Privacy policy

Privacy Notice

Contents

1. Information about the collection of personal data

2. Your rights

3. Objecting to or withdrawing consent for data processing

4. Whether you're required to provide personal data

5. Data collected when you visit our website

6. Cookies and local storage

7. Contact and customer support

8. Using our online shop

9. Advanced shop features: geolocation and international shop redirect, size recommendations, bundle offers

10. Processing of Returns via Our Returns Portal

11. Customer account

12. Becoming a retailer

13. Happy Clients

14. Direct marketing

15. Cookiebot

16. Availability notifications

17. Product reviews

18. Google Tag Manager and Stape

19. Store finder

20. Hotjar

21. Conversion and revenue analysis

22. Internal data analysis and reporting

23. Google Analytics

24. Google Ads and remarketing

25. Meta Pixel and Custom Audiences

26. Microsoft Advertising

27. Pinterest advertising features

28. OpenAi Ads (ChatGPT Ads)

29. Instagram feed

30. Social media

1. Information about the collection of personal data

The following explains what personal data we collect when you use our website. Personal data means any information that can be used to identify you — such as your name, address, email address, or browsing behaviour.

The entity responsible for data processing under Art. 4(7) GDPR is:

Cloud7 GmbH

Zur Heide 9

15712 Königs Wusterhausen, OT Zernsdorf

Deutschland

Tel.: +49 03375 959 7480

E-Mail: office@cluud7.com

We have appointed a Data Protection Officer:

LEROIL Datenschutz

Maak Roberts

Holzmarktstr. 25

10243 Berlin

E-Mail: ro@leroil.de

Where we use third-party service providers for specific features, or where we process your data for marketing purposes, we explain this in detail in the relevant sections below — including how long the data is stored.

2. Your rights

You have the following rights regarding your personal data:

Right of access
Right to rectification or erasure
Right to restriction of processing
Right to object to processing
Right to data portability

To exercise any of these rights, please contact us using the details of either the data controller or the Data Protection Officer listed above.

You also have the right to lodge a complaint with a data protection supervisory authority if you believe your data is being handled unlawfully.

3. Objecting to or withdrawing consent for data processing

If you have given us consent to process your data, you can withdraw it at any time. Withdrawal only affects processing that takes place after you notify us — it doesn't apply retroactively.

Where we process your data based on a balancing of interests (i.e., where it is not strictly necessary to fulfil a contract), you have the right to object. We indicate when this applies in the relevant sections below. If you do object, we'd ask you to briefly explain why. We will then review the situation and either stop or adjust the processing, or explain to you why we believe we have compelling legitimate grounds to continue.

4. Whether you're required to provide personal data

You are not legally or contractually required to provide personal data on this website, and doing so is not a condition for entering into a contract. However, some data is collected automatically and is technically necessary for the website to display correctly — without it, the site simply cannot function properly. In these cases, data is collected automatically when the site loads, or based on your consent.

For our contact form and newsletter, we need at least a minimum set of details — without them, we won't be able to respond or send communications.

If you place an order in our online shop, the required details are necessary to complete the purchase and process payment. You cannot buy without them.

To register as a customer or retailer and create an account, you'll need to fill in the mandatory fields. Without these, no account can be created.

5. Data collected when you visit our website

When you simply browse our website without registering or submitting any information, we only collect the data your browser automatically sends to our server. This is the minimum needed to display the site and keep it stable and secure (legal basis: Art. 6(1)(f) GDPR):

IP address
Date and time of the request
Page requested
HTTP status code
The website you came from (referrer)
Pages you visit on our site
Amount of data transferred
Browser type
Operating system and interface
Browser language and version

Our website is hosted by Shopify, and the data collected here is stored on Shopify's servers. We have a data processing agreement in place with Shopify.

To deliver our website quickly and reliably, Shopify uses Cloudflare's Content Delivery Network (CDN). Cloudflare receives certain technical data sent automatically by your browser, such as your IP address. Where Cloudflare processes data on servers in Canada or the US, this is done on the basis of the European Commission's adequacy decisions for those countries.

To ensure compatibility with older browsers, we use polyfills delivered via a Content Delivery Network operated by Fastly, Inc., 475 Brannan St, Suite 300, San Francisco, CA 94107, USA. When these scripts are loaded, your IP address and technical information (e.g., browser type, operating system, language, date and time) are transmitted to Fastly. This is necessary to deliver the required scripts and display our website correctly. The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in a functioning, browser-compatible website. Processing may take place outside the EU. Fastly is certified under the Trans-Atlantic Data Privacy Framework, and a data processing agreement is in place.

6. Cookies and local storage

In addition to the data mentioned above, our website uses cookies. Cookies are small text files stored on your device by your browser. They allow us to recognise your browser and make the website work better and more efficiently. Cookies cannot run programs or transmit viruses.

Cookies that are strictly necessary for the website to function are stored on the basis of § 25(2)(2) TDDDG (German Telecommunications Digital Services Act) (German Telecommunications Digital Services Act). All other cookies are only stored with your consent, based on § 25(1) TDDDG (German Telecommunications Digital Services Act) in conjunction with Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the "Cookie Settings" link in the footer.

We use the following types of cookies:

Session cookies

These are deleted automatically when you close your browser. They store a session ID that links your browser requests within a single visit, and also help ensure the website displays correctly on your device. Session cookies are deleted when you log out or close the browser.

Persistent cookies

These remain on your device for a set period of time, which varies depending on the cookie. You can delete them at any time in your browser's security settings.

You can configure your browser to block third-party cookies or all cookies entirely — just be aware that some parts of the website may not work properly as a result.

We use cookies for the following purposes:

Essential cookies — required for core website functions such as the shopping cart, checkout, forms, and managing your consent preferences. These cannot be disabled.
Preference cookies — used to remember settings that improve your experience on our site, such as your language preferences, time zone or newsletter preferences. These are only used with your consent.
Analytics cookies — set by Shopify or other providers such as Google Analytics to help us understand how visitors use our site. These are only used with your consent.
Marketing cookies — used by services from Shopify, Google, Meta, Microsoft, or Klaviyo to show you targeted ads on other websites and social media platforms, and to measure the effectiveness of our campaigns. These are only used with your consent.

7. Contact and customer support

When you contact us by email or through our contact form, we store the information you provide — such as your name, email address, message, and phone number if given — in order to handle and respond to your enquiry. We delete this data once it is no longer needed, or restrict its processing where legal retention obligations apply.

Where your enquiry relates to an existing or prospective purchase, the legal basis is Art. 6(1)(b) GDPR. For all other customer service enquiries, the legal basis is Art. 6(1)(f) GDPR — our legitimate interest in handling customer concerns effectively.

To manage and process customer enquiries, we use an external customer service platform, which also powers our contact form. In addition to the contact details above, order-related data and technical information (e.g., IP address, browser data) may be processed to the extent necessary to handle your enquiry.

When you load the contact form, technical services for security checks (CAPTCHA for spam and abuse prevention), error detection, and operational stability are also activated. These are provided by sub-processors of the platform and are technically necessary for the form to function securely. Where cookies are set in this context, the legal basis is § 25(2)(2) TDDDG (German Telecommunications Digital Services Act).

Processing by the platform takes place under a data processing agreement pursuant to Art. 28 GDPR. The provider processes data in the US; transfers are secured by EU standard contractual clauses under Art. 46 GDPR.

8. Using our online shop

To place an order in our online shop, you'll need to provide the personal data we require to process and deliver your order. Mandatory fields are marked accordingly; all other information is optional. We collect the following data:

Last name
First name
Company name (optional)
Phone number
Delivery address
Billing address
Email address

We process this data to fulfil your order (legal basis: Art. 6(1)(b) GDPR).

We work with an e-commerce agency for the development and maintenance of our website and shop. They may occasionally access personal data in the course of this work. We have a data processing agreement in place with the agency.

We may also use your data to keep you informed about new products from our range or to send you relevant technical information by email.

Due to commercial and tax law requirements, we are obliged to retain your address, payment, and order data for ten years.

All order data is transmitted using TLS encryption to protect it from unauthorised access, particularly financial data.

Cookies that are strictly necessary for the shop to function are stored on the basis of § 25(2)(2) TDDDG (German Telecommunications Digital Services Act).

For payment, you will be redirected to your chosen payment provider after placing your order. The payment provider is responsible for processing your personal data to complete the payment and for fraud prevention, including any credit checks.

Orders are shipped via DHL. We share your name and delivery address with DHL for this purpose. For DHL Express deliveries, we also share your phone number to help ensure successful delivery.

For orders shipped outside the European Union, we share certain personal data (e.g., name, address, order contents, invoice value, and where applicable phone number or email address) with our shipping and customs partners to fulfil our legal and contractual obligations — including customs declarations, compliance with import and export regulations, and delivery in the destination country. The legal basis is Art. 6(1)(b) and (c) GDPR.

The sale of our products is handled in partnership with Global-e, who acts as an independent data controller under GDPR. Your personal data is transmitted to Global-e during the ordering process to fulfil the purchase contract. This transfer takes place on the basis of your consent under Art. 6(1)(a) GDPR during checkout. For more information on how Global-e processes your data, please refer to their terms and conditions and privacy policy.

Certain services — such as managing your customer account, handling service requests, and arranging shipping — continue to be provided by us as the data controller, based on Art. 6(1)(b) GDPR.

To detect and prevent fraudulent activity, we use Forter, a fraud detection and transaction security service. Technical information (e.g., IP address, device identifiers, browser data) is processed and stored in the form of cookies or similar technologies. The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in fraud prevention. Forter processes data on servers in the US on the basis of the European Commission's adequacy decision under Art. 45 GDPR. Forter is certified under the Trans-Atlantic Data Privacy Framework.

When accessing and using the login area, the customer account and the checkout, technical services for security checks (CAPTCHA and bot detection to prevent spam and abuse) are integrated. These services are provided by sub-processors of the shop platform and are technically necessary for the secure and proper operation of these functions; in this context, technical data such as your IP address and browser information are processed. The legal basis is Art. 6 (1) sentence 1 lit. f GDPR (legitimate interest in the secure operation of the shop); insofar as cookies are set in this context, the legal basis is Section 25 (2) no. 2 TDDDG.

For importing and exporting shop data (e.g., product, order, or customer data), we use an external service that may access data in our shop system for this purpose. Processing takes place under a data processing agreement pursuant to Art. 28 GDPR, on the basis of Art. 6(1)(b) and (f) GDPR. The provider processes data on servers outside the EU; transfers are secured by EU standard contractual clauses under Art. 46 GDPR.

Our shop infrastructure may also use technical helper services as part of normal operations — for example, for font delivery, error detection, and logging. These are provided or triggered by the shop platform itself, and may receive technical data such as your IP address and browser information. The legal basis is Art. 6(1)(f) GDPR.

9. Advanced shop features: geolocation and international shop redirect, size recommendations, bundle offers

When you visit our online shop, we use your IP address to identify the country you're accessing from. This geolocation is used to automatically redirect visitors outside Germany to the international shop version most relevant to their country or region. Only your country is identified — your precise location is not determined. You can manually change the suggested region at any time. The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in providing a user-friendly, country-specific shopping experience.

We also use a size recommendation tool from a third-party provider to help you find the right fit for our products. Processing takes place on the basis of our legitimate interest in providing personalised size recommendations (Art. 6(1)(f) GDPR). The tool may use cookies or similar technologies, for example to remember your preferences on your next visit. Strictly necessary cookies are stored under § 25(2)(2) TDDDG (German Telecommunications Digital Services Act); other cookies are only used with your consent (§ 25(1) TDDDG (German Telecommunications Digital Services Act) / Art. 6(1)(a) GDPR), which you can withdraw at any time via "Cookie Settings" in the footer. The following data may be processed:

Product information (e.g., item, size, price, returns)
Browser and device data (e.g., IP address, language, operating system, date/time)
Preferences you voluntarily provide (e.g., measurements, fit)
Analytics data (e.g., products viewed or purchased)

We also use an announcement bar to display information such as country-specific shipping conditions, free shipping thresholds, or special promotions. No personal data such as names or email addresses is processed for this feature. However, technical information (e.g., IP address, browser and device data) and anonymous usage statistics (e.g., impressions and clicks) may be transmitted to the service provider, without linking this data to any individual. In this context, cookies are only used with your consent (§ 25(1) TDDDG (German Telecommunications Digital Services Act) / Art. 6(1)(a) GDPR), which you can withdraw at any time via "Cookie Settings" in the footer. The processing is otherwise based on our legitimate interest in communicating shipping and offer terms clearly (Art. 6(1)(f) GDPR).

10. Processing of Returns via Our Returns Portal

To handle product returns—and to help reduce or avoid them in the first place, for example by offering an exchange or a discount if you decide to keep an item after all—we use the returns portal provided by 8returns GmbH, Pappelallee 78/79, 10437 Berlin, Germany.

When you initiate a return, we process the data needed to complete it. This includes your name, contact and address details, order and product information (such as your order number and the items concerned), the reason you provide for the return, your chosen resolution (refund, exchange, or store credit), and any photos of the item you may upload.

We use this information to process your return, to offer you suitable exchange or alternative options, and to analyze return reasons so we can reduce the number of returns going forward. Where processing is necessary to fulfil your return request and the underlying purchase agreement, the legal basis is Art. 6(1)(b) GDPR. For all other purposes, we rely on our legitimate interest in running an efficient returns process and minimizing unnecessary returns, in accordance with Art. 6(1)(f) GDPR.

8returns acts as our processor under a data processing agreement concluded pursuant to Art. 28 GDPR. The platform is currently hosted within the European Union. Depending on which features are used, however, additional sub-processors may be involved, meaning we cannot rule out that your data will be transferred to countries outside the EU/EEA. Any such international transfer will comply with GDPR requirements and be backed by appropriate safeguards—in particular the EU Standard Contractual Clauses under Art. 46 GDPR or an adequacy decision issued by the European Commission under Art. 45 GDPR.

Any suggestions the portal generates automatically—such as exchange or product recommendations—are purely advisory. They do not constitute automated decision-making with legal or similarly significant effects on you within the meaning of Art. 22 GDPR.

We retain the data collected in connection with your return for as long as needed to process it, and afterward for as long as required by applicable statutory retention obligations.

11. Customer account

You can optionally register and create a customer account in our online shop. To do so, simply provide an email address. Each time you log in, you'll receive a one-time password at that address. Your order history is saved in your account for easy access. You can also add further details, such as your name and billing or delivery address, and manage your orders.

The legal basis for processing your data is Art. 6(1)(b) GDPR, as you provide it in the context of a contractual or pre-contractual relationship.

Your data is stored for as long as your account is active and deleted once you close it, provided no legal retention obligations apply. To delete your account, simply contact us at support@cluud7.com.

12. Becoming a retailer

You can apply to become a Cloud7 retailer to access our dealer pricing and conditions. To receive and process retailer applications, we use HubSpot Forms, a service provided by HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA ("HubSpot").

When you submit the form, the following data is collected and transmitted to HubSpot:

Name, company, email address, phone number, country
Message

We process this data on the basis of Art. 6(1)(b) GDPR to carry out pre-contractual steps. Data is stored for the duration of the business relationship and deleted once legal retention periods have expired.

HubSpot processes your data in the US on the basis of the European Commission's adequacy decision under Art. 45 GDPR. HubSpot is certified under the Trans-Atlantic Data Privacy Framework. For more information, see HubSpot's privacy policy.

13. Happy Clients

If you submit a photo of your dog under our "Happy Clients" section, we'll publish it on the relevant page of our website. If you let us know you're happy for us to use it on our Instagram profile, we may post it there too.

Submissions can be made by email or through the form on that page.

Your name will only be used if you provide it and indicate that you're happy to be credited. You're welcome to add an optional comment for us to publish alongside your photo.

Publishing photos, comments, and names is entirely voluntary — for you and for us.

If you'd like your photo removed at any point, just send us a quick email at press@cluud7.com. We'll delete it from the website and our Instagram profile without delay.

The legal basis for processing your personal data is our legitimate interest in featuring our happy customers on our website and Instagram profile (Art. 6(1)(f) GDPR). Since you share your data with us voluntarily, we assume you have no objection to it being used in this way.

We keep your photo and your email or submitted form for as long as the post is published, so we can demonstrate that you shared it voluntarily if needed.

Please only submit photos that you took yourself or for which you are authorised to grant us usage rights.

Instagram processes your data on servers in the US, among other locations. Certain data processing risks cannot be fully excluded. Please also note that while photos can be deleted from Instagram, continued storage or use by Instagram itself may not always be entirely preventable.

14. Direct marketing

You can sign up to receive our marketing emails — including product updates, exclusive offers, and other marketing communications — by giving us your consent. To do so, we collect your email address. We'll then send you marketing emails based on the information we gather about you, such as email open and click rates, location data, and your purchase and browsing history on our site.

We use Klaviyo, a US-based service, to send our marketing emails. When you sign up, we transmit your details to Klaviyo. We have a data processing agreement with Klaviyo, requiring them to handle your data in compliance with GDPR and maintain appropriate security measures. Klaviyo processes data on servers in the US on the basis of the European Commission's adequacy decision under Art. 45 GDPR. Klaviyo is certified under the Trans-Atlantic Data Privacy Framework.

We use a double opt-in process: after you sign up, we send a confirmation email asking you to verify that you want to receive our marketing emails. If you don't confirm, you won't be added to our mailing list. To document your consent, we store the timestamp of sign-up and confirmation, the IP address used, and the wording of the consent texts. The legal basis is Art. 6(1)(f) GDPR.

Once confirmed, we store your email address to send you marketing emails (legal basis: Art. 6(1)(a) GDPR — your consent). Where consent is not required — for example, for existing customer communications — we may send emails on the basis of our legitimate interest in direct marketing (Art. 6(1)(f) GDPR).

We track how you interact with our marketing emails — for example, whether and how often you open them, and which links you click. Klaviyo may also derive approximate location information from IP addresses. We use this data to optimise the content and frequency of our emails and to make sure what we send is relevant to you. The legal basis is Art. 6(1)(a) GDPR where your consent applies; otherwise Art. 6(1)(f) GDPR based on our legitimate interest in improving our marketing.

You can unsubscribe and withdraw your consent at any time by clicking the unsubscribe link at the bottom of any marketing email, or by emailing support@cluud7.com.

We store your data for as long as you remain subscribed and regularly review whether continued storage is necessary. Undeliverable and unsubscribed addresses are removed. After you unsubscribe, we retain your consent record and related data for up to 3 years (until end of the calendar year) to be able to demonstrate that consent existed at the time of sending — this is based on our legitimate interest under Art. 6(1)(f) GDPR.

We may also use your name and postal address to send you product information and offers by post (Art. 6(1)(f) GDPR). You can object to this at any time, without giving a reason.

From time to time we promote a password-protected outlet with special offers, which you can access by signing up to our newsletter and requesting outlet access. In this case, we process your email address and if applicable your name to send you the double opt-in confirmation email for the newsletter subscription, and upon confirmation, the outlet password. The outlet access details are only used for this purpose and are linked to your newsletter subscription.

Klaviyo also uses cookies on our website for mailing list management and web analytics. These are only used with your consent (§ 25(1) TDDDG (German Telecommunications Digital Services Act); legal basis for data processing: Art. 6(1)(a) GDPR). You can withdraw your consent at any time via "Cookie Settings" in the footer.

15. Cookiebot

We use the Cookiebot consent management platform by Usercentrics to obtain and document your consent for cookies and data processing on our website. To keep a record of your consent, the following data is collected: consent ID, consent number, timestamp, language of the consent banner, your selections, banner version, device information, and IP address.

A cookie is also stored to link your consent choices to your browser. This data is retained until you ask us to delete it, until you delete the Cookiebot cookie yourself, or until it is no longer needed.

The legal basis for storing the cookie is § 25(2)(2) TDDDG (German Telecommunications Digital Services Act). The legal basis for processing any personal data is Art. 6(1)(c) GDPR, as it is necessary to fulfil our legal obligation to document consent under Art. 7(1) GDPR.

All data is processed within the EU. We have a data processing agreement in place with Usercentrics.

16. Availability notifications

If a product is out of stock, you can sign up to be notified when it's available again by entering your email address. We use a third-party service for this purpose and have a data processing agreement in place with the provider (Art. 28 GDPR). Your email address is used solely to send you a one-time notification when the item is back in stock.

The legal basis is Art. 6(1)(b) GDPR, as this relates to pre-contractual communication in connection with a potential purchase.

The provider processes data in the US. Transfers are based on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR.

17. Product reviews

After your purchase, you have the option to leave a review for the product you bought. We use judge.me for this, a service provided by Judge.me Company Limited, based in the United Kingdom. Their privacy policy is available at: https://judge.me/privacy

If you have given your consent, you'll receive an email after your purchase inviting you to leave a review. Your review will then be displayed on the relevant product page in our shop and may help other customers make their buying decisions.

Where personal data is processed by the provider in the UK, this is done on the basis of the European Commission's adequacy decision for the United Kingdom.

The legal basis for offering the review feature is our legitimate interest in collecting product feedback (Art. 6(1)(f) GDPR). The legal basis for sending the review invitation email and processing your data to display the review is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

18. Google Tag Manager and Stape

We use Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin D04 E5W5, Ireland. Google Tag Manager is a tool that allows us to manage website tags through a single interface. The Tag Manager itself does not collect any personal data — it simply triggers other tags, which may collect data in their own right. Google Tag Manager does not have access to that data. Your IP address is transmitted to Google as part of how the service works.

We also use Stape, a server-side tracking tool, to analyse how our website is used and to manage cookies that improve the user experience. When you visit our site, personal data — in particular your IP address — is transmitted to Stape's servers. According to Stape, their servers are located within the European Union. We have a data processing agreement in place with Stape pursuant to Art. 28 GDPR.

19. Store locator

To help you find Cloud7 retailers near you, we have integrated an interactive store locator map on our retailer page.

When you visit this page, your browser automatically connects to servers of external service providers that are technically necessary to display the store finder. These include a store locator service provider as well as downstream services for IP-based geolocation, map rendering, and technical helper services.

The following data may be processed: your IP address, location data if transmitted by your device or browser, technical information about your browser and operating system, and information about your use of this page. A technically necessary cookie is also set to enable the store finder to function.

The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in offering you an easy way to find nearby retailers. The store finder is only embedded on a dedicated page that you visit intentionally. The cookie set for the store finder is strictly necessary and is stored under § 25(2)(2) TDDDG (German Telecommunications Digital Services Act).

The services used process data primarily on servers within the EU. However, individual downstream services may connect to servers of providers based outside the EU. In such cases, we rely on appropriate safeguards under Art. 46 GDPR (EU standard contractual clauses) or an adequacy decision under Art. 45 GDPR where one exists for the relevant country.

20. Hotjar

We use Hotjar, an analytics service provided by Hotjar Limited, Level 2, St Julian's Business Centre, 3, Elia Zammit Street, St Julian's STJ 1000, Malta. Hotjar processes your data on servers within Europe. We only use Hotjar with your consent, and we have a data processing agreement in place.

Hotjar only records the behaviour of individual, randomly selected users who have given their consent. If you agree, Hotjar may record your activity on our site — such as how far you scroll, where you click, and where your cursor moves — so we can understand how people use different pages. These recordings cannot be linked to individual users and contain no user IDs or other identifiers. Hotjar compiles this into aggregated statistics that help us identify which pages or areas are more or less visited, where users might be running into issues, and which products are viewed most often. We use these insights to improve our website layout and content.

Data collected by Hotjar is deleted after 12 months.

Hotjar uses cookies. These are stored only with your consent (§ 25(1) TDDDG (German Telecommunications Digital Services Act) / Art. 6(1)(a) GDPR). You can withdraw your consent at any time via "Cookie Settings" in the footer.

21. Conversion and revenue analysis

We use an analytics service to evaluate how our online shop is performing — for example, click behaviour, conversions, marketing channels, and orders. A tracking pixel is used to attribute visits and sales on our website.

The following personal data may be processed:

Technical data (e.g., IP address, referrer, user agent, device ID, cookie ID)
Customer data (customer number, order number, order ID, email address)
Click behaviour and interactions in the shop
Order information (basket value, products, payment method)
Marketing channels through which users arrived at the website

This data is used to create aggregated reports on shop performance — for example, which channel drove which sales.

The legal basis for the tracking pixel is § 25(1) TDDDG (German Telecommunications Digital Services Act) / Art. 6(1)(a) GDPR. The legal basis for processing personal data is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via "Cookie Settings" in the footer.

Processing takes place under a data processing agreement pursuant to Art. 28 GDPR. No transfers to third countries take place. As some order data cannot be transmitted directly and in full to the analytics provider for technical reasons, we use additional technical service providers based in Germany. These providers retrieve, prepare, and forward the relevant data — including customer data — from our shop system via an interface. They also assist with the technical setup and maintenance of the data transfer; no further use of the data takes place. We have data processing agreements in place with all providers involved, pursuant to Art. 28 GDPR.

22. Internal data analysis and reporting

To manage our business operations and evaluate our overall performance, we use a central internal data analytics system. This system brings together and analyses data from our online shop and inventory management system, including order and transaction data as well as customer master data such as names and email addresses.

Processing is carried out exclusively for internal analysis and reporting purposes and is not intended to support automated individual decisions about any person.

The legal basis is our legitimate interest in analysing and managing our business operations (Art. 6(1)(f) GDPR). Data is stored for as long as needed for the relevant purposes and then deleted, unless legal retention obligations require otherwise.

For these purposes, we work with data processors in the areas of data integration, cloud hosting, and data analysis and visualisation. All data is processed and stored exclusively on servers within the European Union. Some service providers are headquartered in the US; however, no regular transfers of data to third countries take place. In the event that access from a third country is required during support or maintenance activities, we have put in place EU standard contractual clauses with these providers pursuant to Art. 46(2)(c) GDPR.

23. Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Ltd. ("Google"), to analyse how visitors use our website — for example, how long they stay, which pages they visit most, and where they come from. We also use it to measure and optimise the effectiveness of our online advertising. We only use Google Analytics with your consent.

Google collects data about your browser, device, and operating system; the time and pages of your visit; the pages you visited before and after; and any interactions on the site or location data. No names or email addresses are stored, though pseudonymous user IDs may be used to track behaviour across pages. IP addresses are anonymised by Google.

Google uses this information to evaluate website usage, compile reports for us, and provide related services — including demographic and interest-based reporting (e.g., age, gender, and interests), which we can use for targeted advertising and content optimisation. Google may share this information with third parties where required by law or where third parties process data on Google's behalf. Access by US authorities cannot be fully excluded.

Data collected via Google Analytics is deleted after 14 months.

For more information: https://www.google.com/intl/en/policies/privacy/#infocollect

You can block Google Analytics cookies in your browser settings, though this may affect how some parts of the site work. You can also opt out of Google Analytics tracking entirely by installing the Google Analytics Opt-out Browser Add-on: http://tools.google.com/dlpage/gaoptout

Google Analytics cookies are stored only with your consent (§ 25(1) TDDDG (German Telecommunications Digital Services Act) / Art. 6(1)(a) GDPR). You can withdraw your consent at any time via "Cookie Settings" in the footer.

We have a data processing agreement in place with Google. Where Google processes data on US servers, transfers are based on the European Commission's adequacy decision under Art. 45 GDPR. Google is certified under the Trans-Atlantic Data Privacy Framework.

Provider: Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

We also use Google Analytics for cross-device visitor analysis using a User ID. You can disable cross-device tracking in your Google account under "My Data" → "Personal data".

24. Google Ads and remarketing

We use Google Ads and various conversion tracking and remarketing technologies provided by Google Ireland Limited ("Google"). Google Ads is only activated with your consent.

These technologies allow us and Google to see, for example, whether a user clicked on one of our ads and was directed to our website. Google Ads also allows us to track sales in combination with Google Analytics. In some cases, sales can be attributed to specific customers — for example, by transmitting an encrypted (hashed) version of a customer's email address to Google, allowing Google to match our customers to their own users if they were logged into their Google account at the time of the purchase or interaction with one of our ads. We do not receive any personally identifiable information — only aggregated statistics about the total number of users who clicked an ad and were directed to a tagged page. We also use remarketing to show our ads to previous visitors of our website on other websites and social media.

Data processed by Google through Google Ads includes: browser language, browser type, ads clicked, cookie ID, cookie information, date and time of visit, session duration, pages visited, content interests, IP address, referrer URL, usage data, web request, and where applicable the following hashed customer data: email address, name, address, or phone number.

The legal basis for storing cookies is § 25(1) TDDDG (German Telecommunications Digital Services Act) / Art. 6(1)(a) GDPR. The legal basis for processing personal data is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via "Cookie Settings" in the footer.

We have a data processing agreement in place with Google. Google also processes data on US servers on the basis of the European Commission's adequacy decision under Art. 45 GDPR. Google is certified under the Trans-Atlantic Data Privacy Framework.

Provider: Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

25. Meta Pixel and Custom Audiences

We have embedded a code from Meta (formerly Facebook) on our website that sets a cookie — known as the Meta Pixel. The Meta Pixel is only activated with your consent. It allows Meta to track your visits to our website and subpages, as well as any actions you take, and to potentially link this to your Facebook profile and other data Meta holds about you. In particular, it records whether you previously clicked on one of our ads on Facebook or other websites. This tracking can work across different devices and browsers as long as you're logged into your Facebook profile — even if you don't have a Facebook window open.

Through the Custom Audiences feature, we can define which audiences and Facebook users see our ads — for example, we can show ads to people who have previously visited our website. This feature also allows us to measure the effectiveness of our ads and make the most of our advertising budget. The data Meta collects is only available to us in the form of anonymous reports and is used solely for advertising purposes.

The Meta Pixel and Custom Audiences are offered by Meta Platforms Ireland Ltd. ("Meta"), 4 Grand Canal Quay, Grand Canal Bridge, Dublin 2, Ireland. You can prevent Meta and its partners from showing you ads by adjusting your Facebook ad settings here: https://www.facebook.com/ads/website_custom_audiences/. For more information on how Meta processes your data: https://www.facebook.com/policy.php

For the processing of your data in connection with tracking your activity on our website and our ads, we are jointly responsible with Meta — but not for Meta's further processing of that data. We have entered into a joint controller agreement with Meta, available here: https://www.facebook.com/legal/controller_addendum

Meta has agreed to handle data subject rights requests in relation to its own processing. Users can, for example, submit access or deletion requests directly to Meta. Your rights as a data subject are not affected in any way by our agreements with Meta.

Meta also processes data on servers in the US on the basis of the European Commission's adequacy decision under Art. 45 GDPR. Meta is certified under the Trans-Atlantic Data Privacy Framework.

26. Microsoft Advertising

We have integrated advertising technologies from Microsoft Ireland Operations Limited on our website. Microsoft Advertising (formerly Bing Ads) is only activated with your consent.

This integration allows us to see, for example, whether a user clicked on one of our ads in Microsoft-powered websites, apps, or search engines (Bing, Yahoo, DuckDuckGo) and then completed certain actions on our website — such as making a purchase or signing up for the newsletter. This works through a user tag placed on our website, which allows Microsoft to attribute user actions to a prior click on one of our ads. We do not receive personally identifiable information — only aggregated statistics about the effectiveness of our ads.

Microsoft Advertising also allows us to group users into audiences based on tracked activity, so we can control which groups see our ads. This helps us use our advertising budget as efficiently as possible.

According to Microsoft, the following cookies are used:

Cookie	Description
MUID	A Microsoft cookie containing a GUID assigned to your browser. Set when you interact with a Microsoft property, including via a UET beacon call.
_uetmsclkid	Microsoft's click ID, used to improve the accuracy of conversion tracking. UET sets this as a first-party cookie in your website's domain.
_uetsid	Contains the session ID for a unique session on the website.
_uetvid	A unique, anonymised visitor ID assigned by UET to represent a unique visitor. Stored as a first-party cookie.

Data processed by Microsoft includes device data, browser data, location data, session duration, timestamps, navigation behaviour, clicks, and IP addresses. Names and email addresses may also be processed. If you are signed into a Microsoft account, Microsoft may link your activity across devices by associating it with your account.

Microsoft processes the data it collects for its own purposes; we have no control over this. Please refer to Microsoft's privacy policy for details. The legal basis for transferring your data to Microsoft is your consent (Art. 6(1)(a) GDPR).

The legal basis for Microsoft storing cookies on our website is § 25(1) TDDDG (German Telecommunications Digital Services Act) / Art. 6(1)(a) GDPR. You can withdraw your consent at any time via "Cookie Settings" in the footer. You can also manage your interest-based advertising preferences with Microsoft at https://account.microsoft.com/privacy/ad-settings and opt out of behavioural tracking via https://youradchoices.com/ or https://optout.networkadvertising.org/.

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Privacy policy: https://privacy.microsoft.com/en-us/privacystatement

Microsoft also processes data on servers in the US on the basis of the European Commission's adequacy decision under Art. 45 GDPR. Microsoft is certified under the Trans-Atlantic Data Privacy Framework.

27. Pinterest advertising features

We have integrated Pinterest advertising features on our website. Pinterest is a service provided by Pinterest Europe Limited, 2nd Floor, Palmerston House, Fenian Street, Dublin 2, Ireland. We use Pinterest technologies that allow us to show visitors of our website relevant ads and offers on Pinterest. These conversion tracking and retargeting technologies are only activated with your consent — which you can give in the consent banner when you first visit the site, and adjust or withdraw at any time via "Cookie Settings" in the footer.

You can also disable interest-based advertising in your Pinterest account settings: https://help.pinterest.com/en/article/personalization-and-data#info-ad

Pinterest uses cookies and tracking pixels so that when you visit our website, Pinterest receives information such as the fact that you visited and which products or pages you viewed. Pinterest may link this information to your Pinterest profile and combine it with other data it holds about you. We do not receive any personally identifiable information from these analyses.

For the collection and transmission of personal data in connection with Pinterest, we are jointly responsible with Pinterest Europe Limited. The joint controller agreement pursuant to Art. 26 GDPR is available here: https://business.pinterest.com/en-us/pinterest-advertising-services-agreement/germany/

Pinterest is solely responsible for the further processing of personal data after collection. For more information on Pinterest's data processing: https://policy.pinterest.com/en/privacy-policy

Pinterest is responsible for fulfilling data subject rights under Art. 15–20 GDPR in relation to data it stores. Users can submit access or deletion requests directly to Pinterest. Your rights as a data subject are not affected in any way by our agreements with Pinterest.

Pinterest may also process your data in the US and states that it complies with applicable data protection regulations in doing so.

28. 28. OpenAi Ads (ChatGPT Ads)

We run ads in ChatGPT and have embedded a code from OpenAI on our website to measure their effectiveness — known as the OpenAI Pixel. It is only activated with your consent. If you reach our website through one of our ads in ChatGPT, the address you open contains an identifier for that ad placement. The pixel stores this identifier in a cookie on your device ("__oppref", lasting around 30 days) and transmits it to OpenAI together with details of the actions you take — such as a page view, a contact request or an order. This allows us to see whether an ad led to an enquiry or a purchase. We do not receive any personally identifiable information — only aggregated statistics on impressions, clicks and completed actions.

Data processed through the OpenAI Pixel includes: IP address, browser type and browser identifier (user agent), ad placement identifier, cookie information, date and time of the action, pages visited, type of event triggered, country, region, city and postal code, and where applicable order value, currency and details of the items ordered.

OpenAI also processes the collected data for its own purposes — in particular to provide, develop and improve its own services and to build audiences; we have no influence over this. We refer you to OpenAI’s privacy policy in this regard. OpenAI and we are each independently responsible for the data processed through the pixel. You can decide whether personalised advertising is shown to you in ChatGPT in your ChatGPT account settings. Further information: https://help.openai.com/en/articles/20001047-ads-in-chatgpt

OpenAI also processes your data on servers in the US. These transfers are based on the European Commission’s Standard Contractual Clauses under Art. 46 GDPR.

Provider: OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Privacy policy: https://openai.com/policies/eu-privacy-policy/

29. Instagram feed

We embed an Instagram feed on our website to display recent posts from our official account.

The feed is integrated via the "Instafeed" app by Mintt Studio, Rua Parque da República, 116, 4430-164 Vila Nova de Gaia, Portugal (https://minttstudio.com). When you load a page with the embedded feed, your browser connects to Mintt Studio's servers to retrieve feed metadata (post content and image references). In the process, your IP address, browser and device data, and the date and time of the request are transmitted to Mintt Studio.

The actual image files are then loaded directly from Meta's CDN server, which also receives the same technical data (IP address, browser and device data, date and time). The responsible entity for EU users is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. No Meta tracking scripts are executed and no cookies are set by Meta in this process. A transfer to the US cannot be fully excluded; where it occurs, this is based on the adequacy decision under Art. 45 GDPR (Meta is certified under the Trans-Atlantic Data Privacy Framework).

The legal basis for this processing is Art. 6(1)(f) GDPR — our legitimate interest in presenting our online offering in an engaging way with current social media content. You have the right to object to this processing at any time (Art. 21 GDPR). Please contact us using the details in the imprint.

Further information about Mintt Studio: https://minttstudio.com/privacy-policy

Further information about Meta's data processing can be found in Meta's privacy policy.

30. Social media

General information about data processing in connection with our social media profiles

We maintain profiles on Facebook, Instagram, Vimeo, LinkedIn, TikTok, and Pinterest to share information about our company and products, and to engage with users of those platforms.

To analyse our social media posts and schedule them in advance, we use Later. We have a data processing agreement in place with Later. Later processes the content of posts and the reactions to them (such as likes and comments). Later processes this data in the US and has entered into EU standard contractual clauses with us pursuant to Art. 46 GDPR.

Please be aware that personal data of social media users may be processed outside the European Union. This can create risks for users — for example, it may be more difficult to enforce your rights.

When you send us messages or leave comments on one of our company profiles, we process your personal data to communicate with you. This is based on our legitimate interest (Art. 6(1)(f) GDPR). We do not store this communication data beyond what is necessary for the exchange.

The terms and conditions of the respective platform operators apply. We cannot make any statements about what data these operators process when you visit their platforms. Please refer directly to the relevant provider; links to their privacy policies and information about the data controllers can be found below.

If you wish to submit a data access request or exercise your rights as a data subject, we recommend doing so directly with the platform providers, as only they have access to user data and can take the necessary action. That said, you are of course welcome to contact us for support.

Facebook Page

We are jointly responsible with Meta for the collection of personal data of visitors to our Facebook page — but not for Meta's further processing of that data. We have entered into a joint controller agreement with Meta, available here: https://www.facebook.com/legal/terms/page_controller_addendum

Meta has agreed to handle data subject rights requests in relation to its own processing. Users can submit requests directly to Meta. Your rights as a data subject are not affected in any way by our agreements with Meta.

For more information on Meta's data processing — including the types of content users view or interact with, and device information such as IP addresses, operating system, browser type, language settings, and cookie data — please see Facebook's privacy policy: https://www.facebook.com/policy

Meta also provides page operators with analytics (known as "Page Insights") to help them understand how users interact with their pages and content. More information from Meta on Page Insights: https://www.facebook.com/legal/terms/information_about_page_insights_data

Provider: Meta Platforms Ireland Ltd. ("Meta"), 4 Grand Canal Quay, Grand Canal Bridge, Dublin 2, Ireland.

Instagram

Provider: Meta Platforms Ireland Ltd. ("Meta"), 4 Grand Canal Quay, Grand Canal Bridge, Dublin 2, Ireland. Privacy notice: https://de-de.facebook.com/help/instagram/519522125107875

TikTok

Provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.

Privacy notice: https://www.tiktok.com/legal/privacy-policy-eea

Vimeo

Provider: Vimeo.com, Inc., 555 West 18th Street, New York, New York 10011, USA.

Privacy notice: https://vimeo.com/privacy

We are jointly responsible with Pinterest for the collection of personal data of visitors to our Pinterest profile — but not for Pinterest's further processing of that data. We have entered into a joint controller agreement with Pinterest, available here: https://business.pinterest.com/en-us/pinterest-advertising-services-agreement/germany/

Pinterest has agreed to handle data subject rights requests in relation to its own processing. Users can submit requests directly to Pinterest. Your rights as a data subject are not affected in any way by our agreements with Pinterest.

Provider: Pinterest Europe Limited, 2nd Floor, Palmerston House, Fenian Street, Dublin 2, Ireland.

Privacy notice: https://policy.pinterest.com/en/privacy-policy

Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. We are jointly responsible with LinkedIn for the collection of personal data of visitors to our LinkedIn profile — but not for LinkedIn's further processing of that data. We have entered into a joint controller agreement with LinkedIn, available here: https://legal.linkedin.com/pages-joint-controller-addendum

LinkedIn has agreed to handle data subject rights requests in relation to its own processing. Users can submit requests directly to LinkedIn. Your rights as a data subject are not affected in any way by our agreements with LinkedIn.

Privacy notice: https://www.linkedin.com/legal/privacy-policy

My shopping cart 0

No more products available for purchase

Privacy policy