[borlabs-cookie type=”btn-cookie-preference” title=”Individuelle Datenschutzeinstellungen”/]
Contact for enquiries about data protection
Nature and processing of data
- Personal data (e.g. names, addresses)
- Contact data (e.g. email, telephone numbers)
- Content data (e.g. text input, images, videos)
- Usage data (e.g. visited websites, interest in content, access times)
- Meta/communication data (e.g. device information, IP addresses)
Categories of persons concerned
Visitors and users of the online offer (hereinafter we collectively refer to all data subjects as “users”).
Purpose of processing
- Provision of the online offer, its functions and contents
- Security measures
- Reach measurement/marketing
“Personal data” is any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by assignment to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more special features that express the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.
“Processing” is any operation or set of operations performed upon personal data, with or without the aid of automated processes. The term goes a long way and covers practically every handling of data.
“Pseudonymization” is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that this additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
“Profiling” is any automated processing of personal data, insofar such personal data is used to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects relating to the performance, economic situation, health, personal preferences, interests, reliability, behavior, location or relocation of that natural person.
“Person responsible” is any natural or legal person, authority, institution or other body that alone or together with others decides on the purposes and means of processing personal data.
“Processor” is any natural or legal person, authority, institution or other body processing personal data on behalf of the person responsible.
Legal bases and security measures
Relevant legal bases
In accordance with Art. 32 GDPR, we take appropriate technical and organizational measures to ensure an adequate level of protection in line with the risks incurred, while also taking into account the state of the art, the costs of implementation, and the type, scope, circumstances and purposes of processing as well as the probability of occurrence and the severity of the risk to the rights and freedoms of natural persons.
These measures include: ensuring the confidentiality, integrity and availability of data by controlling physical access to said data; ensuring the access, entry, transmission of data; and securing the availability and separation of data. Furthermore, we have established procedures to ensure the exercise of rights of data subjects, the deletion of data and an adequate response to compromised data. In addition, we take steps to ensure the safety of personal data during the development process, respectively the selection of hardware, software and procedures, in accordance with the principle of data protection through technology design and privacy-friendly settings (Art. 25 GDPR).
Cooperation with external processors and third parties
If we disclose data to other persons and companies (external processors or third parties) within the scope of our processing, transmit data to them or otherwise grant them access to the data, it shall only be done within the framework of a legal permission (e.g. if a transmission of data to third parties, such as payment service providers, is necessary for contract fulfilment in accordance with Art. 6 para. 1 let. b GDPR), a consent, if a legal obligation exists or based on our legitimate interests (e.g. when using authorized persons, web hosts, etc.).
If we commission third parties with the processing of data on the basis of a so-called “processing contract”, this shall be done in accordance with the provisions laid out in Art. 28 GDPR.
Transfers to third countries
If we process data in a third country (i.e. outside the European Union (EU), Switzerland or the European Economic Area (EEA)) or if this occurs in the context of the use of services of third parties or the disclosure, respectively the transfer, of data to third parties, this is done solely for the fulfilment of our (pre)contractual obligations, on the basis of your consent, a legal obligation or our legitimate interests. Subject to legal or contractual permissions, we process or leave the data in a third country only if the special requirements of Art. 44 ff. GDPR have been fulfilled. This means, for example, that processing is carried out in accordance with special security measures, such as the officially recognized determination of a certain level of data protection corresponding to EU standards (e.g. the “Privacy Shield” in the USA), or the compliance with officially recognized special contractual obligations (so-called “standard contractual clauses”).
Rights of data subjects
In accordance with Art. 15 GDPR, you have the right to request confirmation as to whether or not data related to you is being processed, and to request information about such data, but also to receive further information and a copy of said data.
In accordance with Art. 16 GDPR, you have the right to make a request to supplement your data or to correct any inaccurate data related to you.
In accordance with Art. 17 GDPR, you have the right to demand that data related to you be deleted immediately or, alternatively, to demand a restriction on the processing of the data in accordance with Art. 18 GDPR.
In accordance with Art. 20 GDPR, you have the right to ask us to send you your personal data that you have provided to us and to demand that it be forwarded to other persons responsible.
In accordance with Art. 77 GDPR, you also have the right to file a complaint with the competent supervisory authority.
Right of revocation
You have the right to rescind any consent you have given us pursuant to Art. 7 para. 3 GDPR with effect for the future.
Right of objection
In accordance with Art. 21 GDPR, you have the right to object to the future processing of data related to you at any time. The objection may be submitted particularly in the case of processing for direct marketing purposes.
Cookies and right of objection to direct advertising
“Cookies” are small files that are stored on a user’s computer. Different data can be stored in cookies. A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during or after visiting an online offering. Temporary cookies, respectively “session cookies” or “transient cookies”, are cookies that are deleted after a user leaves an online offering and closes his browser. Such a cookie can store, for example, the content of a shopping basket in an online shop or a login status. “Permanent” or “persistent” cookies remain stored even after the browser is closed. For example, a user’s login can be saved when he or her visits the website after several days. Furthermore, such a cookie can also store the interests of users, which can be used to for audience measurement or marketing purposes. “Third-party cookies” are cookies that are offered by providers other than the person responsible for operating the online offering (the cookies of the person responsible for the online offering are referred to as “first-party cookies”).
If you as a user do not want cookies to be stored on your computer, you may deactivate the corresponding option in the system settings of your browser. Stored cookies can be deleted in the system settings of the browser. Opting out of cookies can lead to functional restrictions of this online offering.
Deletion of data
Order processing in the online shop and customer account
We process the data of our customers in the context of the ordering processes in our online shop in order to enable them to select and order the selected products and services, as well as their payment and delivery, or execution.
The data processed includes inventory data, communication data, contract data, payment data and the persons affected by the processing include our customers, interested parties and other business partners. The processing is carried out for the purpose of providing contractual services within the scope of operating an online shop, billing, delivery and customer services. We use session cookies to store the contents of the shopping cart and permanent cookies to store the login status.
The processing is carried out on the basis of Art. 6 Para. 1 lit. b (execution of order transactions) and c (legally required archiving) DSGVO. In this context, the information marked as required is necessary for the justification and fulfilment of the contract. We disclose the data to third parties only within the scope of delivery, payment or within the scope of legal permissions and obligations towards legal advisors and authorities. The data is only processed in third countries if this is necessary for the fulfilment of the contract (e.g. at the customer’s request for delivery or payment).
Users can optionally create a user account, in which they can view their orders in particular. During the registration process, users are provided with the required mandatory information. The user accounts are not public and cannot be indexed by search engines. If users have cancelled their user account, their data with regard to the user account will be deleted, subject to their retention being necessary for reasons of commercial or tax law in accordance with Art. 6 Para. 1 lit. c DSGVO. Information in the customer account shall remain until its deletion with subsequent archiving in the event of a legal obligation. It is the responsibility of the users to save their data in the event of termination before the end of the contract.
Within the scope of registration and renewed logins as well as the use of our online services, we store the IP address and the time of the respective user action. The storage is based on our legitimate interests as well as those of the users in protection against misuse and other unauthorised use. This data is not passed on to third parties, unless it is necessary for the pursuit of our claims or there is a legal obligation to do so in accordance with Art. 6 Para. 1 lit. c DSGVO.
The deletion takes place after the expiry of legal warranty and comparable obligations, the necessity of keeping the data is reviewed every three years; in the case of legal archiving obligations, the deletion takes place after their expiry (end of commercial law (6 years) and tax law (10 years) retention obligation).
External payment service providers
In the context of the fulfilment of contracts, we use the payment service providers on the basis of Art. 6 para. 1 lit. b. DSGVO. Furthermore, we use external payment service providers on the basis of our legitimate interests pursuant to Art. 6 para. 1 lit. f. DSGVO in order to offer our users effective and secure payment options.
The data processed by the payment service providers include inventory data, such as the name and address, bank data, such as account numbers or credit card numbers, passwords, TANs and checksums, as well as the contract, totals and recipient-related information. The details are required to carry out the transactions. However, the data entered is only processed by the payment service providers and stored with them. I.e. we do not receive any account or credit card-related information, but only information with confirmation or negative information of the payment. Under certain circumstances, the data may be transmitted by the payment service providers to credit agencies. The purpose of this transmission is to check identity and creditworthiness. Please refer to the terms and conditions and data protection information of the payment service providers.
The terms and conditions and data protection notices of the respective payment service providers apply to the payment transactions and can be accessed within the respective websites or transaction applications. We also refer to these for further information and the assertion of revocation, information and other data subject rights.
External shipping service providers
We use external parcel service providers (Die Post and occasionally DPD). We keep ourselves open to also use shipping service providers. In the context of the fulfilment of contracts, we use the shipping and parcel service providers on the basis of Art. 6 Para. 1 lit. b. DSGVO. The data processed by the shipping service providers includes inventory data, such as the name and address, but not bank data or IP addresses. The information is necessary to carry out the purchase and the associated delivery. You have the right to revoke your consent in accordance with Art. 7 (3) DSGVO with effect for the future, but please note that we will then no longer be able to deliver any orders.
Administration, financial accounting, office organisation, contact management
We process data in the context of administrative tasks as well as organisation of our operations, financial accounting and compliance with legal obligations, such as archiving. In doing so, we process the same data that we process in the context of providing our contractual services. The processing bases are Art. 6 para. 1 lit. c. DSGVO, Art. 6 para. 1 lit. f. DSGVO. Customers, interested parties, business partners and website visitors are affected by the processing. The purpose and our interest in the processing lies in the administration, financial accounting, office organisation, archiving of data, i.e. tasks that serve the maintenance of our business activities, performance of our tasks and provision of our services. The deletion of data with regard to contractual services and contractual communication corresponds to the information provided in these processing activities.
We disclose or transmit data to the tax authorities, advisors such as tax advisors or auditors as well as other fee offices and payment service providers.
Furthermore, we store information on suppliers, organisers and other business partners on the basis of our business interests, e.g. for the purpose of contacting them at a later date. This data, most of which is company-related, is stored permanently.
Business analyses and market research
In order to run our business economically, to be able to recognise market trends, wishes of the contractual partners and users, we analyse the data we have on business transactions, contracts, enquiries, etc.. In doing so, we process inventory data, communication data, contract data, payment data, usage data, metadata on the basis of Art. 6 para. 1 lit. f. DSGVO, whereby the data subjects include contractual partners, interested parties, customers, visitors and users of our online offer.
The analyses are carried out for the purpose of business evaluations, marketing and market research. In doing so, we may take into account the profiles of registered users with information, e.g. on the services they have used. The analyses serve us to increase user-friendliness, to optimise our offer and to improve business management. The analyses serve us alone and are not disclosed externally, unless they are anonymous analyses with summarised values.
Sofern diese Analysen oder Profile personenbezogen sind, werden sie mit Kündigung der Nutzer gelöscht oder anonymisiert, sonst nach zwei Jahren ab Vertragsschluss. Im Übrigen werden die gesamtbetriebswirtschaftlichen Analysen und allgemeine Tendenzbestimmungen nach Möglichkeit anonym erstellt.
Users can create a user account. As part of the registration process, the required mandatory information is provided to the users and processed on the basis of Art. 6 (1) lit. b DSGVO for the purpose of providing the user account. The processed data includes in particular the login information (name, password and an e-mail address). The data entered during registration is used for the purposes of using the user account and its purpose.
Users may be informed of information relevant to their user account, such as technical changes, by e-mail. If users have terminated their user account, their data relating to the user account will be deleted, subject to a legal obligation to retain data. It is the responsibility of the users to save their data before the end of the contract in the event of termination. We are entitled to irretrievably delete all user data stored during the term of the contract.
Within the scope of the use of our registration and login functions as well as the use of the user account, we store the IP address and the time of the respective user action. The storage is based on our legitimate interests as well as those of the users in protection against misuse and other unauthorised use. As a matter of principle, this data is not passed on to third parties unless it is necessary for the pursuit of our claims or there is a legal obligation to do so pursuant to Art. 6 Para. 1 lit. c. DSGVO. The IP addresses are anonymised or deleted after 7 days at the latest.
Establishment of contact
When contacting us (e.g. via contact form, email, telephone or social media), the user’s details are processed pursuant to Art. 6 para. 1 let. b (in the context of contractual/pre-contractual relationships) and Art. 6 para. 1 let. f (other requests) of the GDPR for the purpose of processing and handling contact requests. User information can be stored in a customer relationship management system (“CRM system”) or similar organizational tool.
We delete the requests if they are no longer necessary. We review this requirement every two years; the statutory archiving obligations also apply.
You will receive the PADMA newsletter only with your express consent and subscription. For this purpose, we save your email address. You can unsubscribe from the newsletter at any time.
Your personal data that you provide to PADMA will not be rented, traded or sold to third parties by us or our service providers.
Furthermore, we have the right to commission third parties with the technical handling of advertising measures and to pass on your personal data for this purpose within the PADMA Group and to commissioned service providers. These domestic and international service providers are obliged to comply with privacy laws to the same extent as we are. Your user data cannot be associated with your anonymized IP address.
Distribution service providers
The newsletter is sent by the email marketing service provider “MailChimp”, a newsletter delivery platform of the US company Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA. The data protection regulations of the delivery service provider. The Rocket Science Group LLC d/b/a MailChimp is certified under the Privacy Shield Agreement and thus guarantees compliance with the European data protection standards. The delivery service provider is commissioned on the basis of our legitimate interests in accordance with Art. 6 para. 1 let. f GDPR and a processing contract pursuant to Art. 28 para. 3 s. 1 GDPR.
The delivery service provider can use the recipient’s data in pseudonymous form, i.e. without assignment to a user, to optimize or improve its own services, e.g. to technically optimize the dispatch and presentation of the newsletter, or for statistical purposes. However, the delivery service provider does not use the data of our newsletter recipients to contact them on his own account or to pass it on to third parties.
Newsletter – performance measurement
The newsletters contain a so-called “web beacon”, i.e. a pixel-sized file that is fetched from our server when the newsletter is opened or, if we use a delivery service provider, from his third-party server. Within the scope of this retrieval, technical information is collected, such as information about the browser and your system, your IP address and time of retrieval.
This information is used to technically improve the services with the help of technical data or target groups and their reading behavior based on their retrieval locations (which can be determined using the IP address) or access times. The statistical analysis also makes it possible to determine whether the newsletters are opened, when they are opened, and which links are clicked. Technically speaking, this information can be assigned to the individual newsletter recipients. However, it is neither our endeavor, nor that of the delivery service provider, to observe individual users. The analysis is rather used to recognize the reading habits of our users and to adapt our contents accordingly, or to send out various contents based on the interests of our users.
Separately opting-out of the performance measurement is unfortunately not possible, in this case the entire newsletter subscription must be cancelled.
Hosting and email dispatch
The hosting services we use provide the following services: infrastructure and platform services, computing capacity, storage capacity and database services, email distributions, security services and technical maintenance services that we use for the purpose of operating this online offering.
We, respectively our hosting provider, process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties and visitors of this online offering on the basis of our legitimate interests in an efficient and secure provision of this online offering according to Art. 6 Para. 1 let. f GDPR in conjunction with. Art. 28 GDPR (conclusion of processing contracts).
Collection of access data and log files
We, respectively our hosting provider, collect the following data on the basis of our legitimate interests within the scope of Art. 6 para. 1 let. f GDPR pertaining to each access to the server on which this service is located (so-called server log files). Access data includes: name of the visited website, file, date and time of access, transferred data volume, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address and the requesting provider.
Log file information is stored for a maximum of 7 days for security reasons (e.g. to investigate misuse or fraud), and then deleted. Data for which further storage is required for evidentiary purposes are excluded from deletion until the respective incident has been clarified.
Integration of third-party services and content
Within the scope of our legitimate interests (i.e. for purposes such as the analysis, optimization and rentability of our online offering pursuant to Art. 6 para. 1 let. f GDPR), we use contents or services of third parties and incorporate them into our online offering, for example, videos or fonts (hereinafter uniformly referred to as “contents”).
This always presupposes that the third-party providers of this content obtain the IP address of the users, since without the IP address they would not be able send the content to their browser. The IP address is therefore required for the display of this content. We make every effort to use only such contents whose respective providers use the IP address solely for delivering the contents. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. Pixel tags can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and may include technical information about the browser and operating system, referring websites, visiting time and other information about the use of our online offering; they may also be associated with such information from other sources.
GOOGLE TAG MANAGER
Google Tag Manager is a solution which allows us to manage so-called website tags via an interface (and thus, for example, integrate Google Analytics and other Google marketing services into our online offering). The Tag Manager itself (which implements the tags) does not process any personal data of the users. We refer you to the following information on Google services with regard to the processing of users’ personal data. Usage guidelines.
Google is certified under the Privacy Shield Agreement and thus complies with the European data protection laws.
Google will use this information on our behalf to evaluate the use of our online offering by users, to compile reports on the activities within this online offering and to provide us with further services associated with the use of this online offering and the use of the Internet. Anonymized user profiles can be created from the processed data.
We use Google Analytics only with IP anonymization enabled. This means that Google will abbreviate the IP address of users within Member States of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and abbreviated there.
The IP address transmitted by the user’s browser is not merged with other Google data. Users can prevent the storage of cookies by setting their browser software accordingly; users can also prevent Google from collecting the data generated by the cookie and relating to their use of the online offering, and the processing of this data by Google by downloading and installing the browser plug-in.
Users’ personal data will be deleted or made anonymous after 14 months.
JETPACK (WORDPRESS STATS)
Within the scope of our legitimate interests (i.e. for purposes such as the analysis, optimization and rentability of our online offering pursuant to Art. 6 para. 1 let. f GDPR), we use the plugin Jetpack (i.e. the subfunction “WordPress Stats”), which integrates a tool for statistical analysis of visitor access, offered by Automattic Inc. 60 29th Street #343, San Francisco, CA 94110, USA. Jetpack uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site.
Online presence in social media
We have an online presence on social networks and different platforms to communicate with active customers, interested parties and users, and to inform them about our services. When accessing the respective networks and platforms, the terms and conditions and the data processing policies of their respective operators apply.
Trusted Shops Trustdbadge
The Trusted Shops trust badge is integrated on this website to display our Trusted Shops seal of approval and any ratings collected, as well as to offer Trusted Shops products to buyers after they have placed an order.
This serves to protect our legitimate interests in optimal marketing by enabling secure shopping in accordance with Art. 6 para. 1 p. 1 lit. f DSGVO, which prevail in the context of a balancing of interests. The trust badge and the services advertised with it are an offer of Trusted Shops GmbH, Subbelrather Str. 15C, 50823 Cologne. The Trustbadge is provided by a CDN provider (Content Delivery Network) within the framework of order processing. Trusted Shops GmbH also uses service providers from the USA. An appropriate level of data protection is ensured. Further information on the data protection of Trusted Shops GmbH can be found here.
When the Trustbadge is called up, the web server automatically saves a so-called server log file, which also contains your IP address, date and time of the call-up, amount of data transferred and the requesting provider (access data) and documents the call-up. Individual access data are stored in a security database for the analysis of security anomalies. The log files are automatically deleted 90 days after creation at the latest.
Further personal data will be transferred to Trusted Shops GmbH if you decide to use Trusted Shops products after completing an order or have already registered to use them. The contractual agreement between you and Trusted Shops applies. For this purpose, personal data is automatically collected from the order data. Whether you as a buyer are already registered for product use is automatically checked using a neutral parameter, the email address hashed by cryptological one-way function. The e-mail address is converted into this hash value, which cannot be decrypted by Trusted Shops, before it is transmitted. After checking for a match, the parameter is automatically deleted.
Rating reminder through Trusted Shops
If you have given us your express consent to do so during or after your order in accordance with Art. 6 (1) p. 1 lit. a DSGVO, we will transmit your e-mail address to Trusted Shops GmbH (www.trustedshops.de) so that they can send you a rating reminder by e-mail.
Diese Einwilligung kann jederzeit durch eine Nachricht an email@example.com oder direkt gegenüber Trusted Shops widerrufen werden.
Status as of 16 April 2021