Privacy policy

The German version of this privacy policy is legally binding. This English translation is provided for your convenience only.

Supplementary information on services in our shop

Google reviews via Elfsight. On our home page and product pages we embed a widget from Elfsight LLC (1000 N West Street, Suite 1200, Wilmington, DE 19801, USA) that displays our Google reviews. The widget is only loaded once you have given your consent in the cookie banner. Your browser then connects to Elfsight servers; technically necessary data such as your IP address, browser type and time of access are transmitted. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time with effect for the future via the cookie settings. A transfer to the USA is possible; Elfsight is certified under the EU-US Data Privacy Framework. Further information: elfsight.com/privacy-policy.

Privacy Policy

1. Information on the collection of personal data and contact details of the controller
2. Data collection when visiting our website
3. Contacting us
4. Cookies
5. Data processing for order handling
6. Data processing when opening a customer account and for contract processing
7. Contact for review reminders
8. Web analytics services
9. Retargeting / remarketing / referral advertising
10. Tools and other services
11. Rights of the data subject
12. Duration of storage of personal data
13. Use of the withdrawal button

1. Information on the collection of personal data and contact details of the controller

1.1. Thank you for visiting our website. Below we would like to inform you about how we handle your personal data when you use our website. Personal data is any data with which you can be personally identified.

1.2. The controller for data processing on our website within the meaning of the General Data Protection Regulation (GDPR) is:

FlowRow Deutschland GmbH
Forstallee 38
14476 Potsdam
Germany
Phone: +41 79 641 35 33
E-mail: info@flowrowfit.de

1.3. To protect the security of your data during transmission, we use state-of-the-art encryption methods (e.g. SSL or TLS) via HTTPS.

2. Data collection when visiting our website

Each time our website is accessed, our system automatically collects data and information that your browser transmits to our server (so-called "server log files"). The following data, which is technically necessary for us, is collected:

• The page of our website you visited
  
• Date and time of access
• Amount of data sent in bytes
• Source/referrer from which you reached the page
• Operating system used
• Browser used
• IP address used (where applicable in anonymised form)

The legal basis for the processing is Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and maintaining the functionality of our website. The data is not passed on or used in any other way. The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer. For this purpose the user's IP address must remain stored for the duration of the session.
We reserve the right to review the server log files retrospectively if there are specific indications of unlawful use. The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. Where data is collected to provide the website, this is the case when the respective session has ended.
Where data is stored in log files, this is the case after seven days at the latest. Storage beyond this is possible. In this case the users' IP addresses are deleted or altered so that the accessing client can no longer be identified. The collection of data to provide the website and the storage of data in log files is strictly necessary for the operation of the website. Consequently the user has no possibility to object.

3. Contacting us

If you contact us via the contact form, the data entered in the input form is transmitted to us and stored. The data collected can be seen from the respective input form. If you contact us by e-mail, only the data you enter there is transmitted to us.
The data is used exclusively to process the conversation and your request. Where the user has given consent, the legal basis for processing the data is Art. 6(1)(a) GDPR. The legal basis for processing data transmitted in the course of sending an e-mail is Art. 6(1)(f) GDPR. If the e-mail contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected and provided that no statutory retention obligations prevent this. For personal data from the contact form input screen and data sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation has ended when it can be inferred from the circumstances that the matter in question has been conclusively resolved. The user may withdraw their consent to the processing of personal data at any time. If the user contacts us by e-mail, they may object to the storage of their personal data at any time. In such a case the conversation cannot be continued.

4. Cookies

Our website uses cookies.

Cookies are text files that are stored on the user's device. When a user accesses a website, a cookie may be stored on the user's operating system. Some functions of our website cannot be offered without the use of cookies. For this it is necessary that the browser is recognised again even after a page change. User data collected by technically necessary cookies is not used to create user profiles. The above purposes also constitute our legitimate interest in processing personal data pursuant to Art. 6(1)(f) GDPR.

In addition, our website may use cookies that enable an analysis of users' browsing behaviour (so-called third-party cookies). Further information on the scope, purpose, legal basis and options to object can be found in the respective sections of the relevant chapter of this privacy policy.

As a user you have full control over the use of cookies. By changing the settings in your internet browser you can deactivate, restrict or delete the transmission of cookies. If you deactivate cookies for our website, it may no longer be possible to use all functions of the website to their full extent. You can prevent the transmission of Flash cookies by changing the settings of the Flash Player.

Help with the settings can be found in the help menu of your browser or under the following links:
Internet Explorer: http://windows.microsoft.com/de-DE/windows-vista/Block-or-allow-cookies
Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Chrome: http://support.google.com/chrome/bin/answer.py?hl=de&hlrm=en&answer=95647
Safari: https://support.apple.com/de-de/guide/safari/sfri11471/mac
Opera: https://help.opera.com/en/latest/web-preferences/#cookies

Some of the cookies used here are deleted when you close your browser (so-called session cookies). Other cookies remain on your device and enable us or our partner companies (third-party cookies) to recognise your browser on your next visit (persistent cookies). If cookies are set, they collect and process certain user information such as browser and location data and IP address values to an individual extent. Persistent cookies are automatically deleted after a specified period, which may differ depending on the cookie.


5. Data processing for order handling

5.1. If you wish to order in our web shop, it is necessary for the conclusion of the contract that you provide the personal data we require to process your order. We process the data you provide in order to process your order.

In some cases we work with external service providers to process your order. For this purpose we must pass on the personal data required.

If we commission transport companies to deliver your goods, we pass on the data required for the delivery of the goods to the respective transport company. For the processing of payments we pass on your data, to the extent necessary, to the commissioned credit institution. If we use payment service providers, you will also be informed about this below.
The legal basis for passing on your data is Art. 6(1)(b) GDPR.

5.2. Transfer of your personal data to shipping service providers

- DHL

If the goods are delivered to you by the transport service provider DHL (Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany), we pass on only the recipient's name and the delivery address to DHL for the purpose of delivery and to the extent necessary in accordance with Art. 6(1)(b) GDPR. Only if you have given your express consent during the ordering process do we pass on your e-mail address to DHL in accordance with Art. 6(1)(a) GDPR before the goods are delivered, for the purpose of arranging a delivery date or announcing the delivery. Your consent may be withdrawn at any time with effect for the future by contacting the controller named above or the transport service provider DHL.

5.3. Use of payment service providers

5.4. Apple Pay
If you select the payment method "Apple Pay" (a service of Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland), the payment is processed via the "Apple Pay" function of your device running iOS, watchOS or macOS by charging a payment card you have stored with "Apple Pay".

Your transaction is protected by the security functions of the hardware and software of your device. To release a payment, it must be authorised by entering a code and verification using the "Face ID" or "Touch ID" function of your device.

The information you provide during the ordering process together with the information about your order is passed on to Apple in encrypted form for the purpose of payment processing. Apple then re-encrypts this data and transmits it to the payment service provider of the payment card stored in Apple Pay in order to carry out the payment. The encryption ensures that only the website on which the order was placed can access the payment data.

After the payment, Apple sends the device account number and a transaction-specific, dynamic security code to the shop website to confirm the payment.
Personal data may be processed in the course of the operations described. In that case this is done for the purpose of payment processing in accordance with Art. 6(1)(b) GDPR.

When using Apple Pay on an iPhone or Apple Watch to complete a purchase made via Safari on a Mac, the Mac and the authorising device communicate via an encrypted channel on Apple's servers. Apple may process or store data in the process. However, this is done in a format that cannot identify you personally.

Information on Apple Pay's data protection is available here:
https://support.apple.com/de-de/HT203027

5.5. Google Pay
If you select the payment method "Google Pay" (a service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google")), the payment processing is arranged via the "Google Pay" application of your mobile device running Android (at least 4.4 "KitKat") and equipped with an NFC function. Payment is made via one of your payment cards stored with Google Pay or a payment system verified there (e.g. PayPal). To release a payment of more than 25 EUR via Google Pay, you must first unlock your mobile device. The information you provide when ordering is passed on to Google for the purpose of payment processing. Google generates a one-time transaction number which is transmitted to the ordering website to verify the payment. This transaction number is merely a numerical token that contains no information about your data. The actual transaction is carried out between the user and the ordering website by charging the payment method stored with Google Pay. Personal data may be processed in the course of the operations described. In that case the processing is carried out for the purpose of payment processing in accordance with Art. 6(1)(b) GDPR.

The Google Pay terms of use can be found here:
https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=de
Further information on data protection at Google Pay can be found at the following internet address:
https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de
Further information on data protection at Google can be found here: https://business.safety.google/privacy/


- Klarna

For payment using the following payment methods (where offered):
- "Klarna pay by invoice"
- "Klarna instalments"
- "Klarna direct debit" (a Klarna Sofort payment method), "Klarna credit card payment" (a Klarna Sofort payment method) and Klarna "pay now" (a Klarna Sofort payment method),
payment is processed by Klarna AB (publ) [https://www.klarna.com/de], Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter "Klarna"). We pass on your personal data (first and last name, street, house number, postcode, town, gender, e-mail address, telephone number and IP address) as well as data relating to the order (e.g. invoice amount, items, delivery method) to Klarna for the purpose of identity and credit checks, provided that you have expressly consented to this transfer in accordance with Art. 6(1)(a) GDPR. Klarna may pass on your data to one of the following credit agencies:
https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The credit report may contain probability values (so-called score values). Where score values are included in the result of the credit report, they are based on a scientifically recognised mathematical-statistical method. The calculation of score values includes, among other things but not exclusively, address data. You may withdraw your consent at any time by sending a message to the controller responsible for processing your data or to Klarna. However, Klarna may still be entitled to process your personal data if this is necessary for processing the payment in accordance with the contract. For data subjects based in Germany, the following Klarna privacy provisions apply:
https://cdn.klarna.com/1.0/shared/content/policy/data/de_de/data_protection.pdf
For data subjects based in Austria, the following Klarna privacy provisions apply: https://cdn.klarna.com/1.0/shared/content/policy/data/de_at/data_protection.pdf

5.6. Shop Pay
Among other things, we offer payment via Shop Pay on our website (Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, hereinafter "Shop Pay"). When you pay with Shop Pay, personal data is collected from you. Your data is transmitted to Shop Pay on the basis of Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (processing for the performance of the contract) and only to the extent necessary.
You may withdraw your consent to data processing at any time; a withdrawal does not affect the lawfulness of data processing operations carried out in the past.

Further information on data protection at Shop Pay:
https://www.shopify.com/pay
and in the Shop Pay privacy policy at
https://www.shopify.de/legal/datenschutz

- Shopify Payments
We use the payment service provider "Shopify Payments", 3rd Floor, Europa House, Harcourt Building, Harcourt Street, Dublin 2. If you choose a payment method offered via the payment service provider Shopify Payments, the payment is processed via the technical service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to which we pass on the information you provided during the ordering process together with the information about your order (name, address, account number, bank code, credit card number if applicable, invoice amount, currency and transaction number) in accordance with Art. 6(1)(b) GDPR. Your data is passed on exclusively for the purpose of payment processing with Stripe Payments Europe Ltd. and only to the extent necessary for this purpose. Further information on data protection at Shopify Payments can be found at the following internet address:
https://www.shopify.com/legal/privacy
Data protection information on Stripe Payments Europe Ltd. can be found here:
https://stripe.com/de/privacy

6. Data processing when opening a customer account and for contract processing

If you open a customer account with us, personal data is collected and processed in accordance with Art. 6(1)(b) GDPR. The scope of the data can be seen from the input form. The data you enter is stored and used by us for contract processing.
You can delete your customer account at any time. This can be done by sending a message to the address of the controller or, where offered, directly in the customer account. In that case we will also block your data, taking into account retention periods under tax and commercial law, and delete it after these periods have expired. This may only be prevented by your consent to permanent storage or by a further use of the data permitted by law on our part.

7. Contact for review reminders

7.1. Our own review reminder

With your express consent in accordance with Art. 6(1)(a) GDPR, you will receive an e-mail from us as a one-time reminder to submit a review of your order. You may withdraw your consent at any time by sending a message to the controller responsible for processing your data.

7.2. Review reminder via Google Customer Reviews

On the basis of your express consent in accordance with Art. 6(1)(a) GDPR, we transmit your e-mail address to the review platform Google Customer Reviews (© Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, (www.google.de)). You will receive a review reminder from Google by e-mail.
You may withdraw your consent at any time by sending a message to the controller responsible for processing your data or to Google.

Further information on data protection at Google can be found here: https://business.safety.google/privacy/

8. Web analytics services

8.1. Google Analytics 4
We use Google Analytics 4 on our website, a web analytics service of Google Ireland Limited (Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland) (hereinafter "GA4").

Google Analytics uses "cookies". These are small text files that are stored on your device and enable an analysis of your use of the website. The information generated about your use of this website (including the shortened IP address) is transmitted to a Google server, where it is stored and further processed; a transfer to the USA is possible. IP addresses are anonymised by default. For IPv4 addresses the last octet, and for IPv6 addresses the last 80 bits, are set to zero in memory and thus "anonymised". A personal reference is excluded. A transfer to servers of Google LLC, based in the USA, cannot be ruled out.

During your visit to the website, GA4 records your user behaviour in the form of "events", such as: page views, first visit to the website, start of the session, your "click path", interaction with the website, scrolls, clicks on external links, internal search queries, interaction with videos, file downloads, ads seen / clicked, language setting. GA4 also records your approximate location (region), your IP address (in anonymised form), technical information about your browser and the devices you use (e.g. language setting, screen resolution), your internet provider, the referrer URL (via which website / advertising material you came to this website).

On our behalf, Google uses this information to evaluate your use of the website, to compile reports on website activity and to provide us with other services related to website and internet use. Your anonymised IP address collected in this context is not merged with other Google data.

The data collected in this context is stored for fourteen months.

The legal basis for the data processing described here and for setting cookies is your express consent pursuant to Art. 6(1)(a) GDPR. This consent can be revoked at any time with effect for the future, for example by deactivating this Google service via the cookie consent tool in which you previously gave your consent.

Without your consent, Google Analytics 4 is not used during your visit to the site. You may revoke your consent at any time with effect for the future. To exercise your right of revocation, please deactivate this service via the "cookie consent tool" provided on the website.

Google LLC, based in the USA, is certified under the US-European data protection agreement "EU-U.S. Data Privacy Framework", which ensures compliance with the level of data protection applicable in the EU.

We have also concluded a data processing agreement with Google.

Further information on data protection through Google Analytics 4 can be found on the following websites:
https://policies.google.com/technologies/partner-sites
and
https://policies.google.com/privacy?hl=de&gl=de

Demographic characteristics
The "demographic characteristics" function of GA4 can compile statistics from which conclusions can be drawn about the age, gender and interests of site visitors. For this purpose, advertising and information from third-party providers is analysed and target groups for specific marketing activities are identified. However, no personal attribution of data takes place. The data is deleted after fourteen months.

User IDs
If we use the extended "User IDs" function, your activities (including conversions) can be analysed across devices. In this case, the analysis is not pseudonymous.

This is possible if you have given your consent to the use of Google Analytics 4 pursuant to Art. 6(1)(a) GDPR, have set up an account on this website and log in to this account on different devices.

Google Signals
If we use the "Google Signals" extension, we can have cross-device reports on your usage behaviour prepared. However, we only receive statistics and no personal data. This analysis is only possible if you have activated personalised ads in your Google account and linked your devices to a Google account. Your consent to the use of Google Analytics pursuant to Art. 6(1)(a) GDPR must also be in place.

Cross-device analysis can be prevented by deactivating the "personalised advertising" function in your Google account.

Further information on Google Signals can be found here: https://support.google.com/analytics/answer/7532985?hl=de

Further information on Google's privacy practices can be found here:
https://business.safety.google/privacy/

8.2. Microsoft Clarity

We use Microsoft Clarity on our website, a web analytics service of Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052-6399 (hereinafter "Microsoft").

Microsoft collects user data such as
• IP address
• location
• browser information
• screen resolution
• language settings
• website/subpages visited
• date/time of access to the website
• clicks, scrolls, mouse movements

To recognise users, Microsoft sets a cookie in your browser which is stored for one year.

The information generated in this way about your use of this website (including the shortened IP address) is transmitted to a Microsoft server, where it is stored and further processed; a transfer to the USA is possible.

In this way, heatmaps allow us to identify areas where users spend a long time, and we can also record entire sessions and view them afterwards. We use the insights gained to optimise our website.

The legal basis for the data processing described here and for setting cookies is your express consent pursuant to Art. 6(1)(a) GDPR. You can withdraw this consent at any time with effect for the future, for example by deactivating this Microsoft service in the cookie consent tool in which you gave your consent.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:
https://privacy.google.com/businesses/gdprcontrollerterms/ and
https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

We have also concluded a data processing agreement with Microsoft.

Further information on data protection at Microsoft can be found at:
https://privacy.microsoft.com/en-us/privacystatement

8.3. Shopify Analytics

We use the web analytics service of Shopify (Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland).

To safeguard our legitimate interest in the statistical analysis of user behaviour for optimisation and marketing purposes, Shopify collects, evaluates and stores pseudonymised visitor data from which pseudonymised usage profiles can be created and evaluated. Shopify uses cookies to recognise the browser and thus enable a more precise determination of statistical data. Your IP address is also collected, but it is pseudonymised immediately after collection and before storage, so that it cannot be linked to you personally.

The legal basis is Art. 6(1)(a) GDPR, namely your express consent.

Shopify does not combine your IP address with other Shopify data.

To object to data collection, the creation of pseudonymised user profiles and the setting of cookies in future, you can generally deactivate the use of cookies on your computer by setting your internet browser so that no more cookies can be stored on your computer in future or cookies already stored are deleted. However, switching off all cookies may mean that some functions on our website can no longer be used in full.

Shopify's privacy policy can also be found at:
https://www.shopify.com/legal/privacy

9. Retargeting / remarketing / referral advertising

9.1. Meta Custom Audience via the pixel method
On this website we use the "Meta Pixel" of Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Meta"). If express consent has been given, this makes it possible to track the behaviour of users after they have seen or clicked on a Facebook advertisement. This procedure serves to evaluate the effectiveness of Facebook advertisements for statistical and market research purposes and can help to optimise future advertising measures. The data collected is anonymous to us, so we cannot draw any conclusions about the identity of users. However, the data is stored and processed by Facebook, so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes in accordance with the Facebook Data Policy (https://www.facebook.com/about/privacy/).

You can enable Meta and its partners to place advertisements on and off Facebook. For these purposes, a cookie may be stored on your device. These processing operations take place exclusively if express consent has been given in accordance with Art. 6(1)(a) GDPR. Consent to the use of the Meta Pixel may only be given by users who are older than 13 years. If you are younger, we ask you to seek permission from your parents or legal guardians. You can deactivate the use of cookies on your computer via the corresponding browser settings. However, this may mean that some functions on our websites can no longer be used to their full extent. You can also deactivate the use of cookies by third-party providers such as Meta on the following website of the Digital Advertising Alliance: http://www.aboutads.info/choices/

Meta Platforms Inc. is certified under the US-European data protection agreement "EU-U.S. Data Privacy Framework", which ensures compliance with the level of data protection applicable in the EU.
Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum.

9.2. Facebook Custom Audience via the pixel method
On this website we use the "Facebook Conversions API" of Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Facebook"). If express consent has been given, data about user behaviour can be transmitted to Facebook for evaluation. This allows users to be shown advertisements based on their user behaviour.

Data used:
email address, telephone number, gender, date of birth, first and last name, city, state and country, postcode, user IDs, IP addresses, client user agent (the browser and operating system you use), click IDs, browser ID, product IDs, advertising ID, Facebook login ID

The data is stored and processed by Facebook, so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes in accordance with Facebook's data use policy (https://www.facebook.com/about/privacy/).

You can deactivate the use of cookies on your computer via the corresponding browser settings. However, this may mean that some functions on our website can no longer be used in full. You can also deactivate the use of cookies by third-party providers such as Facebook on the following website of the Digital Advertising Alliance: http://www.aboutads.info/choices/

Meta Platforms Inc., based in the USA, is certified under the EU-U.S. Data Privacy Framework, which guarantees compliance with the level of data protection applicable in the EU.

10. Tools and other services

Google reCAPTCHA

We use the reCAPTCHA function of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google") in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in preventing misuse and spam.

reCAPTCHA is a function intended to ensure that an entry is made by a natural person.
In the course of using reCAPTCHA, personal data (e.g. IP address, mouse movements, time spent on the page, and other data required for the analysis if applicable) is transmitted to Google and processed there on our behalf. In this respect Google acts as a processor in accordance with Art. 28 GDPR. We have concluded a corresponding data processing agreement with Google which governs the processing of personal data on our behalf.

When using Google reCAPTCHA, your personal data may also be transmitted to the servers of Google LLC in the USA.

Google LLC, based in the USA, is certified under the US-European data protection agreement "EU-U.S. Data Privacy Framework", which ensures compliance with the level of data protection applicable in the EU. Further information on Google's privacy policy is available at the following internet address:
https://policies.google.com/privacy

11. Rights of the data subject

11.1. The applicable data protection law grants you comprehensive rights as a data subject (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data, about which we inform you below:

- Right of access pursuant to Art. 15 GDPR:
You may request confirmation from the controller as to whether personal data concerning you is being processed by the controller. In addition, you have the right to information about the purpose, the categories of personal data, the recipients, the envisaged period of storage and the existence of further rights such as rectification of the data or the existence of a right to lodge a complaint with a supervisory authority, the origin of your data if it was not collected by us, the existence of automated decision-making including profiling and, where applicable, meaningful information about the logic involved and the significance and envisaged consequences of such processing for you, as well as your right to be informed of the safeguards pursuant to Art. 46 GDPR that exist when your data is transferred to third countries;

- Right to rectification pursuant to Art. 16 GDPR:
You have the right to the immediate rectification of inaccurate data concerning you and/or the completion of incomplete data stored by us; the rectification or completion must be carried out without undue delay.

- Right to restriction of processing pursuant to Art. 18 GDPR:
You have the right to request the restriction of the processing of your personal data while the accuracy of your data, which you contest, is being verified, if you refuse the erasure of your data on account of unlawful data processing and instead request the restriction of the processing of your data, if you need your data for the establishment, exercise or defence of legal claims after we no longer need this data once its purpose has been achieved, or if you have objected on grounds relating to your particular situation, as long as it has not yet been determined whether our legitimate grounds prevail;
If the processing of personal data concerning you has been restricted, this data may – apart from its storage – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. If the restriction of processing has been imposed, you will be informed by the controller before the restriction is lifted.

- Right to erasure pursuant to Art. 17 GDPR:
You have the right to obtain the immediate erasure of your personal data if the conditions of Art. 17(1) GDPR are met. However, this right to erasure does not exist in particular – but not exclusively – where the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims

- Right to be informed pursuant to Art. 19 GDPR:
If you have exercised your right to rectification, erasure or restriction of processing, the controller is obliged to communicate this rectification or erasure of the data or restriction of processing to all recipients to whom your personal data has been disclosed, unless this proves impossible or involves disproportionate effort. You also have the right to be informed about these recipients.

- Right to data portability pursuant to Art. 20 GDPR:
You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller, insofar as this is technically feasible;

- Right of withdrawal pursuant to Art. 7(3) GDPR:
You have the right to object at any time to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions.
You also have the right to withdraw your consent under data protection law at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the time of withdrawal.

- Right to lodge a complaint pursuant to Art. 77 GDPR:
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

11.2. Right to object

You have the right to object at any time, with effect for the future, to the processing of your data if we process your data on the basis of our overriding legitimate interest following a balancing of interests.
If you exercise this right to object, we will cease processing your data unless there are demonstrably compelling legitimate grounds that override this cessation or unless the further processing serves the exercise or defence of legal claims.

12. Duration of storage of personal data

The duration of storage of personal data depends on the respective statutory retention periods. After these have expired, we routinely delete the data if it is no longer required for the performance or initiation of a contract and/or we no longer have a legitimate interest in continued storage.

13. Use of the withdrawal button

As soon as the withdrawal button is used, we process the personal data entered there: name, order data / contract data, communication data (withdrawal declaration), time of withdrawal, and where applicable user account/IP data (for the online form). The processing is carried out for the purpose of identifying your contract and documenting your withdrawal. We store the data for documentation purposes for a maximum of 10 years and delete it automatically, provided that no statutory retention obligations prevent deletion. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (compliance with a legal obligation)