Privacy Policy

Introduction

With the following privacy policy we would like to inform you about the types of your personal data (hereinafter also referred to in short as “data”) that we process, for what purposes and to what extent.

The privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications as well as within external online presences, such as our social media profiles or our delivery service platform for catering services (hereinafter collectively referred to as the “online offering”).

We would like to point out that, in the processing operations carried out by us, data may under certain circumstances also be processed outside the area of the European Union and thus outside the scope of application of the GDPR; unfortunately we have no influence over this. This may give rise to data protection risks for you, because, for example, the enforcement of your rights on the basis of the GDPR could be made more difficult. However, we assure you that we do everything we can to guarantee an optimal level of data protection for you.

The terms used are not gender-specific.

Last updated: 11 November 2024

Table of contents

Controller & contact details of the Data Protection Officer

FCF Holding GmbH
Hohenzollernring 31-35
50672 Cologne
Germany

Authorised representatives: Dr. Johannes Steegmann, Jan Fischer

E-mail address: datenschutz@eathappygroup.com

Telephone: +49 221 6699360

Legal notice: https://eathappygroup.com/fcf-holding-gmbh/impressum/

Contact details of the Data Protection Officer

ap-Datenschutz GmbH
Dr. iur. Andreas Pinheiro LL.M.
Hohenstaufenring 8
50674 Cologne

Telephone: +49 221 99989030
Fax: +49 221 42327859

E-mail: info@ap-datenschutz.de
Website: https://ap-datenschutz.de

Overview of processing operations

The following overview summarises the types of data processed and the purposes of their processing and refers to the data subjects concerned.

Types of data processed

  • Master data (e.g. names, addresses).
  • Applicant data (e.g. personal details, postal and contact addresses, the documents belonging to the application and the information contained therein, such as cover letter, CV, references as well as further information regarding a specific position or information about their person or qualifications provided voluntarily by applicants).
  • Content data (e.g. text entries, photographs, videos).
  • Contact data (e.g. e-mail, telephone numbers).
  • Meta/communication data (e.g. device information, IP addresses).
  • Usage data (e.g. websites visited, interest in content, access times).
  • Location data (data indicating the location of an end user’s terminal device).
  • Contract data (e.g. subject matter of the contract, term, customer category).
  • Payment data (e.g. bank details, invoices, payment history).

Special categories of data

  • Health data (Art. 9 (1) GDPR) (e.g. when asking about allergies in the context of a food order).

Categories of data subjects

  • Employees (e.g. staff, applicants, former employees).
  • Applicants.
  • Business and contractual partners.
  • Prospective customers.
  • Communication partners.
  • Customers.
  • Users (e.g. website visitors, users of online services).
  • Prize draw and competition participants.

Purposes of processing

  • Provision of our online offering and user-friendliness.
  • Visit action evaluation.
  • Application procedure (establishment and any subsequent performance as well as possible subsequent termination of the employment relationship.).
  • Office and organisational procedures.
  • Cross-device tracking (cross-device processing of user data for marketing purposes).
  • Direct marketing (e.g. by e-mail or post).
  • Conducting prize draws and competitions.
  • Feedback (e.g. collecting feedback via online form).
  • Interest-based and behaviour-based marketing.
  • Contact requests and communication.
  • Conversion measurement (measuring the effectiveness of marketing activities).
  • Profiling (creation of user profiles).
  • Remarketing.
  • Reach measurement (e.g. access statistics, recognition of returning visitors).
  • Security measures.
  • Tracking (e.g. interest-/behaviour-based profiling, use of cookies).
  • Contractual services and service.
  • Administration and answering of enquiries.
  • Audience building (determination of target groups relevant for marketing purposes or other output of content).

Relevant legal bases

In the following we set out the legal bases of the General Data Protection Regulation (GDPR) on the basis of which we process personal data. Please note that in addition to the provisions of the GDPR, the national data protection requirements in your or our country of residence and registered office may apply. Furthermore, should more specific legal bases be relevant in an individual case, we will inform you of these in the privacy policy.

  • Consent (Art. 6 (1) sentence 1 (a) GDPR) – The data subject has given their consent to the processing of personal data relating to them for one specific purpose or several specific purposes (e.g. when taking part in a prize draw).
  • Performance of a contract and pre-contractual enquiries (Art. 6 (1) sentence 1 (b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (e.g. in order to deliver a product you have ordered).
  • Legal obligation (Art. 6 (1) sentence 1 (c) GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject (e.g. retention in accordance with the provisions of the German Commercial Code (HGB)).
  • Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. (e.g. when processing data to secure our IT systems)
  • Art. 88 (2) GDPR in conjunction with Sec. 26 (1), (3) sentence 1 BDSG (application procedure as a pre-contractual or contractual relationship) (Insofar as special categories of personal data within the meaning of Art. 9 (1) GDPR (e.g. health data, such as severe disability status or ethnic origin) are requested from applicants in the course of the application procedure so that the controller or the data subject can exercise the rights arising for them from employment law and the law of social security and social protection and fulfil their obligations in this respect, their processing takes place in accordance with Sec. 26 (1), (3) sentence 1 BDSG.

National data protection provisions in Germany: In addition to the data protection provisions of the General Data Protection Regulation, national data protection provisions apply in Germany. These include in particular the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). The BDSG contains in particular special provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transfer as well as automated decision-making in individual cases including profiling. It also regulates data processing for the purposes of the employment relationship (Sec. 26 BDSG), in particular with regard to the establishment, performance or termination of employment relationships as well as the consent of employees. Furthermore, the data protection acts of the individual federal states may apply.

Security measures

In accordance with the statutory requirements and taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of the processing as well as the varying likelihood and severity of the threat to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as the access, input, transfer, safeguarding of availability and separation relating to it. Furthermore, we have set up procedures that ensure the exercise of data subject rights, the erasure of data and responses to threats to the data. In addition, we already take the protection of personal data into account during the development or selection of hardware, software and procedures in accordance with the principle of data protection by design and by data protection-friendly default settings.

Shortening of the IP address: Insofar as it is possible for us or storage of the IP address is not necessary, we shorten your IP address or have it shortened. In the case of shortening the IP address, also referred to as “IP masking”, the last octet, i.e. the last two numbers of an IP address, is deleted (the IP address in this context is an identifier individually assigned to an internet connection by the online access provider). The purpose of shortening the IP address is to prevent or significantly impede the identification of a person on the basis of their IP address.

SSL encryption (https): In order to protect the data you transmit via our online offering, we use SSL encryption. You can recognise connections encrypted in this way by the prefix https:// in the address bar of your browser.

Rights, in particular to information and withdrawal

You have the following rights vis-à-vis us with regard to the personal data relating to you:

  • Right of access,
  • Right to rectification or erasure,
  • Right to restriction of processing,
  • Right to object to the processing,
  • Right to data portability.

If you have given consent to the use of data, you can withdraw it at any time. Should the lawfulness of the processing be based on consent, this remains valid until the withdrawal is exercised.

Please address all requests for information, access requests or objections to data processing by e-mail to datenschutz@fcf-holding.com or to the address stated under Sec. 1 (2).

You can request at any time that we erase your data. In this connection statutory retention periods may exist which allow us to retain your data until the expiry of the period.

If your data should be inaccurate, you have the right to request us to rectify it. We will comply with such a request without undue delay.

You have the right to receive the personal data you have provided to us from us in a readable format, insofar as technically possible, in order to make it available to another company (right to data portability).

You have the right to lodge a complaint with the supervisory authority responsible for you. A list of the data protection officers as well as their contact details can be found at the following link: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

Transfer and disclosure of personal data

In the course of our processing of personal data it happens that the data is transferred to, or disclosed to, other bodies, companies, legally independent organisational units or persons. The recipients of this data may include, for example, payment institutions in the context of payment transactions, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases we comply with the statutory requirements and in particular conclude corresponding contracts or agreements with the recipients of your data that serve to protect your data.

Data transfer within the group of companies: We may transfer personal data to other companies within our group of companies or grant them access to this data. Insofar as this disclosure takes place for administrative purposes, the disclosure of the data is based on our legitimate entrepreneurial and business management interests or takes place insofar as it is necessary for the fulfilment of our contract-related obligations or where consent of the data subjects or a statutory permission exists.

Data transfer within the organisation: We may transfer personal data to other bodies within our organisation or grant them access to this data. Insofar as this disclosure takes place for administrative purposes, the disclosure of the data is based on our legitimate entrepreneurial and business management interests or takes place insofar as it is necessary for the fulfilment of our contract-related obligations or where consent of the data subjects or a statutory permission exists.

Use of cookies

In addition to the data mentioned above, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive assigned to the browser you are using and through which certain information flows to the body that sets the cookie (here, to us). Cookies cannot execute programs or transmit viruses to your computer. They serve to make the internet offering as a whole more user-friendly and more effective.

We use cookies on our website. Such cookies are necessary so that you can move freely around the website and use its features; this includes, among other things, access to secured areas of the website. Cookies enable us to understand who has visited the page(s) and to derive from this how often certain pages are visited and which parts of the page are particularly popular. Session cookies store information about your activities on our website.

The following cookie types and functions are distinguished:

  • Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online offering and closed their browser.
  • Permanent cookies: Permanent cookies remain stored even after the browser has been closed. This makes it possible, for example, to store the login status or to display preferred content directly when the user visits a website again. Likewise, the interests of users that are used for reach measurement or for marketing purposes can be stored in such a cookie.
  • First-party cookies: First-party cookies are set by us ourselves.
  • Third-party cookies: Third-party cookies are mainly used by advertisers (so-called third parties) in order to process user information.
  • Necessary (also: essential or strictly necessary) cookies: On the one hand, cookies may be strictly necessary for the operation of a website (e.g. in order to store logins or other user entries or for security reasons).
  • Statistics, marketing and personalisation cookies: Furthermore, cookies are also generally used in the context of reach measurement as well as where the interests of a user or their behaviour (e.g. viewing certain content, using functions, etc.) on individual websites are stored in a user profile. Such profiles serve to display to users, for example, content that corresponds to their potential interests. This procedure is also referred to as “tracking”, i.e. following the potential interests of users. Insofar as we use cookies or “tracking” technologies, we inform you separately in our privacy policy or in the context of obtaining consent.

You can configure your browser setting in accordance with your wishes and, for example, refuse the acceptance of third-party cookies or of all cookies. We would like to point out that you may then not be able to use all functions of this website.

We use cookies in order to be able to identify you for subsequent visits if you have an account with us. Otherwise you would have to log in again for every visit.

The following cookies are used:

NamePersistenceDescription
borlabs-cookie1 yearConsent to the setting of cookies
1P_JAR1 month
__Secure-3PAPISID2 years
__Secure-3PSIDCC1 year
__Secure-3PSID1 year
_pgar6 months
ANID1 week
APISID2 years
CGIC6 months
CONSENT6 months
CONSISTENCY15 years
DVSESSION
HSID1 year
NID9 monthsCookie from Google for unlocking Google Maps content.
OGPC
OGPIC
OTZ1 month
PAIDCONTENT6 months
SAPISID1 year
SEARCH_SAMESITE18 months
SIDCC1 year
SID2 years
SNID18 months
SSID2 years
_gcl_au, DSID, IDE3 monthsCookie from Google for ad targeting and ad measurement. Generates statistical data about how the visitor uses the website.
_ga, _gat, _gid2 yearsCookie from Google for website analytics. Generates statistical data about how the visitor uses the website.
_fbp, act, c_user, datr, fr, m_pixel_ration, pl, presence, sb, spin, tr, wd, xsSession duration / 3 monthsCookie from Facebook for website analytics, ad targeting and ad measurement.
_hjAbsoluteSessionInProgress, _hjid, _hjIncludedInSample, _hjTLDTestSession durationCookie from Hotjar for website analytics. Generates data (mouse movements, mouse clicks, scroll depths, etc.) about how the visitor uses the website.
rc::cGoogle reCAPTCHA. Cookie from Google for distinguishing between humans and bots.

Legal basis: consent before we process, or have processed, data in the context of the use of cookies, we ask users for consent which can be withdrawn at any time. Until consent has been given, at most those cookies are used which are necessary for the operation of our online offering. Their use takes place on the basis of our interest and the interest of users in the expected functionality of our online offering.

Commercial and business services (customer account)

We process data of our contractual and business partners, e.g. customers and prospective customers (collectively referred to as “contractual partners”) in the context of contractual and comparable legal relationships as well as associated measures and in the context of communication with the contractual partners (or pre-contractually), e.g. in order to answer enquiries.

We inform the contractual partners which data is required for the aforementioned purposes before or in the course of the data collection, e.g. in online forms, by means of special marking (e.g. colours) or symbols (e.g. asterisks or similar), or in person. We process this data in order to fulfil our contractual obligations, to safeguard our rights and for the purposes of the administrative tasks associated with this information as well as of the entrepreneurial organisation.

For the processing operations referred to in paragraphs 1 and 2, Art. 6 (1) (b) GDPR (performance of the contract) constitutes our legal basis.

We pass on the data of contractual partners to third parties within the framework of applicable law only to the extent that this is necessary for the aforementioned purposes or for the fulfilment of statutory obligations (e.g. to the telecommunications, transport and other ancillary services involved as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Contractual partners are informed about further forms of processing, e.g. for marketing purposes, within the framework of this privacy policy.

Insofar as we use third-party providers or platforms in order to provide our services, the terms and conditions and privacy notices of the respective third-party providers or platforms apply in the relationship between users and the providers.

In this connection, the contractors are obliged by us pursuant to Art. 28 GDPR to meet our high data protection requirements. This obligation is underpinned by rights of control and instruction on our part.

We erase the data after expiry of statutory warranty and comparable obligations, i.e. as a rule after expiry of 4 years, unless the data is stored in a customer account, for example for as long as it has to be retained for statutory archiving reasons (e.g. for tax purposes, as a rule 10 years). Data disclosed to us by the contractual partner in the context of an order is erased by us in accordance with the requirements of the order, as a rule after the end of the order. For the last-mentioned processing operations, Art. 6 (1) (c) GDPR (fulfilment of legal obligations) constitutes our legal basis.

Catering services

We process the information of our visitors and prospective customers (uniformly referred to as “visitors”) in order to provide the food and drinks ordered as well as to render and invoice other services and provisions.

In the context of orders placed with us, it may be necessary for us to process special categories of data within the meaning of Art. 9 (1) GDPR, in particular information about a person’s health. The processing takes place in order to protect the health interests of visitors (e.g. in the case of information about allergies) and otherwise only with the consent of the visitors.

Insofar as necessary for the performance of the contract or required by law, or where customers have consented or it takes place on the basis of our legitimate interests, we disclose or transfer customers’ data, for example, to the service providers, authorities and billing agencies involved in the performance of our services as well as in the area of IT, office or comparable services.

  • Types of data processed: Master data (e.g. names, addresses), payment data (e.g. bank details, invoices, payment history), contact data (e.g. e-mail, telephone numbers), contract data (e.g. subject matter of the contract, term, customer category),
  • Special categories of data: Health data (Art. 9 (1) GDPR).
  • Data subjects: Customers
  • Purposes of processing: Contractual services and service, contact requests and communication.

Use of online marketplaces for e-commerce

Shop and e-commerce: We process the data of our customers in order to enable them to select, acquire or order the chosen products, goods and associated services, as well as to pay for and have them delivered or performed.

The required information is marked as such in the context of the ordering or comparable acquisition process and comprises the information required for delivery or provision and invoicing as well as contact information in order to be able to make any enquiries. For the aforementioned processing operations, Art. 6 (1) (b) GDPR (performance of the contract) constitutes our legal basis.

We offer our services on online platforms that are operated by other service providers. In this connection, the privacy notices of the respective platforms apply in addition to our privacy notices. This applies in particular with regard to the procedures used on the platforms for reach measurement and interest-based marketing. For the aforementioned processing operations we rely on our legitimate interest in an efficient and functioning business operation pursuant to Art. 6 (1) (f) GDPR. The interests of the data subjects do not override this here, since we take measures to anonymise/pseudonymise the reach measurement, for example.

In this connection, the contractors are obliged by us pursuant to Art. 28 GDPR to meet our high data protection requirements. This obligation is underpinned by rights of control and instruction on our part.

  • Types of data processed: Master data (e.g. names, addresses), payment data (e.g. bank details, invoices, payment history), contact data (e.g. e-mail, telephone numbers), contract data (e.g. subject matter of the contract, term, customer category), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Customers.
  • Purposes of processing: Contractual services and service.

Services and service providers used:

Lieferando: Delivery service platform for catering services; service provider: yd. yourdelivery GmbH, Am Karlsbad 16, D-10785 Berlin, Germany; website: https://www.lieferando.de; privacy policy: https://www.lieferando.de/privacy-statement.

SimplyDelivery: Delivery service platform for catering services; service provider: SimplyDelivery GmbH, Potsdamer Str. 33, 14974 Ludwigsfelde, Germany; website: https://www.simplydelivery.de/; privacy policy: https://www.simplydelivery.de/datenschutzerklaerung/.

Contacting us

When contacting us (e.g. via contact form, e-mail, telephone or via social media), the information of the enquiring persons is processed insofar as this is necessary in order to answer the contact enquiries and any measures requested.

The answering of contact enquiries in the context of contractual or pre-contractual relationships takes place in order to fulfil our contractual obligations or to answer (pre-)contractual enquiries and otherwise on the basis of the legitimate interests in answering the enquiries.

For the processing operations referred to in paragraphs 1 and 2, Art. 6 (1) (b) GDPR (performance of the order) constitutes our legal basis.

  • Types of data processed: Master data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. text entries, photographs, videos).
  • Data subjects: Communication partners.
  • Purposes of processing: Contact requests and communication.

Communication via messenger services

We use messenger services for communication purposes and therefore ask you to observe the following notices on the functionality of the messenger services, on encryption, on the use of the metadata of the communication and on your options to object.

You can also contact us by alternative means, e.g. via telephone or e-mail. Please use the contact options communicated to you or the contact options stated within our online offering.

In the case of end-to-end encryption of content (i.e. the content of your message and attachments) we would like to point out that the communication content (i.e. the content of the message and attached images) is encrypted from end to end. This means that the content of the messages cannot be viewed, not even by the messenger providers themselves. You should always use a current version of the messenger service with encryption activated so that the encryption of the message content is ensured.

However, we additionally point out to our communication partners that, although the providers of the messenger services cannot view the content, they can find out that and when communication partners communicate with us, and that technical information about the device used by the communication partners and, depending on the settings of your device, also location information (so-called metadata) is processed.

Notes on legal bases: Insofar as we ask communication partners for permission before communicating with you via messenger, the legal basis of our processing of your data is their consent (Art. 6 (1) (a) GDPR). Otherwise, if we do not ask for consent and you contact us on your own initiative, for example, we use messenger services in relation to our contractual partners as well as in the context of initiating a contract as a contractual measure and, in the case of other prospective customers and communication partners, on the basis of our legitimate interests in fast and efficient communication (Art. 6 (1) (f) GDPR). and to meet the needs of our communication partners for communication via messenger services. Furthermore, we point out to you that we do not transfer the contact data communicated to us to the messenger services for the first time without your consent.
For the collection of metadata for reach measurement and advertising we rely on our legitimate interest in advertising our own products pursuant to Art. 6 (1) (f) GDPR. The interests of the data subjects do not override this here, since we take measures to anonymise/pseudonymise the reach measurement, for example, and only simple data (addresses, e-mail) is used for advertising in a legally permitted context.

Withdrawal, objection and erasure: You can withdraw consent given at any time and object to communication with us via messenger at any time. In the case of communication via messenger, we erase the messages in accordance with our general erasure policies (i.e., for example, as described above, after the end of contractual relationships, in the context of archiving requirements, etc.) and otherwise as soon as we can assume that we have answered any enquiries of the communication partners, where no reference back to a previous conversation is to be expected and no statutory retention obligations preclude erasure.

Reservation of referral to other communication channels: In conclusion, we would like to point out that, for reasons of your security, we reserve the right not to answer enquiries via messenger. This is the case, for example, where contract internals require special confidentiality or where a reply via messenger does not meet the formal requirements. In such cases we will refer you to more appropriate communication channels.

Skype: Skype’s end-to-end encryption requires it to be activated (unless it is activated by default).

  • Types of data processed: Contact data (e.g. e-mail, telephone numbers), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses), content data (e.g. text entries, photographs, videos).
  • Data subjects: Communication partners.
  • Purposes of processing: Contact requests and communication, direct marketing (e.g. by e-mail or post).

Services and service providers used:

Online conferences and meetings

We use platforms and applications of other providers (hereinafter referred to as “third-party providers”) for the purposes of conducting video and audio conferences, webinars and other types of video and audio meetings. When selecting the third-party providers and their services we comply with the statutory requirements.

In this context, data of the communication participants is processed and stored on the servers of the third-party providers, insofar as it forms part of communication processes with us. This data may include in particular registration and contact data, visual and vocal contributions as well as entries in chats and shared screen content.

Insofar as users are referred to the third-party providers or their software or platforms in the context of communication, business or other relationships with us, the third-party providers may process usage data and metadata for security purposes, service optimisation or marketing purposes. We therefore ask you to observe the privacy notices of the respective third-party providers.

For the collection of metadata for reach measurement and advertising we rely on our legitimate interest in the further development and improvement of our own products pursuant to Art. 6 (1) (f) GDPR. The interests of the data subjects do not override this here, since we take measures to anonymise/pseudonymise the reach measurement, for example.

Notes on legal bases: Insofar as we ask users for their consent to the use of the third-party providers, the legal basis of the processing is consent (Art. 6 (1) (a) GDPR). Furthermore, their use may form part of our (pre-)contractual services, insofar as the use of the third-party providers has been agreed in this context (Art. 6 (1) (b) GDPR).

In this connection, the contractors are obliged by us pursuant to Art. 28 GDPR to meet our high data protection requirements. This obligation is underpinned by rights of control and instruction on our part.

  • Types of data processed: Master data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. text entries, photographs, videos), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Communication partners, users (e.g. website visitors, users of online services).
  • Purposes of processing: Contractual services and service, contact requests and communication, office and organisational procedures.

Services and service providers used:

Polls and surveys

The polls and surveys conducted by us (hereinafter “surveys”) are evaluated anonymously. Personal data is processed only insofar as this is necessary for the provision and technical implementation of the surveys (e.g. processing of the IP address in order to display the survey in the user’s browser or to enable the survey to be resumed by means of a temporary cookie (session cookie)) or where users have consented.

Notes on legal bases: By taking part in the survey you implicitly give us your consent to the processing pursuant to Art. 6 (1) (a) GDPR. For any collection of metadata for reach measurement and advertising we rely on our legitimate interest in the further development and improvement of our own products pursuant to Art. 6 (1) (f) GDPR. The interests of the data subjects do not override this here, since we take measures to anonymise/pseudonymise the reach measurement, for example.

In this connection, the contractors are obliged by us pursuant to Art. 28 GDPR to meet our high data protection requirements. This obligation is underpinned by rights of control and instruction on our part.

  • Types of data processed: Contact data (e.g. e-mail, telephone numbers), content data (e.g. text entries, photographs, videos), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Communication partners, users (e.g. website visitors, users of online services).
  • Purposes of processing: Feedback (e.g. collecting feedback via online form).

Services and service providers used:

Provision of the online offering and web hosting

In order to be able to provide our online offering securely and efficiently, we make use of the services of one or more web hosting providers from whose servers (or servers managed by them) the online offering can be accessed. For these purposes we may make use of infrastructure and platform services, computing capacity, storage space and database services as well as security services and technical maintenance services.

The data processed in the context of the provision of the hosting service may include all information relating to the users of our online offering that arises in the course of use and communication. This regularly includes the IP address, which is necessary in order to be able to deliver the contents of online offerings to browsers, and all entries made within our online offering or on websites.

Mail dispatch and hosting: The web hosting services we make use of also include the sending, receipt and storage of e-mails. For these purposes the addresses of the recipients and senders as well as further information concerning the sending of e-mails (e.g. the providers involved) and the contents of the respective e-mails are processed. The aforementioned data may furthermore be processed for the purposes of detecting SPAM. Please note that e-mails are generally not sent in encrypted form on the internet. As a rule, e-mails are indeed encrypted in transit, but (unless a so-called end-to-end encryption procedure is used) not on the servers from which they are sent and received. We can therefore accept no responsibility for the transmission path of e-mails between the sender and receipt on our server.

Collection of access data and log files: We ourselves (or our web hosting provider or our delivery service platform for catering services) collect data on every access to the server (so-called server log files). The server log files may include the address and name of the web pages and files accessed, the date and time of access, volumes of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider.

The server log files can be used, on the one hand, for security purposes, e.g. to avoid overloading the servers (in particular in the case of abusive attacks, so-called DDoS attacks) and, on the other hand, to ensure the utilisation of the servers and their stability.

For the processing operations mentioned here we rely on our legitimate interest in an efficient and functioning business operation as well as in functioning IT pursuant to Art. 6 (1) (f) GDPR. The interests of the data subjects do not override this here, since they could expect measures in the area of IT security and this did not occur unexpectedly.

In this connection, the contractors are obliged by us pursuant to Art. 28 GDPR to meet our high data protection requirements. This obligation is underpinned by rights of control and instruction on our part.

  • Types of data processed: Content data (e.g. text entries, photographs, videos), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Contractual services and service.

Services and service providers used:

Application procedure

Purpose of the processing:

The application procedure requires applicants to provide us with the data necessary for their assessment and selection. Which information is required follows from the job description or, in the case of online forms, from the information provided there.

As a rule, the required information includes personal details such as name, address, a means of contact as well as evidence of the qualifications necessary for a position. Upon request we will also be happy to inform you which information is required. This includes the data categories of personnel data (personal details, social information, payroll data (bank details) and further data that is customarily taken into account upon recruitment, such as the documents belonging to the application and the information contained therein, e.g. cover letter, CV, references as well as further information regarding a specific position or information about their person or qualifications provided voluntarily by applicants).

This may also include special categories of personal data (e.g. degree of severe disability, religious affiliation, etc.).

Processing of the data:
Insofar as it is made available, applicants can submit their applications to us by means of an online form. The data is transmitted to our HR Hub in encrypted form in accordance with the state of the art. The HR Hub manages the applications received on the basis of the MS Dynamics software. The software is hosted in our data centre, which is operated by Microsoft Germany exclusively on servers in the European Union. You can obtain further information about data processing in the MS environment here:

https://privacy.microsoft.com/de-DE/privacystatement?culture=de-de&country=DE

Applicants can also submit their applications to us via e-mail. In this connection, however, we ask you to note that e-mails are generally not sent in encrypted form on the internet. As a rule, e-mails are indeed encrypted in transit, but not on the servers from which they are sent and received. We can therefore accept no responsibility for the transmission path of the application between the sender and receipt on our server.

Applicants are welcome to contact us about the method of submitting the application or to send us the application by post.

Legal bases of the processing:

As a rule, we can base the processing of your data on Art. 88 (2) GDPR in conjunction with Sec. 26 (1) BDSG, since it is necessary for the establishment of the employment relationship in the context of personnel selection.

We may carry out the processing of special categories of personal data pursuant to Sec. 26 (3) BDSG in conjunction with Sec. 22 BDSG where it is necessary for the fulfilment of legal obligations arising from employment law, the law of social security and social protection. In this connection, for example, the degree of severe disability may be decisive for your application depending on the job advertisement. The permission to process this item of data would arise from the law (in this case Sec. 2 SGB IX in conjunction with Sec. 80 SGB X).

Erasure of data:

  • The data provided by applicants may be further processed by us for the purposes of the employment relationship in the case of a successful application.
  • Otherwise, if the application for a job offer is unsuccessful, the applicants’ data is erased no later than 4 months after the end of the application period.
  • The applicants’ data is likewise erased if an application is withdrawn, which applicants are entitled to do at any time. Erasure takes place, subject to a legitimate withdrawal by the applicants, no later than after the expiry of a period of six months, so that we can answer any follow-up questions about the application and fulfil our obligations of proof arising from the provisions on the equal treatment of applicants. Invoices for any reimbursement of travel expenses are archived in accordance with the tax law requirements.

Inclusion in an applicant pool:

Inclusion in an applicant pool, where offered, takes place on the basis of voluntary consent. Applicants are informed that their agreement to inclusion in the talent pool is voluntary, has no influence on the ongoing application procedure and that they can withdraw their consent at any time with effect for the future.

The storage takes place in order to enable a “permanent application” for later application procedures (establishment and any subsequent performance as well as possible subsequent termination of the employment relationship.).

With regard to the processing of the data, the processing methods stated under 1.1.3 apply (use of MS Dynamics).

The data is erased from the applicant pool after you have withdrawn your consent to storage, but no later than after we have been unable to offer you a position for 3 years.

We base the inclusion in the applicant pool on your consent pursuant to Art. 6 (1) (a) GDPR. In the case of sensitive data, on your explicit consent pursuant to Art. 9 (1) (a) GDPR, which we obtain prior to inclusion.

Cloud services

We use software services accessible via the internet and executed on the servers of their providers (so-called “cloud services”, also referred to as “software as a service”) for the following purposes: document storage and management, calendar management, e-mail dispatch, spreadsheets and presentations, exchange of documents, content and information with specific recipients or publication of web pages, forms or other content and information as well as chats and participation in audio and video conferences.

In this connection, personal data may be processed and stored on the providers’ servers insofar as it forms part of communication processes with us or is otherwise processed by us as set out within the framework of this privacy policy. This data may include in particular master data and contact data of users, data on transactions, contracts, other processes and their contents. The providers of the cloud services furthermore process usage data and metadata that they use for security purposes and for service optimisation.

Insofar as we use the cloud services to make forms or other documents and content available for other users or publicly accessible web pages, the providers may store cookies on users’ devices for the purposes of web analytics or in order to remember users’ settings (e.g. in the case of media control).

The cloud service provider(s) is/are obliged by us as contractors pursuant to Art. 28 GDPR to meet our high data protection requirements. This obligation is underpinned by rights of control and instruction on our part

For the processing operations mentioned here we also rely, with regard to the processing of metadata and cloud functions in the context of SaaS, on our legitimate interest in an efficient and functioning business operation as well as in functioning IT and in advertising our own products pursuant to Art. 6 (1) (f) GDPR. The interests of the data subjects do not override this here, since they could expect the commissioning of external parties in the area of IT provision and this did not occur unexpectedly. Metadata is processed in anonymised form.

  • Types of data processed: Master data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. text entries, photographs, videos), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses), contract data (e.g. subject matter of the contract, term, customer category).
  • Data subjects: Customers, employees (e.g. staff, applicants, former employees), prospective customers, communication partners.
  • Purposes of processing: Office and organisational procedures.

Services and service providers used:

Promotional communication via e-mail, post, fax or telephone

We process personal data for the purposes of promotional communication, which may take place via various channels, such as e-mail, telephone, post or fax, in accordance with the statutory requirements.

For advertising we rely on our legitimate interest in advertising our own products pursuant to Art. 6 (1) (f) GDPR. The interests of the data subjects do not override this here, since we take measures to anonymise/pseudonymise the reach measurement, for example, and only simple data (addresses, e-mail) is used for advertising in a legally permitted context.

Should we, in exceptional cases, not be entitled to advertise pursuant to paragraph 2, we will obtain your consent to the advertising pursuant to Art. 6 (1) (a) GDPR.

Recipients have the right to withdraw consent given at any time or to object to the promotional communication at any time.

Following withdrawal or objection, we may store the data required as proof of consent for up to three years on the basis of our legitimate interests before we erase it. The processing of this data is limited to the purpose of a possible defence against claims. An individual request for erasure is possible at any time, provided that the former existence of consent is confirmed at the same time.

  • Types of data processed: Master data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers).
  • Data subjects: Communication partners.
  • Purposes of processing: Direct marketing (e.g. by e-mail or post).

Newsletter

With your consent you can subscribe to our newsletter, with which we inform you about our current interesting offers. The goods and services advertised are exclusively news and offers from Eat Happy.

For registration for our newsletter we use the so-called double opt-in procedure. This means that after your registration we send you an e-mail to the e-mail address provided in which we ask you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, your information will be blocked and automatically erased after one month. In addition, we store the IP addresses you used and the times of registration and confirmation. The purpose of the procedure is to be able to prove your registration and, where applicable, to clarify a possible misuse of your personal data. The legal basis is Art. 6 (1) sentence 1 (f) GDPR.

The only mandatory information for sending the newsletter is your e-mail address and your first name. The latter is used in order to be able to address you personally. Providing a surname is voluntary. After your confirmation we store your e-mail address for the purpose of sending the newsletter. The legal basis is Art. 6 (1) sentence 1 (a) GDPR.

The newsletter is sent via our service provider “Braze”. You can find out more about this in the corresponding section of our privacy policy.

You can withdraw your consent to the sending of the newsletter at any time and unsubscribe from the newsletter. You can declare the withdrawal by clicking on the link provided in every newsletter e-mail, by e-mail to datenschutz@eathappygroup.com or by sending a message to the contact details stated in the legal notice.

We would like to point out that we evaluate your user behaviour when sending the newsletter. For this evaluation, the e-mails sent contain so-called web beacons, also known as tracking pixels. These are one-pixel image files that link to web pages and thus enable us to evaluate your user behaviour. With the data obtained in this way we create a user profile in order to be able to provide you with the newsletter tailored to your interests. The newsletter provider stores the information collected in this way on its server.

You can object to this tracking at any time by clicking on the separate link provided in every e-mail or by informing us via datenschutz@eathappygroup.com.

Such tracking is also not possible if you have deactivated the display of images by default in your e-mail program. In this case, however, the newsletter will not be displayed to you in full and you may not be able to use all functions. If you display the images manually, the tracking described above takes place.

Prize draws and competitions

We process personal data of participants in prize draws and competitions only in compliance with the relevant data protection provisions, insofar as the processing is contractually necessary for the provision, conduct and settlement of the prize draw, participants have consented to the processing or the processing serves our legitimate interests (e.g. in the security of the prize draw or the protection of our interests against misuse through the possible recording of IP addresses upon submission of prize draw entries).

For the collection of your data for the purposes of participation in the prize draw we rely on the consent you have given pursuant to Art. 6 (1) (a) GDPR. The further processing for the above-mentioned purpose then takes place for the purpose of conducting the prize draw pursuant to Art. 6 (1) (b) GDPR.

If participants’ entries are published in the context of the prize draws (e.g. in the context of a vote or presentation of the prize draw entries or of the winners or the reporting on the prize draw), we would like to point out that the names of the participants may also be published in this connection. Participants can object to this at any time.

If the prize draw takes place within an online platform or a social network (e.g. Facebook or Instagram, hereinafter referred to as “online platform”), the terms of use and data protection provisions of the respective platforms additionally apply. In these cases we point out that we are responsible for the information provided by participants in the context of the prize draw and that enquiries regarding the prize draw are to be addressed to us.

Participants’ data is erased as soon as the prize draw or competition has ended and the data is no longer required in order to inform the winners or because follow-up questions about the prize draw are to be expected. As a rule, participants’ data is erased no later than 6 months after the end of the prize draw. Winners’ data may be retained for longer in order, for example, to be able to answer follow-up questions about the prizes or to fulfil the prize obligations; in this case the retention period depends on the type of prize and amounts, for example in the case of goods or services, to up to three years in order to be able to handle warranty cases, for example. Furthermore, participants’ data may be stored for longer, e.g. in the form of reporting on the prize draw in online and offline media.

Insofar as data was also collected for other purposes in the context of the prize draw, its processing and the retention period are governed by the privacy notices for that use (e.g. in the case of registration for the newsletter in the context of a prize draw).

  • Types of data processed: Master data (e.g. names, addresses), content data (e.g. text entries, photographs, videos).
  • Data subjects: Prize draw and competition participants.
  • Purposes of processing: Conducting prize draws and competitions.

Online marketing

We process personal data for the purposes of online marketing, which may include in particular the marketing of advertising space or the display of advertising and other content (collectively referred to as “content”) on the basis of the potential interests of users as well as the measurement of their effectiveness.

For these purposes, so-called user profiles are created and stored in a file (so-called “cookie”) or similar procedures are used by means of which the information about the user relevant for the display of the aforementioned content is stored. This information may include, for example, content viewed, websites visited, online networks used, but also communication partners and technical information such as the browser used, the computer system used as well as information about usage times. Insofar as users have consented to the collection of their location data, this may also be processed.

Users’ IP addresses are also stored. However, we use available IP masking procedures (i.e. pseudonymisation by shortening the IP address) to protect users. Generally, no plain data of users (such as e-mail addresses or names) is stored in the context of online marketing procedures, but rather pseudonyms. This means that we as well as the providers of the online marketing procedures do not know the actual identity of the users, but only the information stored in their profiles.

The information in the profiles is as a rule stored in cookies or by means of similar procedures. These cookies can generally also be read out later on other websites that use the same online marketing procedure and analysed for the purposes of displaying content as well as supplemented with further data and stored on the server of the online marketing procedure provider.

In exceptional cases, plain data can be assigned to the profiles. This is the case where users are, for example, members of a social network whose online marketing procedure we use and the network links users’ profiles with the aforementioned information. We ask you to note that users may make additional arrangements with the providers, e.g. by giving consent in the course of registration.
As a rule, we only obtain access to aggregated information about the success of our advertisements. However, in the context of so-called conversion measurements we can check which of our online marketing procedures has led to a so-called conversion, i.e., for example, to the conclusion of a contract with us. The conversion measurement is used solely to analyse the success of our marketing activities.

Unless otherwise stated, we ask you to assume that the cookies used are stored for a period of two years.

Braze

This website uses, provided that you have given consent, Braze, a web analytics service of Braze Inc. Braze uses so-called “cookies” (text files) that are stored on your computer and that enable an analysis of your use of the website. The information generated by the cookies about your use of this website is as a rule transferred to a Braze server. In the process you are assigned a random customer ID by means of which re-identification of the user is generally not possible. You can find more detailed information on the individual cookies, such as storage period and function, in our cookie banner.

Braze uses the information received on behalf of the operator of this website in order to evaluate your use of the website, to compile reports on website activities and to provide further services associated with the use of the website and the internet to the website operator.

The cookies are only stored after you have given your consent to this. You can generally refuse them by means of a corresponding setting of your browser software; we would, however, point out that in this case you may not be able to use all functions of this website to their full extent.

We use Braze in order to be able to analyse the use of our website and thereby improve it on an ongoing basis. Using the statistics obtained we can improve our offering and make it more interesting for you as a user.

We also use Braze for sending newsletters. If you enter data for the purpose of receiving the newsletter (e.g. e-mail address), this is stored on Braze’s servers in the EU.

With the help of Braze we can analyse our newsletter campaigns. When you open an e-mail sent with Braze, a file contained in the e-mail (so-called web beacon) connects to Braze’s servers. In this way it can be determined whether a newsletter message has been opened and which links, if any, have been clicked. In addition, technical information is recorded (e.g. time of retrieval, IP address, browser type and operating system). The results of these analyses can be used in order to better tailor future newsletters to the interests of the recipients.

The data you have deposited with us for the purpose of receiving the newsletter is stored by us until you unsubscribe from the newsletter and is erased both from our servers and from Braze’s servers after the newsletter has been cancelled. Data that has been stored with us for other purposes (e.g. e-mail addresses for the members’ area) remains unaffected by this.

We base the use of Braze on our legitimate interest in advertising and efficiently administering our services, which in turn is based on the freedom to pursue an occupation and the freedom to conduct a business under Art. 15 (1) and Art. 16 of the Charter of Fundamental Rights of the EU. Since we inform you about this processing and no special data other than the e-mail address and name is transferred, we base our processing on the legitimate interest existing here pursuant to Art. 6 (1) sentence 1 (f) GDPR.

The legal basis for the use of Braze is your consent pursuant to Art. 6 (1) sentence 1 (a) GDPR.

Information about the third-party provider: Braze Inc. 330 W 34th Street, 18th Floor,
New York, NY 10001, USA
Terms of use: Main Subscription Agreement | Braze
Privacy policy: Privacy Policy | Braze

Web tracking – Google Analytics 4

This website uses, provided that you have given consent, Google Analytics 4, the current version of the web analytics service of Google Ireland Limited (“Google”). We use Google Analytics in order to be able to analyse the use of our website and thereby improve it on an ongoing basis. Using the statistics obtained we can improve our offering and make it more interesting for you as a user.

Google Analytics uses so-called “cookies” (text files that are stored on your computer and that enable an analysis of your use of the website), scripts (executable program code) and pixels (images). The information generated by Google Analytics about your use of this website is as a rule transferred to a server of Google LLC in the USA and stored there. With Google Analytics 4, your IP address is processed exclusively in shortened form. No logging or storage of the IP addresses takes place. On behalf of the operator of this website, Google will use the information collected in order to evaluate your use of the website, to compile reports on website activities and to provide further services associated with website use and internet use to the website operator. The information collected consists of so-called “events”, which can be all kinds of actions on the website (scrolling, reloading, time spent, etc.). In addition, Google Analytics determines detailed location and device data.

Google evaluates the data collected in the context of Google Analytics with the help of artificial intelligence. In this way Google Analytics enables a cross-device analysis of visitor flows by recognising user behaviour. These visitor logs are automatically erased after 14 months.

You can prevent the storage of the cookies by means of a corresponding setting of your browser software; we would, however, point out that in this case you may not be able to use all functions of this website to their full extent. You can furthermore prevent the collection of the data generated by the cookie and relating to your use of the website by Google as well as the processing of this data by Google by downloading and installing the browser plug-in provided by Google at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

For the exceptional cases in which personal data is transferred to the USA, Google Ireland has agreed, by concluding so-called standard data protection clauses (SDC) pursuant to Art. 46 (2) (c) GDPR, that a comparable level of data protection is ensured for the data transfer to the third country. You can obtain further information at: https://privacy.google.com/businesses/compliance/#!#gdpr

The legal basis for the use of Google Analytics is your consent (Art. 6 (1) sentence 1 (a) GDPR), which you give us via the cookie banner. You can withdraw your consent by deactivating the use of Google Analytics:
Click here to switch off Google Analytics

Information about the third-party provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland
Terms of use: http://www.google.com/analytics/terms/de.html
Data protection overview: https://support.google.com/analytics/answer/6004245?hl=de&ref_topic=2919631&sjid=6373951679058141562-EU
Privacy policy: https://policies.google.com/privacy?hl=de&gl=de

Use of Google Tag Manager

Google Tag Manager is a solution of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), with which marketers can manage website tags via one interface.

The Tag Manager tool itself (which implements the tags) is a cookieless domain and does not collect any personal data. The tool ensures the triggering of other tags, which in turn may collect data. Google Tag Manager does not access this data. If a deactivation has been carried out at domain or cookie level, it remains in place for all tracking tags that are implemented with Google Tag Manager. http://www.google.de/tagmanager/use-policy.html

The legal basis for the disclosure of personal data to Google is your consent, i.e. Art. 6 (1) sentence 1 (a) GDPR. Click here to be excluded from the collection via Google Tag Manager.

For the exceptional cases in which personal data is transferred to the USA, Google Ireland has ensured by concluding so-called standard contractual clauses (SCC) pursuant to Art. 46 (2) GDPR that a comparable level of data protection is ensured for the data transfer to the third country. You can obtain further information at: https://privacy.google.com/businesses/compliance/#!#gdpr.

Hotjar analytics tool

On our web pages we use the web analytics service hotjar of Hotjar Ltd, Level 2, St Julians Business Centre, 3 Elia Zammit Street, St Julians STJ 1000, Malta, Europe, +1 (855) 464-6788.

This tool records movements on the observed web pages in so-called heatmaps. This enables us to see in anonymised form where visitors click and how far they scroll. As a result we can design our website better and in a more customer-friendly way.

The protection of your personal data is very important to us when using this tool. All data is collected without our being able to assign it to specific users. We can only trace how the mouse was moved, where clicks were made and how far scrolling took place. Furthermore, the screen size of the device, the device type, information about the browser, the country from which access took place and the preferred language are recorded. If personal data of yours or of third parties is displayed on a web page, this is automatically hidden by Hotjar. It is therefore not traceable for us.

You can prevent the use of the hotjar tool by means of a “Do Not Track header”. No data about your visit to our website will then be collected. To do this you must configure your browser accordingly. You can find instructions on this in German at http://www.akademie.de/wissen/do-not-track-datenschutz. You can also deactivate the hotjar tool alone by means of the opt-out switch at https://www.hotjar.com/opt-out.

You can find further information about hotjar Ltd. and about the hotjar tool at https://www.hotjar.com. You can find the privacy policy of hotjar Ltd. at https://www.hotjar.com/privacy.

With regard to the use of Hotjar we rely on our legitimate interest in optimising and improving the presentation of web pages. Since Hotjar does not transfer any personal data but tracks anonymously, this interest, based on our freedom to conduct a business (Art. 15 of the Charter of Fundamental Rights of the EU), overrides pursuant to Art. 6 (1) (f) GDPR.

Since we also store cookies in order to use the service, we require your consent for this (CJEU judgment of 1 October 2019 – Planet 49). We obtain this prior to storing the cookies. We store them on the basis of Art. 6 (1) (a) GDPR.

Presences in social networks

We maintain online presences within social networks in order to communicate with the users active there or to offer information about us there. We would like to point out that in this connection users’ data may be processed outside the area of the European Union. This may give rise to risks for users, because, for example, the enforcement of users’ rights could be made more difficult.

Furthermore, users’ data within social networks is as a rule processed for market research and advertising purposes. For example, usage profiles can be created on the basis of the usage behaviour and the resulting interests of users. The usage profiles can in turn be used, for example, to place advertisements within and outside the networks that presumably correspond to the interests of users. For these purposes, cookies are as a rule stored on users’ computers, in which the usage behaviour and the interests of users are stored. Furthermore, data may also be stored in the usage profiles independently of the devices used by the users (in particular where users are members of the respective platforms and are logged in to them).

For a detailed presentation of the respective forms of processing and the options to object (opt-out) we refer to the privacy policies and information of the operators of the respective networks.

Also in the case of access requests and the assertion of data subject rights, we would like to point out that these can be asserted most effectively with the providers. Only the providers each have access to users’ data and can directly take appropriate measures and provide information. Should you nevertheless require assistance, you can contact us.
You can find further details in our separate privacy policies:

Types of data processed: Master data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. text entries, photographs, videos), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).

  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Contact requests and communication, tracking (e.g. interest-/behaviour-based profiling, use of cookies), remarketing, reach measurement (e.g. access statistics, recognition of returning visitors).

Social media plug-ins

We currently use the following social media plug-ins: Facebook, Instagram, Xing, LinkedIn, TikTok. In doing so we use the so-called two-click solution. This means that when you visit our page, no personal data is generally passed on to the providers of the plug-ins in the first instance. You can recognise the provider of the plug-in by the marking on the box showing its initial letter or its logo. We give you the option of communicating directly with the provider of the plug-in via the button. Only if you click on the marked field and thereby activate it does the plug-in provider receive the information that you have accessed the corresponding website of our online offering. In addition, the data referred to under Sec. 4 of this policy is transmitted. In the case of Facebook and Xing, according to the information of the respective providers in Germany, the IP address is anonymised immediately after collection. By activating the plug-in, personal data of yours is therefore transmitted to the respective plug-in provider and stored there (in the case of US providers, in the USA). Since the plug-in provider carries out the data collection in particular via cookies, we recommend that you delete all cookies via the security settings of your browser before clicking on the greyed-out box.

We have no influence either on the data collected or on the data processing operations, nor are we aware of the full extent of the data collection, the purposes of the processing or the storage periods. We also have no information about the erasure of the collected data by the plug-in provider.

The plug-in provider stores the data collected about you as usage profiles and uses these for the purposes of advertising, market research and/or needs-based design of its website. Such an evaluation takes place in particular (also for users who are not logged in) in order to display needs-based advertising and to inform other users of the social network about your activities on our website. You have a right to object to the creation of these user profiles, whereby you must contact the respective plug-in provider in order to exercise it. Via the plug-ins we offer you the option of interacting with the social networks and other users, so that we can improve our offering and make it more interesting for you as a user. The legal basis for the use of the plug-ins is Art. 6 (1) sentence 1 (f) GDPR.

The data is passed on regardless of whether you have an account with the plug-in provider and are logged in there. If you are logged in with the plug-in provider, the data collected by us about you is assigned directly to your existing account with the plug-in provider. If you activate the button and, for example, link the page, the plug-in provider also stores this information in your user account and communicates it publicly to your contacts. We recommend that you log out regularly after using a social network, but in particular before activating the button, as this enables you to avoid an assignment to your profile with the plug-in provider.

You can obtain further information about the purpose and scope of the data collection and its processing by the plug-in provider in the privacy policies of these providers communicated below. There you will also obtain further information about your rights in this respect and about the settings options for protecting your privacy.

Addresses of the respective plug-in providers and URL with their privacy notices:

Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA; http://www.facebook.com/policy.php; further information about the data collection: http://www.facebook.com/help/186325668085084, http://www.facebook.com/about/privacy/your-info-on-other#applications as well as http://www.facebook.com/about/privacy/your-info#everyoneinfo.
in which personal data is transferred to the USA, Facebook Ireland ensures a comparable level of data protection for the data transfer to the parent group in the USA by concluding so-called standard contractual clauses (SCC) pursuant to Art. 46 (2) GDPR. You can obtain further information at:
https://de-de.facebook.com/help/566994660333381

Twitter, Inc., 1355 Market St, Suite 900, San Francisco, California 94103, Twitter ensures a comparable level of data protection for the data transfer to the parent group in the USA by concluding so-called standard contractual clauses (SCC) pursuant to Art. 46 (2) GDPR. You can obtain further information at: https://gdpr.twitter.com/en/controller-to-controller-transfers.html,

Xing AG, Gänsemarkt 43, 20354 Hamburg, DE; http://www.xing.com/privacy.

LinkedIn Corporation, 2029 Stierlin Court, Mountain View, California 94043, USA; http://www.linkedin.com/legal/privacy-policy. LinkedIn ensures a comparable level of data protection for the data transfer to the parent group in the USA by concluding so-called standard contractual clauses (SCC) pursuant to Art. 46 (2) GDPR. You can obtain further information at:
https://www.linkedin.com/help/linkedin/answer/62533/eu-eea-and-swiss-data-transfers?lang=en

TikTok: Social network; service provider: TikTok Inc., Venice Blvd., Culver City, CA 90232, USA; website: https://www.tiktok.com; privacy policy: https://www.tiktok.com/legal/privacy-policy?lang=de.
TikTok ensures a comparable level of data protection for the data transfer to the parent group in the USA by concluding so-called standard contractual clauses (SCC) pursuant to Art. 46 (2) GDPR. You can obtain further information at:
https://www.tiktok.com/legal/privacy-policy?lang=de.

Facebook Pixel, Facebook Custom Audiences and Facebook Conversion

Within our online offering, the so-called “Facebook pixel” of the social network Facebook, which is operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or in the EU by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”), is used. This makes it possible to display interest-based advertisements (“Facebook Ads”) to users of the website in the course of their visit to the social network Facebook or other websites that likewise use this procedure. We thereby pursue the interest of showing you advertising that is of interest to you, in order to make our website more interesting for you.

Due to the marketing tools used, your browser automatically establishes a direct connection with the Facebook server. We have no influence on the scope and the further use of the data that is collected by Facebook through the use of this tool and therefore inform you in accordance with our state of knowledge: Through the integration of Facebook Custom Audiences, Facebook receives the information that you have accessed the corresponding web page of our website or have clicked on an advertisement of ours. If you are registered with a Facebook service, Facebook can assign the visit to your account. Even if you are not registered with Facebook or are not logged in, there is a possibility that the provider will find out and store your IP address and further identifying features.

Facebook’s privacy policy
The processing of the data by Facebook takes place within the framework of Facebook’s data use policy. Accordingly, general information on the display of Facebook Ads can be found in Facebook’s data use policy. You can obtain specific information and details about the Facebook pixel and how it works in Facebook’s help section.

For the collection of the data for advertising purposes we rely on the consent you have given pursuant to Art. 6 (1) (a) GDPR.

You can obtain further information about data processing by Facebook at https://www.facebook.com/about/privacy.

Facebook Ireland ensures a comparable level of data protection for the data transfer to the parent group in the USA by concluding so-called standard contractual clauses (SCC) pursuant to Art. 46 (2) GDPR. You can obtain further information at:
https://de-de.facebook.com/help/566994660333381.

Objection
You can object to the collection by the Facebook pixel and the use of your data for the display of Facebook Ads.

Deactivation of the “Facebook Custom Audiences” function is possible for logged-in users at https://www.facebook.com/settings/?tab=ads#_.

You can furthermore object to the use of cookies that serve reach measurement and advertising purposes via the deactivation page of the Network Advertising Initiative and additionally the US website aboutads.info or the European website youronlinechoices.com.

Furthermore, you can refuse the measurement by rejecting all analytics-based cookies in the cookie banner.

PLUGIN: YouTube

We have integrated YouTube videos of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), into our online offering, which are stored on http://www.YouTube.com and can be played directly from our website. These are all integrated in “extended data protection mode”, i.e. no data about you as a user is transferred to YouTube if you do not play the videos. Only when you play the videos is the data referred to in paragraph 2 transferred. We have no influence on this data transfer.

Through the visit to the website, YouTube (Google) receives the information that you have accessed the corresponding sub-page of our website. In addition, the data referred to under Sec. 4 of this policy is transmitted. This takes place regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in with Google, your data is assigned directly to your account. If you do not wish the assignment to your profile with YouTube, you must log out before activating the button. YouTube stores your data as usage profiles and uses it for the purposes of advertising, market research and/or needs-based design of its website. Such an evaluation takes place in particular (even for users who are not logged in) in order to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have a right to object to the creation of these user profiles, whereby you must address YouTube in order to exercise it.

The legal basis for the disclosure of personal data to YouTube (Google) is your consent, i.e. Art. 6 (1) sentence 1 (a) GDPR.

You can obtain further information about the purpose and scope of the data collection and its processing by YouTube in the privacy policy. There you will also obtain further information about your rights and the settings options for protecting your privacy: https://www.google.de/intl/de/policies/privacy.

For the exceptional cases in which personal data is transferred to the USA, Google Ireland has ensured by concluding so-called standard contractual clauses (SCC) pursuant to Art. 46 (2) GDPR that a comparable level of data protection is ensured for the data transfer to the third country. You can obtain further information at: https://privacy.google.com/businesses/compliance/#!#gdpr.

PLUGIN: Integration of Google Maps

On this website we use the Google Maps service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). This enables us to display interactive maps directly in the website and to allow you to use the map function conveniently.

Through the visit to the website, Google receives the information that you have accessed the corresponding sub-page of our website. In addition, the data referred to under Sec. 4 of this policy is transmitted. This takes place regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in with Google, your data is assigned directly to your account. If you do not wish the assignment to your profile with Google, you must log out before activating the button. Google stores your data as usage profiles and uses it for the purposes of advertising, market research and/or needs-based design of its website. Such an evaluation takes place in particular (even for users who are not logged in) in order to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have a right to object to the creation of these user profiles, whereby you must address Google in order to exercise it.

The legal basis for the disclosure of personal data to Google is your consent, i.e. Art. 6 (1) sentence 1 (a) GDPR.

You can obtain further information about the purpose and scope of the data collection and its processing by the plug-in provider in the provider’s privacy policies. There you will also obtain further information about your rights in this respect and the settings options for protecting your privacy: http://www.google.de/intl/de/policies/privacy.

For the exceptional cases in which personal data is transferred to the USA, Google Ireland has ensured by concluding so-called standard contractual clauses (SCC) pursuant to Art. 46 (2) GDPR that a comparable level of data protection is ensured for the data transfer to the third country. You can obtain further information at: https://privacy.google.com/businesses/compliance/#!#gdpr.

Google reCAPTCHA

On our website we use the Google reCAPTCHA service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). This service is intended to serve to distinguish natural persons from so-called BOTS (machine-based and automated processing) upon logins. In this connection the IP address may be passed on to Google. This results in a transfer of personal data to Google Ltd.

The legal basis for the disclosure of personal data to Google is your consent, i.e. Art. 6 (1) sentence 1 (a) GDPR.

In the event of a transfer of personal data by Google Ltd. to the parent company based in the USA (Google LLC), Google Ireland has ensured by concluding so-called standard contractual clauses (SCC) pursuant to Art. 46 (2) GDPR that a comparable level of data protection is ensured for the data transfer to the third country. You can obtain further information at: https://privacy.google.com/businesses/compliance/#!#gdpr.

You can view further information about Google reCAPTCHA as well as Google’s privacy policy at: https://www.google.com/intl/de/policies/privacy/.

Erasure of data

The data processed by us is erased in accordance with the statutory requirements as soon as the consents permitting its processing are withdrawn or other permissions cease to apply (e.g. where the purpose of processing this data has ceased to apply or it is not necessary for the purpose).

Insofar as the data is not erased because it is necessary for other and legally permissible purposes, its processing is limited to these purposes. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that has to be retained for commercial or tax law reasons or whose storage is necessary for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person.

Further information on the erasure of personal data may also be provided within the individual privacy notices of this privacy policy.

Amendment and updating of the privacy policy

We ask you to inform yourself regularly about the content of our privacy policy. We adapt the privacy policy as soon as changes to the data processing operations carried out by us make this necessary. We will inform you as soon as the changes make an act of cooperation on your part (e.g. consent) or another individual notification necessary.

Insofar as we state addresses and contact information of companies and organisations in this privacy policy, we ask you to note that the addresses may change over time and ask you to check the details before making contact.

Supervisory authority responsible for us:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia

Helga Block
Postfach 20 04 44
40102 Düsseldorf

Kavalleriestraße 2-4
40213 Düsseldorf

Telephone: +49 211 384240
Fax: +49 211 3842410

E-mail: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de

Definitions of terms

In this section you will find an overview of the terms used in this privacy policy. Many of the terms are taken from the law and are defined above all in Art. 4 GDPR. The statutory definitions are binding. The following explanations, by contrast, are intended above all to aid understanding. The terms are sorted alphabetically.

  • Visit action evaluation: “Visit action evaluation” (in English “conversion tracking”) refers to a procedure by which the effectiveness of marketing activities can be determined. For this purpose a cookie is as a rule stored on users’ devices within the websites on which the marketing activities take place and then read out again on the target website. In this way we can, for example, understand whether the advertisements we have placed on other websites were successful).
  • Cross-device tracking: Cross-device tracking is a form of tracking in which behavioural and interest information of users is recorded across devices in so-called profiles by assigning an online identifier to the users. This makes it possible, as a rule, to analyse the user information independently of the browsers or devices used (e.g. mobile phones or desktop computers) for marketing purposes. With most providers, the online identifier is not linked to plain data such as names, postal addresses or e-mail addresses.
  • IP masking: “IP masking” refers to a method in which the last octet, i.e. the last two numbers of an IP address, is deleted so that the IP address can no longer serve to uniquely identify a person. IP masking is therefore a means of pseudonymising processing procedures, in particular in online marketing
  • Interest-based and behaviour-based marketing: One speaks of interest-based and/or behaviour-based marketing where potential interests of users in advertisements and other content are predetermined as precisely as possible. This takes place on the basis of information about their previous behaviour (e.g. visiting certain websites and dwelling on them, purchasing behaviour or interaction with other users), which is stored in a so-called profile. Cookies are as a rule used for these purposes.
  • Conversion measurement: Conversion measurement is a procedure by which the effectiveness of marketing activities can be determined. For this purpose a cookie is as a rule stored on users’ devices within the websites on which the marketing activities take place and then read out again on the target website. In this way we can, for example, understand whether the advertisements we have placed on other websites were successful.
  • Personal data: “Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • Profiling: “Profiling” means any form of automated processing of personal data consisting of the use of that personal data to analyse, evaluate or predict certain personal aspects relating to a natural person (depending on the type of profiling, this includes information concerning age, gender, location data and movement data, interaction with websites and their content, purchasing behaviour, social interactions with other people) (e.g. interests in certain content or products, click behaviour on a website or the place of residence). Cookies and web beacons are frequently used for the purposes of profiling.
  • Reach measurement: Reach measurement (also referred to as web analytics) serves to evaluate the visitor flows of an online offering and may include the behaviour or interests of visitors in certain information, such as the contents of web pages. With the help of reach analysis, website owners can, for example, recognise at what time visitors visit their website and which content they are interested in. This enables them, for example, to better adapt the contents of the website to the needs of their visitors. Pseudonymous cookies and web beacons are frequently used for the purposes of reach analysis in order to recognise returning visitors and thus obtain more precise analyses of the use of an online offering.
  • Remarketing: One speaks of “remarketing” or “retargeting” where, for example, it is recorded for advertising purposes which products a user was interested in on a website, in order to remind the user of these products on other websites, e.g. in advertisements.
  • Tracking: One speaks of “tracking” where the behaviour of users can be traced across several online offerings. As a rule, behavioural and interest information relating to the online offerings used is stored in cookies or on servers of the providers of the tracking technologies (so-called profiling). This information can subsequently be used, for example, to display advertisements to users that are likely to correspond to their interests.
  • Controller: “Controller” refers to the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • Processing: “Processing” is any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data, be it collection, evaluation, storage, transfer or erasure.
  • Audience building: One speaks of audience building (or “custom audiences”) where target groups are determined for advertising purposes, e.g. the display of advertisements. Thus it can be concluded, for example, on the basis of a user’s interest in certain products or topics on the internet, that this user is interested in advertisements for similar products or in the online shop in which they viewed the products. One speaks of “lookalike audiences” (or similar target groups), in turn, where the content assessed as suitable is displayed to users whose profiles or interests presumably correspond to the users for whom the profiles were created. Cookies and web beacons are as a rule used for the purposes of building custom audiences and lookalike audiences.

Shopping Cart

You don’t have products in your cart.See our products

PICK UP LOCATION

Loading...

Pre-orders must be placed at least one day before your preferred collection date