Privacy policy

1) Introduction and Contact Details of the Data Controller

1.1

We are pleased that you are visiting our website and thank you for your interest. Below, we explain how we process your personal data when you use our website. Personal data means any information by which you can be personally identified.

1.2

The data controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

ROWAC GmbH
Oberauer Weg 61 a
09429 Wolkenstein
Germany

Tel.: +49 (0) 1577 1976585
Email: info@rowac.com

The data controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2) Data Collection When Visiting Our Website

2.1

When you use our website for information purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the data that your browser transmits to our server (so-called "server log files"). When you access our website, we collect the following data, which is technically necessary to display the website to you:

• The website you visited

• Date and time of access

• Amount of data transmitted (in bytes)

• Source/referring website from which you accessed our website

• Browser used

• Operating system used

• IP address used (where applicable, in anonymised form)

The processing is carried out in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be disclosed to third parties or used for any other purpose. However, we reserve the right to review the server log files retrospectively if there are specific indications of unlawful use.

2.2

For security reasons and to protect the transmission of personal data and other confidential content (such as orders or enquiries sent to the data controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the "https://" prefix and the padlock symbol displayed in your browser's address bar.

3) Hosting & Content Delivery Network

3.1 Shopify

We use the following provider to host our website and deliver its content:

Shopify International Limited
Victoria Buildings, 2nd Floor
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland ("Shopify")

Data is also transferred to:

Shopify Inc.
150 Elgin St
Ottawa, ON K2P 1L4
Canada

All data collected via our website is processed on the provider's servers. We have entered into a data processing agreement with the provider to ensure the protection of our website visitors' data and to prohibit any unauthorised disclosure to third parties.

For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

3.2 Shopify

We use a Content Delivery Network (CDN) provided by:

Shopify International Limited
Victoria Buildings, 2nd Floor
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland ("Shopify")

Data may also be transferred to:

• Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada

• Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA

This service enables us to deliver large media files, such as images, website content and scripts, more quickly through a network of geographically distributed servers. Processing is carried out on the basis of our legitimate interest in improving the stability and functionality of our website in accordance with Article 6(1)(f) GDPR.

We have entered into a data processing agreement with the provider to ensure the protection of our website visitors' data and to prohibit any unauthorised disclosure to third parties.

For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

For transfers of data to the United States, the data recipient is certified under the EU–US Data Privacy Framework, which ensures an adequate level of data protection based on an adequacy decision adopted by the European Commission.

4) Cookies

To make your visit to our website more user-friendly and to enable the use of certain features, we use cookies. Cookies are small text files that are stored on your device. Some of these cookies are automatically deleted when you close your browser (so-called session cookies), while others remain on your device for a longer period and allow website settings to be saved (so-called persistent cookies). In the latter case, you can find details of the storage period in your web browser's cookie settings.

Where personal data is processed through individual cookies used by us, such processing is carried out in accordance with Article 6(1)(b) GDPR for the performance of a contract, Article 6(1)(a) GDPR where you have given your consent, or Article 6(1)(f) GDPR to safeguard our legitimate interests in ensuring the best possible functionality of the website and a user-friendly and effective browsing experience.

You can configure your browser to notify you whenever cookies are set, allowing you to decide on a case-by-case basis whether to accept them, or to disable cookies altogether or for specific situations.

Please note that disabling cookies may limit the functionality of our website.

5) Contacting Us

When you contact us (for example, via our contact form or by email), personal data is processed solely for the purpose of handling and responding to your enquiry, and only to the extent necessary for that purpose.

The legal basis for processing this data is our legitimate interest in responding to your enquiry in accordance with Article 6(1)(f) GDPR. Where your enquiry is related to the conclusion of a contract, the additional legal basis for processing is Article 6(1)(b) GDPR.

Your data will be deleted once it is clear from the circumstances that the matter has been fully resolved, provided that no statutory retention obligations apply.

6) Data Processing When Opening a Customer Account

In accordance with Article 6(1)(b) GDPR, personal data will be collected and processed to the extent necessary when you provide such data while opening a customer account. The data required for creating a customer account can be found in the relevant input form on our website.

You may delete your customer account at any time by notifying the data controller using the contact details provided above. Once your customer account has been deleted, your personal data will also be deleted, provided that all contracts concluded through the account have been fully performed, no statutory retention periods apply, and we have no legitimate interest in retaining the data.

7) Use of Customer Data for Direct Marketing

7.1 Subscription to Our Email Newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information required to receive the newsletter is your email address. Providing additional information is voluntary and may be used to address you personally.

We use the double opt-in procedure for newsletter subscriptions. This means that you will only receive our newsletter after you have expressly confirmed your consent by clicking the verification link sent to the email address you provided.

By activating the confirmation link, you consent to the processing of your personal data in accordance with Article 6(1)(a) GDPR. In doing so, we store the IP address assigned by your Internet Service Provider (ISP), together with the date and time of registration, in order to be able to trace any potential misuse of your email address at a later date. The data collected when you subscribe to the newsletter is used strictly for this purpose.

You may unsubscribe from the newsletter at any time by using the unsubscribe link included in every newsletter or by contacting the data controller named above. Once you have unsubscribed, your email address will be removed from our newsletter mailing list without undue delay, unless you have expressly consented to further use of your data or we are otherwise legally permitted to use your data beyond this scope, as explained in this Privacy Policy.

7.2 Brevo

Our email newsletters and other marketing emails are sent via the following provider:

Brevo GmbH
Köpenicker Str. 126
10179 Berlin
Germany

Based on our legitimate interest in effective and user-friendly email marketing, we transfer the data you provide when subscribing to the provider in accordance with Article 6(1)(f) GDPR so that it can send emails on our behalf.

Subject to your express consent pursuant to Article 6(1)(a) GDPR, we also reserve the right to carry out statistical analyses of email campaigns using web beacons or tracking pixels contained in the emails. These enable us to measure open rates and specific interactions with newsletter content. Device information (such as the time of access, IP address, browser type and operating system) may also be collected and analysed but will not be combined with any other datasets.

You may withdraw your consent to email tracking at any time with effect for the future.

We have entered into a data processing agreement with the provider to protect the personal data of visitors to our website and to prevent unauthorised disclosure to third parties.

7.3 Shopify Email

Our email newsletters are sent via the following provider:

Shopify International Limited
Victoria Buildings, 2nd Floor
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland

Data is also transferred to:

Shopify Inc.
150 Elgin St
Ottawa, ON K2P 1L4
Canada

Based on our legitimate interest in effective and user-friendly newsletter marketing, we transfer the data you provide when subscribing to our newsletter to this provider in accordance with Article 6(1)(f) GDPR so that it can send newsletters on our behalf.

Subject to your express consent pursuant to Article 6(1)(a) GDPR, the provider also carries out statistical analyses of newsletter campaigns using web beacons or tracking pixels included in the emails. These enable the measurement of open rates and specific interactions with newsletter content. Device information (such as the time of access, IP address, browser type and operating system) may also be collected and analysed but will not be combined with other datasets.

You may withdraw your consent to newsletter tracking at any time with effect for the future.

We have entered into a data processing agreement with the provider to protect the personal data of visitors to our website and to prevent unauthorised disclosure to third parties.

For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

7.4 Email Back-in-Stock Notifications

For products that are temporarily unavailable, you may subscribe to receive an email notification when the selected item becomes available again. In this case, we will send you a one-off email informing you that the selected product is back in stock.

The only mandatory information required for this notification service is your email address. Providing additional information is voluntary and may be used to address you personally.

We use the double opt-in procedure for this service. This means that you will only receive a back-in-stock notification after you have expressly confirmed your consent by clicking the verification link sent to your email address.

By activating the confirmation link, you consent to the processing of your personal data in accordance with Article 6(1)(a) GDPR. In doing so, we store the IP address assigned by your Internet Service Provider (ISP), together with the date and time of registration, in order to trace any potential misuse of your email address at a later date. The data collected when registering for this notification service is used strictly for this purpose.

You may unsubscribe from back-in-stock notifications at any time by contacting the data controller named above. Once you have unsubscribed, your email address will be removed from the relevant mailing list without undue delay, unless you have expressly consented to further use of your data or we are otherwise legally permitted to use your data beyond this scope, as explained in this Privacy Policy.

8) Data Processing for Order Fulfilment

8.1

Where necessary for the performance of the contract, in particular for delivery and payment purposes, the personal data we collect will be passed on to the appointed shipping company and the appointed payment institution in accordance with Article 6(1)(b) GDPR.

Where, under the terms of a contract, we are required to provide updates for goods containing digital elements or for digital products, we process the contact details you provide when placing your order in order to inform you personally of such updates in accordance with our legal obligations under Article 6(1)(c) GDPR. Your contact details are used strictly for the purpose of communicating updates that we are legally required to provide and are processed only to the extent necessary for the relevant notification.

To fulfil your order, we also work with the service providers listed below, who support us wholly or partly in the performance of our contractual obligations. Certain personal data is transferred to these service providers in accordance with the information set out below.

8.2 Billbee

For order processing, we use the following provider:

Billbee GmbH
Arolser Str. 10
34477 Twistetal
Germany

Your name, address and, where applicable, other personal data are transferred to the provider solely for the purpose of processing your online order in accordance with Article 6(1)(b) GDPR. Your data is transferred only to the extent necessary for processing your order.

8.3 Transfer of Personal Data to Shipping Providers

DHL

We use the following shipping provider:

DHL Paket GmbH
Sträßchensweg 10
53113 Bonn
Germany

Where you have given your express consent during the ordering process, we will provide your email address and/or telephone number to the provider prior to delivery in accordance with Article 6(1)(a) GDPR for the purpose of arranging a delivery date or providing delivery notifications.

If you have not given your consent, we will only pass on the recipient's name and delivery address to the provider in accordance with Article 6(1)(b) GDPR, and only to the extent necessary for delivery of the goods. In this case, it is not possible to arrange a delivery date in advance or to receive delivery notifications.

You may withdraw your consent at any time with effect for the future by contacting either the data controller named above or the provider directly.

8.4 Use of Payment Service Providers

PayPal

This website offers one or more online payment methods provided by:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

If you choose a payment method where payment is made in advance, the payment data you provide during the ordering process (including your name, address, bank and payment card details, currency and transaction number), together with information relating to your order, will be transferred to the provider in accordance with Article 6(1)(b) GDPR. Your data will be transferred solely for the purpose of processing the payment and only to the extent necessary.

Where you select a payment method under which we provide credit in advance, you will also be asked during the ordering process to provide certain personal information (including your first and last name, street address, house number, postcode, town or city, date of birth, email address, telephone number and, where applicable, details of an alternative payment method).

To protect our legitimate interest in assessing your creditworthiness, we will forward this information to the provider for the purpose of a credit assessment in accordance with Article 6(1)(f) GDPR. Based on the personal information you provide and additional data (such as your shopping basket, invoice amount, order history and previous payment behaviour), the provider will assess whether the selected payment method can be offered with regard to payment and default risks.

The credit assessment may include probability values (known as credit scores). Where credit scores are taken into account, they are calculated using scientifically recognised mathematical and statistical methods. Address data may be included in the calculation of these scores, among other factors.

You may object to this processing of your data at any time by contacting either us or the provider. However, the provider may still be entitled to process your personal data where this is necessary for the contractual processing of payments.

Shopify Payments

This website offers one or more online payment methods provided by:

Shopify International Limited
Victoria Buildings
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland

If you select a payment method provided by this provider where payment is made in advance (such as payment by credit card), the payment data you provide during the ordering process (including your name, address, bank and payment card details, currency and transaction number), together with information relating to your order, will be transferred to the provider in accordance with Article 6(1)(b) GDPR. Your data will be transferred solely for the purpose of processing the payment and only to the extent necessary.

SumUp

This website offers one or more online payment methods provided by:

SumUp Limited
Block 8, Harcourt Centre
Charlotte Way
Dublin 2, D02 K580
Ireland

If you select a payment method provided by this provider where payment is made in advance (such as payment by credit card), the payment data you provide during the ordering process (including your name, address, bank and payment card details, currency and transaction number), together with information relating to your order, will be transferred to the provider in accordance with Article 6(1)(b) GDPR. Your data will be transferred solely for the purpose of processing the payment and only to the extent necessary.

8.5 Electronic Withdrawal Feature for Distance Selling Contracts

Consumers who conclude contracts through this website and who are entitled to a statutory right of withdrawal may exercise that right using an electronic withdrawal feature in accordance with the applicable withdrawal provisions.

To provide this electronic withdrawal feature, we use a solution supplied by:

Boo Apps
Ha Noi
Vietnam

When using the electronic withdrawal feature, you will be required to provide or confirm information identifying the contract from which you wish to withdraw, together with certain personal information, including your first and last name and email address.

Based on our legitimate interest in providing a user-friendly, reliable and efficient solution, the provider initially collects this information in accordance with Article 6(1)(f) GDPR, uses it to send an email confirming receipt of your withdrawal notice on our behalf, and then forwards it to us.

We subsequently process the transmitted information for the proper handling of your withdrawal in accordance with Article 6(1)(b) and Article 6(1)(c) GDPR, based on our statutory obligation to provide an electronic withdrawal feature for chargeable distance contracts concluded with consumers.

The information collected by the provider is routinely deleted once the withdrawal has been fully processed, provided that no statutory retention obligations apply.

We have entered into a data processing agreement with the provider to ensure that personal data processed through the electronic withdrawal feature is protected and is not disclosed to unauthorised third parties.

9) Web Analytics Services

9.1 Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by:

Google Ireland Limited
Gordon House
4 Barrow Street
Dublin, D04 E5W5
Ireland ("Google")

Google Analytics 4 enables us to analyse how visitors use our website.

By default, Google Analytics 4 places cookies on your device when you visit our website. These cookies collect certain information, including your IP address. However, Google shortens your IP address by removing the last digits before processing it, preventing it from being directly linked to you.

The information is transmitted to Google's servers and processed there. This may also include transfers to Google LLC in the United States.

Google processes this information on our behalf to evaluate your use of the website, compile reports on website activity, and provide us with other services relating to website and internet usage. The shortened IP address transmitted by your browser as part of Google Analytics is not combined with other Google data. Data collected through Google Analytics 4 is stored for two months and then deleted.

All of the processing described above, including the storage of cookies on your device, takes place only where you have given your express consent in accordance with Article 6(1)(a) GDPR.

If you do not provide your consent, Google Analytics 4 will not be used during your visit to our website. You may withdraw your consent at any time with effect for the future by disabling this service via the Cookie Consent Toolprovided on our website.

We have entered into a data processing agreement with Google to ensure the protection of our website visitors' data and to prevent unauthorised disclosure to third parties.

Further legal information regarding Google Analytics 4 can be found at:

• https://business.safety.google/intl/privacy/

• https://policies.google.com/privacy

• https://policies.google.com/technologies/partner-sites

Demographic Data

Google Analytics 4 includes the Demographic Data feature, which enables statistical reports to be generated regarding the age, gender and interests of website visitors. This is achieved by analysing advertising data and information obtained from third parties. The resulting data allows target groups to be identified for marketing purposes.

The collected data cannot be assigned to any specific individual and is deleted after being stored for a period of two months.

Google Signals

As an extension of Google Analytics 4, this website may use Google Signals to generate cross-device reports.

If you have enabled personalised advertising and linked your devices to your Google Account, Google may, subject to your consent under Article 6(1)(a) GDPR, analyse your usage behaviour across multiple devices and create database models, including models for cross-device conversions.

We do not receive any personal data from Google; we receive only aggregated statistical information.

If you wish to disable cross-device analysis, you can turn off the Personalised Ads feature in your Google Account settings by following the instructions available at:

https://support.google.com/My-Ad-Center-Help/answer/12155764

Further information about Google Signals is available at:

https://support.google.com/analytics/answer/7532985

User IDs

As an extension of Google Analytics 4, this website may also use the User IDs feature.

If you have consented to the use of Google Analytics 4 in accordance with Article 6(1)(a) GDPR, have created an account on this website and log into that account on different devices, your activities—including conversions—may be analysed across multiple devices.

For transfers of data to the United States, the provider is certified under the EU–US Data Privacy Framework, which ensures an adequate level of data protection based on an adequacy decision adopted by the European Commission.

9.2 Shopify Analytics

This website uses the web analytics service provided by:

Shopify International Limited
Victoria Buildings, 2nd Floor
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland

Data is also transferred to:

Shopify Inc.
150 Elgin Street
Ottawa, ON K2P 1L4
Canada

Using cookies and/or comparable technologies (such as tracking pixels, web beacons and algorithms for reading device and browser information), the service collects and stores pseudonymised visitor data, including information about the device used, such as IP addresses and browser information.

This information is used to carry out statistical analyses of user behaviour on our website and to create pseudonymised user profiles. Among other things, this makes it possible to analyse browsing patterns (known as heatmaps), showing the duration of page visits and interactions with website content (such as text input, scrolling, clicks and mouse movements).

Pseudonymisation generally prevents the data from being directly linked to an identifiable individual. No merging of this data with other personally identifiable information collected by other means takes place.

All processing described above, in particular the reading or storage of information on your device, is carried out only where you have given your express consent in accordance with Article 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future by disabling this service via the Cookie Consent Tool provided on our website.

We have entered into a data processing agreement with the provider to ensure the protection of our website visitors' data and to prevent unauthorised disclosure to third parties.

For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

9.3 Shopify Network Intelligence

This website uses the Shopify Network Intelligence feature provided by:

Shopify International Limited
Victoria Buildings, 2nd Floor
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland ("Shopify")

Where collected, certain customer data (including order and search history, location information and transaction details) is automatically transferred to Shopify in pseudonymised form. Shopify processes this data and uses it for statistical analysis and reporting purposes.

The analysis may also include pseudonymised data from customers of other Shopify merchants. However, individual merchants do not have access to another merchant's customer data outside their own customer base.

As part of the processing, Shopify does not have access to identifiable personal data. Instead, the information is automatically encrypted during transmission using a dedicated algorithm.

Processing is carried out in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest in statistically evaluating the reach of our online shop and the acceptance of our products and services for optimisation purposes.

As part of this processing, data may also be transferred to:

Shopify Inc.
150 Elgin Street
Ottawa, ON K2P 1L4
Canada

We have entered into a data processing agreement with the provider to ensure the protection of our website visitors' data and to prevent unauthorised disclosure to third parties.

For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

Further information about the processing described above can be found in Shopify's Privacy Policy:

https://www.shopify.com/legal/privacy/consumers

10) Retargeting, Remarketing and Conversion Tracking

Meta Pixel with Advanced Matching

Within our online offering, we use Meta Pixel with Advanced Matching, provided by:

Meta Platforms Ireland Limited
4 Grand Canal Square
Dublin 2
Ireland ("Meta")

When a user clicks on one of our advertisements displayed on Facebook or Instagram, a parameter is added to the URL of the linked page using Meta Pixel. After the redirect, this URL parameter is stored in the user's browser by means of a cookie placed by our website.

In addition, this cookie collects specific customer data—such as the email address—that we collect on pages linked to our Facebook or Instagram advertisements during activities such as purchases, account registrations or sign-ups (Advanced Matching). The cookie is then read, allowing the collected data, including the specific customer information, to be transmitted to Meta.

We use Meta Pixel with Advanced Matching to make our advertisements ("Ads") on Facebook and/or Instagram more effective and to ensure that they correspond to users' interests or exhibit certain characteristics (for example, interests in particular products or topics determined from the websites they have visited). This information is transmitted to Meta to create Custom Audiences.

We also analyse the effectiveness of our advertisements by tracking whether users are redirected to our website after clicking an advertisement (conversion tracking). Compared with the standard version of Meta Pixel, the Advanced Matching feature helps us measure the effectiveness of our advertising campaigns more accurately by attributing a greater number of conversions.

All transmitted data is stored and processed by Meta so that it can be associated with the relevant user profile. Meta may also use the data for its own advertising purposes in accordance with its Data Policy. The data may enable Meta and its partners to display advertisements on and outside Facebook.

All of the processing described above, in particular the storage of cookies for the purpose of accessing information on your device, is carried out only where you have given your express consent in accordance with Article 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future by disabling this service via the Cookie Consent Tool provided on our website.

We have entered into a data processing agreement with Meta to ensure the protection of our website visitors' data and to prevent unauthorised disclosure to third parties.

The information generated by Meta is generally transmitted to and stored on Meta's servers. This may also involve the transfer of data to Meta Platforms Inc. in the United States.

For transfers of data to the United States, the provider is certified under the EU–US Data Privacy Framework, which ensures an adequate level of data protection based on an adequacy decision adopted by the European Commission.

11) Website Features

11.1 Google Maps

This website uses the online mapping service Google Maps (API) provided by:

Google Ireland Limited
Gordon House
4 Barrow Street
Dublin, D04 E5W5
Ireland ("Google")

Google Maps is a web service used to display interactive maps in order to present geographical information visually. By using this service, our location can be displayed and directions to our premises can be provided.

When you access any page on which Google Maps is embedded, information about your use of our website (such as your IP address) is transmitted to and stored on Google's servers. This may also involve the transfer of data to Google LLCservers in the United States.

This occurs regardless of whether Google provides a user account through which you are logged in or whether you have a Google account. If you are logged into Google, your data will be assigned directly to your account. If you do not wish your data to be associated with your Google profile, you must log out before activating the map. Google stores your data (including data relating to users who are not logged in) as usage profiles and analyses it.

The collection, storage and analysis of this data are carried out in accordance with Article 6(1)(f) GDPR on the basis of Google's legitimate interest in displaying personalised advertising, conducting market research and/or designing Google websites to meet users' needs. You have the right to object to the creation of these user profiles, although you must contact Google directly in order to exercise this right.

If you do not wish your data to be transmitted to Google when using Google Maps, you may completely disable the Google Maps service by disabling JavaScript in your browser. In this case, Google Maps, and therefore the map displayed on this website, cannot be used.

Where required by law, we obtain your consent for the processing of your data as described above in accordance with Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future. To do so, please follow the procedure described above for objecting to the processing.

For transfers of data to the United States, the provider is certified under the EU–US Data Privacy Framework, which ensures an adequate level of data protection based on an adequacy decision adopted by the European Commission.

Further information about Google's privacy practices can be found at:

https://business.safety.google/intl/privacy/

11.2 Google Maps API

To validate certain address details entered during the checkout process in real time and to identify input errors, we use the services of:

Google Ireland Limited
Gordon House
4 Barrow Street
Dublin, D04 E5W5
Ireland

Data may also be transferred to:

Google LLC, United States.

The provider validates the address entered, verifies its spelling and, where appropriate, supplements any missing information. Where an address is ambiguous, alternative suggestions may be displayed. For this purpose, the address data you enter is transmitted to, stored by and processed by the provider.

This processing is carried out in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest in accurately recording customers' address details in order to fulfil our contractual delivery obligations and prevent problems in the performance of the contract.

The provider processes the relevant data separately, does not combine it with other datasets, and deletes it once the address has been verified or corrected, and no later than 30 days afterwards.

For transfers of data to the United States, the provider is certified under the EU–US Data Privacy Framework, which ensures an adequate level of data protection based on an adequacy decision adopted by the European Commission.

Further information about Google's privacy practices can be found at:

https://business.safety.google/intl/privacy/

11.3 hCaptcha

This website uses the hCaptcha CAPTCHA service provided by:

Intuition Machines, Inc.
350 Alabama Street
San Francisco, CA 94110
United States

The service checks whether information entered on our website has been entered by a human or through automated or abusive processing, and helps to prevent spam, DDoS attacks and similar forms of automated abuse.

To make this determination, the provider collects the IP address of the device used, information identifying the browser and operating system, together with the date and duration of the visit, and transmits this information to the provider's servers for analysis.

The legal basis for this processing is our legitimate interest in ensuring individual accountability on the internet and preventing abuse and spam in accordance with Article 6(1)(f) GDPR.

We have entered into a data processing agreement with the provider to ensure the protection of our website visitors' data and to prevent unauthorised disclosure to third parties.

For transfers of data to the United States, the provider relies on the European Commission's Standard Contractual Clauses to ensure an adequate level of data protection.

12) Tools and Miscellaneous

12.1 Billbee

For our accounting processes, we use the cloud-based accounting software provided by:

Billbee GmbH
Arolser Str. 10
34477 Twistetal
Germany

The provider processes incoming and outgoing invoices and, where applicable, our company's banking transactions in order to record invoices automatically, match them to transactions and generate financial accounting records through a partially automated process.

Where personal data is processed in this context, the processing is carried out in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest in the efficient organisation and documentation of our business operations.

12.2 DATEV

For our accounting processes, we use the cloud-based accounting software provided by:

DATEV eG
Paumgartnerstr. 6–14
90429 Nuremberg
Germany

The provider processes incoming and outgoing invoices and, where applicable, our company's banking transactions in order to record invoices automatically, match them to transactions and generate financial accounting records through a partially automated process.

Where personal data is processed in this context, the processing is carried out in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest in the efficient organisation and documentation of our business operations.

13) Rights of the Data Subject

13.1

Applicable data protection legislation grants you the following rights in relation to the processing of your personal data. The specific conditions governing the exercise of these rights are determined by the relevant provisions of the GDPR:

• Right of access under Article 15 GDPR;

• Right to rectification under Article 16 GDPR;

• Right to erasure under Article 17 GDPR;

• Right to restriction of processing under Article 18 GDPR;

• Right to notification under Article 19 GDPR;

• Right to data portability under Article 20 GDPR;

• Right to withdraw consent under Article 7(3) GDPR;

• Right to lodge a complaint under Article 77 GDPR.

13.2 Right to Object

WHERE WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTERESTS FOLLOWING A BALANCING OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO SUCH PROCESSING AT ANY TIME WITH EFFECT FOR THE FUTURE, PROVIDED THAT YOUR OBJECTION IS BASED ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE PERSONAL DATA CONCERNED. HOWEVER, WE MAY CONTINUE TO PROCESS YOUR DATA IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR WHERE THE PROCESSING IS NECESSARY FOR THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

WHERE YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSES OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING PURPOSES. YOU MAY EXERCISE YOUR RIGHT TO OBJECT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES.

14) Retention of Personal Data

The length of time for which personal data is stored depends on the applicable legal basis, the purpose of the processing and, where relevant, any applicable statutory retention periods (for example, retention periods under commercial or tax law).

Where personal data is processed on the basis of your express consent pursuant to Article 6(1)(a) GDPR, such data will be retained until you withdraw your consent.

Where statutory retention periods apply to data processed in connection with contractual or quasi-contractual obligations pursuant to Article 6(1)(b) GDPR, such data will be routinely deleted once the applicable retention period has expired, provided that it is no longer required for the performance or initiation of the contract and we no longer have a legitimate interest in retaining it.

Where personal data is processed on the basis of Article 6(1)(f) GDPR, such data will be retained until you exercise your right to object under Article 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes on the basis of Article 6(1)(f) GDPR, such data will be retained until you exercise your right to object under Article 21(2) GDPR.

Unless otherwise stated in this Privacy Policy in relation to specific processing activities, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.