Privacy Policy

1 Introduction

We, Wortmann Fashion Retail GmbH & Co. KG, Klingenbergstraße 1-3, D-32758 Detmold, as the operator of this online offering, are the controller responsible for processing the personal data of users of the online offering. You can find our contact details in the imprint of the online offering; the contacts for questions regarding the processing of personal data are named directly in this privacy policy.
We take the protection of your privacy and your personal data very seriously. We collect, store and use your personal data only in accordance with the content of this privacy policy and the applicable data protection provisions, in particular the European General Data Protection Regulation (GDPR) and the applicable national data protection laws.
With this privacy policy, we inform you to what extent and for which purposes personal data is processed in connection with the use of the online offering.

1.1 Personal data

Personal data is information relating to an identified or identifiable natural person. This includes all information about your identity, such as your name, email address or postal address. Information that cannot be associated with your identity (such as statistical information, e.g. about the number of users of the online offering) is not considered personal data.
You can generally use our online offering without disclosing your identity and without providing personal data. In that case, we only collect general information about the visit to our online offering. However, for some of the services offered, personal data will be collected from you. We then generally process this data only for the purpose of using this online offering, in particular to provide the information you request. When we collect personal data, only the data that is absolutely necessary must be provided. Additional information may be possible on a voluntary basis. We will indicate in each case whether data fields are mandatory or whether information is voluntary. We will inform you of the specific details in the relevant section of this privacy policy.
No automated decision-making based on your personal data takes place in connection with the use of our online offering.

1.2 Processing of personal data

Your data is stored by us on specially protected servers within the European Union. These are protected by technical and organisational measures against loss, destruction, access, modification or distribution of your data by unauthorised persons. Access to your data is only possible for a few authorised persons who are responsible for the technical, commercial or editorial maintenance of the servers. However, despite regular checks, complete protection against all risks is not possible.
Your personal data is transmitted in encrypted form over the internet. We use TLS / SSL encryption (Transport Layer Security / Secure Socket Layer) for data transmission.

1.3 Disclosure of personal data to third parties

We generally use your personal information only to provide the services you have requested. If we use external service providers for the provision of services, their access to the data is also exclusively for the purpose of providing the service. By means of technical and organisational measures, we ensure compliance with data protection regulations and also oblige our external service providers to do so.
We will not pass on data to third parties beyond this without your express consent, in particular not for advertising purposes. Your personal data will only be disclosed if you have consented to the transfer of data or if we are entitled or obliged to do so on the basis of statutory provisions and/or official or court orders. This may in particular involve providing information for the purposes of criminal prosecution, hazard prevention or enforcement of intellectual property rights.
If we transfer your personal data ourselves or through service providers to countries outside the European Union, we comply with the special requirements of Art. 44 et seq. GDPR for this purpose and also oblige our service providers to comply with these rules. We will therefore only transfer your data to countries outside the European Union subject to the level of protection guaranteed by the GDPR. This level of protection is particularly ensured by an adequacy decision of the EU Commission or by appropriate safeguards in accordance with Art. 46 GDPR.

1.4 Legal bases for data processing

Insofar as we obtain your consent for the processing of your personal data, Art. 6(1)(a) GDPR is the legal basis for data processing.
Insofar as we process your personal data because this is necessary for the performance of a contract or in the context of a contract-like relationship with you, Art. 6(1)(b) GDPR is the legal basis for data processing.
Insofar as we process your personal data to comply with a legal obligation, Art. 6(1)(c) GDPR is the legal basis for data processing.
Furthermore, Art. 6(1)(f) GDPR may be considered as the legal basis for data processing if the processing of your personal data is necessary for the purposes of a legitimate interest pursued by our company or by a third party and provided that your interests or fundamental rights and freedoms do not require the protection of personal data.
In this privacy policy, we will always indicate the legal basis on which we base the processing of your personal data.

1.5 Data deletion and storage period

We generally delete or block your personal data as soon as the purpose of storage no longer applies. However, storage may take place beyond this if this is provided for by legal requirements to which we are subject, for example with regard to statutory retention and documentation obligations. In such a case, we will delete or block your personal data after the end of the relevant requirements.

2 Use of our online offering

2.1 Information about your end device

Each time you access our online offering, we collect the following information about your end device, regardless of your registration status: the IP address of your end device, the request of your browser and the time of this request. The status and the amount of data transferred during this request are also recorded. We also collect product and version information about the browser used and the operating system of the end device. We also record from which website the access to the online offering took place. The IP address of your end device is stored only for the duration of your use of the online offering and is then deleted or anonymised by shortening it. The remaining data is stored for a limited period of time.
We use this data for the operation of the online offering, in particular to detect and eliminate errors, to determine the utilisation of the online offering and to make adjustments or improvements. These purposes also constitute our legitimate interest in data processing within the meaning of Art. 6(1)(f) GDPR.

2.2 Use of cookies

We use cookies for our online offering – as is the case on many websites. Cookies are small text files that are stored on your end device and store certain settings as well as data for exchange with the online offering via your browser. A cookie typically contains the name of the domain from which the cookie file was sent, as well as information about the age of the cookie and an alphanumeric identifier.
Cookies enable us to recognise your end device and to make any default settings and preferences immediately available. The cookies we use are – where possible – so-called session cookies, which are automatically deleted at the end of the browser session. In some cases, cookies with a longer storage period may also be used so that your preferences and settings can be taken into account again during your next visit to our online offering.
Most browsers are configured to automatically accept cookies. However, you can disable the storage of cookies or configure your browser so that you are notified as soon as cookies are sent. It is also possible to manually delete cookies that have already been stored using your browser settings. Please note that if you refuse the storage of cookies or delete necessary cookies, you may only be able to use our online offering to a limited extent or not at all.
Insofar as cookies are not required for our online offering, we ask for your consent to the use of cookies when you first access the online offering. With regard to non-essential cookies from third-party providers, you will find a more detailed description of the services used by these third-party providers below. The legal basis for the associated data processing, including any data transfer, is your consent within the meaning of Art. 6(1)(a) GDPR. Consent once given can be withdrawn at any time with effect for the future, in particular by changing the settings you have selected.
The legal basis for the use of necessary cookies is our legitimate interest in the proper provision of our online offering within the meaning of Art. 6(1)(f) GDPR and – insofar as contracts are concluded or fulfilled via our online offering – the performance of the contract within the meaning of Art. 6(1)(b) GDPR.

3 Integration of third-party services

For the operation of our online shop and for some functions in our online offering, we make use of services from third-party providers. The respective services mainly consist of optional functions that must be explicitly selected or used by you. We have concluded contractual agreements with the respective providers for the provision or integration of their services and, within the scope of our possibilities, make every effort to ensure that the third-party providers also transparently inform about the scope of the processing of personal data and comply with data protection requirements.

3.1 Use of SCAYLE Commerce Engine for operating our online shop

For the operation of our online shop, we use the shop system SCAYLE Commerce Engine provided by SCAYLE GmbH (a subsidiary of ABOUT YOU SE & Co. KG), Domstraße 10, 20095 Hamburg, Germany (hereinafter: “SCAYLE”). SCAYLE is an e‑commerce platform via which the entire handling of our online trade is carried out, including hosting, shopping cart functionality and order management.
When you use our online offering, a connection is established to SCAYLE’s servers. In this context, personal data is processed, in particular IP addresses, metadata and communication data as well as data that you provide during the ordering process (e.g. names, address and contact data as well as contract data). Data processing generally takes place within the European Union. However, since SCAYLE uses specialised subcontractors to provide its services, it cannot be ruled out that data is transferred to service providers in third countries, in particular the USA. Such a transfer is carried out exclusively in compliance with the requirements of Art. 44 et seq. GDPR, for example on the basis of standard contractual clauses or an adequacy decision. For more information about data protection at SCAYLE and data processing by this provider, please visit https://www.scayle.com/privacy-policy/.
The legal basis for the use of the SCAYLE Commerce Engine is the performance of the contract concluded with you and/or the implementation of pre-contractual measures in accordance with Art. 6(1)(b) GDPR. In addition, we have a legitimate interest within the meaning of Art. 6(1)(f) GDPR in using a secure, fast and efficient e‑commerce platform provided by a professional provider.

3.2 Necessary services for managing user data

For our online offering, we use external services that serve the central management of user data and the consideration of user preferences, including with regard to consent to the storage of non-essential cookies. Specifically, we use Google Tag Manager, Commanders Act and BrowseAid.
We are of the opinion that, due to the safeguards we have taken (anonymisation and options to object), data processing for the optimisation of our online offering constitutes a legitimate interest in data processing pursuant to Art. 6(1)(f) GDPR.

3.2.1 Google Tag Manager

For our online offering we use Google Tag Manager, a service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (hereinafter: “Google”). Google Tag Manager is a tag management system (TMS) that allows tags, i.e. tracking codes and associated code fragments, to be managed on our website. Google Tag Manager can be used to integrate Google services into a website.
When Google Tag Manager is used, a connection to Google’s servers is established. This means that Google stores the IP address of the browser of the end device used by the visitor to these web pages. It cannot be ruled out that data is transferred to Google in the USA in this context and that US security authorities may have access to the data. However, cookies are not set in connection with the use of Google Tag Manager. For more information about Google Tag Manager and data processing by Google, please visit https://support.google.com/tagmanager/answer/6102821?hl=en&sjid=522631386220956380-EU and https://policies.google.com/privacy?hl=en.
Our legal basis for using Google Tag Manager is our legitimate interest pursuant to Art. 6(1)(f) GDPR. Our legitimate interest lies in the management of tracking codes in our online offering, which enable us to analyse the use of our online offering and to improve and personalise our services.

3.2.2 Commanders Act

As part of our online offering, we also use Commanders Act, a service provided by Fjord Technologies, 3 rue Saint-Georges, 75009 Paris. This is a management tool for marketing campaigns. We use the service as a consent tool and for editing metadata. By using it, we can provide our services to you as a user.
Commanders Act processes and stores information about your user behaviour on our website. For this purpose, Commanders Act uses, among other things, cookies, i.e. small text files that are stored locally in the cache of your web browser on your end device and which enable an analysis of your use of our website.
The legal basis for managing your consent settings is, on the one hand, our legitimate interest in an optimal design of our online offering. Furthermore, data is processed in order to obtain and document the legally required consents for the use of certain technologies, Art. 6(1)(c) GDPR.
The legal basis for the processing of data by Commanders Act beyond this is your consent in accordance with Art. 6(1)(a) GDPR.
Further information on data processing by Commanders Act can be found at https://www.commandersact.com/en/privacy/.

3.2.3 Cloudflare

We also use the Cloudflare service on our website, provided by the US-based company Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA. This is a content delivery network and various web services used, inter alia, to increase website loading times and protect against attacks. For these purposes, Cloudflare collects personal data of users, such as IP address as well as data relating to the accessed website, the browser type used and the operating system. Data transfers to the USA take place in compliance with the EU‑U.S. Data Privacy Framework. Further information on data processing by Cloudflare can be found in Cloudflare’s data protection information at https://www.cloudflare.com/privacypolicy/.
The legal basis for the use of Cloudflare is Art. 6(1)(f) GDPR; our legitimate interest lies in the technical optimisation of our online offering and in ensuring the security and stability of our web presence against unauthorised access. In this context, Cloudflare is used in particular to defend against bots and to protect against harmful automated scripts.

3.2.4 BrowseAid

For our online offering, we use the BrowseAid service provided by Machinas Ecommerce SRL, Sector 3, Str. DECEBAL, Nr. 25-29, Lvl. 9, 030965 Bucharest, Romania (hereinafter: “Machinas”).
BrowseAid supports us in analysing and improving our online offering by eliminating digital barriers and ensuring the accessibility of our content. We are obliged to do this under the Barrier-Free Access Strengthening Act (Barrierefreiheitsstärkungsgesetz – BFSG); further information can be found on our website at https://marcotozzi.com/en-IE/service/accessibility-statement. As part of the use of this service, your IP address is collected and cookies are set on your end device. Further information on data processing by Machinas can be found at https://browseaid.com/privacy-policy.
The legal basis for data processing is the fulfilment of our legal obligations under Section 3(1) Sentence 1 BFSG in conjunction with Art. 6(1)(c) GDPR.

3.3 Analytics services

We use various services to check and evaluate which content from our online offering is of particular interest and how users react to certain designs. In addition to classic analytics services such as Google Analytics, we also use tools for evaluating different designs (A/B testing).

3.3.1 Google Analytics

We use Google Analytics for statistical evaluations. Google Analytics is a web analytics service provided by Google. As part of Google Analytics, Google uses cookies, among other things, for evaluations. The type and scope of the use and evaluation of cookies are specified by Google. The information generated by the cookies about your use of the online offering is transmitted to a Google server and stored there. It cannot be ruled out that data is transferred to the USA and that public authorities may gain access to this data.
However, your IP address is shortened by Google beforehand on servers within the European Union by means of standard IP anonymisation.
On our behalf, Google uses this information to evaluate your use of the online offering, to compile reports on website activity and to provide us, as the operator of the online offering, with other services related to website and internet usage. For the analysis and optimisation of our online offering, we also work with advertising agencies that, as our processors, may have access to the data collected via Google Analytics. We have concluded contracts for commissioned processing with these service providers in accordance with Art. 28 GDPR in order to ensure the protection of your data. In addition, Google may use the data for its own purposes. As part of these purposes, Google may, for example, create profiles regarding user behaviour or link the data with other data, for example with an existing Google account. We have no influence on these data processing operations. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. For more information, please refer to the data protection information provided by Google, which is linked below.
We also use the “demographic features” function of Google Analytics. This allows reports to be created which contain statements on the age, gender and interests of visitors to the site. This data originates from interest-based advertising by Google and visitor data from third-party providers. You can deactivate this function at any time via the ad settings in your Google account or you can generally prohibit the collection of your data by Google Analytics as described in the paragraph below. Further information on the “demographic features” function can be found at Google under https://support.google.com/analytics/answer/2799357?hl. Further information on Google Analytics can be found at https://tools.google.com/dlpage/gaoptout?hl&hl=en and http://www.google.com/intl/de/analytics/privacyoverview.html. We would like to point out that on our websites Google Analytics has been extended by the code “anonymizeIp();” to anonymise IP addresses, whereby the last octet is deleted.
The legal basis for data processing is your consent in accordance with Art. 6(1)(a) GDPR.

3.3.2 Google Signals

On our online offering, we also use the Google Signals service from Google as an extension of Google Analytics.
We use the service to create cross-device evaluations of our online offering. If your devices are linked to your Google account, your usage behaviour is analysed across devices and database models are created, among other things, for cross-device conversions.
As part of Google Signals, Google uses cookies, among other things, for cross-device evaluations. The type and scope of the use and evaluation of cookies are specified by Google. The information generated by the cookies about your cross-device use of the online offering is transmitted to a Google server and stored there. It cannot be ruled out that data is transferred to the USA and that public authorities may gain access to this data. However, your IP address is shortened by Google beforehand on servers within the European Union by means of standard IP anonymisation.
On our behalf, Google uses this information to evaluate your cross-device use of the online offering, to compile reports on website activity and to provide us, as the operator of the online offering, with other services related to website and internet usage. In addition, Google may use the data for its own purposes. As part of these purposes, Google may create profiles regarding user behaviour or link the data with other data, particularly with an existing Google account. We have no influence on these data processing operations. For more information, please refer to Google’s privacy policy at: https://policies.google.com/privacy?hl=en.
The legal basis for the use of Google Signals is your consent in accordance with Art. 6(1)(a) GDPR.

3.3.3 Google Enhanced Conversion Tracking

For our online offering, we use Google Enhanced Conversion Tracking provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).
Google Enhanced Conversions supplement the existing conversion tags. Conversion tracking is used to create statistics to find out the total number of website users and to obtain information about which actions they have performed. With the help of enhanced conversions, conversions can be recorded more accurately. Conversion data on our online offering, which we as the controller have collected from users directly, can be encrypted and sent to Google via enhanced conversions. The data of website visitors is encrypted using a one-way hash algorithm (SHA256), so it is not possible to identify individuals. Enhanced conversions are used for customers who have provided data such as email address, name, home address or telephone number themselves, for example in the context of a customer account. Based on this information, customers are assigned to their Google accounts in which they were logged in at the time an interaction with the online offering took place. It cannot be ruled out that data is transferred to the USA in this context and that US security authorities may have access to this data.
Further information can be found in Google’s privacy policy at https://policies.google.com/privacy?hl=en and at https://support.google.com/google-ads/answer/9888656.
The use of this service is subject to your express consent. The legal basis for the use of the service is Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future.

3.3.4 Microsoft Advertising

On our online offering, we use the conversion tracking technology “Microsoft Advertising” provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (“Microsoft”). The service uses cookies or similar technologies. In this way – if you have reached our online offering via an advertisement from Microsoft Advertising – interactions you make (such as page views, clicks on an advertisement, downloads) are recorded and analysed. The service is used to show you interest-based advertisements for our products on other websites and to optimise our online offering. As part of the technical process, personal data may be stored on Microsoft’s servers in the United States. It cannot be ruled out that US security authorities gain access to this data. The USA does not have a data protection level comparable to that of the EU.
If you have a Microsoft account, Microsoft may be able to link your web and app browsing history to your Microsoft account and use information from your account to personalise ads. If you do not want such an allocation to your account, you must log out of your Microsoft account before visiting our online offering.
The legal basis for the data processing is your consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future.
Further information on data protection at Microsoft can be found at: https://www.microsoft.com/en-us/privacy.

3.3.5 Amplitude

On our online offering, we also use the analytics service Amplitude provided by Amplitude Inc., 501 2nd Street, Suite 100, San Francisco, CA 94107, USA, for usage analysis.
When using the service, your order number and your IP address in anonymised form are recorded, among other things. In addition, the service records several parameters for analysing the use of our online offering, such as clicks and page views. These statistical data are used to analyse the use of our online offering and thus to optimise your visit experience. If the order number is not recorded, evaluations are carried out without any personal reference.
Further information on data protection at Amplitude can be found at: https://amplitude.com/privacy.
The legal basis for the use of Amplitude is your consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future. If the order number is not collected, the legal basis is our legitimate interest in an optimal design of our online offering in accordance with Art. 6(1)(f) GDPR.

3.3.6 Use of Salesforce (Commerce Cloud & Einstein)

We use services of salesforce.com Germany GmbH (Erika-Mann-Str. 31, 80636 Munich; hereinafter: “Salesforce”) for operating our online offering and managing our customer relationships. Salesforce Commerce Cloud (formerly Demandware) is a cloud-based B2C platform for managing our online shop. This includes the provision of the shop system as well as the personalisation of the shopping experience. In this context, data such as order history, shopping carts and interaction data is processed. We use the Salesforce Cloud to manage existing and potential customer contacts and organise sales and communication processes, consolidating customer data. We use the Salesforce Einstein service for natural language processing. This helps us to refine search queries, automate content and provide you with personalised product suggestions. As part of the use of Salesforce services, it cannot be ruled out that personal data is stored on servers of Salesforce, Inc. in the USA and that US security authorities may have access to the data. However, Salesforce, Inc. is an active participant in the EU‑U.S. Data Privacy Framework (DPF), which ensures an adequate level of data protection. In addition, Salesforce has implemented binding corporate rules (BCRs) to ensure the protection of personal data also in case of intra-group transfers within the Salesforce group. These rules can be accessed online at https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/Salesforce-Processor-BCR.pdf.
The use of Salesforce services is based on our legitimate interests in accordance with Art. 6(1)(f) GDPR. Our legitimate interests lie in the efficient management of our customer relationships, the provision of a secure and high-performance online shop and the continuous optimisation of our service offering. You can find more information about data processing by Salesforce at https://www.salesforce.com/company/legal/privacy/.
Cookies are also used when using Salesforce. The legal basis for the use of cookies is your consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, for example by adjusting the cookie settings in your browser or adjusting your preferences in our cookie consent tool. Otherwise, the collected data will be stored until the purpose of the data collection no longer applies or you request us to delete it. Statutory retention periods remain unaffected.

3.3.7 Bloomreach

For our online offering, we use Bloomreach, a service provided by Bloomreach Inc., 700 E El Camino Real 130, Mountain View, CA 94041, USA. Bloomreach is a cloud-based e‑commerce experience platform and a B2B service specialising in marketing automation, product search and content management systems. We use Bloomreach to centralise, consolidate and store customer data. This increases transparency across various customer touchpoints throughout the customer journey and creates a database for targeted, personalised customer service measures. This particularly includes our email marketing activities. In this case, Bloomreach processes the following data if you have provided it when registering for our newsletter: your first and last name, your gender and your email address. The data collected for analysis and marketing purposes is merged into a user profile so that we can send you a newsletter tailored to your interests. Further information on data protection when registering for our newsletter can be found in the relevant section of this privacy policy.
The personal data processed by Bloomreach and the content of the online offering are stored on servers operated by Bloomreach. The personal data processed may include information such as names, contact details, job titles, account access data, billing information, IP addresses, device and browser data, location data, time zone settings, online activities, interaction and transaction history, user preferences and other data that is provided directly by you or collected during your visit to our website. The tracking data collected by Bloomreach is stored for a maximum of six months. It can be used, among other things, to identify content from the online offering that is relevant for the user and to analyse and evaluate user behaviour. It cannot be ruled out that data is transferred to the USA in this context and that US security authorities may have access to the data. All data processed in this context is used exclusively for the processing purposes described by us. The use of this service is based on our legitimate interests in accordance with Art. 6(1)(f) GDPR, which result from the processing purposes described. Further information on data protection at Bloomreach can be found at: https://www.bloomreach.com/en/legal/privacy.
The legal basis for our cooperation with Bloomreach and the processing of your data in connection with our newsletter management is your consent in accordance with Art. 6(1)(a) GDPR if you have explicitly subscribed to the newsletter. Further information on data protection in connection with our newsletter can be found in the relevant section of this privacy policy.
Cookies are also used when using Bloomreach. The legal basis for the use of cookies is your consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, for example by changing the cookie settings in your browser. Otherwise, the collected data will be stored until you request us to delete it or until the purpose of data storage no longer applies. Statutory retention periods remain unaffected.

3.3.8 Use of SAP Emarsys (Scarab Research)

For our online offering, we use the service provided by SAP Emarsys (Scarab Research), a company of Emarsys Interactive Services GmbH (Stralauer Allee 6, 10245 Berlin), which is part of the SAP group. This service is used to analyse user behaviour so that we can optimise our website and display personalised content and product recommendations (so-called recommendation engine). Pseudonymised data about your interactions with our website (e.g. products viewed, shopping cart contents) is collected and evaluated.
As part of this service, cookies are stored on your device. These include in particular the Scarab Research control cookie, which is used in connection with the website’s Content Delivery Network (CDN). This cookie serves the technical control and efficient delivery of personalised content via the CDN as well as the identification of visitors across different sessions. Data processing is based on your express consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, for example by adjusting the cookie settings in your browser or setting preferences in our cookie consent tool. Otherwise, the data collected will be stored until the purpose of data collection no longer applies or until you request us to delete it. Statutory retention periods remain unaffected. Please refer to the Emarsys privacy policy at https://emarsys.com/privacy-policy/ and the general SAP privacy notice at https://www.sap.com/germany/about/legal/privacy.html for more information about data processing by SAP Emarsys.

3.3.9 Prismic

On our online offering, we use Prismic, a service provided by New Prismic SAS (9, Rue de la Pierre Levée, 75011 Paris, France; hereinafter: “Prismic”). Prismic is a cloud-based headless content management system (CMS), including a content delivery network (CDN), which helps us to manage content efficiently and deliver it quickly across various digital channels.
By using Prismic, the presentation layer of our website is separated from content management, which enables central and high-performance content delivery. In this context, technical data such as your IP address and device and browser information is processed in order to correctly deliver the requested content. The use of Prismic is based on our legitimate interests in accordance with Art. 6(1)(f) GDPR. Our legitimate interests lie in the stable, fast and cross-media provision of our website content and in efficient management of our content workflow. Further information on data protection at Prismic can be found at https://prismic.io/legal/privacy.
Cookies are also used when using Prismic, which enable us to recognise your browser and optimise the use of the features provided. The legal basis for the use of these cookies is your consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, for example by changing the cookie settings in your browser or setting preferences in our cookie consent tool. Otherwise, the data collected will be stored until the purpose of data collection no longer applies or until you request us to delete it. Statutory retention periods remain unaffected.

3.3.10 Contentful

On our online offering, we use Contentful, a service provided by Contentful GmbH, Max-Urich-Straße 3, 13355 Berlin. Contentful is a headless content management system that helps us provide content across multiple channels. To this end, the presentation layer in which our content is displayed is separated from the backend in which the content is managed. This allows us to manage the content centrally, independently, quickly and on a large scale and make it available on different digital channels. The use of this service is based on our legitimate interests in accordance with Art. 6(1)(f) GDPR; our legitimate interests result from the purposes of processing described. Further information on data protection at Contentful can be found at: https://www.contentful.com/legal/privacy-at-contentful/privacy-notice/.
Cookies are also used when using Contentful. The legal basis for the use of cookies is your consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, for example by changing the cookie settings in your browser or contacting Contentful directly. Contentful also allows you to set your preferences yourself. Further information on this can be found at: https://preferences.contentful.com/.
The data collected is stored until you request us to delete it or until the purpose of data storage no longer applies, or until you delete the cookies set by Contentful yourself. Statutory retention periods remain unaffected.

3.4 Retargeting and remarketing

Retargeting and remarketing are technologies which allow users who have previously visited a particular website to be shown relevant advertising even after leaving that website. To do this, it is necessary to recognise internet users beyond your own website, for which cookies from the respective service providers are used; previous usage behaviour is also taken into account. For example, if a user views certain products, these or similar products can later be displayed as advertising on other websites. This is personalised advertising that is tailored to the needs of individual users. For this personalised advertising, it is not necessary to identify the user beyond the recognition process. We therefore do not merge the data used for retargeting or remarketing with other data.

3.4.1 Google Remarketing and Google AdWords Conversion Tracking

We use such technologies for displaying ads on the internet. For displaying these ads we use various third-party providers. In particular, we use Google’s services, which enable the automatic display of products of interest to internet users. This function is implemented through cookies. It cannot be ruled out that data is transferred to Google in the USA as part of this process and that US security authorities have access to such data.
Further information on this technology can be found in Google’s privacy policy at https://policies.google.com/privacy?hl.&hl=en. The installation of cookies for Google Remarketing and Google AdWords Conversion Tracking can be prevented in advance through a corresponding setting in your browser software by visiting http://www.google.com/policies/privacy/ads/ and changing the relevant settings.
The legal basis is your consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, for example by changing the cookie settings in your browser or adjusting your preferences in our cookie consent tool. Otherwise, the data collected is stored until the purpose of data collection no longer applies or until you request us to delete it. Statutory retention periods remain unaffected.

3.4.2 Facebook Custom Audience

Remarketing tags provided by Meta Platforms Inc., 1 Hacker Way, Menlo Park, CA 94025, USA (“Facebook”) are integrated into our online offering. When you visit our online offering, a direct connection is established between your browser and Facebook’s servers via the remarketing tags. As a result, Facebook receives the information that you have visited our online offering using your IP address. In this way, Facebook can associate your visit to our online offering with your Facebook user account, where you are registered there. The information obtained in this way can be used by us to place advertisements via Facebook. It cannot be ruled out that data is transferred to Facebook servers in the USA and that US security authorities may have access to this data. We would like to point out that we do not receive any further information about the content of the transmitted data or how it is used by Facebook. Further information can be found in Facebook’s privacy policy at <www.facebook.com/about/privacy/&gt;.
The legal basis for the use of remarketing tags is your consent in accordance with Art. 6(1)(a) GDPR. If you do not want data to be collected via Facebook’s remarketing tags, you can deactivate the use of Facebook Custom Audience via the following link: <www.facebook.com/ads/website_custom_audiences/&gt;.

3.5 Affiliate marketing

As part of our online offering, we also use affiliate marketing. This is an online-based sales method in which providers of other online offerings (often referred to as “merchants” or “advertisers”) refer users to our online offering. If a page visit or purchase is made on our online offering following such referral, a fee may be paid as a click or sale commission. In affiliate marketing, we work together with a service provider.
The service provider uses cookies to record user activities. The tracking cookie does not store any personal data; it only stores an identification number of the affiliate, i.e. the partner who referred the potential customer, and a serial number. The purpose of storing this data is to process commission payments. The legal basis is your consent in accordance with Art. 6(1)(a) GDPR.

3.5.1 Tradedoubler

On our online offering, we use services provided by Tradedoubler GmbH, Mainzer Straße 13, 80804 Munich, to conduct affiliate marketing. This enables us to place advertisements via Tradedoubler’s publisher network and to track which third-party providers (publishers) have referred potential or actual customers to us.
Tradedoubler uses cookies and comparable browser technologies to record referral activities. A tracking cookie is placed on your end device to enable the processing of commission payments between us and the referring partner (affiliate). This cookie generally does not store any directly identifiable personal data, but only an identification number of the partner (affiliate ID) and a serial number used to assign the click or purchase. The purpose of processing is the statistical evaluation and the correct billing of advertising success within the affiliate network.
The use of cookies and the subsequent processing of your personal data for commission billing is based exclusively on your consent in accordance with Art. 6(1)(a) GDPR. The data is stored for as long as necessary for the fulfilment of this purpose, i.e. the billing of commissions, or until you withdraw your consent. Statutory retention periods remain unaffected. You can withdraw your consent at any time with effect for the future by adjusting the settings or your preferences in our cookie consent tool or by deleting the cookies set by Tradedoubler via your internet browser. Further information on data processing and data protection at Tradedoubler can be found at: https://www.tradedoubler.com/privacy-policy/ and the additional information at: https://www.tradedoubler.com/gdpr.

3.6 Interactive elements and additional features

We use services from third-party providers to realise various services in our online offering, for example for embedding maps, displaying fonts or embedding videos.

3.6.1 Google Maps

For our online offering, we use the Google Maps mapping service. Google Maps is a service provided by Google. For maps embedded in our online offering, only technically necessary cookies are set.
In order to comply with data protection regulations, the terms of use for the mapping service include data protection provisions which serve to protect you. Google’s terms of use for the mapping service can be found at https://www.google.com/intl/de_US/help/terms_maps.html. General information about Google’s data protection is available at https://policies.google.com/privacy?hl=en&amp;gl=de.
The legal basis for embedding the mapping service is Art. 6(1)(f) GDPR; our legitimate interest lies in providing map material for your orientation. Our legal basis for setting cookies in connection with the use of Google Maps is your consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, for example by changing the cookie settings in your browser or adjusting your preferences in our cookie consent tool. Otherwise, the data collected will be stored until the purpose of data collection no longer applies or until you request us to delete it. Statutory retention periods remain unaffected.

3.6.2 Use of web fonts

For our online offering, we use web fonts from Google (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland) and Adobe (Adobe Systems Software Ireland Limited, 4-6 Riverwalk, City West Business Campus, Saggart, Dublin 24, Ireland) as external fonts. These web fonts are embedded using a server call, usually to a server owned by Google or Adobe. This informs the server which of our websites you have visited. The IP address of the browser used by the visitor’s end device is also stored by Google and/or Adobe. It cannot be ruled out that data is transferred to the USA in this context and that US security authorities may have access to such data. For more information on data processing by Google and Adobe, please refer to the privacy policies provided by Google and Adobe, which can be accessed at:
<www.google.com/fontsAboutPlace:about&gt;
<www.google.com/policies/privacy/&gt;
<www.adobe.com/de/privacy/policies/typekit.html&gt;
The legal basis for embedding web fonts is Art. 6(1)(f) GDPR; our legitimate interest is the optimisation of our online offering.

3.6.3 Use of YouTube

Our online offering includes YouTube videos, the playback of which is realised via a plugin of the YouTube service operated by Google (hereinafter: “YouTube”). The provider of the service is Google. We use YouTube in extended data protection mode in order to protect your privacy as much as possible. When you access a webpage of our online offering on which a YouTube video is embedded, Google initially only receives the information that is technically necessary for embedding and no cookies are set for the purpose of usage analysis. Only when you play the embedded video does Google receive further information; in this context, Google may also set cookies to analyse your user behaviour. When the video is played, the YouTube servers operated by Google are informed, for example, which page of our online offering you are using to play the video.
If you are logged into your Google account, you allow Google or YouTube to assign your browsing behaviour directly to your personal Google profile. We therefore recommend that you only play embedded YouTube videos if you agree to the data processing by Google associated with this. You can prevent data being associated with your Google profile by logging out of your YouTube account. Further information on how user data is handled can be found in Google’s privacy policy at https://policies.google.com/privacy?hl=en&amp;gl=de which also applies to YouTube.
We use YouTube to show you videos and provide you with better information about us and our services. The legal basis for embedding the videos is our legitimate interest within the meaning of Art. 6(1)(f) GDPR; however, playing the videos and the associated further data processing only take place on the basis of your consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, for example by changing the cookie settings in your browser or adjusting your preferences in our cookie consent tool. Otherwise, the data collected will be stored until the purpose of data collection no longer applies or until you request us to delete it. Statutory retention periods remain unaffected.

3.6.4 Embedding videos via bunny.net

Videos are embedded in our online offering via the bunny.net service using the native video player or an iframe. The provider of the service is BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia (hereinafter: “Bunny”).
When you access a webpage of our online offering on which a video is embedded via Bunny, a connection is established to Bunny’s servers. The video or the content of the iframe is transmitted directly from Bunny to your browser and embedded into the page. In this context, the server is informed, for example, which webpages of our online offering you have visited. If you interact with the video, this information is also transmitted to Bunny’s servers.
Further information about data protection at Bunny can be found in Bunny’s privacy policy at https://bunny.net/privacy/.
We use Bunny to show you videos and inform you about us and our services. The legal basis for embedding the videos is our legitimate interest within the meaning of Art. 6(1)(f) GDPR.

4 Order processing

We use your personal data for orders only within our company and affiliated companies and with companies commissioned with the processing of orders.

4.1 Storage and data transfer in connection with orders

For order processing, we cooperate with various companies responsible for payment processing and logistics. We ensure that our partners also comply with data protection regulations. For example, we pass on your address data (name and address) to the transport company which delivers the ordered products to you. The legal basis for this is Art. 6(1)(b) GDPR. The processing of your personal data is necessary for the performance of the contract with you.
We store the data for as long as it is required for the performance of the contract. After that, we store this data to fulfil post-contractual obligations and due to commercial and tax law retention periods for the legally prescribed period. This retention period is generally 10 years from the end of the respective calendar year.

4.2 Payment processing for orders

Depending on the selected payment method, payment processing for orders may be carried out using a payment service provider.
If you pay by credit card, your necessary data such as name, address and purchase data will be passed on to the respective credit card company.
If you pay via PayPal, you will be redirected to the PayPal website via a link. In this context, your personal data is processed. This includes your name, address, email address, any telephone number and account or credit card data. Please refer to the General Terms and Conditions, Terms of Use and Privacy Policy of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, on the website <www.paypal.com&gt;. For safety’s sake, we would like to point out that for payment methods such as “credit card via PayPal”, “direct debit via PayPal” or “purchase on account via PayPal”, PayPal reserves the right to carry out a credit check. In this context, your payment data is exchanged with credit agencies based on PayPal’s legitimate interest in ensuring your identity and creditworthiness in accordance with Art. 6(1)(f) GDPR. The result of the credit check is usually a “score” value that describes your statistical probability of default and is used by PayPal to decide whether and, if so, which payment method to offer you. For more information on the credit check carried out by PayPal please refer to https://www.paypal.com/de/legalhub/paypal/creditchk.
Please note that PayPal also uses cookies and other tracking technologies. These are used to ensure the functionality and security of payment transactions and for marketing purposes. Data processing is based on your consent in accordance with Art. 6(1)(a) GDPR (in particular for marketing cookies) or on legitimate interests in accordance with Art. 6(1)(f) GDPR (e.g. to ensure technical functionality and, in particular, fraud prevention). If you use PayPal, you can change your cookie preferences selected with PayPal at any time at https://www.paypal.com/myaccount/privacy/cookiePrefs?locale=en_DE. Users with a PayPal account can also deactivate personalised advertising or withdraw any consents they may have granted (e.g. for marketing cookies) with effect for the future in the “Data & Privacy” section. Further information can be found in PayPal’s statement on cookies and other tracking technologies at https://www.paypal.com/en/legalhub/paypal/cookie-full.
If you select a Klarna payment method, your necessary data – in particular name, contact details and other identification information as well as payment information and creditworthiness data – is transferred to and processed by Klarna Bank AB, Sveavägen 46, 11134 Stockholm, Sweden (“Klarna”). Information on data protection at Klarna can be found at https://www.klarna.com/de/datenschutz/ and https://www.klarna.com/international/privacy-policy/.
In the case of purchase on account, it may be necessary to carry out a credit check during the ordering process, for which we provide more specific information below. In the event of a positive credit check, you will receive the relevant invoice from our service provider, which you can pay by bank transfer to our account. If you pay in advance, no assessment by service providers is carried out; the goods are dispatched after payment has been received by us.
The legal basis for payment processing is Art. 6(1)(b) GDPR. The processing of your personal data is necessary for the performance of the contract with you, with the payment method being freely selectable by you.
We store the data for as long as it is required for the performance of the contract. After that, we store this data to fulfil post-contractual obligations and due to commercial and tax law retention periods for the legally prescribed period. This retention period is generally 10 years from the end of the respective calendar year.

4.3 Credit check

Depending on the selected payment method, it may be necessary to check your creditworthiness. Specifically, a credit check is only required for purchases on account. In this case, if you give your consent to the credit check, we use external service providers to carry out the credit check and pass your data (name, address, date of birth, order value) on to them. For this purpose, we transmit the data to Unzer Group GmbH, Schöneberger Str. 21 a, 10963 Berlin. The legal basis for the credit check is Art. 6(1)(a) GDPR. If you do not wish to give your consent to the credit check, you may need to choose a different payment method.
As part of the credit check, an assessment is obtained as to the probability of a default in relation to our claim arising from the order. For data processing by Unzer Group GmbH (formerly Payolution), the data protection regulations and additional data protection information of this provider apply, which you can see at https://www.unzer.com/en/data-protection and https://www.unzer.com/en/datenschutzhinweise-payolution-endkunden/.

5 Customer account

You can create a customer account for our online offering on a voluntary basis. All information about you and your use of the various offerings is centrally managed in the customer account. This allows you to manage, update and, if necessary, delete all data. The legal basis for processing the data for registration is your consent in accordance with Art. 6(1)(a) GDPR. If you register with us for the purpose of fulfilling or initiating a contract, the legal basis for data processing is additionally Art. 6(1)(b) GDPR.

5.1 Registration for the customer account

You can register for the customer account online. To create the customer account, you only need to provide your name, an email address and protect the account with a password. We reserve the right to offer additional registration options in addition to online registration, to which these provisions apply accordingly.
To use the full functionality of the customer account, it may be necessary to verify the email address provided during registration. For this purpose, we will send a confirmation link to the email address provided, which you must follow. This procedure serves to protect your data and also ensures that communications regarding services, delivery status or payment status are sent to a valid email address.

5.2 Collection of data via the customer account

All data relating to your use of the online offering is stored in your customer account insofar as you log in to your customer account when using each service. This particularly includes personal data (name, age, addresses, delivery and payment information), vouchers, wish lists, purchase history, communication history, search and navigation behaviour, consents to individual services (e.g. newsletters), discount affinity and information on areas of interest explicitly or implicitly provided by the customer. We can create segments based on this data and assign customers to these segments. The assignment to such segments is also stored in the customer account. Location-based data such as your delivery addresses or your location is stored if you have given your consent.
Your current location may be used to provide you with location-based offers. If you do not want data to be stored in your customer account for individual situations, you can use the corresponding services without your customer account. If you want to completely stop storing data in your customer account, you can have your customer account deleted.

5.3 Social login

We offer you the option of using your existing profile with social networks provided by Meta (formerly Facebook; Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA) and Google (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland) for registration and login to our online offering. To do this, you can click on the respective Facebook or Google symbol during registration or login. Clicking on the respective symbol opens a new window where you can log in to the relevant provider. You will also be informed which data is transmitted for authentication and for registration or login. Based on your consent, it is also possible that additional data from your profile is transmitted to us. This data (such as your age or your likes) is used to optimise our offerings, including tailoring them to your interests. The legal basis for data processing is your consent in accordance with Art. 6(1)(a) GDPR.
To carry out authentication, a connection is established between your end device and the servers of the respective provider. This informs the provider of your IP address and possibly other information about your end device. We have no influence on this data processing by the provider. The privacy policies of the respective provider apply: http://www.facebook.com/policy.php and https://policies.google.com/privacy?hl=en.

5.4 Use of data from the customer account

We use the stored data to process our business relationship and – with your consent – to provide you with interesting and relevant offers via all communication channels you use. Based on the stored data, we try to determine which offers are relevant to you.
We may contact you as part of the business relationship using the contact information you have provided when you make use of individual services. For example, you will automatically receive order notifications or information about the delivery status; we will provide information in accordance with your selected preferences. Contact may be made by email, via messages on your smartphone or via other digital communication channels. Additionally, you can select optional communications and occasions; these include in particular special newsletters and app messages.

5.5 Storage period and deletion

The data generated from the use of the customer account is generally stored for the duration of the existence of the customer account, but can be deleted earlier upon request. Most of the data can be viewed online and – with the exception of the email address – changed or deleted. You can delete your customer account at any time by communicating your request for deletion to us, for example via the general contact form. In the case of immediate deletion, the data may not be recoverable if you register again later.

6 Communication with us

You can contact us in various ways, including via the contact form on our website, by email or by telephone. We would also be pleased to send you our newsletter by email on a regular basis. More detailed information on participation in competitions can also be found below.

6.1 Contact form

If you use the contact form in our online offering, we collect the personal data that you enter in the contact form, in particular your name and email address. We also store the IP address and the date and time of your request. We process the data transmitted via the contact form solely for the purpose of being able to respond to your request.
You decide yourself which information you wish to provide via the contact form. The legal basis for processing your data is your consent in accordance with Art. 6(1)(a) GDPR.
After we have processed the matter, the data will initially be stored in case of follow-up questions. You can request deletion at any time; otherwise the data will be deleted once the matter has been fully resolved. Statutory retention periods remain unaffected.

6.2 Telephone contact

Our online offering includes a telephone link which allows you to call our telephone number directly with a single click. If you contact us by telephone, we collect the personal data that you provide to us during the call, in particular your name and your telephone number. We also store the date and time of your call. We process the data transmitted in the context of the call solely for the purpose of being able to respond to your request.
You decide yourself which information you wish to provide during the call. The legal basis for processing your data is your consent in accordance with Art. 6(1)(a) GDPR.
After we have processed the matter, the data will initially be stored in case of follow-up questions. You can request deletion at any time; otherwise we will delete the data once the matter has been fully resolved. Statutory retention periods remain unaffected.

6.3 Newsletter

The MARCO TOZZI newsletter is sent jointly by Wortmann Fashion Retail GmbH & Co. KG, Klingenbergstraße 1-3, D-32758 Detmold, and MARCO TOZZI Shoes GmbH & Co. KG, Klingenbergstraße 1-3, D-32758 Detmold, as joint controllers under data protection law. Both companies may therefore send you the MARCO TOZZI newsletter you have requested in your consent both jointly and independently of each other. In accordance with data protection requirements, the two companies have entered into an agreement setting out their respective responsibilities. You can exercise your data subject rights, in particular withdraw your consent to the sending of the newsletter, with either of the two companies and in particular use the contact details provided in this privacy policy.
When you subscribe to our newsletter, your email address is used for our own advertising purposes until you unsubscribe. You will receive regular emails with information on current topics and emails for special occasions, e.g. for special promotions. The emails may be personalised and customised based on the information we hold about you.
If you do not provide your consent in writing, we use the double opt-in procedure for subscription to our newsletter. This means that we will only send you a newsletter by email if you have explicitly confirmed that we should activate the newsletter subscription. We will send you a notification email asking you to confirm that you would like to receive our newsletter by clicking on a link contained in this email.
The legal basis for processing your data is your consent in accordance with Art. 6(1)(a) GDPR if you have explicitly subscribed to the newsletter. In accordance with statutory provisions, it may also be possible that you receive our newsletter without explicit consent if you have ordered goods or services from us and we have received your email address in this context and you have not objected to receiving such information by email. In this case, the legal basis is our legitimate interest in sending direct advertising within the meaning of Art. 6(1)(f) GDPR.
If you no longer wish to receive newsletters from us, you can withdraw your consent at any time with effect for the future or object to receiving further newsletters, without incurring any costs other than the transmission costs according to the basic tariffs. Simply use the unsubscribe link contained in every newsletter or send a message to us or our data protection officer.

6.3.1 Emarsys

To send our newsletter, we use the services of Emarsys eMarketing Systems GmbH, Lassallestraße 7b, 1020 Vienna, Austria (“Emarsys”). Emarsys provides various analysis options to determine the extent to which the newsletters sent are opened and used, e.g. how many users an email was sent to, whether emails were bounced or whether users unsubscribed from the list after receiving an email. Pseudonymous user profiles are created as part of the analysis.
Emarsys also uses cookies for its services. Your newsletter usage data is linked to your Emarsys account if you have subscribed to the newsletter and created a customer account with us. Further information on data protection in connection with Emarsys can be found at: https://emarsys.com/privacy-policy/.
The legal basis for cooperation with Emarsys is your express consent in accordance with Art. 6(1)(a) GDPR.

6.4 Competitions

From time to time, we offer competitions via our online offering or other channels. You can register for participation in the competition on a voluntary basis; participation may require solving tasks or submitting contributions. To participate, you need to provide contact details, which we use exclusively to conduct the competition. Unless otherwise specified in the specific case, data from the competition will not be merged with other data. Participation and chances of winning are independent of other factors, such as the purchase of goods or the granting of optional consent to advertising.
After completion of the competition, your data will be stored for a period of six months, unless you request earlier deletion. This temporary storage is to enable us to examine any enquiries and complaints. After that, all participants’ data will be deleted. This does not include data which, based on an explicit agreement with the respective participant, is retained for a longer period. This may include, for example, information about the winner. You are not obliged to enter into such agreements with us. Regardless of such an agreement, it is permissible to publish participant data in anonymised form (e.g. “Max M. from M.”).
The legal basis for data processing is Art. 6(1)(a) GDPR (consent in the context of participation in the competition) and Art. 6(1)(b) GDPR (execution of the competition).

7 Social media

In addition to our online offering, we also use various social media channels for information and communication purposes, which are linked from our online offering. Specifically, we use the social networks Facebook, Pinterest, Instagram, YouTube and TikTok. These links are indicated by the respective provider’s logo.
By clicking on the links, the respective social media channels are opened, to which the primary privacy policies of the platform providers apply; these can be found at:
Facebook: http://www.facebook.com/policy.php
Instagram: https://help.instagram.com/155833707900388
Pinterest: https://policy.pinterest.com/en/privacy-policy
YouTube: https://policies.google.com/privacy?hl=en
TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/en
No personal information is transmitted to the respective providers before the corresponding links are called up. Your access to the linked site is the basis of data processing by the respective providers.
The following information regarding the processing of your personal data also applies to our use of the social media channels Facebook, Instagram and Pinterest.
If you have any questions about our use of personal data in connection with the use of social media channels, you can contact us and our data protection officer at any time. If you have general questions about data protection relating to the social media channels, we ask that you contact the respective provider directly whose contact details are provided below.
We would also like to draw your attention to the information provided by the German Federal Office for Information Security (BSI) on its website at https://www.bsi.bund.de/EN/Themen/Verbraucherinnen-und-Verbraucher/Informationen-und-Empfehlungen/Onlinekommunikation/Soziale-Netzwerke/soziale-netzwerke_node.html regarding the safe use of social networks.

7.1 Facebook fanpage

In addition to our own online offering, we operate several fanpages on the social network Facebook. We use our fanpages to provide information about our activities and offer a communication channel. The social network Facebook is operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (hereinafter: “Meta”). We use Meta’s platform and services.

7.1.1 Allocation of responsibilities

Please note that you use the fanpage and its functions under your own responsibility, especially with regard to interactive functions such as commenting, sharing or rating. Alternatively, you can access the information offered on the fanpage via our website.
Within the scope of the possibilities on Facebook, we do our best to ensure the protection of your privacy and personal data. Insofar as your personal data is processed by us in connection with visiting our fanpages, the explanations in this privacy policy apply without limitation. Due to the integration of the fanpages into Facebook’s offering, it must also be noted that personal data is processed by Meta at the same time. When you visit the fanpages, Meta collects, among other things, your IP address and additional information that is stored in the form of cookies on your end device and/or in your browser. We have no influence on this data processing by Meta; in particular, Facebook does not act as a processor for us. According to Meta, Facebook’s guidelines apply to data processing carried out by Facebook, which can be accessed at https://facebook.com/policy.php. We would like to point out that data collected by Meta in this context about you may also be transferred outside the European Union.
From a data protection point of view, Meta and we are joint controllers for the operation of the fanpage and the evaluation of usage data when visiting our fanpages. In accordance with data protection requirements, we have entered into an agreement with Meta setting out our respective responsibilities.

7.1.2 Facebook Insights

Meta offers fanpage operators the “Page Insights” function to provide an overview of the use of the fanpage and its users. Page Insights allows statistical data to be accessed and evaluated. We use Page Insights to optimise our fanpages and make them as attractive and efficient as possible. For this purpose, Meta provides us with data that Meta itself has generated. Further information on the functionality and responsibilities in relation to Page Insights is provided by Facebook at https://www.facebook.com/legal/terms/page_controller_addendum.

7.1.3 Messenger

Registered Facebook users also have the option of direct communication via Facebook Messenger. If you contact us via Messenger, the data transmitted will be stored and used by us solely for the purpose of responding to your enquiry. The legal basis for processing your data is your consent within the meaning of Art. 6(1)(a) GDPR and our legitimate interest within the meaning of Art. 6(1)(f) GDPR. Our legitimate interest lies in recording and processing customer enquiries, analysing customer enquiries and preventing misuse.
The data is deleted as soon as it is no longer required for the purpose for which it was collected. For your personal data, this is normally the case when the relevant conversation has ended. The conversation is deemed to have ended for us when the circumstances indicate that the matter in question has been conclusively clarified. You can withdraw your consent to the processing of personal data at any time; in this case, the data will be deleted immediately if there is no basis for further storage.

7.1.4 Further information about Facebook

If you have any questions about our use of personal data in connection with our Facebook fanpages, you can contact us and our data protection officer at any time. The contact details and communication channels are explained in this privacy policy. For any questions regarding data protection at Facebook, please contact Meta directly.

7.2 Instagram account

We also operate several accounts on the social network Instagram. We use our Instagram accounts to publish our own content on our activities and to provide further communication channels. The social network Instagram is operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (hereinafter: “Meta”).
Please note that you use Instagram and its functions under your own responsibility, especially for interactive functions such as commenting, sharing or rating.

7.2.1 Data protection responsibility

Within the scope of the possibilities on Instagram, we do our best to ensure the protection of your privacy and personal data. Insofar as your personal data is processed by us in connection with visiting one of our Instagram accounts, the explanations in this privacy policy apply without limitation. Due to the integration of our accounts into Meta’s offering, it must also be noted that personal data is processed by Meta at the same time. When you access our Instagram content, Meta collects, among other things, your IP address and further information that is stored in the form of cookies on your end device and/or in your browser. We have no influence on this data processing by Instagram; in particular, Meta does not act as a processor for us. For data processing by Facebook (Meta), Meta’s guidelines apply, which can be accessed at https://www.facebook.com/help/instagram/155833707900388. We would like to point out that data collected by Meta in this context about you may also be transferred outside the European Union.
From a data protection point of view, Meta and we are separately responsible controllers for operating our Instagram accounts and the associated communication and analysis options. Insofar as your personal data is processed by us in connection with visiting our Instagram accounts and we alone decide on the purposes and means of this processing, we are responsible for this processing. This is usually the case when you contact us directly through the “Instagram Direct Messaging” function and provide us with your data. Insofar as your personal data is processed by Meta and Meta alone decides on the purposes and means of data processing, Meta is solely responsible for this data processing. This applies in particular to Meta’s analysis of user behaviour for its own purposes.

7.2.2 Instagram Insights

Meta offers operators of Instagram accounts the “Instagram Insights” function to provide an overview of the use of the account and its users. Instagram Insights allows statistical data to be accessed and evaluated. We use the data from Instagram Insights to optimise our Instagram accounts and make them as attractive and efficient as possible. For this purpose, Meta provides us with data that Meta has generated in its own responsibility. The data we receive from Meta is mostly anonymised data and statistics. Insofar as we receive personal data in this context, we are responsible for the further processing of this data for analysing the use of our Instagram accounts.
Further information on Instagram Insights is provided by Meta at https://help.instagram.com/1533933820244654?locale=en.

7.2.2 Instagram Direct Messaging

On Instagram, you can contact us directly using the “Instagram Direct Messaging” function. If you contact us via Instagram Direct Messaging, the data transmitted will be stored and used by us solely for the purpose of responding to your enquiry. The legal basis for processing your data is your consent within the meaning of Art. 6(1)(a) GDPR and our legitimate interest within the meaning of Art. 6(1)(f) GDPR. Our legitimate interest lies in recording and processing customer enquiries, analysing customer enquiries and preventing misuse.
The data is deleted as soon as it is no longer required for the purpose for which it was collected. For your personal data, this is normally the case when the relevant conversation has ended. The conversation is deemed to have ended for us when the circumstances indicate that the matter in question has been conclusively clarified. You can withdraw your consent to the processing of personal data at any time; in this case, the data will be deleted immediately if there is no basis for further storage.

7.2.3 Further information about Instagram

If you have any questions about our use of personal data in connection with our Instagram accounts, you can contact us and our data protection officer at any time. The contact details and communication channels are explained in this privacy policy. For any questions about data protection relating to the social network Instagram provided by Meta, please contact Meta directly.

7.3 Pinterest profile

We also have an account on the social network Pinterest. We use this account to inform you about our activities and provide an additional communication channel. The social network Pinterest is operated by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland (hereinafter: “Pinterest”). Please note that you use the social network and its functions under your own responsibility. This applies in particular to the use of interactive functions.

7.3.1 Processing of personal data

The data collected about you when you use the service is processed by Pinterest and may be transferred to countries outside the European Union. The data processed includes, among other things, data voluntarily provided by you such as your name, username, email address and telephone number, content that you create, upload or receive (e.g. photos and videos), your IP address, information about the end device used, information about websites and content accessed as well as your location. We have no influence on the type and scope of the data processed by Pinterest, the type of processing and use or the transfer of this data to third parties. Information on the data that is processed by Pinterest and the purposes for which it is used can be found in Pinterest’s privacy policy at https://policy.pinterest.com/en/privacy-policy.
From a data protection point of view, Pinterest and we are separately responsible controllers for operating the Pinterest account and the associated communication and analysis options. Insofar as your personal data is processed by us in connection with your visit to our Pinterest presence and we alone decide on the purposes and means of processing, we are responsible for this processing. This is usually the case when you contact us directly using the messenger function and provide us with your data. Insofar as your personal data is processed by Pinterest and Pinterest alone decides on the purposes and means of data processing, Pinterest is solely responsible for this data processing. This applies in particular to Pinterest’s analysis of user behaviour for its own purposes.
We process the data that you enter on Pinterest – in particular your username and the content that you publish on your account – insofar as we include your posts in our offering by pinning or linking them or by writing our own posts that refer to your account. The data you have publicly published and disseminated on Pinterest will therefore be integrated into our offering and made accessible to our followers.
You can restrict the processing of your data by using the general settings of your Pinterest account. Furthermore, you can restrict Pinterest’s access to your data in the settings of your mobile device. However, this depends on the operating system used.

7.3.2 Pinterest Analytics

Pinterest offers account holders the “Analytics” function to provide an overview of the use of the account and its users. The Analytics function allows statistical data to be accessed and evaluated. We use the data to optimise our Pinterest account and make it as attractive and efficient as possible. For this purpose, Pinterest provides us with data that Pinterest generates in its own responsibility. The data we receive from Pinterest is mostly anonymised data and statistics. Insofar as we receive personal data in this context, we are responsible for the further processing of this data for analysing the use of our Pinterest account. Further information is provided by Pinterest at https://business.pinterest.com/analytics-and-measurement?change_language=true.

7.3.3 Messenger

On Pinterest, you can contact us directly via the messenger. If you contact us via this function, the data transmitted will be stored and used by us solely for the purpose of responding to your enquiry. The legal basis for processing your data is your consent within the meaning of Art. 6(1)(b) GDPR and our legitimate interest within the meaning of Art. 6(1)(f) GDPR. Our legitimate interest lies in recording and processing customer enquiries, analysing customer enquiries and preventing misuse.
The data is deleted as soon as it is no longer required for the purpose for which it was collected. For your personal data, this is normally the case when the relevant conversation has ended. The conversation is deemed to have ended for us when the circumstances indicate that the matter in question has been conclusively clarified. You can withdraw your consent to the processing of personal data at any time; in this case, the data will be deleted immediately if there is no basis for further storage.

7.3.4 Further information about Pinterest

If you have any questions about our use of personal data in connection with our Pinterest account, you can contact us and our data protection officer at any time. The contact details and communication channels are explained in this privacy policy. For any questions about data protection at Pinterest, please contact Pinterest directly.

7.4 TikTok

In addition to our own online offering, we also operate a channel on the social network TikTok. We use this TikTok channel to inform you about our activities and offer a communication channel. The social network TikTok is operated by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London, EC1A 9HP, United Kingdom (hereinafter: “TikTok”).
Please note that you use the social network TikTok and its functions on your own responsibility. This applies in particular to the use of interactive functions (e.g. likes, sharing and comments).

7.4.1 Processing of personal data

The data collected about you when you use the service is processed by TikTok and may be transferred to countries outside the European Union. The data processed includes, among other things, data voluntarily provided by you such as your name, username, date of birth, email address and telephone number, content that you create, upload or receive, information about contacts, purchase information and other information provided by you, your IP address, the application used, information about your end device and operating system (including device ID and application ID), information about websites you have visited, your location and mobile service provider and information on how you use the service. This data is associated with your TikTok account data. We have no influence on the type and scope of data processed by TikTok, the type of processing and use or the transfer of this data to third parties. Information on the data that is processed by TikTok and the purposes for which it is used can be found in TikTok’s privacy policy at https://www.tiktok.com/legal/page/eea/privacy-policy/en.
From a data protection point of view, TikTok and we are separately responsible controllers for operating the TikTok account and the associated communication and analysis options. Insofar as your personal data is processed by us in connection with your visit to our TikTok presence and we alone decide on the purposes and means of processing, we are responsible for this processing. This is usually the case when you contact us directly using the “Direct Messages” function and provide us with your data. Insofar as your personal data is processed by TikTok and TikTok alone decides on the purposes and means of data processing, TikTok is solely responsible for this data processing. This applies in particular to TikTok’s analysis of user behaviour for its own purposes.
We process the data that you enter on TikTok – in particular your username and the content that you publish on your account – insofar as we share or link your posts, respond to them or write our own posts that refer to your account. The data you have publicly published and disseminated on TikTok will therefore be integrated into our offering and made accessible to our followers.
You can restrict the processing of your data by using the general settings of your TikTok account as well as “Account and Privacy Settings” and “Security”. Furthermore, you can restrict TikTok’s access to your contact details, photos and videos, location data, etc. in the settings of your mobile device. However, this depends on the operating system used. Further information can also be found at https://support.tiktok.com/en/account-and-privacy and https://support.tiktok.com/en/safety-hc.

7.4.2 TikTok Analytics

TikTok offers account holders the “Analytics” function to provide an overview of the use of the account and its users. The Analytics function allows statistical data to be accessed and evaluated. We use TikTok Analytics data to optimise our TikTok account and make it as attractive and efficient as possible. For this purpose, TikTok provides us with data that TikTok generates in its own responsibility. The data we receive from TikTok is mostly anonymised data and statistics. Insofar as we receive personal data in this context, we are responsible for the further processing of this data for analysing the use of our TikTok account. Further information on Analytics is provided by TikTok at https://www.tiktok.com/analytics and https://www.tiktok.com/creators/creator-portal/en-us/tiktok-content-strategy/understanding-your-analytics/.

7.4.3 Direct messages

On TikTok, you can contact us directly using the “Direct Messages” function. If you contact us via Direct Messages, the data transmitted will be stored and used by us solely for the purpose of responding to your enquiry. The legal basis for processing your data is your consent within the meaning of Art. 6(1)(a) GDPR and our legitimate interest within the meaning of Art. 6(1)(f) GDPR. Our legitimate interest lies in recording and processing customer enquiries, analysing customer enquiries and preventing misuse.
The data is deleted as soon as it is no longer required for the purpose for which it was collected. For your personal data, this is normally the case when the relevant conversation has ended. The conversation is deemed to have ended for us when the circumstances indicate that the matter in question has been conclusively clarified. You can withdraw your consent to the processing of personal data at any time; in this case, the data will be deleted immediately if there is no basis for further storage.

7.4.4 Further information about TikTok

If you have any questions about our use of personal data in connection with our TikTok account, you can contact us and our data protection officer at any time. The contact details and communication channels are explained in this privacy policy. For any questions about data protection at TikTok, please contact TikTok directly.

8 Your rights and contact

We attach great importance to explaining the processing of your personal data in as transparent a manner as possible and to informing you about your rights. If you require more detailed information or wish to exercise your rights, you can contact us at any time so that we can take care of your request.

8.1 Data subject rights

You have extensive rights with regard to the processing of your personal data. First of all, you have the right of access and, where applicable, the right to rectification and/or erasure or blocking of your personal data. You may also request a restriction of processing and have the right to object. With regard to the personal data you have provided to us, you also have the right to data portability.
If you wish to exercise any of your rights and/or receive more detailed information, please contact our customer service. Alternatively, you can also contact our data protection officer.

8.2 Withdrawal of consent and objection

You may freely withdraw any consent you have given at any time with effect for the future. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. The contacts for this purpose are our customer service and our data protection officer.
If your personal data is not processed on the basis of consent, but on another legal basis, you may object to this processing. Your objection will result in a review and, where applicable, termination of data processing. You will be informed of the outcome of the review and – if data processing is to continue – receive additional information as to why data processing is lawful.

8.3 Data protection officer and contact

We have appointed an external data protection officer who supports us on data protection matters and whom you can also contact directly. If you have questions about our handling of personal data or require further information on data protection matters, our data protection officer and his team will be happy to assist you:

RA Dr. Sebastian Meyer, LL.M.
c/o BRANDI Rechtsanwälte
Adenauerplatz 1, 33602 Bielefeld
Phone: +49 521 / 96535-812
Email: [email protected]

If you wish to contact our data protection officer personally by email, you can also reach him at [email protected].

8.4 Complaints

If you believe that the processing of your personal data by us is not in accordance with this privacy policy or with applicable data protection provisions, you have the right to lodge a complaint with the supervisory authority. You can also file a complaint with our data protection officer, who will investigate the matter and inform you of the outcome.

9 Further information and changes

9.1 Links to other websites

Our online offering may contain links to other websites. These links are usually identified as such. We have no influence on whether and to what extent data protection regulations are complied with on the linked websites. We therefore recommend that you also consult the privacy policies of other websites.

9.2 Changes to this privacy policy

We reserve the right to change this privacy policy at any time with effect for the future. Changes will be made in particular in the case of technical adaptations of the online offering or changes to data protection regulations. The current version of the privacy policy is always available directly via the online offering.
Status of this privacy policy: March 2026