP address and order data) to a credit agency for the purpose of identity and credit checks and uses the information received on the statistical probability of payment default for a balanced decision on the establishment, implementation or termination of the contractual relationship. The processing is carried out on the basis of Art. 6 (1) (f) GDPR due to our overriding legitimate interest in protection against payment default when Klarna provides advance performance. You have the right to object to this processing at any time by notifying Klarna. The provision of the data is necessary for the conclusion of the contract with the desired payment method.
Information on the credit agencies used by Klarna: https://cdn.klarna.com/1.0/shared/content/legal/terms/0/en_de/credit_rating_agencies — Klarna privacy policy: https://cdn.klarna.com/1.0/shared/content/legal/terms/0/en_de/privacy
7. Reviews and Comments
7.1 Data Collection When Writing a Comment or Review
When you comment on or review an article or post, we collect your personal data (name, e-mail address, comment text) only to the extent provided by you. The processing serves the purpose of enabling comments/reviews and displaying them. For the purpose of verifying your review, we also collect your order number and customer number.
By submitting the comment/review, you consent to the processing of the transmitted data. The processing is carried out on the basis of Art. 6 (1) (a) GDPR with your consent. You can withdraw your consent at any time by notifying us, without affecting the lawfulness of the processing carried out until withdrawal. Upon publication, only the name you provided will be published.
7.2 Website Logo for Google Customer Reviews
The website logo for Google Customer Reviews of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google") is integrated on our website. The integration serves the purpose of displaying the number and result of our reviews received via Google and of advertising with participation in this programme. Google uses cookies for this purpose; among other things, your IP address may be processed and transmitted to Google.
Your data may be transferred to the USA. Google LLC is certified under the TADPF.
The use of cookies or comparable technologies is based on your consent pursuant to § 25 (1) sentence 1 TDDDG in conjunction with Art. 6 (1) (a) GDPR. The processing of your personal data is based on your consent pursuant to Art. 6 (1) (a) GDPR. You can withdraw your consent at any time.
Further information: https://policies.google.com/privacy
8. Advertising and Newsletter
8.1 Postal Advertising
We use your personal data (name, postal address), which we received in connection with the sale of goods or services, to send you postal advertising, unless you have objected to this use. The processing is carried out on the basis of Art. 6 (1) (f) GDPR due to our overriding legitimate interest in direct marketing. You can object to this use of your address data at any time by notifying us. The contact details for exercising the objection can be found in the imprint.
8.2 E-mail Newsletter (With Consent)
We use your e-mail address, independently of contract processing, exclusively for our own advertising purposes for sending the newsletter, provided you have expressly consented to this. The processing is carried out on the basis of Art. 6 (1) (a) GDPR with your consent. You can withdraw your consent at any time, e.g. via the unsubscribe link in the newsletter or by notifying us. Your e-mail address will then be removed from the mailing list.
8.3 Direct E-mail Marketing to Existing Customers
We use your e-mail address, which we received in connection with the sale of goods or services, for the electronic transmission of advertising for our own goods or services that are similar to those you have already purchased from us (§ 7 (3) of the German Act against Unfair Competition, UWG), unless you have objected to this use. The processing is carried out on the basis of Art. 6 (1) (f) GDPR due to our overriding legitimate interest in direct marketing. You can object to this use of your e-mail address at any time by notifying us or via the link provided for this purpose in the advertising e-mail. No costs other than the transmission costs according to the basic rates will be incurred for this.
8.4 Newsletter Dispatch With Klaviyo
We use the service of Klaviyo Inc. (125 Summer St, Floor 7, Boston, MA 02111, USA; "Klaviyo") for sending our newsletter within the scope of a data processing agreement. We pass on the information you provided when registering for the newsletter (e-mail address, first and last name if applicable) to Klaviyo. The data processing serves the purpose of sending the newsletter and its statistical evaluation.
To evaluate newsletter campaigns, the newsletters sent contain a 1x1 pixel graphic (tracking pixel) or a tracking link. This allows us to determine whether you have opened the newsletter and whether you have clicked on integrated links. In this context, we collect personal data such as IP address, browser type and device as well as the time. Usage profiles may be created from this data under a pseudonym. The data collected is not used to identify you personally, but only for statistical evaluation and improvement of newsletter campaigns.
Your data is generally transmitted to and stored on Klaviyo servers in the USA. Klaviyo is certified under the TADPF.
The processing of your personal data is carried out on the basis of Art. 6 (1) (f) GDPR due to our overriding legitimate interest in a targeted, effective and user-friendly newsletter system. You have the right to object to this processing at any time on grounds relating to your particular situation.
Further information: https://www.klaviyo.com/legal/privacy-notice
9. Analysis, Advertising Tracking and Affiliate
We only use the services described in this section with your consent. The use of cookies or comparable technologies is in each case based on § 25 (1) sentence 1 TDDDG in conjunction with Art. 6 (1) (a) GDPR; the processing of your personal data is in each case based on your consent pursuant to Art. 6 (1) (a) GDPR. You can withdraw your consent at any time via the cookie settings with effect for the future, without affecting the lawfulness of the processing carried out until withdrawal.
9.1 Google Analytics 4
We use the web analysis service Google Analytics of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google"). The data processing serves the purpose of analysing this website and its visitors as well as for marketing and advertising purposes. Google will use the information obtained on our behalf to evaluate your use of the website, to compile reports on website activity and to provide us with further services associated with website use.
The following information, among others, may be collected: IP address, date and time of the page view, click path, information about browser and device, pages visited, referrer URL, location data, purchase activity. Your data may be combined by Google with other data (e.g. search history, personal accounts, usage data from other devices). IP anonymisation is activated, so that Google only receives shortened or pseudonymised data. Google uses technologies such as cookies, web storage in the browser and tracking pixels.
The information generated is generally transmitted to a Google server in the USA and stored there. Google LLC is certified under the TADPF.
Further information: https://policies.google.com/technologies/partner-sites and https://policies.google.com/privacy
9.2 Google Ads Conversion Tracking and Enhanced Conversions
We use the online advertising programme "Google Ads" and, within this framework, conversion tracking of Google Ireland Limited. If you click on an ad placed by Google, a cookie for conversion tracking is stored on your device. These cookies have limited validity and are not used for personal identification. The information obtained with the help of the conversion cookie serves the purpose of creating conversion statistics.
In addition, we use the Enhanced Conversions function. This enables us to send certain data (e.g. place of residence, postcode, hashed e-mail addresses, names, telephone number) of our customers and prospects to Google as hash values in order to control advertising campaigns more precisely and to improve the assignment of website conversions to ad events.
Your data may be transmitted to servers of Google LLC in the USA. Google LLC is certified under the TADPF.
Further information: https://policies.google.com/privacy
9.3 Google Tag Manager
We use the Google Tag Manager of Google Ireland Limited. This application is used to manage JavaScript and HTML tags that are used to implement tracking and analysis tools in particular. The Google Tag Manager itself neither stores cookies nor processes personal data; however, it enables the triggering of further tags that may collect and process personal data.
Further information: https://www.google.com/intl/en/tagmanager/use-policy.html
9.4 Meta Pixel and Advanced Matching
We use the Meta Pixel of Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; "Meta").
Meta and we are joint controllers for the collection of your data and its transmission to Meta that takes place when the service is integrated. This is based on an agreement on joint processing of personal data (available at https://www.facebook.com/legal/terms/businesstools), in which the respective responsibilities are defined. According to this, we are responsible in particular for fulfilling the information obligations pursuant to Art. 13, 14 GDPR, for complying with the security requirements of Art. 32 GDPR with regard to the correct technical implementation and configuration of the service, and for the obligations under Art. 33, 34 GDPR insofar as a personal data breach concerns our obligations. Meta is responsible for enabling data subject rights pursuant to Art. 15–20 GDPR, for complying with the security requirements of Art. 32 GDPR with regard to the security of the service, and for fulfilling the obligations under Art. 33, 34 GDPR insofar as a personal data breach concerns Meta's obligations.
The application serves the purpose of targeting website visitors with interest-based advertising on the social networks Facebook and Instagram and of creating conversion statistics. When you visit the website, a direct connection to the Meta servers is established via the remarketing tag, transmitting which of our pages you have visited. Meta may assign this information to your personal Facebook and/or Instagram user account.
In addition, we use the Advanced Matching function: certain data (e.g. place of residence, postcode, hashed e-mail addresses, names, gender, date of birth, telephone number) may be transmitted to Meta in order to control advertising campaigns more precisely, improve the assignment of conversions and expand custom audiences.
Your data may be transferred to the USA. Meta Platforms Inc. is certified under the TADPF.
Further information: https://www.facebook.com/privacy/policy/
9.5 TikTok Pixel
We use the TikTok Pixel of TikTok Technology Limited (10 Earlsfort Terrace, Dublin, D02 T380, Ireland; "TikTok Ireland") and TikTok Information Technologies UK Limited (6th Floor, One London Wall, London, EC2Y 5EB, United Kingdom; "TikTok UK"), which are joint controllers (hereinafter "TikTok").
The data processing serves the purpose of analysing website access, improving customer targeting through personalised advertising and evaluating the effectiveness of advertisements on TikTok. For this purpose, TikTok uses technologies such as cookies and pixels that enable your browser to be recognised. The following information, among others, may be collected and transmitted to TikTok: date and time of the visit, information about browser and device type, screen resolution, IP address. TikTok may assign this information to your personal TikTok user account.
Your data may be transferred to third countries such as the USA. Insofar as no TADPF certification exists for the recipient, the transfer is based on standard contractual clauses as appropriate safeguards (available at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en).
Further information: https://www.tiktok.com/legal/page/eea/privacy-policy/en
9.6 Shopify Statistics
We use the statistics and analysis functions of Shopify International Limited (see section 2.2) within the scope of a data processing agreement. The data processing serves the purpose of analysing this website and its visitors. The following information, among others, is collected and processed: information about the web browser, IP address, time zone, installed cookies, pages and products viewed, referrer URL and information about interaction with the website. Technologies such as cookies, web beacons, tags and pixels are used for this purpose.
Your data may be transferred to Canada and the USA (see section 2.2).
Further information: https://www.shopify.com/legal/cookies
9.7 Awin Partner Programme
We use the "Awin" partner programme of AWIN AG (Eichhornstraße 3, 10785 Berlin, Germany; "Awin"). If you click on an advertisement provided with a partner link, Awin stores a cookie for conversion tracking on your device. The cookies serve the purpose of correct accounting within the partner programme by recording the success of an advertising medium. Awin also uses so-called fingerprinting, which allows the device you are using to be recognised. Awin collects, among other things, transaction data (e.g. order value, product type, sales channel, use of a voucher) and a pseudonymous user identifier in the form of an individual sequence of numbers from which your identity cannot be recognised.
Your data may be transferred to third countries such as the USA. The transfer is based, among other things, on standard contractual clauses as appropriate safeguards.
Further information: https://www.awin.com/gb/privacy
10. Integrated Third-Party Services and Content
The following also applies to the services listed in this section: the use of cookies or comparable technologies is based on your consent pursuant to § 25 (1) sentence 1 TDDDG in conjunction with Art. 6 (1) (a) GDPR; the processing of your personal data is based on your consent pursuant to Art. 6 (1) (a) GDPR. You can withdraw your consent at any time.
10.1 Google reCAPTCHA / Invisible reCAPTCHA
We use the reCAPTCHA service (including invisible reCAPTCHA) of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google"). The query serves the purpose of distinguishing whether an input is made by a human or by automated, machine processing. For this purpose, your input, your IP address and, where applicable, further usage data required by Google for the service are transmitted to Google and used further there. This data is processed by Google within the European Union and may also be transmitted to servers of Google LLC in the USA. Google LLC is certified under the TADPF.
Further information: https://policies.google.com/privacy
10.2 Google Maps
We use the function for embedding Google Maps of Google Ireland Limited. The function enables the visual display of geographical information and interactive maps. When pages containing embedded maps are accessed, Google also collects, processes and uses data of website visitors. Your data may be transferred to the USA; Google LLC is certified under the TADPF.
Further information: https://policies.google.com/privacy
10.3 YouTube
We use the function for embedding YouTube videos of Google Ireland Limited ("YouTube"). The function displays videos stored on YouTube in an iFrame on the website. The "extended data protection mode" option is activated, meaning that YouTube does not store any information about visitors before they watch a video. Only when you watch a video is information about it transmitted to YouTube and stored there. Your data may be transferred to the USA; Google LLC is certified under the TADPF.
Further information: https://www.youtube.com/t/privacy
10.4 Vimeo
We use plug-ins of Vimeo Inc. (555 West 18th Street, New York, NY 10011, USA; "Vimeo") to embed videos. When pages with such a plug-in are accessed, a connection to the Vimeo servers is established; this transmits your IP address and the information about which of our pages you have visited to Vimeo. If you are logged in to Vimeo, Vimeo assigns this information to your personal user account.
Your data may be transferred to the USA. Insofar as no TADPF certification exists for the recipient, the transfer is based on standard contractual clauses as appropriate safeguards.
Further information: https://vimeo.com/privacy
11. Job Applications
When you use the application form or apply by e-mail, we collect your personal data only to the extent provided by you. This includes your contact details (e.g. name, e-mail address, telephone number), information on your professional qualifications and education, information on professional training and performance-related evidence.
The data processing serves the purpose of establishing contact and deciding on the establishment of an employment relationship. The provision of the data is necessary to carry out the application procedure. The processing is carried out on the basis of Art. 6 (1) (b) GDPR in conjunction with § 26 (1) of the German Federal Data Protection Act (BDSG) for the implementation of pre-contractual measures.
If you have given us consent to be included in our applicant pool (e.g. by ticking a checkbox), the processing is carried out on the basis of Art. 6 (1) (a) GDPR. You can withdraw your consent at any time.
If special categories of personal data within the meaning of Art. 9 (1) GDPR are requested as part of the application procedure (e.g. information on the degree of a severe disability), this is done on the basis of Art. 9 (2) (b) GDPR so that we can exercise the rights and fulfil our obligations arising from employment law and social security law.
We store your personal data for as long as is necessary for the decision on your application. Your data will be deleted no later than six months after completion of the application procedure, unless you have consented to further processing. If an employment relationship is established, the data will be further processed on the basis of Art. 6 (1) (b) GDPR in conjunction with § 26 (1) BDSG.
12. Data Transfers to Third Countries
As described in this privacy policy, your data may be transferred to third countries outside the EU or EEA, in particular to the USA and Canada. An adequacy decision of the EU Commission exists for Canada. For the USA, an adequacy decision of the EU Commission is in place, the Trans-Atlantic Data Privacy Framework (TADPF); transfers to TADPF-certified recipients are based on this. Insofar as a recipient is not certified or data is transferred to other third countries without an adequacy decision, the transfer is based on appropriate safeguards, in particular the standard contractual clauses of the EU Commission (Art. 46 (2) (c) GDPR), supplemented by additional protective measures where necessary.
13. Duration of Storage
After complete contract processing, the data is initially stored for the duration of the warranty period, then in consideration of statutory retention periods, in particular under tax and commercial law (generally six or ten years pursuant to § 257 of the German Commercial Code (HGB) and § 147 of the German Fiscal Code (AO)), and deleted after expiry of the period, unless you have consented to further processing and use. Otherwise, the storage period is governed by the information provided for the individual processing operations.
14. Rights of the Data Subject
If the legal requirements are met, you have the following rights under Art. 15 to 20 GDPR: right of access, rectification, erasure, restriction of processing and data portability. Insofar as processing is based on your consent, you also have the right to withdraw it at any time with effect for the future (Art. 7 (3) GDPR).
Right to Object (Art. 21 GDPR)
If the processing operations of personal data listed here are based on our legitimate interest pursuant to Art. 6 (1) (f) GDPR, you have the right to object to these processing operations at any time with effect for the future on grounds relating to your particular situation. After the objection has been made, the processing of the data concerned will be terminated unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
If personal data is processed for direct marketing purposes, you can object to this processing at any time by notifying us. After the objection has been made, we will stop processing the data concerned for direct marketing purposes.
Right to Lodge a Complaint With the Supervisory Authority
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data is not lawful. The supervisory authority responsible for us is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
(The Hessian Commissioner for Data Protection and Freedom of Information)
Postfach 3163
65021 Wiesbaden, Germany
Phone: +49 611 1408-0
E-mail: poststelle@datenschutz.hessen.de
Last updated: July 2026