Data protection

Data protection declaration (information on data protection about our data processing according to Article Art. 12 and 13 of the General Data Protection Regulation)

We appreciate your visit to our website and your interest in our company. The protection of your personal data is important to us. Below we inform you in accordance with Art. 12 and 13 of the General Data Protection Regulation (GDPR) on the handling of your personal data when using our website https://spilanthox.shop (hereinafter: “Website”).

Personal data is individual information about the personal or factual circumstances of a specific or identifiable natural person. This includes information such as name, address, telephone number and date of birth.

1. Responsible

NB Green Cosmetics GmbH
(Nikki Benett Green Group)
Borselstraße 18
22765 Hamburg/Germany
Email: info@spilanthox.shop

2. Purposes and legal basis for data processing when using the website

2.1 Informational use of the website

You can visit our website without providing any personal information. If you only use our website for informational purposes, i.e. do not register for a customer account or newsletter, place an order or otherwise provide us with information about yourself, we do not process any personal data, with the exception of the data that your browser transmits to enable you to visit to enable the website as well as information that is transmitted to us through the cookies we use.

2.2 Technical provision of the website

For the purpose of technically providing the website, our system (i.e.H the web server) automatically collects information from your browser every time you access the website.

The temporary storage of your IP address by our system is necessary to enable delivery of the website to your computer. For this purpose, the user's IP address must necessarily be saved for the duration of the session.

The IP address is stored in the log files to ensure the functionality of our website. This data also serves us to optimize the website and to ensure the security of our information technology systems (e.g.b Attack detection).

The following information is collected:

• IP address;
• Browser type/version (ex.: Firefox 59.2 (64 bits));
• Browser language (ex.: German);
• Operating system used (ex.: Windows 10);
• Inner resolution of the browser window;
• Screen resolution;
• Javascript activation;
• Java On/Off;
• Cookies on/off;
• Color depth;
• Time of access
• The previous website from which you came to us.

We process your personal data for the technical provision of our website based on the following legal bases:

• for the technical provision of our website in accordance with Section 25 Para. 2 No. 2 TTDSG, since the processing of the aboveG Data is absolutely necessary so that we can use our website as you expressly requested (i.e.H also without or with cookies);
• to fulfill a contract or to carry out pre-contractual measures in accordance with Art. 6 para. 1 lit. b GDPR, if you visit our website to find out about our products;
• to protect our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR in order to be able to provide you with the website technically and securely.

2.3 Use of cookies

We use cookies to make our website available for you to use. Cookies are text files that are stored in the internet browser or are stored on your computer system by the internet browser when you access a website. A cookie contains a characteristic string that allows the browser to be uniquely identified when the website is accessed again. We use these cookies, among other things, to make our website and its technical functions available to you. Some functions of our website cannot be offered without the use of cookies.

2.31 Cookie First Consent Manager

On our website we use the Cookie First Consent Manager. The Cookie First Consent Manager from Digital Data Solutions B.v (CookieFirst) (Plantage Middenlaan 42a, 1018DH, Amsterdam) is a solution with which we obtain your consent to certain data processing that requires consent (e.g.b Analysis, tracking etc.Ä.). By using it we can inform you about the individual cookies we use. You can choose which cookies you want to categorically allow or reject via the Cookie First Consent Manager. This enables you to make an informed decision about sharing your data and allows us to use cookies in a data protection-compliant, transparent and documented manner.

The Cookie First Consent Manager processes your personal data to record your decision about accepting cookies and save it for future visits to our website. This includes the corresponding cookie with your consent decision as well as other usage data such as your IP, the browser used, language and country and the website you access.

In detail, the Cookie First Consent Manager lists the following cookies:

Name
Necessary cookies
secure_customer_sig	Shopify. Used in conjunction with customer login.	one year
cart_currency	This cookie contains information about the currency in which the website visitor wants to pay.	14 days
shopify_pay_redirect	The cookie is required for the secure checkout and payment functionality on the website. This feature is powered by shopify.com provided.	one hour
_pay_session	The cookie is required for the secure checkout and payment functionality on the website. This feature is powered by shopify.com provided.	Session
_orig_referrer	This cookie is typically provided by Shopify and used in connection with a shopping part.	14 days
cookiefirst consent	This cookie stores your cookie settings for this website. You can change this at any time or revoke your consent. Provider: Cookie First	6 months
cookiefirst-id	This cookie contains your unique ID to enable CookieFirst to identify unique visitors to this website. Provider: Cookie First	6 months
Performance Cookies
_y	Shopify Analytics.	one year
_shopify_y	Shopify Analytics.	one year
_shopify_sa_p	Shopify Analytics related to marketing and recommendations.	30 minutes
_s	This cookie is associated with Shopify's analytics suite.	30 minutes
_shopify_sa_t	Shopify Analytics related to marketing and recommendations.	30 minutes
_landing_page	This cookie is used to track, report and analyze landing pages.	14 days
Advertising/tracking cookies
YSC	Registers a unique ID to store statistics about which videos from YouTube the user has seen.	Session
VISITOR_INFO1_LIVE	This cookie allows YouTube to monitor bandwidth usage.	6 months
CONSENT	Third party cookies. They provide certain Google features and can store certain settings based on usage patterns and personalize the ads that appear in Google searches. Provider: Google Inc	2 years
localization	This cookie is used to monitor user location	14 days

Further information and Cookie First's privacy policy can be found at:

https://cookiefirst.com/legal/privacy-policy/

We process your personal data for the technical provision of our website based on the following legal basis:

• with your consent in accordance with Section 25 Para. 1 TTDSG regarding the initial storage and reading of data as far as advertising and tracking cookies are concerned;
• for the technical provision of Cookie First Consent Management in accordance with Section 25 Paragraph. 2 No. 2 TTDSG, since the processing of the aboveG Data is absolutely necessary so that we can enable you to use our website as expressly requested by you (without or with cookies);
• to protect our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR, in order to be able to make the website technically available to you,
• to fulfill a legal obligation under the GDPR in accordance with Art. 6 para. 1 lit. c GDPR, which lies in the provision of the option to consent and the documentation of your decision.

2.32 Analysis

When you visit our website, your surfing behavior can be statistically evaluated. This happens primarily with cookies and with so-called analysis programs. This allows us to improve the quality of our website and its content. We find out how the website is used and can therefore continually optimize our offering. You can find detailed information about this in the following explanations.

We process your personal data based on the following legal bases:

• with your consent in accordance with Section 25 Para. 1 TTDSG regarding the initial saving and reading of data;
• with your consent in accordance with Art. 6 para. 1 lit. a GDPR for further data processing (e.g.b Provision of functionalities, analysis, tracking, optimization, etc.)

You can revoke your consent at any time with future effect via our Cookie First Consent Manager. You can access the Cookie First Consent Manager from any page with one click and adjust your settings and thus revoke your consent. In addition, the Cookie-First Consent Manager can be opened via the following link to revoke your consent or to change your cookie settings:

                        Change cookie settings/revoke consent

2.321 Google Analytics

This website uses functions of the web analysis service Google Analytics. The provider is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (subsidiary of Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA; “Google”). Google Analytics uses cookies that enable analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there.

IP anonymization

We have activated the IP anonymization function on this website. This means that your IP address will be shortened by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area before it is transmitted to the USA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services related to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics is not combined with other Google data.

Browser plugin

You can prevent the storage of cookies by setting your browser software accordingly; However, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. You can also have the data generated by the cookie and related to your use of the website (incl. Your IP address) to Google and the processing of this data by Google by downloading and installing the browser plug-in available under the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

Objection to data collection

You can prevent Google Analytics from collecting your data by clicking on the following link. An opt-out cookie will be set to prevent your data from being collected on future visits to this website:

You can find more information about how Google Analytics handles user data in Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=de and https://policies.google.com/privacy?hl=de.

2.322 Google Ads Remarketing

We use Google Ads Remarketing from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google Ireland”) on our website.

Google Ads Remarketing analyzes your user behavior on our website (e.g.b Click on specific products/ads) to assign them to specific advertising target groups. With the remarketing function we can present users of our website within the Google network with advertisements based on their interests.

In addition, Google Ads Remarketing enables the created advertising target groups to be linked to the cross-device functions of Google Ireland. This means that interest-based and personalized advertising that has been tailored to you on one of your devices based on your previous usage and surfing behavior can also be displayed on another of your devices.

The use of Google Ads Remarketing is based on your consent given to us in accordance with Art. 6 para. 1 lit. a GDPR

Google Ireland receives the data as an independent controller and not as a service provider.

The information collected through the use of Google Ads will be processed after 9 or Deleted after 18 months (https://policies.google.com/technologies/ads).

The use of Google Ads Remarketing results in your data being transferred to the USA. There is no adequacy decision from the European Commission for data transfers to the USA. The data transfer takes place on the basis of standard contractual clauses as appropriate guarantees for the protection of personal data that we have concluded with Google Ireland in a data processing agreement, available at: https://business.safety.google/adscontrollerterms/

You can prevent data from being transmitted to Google Ireland by downloading and installing the browser plug-in available under the following link: https://support.google.com/My-Ad-Center-Help/answer/12155656. If you have a Google account, you can object to personalized advertising using the following link: https://myadcenter.google.com/home?hl=en&sasb=true&ref=ad-settings

2.323 Google Ads Conversion Tracking

We use Google Ads Conversion Tracking from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google Ireland”) on our website.

With the help of Google Ads Conversion Tracking, Google Ireland and we can recognize whether you have carried out certain actions. For example, we can evaluate which fields on our website were clicked how often and which products were viewed or purchased particularly frequently. This information is used to create conversion statistics. This tells us the total number of users who clicked on our ads and what actions they took. If you are registered with a Google Ireland service, Google Ireland can assign the visit to your account. Even if you are not registered with Google Ireland or If you have not logged in, it is possible that Google Ireland will find out and store your IP address.

The use of Google Ads Conversion Tracking is based on your consent given to us in accordance with Art. 6 para. 1 lit. a GDPR

Google Ireland receives the data as an independent controller and not as a service provider.

The information collected through the use of Google Ads Conversion Tracking will be processed after 9 or Deleted after 18 months (https://policies.google.com/technologies/ads).

The use of Google Ads Conversion Tracking results in your data being transferred to the USA. There is no adequacy decision from the European Commission for data transfers to the USA. The data transmission takes place u.a based on standard contractual clauses as appropriate safeguards for the protection of personal data that we have concluded with Google Ireland in a data processing agreement, available at: https://business.safety.google/adscontrollerterms/

You can prevent data from being transmitted to Google Ireland by downloading and installing the browser plug-in available at the following link: https://support.google.com/My-Ad-Center-Help/answer/12155656.

2.324 Meta pixel

We use “meta pixels” from the social network Meta from Meta Platforms Ireland Ltd. on our website., 4 Grand Canal Square, Dublin 2, Ireland (“Meta Ireland”).

When you visit our website, the meta pixel is loaded. With the meta pixel we can classify visitors to our website into specific target groups in order to be able to display appropriate advertising (“ads”) to you on meta. These pixels collect information about your browser session, in particular the banners and links clicked, a hashed version of the meta ID and the URL that is viewed. If you have a Meta account and are logged in, your visit to this website will be associated with your Meta user account. For more information about the meta pixel and how it works, see the Meta help section: https://www.facebook.com/business/help/651294705016616.

The use of meta pixels is based on your consent given to us in accordance with Art. 6 para. 1 lit. a) GDPR.

We are responsible for the use of Meta-Pixel together with Meta Ireland. The agreement on shared responsibility according to Art. 26 GDPR can be viewed at the following link: https://de-de.facebook.com/legal/terms/page_controller_addendum.

The use of Meta-Pixel results in your data being transferred to the USA. There is no adequacy decision from the European Commission for data transfers to the USA. The data transmission takes place u.a based on standard contractual clauses as appropriate guarantees for the protection of personal data, available at: As an additional measure to the standard contractual clauses, Meta has implemented the following technical and organizational measures to protect your data: https://www.facebook.com/legal/terms/data_security_terms.

For further, unilateral processing of your data by Meta Ireland, in particular with regard to. Meta Ireland is solely responsible for any potential transfer of your data to the USA. Meta Ireland uses cookies and other technologies to collect information from you. You can find out for what purposes and on what legal basis this processing takes place in the Meta data policy (https://www.facebook.com/policy.php). Please note that when you visit the website www.facebook.com/ Meta Ireland may collect and process data about you even if you neither have a Meta account nor are logged in to Meta. However, we do not know what data Meta Ireland collects from you and for what purposes it is processed.

2.325 Google Tag Manager

On our website we use Google Tag Manager from Google. Google Tag Manager is a solution that allows marketers to manage website tags from one interface. The Google Tag Manager service itself (which implements the tags) is a cookie-less domain and does not collect any personal data. The Google Tag Manager service triggers other tags, which in turn may collect data. Google Tag Manager does not access this data. If a deactivation has been made at the domain or cookie level, this will remain in effect for all tracking tags implemented with Google Tag Manager.

2.33 Youtube

We include videos from the YouTube service, the provider is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (subsidiary of Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA; “Google”). In order to make the videos available, technically necessary data is processed by Google for this purpose. Google is responsible for this processing. Further information on how Google handles your personal data can be found at: https://policies.google.com/privacy?hl=de.

The legal basis for the initial reading and/or saving of data is Section 25 Paragraph. 2 No. 2 TTDSG, because the processing of the data is absolutely necessary so that we can use our website as you expressly requested (i.e.H for example with YouTube videos). The legal basis for the initial reading and/or saving of other, technically unnecessary data is your consent in accordance with Section 25 Paragraph. 1 TTDSG Further data processing when integrating YouTube is necessary to design our website to meet your needs. This also includes our legitimate interest in data processing in accordance with Art. 6 para. 1 lit. f GDPR

2.4 Active use of the website

In addition to using our website for purely informational purposes, you can also actively use our website to order one of our products, register for a newsletter or to get in touch with us. In addition to the processing of your personal data described above for purely informational use, we also process other personal data from you, e.g.b needed to process your order.

2.41 User requests

To send us your inquiries, e.g.b To be able to process and respond to our email address or the customer chat integrated on the website, we process the data you provide in this context. These include, among other things:a Your (first and last) name, your email address and order number in order to send you a reply, as well as the other information that you send to us as part of your communication.

We process your data to answer your inquiries on the following legal basis:

• If your contact is within the framework of a contract to which you are a party or for the implementation of pre-contractual measures, the legal basis is Art. 6 para. 1 lit. b GDPR
• To protect our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR; Our legitimate interest lies in answering customer inquiries appropriately.

2.42 Registration for a customer account and use of our online shop

You have the opportunity to create a customer account on our website to access the closed area for registered users in order to view and manage your orders and your delivery address. To do this, you must register with your first and last name, email address and a password of your choice. As part of the registration process, we process the data you provide in the registration form as well as your email address and a password of your choice as access data. After sending the registration data, you must complete the registration using the so-called Confirm the double opt-in procedure by clicking on a link sent by email. The user can change his password at any time under “Account”.

We process your data when creating a customer account on the basis of Art. 6 para. 1 lit. b GDPR (foundation and implementation of a contract or pre-contractual measures).

If you register, we initially store your personal data for the duration of our business relationship, in particular for the duration of the customer account. This also includes the initiation of a contract (pre-contractual legal relationship) and the execution of a contract.

On the website we enable you to order products from our range. For this purpose, you can add items from our range to your shopping cart on the website. All items and their number are stored in the shopping cart. To make your order easier for you, we also save an order that has not yet been completely completed for you so that you can complete it the next time you visit.

For the purpose of carrying out the ordering process and the contract, we process the data that you provide to us in the ordering process. We process your data for the above purpose on the following legal basis:

• To fulfill a contract or to carry out pre-contractual measures in accordance with Art. 6 para. 1 lit. b GDPR;
• With regard to data processing at or Storage of shopping carts in accordance with Section 25 Para. 2 No. 2 TTDSG, since the processing of the relevant data is absolutely necessary so that we can use our website as you expressly requested (i.e.H of the shopping cart).

On our website we offer you various payment options when ordering, such as:b Payment by Visa, Mastercard, American Express, PayPal and Klarna Sofortüberweisung. For this purpose, payment data may be transmitted to payment service providers with whom we work. Further information on the processing of personal data by payment service providers can be found in the data protection declarations of the respective payment service providers:

• Visa Europe Management Services Limited, German Branch, Neue Mainzer Strasse 66 – 68, 60311 Frankfurt am Main. For further information, please see Visa's privacy policy: https://www.visa.de/nutzungsbedingungen/visa-globale-datenschutzmitteilung.html
• Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium. For further information, please see Mastercard's privacy policy: https://www.mastercard.de/de-de/datenschutz.html
• American Express Payment Services Limited, Frankfurt am Main branch, Theodor-Heuss-Allee 112, 60486 Frankfurt am Main. For further information, please see the American Express Services Limited Privacy Policy: https://www.americanexpress.com/de-de/firma/legal/datenschutz-center/online-datenschutzerklarung/?inav=de_legalfooter_dataprivacy
• PayPal (Europe) p.a r.l et Cie, p.CA, 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg. For further information, please see PayPal's privacy policy: https://www.paypal.com/us/legalhub/privacy-full
• Klarna Bank AU, Sveavägen 46, 111 34 Stockholm, Sweden. You can find further information in Klarna's data protection declaration: https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/privacy

2.43 Shipping company

To deliver orders, we work with external shipping service providers (e.g.b DHL) together. These shipping service providers receive the following data from us to carry out the respective order:

• Your name
• Your delivery address
• Your postal number (if you would like to have the order delivered to a DHL packing station)
• Your email address (if the shipping service provider would like to inform you by email about the expected delivery date)

2.44 Regulatory Compliance

We also process your personal data to fulfill other legal obligations. These can help us anda in connection with the processing of the order or business communication. This includes, in particular, commercial, commercial or tax retention periods.

We process your personal data based on the following legal basis:

• to fulfill a legal obligation to which we are subject in accordance with Art. 6 para. 1 lit. c GDPR in connection with commercial, commercial or tax law, insofar as we are obliged to record and store your data.

2.45 Law enforcement

We also process your personal data in order to be able to assert our rights and enforce our legal claims. We also process your personal data in order to be able to defend ourselves against legal claims. Finally, we process your personal data to the extent this is necessary to prevent or prosecute criminal offenses.

We process your personal data for this purpose based on the following legal basis:

• to protect our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR, insofar as we assert legal claims or defend ourselves in legal disputes or we prevent or investigate criminal offenses; and/or
• 17 para. 3 lit. e GDPR to assert, exercise or defend legal claims in the event of a potential obligation to delete personal data.

2.46 Advertising purposes (newsletter)

With your consent, we will use your data for advertising purposes, namely to send our newsletter. To subscribe to the newsletter, we collect your email address as mandatory information.

If you have provided us with your email address in connection with the purchase of goods, we can subsequently use it to send you a newsletter. In such a case, the newsletter will only be used to send direct advertising for similar goods or services.

We process your data for sending newsletters on the following legal basis:

• if you have given us your consent, in accordance with Art. 6 para. 1 lit. a GDPR;
• if you have provided us with your email address in connection with the purchase of goods or services or we send you personalized advertising to protect our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR i.vm § 7 para. 3 UWG; Our legitimate interest is based on our economic interests in carrying out advertising measures and target group-oriented advertising.

Right to object when used as part of a contract

If we receive your email address in connection with the conclusion of the contract and the provision of our products and you have not objected to this, we reserve the right to regularly send you offers for similar products from our range by email. You can object to this use of your email address at any time by sending a message to the contact option described below or via a link provided in the newsletter email, without incurring any costs other than the transmission costs according to the basic tariffs.

3. Left

Some sections of our website contain links to third party websites, such as:b for viewing YouTube videos. The websites of all third-party providers are subject to their own data protection principles. We are not responsible for their operation, including data handling. If you submit information to or through such third party sites, you should check the privacy statements of those sites before providing them with information that can be associated with you.

4. Categories of recipients

Initially only our employees receive knowledge of your personal data.

Your data will generally only be passed on to third parties if this is permitted or required by law or if you have consented. We also share your data with the service providers we use to the extent necessary in order to be able to provide our services. We limit the transfer of data to what is necessary to provide our services to you. In some cases, our service providers receive your data as processors and are then strictly bound to our instructions when handling your data. In some cases, the recipients act independently with the data we transmit to them.

Below we will give you the categories of recipients of your data:

• E-commerce platform provider Shopify for the use of the online shop
• IT service provider or IT consultant for the operation and hosting of the website
• Banks and payment service providers when processing the payment
• External service providers (e.g.b Logistics service provider) for shipping the ordered goods
• Collection companies and legal advisors when asserting our claims
• Public bodies and institutions, insofar as we are legally obliged to do so
• Service provider for sending the newsletter

We do not pass on your data to third parties.

5. Third country transfer

When data is transferred to countries outside the European Union, we ensure that a level of data protection within the meaning of Art. 44 ff. GDPR is complied with. Unfortunately, due to the laws of non-EU countries (e.g. b within the framework of the so-called Cloud Act in the USA), even if appropriate agreements and regulations are concluded, the possibility that government authorities in particular access your personal data without us or you being able to prevent, prevent or control this. For these reasons, your consent includes e.g. b the use of cookies also includes the purpose of data transfer to countries outside the EU.  As part of the use of the tools Google Analytics, Google Ads Remarketing, Facebook Pixel and Google Ads Conversion Tracking, we transmit your IP address or Your shortened IP address in countries outside the European Union, including.a in the USA

If service providers are used in third countries and we can influence this, they are obliged to comply with the data protection level in Europe in addition to written instructions by agreeing on the EU standard contractual clauses. Alternatively, we transmit the data based on Binding Corporate Rules or an adequacy decision.

In addition, we do not transfer your personal data to countries outside the EU or of the EEA or to international organizations.

6. Duration of storage

6.1 Informational use of the website

When you use our website for purely informational purposes, we store your personal data on our servers exclusively for the duration of your visit to our website. After you leave our website and close your browser, your personal data will be deleted immediately.

Cookies installed by us based on your consent will be deleted after a storage period of up to 24 months. With regard to Google cookies, the storage period may be reset to the specified period for further actions. If a cookie is used for recognition, you can delete it yourself at any time via your browser settings.

6.2 Active use of the website

If you actively use our website, we initially store your personal data for the duration of our business relationship. This also includes the potential future and actual initiation of a contract (pre-contractual legal relationship) and the processing of a contract.

The log files for the login are stored for 90 days for security reasons and for support requests and then deleted.

We process your data for the duration of your subscription to our newsletter or until you revoke your consent to their sending. This also includes the initiation of a contract (pre-contractual legal relationship) and the execution of a contract.

In addition, we will then store your personal data until any legal claims arising from the relationship with you become statute-barred in order to use it as evidence if necessary. The limitation period is usually between 1 and 3 years, but can also be up to 30 years.

When the statute of limitations expires, we will delete your personal data, unless there is a legal obligation to retain it, for example from the Commercial Code (§§ 238, 257 para. 4 HGB) or from the tax code (§ 147 para. 3, 4 AO). These retention obligations can last from two to ten years. For this period, the data will be processed again solely in the event of an inspection by the tax authorities.

7. Your rights as a data subject

If your personal data is processed, you are a “data subject” within the meaning of the GDPR. You have the following rights towards us as the controller:

• Right to information

You can request information about whether we process your personal data. If this is the case, you have the right to information about this personal data as well as other information related to the processing (Art. 15 GDPR). Please note that this right to information may be restricted or excluded in certain cases.

• Right to rectification

If personal data about you is no longer accurate or incomplete, you can request that this data be corrected and, if necessary, completed (Art. 16 GDPR).

• Right to deletion or restriction of processing

If the legal requirements are met, you can request the deletion of your personal data (Art. 17 GDPR) or the restriction of the processing of this data (Art. 18 GDPR). The right to deletion according to Art. 17 para. However, 1 and 2 GDPR do not apply, among other things, if the processing of personal data is necessary to fulfill a legal obligation (Art. 17 para. 3 letters. b GDPR).

• Right to object

For reasons arising from your particular situation, you can also object to our processing of personal data concerning you at any time (Art. 21 GDPR). If the legal requirements are met, we will no longer process your personal data.

• Right to data portability

You are entitled, under the conditions of Art. 20 GDPR to require us to provide you with the personal data concerning you that you have provided to us in a structured, common and machine-readable format.

• Right to revoke the data protection declaration of consent

You have the right to withdraw your consent at any time. The revocation only takes effect in the future; This means that the revocation does not affect the lawfulness of the processing carried out based on the consent before the revocation.

• Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, a data subject (you) has the right to lodge a complaint with a supervisory authority - in particular in the member state of your place of residence - if you are of the opinion that the processing of your personal data by us violates the GDPR violates.

The supervisory authority responsible for us is:

The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard Straße 22
20459 Hamburg
Telephone: 040/428544040
Fax: 040/428544000
E-Mail: mailbox@datenschutz.hamburg.de

However, we recommend that you always address a complaint to us first (e.g.b by email).

Your requests to exercise your rights should, if possible, be addressed in writing to the address specified in Section 1 of this data protection declaration.

8. Scope of your obligations to provide data

In principle, you are not obliged to provide us with your personal data. However, if you do not do this, we may not be able to provide you witha not make our website available to you, provide you with any information, etc. and will not enter into a contract with you.

9. Profiling / Automated Decision Making

We do not carry out profiling and do not use purely automated decision-making processes in accordance with Article 22 GDPR. If we use additional procedures in individual cases in the future, we will inform you about this separately.

10. Changes

We reserve the right to change this privacy policy at any time. Any changes will be announced by publishing the revised privacy policy on our website. Unless otherwise specified, such changes will take effect immediately. Please check this privacy policy regularly to see the most current version.

As of: May 2024