Data protection

Privacy Policy

Personal data (hereinafter mostly referred to as "data") will only be processed by us as far as necessary and for the purpose of providing a functional and user-friendly website, including its contents and the services offered there.

According to Art. 4 No. 1 of Regulation (EU) 2016/679, i.e. the General Data Protection Regulation (hereinafter referred to as "GDPR"), "processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

With the following privacy policy, we inform you in particular about the type, scope, purpose, duration and legal basis of the processing of personal data, insofar as we decide either alone or jointly with others on the purposes and means of processing. In addition, we inform you below about the third-party components we use for optimization purposes and to increase the quality of use, insofar as third parties process data on their own responsibility.

Our privacy policy is structured as follows:

I. Information about us as the controller
II. Rights of users and data subjects
III. Information on data processing

I. Information about us as the controller

The controller of this website in terms of data protection law is:

MONOPOL Handelsges.mbH
Meinecke, Kendy
Bürgermeister-Ebert-Straße 26
36124 Eichenzell

Phone: 0661-6710-13
E-mail: service@trendyshop365.de

The data protection officer at the provider is:

Meinecke, Kendy
Phone: 0661-6791020
E-mail: service@trendyshop365.de

II. Rights of users and data subjects

With regard to the data processing described in more detail below, users and data subjects have the right

• to confirmation as to whether data concerning them are processed, to information about the processed data, to further information about the data processing, and to copies of the data (cf. also Art. 15 GDPR);
• to rectification or completion of inaccurate or incomplete data (cf. also Art. 16 GDPR);
• to immediate erasure of the data concerning them (cf. also Art. 17 GDPR), or, alternatively, if further processing is necessary pursuant to Art. 17 Para. 3 GDPR, to restriction of processing in accordance with Art. 18 GDPR;
• to receive the data concerning them and provided by them and to transmit these data to other providers/controllers (cf. also Art. 20 GDPR);
• to lodge a complaint with the supervisory authority if they believe that the data concerning them are being processed by the provider in violation of data protection provisions (cf. also Art. 77 GDPR).

Furthermore, the provider is obliged to inform all recipients to whom data have been disclosed by the provider about any rectification or erasure of data or restriction of processing carried out pursuant to Art. 16, Art. 17 Para. 1, Art. 18 GDPR. This obligation does not apply if this notification is impossible or involves disproportionate effort. Without prejudice to this, the user has a right to information about these recipients.

Users and data subjects also have the right, pursuant to Art. 21 GDPR, to object to the future processing of data concerning them, provided that the data are processed by the provider in accordance with Art. 6 Para. 1 lit. f) GDPR. In particular, an objection to data processing for the purpose of direct marketing is permissible.

III. Information on data processing

Your data processed when using our website will be deleted or blocked as soon as the purpose of storage ceases to apply, no statutory retention obligations prevent the deletion of the data, and no other information on individual processing procedures is provided below.

Hosting by Shopify

We use the shop system of the service provider Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"), for the purpose of hosting and displaying the online shop based on processing on our behalf. All data collected on our website are processed on Shopify's servers. Within the scope of Shopify's aforementioned services, data may also be transmitted to Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada, Shopify Data Processing (USA) Inc., Shopify Payments (USA) Inc., or Shopify (USA) Inc. for further processing on commission. In the event of data transfer to Shopify Inc. in Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission. Further information on Shopify's data protection can be found on the following website: https://www.shopify.de/legal/datenschutz
Further processing on servers other than those mentioned above by Shopify only takes place within the scope communicated below.

Cookie Manager

To obtain consent for the use of technically non-essential cookies on the website, the provider uses a cookie manager.

When accessing the website, a cookie with the setting information is stored on the user's device so that a query regarding consent is not necessary for a subsequent visit.

The cookie is required to obtain legally compliant consent from the user.

The user can prevent or stop the installation of cookies by adjusting their browser settings.

Cookies

a) Session Cookies

We use so-called cookies on our website. Cookies are small text files or other storage technologies that are stored on your device by the internet browser you use. These cookies process certain information about you, such as your browser or location data or your IP address, to an individual extent.

This processing makes our website more user-friendly, effective, and secure, as the processing enables, for example, the display of our website in different languages or the offering of a shopping cart function.

The legal basis for this processing is Art. 6 para. 1 lit b.) GDPR, provided that these cookies process data for the initiation or execution of a contract.

If the processing does not serve to initiate or execute a contract, our legitimate interest lies in improving the functionality of our website. The legal basis is then Art. 6 para. 1 lit. f) GDPR.

These session cookies are deleted when you close your internet browser.

b) Third-party cookies

Our website may also use cookies from partner companies with whom we cooperate for the purposes of advertising, analysis, or the functionalities of our website.

You will find details on this, in particular on the purposes and legal bases of the processing of such third-party cookies, in the following information.

c) Removal options

You can prevent or restrict the installation of cookies by adjusting your internet browser settings. You can also delete already stored cookies at any time. The steps and measures required for this, however, depend on the specific internet browser you are using. For questions, please use the help function or documentation of your internet browser or contact its manufacturer or support. For so-called Flash cookies, however, processing cannot be prevented via the browser settings. Instead, you must change the settings of your Flash player. The steps and measures required for this also depend on the specific Flash player you are using. For questions, please also use the help function or documentation of your Flash player or contact the manufacturer or user support.

If you prevent or restrict the installation of cookies, this may, however, lead to not all functions of our website being fully usable.

Contact inquiries / contact options

If you contact us via contact form or email, the data you provide will be used to process your inquiry. The provision of data is necessary to process and answer your inquiry – without providing it, we cannot answer your inquiry or can only do so to a limited extent.

The legal basis for this processing is Art. 6 para. 1 lit. b) GDPR.

Your data will be deleted as soon as your inquiry has been conclusively answered and no statutory retention obligations prevent the deletion, such as in the case of a subsequent contract execution.

Customer account / Registration function

If you create a customer account with us via our website, we will collect and store the data you enter during registration (e.g., your name, address, or email address) exclusively for pre-contractual services, for the fulfillment of the contract, or for customer service purposes (e.g., to provide you with an overview of your previous orders with us or to offer you the so-called notepad function). At the same time, we will then store the IP address and the date and time of your registration. Of course, this data will not be passed on to third parties.

During the further registration process, your consent to this processing will be obtained, and reference will be made to this privacy policy. The data collected by us will be used exclusively for the provision of the customer account.

If you consent to this processing, Art. 6 para. 1 lit. a) GDPR is the legal basis for the processing.

If the opening of the customer account also serves pre-contractual measures or contract fulfillment, then Art. 6 para. 1 lit. b) GDPR is also the legal basis for this processing.

You can revoke your consent to the opening and maintenance of the customer account at any time with effect for the future in accordance with Art. 7 para. 3 GDPR. To do this, you only need to inform us of your revocation.

The data collected in this regard will be deleted as soon as processing is no longer necessary. However, we must observe tax and commercial law retention periods.

Server data

For technical reasons, in particular to ensure a secure and stable website, data is transmitted by your internet browser to us or to our web space provider. These so-called server log files include the type and version of your internet browser, the operating system, the website from which you switched to our website (referrer URL), the website(s) of our website that you visit, the date and time of each access, and the IP address of the internet connection from which the use of our website takes place.

This collected data is stored temporarily, but not together with other data from you.

This storage takes place on the legal basis of Art. 6 Para. 1 lit. f) GDPR. Our legitimate interest lies in the improvement, stability, functionality, and security of our website.

The data will be deleted after seven days at the latest, unless further retention is necessary for evidentiary purposes. Otherwise, the data will be completely or partially excluded from deletion until a final clarification of an incident.

Contract fulfillment

The data you transmit for the use of our goods and/or services will be processed by us for the purpose of contract fulfillment and is necessary for this. Conclusion and fulfillment of a contract are not possible without providing your data.

The legal basis for the processing is Art. 6 para. 1 lit. b) GDPR.

We delete the data upon complete contract fulfillment, but must observe the tax and commercial law retention periods.

In the context of contract fulfillment, we pass on your data to the transport company commissioned with the delivery of goods or to the financial service provider, insofar as the transfer is necessary for the delivery of goods or for payment purposes.

The legal basis for the transfer of data is then Art. 6 Para. 1 lit. b) GDPR.

Review - Advertising

Data collection when writing a comment or review
When commenting on/reviewing an article or a post, we only collect your personal data (name, email address, comment text) to the extent provided by you. The processing serves the purpose of enabling commenting/reviewing and displaying comments/reviews.

By submitting the comment/review, you consent to the processing of the transmitted data. The processing takes place on the basis of Art. 6 Para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by notifying us, without affecting the legality of the processing carried out on the basis of the consent until revocation. Your personal data will then be deleted.

When publishing your comment/review, your name and the email address you provided will be published.

YouTube

We maintain an online presence on YouTube to present our company and our services and to communicate with customers/interested parties. YouTube is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA.

In this regard, we point out that there is a possibility that user data may be processed outside the European Union, in particular in the USA. This may entail increased risks for users, for example, that later access to user data may be more difficult. We also have no access to this user data. The possibility of access lies exclusively with YouTube.

YouTube's privacy policy can be found at

https://policies.google.com/privacy

YouTube

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA

Privacy Policy: https://policies.google.com/privacy

Google Analytics

We use Google Analytics on our website. This is a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter referred to as "Google".

The Google Analytics service is used to analyze the usage behavior of our website. The legal basis is Art. 6 para. 1 lit. f) GDPR. Our legitimate interest lies in the analysis, optimization and economic operation of our website.

Usage and user-related information, such as IP address, location, time or frequency of visiting our website, are transmitted to a Google server in the USA and stored there. However, we use Google Analytics with the so-called anonymization function. Through this function, Google shortens the IP address already within the EU or the EEA.

The data collected in this way is in turn used by Google to provide us with an evaluation of the visit to our website and the usage activities there. This data can also be used to provide other services related to the use of our website and the use of the internet.

Google states that it does not link your IP address with other data. In addition, Google provides further data protection information under

https://www.google.com/intl/de/policies/privacy/partners

such as options to prevent data use.

Google also offers under

https://tools.google.com/dlpage/gaoptout?hl=de

a so-called deactivation add-on, along with further information on it. This add-on can be installed with common internet browsers and offers you further control over the data that Google collects when you access our website. The add-on informs Google Analytics' JavaScript (ga.js) that information about your visit to our website should not be transmitted to Google Analytics. However, this does not prevent information from being transmitted to us or to other web analytics services. You can, of course, also find out whether and which other web analytics services we use in this privacy policy.

Bootstrap

Type and scope of processing
We use Bootstrap CDN to deliver the content of our website correctly. Bootstrap CDN is a service provided by Bootstrap that acts as a Content
Delivery Network (CDN) on our website.
A CDN serves to deliver content of our online offering, especially files such as graphics or scripts, more quickly with the help of regionally or internationally distributed servers. When you access this content, you connect to Bootstrap's servers, whereby your IP address and possibly browser data such as your user agent
are transmitted. This data is used exclusively for the purposes mentioned above and to maintain the security and functionality of the Bootstrap CDN.
Purpose and legal basis
The use of the Content Delivery Network is based on our legitimate interests, i.e., interest in the secure and efficient provision and optimization of our online offering. Optimization of our online offering in accordance with Art. 6 para. 1 lit. f. GDPR.
Storage period
We have no influence on the specific storage period of the processed data; it is determined by Bootstrap. Further information can be found in the
privacy policy for Bootstrap CDN: https://www.bootstrapcdn.com/privacy-policy/.

CloudFlare

To secure our website and optimize loading times, we use the CloudFlare service as a so-called CDN (Content Delivery Network). This is a service provided by Cloudflare Inc., 101 Townsend Street, San Francisco, California 94107, USA, hereinafter referred to as "CloudFlare".

The legal basis is Art. 6 para. 1 lit. f) GDPR. Our legitimate interest lies in the secure operation of our website and its optimization.

If you access our website, your requests are routed through CloudFlare's server. Statistical access data about your visit to our website is collected, and CloudFlare stores a cookie via your internet browser on your end device. The access data includes:

– Your IP address,

– the website(s) of our internet presence that you visited,

– type and version of the internet browser you are using,

– the operating system you are using,

– the website from which you switched to our internet presence (referrer URL),

– your time spent on our internet presence and

– the frequency of accessing our web pages.

The data is used by CloudFlare for the purpose of statistical analysis of access and for the security and optimization of the offering.

If you do not agree with this processing, you have the option to prevent the installation of cookies by making the appropriate settings in your internet browser. Further details can be found above under "Cookies".

CloudFlare provides further information on the collection and use of data as well as your rights and options for protecting your privacy at

https://www.cloudflare.com/privacypolicy/

Amazon Cloudfront

We use the Amazon CloudFront Content Delivery Network (CDN) from Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg (AWS), to increase the security and delivery speed of our website. This corresponds to our legitimate interest (Art. 6 Para. 1 lit. f GDPR). A CDN is a network of [globally] distributed servers that can deliver optimized content to website users. For this purpose, personal data may be processed in AWS server log files. Please compare the explanations under "Hosting". [In addition, we keep [anonymized] log files to ensure [optimize] the stability and security of our website.]

AWS is the recipient of your personal data and acts as a processor for us. This corresponds to our legitimate interest within the meaning of Art. 6 Para. 1 S. 1 lit. f GDPR not to operate a Content Delivery Network ourselves.

You have the right to object to the processing. Whether the objection is successful must be determined by balancing interests.

The processing of the data specified in this section is neither legally nor contractually required. The functionality of the website is not guaranteed without processing.

Your personal data will be stored by AWS for as long as necessary for the described purposes. [We delete the stored log files after [ ]].

Further information on objection and removal options vis-à-vis AWS can be found at: https://d1.awsstatic.com/legal/privacypolicy/AWS_Privacy_Notice__German_Translation.pdf

AWS has implemented compliance measures for international data transfers. These apply to all worldwide activities in which AWS processes personal data of natural persons in the EU. These measures are based on the EU standard contractual clauses (SCCs). Further information can be found at: https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf

ipify (api.ipify.org)

We use ipify, a service provided by Randalf S., 201 E 5th Street, Suite 1900, Sheridan, WY 82801, USA, to query your public IP address in order to diagnose network connections and perform statistical analyses. The IP address may be transmitted to countries outside the EU, including the USA. ipify ensures an adequate level of data protection through EU standard contractual clauses. Further information on data processing by ipify can be found in ipify's privacy policy. The legal basis for using ipify is our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR.

FontAwesome

To display fonts and visual elements of our website, we use external fonts from FontAwesome. FontAwesome is a service provided by

Fonticons Inc., 6 Porter Road, Apartment 3R, Cambridge, MA 02140, USA, hereinafter referred to as "FontAwesome".

When accessing our website, a connection is established to FontAwesome's server in the USA to enable and update the display of fonts and visual elements.

The legal basis is Art. 6 para. 1 lit. f) GDPR. Our legitimate interest lies in the optimization and economic operation of our website.

Through the connection established to FontAwesome's server when you access our website, FontAwesome can determine from which website your request was sent and to which IP address the font display should be transmitted.

FontAwesome offers further information, particularly on ways to prevent data usage, at

https://fontawesome.com/privacy

Trusted Shops Trustbadge

To display external customer reviews and/or an externally awarded quality seal, we have integrated graphic elements from the following provider on our website: Trusted Shops AG, Subbelrather Str. 15C, 50823 Cologne, Germany

If you call up a page of our website that contains such graphic elements, your browser establishes a direct connection to the provider's servers to load the elements correctly. Certain browser information, including your IP address, is transmitted to the provider.

If personal data is also processed in the process, this is done in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in the optimal marketing of our offer and the appealing design of our website.

In the event of an online order with us, further processing may take place.

Depending on your express consent in accordance with Art. 6 para. 1 lit. a GDPR, your order information (order sum, order number, possibly purchased product) and your e-mail address will be transmitted encrypted to the provider via the Trustbadge after completion of an order to check an existing registration for the provider's services (especially the "Buyer Protection") and, if necessary, to enable a new registration.

In the event of an existing registration or a new registration with the provider for its services (in particular buyer protection), your order information (order sum, order number, purchased product) and your e-mail address will be transmitted to the provider on the basis of the contractual agreement with the provider in accordance with Art. 6 Para. 1 lit. b GDPR and further processed by the provider to provide the services (in particular buyer protection).

We are jointly responsible with the provider for the processing described above in accordance with Art. 26 GDPR. The contract for joint responsibility can be viewed here: https://help.etrusted.com/hc/de/articles/4402587369105-Vertrag-%C3%BCber-die-gemeinsame-Verantwortlichkeit-nach-DSGVO

Google Fonts

On our website, we use Google Fonts to display external fonts. This is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter referred to as "Google".

To enable the display of certain fonts on our website, a connection to the Google server in the USA is established when you access our website.

The legal basis is Art. 6 para. 1 lit. f) GDPR. Our legitimate interest lies in the optimization and economic operation of our website.

Through the connection established to Google when you access our website, Google can determine from which website your request was sent and to which IP address the font display should be transmitted.

Google offers further information, particularly on how to prevent data usage, at

https://adssettings.google.com/authenticated

https://policies.google.com/privacy

Google reCAPTCHA

On our website, we use Google reCAPTCHA to verify and prevent automated interactions, such as those by bots, on our website. This is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter referred to as "Google".

Through this service, Google can determine from which website a request is sent and from which IP address you are using the so-called reCAPTCHA input box. In addition to your IP address, Google may collect further information that is necessary for the provision and guarantee of this service.

The legal basis is Art. 6 para. 1 lit. f) GDPR. Our legitimate interest lies in the security of our website and in fending off unwanted, automated access in the form of spam or similar.

Google provides further information on the general handling of your user data at

https://policies.google.com/privacy

YouTube

We use YouTube on our website. This is a video portal of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter referred to as "YouTube".

We use YouTube in conjunction with the "Enhanced privacy mode" function to show you videos. If you have given your consent for this processing, the legal basis is Art. 6 para. 1 lit. a GDPR. The legal basis can also be Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in improving the quality of our website. According to YouTube, the "Enhanced privacy mode" function means that the data described in more detail below is only transmitted to the YouTube server if you actually start a video.

Without this "Enhanced privacy mode", a connection to YouTube's server in the USA is established as soon as you access one of our internet pages on which a YouTube video is embedded.

This connection is necessary to be able to display the respective video on our website via your internet browser. In the course of this, YouTube will at least collect and process your IP address, the date and time, and the internet page you visited. In addition, a connection to Google's "DoubleClick" advertising network is established.

If you are logged in to YouTube at the same time, YouTube assigns the connection information to your YouTube account. If you want to prevent this, you must either log out of YouTube before visiting our website or make the appropriate settings in your YouTube user account.

For the purpose of functionality and to analyze user behavior, YouTube permanently stores cookies on your device via your internet browser. If you do not agree with this processing, you have the option to prevent the storage of cookies by adjusting a setting in your internet browser. Further information on this can be found above under "Cookies".

Google provides further information on the collection and use of data as well as your rights and protection options in the data protection notices available at

https://policies.google.com/privacy

Shopify (Shop Software + Web Analytics)

a) Shopify Shop Software

We use "Shopify" for hosting our shop system and for presenting our offers and processing contracts.

The legal basis is Art. 6 para. 1 lit. b) GDPR (contract initiation/contract processing).

"Shopify" is the service of a group of companies consisting of Shopify Data Processing (USA) Inc., Shopify Payments (USA) Inc., Shopify (USA) Inc., Shopify Commerce Singapore Pte. Ltd., and Shopify International Limited.

As far as we are located in the European Economic Area (EEA), the processing is carried out by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, hereinafter referred to as "Shopify".

However, due to the corporate group, it cannot be ruled out that processing also takes place in Canada and the USA, i.e., outside the EEA. When data is transferred to the Canadian Shopify Inc., an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

Shopify processes the following data on our behalf:

Name, billing and, if applicable, delivery address, email address, payment data, if applicable company name, if applicable telephone number, IP address, information about orders, information about the merchant shops supported by Shopify that you visit, and information about your end device and your internet browser.

In addition, Shopify provides further data protection information at

https://www.shopify.de/legal/datenschutz

b) Shopify Web Analytics

Insofar as we also use Shopify's web analytics service on our website, Shopify stores cookies on your end device via your internet browser. Through these cookies, further information, such as your location, time, or frequency of your visit to our website, is transmitted to a Shopify server and evaluated.

If you have given your consent for this processing, the legal basis is Art. 6 para. 1 lit. a GDPR. The legal basis can also be Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the analysis and optimization of our website.

If you do not agree with this processing, you have the option to prevent the storage of the cookie by adjusting a setting in your internet browser. Further information on this can be found above under "Cookies".

Recipients outside the EU

With the exception of the processing described under III., we do not transfer your data to recipients located outside the European Union or the European Economic Area. The processing mentioned under III. results in data transfer to the servers of the tracking or targeting technology providers commissioned by us. These servers are located in the USA. Data transfer takes place on the basis of so-called standard contractual clauses of the EU Commission. You can obtain a copy of these standard contractual clauses from us. To do this, please send a letter and a stamped, self-addressed envelope to the address given in section 2.

Plug-ins and other services

Use of social plug-ins via the "2-click solution"
We use social network plug-ins on our website via the "2-click solution". This means that no connections to the social networks' servers are established and, consequently, no data is transmitted without your explicit consent.
With the standard integration of plug-ins, when you access pages on our website that contain such a plug-in, a link is established between your computer and the servers of the social network providers, and the plug-in is displayed on the page by communicating with your browser. Both your IP address and the information about which of our pages you have visited are transmitted to the provider's servers. This applies regardless of whether you are registered or logged in to the social network. Transmission also occurs for users who are not registered or not logged in. If you are also logged in to the social network Facebook, this information will be assigned to your personal user account. When using the plug-in functions (e.g. by pressing the button), this information will also be assigned to your user account, which you can only prevent by logging out before using the plug-in. To ensure you retain control over your data, we have decided to initially deactivate the corresponding button. You can recognize this by the greyed-out button. Without your explicit consent - in the form of activating the button - no connection to the social network's server will be established and, consequently, no data will be transmitted.
Only when you activate the button will it become active (highlighted in color) and a direct connection to the social network's server will be established.
By activating it, you give your consent to the transfer of your data to the respective social network provider. This includes the transmission of both your IP address and information about which of our pages you have visited. If you are simultaneously connected to one or more of your social network accounts, the collected information will also be assigned to your corresponding profiles. You can only prevent this assignment by logging out of your social network accounts before visiting our website and before activating the buttons.
The social networks listed below are integrated using the "2-click function". Further information on the scope and purpose of data collection and use, as well as your rights and options for protecting your privacy in this regard, can be found in the linked privacy notices of the providers.

Facebook by Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland):
https://www.facebook.com/policy.php
Your data may be transferred to the USA. An adequacy decision by the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF), exists for the USA. Meta has certified itself under the TADPF and is thus committed to complying with European data protection principles.X, formerly known as Twitter, (X Corp., 1355 Market Street, Suite 900 San Francisco, CA 94103, USA)

Payment Service Providers

Use of PayPal Express
We use the payment service PayPal Express provided by PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal") on our website. Data processing serves the purpose of enabling you to make payments via the PayPal Express payment service. To integrate this payment service, it is necessary for PayPal to collect, store, and analyze data (e.g., IP address, device type, operating system, browser type, location of your device) when you access the website. Cookies may also be used for this purpose. Cookies enable the recognition of your browser.
The processing of your personal data is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in offering customer-oriented payment methods. You have the right to object to this processing of your personal data at any time for reasons arising from your particular situation.
By selecting and using PayPal Express, the data required for payment processing will be transmitted to PayPal in order to fulfill the contract with you using the selected payment method. This processing is based on Art. 6 para. 1 lit. b GDPR. Further information on data processing when using the PayPal Express payment service can be found in the associated privacy policy at www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE#Updated_PS.

Use of PayPal Checkout
We use the payment service PayPal Checkout provided by PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal") on our website. Data processing serves the purpose of enabling you to make payments via the payment service. By selecting and using payment via PayPal, credit card via PayPal, direct debit via PayPal, or "Pay Later" via PayPal, the data required for payment processing will be transmitted to PayPal in order to fulfill the contract with you using the selected payment method. This processing is based on Art. 6 para. 1 lit. b GDPR.

Cookies may be stored here, which enable the recognition of your browser. The data processing that takes place as a result is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in offering customer-oriented payment methods. You have the right to object to this processing of your personal data at any time for reasons arising from your particular situation.

Credit card via PayPal, direct debit via PayPal & "Pay Later" via PayPal
For individual payment methods such as credit card via PayPal, direct debit via PayPal, or "Pay Later" via PayPal, PayPal reserves the right to obtain a credit report based on mathematically-statistical procedures using credit agencies. For this purpose, PayPal transmits the personal data required for a credit check to a credit agency and uses the information received about the statistical probability of a payment default for a balanced decision on the establishment, execution, or termination of the contractual relationship. The credit report may include probability values (score values) that are calculated on the basis of scientifically recognized mathematically-statistical procedures and whose calculation includes, among other things, address data. Your legitimate interests are taken into account in accordance with legal provisions. Data processing serves the purpose of credit checking for initiating a contract. Processing is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in protection against payment default when PayPal makes advance payment.
You have the right to object to this processing of your personal data, which is based on Art. 6 para. 1 lit. f GDPR, at any time for reasons arising from your particular situation by notifying PayPal. The provision of data is necessary for the conclusion of the contract with the payment method you desire. Non-provision will result in the contract not being concluded with the payment method you have chosen.

Third-party providers
When paying via a third-party payment method, the data required for payment processing will be transmitted to PayPal. This processing is based on Art. 6 para. 1 lit. b GDPR. To carry out this payment method, the data may then be forwarded by PayPal to the respective provider. This processing is based on Art. 6 para. 1 lit. b GDPR. Local third-party providers may include, for example:

• Sofort (SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany)
• giropay (Paydirekt GmbH, Stephanstr. 14-16, 60313 Frankfurt am Main)

Invoice purchase via PayPal
When paying via invoice purchase, the data required for payment processing is first transmitted to PayPal. To carry out this payment method, the data is then transmitted by PayPal to Ratepay GmbH (Franklinstraße 28-29, 10587 Berlin; "Ratepay") in order to fulfill the contract with you using the selected payment method. This processing is based on Art. 6 para. 1 lit. b GDPR. Ratepay may carry out a credit assessment based on mathematically-statistical procedures (probability or score values) using credit agencies as described above. Data processing serves the purpose of credit assessment for initiating a contract. Processing is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in protection against payment default when Ratepay makes advance payment. Further information on data protection and which credit agencies Ratepay uses can be found at https://www.ratepay.com/legal-payment-dataprivacy/ and https://www.ratepay.com/legal-payment-creditagencies/.

Further information on data processing when using PayPal can be found in the associated privacy policy at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Shipping service providers - Enterprise Resource Planning

Disclosure of email address to shipping companies for information on shipping status
We pass on your email address to the transport company as part of the contract processing, provided you have expressly consented to this in the order process. The disclosure serves the purpose of informing you about the shipping status by email. Processing is based on Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by notifying us or the transport company, without affecting the legality of the processing carried out based on the consent until revocation.

Use of an external enterprise resource planning system
We use an enterprise resource planning system for contract processing within the scope of order processing. For this purpose, your personal data collected during the order is transmitted to
Pickware GmbH, Goebelstr. 21, 64293 Darmstadt
The processing of your personal data serves the purpose of fulfilling the contract concluded with you and is based on Art. 6 para. 1 lit. b GDPR.