Privacy Policy

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can personally identify you. For detailed information on data protection, please refer to our privacy policy listed below this text.

Data collection on this website

Who is responsible for data collection on this website?

The website operator processes the data on this website. You can find the operator’s contact details in the legal notice of this website.

How do we collect your data?

Your data is collected, on the one hand, when you provide it to us. This may include, for example, data that you enter into a contact form.

Other data is automatically collected by our IT systems when you visit the website. This primarily includes technical data (e.g., internet browser, operating system, or time the page was accessed). This data is collected automatically as soon as you enter this website.

What do we use your data for?

Some data is collected to ensure that the website is provided without errors. Other data may be used to analyze your user behavior.

What rights do you have regarding your data?

You have the right at any time to obtain free information about the origin, recipients, and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. You can contact us at any time at the address provided in the legal notice with regard to this and any other questions about data protection. You also have the right to lodge a complaint with the competent supervisory authority.

You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. For details, please refer to the privacy policy under “Right to restriction of processing.”

Analytics tools and tools from third-party providers

When you visit this website, your browsing behavior may be statistically evaluated. This is done primarily using cookies and so-called analytics programs. The analysis of your browsing behavior is generally anonymous; your browsing behavior cannot be traced back to you.

You can object to this analysis or prevent it by not using certain tools. Detailed information about these tools and your options for objecting can be found in the following privacy policy.

2. Hosting and Content Delivery Networks (CDN)

External Hosting

This website is hosted by an external service provider (host). The personal data collected on this website is stored on the host’s servers. This may include, in particular, IP addresses, contact requests, metadata and communication data, contract data, contact details, names, website visits, and other data generated through a website.

The hosting provider is used for the purpose of fulfilling contracts with our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of providing our online offering securely, quickly, and efficiently through a professional provider (Art. 6 para. 1 lit. f GDPR).

Our hosting provider will process your data only to the extent necessary to fulfill its service obligations and will follow our instructions regarding this data.

Conclusion of a data processing agreement

To ensure data processing in compliance with data protection laws, we have concluded a data processing agreement with our hosting provider.

Cloudflare

We use the “Cloudflare” service. The provider is Cloudflare, Inc. 665 3rd St. #200, San Francisco, CA 94107, USA (hereinafter “Cloudflare”).

Cloudflare provides a globally distributed content delivery network with DNS. Technically, this routes the transfer of information between your browser and our website through Cloudflare’s network. This enables Cloudflare to analyze traffic between your browser and our website and serve as a filter between our servers and potentially malicious traffic from the internet. Cloudflare may also use cookies for this purpose, but solely for the purpose described here.

We have concluded a data processing agreement with Cloudflare. Cloudflare is also a certified participant in the “EU-US Privacy Shield Framework”. Cloudflare has undertaken to handle all personal data received from member states of the European Union (EU) in accordance with the “Privacy Shield Framework”.

The use of Cloudflare is based on our legitimate interest in providing our website as reliably and securely as possible (Art. 6 para. 1 lit. f GDPR).

Further information on security and data protection at Cloudflare can be found here: https://www.cloudflare.com/privacypolicy/.

3. General information and mandatory information

Privacy

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various items of personal data are collected. Personal data are data that can personally identify you. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

We would like to point out that data transmission over the internet (e.g., when communicating by email) may have security vulnerabilities. Complete protection of data from access by third parties is not possible.

Information about the controller

The controller responsible for data processing on this website is:

MYBODY LAB GmbH
Lindenstrasse 8
6340 Baar

Schedule an appointment: Book an appointment now!
Email: info@mybody-x.com

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data (e.g., names, email addresses, or similar).

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You may withdraw consent already given at any time. An informal notification by email to us is sufficient. The lawfulness of data processing carried out before withdrawal remains unaffected by the withdrawal.

Right to object to data collection in particular cases and to direct marketing (Art. 21 GDPR)

IF DATA PROCESSING IS CARRIED OUT ON THE BASIS OF ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO THE PROCESSING OF YOUR PERSONAL DATA; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RELEVANT LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED, UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21(1) GDPR).

IF YOUR PERSONAL DATA ARE PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING, TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION PURSUANT TO ART. 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or the place of the alleged violation. The right to lodge a complaint is without prejudice to any other administrative or judicial remedies.

Right to data portability

You have the right to have data that we process automatically based on your consent or in fulfillment of a contract provided to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will only be carried out where technically feasible.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or inquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the browser's address bar changing from “http://” to “https://” and by the padlock symbol in your browser's address bar.

When SSL or TLS encryption is enabled, third parties cannot read the data you transmit to us.

Encrypted payment transactions on this website

If, after concluding a paid contract, you are required to provide us with your payment details (e.g. your account number for direct debit authorization), this data is required to process the payment.

Payment transactions using standard payment methods (Visa/MasterCard, direct debit) are carried out exclusively via an encrypted SSL or TLS connection. You can recognize an encrypted connection by the browser's address bar changing from “http://” to “https://” and by the padlock symbol in your browser's address bar.

With encrypted communication, third parties cannot read the payment data you transmit to us.

Access, deletion, and correction

Under the applicable statutory provisions, you have the right at any time to obtain free information about your stored personal data, its origin and recipients, and the purpose of data processing, and, where applicable, the right to have this data corrected or deleted. For this purpose, and for any further questions regarding personal data, you may contact us at any time at the address provided in the legal notice.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. To do so, you may contact us at any time at the address provided in the legal notice. The right to restrict processing exists in the following cases:

If you dispute the accuracy of your personal data stored by us, we generally need time to verify this. For the duration of the verification, you have the right to request restriction of the processing of your personal data.
If the processing of your personal data was or is unlawful, you may request restriction of data processing instead of deletion.
If we no longer need your personal data, but you need it to exercise, defend, or establish legal claims, you have the right to request restriction of the processing of your personal data instead of its deletion.
If you have lodged an objection under Article 21(1) GDPR, a balancing of your interests against ours must be carried out. Until it has been established whose interests prevail, you have the right to request restriction of the processing of your personal data.

If you have restricted the processing of your personal data, that data may, apart from being stored, only be processed with your consent, or for the establishment, exercise, or defense of legal claims, or to protect the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

Objection to promotional emails

We hereby object to the use of contact details published as part of the legal notice requirement for sending unsolicited advertising and information materials. The operators of these pages expressly reserve the right to take legal action in the event of unsolicited promotional information being sent, such as through spam emails.

4. Data collection on this website

Cookies

Our websites use so-called “cookies.” Cookies are small text files and do not cause any damage to your device. They are stored either temporarily for the duration of a session (session cookies) or permanently (persistent cookies) on your device. Session cookies are automatically deleted after your visit ends. Persistent cookies remain stored on your device until you delete them yourself or your web browser automatically deletes them.

Third-party cookies may also be stored on your device when you visit our website (third-party cookies). These enable us or you to use certain services provided by the third party (e.g., cookies for processing payment services).

Cookies have various functions. Numerous cookies are technically necessary because certain website functions would not work without them (e.g. the shopping cart function or the display of videos). Other cookies are used to analyze user behavior or display advertising.

Cookies that are required to carry out the electronic communication process or to provide certain functions you request (e.g. the shopping cart function) are stored on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in storing cookies to provide its services without technical errors and in an optimized manner. If corresponding consent has been requested (e.g. consent to store cookies), processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR; consent may be withdrawn at any time.

You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, reject cookies in certain cases or generally, and activate the automatic deletion of cookies when you close your browser. Disabling cookies may limit the functionality of this website.

If cookies from third-party companies or for analytical purposes are used, we will inform you separately in this privacy policy and, where applicable, ask for your consent.

Cookie consent with Borlabs Cookie

Our website uses Borlabs Cookie's cookie consent technology to obtain your consent to store certain cookies in your browser and to document this in compliance with data protection regulations. The provider of this technology is Borlabs – Benjamin A. Bornschein, Georg-Wilhelm-Str. 17, 21107 Hamburg (hereinafter Borlabs).

When you visit our website, a Borlabs Cookie is stored in your browser, recording the consents you have given or withdrawn. This data is not disclosed to the provider of Borlabs Cookie.

The collected data is stored until you ask us to delete it, delete the Borlabs Cookie itself, or the purpose for data storage no longer applies. Mandatory statutory retention periods remain unaffected. Details about data processing by Borlabs Cookie can be found at https://de.borlabs.io/kb/welche-daten-speichert-borlabs-cookie/

Borlabs Cookie Consent technology is used to obtain the legally required consents for the use of cookies. The legal basis for this is Art. 6(1)(c) GDPR.

List of cookies used

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

Browser type and browser version
Operating system used
Referrer URL
Hostname of the accessing computer
Time of the server request
IP address

This data is not combined with data from other sources.

This data is collected on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in ensuring that its website is displayed without technical errors and in optimizing it; server log files must be recorded for this purpose.

Contact form

If you send us inquiries via the contact form, your details from the inquiry form, including the contact details you provide there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. We will not share this data without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR if your inquiry is related to the performance of a contract or is necessary to carry out pre-contractual measures. In all other cases, processing is based on our legitimate interest in effectively processing the inquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR), where this was requested.

The data you enter in the contact form will remain with us until you request its deletion, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your inquiry has been fully processed). Mandatory statutory provisions—in particular retention periods—remain unaffected.

Inquiry by email, telephone, or fax

If you contact us by email, telephone, or fax, your inquiry, including all personal data arising from it (name, inquiry), will be stored and processed by us for the purpose of handling your request. We will not share this data without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR if your inquiry is related to the performance of a contract or is necessary to carry out pre-contractual measures. In all other cases, processing is based on your consent (Art. 6(1)(a) GDPR) and/or our legitimate interests (Art. 6(1)(f) GDPR), as we have a legitimate interest in effectively processing the inquiries addressed to us.

The data you send to us through contact inquiries will remain with us until you request its deletion, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your request has been fully processed). Mandatory statutory provisions—in particular statutory retention periods—remain unaffected.

Registration on this website

You can register on this website to use additional functions on the site. We use the data entered for this purpose only to provide the respective offering or service for which you have registered. The mandatory information requested during registration must be provided in full. Otherwise, we will reject the registration.

For important changes, such as changes to the scope of our offerings or technically necessary changes, we use the email address provided during registration to inform you in this way.

The data entered during registration is processed for the purpose of carrying out the user relationship established by the registration and, where applicable, initiating further contracts (Article 6(1)(b) GDPR).

The data collected during registration is stored by us for as long as you are registered on this website and is then deleted. Statutory retention periods remain unaffected.

5. Social Media

Instagram Plugin

This website incorporates functions of the Instagram service. These functions are provided by Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA.

If you are logged into your Instagram account, you can link the content of this website to your Instagram profile by clicking the Instagram button. This enables Instagram to associate your visit to this website with your user account. We would like to point out that, as the provider of the pages, we have no knowledge of the content of the transmitted data or how Instagram uses it.

The data is stored and analyzed on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in achieving the broadest possible visibility on social media. If corresponding consent has been requested (e.g., consent to the storage of cookies), processing is carried out exclusively on the basis of Article 6(1)(a) GDPR; consent may be withdrawn at any time.

Further information can be found in Instagram’s privacy policy: https://instagram.com/about/legal/privacy/.

6. Analytics Tools and Advertising

Google Analytics

This website uses functions of the web analytics service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses so-called “cookies.” These are text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie about your use of this website is generally transmitted to a Google server in the USA and stored there.

The storage of Google Analytics cookies and use of this analytics tool are based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in analyzing user behavior in order to optimize both its website and its advertising. If corresponding consent has been requested (e.g., consent to store cookies), processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; consent may be withdrawn at any time.

IP anonymization

We have activated the IP anonymization feature on this website. As a result, Google truncates your IP address within member states of the European Union or in other states party to the Agreement on the European Economic Area before transmitting it to the United States. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, compile reports on website activity, and provide the website operator with other services related to website and Internet use. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

Browser plugin

You can prevent cookies from being stored by selecting the appropriate setting in your browser software; however, please note that in this case you may not be able to use all the functions of this website to their full extent. You can also prevent Google from collecting and processing the data generated by the cookie and related to your use of the website (including your IP address) by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

Objection to data collection

You can prevent Google Analytics from collecting your data by setting the following button to “Off.” An opt-out cookie will be set to prevent your data from being collected during future visits to this website: .

More information about how Google Analytics handles user data can be found in Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

Data processing agreement

We have concluded a data processing agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

Demographic characteristics in Google Analytics

This website uses Google Analytics' “demographic characteristics” feature. This enables reports to be created containing information about the age, gender, and interests of page visitors. This data comes from interest-based advertising by Google and from visitor data provided by third parties. This data cannot be attributed to a specific person. You can deactivate this feature at any time via the ad settings in your Google account or generally prohibit Google Analytics from collecting your data as described in the section “Objection to data collection.”

Storage period

Data stored by Google at the user and event level and linked to cookies, user identifiers (e.g., User ID), or advertising IDs (e.g., DoubleClick cookies, Android Advertising ID) are anonymized or deleted after 26 months. Details can be found at the following link: https://support.google.com/analytics/answer/7667196?hl=de

Hotjar

This website uses Hotjar. The provider is Hotjar Ltd., Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe (website: https://www.hotjar.com).

Hotjar is a tool for analyzing your user behavior on this website. With Hotjar, we can record, among other things, your mouse and scrolling movements and clicks. Hotjar can also determine how long you kept the mouse pointer over a particular spot. Based on this information, Hotjar creates so-called heat maps, which can be used to determine which areas of the website website visitors prefer to view.

Furthermore, we can determine how long you stayed on a page and when you left it. We can also determine where you abandoned your entries in a contact form (known as conversion funnels).

In addition, Hotjar can be used to obtain direct feedback from website visitors. This function serves to improve the website operator's online offerings.

Hotjar uses cookies. Cookies are small text files that are stored on your computer and saved by your browser. They are used to make our offering more user-friendly, effective, and secure. These cookies can be used in particular to determine whether this website was visited using a specific device or whether Hotjar's functions have been disabled for the browser in question. Hotjar cookies remain on your device until you delete them.

The use of Hotjar and the storage of Hotjar cookies are based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in analyzing user behavior in order to optimize both its website and its advertising. If corresponding consent has been requested (e.g., consent to store cookies), processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; consent may be withdrawn at any time.

Disable Hotjar

If you wish to disable data collection by Hotjar, click the following link and follow the instructions provided there: https://www.hotjar.com/opt-out

Please note that Hotjar must be disabled separately for each browser and each device.

For more information about Hotjar and the data collected, please refer to Hotjar’s privacy policy at the following link: https://www.hotjar.com/privacy

Data Processing Agreement

We have concluded a data processing agreement with Hotjar to implement the strict European data protection regulations.

Google Analytics Remarketing

This website uses the functions of Google Analytics Remarketing in conjunction with the cross-device functions of Google Ads and Google DoubleClick. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

This function makes it possible to link the advertising audiences created with Google Analytics Remarketing to the cross-device functions of Google Ads and Google DoubleClick. In this way, interest-based, personalized advertising messages tailored to you based on your previous usage and browsing behavior on one device (e.g. mobile phone) can also be displayed on another of your devices (e.g. tablet or PC).

If you have given the corresponding consent, Google links your web and app browsing history to your Google Account for this purpose. In this way, the same personalized advertising messages can be displayed on every device on which you sign in with your Google Account.

To support this function, Google Analytics collects Google-authenticated user IDs, which are temporarily linked to our Google Analytics data in order to define and create audiences for cross-device advertising.

You can permanently object to cross-device remarketing/targeting by deactivating personalized advertising; to do so, follow this link: https://www.google.com/settings/ads/onweb/.

The consolidation of the data collected in your Google Account takes place exclusively on the basis of your consent, which you can give or withdraw from Google (Art. 6 para. 1 lit. a GDPR). For data collection processes that are not consolidated in your Google Account (e.g. because you do not have a Google Account or have objected to the consolidation), the collection of data is based on Art. 6 para. 1 lit. f GDPR. The legitimate interest arises from the fact that the website operator has an interest in the anonymized analysis of website visitors for advertising purposes.

Further information and the privacy policy can be found in Google's privacy policy at: https://policies.google.com/technologies/ads?hl=de.

Google Ads and Google Conversion Tracking

This website uses Google Ads. Google Ads is an online advertising program of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

As part of Google Ads, we use so-called conversion tracking. When you click on an advertisement served by Google, a cookie for conversion tracking is set. Cookies are small text files that the Internet browser stores on the user's computer. These cookies expire after 30 days and are not used to personally identify users. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognize that the user clicked on the advertisement and was redirected to this page.

Each Google Ads customer receives a different cookie. The cookies cannot be tracked across the websites of Google Ads customers. The information collected using the conversion cookie is used to create conversion statistics for Google Ads customers who have opted for conversion tracking. Customers learn the total number of users who clicked on their ad and were redirected to a page equipped with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users. If you do not wish to participate in tracking, you can object to this use by easily disabling the Google conversion tracking cookie in your Internet browser through the user settings. You will then not be included in the conversion tracking statistics.

The storage of “conversion cookies” and the use of this tracking tool are based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in analyzing user behavior in order to optimize both its website and its advertising. If corresponding consent has been requested (e.g., consent to the storage of cookies), processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; consent may be withdrawn at any time.

For more information about Google Ads and Google conversion tracking, please see Google's privacy policy: https://policies.google.com/privacy?hl=de.

Facebook Pixel

This website uses Facebook’s visitor action pixel to measure conversions. The provider of this service is Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. According to Facebook, however, the data collected is also transferred to the United States and other third countries.

This makes it possible to track the behavior of page visitors after they have been redirected to the provider’s website by clicking on a Facebook advertisement. This allows the effectiveness of Facebook advertisements to be evaluated for statistical and market research purposes and future advertising measures to be optimized.

The data collected is anonymous to us as the operator of this website; we cannot draw any conclusions about the identity of users. However, the data is stored and processed by Facebook, meaning that it may be linked to the respective user profile and Facebook may use the data for its own advertising purposes in accordance with the Facebook Data Policy. This enables Facebook to serve advertisements on Facebook pages and outside Facebook. We, as the operator of this page, cannot influence this use of the data.

The use of the Facebook Pixel is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in effective advertising measures, including social media. If corresponding consent has been requested (e.g., consent to the storage of cookies), processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; consent may be withdrawn at any time.

Further information on protecting your privacy can be found in Facebook’s privacy policy: https://de-de.facebook.com/about/privacy/.

You can also deactivate the “Custom Audiences” remarketing feature under Ad Settings at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen opt out. To do so, you must be logged in to Facebook.

If you do not have a Facebook account, you can opt out of usage-based advertising from Facebook on the European Interactive Digital Advertising Alliance website: http://www.youronlinechoices.com/de/praferenzmanagement/.

7. Newsletter

Newsletter data

If you would like to receive the newsletter offered on the website, we need your email address and information that allows us to verify that you are the owner of the email address provided and agree to receive the newsletter. No other data is collected, or it is collected only on a voluntary basis. We use this data exclusively to send the requested information and do not disclose it to third parties.

The processing of the data entered in the newsletter registration form is based exclusively on your consent (Art. 6 para. 1 lit. a GDPR). You may withdraw your consent to the storage of the data and email address and their use to send the newsletter at any time, for example via the “Unsubscribe” link in the newsletter. The lawfulness of the data processing operations already carried out remains unaffected by the withdrawal.

The data you provide to us for the purpose of receiving the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter and will be deleted from the newsletter distribution list after you unsubscribe. Data stored by us for other purposes remains unaffected.

After you unsubscribe from the newsletter distribution list, your email address may be stored by us or the newsletter service provider in a blacklist to prevent future mailings. The data from the blacklist is used solely for this purpose and is not merged with other data. This serves both your interests and our interests in complying with the statutory requirements for sending newsletters (legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR). Storage in the blacklist is not limited in time. You may object to this storage if your interests override our legitimate interest.

MailChimp

This website uses MailChimp's services to send newsletters. The provider is Rocket Science Group LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA.

MailChimp is a service that can be used, among other things, to organize and analyze the sending of newsletters. If you enter data for the purpose of subscribing to the newsletter (e.g., email address), this data is stored on MailChimp's servers in the USA.

MailChimp is certified under the “EU-US Privacy Shield.” The “Privacy Shield” is an agreement between the European Union (EU) and the USA intended to ensure compliance with European data protection standards in the USA.

With the help of MailChimp, we can analyze our newsletter campaigns. When you open an email sent via MailChimp, a file contained in the email (known as a web beacon) connects to MailChimp's servers in the USA. This makes it possible to determine whether a newsletter message has been opened and which links, if any, have been clicked. Technical information is also collected (e.g., the time of retrieval, IP address, browser type, and operating system). This information cannot be attributed to the respective newsletter recipient. It is used exclusively for the statistical analysis of newsletter campaigns. The results of these analyses may be used to better tailor future newsletters to the recipients' interests.

If you do not want MailChimp to analyze your data, you must unsubscribe from the newsletter. To do so, we provide an appropriate link in every newsletter message. You can also unsubscribe from the newsletter directly on the website.

Data processing is based on your consent (Art. 6 para. 1 lit. a GDPR). You may withdraw this consent at any time by unsubscribing from the newsletter. The lawfulness of data processing operations already carried out remains unaffected by the withdrawal.

For more information, please refer to MailChimp's privacy policy at: https://mailchimp.com/legal/terms/.

Conclusion of a Data-Processing-Agreement

We have concluded a so-called “Data-Processing-Agreement” with MailChimp, under which we require MailChimp to protect our customers' data and not disclose it to third parties.

8. Plugins and tools

Google Web Fonts

This website uses so-called web fonts provided by Google to ensure a consistent presentation of fonts. The Google Fonts are installed locally. No connection to Google's servers is established.

For more information about Google Web Fonts, please see https://developers.google.com/fonts/faq and in Google's privacy policy: https://policies.google.com/privacy?hl=de.

9. eCommerce and payment providers

Processing of data (customer and contract data)

We collect, process, and use personal data only insofar as it is required to establish, define the content of, or amend the legal relationship (master data). This is done on the basis of Art. 6 para. 1 lit. b GDPR, which permits the processing of data for the performance of a contract or for pre-contractual measures. We collect, process, and use personal data relating to the use of this website (usage data) only insofar as this is necessary to enable the user to use or bill for the service.

The collected customer data will be deleted after completion of the order or termination of the business relationship. Statutory retention periods remain unaffected.

Data transfer upon conclusion of a contract for online shops, merchants, and shipment of goods

We transfer personal data to third parties only if this is necessary as part of contract processing, for example to the companies entrusted with delivering the goods or to the credit institution commissioned with processing the payment. No further transfer of the data takes place, or only if you have expressly consented to the transfer. Your data will not be disclosed to third parties without your express consent, for example for advertising purposes.

The legal basis for data processing is Art. 6 para. 1 lit. b GDPR, which permits the processing of data for the performance of a contract or for the implementation of pre-contractual measures.

Data transfer upon conclusion of a contract for services and digital content

We transfer personal data to third parties only if this is necessary as part of contract processing, for example to the credit institution commissioned with processing the payment.

No further transfer of the data takes place, or only if you have expressly consented to the transfer. Your data will not be disclosed to third parties without your express consent, for example for advertising purposes.

The legal basis for data processing is Art. 6 para. 1 lit. b GDPR, which permits the processing of data for the performance of a contract or for the implementation of pre-contractual measures.

Stripe

On this website, we offer payment with Stripe’s services, among other options. The provider for customers within the EU is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (hereinafter “Stripe”).

When paying via Stripe, your payment details are forwarded to Stripe via an interface on our website in order to process the payment. You can find details on this in Stripe’s privacy policy at the following link: https://stripe.com/de/privacy.

The transfer of your data to Stripe is based on Art. 6 para. 1 lit. b GDPR (contract performance) and on our legitimate interest in using reliable and secure payment processes (Art. 6 para. 1 lit. f GDPR).

PayPal

On this website, we offer payment via PayPal, among other options. The provider of this payment service is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”).

If you select payment via PayPal, the payment details you enter will be transferred to PayPal.

The transfer of your data to PayPal is based on Art. 6 para. 1 lit. a GDPR (consent) and Art. 6 para. 1 lit. b GDPR (processing for the performance of a contract). You may withdraw your consent to data processing at any time. Withdrawal does not affect the lawfulness of data processing operations carried out in the past.

Sofortüberweisung

On this website, we offer payment via “Sofortüberweisung”, among other options. The provider of this payment service is Sofort GmbH, Theresienhöhe 12, 80339 Munich (hereinafter “Sofort GmbH”).

Using the “Sofortüberweisung” procedure, we receive payment confirmation from Sofort GmbH in real time and can immediately begin fulfilling our obligations.

If you have chosen the “Sofortüberweisung” payment method, you provide your PIN and a valid TAN to Sofort GmbH, which can use them to log in to your online banking account. After logging in, Sofort GmbH automatically checks your account balance and makes the transfer to us using the TAN you provided. It then immediately sends us a transaction confirmation. After logging in, your transactions, the overdraft facility limit, and the existence of other accounts and their balances are also checked automatically.

In addition to your PIN and TAN, the payment data you enter and personal data are also transmitted to Sofort GmbH. Personal data includes your first and last name, address, telephone number(s), email address, IP address, and, where applicable, other data required for payment processing. Transmitting this data is necessary to verify your identity beyond doubt and prevent attempted fraud.

The transfer of your data to Sofort GmbH is based on Art. 6 para. 1 lit. a GDPR (consent) and Art. 6 para. 1 lit. b GDPR (processing for the performance of a contract). You may withdraw your consent to data processing at any time. Withdrawal does not affect the lawfulness of data processing carried out in the past.

For details about payment via Sofortüberweisung, please refer to the following links: https://www.sofort.de/datenschutz.html and https://www.klarna.com/sofort/.

Paydirekt

On this website, we offer payment via Paydirekt, among other options. The provider of this payment service is Paydirekt GmbH, Hamburger Allee 26-28, 60486 Frankfurt am Main, Germany (hereinafter “Paydirekt”).

When you make a payment using Paydirekt, Paydirekt collects various transaction data and forwards it to the bank with which you are registered for Paydirekt. In addition to the data required for payment, Paydirekt may collect further data as part of transaction processing, such as the delivery address or individual items in the shopping cart.

Paydirekt then authenticates the transaction using the authentication procedure stored with the bank for this purpose. The payment amount is then transferred from your account to our account. Neither we nor third parties have access to your account data.

For details about payment with Paydirekt, please refer to Paydirekt's terms and conditions and privacy policy at: https://www.paydirekt.de/agb/index.html.

10. Our social media presences

Data processing by social networks

We maintain publicly accessible profiles on social networks. The social networks we use are listed below.

Social networks such as Facebook, Google+, etc. can generally analyze your user behavior extensively when you visit their website or a website with integrated social media content (e.g., Like buttons or advertising banners). Visiting our social media presences triggers numerous data protection-relevant processing operations. Specifically:

If you are logged in to your social media account and visit our social media presence, the operator of the social media portal may associate this visit with your user account. However, your personal data may also be collected if you are not logged in or do not have an account with the respective social media portal. In this case, data collection may take place, for example, through cookies stored on your device or by recording your IP address.

The operators of the social media portals can use the data collected in this way to create user profiles containing your preferences and interests. This allows interest-based advertising to be displayed to you within and outside the respective social media presence. If you have an account with the respective social network, interest-based advertising can be displayed on all devices on which you are or have been logged in.

Please also note that we cannot track all processing operations on the social media portals. Depending on the provider, the operators of the social media portals may therefore carry out additional processing operations. For details, please refer to the terms of use and privacy policies of the respective social media portals.

Legal basis

Our social media presences are intended to ensure as comprehensive an online presence as possible. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. The analysis processes initiated by the social networks may be based on different legal grounds, which must be specified by the operators of the social networks (e.g., consent within the meaning of Art. 6(1)(a) GDPR).

Controller and exercise of rights

When you visit one of our social media profiles (e.g. Facebook), we and the operator of the social media platform are jointly responsible for the data processing activities triggered by this visit. You may generally exercise your rights (access, rectification, erasure, restriction of processing, data portability, and complaint) both against us and against the operator of the respective social media portal (e.g. against Facebook).

Please note that, despite our joint responsibility with the operators of social media portals, we do not have comprehensive control over the data processing activities of the social media portals. Our options are determined largely by the respective provider’s corporate policy.

Storage period

The data collected directly by us via our social media presence is deleted by our systems as soon as the purpose for storing it no longer applies, you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies. Stored cookies remain on your device until you delete them. Mandatory statutory provisions—in particular retention periods—remain unaffected.

We have no influence over how long your data is stored by the operators of social networks for their own purposes. For details, please contact the operators of the social networks directly (e.g. in their privacy policies; see below).

Social networks in detail

Facebook

We have a profile on Facebook. The provider is Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA. Facebook is certified under the EU-US Privacy Shield.

We have entered into an agreement with Facebook on joint processing (Controller Addendum). This agreement specifies which data processing activities we or Facebook are responsible for when you visit our Facebook Page. You can view this agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum.

You can adjust your advertising settings independently in your user account. To do so, click the following link and log in: https://www.facebook.com/settings?tab=ads.

For details, please refer to Facebook’s privacy policy: https://www.facebook.com/about/privacy/.

Instagram

We have a profile on Instagram. The provider is Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. For details on how it handles your personal data, please refer to Instagram’s privacy policy: https://help.instagram.com/519522125107875.