Datenschutzerklärung

1. Name and Contact Details of the Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Contact Details of the Data Protection Officer

3. General Information on Data Processing

a) Scope of Processing

We process personal data when this is necessary to provide our services, to perform contracts, to improve our offer, or to fulfill legal obligations.

b) Legal Basis

Processing is carried out on the basis of the following legal grounds:

• Art. 6 (1) lit. a GDPR (Consent)
• Art. 6 (1) lit. b GDPR (Performance of contract)
• Art. 6 (1) lit. c GDPR (Legal obligation)
• Art. 6 (1) lit. f GDPR (Legitimate interest)

c) Retention Period

Data will be deleted as soon as the purpose of the processing no longer applies, unless statutory regulations require longer storage. Specific storage periods are based on legal requirements and contractual agreements.

4. Data Processing within the Framework of Contractual Relationships

a) Processing of Customer Data

We collect personal data within the framework of contractual relationships to provide our services. This includes:

• Name, address, email address, telephone number
• Contractual and payment information
• Data on products and services

Processing is carried out on the basis of Art. 6 (1) lit. b GDPR (Performance of contract).

b) Disclosure to Third Parties

Suppliers (Dropshipping): Customer data such as name and delivery address are passed on to our suppliers in order to ship orders directly to the customers.

Tax Consultants: Customer data is transmitted to our tax consultant, who uses DATEV to fulfill legal obligations.

c) Processing of Test Products

Customers can provide products for testing. These products and the associated data may be passed on to partners or suppliers. Videos of the tests are only used with the customer's consent.

This data is stored as long as it is necessary for contractual and documentation purposes.

5. Provision of the Website and Hosting

a) Hosting Services and IT Infrastructure

Our website is provided by the hosting service providers IONOS and Hetzner. Both providers store data in the EU and process it on the basis of Art. 6 (1) lit. b and lit. f GDPR.

b) Nameserver and Domain Management

Our domains and nameservers are managed by Schlund Technologies GmbH. Processing takes place exclusively for the administration and provision of our domains and DNS entries.

c) IT Service Providers

Our IT service providers, Neuguine Internet GmbH and Wineberger Projektmanagement, support us in the maintenance and administration of our web servers and IT systems.

In addition, the following data is collected with each access to our website:

• Browser type and version
• Operating system
• Referrer URL
• IP address
• Date and time of access

These log files are stored for 7 days and serve IT security purposes.

6. Use of Tracking and Analysis Tools

a) Google Analytics

We use Google Analytics to analyze user behavior on our website. Processing is carried out on the basis of Art. 6 (1) lit. a GDPR (Consent).

Further information can be found at: https://policies.google.com/privacy.

b) Use of Cookies

• Technically necessary cookies: For basic functions of the website.
• Analysis cookies: To improve our offer (e.g., Google Analytics).

Processing is carried out depending on the purpose on the basis of Art. 6 (1) lit. a or lit. f GDPR.

7. Integration of External Services

a) Payment Service Provider: PayPal

We use PayPal for payment processing. Data such as name, address, and payment information are transmitted to PayPal.

Further information can be found at: https://www.paypal.com/webapps/mpp/ua/privacy-full.

b) YouTube Videos

We use YouTube videos in enhanced privacy mode. Processing is carried out on the basis of your consent according to Art. 6 (1) lit. a GDPR.

Further information can be found at: https://policies.google.com/privacy.

c) Google Ads and Microsoft Ads

We use Google Ads and Microsoft Ads for targeted advertising. Your data may be transmitted to the USA. Further details can be found in the privacy policies of the providers. The transfer takes place using standard contractual clauses according to Art. 46 GDPR.

d) Hotjar

Our website uses Hotjar, a web analysis tool from Hotjar Ltd. (Level 2, St Julian’s Business Centre, 3, Elia Zammit Street, St Julian’s STJ 1000, Malta). We use Hotjar to anonymously analyze user behavior on our website, e.g., mouse movements, clicks, scrolling behavior, and page views. Hotjar uses cookies that enable an analysis of website usage. No personal data such as names or IP addresses are stored in full — IP addresses are anonymized, and recordings cannot be assigned to a specific user.
More information: https://www.hotjar.com/legal/policies/privacy/

8. Communication and Cloud Services

a) Use of Microsoft 365 and Microsoft Teams

We use Microsoft 365 and Microsoft Teams for communication and document management. Processing is carried out on the basis of Art. 6 (1) lit. b, lit. f, and lit. a GDPR (for recordings and transcripts). Customer data is processed within the EU.

b) Internal Data Processing

We use JTL-Wawi, local servers, and cloud services such as Microsoft OneDrive and SharePoint for the management of customer data.

9. Shipping and Logistics

a) Shipping Service Providers and Freight Forwarders

For the shipping of goods, we use shipping service providers such as DHL, UPS, FedEx, as well as freight forwarders. We reserve the right to use other service providers as needed.

Processing is carried out on the basis of Art. 6 (1) lit. b and lit. f GDPR.

10. Rights of the Data Subject

Data subjects have the following rights under the GDPR:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)

Right to lodge a complaint: You can lodge a complaint with the competent data protection supervisory authority:

11. Data Transfers to the USA

The transfer of personal data to the USA only takes place under the application of standard contractual clauses and additional protective measures in accordance with the requirements of the Schrems II ruling.

(As of January 1, 2026)