Privacy policy

Privacy information Blackstoneproducts.eu

On this page, we inform you about the processing of your personal data when you visit and shop on the Blackstoneproducts.eu website. Please note that this privacy policy may be updated from time to time as new technologies are implemented and/or legislation changes.

Information about data processing in connection with applications for vacancies at WeberBlackstone is available on our website under “Privacy information for applicants”.

A. General information

1. Contact details of the controller and data protection officer

a. Joint controllers

The joint controllers for data protection purposes are Weber-Stephen Deutschland GmbH, Rheinstraße 194, 55218 Ingelheim (Germany), Weber-Stephen Products (U.K.) Limited, Campus Reading International, Reading, RG2 6DA (United Kingdom), Weber-Stephen Schweiz GmbH, Bahnhofplatz 1, 8001 Zürich (Switzerland), Weber-Stephen Products LLC, 1415 S. Roselle Road, Palatine, Illinois 60067 (USA), and North Atlantic Imports LLC, 49 S HWY 165, Providence, UT 84332 (USA).

Weber-Stephen Deutschland GmbH is generally the controller responsible for processing in connection with the sale of products. By way of exception, Weber-Stephen Products (U.K.) Limited is responsible for customers from the United Kingdom and Weber-Stephen Schweiz GmbH for customers from Switzerland. Your billing address determines which company is responsible.

The controllers named above jointly determine the purposes and means of data processing. Below, “WeberBlackstone” refers collectively to the joint controllers, unless individual controllers are expressly named. All transfers to third countries within the WeberBlackstone group take place on the basis of EU standard contractual clauses pursuant to Implementing Decision EU/2021/914, unless an adequacy decision exists. Adequacy decisions exist for transfers between establishments in the EU and the United Kingdom, Switzerland and Canada. Weber-Stephen Products LLC (USA) and North Atlantic Imports LLC are not certified under the EU–US Data Privacy Framework, which means that no EU adequacy decision applies to transfers to these companies.

b. Contact

The central point of contact for data protection questions and for exercising your rights under applicable data protection law for all joint controllers in the WeberBlackstone group is Weber-Stephen Deutschland GmbH, Rheinstrasse 194, 55218 Ingelheim, Germany.

Email: support@blackstoneproducts.eu

Tel: +442046034598

c. Data protection officer

The contact details of the data protection officer of Weber-Stephen Deutschland GmbH are: Weber-Stephen Deutschland GmbH, for the attention of the Data Protection Officer (personal/confidential), Rheinstrasse 194, 55218 Ingelheim, Germany, dpo@weberblackstone.com.

2. Children

Our online services are not directed at children under the age of 16.

3. Data deletion and retention periods

As a rule, we only store your personal data for as long as necessary to fulfil the relevant purposes. Once the purpose no longer applies, the data is deleted, Article 17, Article 5(1)(e) GDPR.

In some cases, we are legally required to retain your data for a specific period (e.g. for tax purposes). We also cannot delete your data while legal proceedings are pending in which your data is required as evidence.

4. Information for customers from Switzerland and the United Kingdom

Where this privacy policy refers to the GDPR, for you as a customer from the United Kingdom this also means the largely equivalent provisions of the UK GDPR.

Where we state that transfers to third countries are protected by EU standard contractual clauses pursuant to Implementing Decision EU/2021/914, transfers from the United Kingdom are additionally subject to the International Data Transfer Addendum issued by the UK supervisory authority, the Information Commissioner's Office (ICO). We have agreed this addendum with the respective service providers; it supplements the standard contractual clauses with the modifications required under the UK GDPR.

For transfers from Switzerland, we rely on the same EU standard contractual clauses as standard data protection clauses recognised by the Swiss supervisory authority, the Federal Data Protection and Information Commissioner (FDPIC), within the meaning of Article 16(2)(d) of the Swiss Federal Act on Data Protection (FADP). As these clauses in their original form are tailored to the GDPR, we have concluded an additional agreement with the respective service providers under which Swiss law applies to these transfers, the FDPIC is recognised as the competent supervisory authority and references to the GDPR are to be understood as references to the FADP.

5. Your rights

You have the following rights:

  • The right of access under Article 15 GDPR.

  • The right to rectification under Article 16 GDPR.

  • The right to erasure under Article 17 GDPR.

  • The right to restriction of processing under Article 18 GDPR.

  • The right to data portability under Article 20 GDPR.

  • The right to object under Article 21 GDPR.

Where you have given consent, you also have the right to withdraw it with effect for the future, Article 7(3) GDPR.

To exercise your data subject rights, please contact our central point of contact, Weber-Stephen Deutschland GmbH. However, you may exercise your data subject rights against any of the joint controllers.

Do you no longer wish to receive promotional emails? Use the unsubscribe link in our emails or send us a message at the email address listed above under “Controller”.

You also have the right to lodge a complaint with a data protection supervisory authority.

The corresponding rights under the UK GDPR apply to customers in the United Kingdom. You may lodge complaints there with the ICO supervisory authority.

6. Participation in competitions/promotions

We regularly organise competitions and promotions online and offline in which you can participate. Participants are informed separately of the terms of participation and the personal data collected when the competition or promotion is held, as these may vary. We need your data to run the competition. We can use the information you provide to

  • check whether you are eligible to participate,

  • notify you if you have won,

  • send you your prize and

  • subject to your consent, offer you similar competitions or offers in the future.

Your data is processed on the basis of Article 6(1), first sentence, point (b) GDPR (performance of a contract) to perform the competition contract and Article 6(1), first sentence, point (f) GDPR (legitimate interest: sales promotion, increasing brand awareness). We require your express consent under Article 6(1), first sentence, point (a) GDPR to process your data for advertising purposes.

Where winners are photographed for corporate communications and external presentation purposes (e.g. for publication online or on social media channels), or photographs are taken in connection with the prize, these photographs may also be used by us and/or the competition partner (e.g. manufacturer, organiser). The legal basis is your consent under Article 6(1), first sentence, point (a) GDPR.

The recipients of the data are the WeberBlackstone companies involved in the competition and the manufacturer or competition partner with whom we conduct the competitions/promotions. Where necessary, we have concluded appropriate joint controllership and data processing agreements.

7. Contact and support enquiries

We use the data you provide exclusively to deal with your enquiry. The legal basis is your consent (Article 6(1), first sentence, point (a) GDPR) or, where your enquiry relates to a contract, the performance or initiation of a contract (Article 6(1), first sentence, point (b) GDPR).

Once your enquiry has been answered, it is archived. Access is strictly limited. Enquiries unrelated to a contract are deleted after one year. Enquiries relating to a contract are subject to statutory retention periods. We process your enquiries using the ticket management system of the processor Salesforce Service Cloud, Salesforce Tower 415 Mission Street, 3rd Floor San Francisco, CA 94105, USA. Salesforce has joined the Data Privacy Framework and thereby guarantees compliance with European data protection standards (https://www.salesforce.com/de/company/privacy/). We have also agreed standard contractual clauses with Salesforce pursuant to Implementing Decision EU/2021/914. Further information about Salesforce is available at https://www.salesforce.com/de/company/privacy/full_privacy. Your support and complaint enquiries are handled operationally by agents of the processor Yoummday GmbH, Infanteriestraße 11a, Haus E2, 80797 München.

8. Newsletter

Sign up for our newsletter now and be the first to hear about our latest offers, exciting events and current grilling trends. We need your email address for this.

Your opinion matters to us! To get to know you better, we may send you a separate email inviting you to take part voluntarily in surveys about your interests and preferences. This enables us to tailor our offers even better to your needs. Your data is used to send the newsletter and improve our offers.

We use the double opt-in procedure for newsletter subscriptions. After you sign up, we send you a confirmation email. If you do not confirm receipt within 14 days, we automatically delete your registration. Once you have confirmed, we store your email address until you unsubscribe. Mandatory fields in the registration form are marked with an asterisk; we use any additional voluntary information to tailor the newsletter content.

Data analysis – how we personalise our offers for you

We use modern analytical methods to provide you with a newsletter tailored to your interests and an even better shopping experience.

We use pixel-sized image files and individual links to measure the opening and click-through rates of our newsletters and assign these to your subscriber profile. This allows us to tailor content and sending times to your interests. We also include the order history associated with the email address. We do not offer a separate withdrawal option; you must cancel the entire subscription for this purpose.

The legal basis for sending the newsletter and measuring its performance, including storing files on your device, is your consent, which you may withdraw at any time with effect for the future. To withdraw your consent, use the unsubscribe link in our emails. Alternatively, send us a message at the email address listed above under “Controller”.

We also store the IP address used when registering and confirming, together with the respective time, to demonstrate that registration was carried out correctly and to prevent misuse. This corresponds to our legitimate interest under Article 6(1), first sentence, point (f) GDPR. There is also a legal obligation to do so under Article 6(1), first sentence, point (c) GDPR in conjunction with Article 7 GDPR.

For all processing under this section, we use the service provider Klaviyo, Inc., 125 Summer St, Floor 6–7, Boston, MA 02111 (USA), acting as our processor. An overview of the subprocessors used by Klaviyo is available at https://www.klaviyo.com/legal/subprocessors/. We base transfers to Klaviyo in the USA on the Data Privacy Framework and, additionally, EU standard contractual clauses pursuant to Implementing Decision EU/2021/914.

9. Links to third-party websites

Our website may contain links to third-party websites. We would like to emphasise that we are not the controller within the meaning of Article 4(7) GDPR for the processing of your personal data on these websites. Please consult the privacy policies of the respective websites before disclosing personal data.

B. Visiting the website and shopping at Blackstone

1. Technical provision of our website, log files

When you access our website, technical information is exchanged between the servers on which our website is operated and your device (computer, tablet, mobile phone). Your browser transmits the following data, which is processed by our servers:

  • Date and time of access

  • IP address of the requesting computer

  • Host name of the accessing computer

  • Website from which our website was accessed

  • Websites accessed through our website

  • Page visited on our website

  • Volume of data transferred and access status (file transferred, file not found, etc.)

  • Notification of whether access was successful

  • Operating system

  • Browser used, certain browser settings, operating system used

This information is technically necessary to deliver the website content you request correctly and in the appropriate language, and is inevitably generated when using the internet. This and presenting our business attractively also constitute our legitimate interests under Article 6(1), first sentence, point (f) GDPR.

Under our IT security concept, the log file data generated is stored for two weeks to identify and analyse potential attacks against our website. The legal basis for processing the data is Article 6(1), first sentence, point (f) GDPR. Our legitimate interest is protecting our information technology systems (particularly in the event of abusive attacks, known as DDoS attacks).

To operate this website and online shop, we use the Shopify e-commerce platform provided by the processors Shopify Inc., 151 O'Connor Street, Ground floor, Ottawa, Ontario, K2P 2L8, Canada, and Shopify Technology (USA) Inc., 85 10th Ave, Suite 800, New York, NY 10011, USA. Unless otherwise stated, Shopify processes data collected through the shop on our behalf. Transfers to third countries to both Shopify companies are protected by standard contractual clauses pursuant to Implementing Decision EU/2021/914. An adequacy decision applies to transfers to Shopify Inc. (Canada), ensuring an adequate level of data protection.

To display the website in the correct language and with the appropriate product descriptions, prices and taxes, we process your temporarily stored IP address and your language settings. The legal basis is our legitimate interest in a customer-friendly presentation (Article 6(1), first sentence, point (f) GDPR), as well as Article 6(1), first sentence, point (c) GDPR in conjunction with national tax law, transparency requirements under distance selling law and the EU Geo-blocking Regulation.

2. Product registration

You can register products on our website to receive important information about warranty periods, operating instructions and more. We require your name, email address and product serial number for this. We use the processor Salesforce Service Cloud, Salesforce Tower 415 Mission Street, 3rd Floor San Francisco, CA 94105, USA. Salesforce has joined the Data Privacy Framework and thereby guarantees compliance with European data protection standards (https://www.salesforce.com/de/company/privacy/). We have also agreed standard contractual clauses with Salesforce pursuant to Implementing Decision EU/2021/914. Further information about Salesforce is available at https://www.salesforce.com/de/company/privacy/full_privacy.

3. Shopping at Blackstone

When you shop in our online shop, we process the data necessary to conclude, perform or terminate the contract with you. These fields are marked with an (*). The data processed comprises: order data, name, delivery address, billing address (if different), payment details, email address and telephone number (for freight deliveries). You may provide further information voluntarily.

The data is deleted as soon as it is no longer required for contractual purposes and no statutory retention obligations prevent deletion. Unless otherwise indicated, the legal basis for processing is Article 6(1), first sentence, point (b) GDPR.

Your name and delivery address are passed to the respective delivery service provider and, additionally, your telephone number to a freight carrier to arrange a delivery appointment. This enables delivery. The delivery and freight companies are independently responsible as third parties for processing this data for data protection purposes.

To manage your customer data and process your order, after you complete your order and when a complaint order is created, we also transfer your order and contact data to our internal group ERP system, SAP. We operate the SAP Cloud used for this through our processor SAP America, Inc., 3999 West Chester Pike, Newtown Square, PA 19073, USA. The legal basis is Article 6(1), first sentence, point (b) GDPR. As there is no certification under the Data Privacy Framework, no adequate level of data protection applies. We therefore base transfers to the USA on EU standard contractual clauses pursuant to Implementing Decision EU/2021/914. We also use SAP for supply chain management, for example to make the processing of incoming and outgoing goods in connection with your order as effective as possible and to coordinate goods movements more efficiently. This corresponds to our legitimate interest in optimising goods processing. The legal basis for our legitimate interest is Article 6(1), first sentence, point (f) GDPR.

Data processing agreements and, where transfers to third countries take place, EU standard contractual clauses pursuant to Implementing Decision EU/2021/914 have been concluded with the service providers mentioned above in this section.

4. Gift cards

To issue, manage and redeem gift cards, we process the gift card code and balance and, when a card is purchased or redeemed, the name and email address as well. We engage 99minds Inc. from New York, USA, which operates the 99minds service, as our processor for this purpose. The legal basis is Article 6(1), first sentence, point (b) GDPR. As there is no certification under the Data Privacy Framework, no adequate level of data protection applies. We therefore base transfers to the USA on EU standard contractual clauses pursuant to Implementing Decision EU/2021/914. An overview of the subprocessors used by 99minds is available at 99minds.io/legal/subprocessors.

5. Customer account

You can create a customer account with us. You sign in without a password, using your email address and a one-time code. This code is valid only for a limited period; your order history remains available without a time limit for as long as your customer account exists. To manage your account, we process your registration and profile data. The legal basis is Article 6(1), first sentence, point (b) GDPR.

6. Payment processing

Depending on the payment method you select, the following payment service providers process your data as independent controllers.

For credit card payments through Shopify Payments, for Visa, Mastercard and Amex, we process name, card number or token, expiry date, CVC, billing and delivery addresses, email address and transaction data. We use Shopify Payments as a processor. The service is operated by Shopify Payment Activities Inc., 151 O'Connor Street, Ground floor, Ottawa, Ontario, K2P 2L8, Canada. The payment service providers used also process your data as independent controllers, including to fulfil their own obligations relating to money laundering prevention and customer identification.

If you choose to pay by credit card, Shopify uses Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Netherlands (“Adyen”), as a payment service provider. Adyen carries out a credit check. Detailed information about Adyen's data processing is available at https://www.adyen.com/policies-and-disclaimer/privacy-policy.

When paying through PayPal, PayPal (Europe) S.à r.l. & Cie, S.C.A., 5. Etage, 22-24 Boulevard Royal, L-2449 Luxembourg (“PayPal”), processes name, amount, bank details, card data, email address, IP address and location, both for payment processing and for PayPal's own fraud and money laundering prevention. An overview of the third parties used by PayPal is available at paypal.com/de/legalhub/paypal/third-parties-list. Detailed information about PayPal's data processing is available at https://www.paypal.com/webapps/mpp/ua/privacy-full.

With Google Pay, transaction data, name, email address, card data, IP address, billing address, telephone number and device and location data are processed for payment processing. The service is operated by Google Ireland Limited. Further information about Google Pay's compliance with the GDPR is available in the Google Payments privacy notice at https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de.

With Apple Pay, name, email address, billing and delivery addresses and a device-side payment token are processed; your card number is not transmitted in plain text. If you choose to pay through Apple Pay, payment is made through Apple Distribution International Ltd., Hollyhill Ln, Hollyhill Industrial Estate, Cork, T23 YK84, Ireland (a company of Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA), as the payment provider. Further information about Apple's compliance with the GDPR is available in Apple's privacy policy at https://www.apple.com/legal/privacy/de-ww/.

With Klarna, the amount of data processed depends on the Klarna option selected. The service is operated by Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (“Klarna”). For immediate payments, Klarna processes your contact data; for payment by invoice and instalments, it additionally processes creditworthiness and fraud check data, including data from its own and third-party scores, to make an actual credit decision. Payment by invoice and instalments may involve automated individual decision-making under Article 22 GDPR. Detailed information about Klarna's data processing is available at https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/privacy

Depending on the country, we also offer Bancontact, operated by Bancontact Payconiq Company NV/SA; TWINT, operated by TWINT AG; Vipps and MobilePay, operated by Vipps MobilePay AS; BLIK, operated by Polski Standard Płatności sp. z o.o.; Przelewy24, also known as P24, operated by PayPro S.A.; and iDEAL, operated by Currence iDEAL B.V. These providers process payments for their respective countries; in some cases, additional requirements of the card-issuing or account-holding bank apply. With TWINT, data is transferred to Switzerland, which is a third country within the meaning of the GDPR, but for which an adequacy decision of the European Commission under Article 45 GDPR exists. iDEAL processes only a transaction reference number for this purpose; your other account data remains with your account-holding bank, which is also an independent controller in this respect.

7. Order management

To manage your order centrally, from order acceptance through payment processing to delivery, and to coordinate subsequent returns, exchanges and refunds, we additionally process your order and contact data and payment and delivery information in the Salesforce Order Management System of the processor Salesforce, Salesforce Tower 415 Mission Street, 3rd Floor San Francisco, CA 94105, USA. Salesforce has joined the Data Privacy Framework and thereby guarantees compliance with European data protection standards (https://www.salesforce.com/de/company/privacy/). We have also agreed standard contractual clauses with Salesforce pursuant to Implementing Decision EU/2021/914. Further information about Salesforce is available at https://www.salesforce.com/de/company/privacy/full_privacy.

8. Shipping and delivery

For invoices, packing slips, credit notes and delivery notes, we process name, address, telephone number, email address and your full order data. The two apps Order Printer Pro, provided by Shop Circle, and Vify Order Printer PDF Invoice perform this task for us as processors. The legal basis is Article 6(1), first sentence, point (b) GDPR. The subprocessors used by Shop Circle are listed in its privacy policy at get.orderprinterpro.com/policies/privacy-policy.

Orders from our online shop are picked, packed and dispatched by Weber-Stephen Deutschland GmbH. In the United Kingdom, we use the logistics service provider Yusen Logistics (UK) Ltd, GP2 Cheaney Drive, Grange Park, Northampton NN4 5FB (United Kingdom), for this purpose. Yusen receives the data necessary to fulfil your order: name, delivery address, order number, items ordered and tracking number.

We transmit your name and delivery address to the delivery service providers we use to deliver your parcel, your email address for delivery notifications and, for large freight deliveries, your telephone number to arrange a delivery appointment. Depending on the country of delivery, these are generally the following companies:

For information about the entity responsible for your destination country, please click on the linked privacy policies of the delivery service providers. The legal basis for the transfer is Article 6(1), first sentence, point (b) GDPR.

9. Direct advertising

To email you individual product recommendations for similar goods and services, we need to process your name, email address and order history. Processing is based on Article 6(1), first sentence, point (f) GDPR (legitimate interest: sales promotion and increasing brand awareness) and the national laws implementing Article 13(2) of Directive 2002/58/EC (in Germany, section 7(3) of the Act against Unfair Competition, UWG).

We also process your postal address and order data on the basis of our legitimate interests (sales promotion and increasing brand awareness) to send you advertising by post, Article 6(1), first sentence, point (f) GDPR.

You have the right to object at any time to the processing of your data for direct marketing purposes. Simply use the unsubscribe link in our emails or send us a message at the email address listed above under “Controller”.

To send advertising by email, we use the processor Klaviyo, Inc., 125 Summer St, Floor 6–7, Boston, MA 02111 (USA). An overview of the subprocessors used by Klaviyo is available at https://www.klaviyo.com/legal/subprocessors. We base transfers to Klaviyo in the USA on the Data Privacy Framework and, additionally, EU standard contractual clauses pursuant to Implementing Decision EU/2021/914.

10. Product reviews

After you purchase a product, we warmly invite you to share your experiences with us. To do so, we send you an email (Article 6(1), first sentence, point (f) GDPR), provided you have not objected to receiving direct advertising, containing a link to our review portal.

To publish your review on our website, we require your first name and the first letter of your surname. Your email address is treated confidentially and is not published. You may withdraw your consent to publication of your review at any time.

We work with our processor Bazaarvoice Inc., 10901 Stonelake Blvd., Austin, Texas 78759, USA, to manage your reviews. Bazaarvoice is certified under the Data Privacy Framework, https://www.bazaarvoice.com/legal/privacy-policy/.

Why your opinion matters: your reviews help us continually improve our products and support other customers in making their purchasing decisions.

11. Back-in-stock notifications

If individual products in our shop are sold out, we offer a notification function. As soon as the product you want is back in stock and available for delivery, you receive an email notification.

The legal basis is your consent (Article 6(1), first sentence, point (a) GDPR), which you give by clicking the confirmation link in the email sent to you. If you no longer wish to receive further notifications at a later date, simply click the relevant link at the end of each notification email or contact us at the email address listed above. Please specify which service you wish to unsubscribe from.

Your data is automatically deleted from our notification database once the product is available again and you have been notified, or once you have withdrawn your consent.

To provide this service, we need to process your email address in connection with the product you want. Processing takes place at our processor Salesforce Inc., 415 Mission St FL 3, San Francisco, CA 94105, USA. Salesforce has joined the Data Privacy Framework and thereby guarantees compliance with European data protection standards (https://www.salesforce.com/de/company/privacy/). We have also agreed standard contractual clauses with Salesforce pursuant to Implementing Decision EU/2021/914. Further information about Salesforce is available at https://www.salesforce.com/de/company/privacy/full_privacy.

12. YouTube

We embed videos from YouTube, a Google company, on our website (service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

Embedding these videos improves our online presence by allowing us to introduce ourselves or explain our business model through short videos.

We use YouTube in “privacy-enhanced mode” to display these videos to you. According to YouTube, this means that data is only transmitted to YouTube's server when you actually start a video. If you are signed in to YouTube or Google, your data is assigned directly to your account; otherwise, the data is assigned to an advertising ID separate from your account.

Where Google Ireland Limited transfers personal data to its US parent company Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, Google guarantees the maintenance of EU data protection standards by means of standard contractual clauses pursuant to Implementing Decision EU/2021/914. Google LLC is also certified under the EU–US Data Privacy Framework, which means that an adequate level of data protection may be assumed for this transfer.

The legal basis is your consent under Article 6(1), first sentence, point (a) GDPR, which can be given through the privacy settings when you first visit the website. This consent can be withdrawn at any time in the privacy settings by deleting this website's cookies in your browser.

YouTube stores cookies on your device. If you do not agree to this, you can prevent cookies from being stored by adjusting your browser settings.

Detailed information about the purpose and scope of data collection and the storage period applied by Google is available in the provider's privacy policy at https://policies.google.com/privacy.

13. Google Tag Manager

We use Google Tag Manager to integrate services from external partners. This tool works without cookies but nevertheless requires IP addresses to be transmitted to Google. The application and use of Tag Manager are measured in this process. We have enabled anonymisation of the IP address before it is forwarded to Google. The legal basis for processing is Article 6(1), first sentence, point (f) GDPR (legitimate interests: increased efficiency in maintaining and servicing our website; reduced loading times).

C. Use of cookies and comparable technologies, consent management (privacy settings)

Our website uses cookies. Cookies are small text files placed on your device and stored by your browser. The contents of these files can be read by our servers or those of our partners, particularly to associate your device with additional information. We use both temporary cookies, which are automatically deleted when you close your browser (“session cookies”), and persistent (permanent) cookies.

Through the privacy settings, you can choose the extent to which you allow cookies to be set. Alternatively, you can make changes in your browser settings. As a rule, you can choose whether to accept all cookies, be notified when cookies are set or reject all cookies. If you choose the last option, you may not be able to use all of our services.

When using cookies, a distinction must be made between strictly necessary cookies and those used for additional purposes, which are displayed in the privacy settings.

Strictly necessary cookies are those essential for providing the website and enabling you to make purchases. These include, for example, cookies for saving language settings or products you have placed in your basket. They also contribute to the secure use of our services and help prevent fraud. Detailed information is available in the privacy settings.

1. Cookies based on your consent; privacy settings

Below is an overview of the cookies we use with the consent you give when you start using the website. Each explanation of their use also includes an opt-out option. These include cookies that record how our website is used and cookies used for advertising purposes.

To obtain, record and manage consent and receive withdrawals of consent, we use the service provider Pandectes, Pudisoo küla, Männimäe/1, 74626, Kuusalu vald, (Estonia). An individual user ID, language, types of consent and the time consent was given are stored on the server and in a cookie on your device. In addition, the data listed in section B, “Technical provision of our website, log files”, is processed to load the service. Processing takes place both on the basis of a legal obligation (Article 6(1), first sentence, point (c) GDPR in conjunction with Article 5(3) of the ePrivacy Directive 2002/58/EC, implemented in Germany in section 25 TDDDG) and on the basis of our legitimate interests in economically efficient consent management, Article 6(1), first sentence, point (f) GDPR. Pandectes privacy policy: https://pandectes.io/privacy-policy/.

We have concluded a data processing agreement with Pandectes.

2. Use of cookies to record usage behaviour (tracking, statistics)

Tracking cookies enable us to recognise users when they return to our website and thus assign usage activities to an internally allocated identifier (pseudonym). This allows us to record repeat visits to our website and analyse them together. This helps us determine which content on our website interests you most. In particular, we process your data

  • to record the number of visitors to our websites,

  • to record the respective visiting times of our website visitors, and

  • to record the sequence in which different websites are visited and to optimise our website.

Specifically, the following tracking cookies are used:

a. Tracking through Google Analytics

On this website, we use the Google Analytics web analysis service provided by our appointed service provider Google Ireland Limited to evaluate your use of the website and compile reports on website activities. This helps us better understand how visitors use our website, so we can make it more intuitive. On our behalf, our service provider processes information about your visits to our website under a pseudonymous user ID that can be assigned to your device. The tool uses cookies to assign the user ID to your device. Cookies are text files stored on your computer that can be read when you visit again. Further details about the cookies used are available in our privacy settings.

Usage information includes page views, time spent on pages and clicks, supplemented by IP-address-based location data and technical information about the device, operating system and browser used.

We have enabled IP anonymisation in Google Analytics. This truncates and anonymises your IP address. Your IP address is not transferred to the USA. Data stored on the basis of the user ID is automatically deleted after 2 months.

The data collected by the web analysis service is also partly stored and processed in the USA by our service provider. Transfers to the USA are based on the Data Privacy Framework, under which Google has obtained certification, https://www.dataprivacyframework.gov/list, Adequacy Decision EU/2023/1795, Article 45 GDPR.

You may withdraw the consent you have given at any time with effect for the future in our privacy settings (cookie button at the bottom left of the page).

Opt-out plug-in: https://tools.google.com/dlpage/gaoptout?hl=en

Google privacy policy: https://policies.google.com/privacy

b. Hotjar

Our website also uses the “Hotjar” analytics software provided by Hotjar Ltd., Level 2, St. Julian's Business Centre, 3 Elia Zammit Street, St. Julian's STJ 1000, Malta.

Hotjar allows us to measure and analyse the use of our website (clicks, mouse movements, scrolling movements, etc.). The data collected is transferred to a Hotjar server in Ireland and stored there. Hotjar collects the following data on our behalf:

  • IP address (stored and further processed in anonymised form);

  • Your email address, including your first name and surname, if you have provided these to us through our website;

  • Your device's screen size;

  • Information about device type and browser;

  • The preferred language for displaying our website;

  • Previously visited page (referrer domain);

  • Web pages visited;

  • Date and time of access to the website.

Hotjar uses this information to analyse your use of our website, create reports on its use and offer other internet analysis services.

Further information is available at https://www.hotjar.com/de/datenschutz

3. Use of cookies for advertising purposes

We use cookies for marketing purposes, for example to tailor advertising to a website visitor's interests. They are also used to limit how often an advertisement is displayed and measure its effectiveness. This records which websites and items have been clicked. In this way, we can collect information about usage habits to deliver interest-based advertising. We therefore use tracking and retargeting technologies on our website for advertising tailored to your interests. As a rule, cookies are used for this, but sometimes other technologies such as “fingerprinting” are used. The cookies temporarily stored for this purpose allow our retargeting partners to recognise visitors to our website under a pseudonym and show them only products likely to interest them. Fingerprinting recognises your device on the basis of your computer hardware, software, add-ons and browser settings. The information obtained is shared with third parties. In these cases, cookies are generally set directly by the advertising partner.

Unless otherwise stated, processing described in this section is based on your consent under Article 6(1), first sentence, point (a) GDPR.

We use the data collected for statistical and advertising purposes, specifically

  • for targeted advertising, including through advertising networks in cooperation with partners,

  • to measure the performance of and account for advertising activities between advertising partners and us,

  • to determine which advertisements you have already seen so that you are not shown the same advertisement again, and

  • to assess which parts of our website need to be optimised.

Specifically, the following cookies are set:

a. Rebuy

To provide individual product and volume-discount recommendations on our product pages and in the basket, we analyse your browsing and ordering behaviour and process, where already known, your name, email address, telephone number and address, together with your IP address, approximate geolocation and device and browser data. We use Rebuy as our processor for this purpose. The legal basis is your consent. Through an integration we have set up, data collected by Rebuy may also be included in your newsletter profile. An overview of the subprocessors used by Rebuy is available at rebuyengine.com/legal/sub-processors.

b. A/B testing – Visually

For A/B tests and the personalisation of product recommendations and content, we process behavioural and browsing data, your IP address, device and session data and transaction-related data using Visually, operated on our behalf as a processor by Visually.io, 251 Little Falls Drive, Wilmington, DE 19808 (USA). In the absence of an EU adequacy decision, transfers to the USA are based on standard contractual clauses pursuant to Implementing Decision EU/2021/914. The legal basis for processing is your consent.

c. Use of Google Ads with conversion tracking

We use the Google Ads service. Through Google Ads, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, your personal data is processed for targeted online advertising, conversion measurement (success and effectiveness of online advertising activities), tracking and the resulting creation of audiences for further advertising activities. This allows us to display online advertising within Google's advertising network mainly to users who are likely to be interested in the advertisements. For example, after visiting our website, you may be shown targeted advertising for our products and services.

For conversion and performance measurement, Google provides us with information for evaluating performance parameters such as ad impressions, clicks and conversions. This allows us to analyse how often individual buttons on our website are clicked and which products are viewed particularly frequently. By comparing this with advertising campaign data, we can determine how successful individual advertising activities are. For these purposes, user profiles are created to which you can be assigned by means of a cookie stored on your device or similar procedures. These cookies are not intended to identify you personally. The information Google provides to us is pseudonymised in a way that generally does not allow us to identify natural persons. We receive only statistical evaluations from Google. These evaluations help us identify which advertising activities are particularly effective. We receive no further data from the use of advertising materials. Identification may be possible when a “conversion” occurs. This happens when you contact us after clicking one of our advertisements.

If you are registered with a Google service, Google may be able to associate your visit with your account. Please check the privacy settings in your Google account in this regard. Google generally stores the following analytical values in user profiles:

  • Unique cookie ID

  • Number of ad impressions per placement (frequency), information about interactions with websites (click paths, intensity of use) and technical information (particularly truncated IP address, browser information, operating system)

  • Information about your location

  • Last impression (relevant for post-view conversions)

  • Opt-out information (a flag indicating that the user no longer wishes to be targeted)

The legal basis for processing and for storing and reading cookies is your consent.

Further information is available in Google's privacy policy at https://policies.google.com/privacy. Where Google processes personal data in the USA at Google LLC, this takes place on the basis of the Data Privacy Framework, under which Google has obtained certification, https://www.dataprivacyframework.gov/list, Adequacy Decision EU/2023/1795, Article 45 GDPR.

You can also prevent Google from collecting the data generated by the cookie relating to your use of the website by installing a browser plug-in: https://tools.google.com/dlpage/gaoptout?hl=de. If you do not wish to receive interest-based advertising, you can disable Google's use of cookies for these purposes by visiting https://www.google.de/settings/ads/. Further information about data protection at Google is available here: https://www.google.com/intl/de/policies/privacy/. Alternatively, you can visit the Network Advertising Initiative (NAI) website: http://www.networkadvertising.org/.

d. Use of DoubleClick by Google

This website uses the online marketing tool DoubleClick by Google, another service provided by Google. DoubleClick uses cookies to show users relevant advertisements, improve campaign performance reports or prevent users from seeing the same advertisements repeatedly. Using a cookie ID, Google records which advertisements are displayed in which browser and can prevent them from being displayed repeatedly. DoubleClick can also use cookie IDs to record conversions relating to ad requests. This occurs, for example, when a user sees a DoubleClick advertisement and later uses the same browser to visit the advertiser's website and buy something there. According to Google, DoubleClick cookies contain no personal information.

By implementing these tools, your browser automatically establishes a direct connection to Google's server. Please note that this may involve data processing outside the European Union or the European Economic Area. Transfers to the USA are based on the Data Privacy Framework, under which Google has obtained certification, https://www.dataprivacyframework.gov/list, Adequacy Decision EU/2023/1795, Article 45 GDPR.

If you do not wish to receive interest-based advertising, you can disable Google's use of cookies for these purposes by visiting https://www.google.de/settings/ads/. Further information about DoubleClick by Google is available at https://www.google.de/doubleclick/ and about data protection at Google generally at https://www.google.de/intl/de/policies/privacy/. Alternatively, you can visit the Network Advertising Initiative (NAI) website at http://www.networkadvertising.org/.

e. Microsoft Ads (Bing Ads)

We use the online advertising programme “Microsoft Ads” on our website, a service provided by Microsoft Ireland Operations, Ltd. (Ireland), One Microsoft Place, South County Business Park. Leopardstown, Dublin 18, Ireland. Microsoft Ads is an internet advertising service that allows advertisers such as us to display interest-based advertisements in Bing search results and the Microsoft Ads advertising network on the basis of your usage behaviour. Microsoft processes information about your usage behaviour to create pseudonymous usage profiles. These usage profiles are used to analyse browsing behaviour and display interest-based advertisements. This takes place by means of a cookie set by Microsoft that is valid for 180 days. This cookie is also set through our website if you have previously given your consent in our cookie settings. We learn the total number of users who clicked a Bing advertisement and were then redirected to our conversion page, meaning the page linked in the advertisement. However, we receive no information that allows us to identify individual users personally.

The legal basis for processing when using Microsoft Ads is your consent, Article 6(1), first sentence, point (a) GDPR. Your data is processed in the USA by Microsoft. Microsoft is also certified under the EU–US Data Privacy Framework, which means that an adequate level of data protection may be assumed for this transfer. The legal basis for the transfer to the third country USA is likewise your consent, Article 49(1)(a) GDPR.

Further information about data protection and the cookies used by Microsoft Ads is available on Microsoft's website at https://privacy.microsoft.com/de-de/privacystatement.

f. Amazon Ads

We use Amazon Ads, a service provided by Amazon Europe Core S.a.r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg, and its parent company Amazon.com, Inc., 410 Terry Ave N, Seattle, WA 98109 (USA) (hereinafter “Amazon”). Personal data is transferred to the USA on the basis of the parent company's certification under the Data Privacy Framework and the adequacy decision.

Amazon stores and processes information about your usage behaviour on our website. Among other things, Amazon uses cookies, i.e. small text files stored locally in the cache of your device's internet browser that enable your use of the website to be analysed. We use cookies for marketing and optimisation purposes, particularly to analyse the use of our website and continually improve individual functions, offers and the user experience. Statistical analysis of user behaviour enables us to improve our services and make them more interesting for you as a user. The following data is processed:

  • Web browser information, device information (including operating system, browser used, screen resolution)

  • HTTP header data (including cache-control data, content-type data)

  • Date and time of page access

  • URL of the previously visited page (referrer)

  • URL of the page visited

  • User ID

  • Tag ID

  • Ad ID

Further information about data processing by Amazon is available in its privacy policy at https://www.amazon.de/gp/help/customer/display.html/?ie=UTF8&nodeId=3312401&ref_=a20m_us_fnav_l_prvcy_de and at https://advertising.amazon.de/help/GSXZ8QERY34WK4QS.

g. Meta Pixel

We use Meta Pixel on our website, an analytics tool provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Meta Pixel allows us to analyse the use of our website and optimise our marketing activities.

Meta Pixel collects the following data:

Device and usage data (information as described in section B, “Technical provision of our website, log files”), your IP address (in anonymised form) and your activities on our website (e.g. pages visited, links clicked) are processed.

We process your data to display personalised advertising on other platforms (e.g. Facebook, Instagram), measure reach (measuring and optimising the effectiveness of our advertising campaigns) and optimise our website (improving our content and user-friendliness). This technology allows Meta (Facebook) to assign visitors to our services to particular groups (e.g. visitors coming from our website or according to the interests we transmit to Meta (Facebook), known as “Custom Audiences”) for the display of specific advertisements, and to recognise them again in this way.

The user data collected is anonymous to us and therefore does not allow us to draw conclusions about your identity. However, Meta Platforms Ireland Limited stores and processes data through Facebook that allows conclusions to be drawn about the respective user profile. We cannot influence the specific retention period for the processed data; this is determined by Meta Platforms Ireland Limited. Further information about Meta Pixel is available at https://www.facebook.com/business/tools/meta-pixel. Data processing by Facebook Meta takes place in accordance with Facebook Meta's data use policies. For this purpose, we have concluded a joint controllership agreement with Facebook Meta as a joint controller. Further information about data processing by Meta is available at https://www.facebook.com/about/privacy/.

The legal basis for using Meta Pixel is your consent, which you may withdraw at any time through the privacy settings, Article 6(1)(a) GDPR. Meta companies established in the USA are certified under the EU–US Data Privacy Framework, which means that the EU adequacy decision applies.