Privacy policy

1) Information on the collection of personal data and contact details of the controller

1.1 We are pleased that you are visiting our website and thank you for your interest. In the following, we will inform you about how we handle your personal data when you use our website. Personal data is all data that can be used to personally identify you.

1.2 The controller in charge for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Brandize GmbH, Finkenberg 14, 6067 Absam, Österreich, Tel.:. , E-Mail: support@healthroutine.de. The controller in charge of the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

1.3 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or requests to the controller). You can recognise an encrypted connection by the character string ‘https://’ and the lock symbol in your browser line.

2) Data collection when you visit our website

If you use our website for informational purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the data that your browser transmits to our server (so-called ‘server log files’). When you visit our website, we collect the following data, which is technically necessary for us to display the website to you:

Our visited website
Date and time at the time of access
Amount of data sent in bytes
Source/reference from which you came to the page
Browser used
Operating system used
IP address used (if applicable: in anonymised form)

The processing is carried out in accordance with Art. 6 (1) point f GDPR, on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to check the server log files retrospectively if there are concrete indications of illegal use.

3) Hosting & content delivery network

Hosting by Shopify

We use the shop system of the service provider Shopify International Limited, Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (‘Shopify’), for the purpose of hosting and displaying the online shop on the basis of processing on our behalf. All data collected on our website is processed on Shopify's servers. As part of the aforementioned services provided by Shopify, data may also be transferred to Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada, Shopify Data Processing (USA) Inc., Shopify Payments (USA) Inc. or Shopify (USA) Inc. for further processing. In the event of data being transmitted to Shopify Inc. in Canada, the European Commission's adequacy decision ensures an adequate level of data protection. Further information on Shopify's data protection can be found at the following website:

Any further processing on servers other than those mentioned above will only take place within the scope specified below.

4) Cookies

We use cookies, which are small text files placed on your device, to make our website attractive to visit and to enable the use of certain functions. Some of these cookies are automatically deleted after you close your browser (so-called ‘session cookies’), while some of these cookies remain on your device for a longer period of time and enable the storage of page settings (so-called ‘persistent cookies’). In the latter case, you can see the storage period in the overview of the cookie settings of your web browser.

If personal data is also processed by individual cookies we use, the processing is carried out in accordance with Art. 6 (1) point b GDPR, either for the execution of the contract or in accordance with Art. 6 (1) point f GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the page visit.

You can adjust the settings on your browser so that you are informed when cookies are set and can decide whether to accept them on a case-by-case basis, or to exclude the acceptance of cookies in certain cases or in general.

Please note that if you do not accept cookies, the functionality of our website may be limited.

5) Contact

When you contact us (e.g. using the contact form or by email), personal data is processed solely for the purpose of handling and responding to your request and only to the extent necessary for this purpose. The legal basis for processing this data is our legitimate interest in responding to your request in accordance with Article 6(1)(f) of the GDPR. If you contact us with a view to entering into a contract, the additional legal basis for the processing is Art. 6 (1) lit. b GDPR. Your data will be deleted if it can be inferred from the circumstances that the matter in question has been conclusively clarified, provided that there are no legal storage obligations to the contrary.

6) Data processing when opening a customer account

In accordance with Art. 6 (1) point b GDPR, personal data will continue to be collected and processed to the extent necessary if you provide it to us when opening a customer account. The input mask used for this purpose on our website indicates which data must be provided. You can delete your customer account at any time by sending a message to the address of the controller mentioned above. After deletion of your customer account, your data will be deleted, provided that all contracts concluded through it have been fully processed, there are no legal retention periods to the contrary and we have no justified interest in further storage.

7) Use of customer data for direct advertising

7.1 Registration for our email newsletter

If you register for our email newsletter, we will regularly send you information about our offers. The only mandatory information for sending the newsletter is your email address. The provision of further data is voluntary and is used to address you personally. We use the so-called double opt-in procedure for sending the newsletter, which ensures that you only receive the newsletter after you have expressly confirmed your consent to receiving the newsletter by clicking on a verification link sent to the specified email address

By activating the confirmation link, you give us your consent to use your personal data in accordance with Art. 6 (1) point a GDPR. In doing so, we store your IP address entered by the Internet Service Provider (ISP) as well as the date and time of registration in order to be able to trace any possible misuse of your e-mail address at a later point in time. The data collected by us when registering for the newsletter is used strictly for the intended purpose. You can unsubscribe from the newsletter at any time using the link provided in the newsletter or by sending a message to the controller named at the beginning. After you have unsubscribed, your email address will be immediately deleted from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to use the data in a manner that goes beyond the scope permitted by law and about which we inform you in this statement.

7.2 – Newsletter distribution via Klaviyo

Our e-mail newsletter is distributed via the technical service provider ‘Klaviyo’, 225 Franklin St, Boston, MA 02110, USA (), to whom we pass on the data you provided when registering for the newsletter. This transfer takes place in accordance with Art. 6 para. 1 lit. f GDPR and serves our legitimate interest in using an effective, secure and user-friendly newsletter system. Please note that your data is usually transferred to a Klaviyo server in the USA and stored there.

Klaviyo uses this information to send the newsletter on our behalf. Klaviyo does not use the data of our newsletter recipients to write to them itself or to pass them on to third parties.

To protect your data in the USA, we have a data processing agreement with Klaviyo, in which Klaviyo undertakes to protect our users‘ data, to process it on our behalf in accordance with its data protection regulations and, in particular, not to pass it on to third parties.

You can view Klaviyo's privacy policy here:

7.3 - Registering for our WhatsApp newsletter

When you register for our WhatsApp newsletter, we will regularly send you information about our offers. The information required for sending the newsletter is your email address and your mobile phone number. The provision of further data is voluntary and is used to address you personally. We use the so-called double opt-in procedure for sending the newsletter, which ensures that you only receive the newsletter if you have expressly given us your consent to receive the newsletter by confirming it with a WhatsApp message. By activating the newsletter with a WhatsApp message, you give us your consent to use your personal data in accordance with Art. 6 (1) point a GDPR. The data collected by us when you register for the newsletter will be used strictly for the intended purpose. You can unsubscribe from the newsletter at any time by typing ‘stop’ in the WhatsApp chat or by sending a message to the controller named at the beginning of this document. After you have successfully unsubscribed, your mobile phone number will be immediately deleted from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to use the data in a manner that goes beyond the scope permitted by law and about which we inform you in this statement.

7.4 - Newsletter delivery via Chatarmin

Our WhatsApp newsletters are sent via the technical service provider ‘Chatarmin’, to whom we pass on the data you provided when registering for the newsletter. Stored, processed and used in the context of using the respective WhatsApp, SMS or Messenger service to deliver messages to you. To use the Messenger service, an active account with the respective provider is required. This service is provided by the WhatsApp marketing tool chatarmin.com GmbH, A-3400 Klosterneuburg, as a technical service provider and processor. Your consent to the processing of personal data is always freely revocable; a corresponding notification to our support or Chatarmin is sufficient for this. Further information can be found in our respective data protection guidelines and/or the messenger services of chatarmin.com GmbH.

8) Data processing for order processing

8.1 Insofar as necessary for the execution of the contract for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6 (1) point b GDPR.

If we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we process the contact data you provided when placing the order (name, address, email address) in order to personally inform you of upcoming updates within the legally prescribed period and in accordance with our legal information obligations pursuant to Art. 6 (1) point c GDPR, using a suitable means of communication (e.g. by post or email). Your contact details will be used strictly for the purpose of providing information about updates that we are obliged to provide and will only be processed by us to the extent necessary for the respective information.

In order to process your order, we also work together with the following service provider(s), who support us in whole or in part in the execution of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

8.2 Use of payment service providers (payment services)

– Amazon Pay

If you select ‘Amazon Pay’ as your payment method, payment will be processed by the payment service provider Amazon Payments Europe s.c.a., 38 avenue J.F. Kennedy, L-1855 Luxembourg (hereinafter: ‘Amazon Payments’), to whom we will pass on the information you provided during the ordering process, together with information about your order, in accordance with Art. 6 (1) point b GDPR. Your data is forwarded exclusively for the purpose of payment processing with the payment service provider Amazon Payments and only to the extent necessary. If cookies (small text files) are set on the end device when using Amazon Pay, this is done exclusively on the basis of your express consent in accordance with Art. 6 (1) point a GDPR. This consent can be withdrawn at any time via the ‘Cookie Consent Tool’ implemented on the website. You can find more information about Amazon Payments' privacy policy at the following Internet address:

- Klarna

If you choose a Klarna payment service, payment will be processed by Klarna Bank AB (publ), , Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter “Klarna”). To enable the payment to be processed, your personal data (first name and surname, street, house number, postcode, town/city, gender, email address, telephone number and IP address, and, if applicable, your date of birth and bank details) and data relating to the order (e.g. invoice amount, items, delivery type) for the purpose of identity and credit checks to Klarna, provided that you have expressly consented to this in accordance with Art. 6 (1) point a GDPR in the context of the ordering process. You can see which credit reference agencies your data may be forwarded to here:

https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. The calculation of the score values includes, among other things, but not exclusively, address data. Klarna uses the information obtained on the statistical probability of a payment default for a balanced decision on the establishment, execution or termination of the contractual relationship.

You can revoke your consent at any time by sending a message to the person responsible for data processing or to Klarna. However, Klarna may still be entitled to process your personal data if this is necessary for the contractual processing of payments.

Your personal data will be treated in accordance with the applicable data protection regulations and in accordance with the information in Klarna's data protection regulations for data subjects based in Germany

or for data subjects based in Austria

- Mollie

If you choose a payment method from the payment service provider Mollie, the payment will be processed by the payment service provider Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, the Netherlands, to whom we will send your information provided during the ordering process together with the information about your order (name, address, IBAN, BIC, invoice amount, currency and transaction number) in accordance with Art. 6 (1) point b GDPR. Your data will only be passed on for the purpose of payment processing with the payment service provider Mollie and only to the extent necessary.

- Paypal

When paying via PayPal, credit card via PayPal, direct debit via PayPal or – if offered – ‘purchase on account’ or ‘payment by instalments’ via PayPal, we will pass on your payment data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter ‘PayPal’) as part of the payment processing. The transfer is carried out in accordance with Art. 6 (1) point b GDPR, and only insofar as it is necessary for payment processing.

PayPal reserves the right to carry out a credit check for the payment methods credit card via PayPal, direct debit via PayPal or – if offered – ‘purchase on account’ or ‘payment by instalments’ via PayPal. For this purpose, your payment data may be passed on to credit reference agencies in accordance with Art. 6 (1) point f GDPR, on the basis of PayPal's legitimate interest in determining your solvency. PayPal uses the result of the credit check in relation to the statistical probability of non-payment for the purpose of deciding whether to provide the respective payment method. The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. Among other things, but not exclusively, address data is included in the calculation of the score values. For more information on data protection, including information on the credit reference agencies used, please refer to PayPal's privacy policy:

You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for the contractual processing of payments.

Shopify Payments

We use the payment service provider ‘Shopify Payments’, 3rd Floor, Europa House, Harcourt Building, Harcourt Street, Dublin 2. If you choose a payment method offered by the payment service provider Shopify Payments, the payment will be processed by the technical service provider Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to whom we pass on your information provided during the ordering process together with the information about your order (name, address, account number, bank code, possibly credit card number, invoice amount, currency and transaction number) in accordance with Art. 6 (1) point b GDPR. Your data will only be passed on for the purpose of payment processing with Stripe Payments Europe Ltd. and only to the extent necessary. You can find more information about Shopify Payments' data protection at the following Internet address: .

You can find data protection information about Stripe Payments Europe Ltd. here:

- IMMEDIATELY

If you select the ‘SOFORT’ payment method, the payment will be processed by the payment service provider SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany (hereinafter ‘SOFORT’), to whom we will pass on the information you provided during the ordering process together with the information about your order in accordance with Art. 6 (1) point b GDPR. Sofort GmbH is part of the Klarna Group (Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden). Your data will be passed on solely for the purpose of processing the payment with the payment service provider SOFORT and only to the extent necessary for this purpose. You can find more information about SOFORT's data protection policy at the following Internet address: .

9) Online marketing

9.1 Facebook Pixel for creating custom audiences (with cookie consent tool)

Our online offering uses the so-called ‘Facebook pixel’ from the social network Facebook, which is operated by Meta Platforms Ireland Limited, 4 Grand Canal Quare, Dublin 2, Ireland (‘Facebook’).

If a user clicks on one of our adverts that is displayed on Facebook, an addition is added to the URL of our linked page by Facebook Pixel. If our page allows data to be shared with Facebook via pixels, this URL parameter is written to the user's browser via a cookie that our linked page itself sets. This cookie is then read by Facebook Pixel and enables the data to be forwarded to Facebook.

With the help of the Facebook pixel, Facebook is able, on the one hand, to identify visitors to our online services as a target group for the display of ads (so-called ‘Facebook ads’). Accordingly, we use the Facebook pixel to display the Facebook ads we have placed only to Facebook users who have also shown an interest in our online offering or who exhibit certain characteristics (e.g. interests in certain topics or products, which are determined on the basis of the websites visited) that we transmit to Facebook (so-called ‘custom audiences’). With the help of Facebook pixels, we also want to ensure that our Facebook ads match the potential interest of users and are not perceived as annoying. This allows us to further evaluate the effectiveness of Facebook ads for statistical and market research purposes by tracking whether users have been redirected to our website after clicking on a Facebook ad (so-called ‘conversion’).

The data collected is anonymous to us, so we cannot draw any conclusions about the identity of the user. However, the data is stored and processed by Facebook so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes, in accordance with the Facebook Data Usage Policy (). The data may enable Facebook and its partners to place ads on and off Facebook.

The data processing associated with the use of Facebook Pixels will only take place if you have given your express consent in accordance with Art. 6 (1) point a GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service in the ‘Cookie Consent Tool’ provided on the website.

9.2 - Google Ads conversion tracking

This website uses the online advertising programme ‘Google Ads’ and, as part of Google Ads, the conversion tracking of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (‘Google’). We use the Google Ads service to draw attention to our attractive offers with the help of advertising material (so-called Google Adwords) on external websites. We can determine how successful the individual advertising measures are in relation to the data of the advertising campaigns. In doing so, we pursue the aim of showing you advertising that is of interest to you, making our website more interesting for you and achieving a fair calculation of the advertising costs incurred.

The conversion tracking cookie is set when a user clicks on an ad placed by Google. Cookies are small text files that are stored on your end device. These cookies usually lose their validity after 30 days and are not used for personal identification. If the user visits certain pages of this website and the cookie has not yet expired, we and Google can recognise that the user clicked on the ad and was redirected to this page. Every Google Ads customer receives a different cookie. This means that cookies cannot be tracked across the websites of Google Ads customers. The information collected using the conversion cookie is used to generate conversion statistics for Google Ads customers who have opted for conversion tracking. Customers are told the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users.

When using Google Ads, personal data may also be transmitted to the servers of Google LLC. in the USA.

Details on the processing triggered by Google Ads Conversion Tracking and how Google handles data from websites can be found here:

You can permanently opt out of cookies being set by Google Ads conversion tracking by downloading and installing the Google browser plug-in available at the following link:

https://www.google.com/settings/ads/plugin?hl=de

In order to address users whose data we have received in the context of business or business-like relationships in a more interest-based manner, we use a customer matching function within the framework of Google Ads. To do this, we electronically transmit one or more files with aggregated customer data (mainly email addresses and telephone numbers) to Google. Google does not have access to plain text data, but automatically encrypts the information in the customer files using a special algorithm as part of the transmission process. The encrypted information can then only be used by Google to assign it to existing Google accounts that the data subjects have set up. This enables personalised advertising to be displayed across all Google services linked to the respective Google account.

Customer data will only be transmitted to Google if you have given us your express consent to do so in accordance with Art. 6 (1) point a GDPR. You can revoke this consent at any time with effect for the future. Further information on Google's data protection measures regarding the customer matching function can be found here:

Google's data protection policy can be viewed here:

10) Web analysis services

Google Analytics 4

This website uses Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (‘Google’), which can be used to analyse the use of websites.

When using Google Analytics 4, so-called ‘cookies’ are used by default. Cookies are text files that are stored on your end device and enable an analysis of your use of a website. The information collected by cookies about your use of the website (including the IP address transmitted by your end device, shortened by the last few digits, see below) is usually transmitted to a Google server and stored and processed there. This may also result in the transmission of information to the servers of Google LLC, based in the USA, and further processing of the information there.

When using Google Analytics 4, the IP address transmitted by your end device when you use the website is always collected and processed by default and automatically in anonymised form only, so that the information collected cannot be directly linked to a particular person. This automatic anonymisation is achieved by Google shortening the last digits of the IP address transmitted by your end device within the member states of the European Union (EU) or other signatory states to the Agreement on the European Economic Area (EEA).

On our behalf, Google uses this and other information to evaluate your use of the website, to compile reports on your website activities and your usage behaviour and to provide us with further services associated with your use of the website and the internet. The abbreviated IP address transmitted by your end device as part of Google Analytics 4 is not merged with other data from Google. The data collected in the course of using Google Analytics 4 is stored for 2 months and then deleted.

Google Analytics 4 also enables the creation of statistics with information about the age, gender and interests of website users based on an evaluation of interest-based advertising and the use of third-party provider information via a special function known as ‘demographic characteristics’. This makes it possible to identify and distinguish between user groups on the website for the purpose of optimising marketing measures for specific target groups. However, data collected via ‘demographic characteristics’ cannot be assigned to a specific person and therefore not to you personally. This data collected via the ‘demographic characteristics’ function is stored for two months and then deleted.

All the processing described above, in particular the setting of Google Analytics cookies for the storage and reading of information on the device you are using to access the website, will only take place if you have given us your express consent to do so in accordance with Art. 6 (1) point a GDPR. Without your consent, Google Analytics will not be used during your use of the website. You can revoke your consent at any time with effect for the future. To exercise your revocation, please deactivate this service using the ‘Cookie Consent Tool’ provided on the website.

In connection with this website, the ‘UserIDs’ function is also used as an extension of Google Analytics 4. By assigning individual UserIDs, we can have Google create cross-device reports (so-called ‘cross-device tracking’). This means that, with your corresponding consent to the use of Google Analytics 4, your usage behaviour can also be analysed across devices in accordance with Art. 6 (1) point a GDPR if you have set up a personal account by registering on this website and are logged into various end devices with your relevant login data in your personal account. The data collected in this way shows, among other things, on which device you first clicked on an ad and on which device the relevant conversion took place.

In connection with this website, the Google Signals service is also used as an extension of Google Analytics 4. With Google Signals, we can have Google create cross-device reports (so-called ‘cross-device tracking’). If you have activated ‘personalised ads’ in your Google Account settings and linked your internet-enabled devices to your Google Account, Google may, with your consent to the use of Google Analytics 4, analyse your usage behaviour across devices in accordance with Art. 6 (1) point a GDPR and create database models based on this. The registrations and device types of all website users who were registered in a Google account and have carried out a conversion are taken into account. Among other things, the data shows on which device you first clicked on an ad and on which device the related conversion took place. We do not receive any personal data from Google, only statistics based on Google Signals. You have the option to disable the ‘personalised ads’ feature in your Google account settings and thus disable cross-device analysis in connection with Google Signals. To do this, follow the instructions on this page:

Further information about Google Signals can be found at the following link:

We have concluded a so-called data processing agreement with Google for our use of Google Analytics 4, which obliges Google to protect the data of our website users and not to pass it on to third parties.

To ensure compliance with the European level of data protection, even in the event of any transfer of data from the EU or the EEA to the USA and the possible further processing of such data there, Google relies on the so-called standard contractual clauses of the European Commission, which we have contractually agreed with Google.

Further legal information on Google Analytics 4, including a copy of the standard contractual clauses mentioned, can be found at and at .

11) Retargeting/Remarketing/Recommendation advertising

Google Ads Remarketing

Our website uses the functions of Google Ads Remarketing, which we use to advertise this website in Google search results and on third-party websites. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (‘Google’). For this purpose, Google sets a cookie in the browser of your device, which automatically enables interest-based advertising by means of a pseudonymous cookie ID and based on the pages you visit. Any further data processing will only take place if you have consented to Google linking your internet and app browsing history to your Google account and using information from your Google account to personalise ads that you view on the web. If you are logged into Google while visiting our website, Google will use your data together with Google Analytics data to create and define target group lists for cross-device remarketing. To do this, Google temporarily links your personal data with Google Analytics data to create target groups. When using Google Ads Remarketing, personal data may also be transmitted to the servers of Google LLC. in the USA.

Details on the processing triggered by Google Ads Remarketing and how Google handles data from websites can be found here:

You can permanently opt out of cookies being set by Google Ads Remarketing by downloading and installing the Google browser plug-in available at the following link:

Further information and the data protection provisions regarding advertising and Google can be viewed here:

https://www.google.com/policies/technologies/ads/

TikTok Pixel

This website uses the ‘TikTok Pixel’, a tracking technology of the social network ‘TikTok’ of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (‘TikTok’).

With the help of cookies (small text files that are stored on the end device used), information about the surfing behaviour on our website is collected in pseudonymised form, transmitted to TikTok, stored and evaluated there, in order to then enable the display of interest-based and personalised product recommendations on TikTok. The information collected and processed in pseudonymised form includes, in principle, the device ID, device type, timestamp, operating system used and IP address. The information can be assigned to the user with the help of further information that TikTok has stored about the user, e.g. based on ownership of an account on the social network ‘TikTok’. TikTok may also combine the information collected through the pixel with other information that TikTok has collected through other websites and/or in connection with the use of the social network ‘TikTok’ to create pseudonymised user profiles. Under no circumstances can the information collected be used to personally identify visitors to this website.

The TikTok pixel also allows us to track the effectiveness of ads on TikTok. If the user is redirected from an ad on TikTok to pages on this website and the cookies have not yet expired, the pixel records certain user actions that we have predefined and can track (e.g. completed transactions, leads, search queries on the website, views of product pages). When such an action is performed, your browser sends an HTTP request from the cookie to the TikTok server via the TikTok pixel, with which certain information about the action is transmitted. This transmission enables TikTok to create statistics about user behaviour on our website after being redirected from a TikTok ad, which we use to optimise our offering.

All the processing described above, in particular the setting of cookies for reading information on the end device used, will only be carried out if you have given us your express consent to do so in accordance with Art. 6 (1) point a GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service in the ‘Cookie Consent Tool’ provided on the website. We have concluded an order processing contract with TikTok for the use of the TikTok pixel, which obliges TikTok to protect the data of our site visitors and not to pass it on to third parties. TikTok generally transfers collected information outside the European Economic Area and relies on so-called standard data protection clauses of the European Commission, which are intended to ensure compliance with the European level of data protection.

12) Site functionalities

12.1 Use of YouTube videos

This website uses the YouTube embedding function to display and play videos from the provider YouTube, which belongs to Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (‘Google’).

The advanced privacy mode is used here, which, according to the provider, only initiates the storage of user information when the video(s) are played. When embedded YouTube videos are played, the provider ‘YouTube’ uses cookies to collect information about user behaviour. According to information from ‘YouTube’, these are used, among other things, to collect video statistics, improve user-friendliness and prevent abusive practices. If you are logged into Google, your data will be directly associated with your account when you click on a video. If you do not want this information to be associated with your YouTube profile, you must log out before activating the button. You have the right to object to the creation of these user profiles, but you must contact YouTube to exercise this right. When using YouTube, personal data may also be transmitted to the servers of Google LLC. in the United States.

Regardless of whether the embedded videos are played, a connection to the Google network is established each time this website is accessed, which may trigger further data processing operations without our influence.

All the processing described above, in particular the reading of information on the end device used via the tracking pixel, will only be carried out if you have given us your express consent to do so in accordance with Art. 6 (1) point a GDPR. Without this consent, YouTube videos will not be used when you visit our site.

You can revoke your consent at any time with effect for the future. To exercise your right of revocation, please deactivate this service in the ‘Cookie-Consent-Tool’ provided on the website using alternative options provided on the website.

Further information on data protection at ‘YouTube’ can be found in the YouTube terms of use at and in Google's privacy policy at .

12.2 Trusted Shops Trustbadge

The Trusted Shops Trustbadge is integrated into this website to display our Trusted Shops seal of approval and to offer Trusted Shops membership to buyers after an order.

This serves to safeguard our legitimate interests in the optimal marketing of our offer, which are overriding in the process of balancing of interests, Art. 6 (1) (f) GDPR. The Trustbadge and the services advertised with it are provided by Trusted Shops GmbH, Subbelrather Str. 15C, 50823 Cologne, Germany.

When the Trustbadge is accessed, the web server automatically stores a so-called server log file, which contains, for example, your IP address, the date and time of access, the amount of data transferred and the requesting provider (access data) and documents the retrieval. These access data are not evaluated and are automatically overwritten no later than seven days after the end of your page visit.

Additional personal data is only transferred to Trusted Shops if you decide to use Trusted Shops products after completing an order or have already registered to use them. In this case, the contractual agreement between you and Trusted Shops applies.

12.3 Online applications using a form

On our website, we offer prospective job applicants the opportunity to apply online using a form. To be included in the application process, applicants must provide us with all the personal data required for a well-founded and informed assessment and selection via the form.

The required information includes general personal information (name, address, telephone or electronic contact details) as well as performance-specific proof of the qualifications required for a position. In addition, health-related information may be required, which, in the interest of social protection, must be given special consideration under labour and social law in the person of the applicant.

When the form is sent, the applicant data is encrypted and transmitted to us in accordance with the state of the art, stored by us and evaluated exclusively for the purpose of processing the application.

The legal basis for this processing is generally Art. 6 Para. 1 lit. b DSGVO (for processing in Germany in conjunction with § 26 Para. 1 BDSG), in the sense of which going through the application procedure is considered to be the initiation of an employment contract.

Insofar as special categories of personal data within the meaning of Art. 9 (1) GDPR (e.g. health data such as information on severely disabled status) are requested from applicants as part of the application process, the processing is carried out in accordance with Art. 9 (2) lit. b. GDPR, so that we can exercise the rights arising from labour law and social security and social protection law and fulfil our obligations in this regard.

Alternatively, or cumulatively, the processing of special categories of data may also be based on Article 9(1)(h) of the GDPR if it is carried out for the purposes of preventive or occupational medicine, for the assessment of the applicant's ability to work, for medical diagnosis, for the provision of care or treatment in the health or social sector or for the management of health or social care systems and services.

If the applicant is not selected in the course of the evaluation described above or if an applicant withdraws his application prematurely, his data submitted on forms will be deleted after 6 months at the latest after notification. This period is based on our legitimate interest in answering any follow-up questions regarding the application and, if necessary, in being able to fulfil our obligations to provide evidence under the regulations for the equal treatment of applicants.

In the event of a successful application, the data provided will be processed further for the purposes of implementing the employment relationship on the basis of Article 6(1)(b) GDPR (in the case of processing in Germany in conjunction with Section 26(1) of the German Federal Data Protection Act (BDSG)).

12.4 Applications for job vacancies by email

We advertise current vacancies on our website in a separate section, for which interested parties can apply by emailing the provided contact address.

In order to be included in the application process, applicants must provide us with all the personal data required for a well-founded and informed assessment and selection together with their application by email.

The information on which components an application must contain in order to be considered in individual cases and in which form these components are to be sent by email can be found in the respective job advertisement.

After receiving the application sent to the email contact address provided, we store the applicant's data and evaluate it solely for the purpose of processing the application. For any queries that arise during the processing, we use either the email address provided by the applicant with his application or a telephone number provided, at our discretion.

The legal basis for this processing, including for making contact in the event of queries, is Article 6(1)(b) GDPR (in the case of processing in Germany in conjunction with Section 26(1) of the German Federal Data Protection Act (BDSG)), according to which going through the application process is considered to be the initiation of an employment contract.

Insofar as special categories of personal data within the meaning of Art. 9 (1) GDPR (e.g. health data such as information on severely disabled status) are requested from applicants as part of the application process, the processing is carried out in accordance with Art. 9 (2) point b GDPR so that we can exercise the rights arising from labour law and social security and social protection law and fulfil our obligations in this regard.

Cumulatively or alternatively, the processing of special categories of data may also be based on Article 9(1)(h) of the GDPR if it is carried out for the purposes of preventive or occupational medicine, for the assessment of the applicant's ability to work, for medical diagnosis, for the provision of care or treatment in the health or social sector or for the management of systems and services in the health or social sector.

If the applicant is not selected in the course of the evaluation described above or if an applicant withdraws his application prematurely, his data transmitted by e-mail as well as all electronic correspondence including the original application e-mail will be deleted after a corresponding notification at the latest after 6 months. This period is determined on the basis of our legitimate interest in answering any follow-up questions regarding the application and, if necessary, to be able to fulfil our obligations to provide evidence under the regulations for the equal treatment of applicants.

In the event of a successful application, the data provided will be processed on the basis of Art. 6 (1) point b GDPR (for processing in Germany in conjunction with Section 26 (1) of the German Federal Data Protection Act (BDSG)) for the purposes of implementing the employment relationship.

13) Rights of the data subject

13.1 The applicable data protection law grants you the following rights (rights of information and intervention) vis-à-vis the data controller with regard to the processing of your personal data, whereby reference is made to the cited legal basis for the respective conditions for exercising these rights:

Right of access according to Art. 15 GDPR;
Right to rectification according to Art. 16 GDPR;
right to erasure in accordance with Art. 17 GDPR;
right to restriction of processing in accordance with Art. 18 GDPR;
right to notification in accordance with Art. 19 GDPR;
right to data portability in accordance with Art. 20 GDPR;
right to withdraw consent granted in accordance with Art. 7 (3) GDPR;
right to lodge a complaint in accordance with Art. 77 GDPR.

13.2 RIGHT TO OBJECT

IF, IN THE CONTEXT OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY ANY TIME, FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, TO FILE AN OBJECTION TO THIS PROCESSING WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN PROVE THAT THERE ARE COMPELLING REASONS FOR PROCESSING WHICH ARE WORTHY OF PROTECTION AND WHICH OUTWEIGH YOUR INTERESTS, fundamental rights and freedoms, or for the establishment, exercise or defence of legal claims.

IF WE PROCESS YOUR PERSONAL DATA FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR THE PURPOSE OF SUCH MARKETING. YOU CAN EXERCISE THE RIGHT TO OBJECT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

14) Duration of personal data storage

The duration of the storage of personal data is determined on the basis of the respective legal basis, the purpose of the processing and, if relevant, additionally on the basis of the respective statutory retention period (e.g. retention periods under commercial and tax law).

When personal data is processed on the basis of express consent in accordance with Art. 6 (1) point a GDPR, this data is stored until the data subject withdraws their consent.

If there are statutory retention periods for data that is processed in the context of legal or similar obligations on the basis of Art. 6 (1) point b GDPR, this data is routinely deleted after the retention period has expired if it is no longer required for the fulfilment or initiation of a contract and/or if there is no longer any legitimate interest on our part in further storage.

When processing personal data on the basis of Art. 6 (1) point f GDPR, this data is stored until the data subject exercises his right of objection under Art. 21 (1) GDPR, unless we can prove compelling legitimate reasons for the processing that outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.

When processing personal data for the purpose of direct marketing on the basis of Art. 6 (1) point f GDPR, this data is stored until the data subject exercises his right of objection under Art. 21 (2) GDPR.

Unless otherwise indicated by the other information in this statement about specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.