Privacy Information

This Privacy Information explains how we handle your personal data and informs you of your rights under the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Bestsales Online GmbH (referred to below as "we" or "us") is responsible for data processing.

I. General Information

1. Contact

If you have any questions or comments regarding this information, or if you wish to contact us to exercise your rights, please send your enquiry to:

2. Legal Bases

The term "personal data" under data protection law refers to any information relating to an identified or identifiable individual. We process personal data in compliance with the applicable data protection regulations, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). We process data only where permitted by law. We process personal data only with your consent (Section 25(1) TDDDG or Art. 6(1)(a) GDPR), for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR), for compliance with a legal obligation (Art. 6(1)(c) GDPR), or where processing is necessary for the purposes of our legitimate interests or those of a third party, provided that your interests or fundamental rights and freedoms requiring the protection of personal data do not override those interests (Art. 6(1)(f) GDPR).

3. Storage Period

Unless otherwise stated below, we store data only for as long as necessary to achieve the purpose of processing or to fulfil our contractual or legal obligations. Such statutory retention obligations may arise, in particular, from commercial or tax law. From the end of the calendar year in which the data was collected, we retain personal data contained in our accounting records for ten years, and personal data contained in business correspondence and contracts for six years. In addition, we retain data relating to consents that we are required to document, as well as complaints and claims, for the duration of the applicable statutory limitation periods. We will delete data stored for advertising purposes if you object to processing for that purpose.

4. Categories of Data Recipients

We use processors in connection with the processing of your data. Processing activities carried out by these processors include, for example, hosting, sending emails, maintenance and support of IT systems, customer and order management, order fulfilment, accounting and invoicing, marketing activities, and the destruction of files and data storage media. A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller. Processors do not use the data for their own purposes; they process it exclusively on behalf of the controller and are contractually obliged to ensure appropriate technical and organisational data protection measures. We may also disclose your personal data to entities such as postal and delivery services, our bank, tax advisers/auditors or the tax authorities. Any additional recipients are specified in the following sections where applicable.

5. Transfers of Data to Third Countries

Our data processing activities may involve the transfer of certain personal data to third countries, i.e. countries in which the GDPR is not applicable law. Such transfers are permitted if the European Commission has determined that the third country ensures an adequate level of data protection. Where no such adequacy decision exists, personal data will be transferred to a third country only if appropriate safeguards are in place pursuant to Art. 46 GDPR or if one of the conditions laid down in Art. 49 GDPR is met.

Unless otherwise stated below, where no adequacy decision exists, we use the EU Standard Contractual Clauses as appropriate safeguards for transfers of personal data to third countries. You may obtain a copy of, or inspect, these EU Standard Contractual Clauses. Please contact us using the address given under "Contact".

If you consent to the transfer of personal data to third countries, the transfer is based on Art. 49(1)(a) GDPR.

6. Processing When You Exercise Your Rights

When you exercise your rights under Arts. 15 to 22 GDPR, we process the personal data you provide in order to implement those rights and to demonstrate that we have done so. Data stored for the purpose of providing information and preparing a response will be processed solely for that purpose and for data protection compliance purposes. In other respects, we will restrict processing in accordance with Art. 18 GDPR.

These processing activities are based on Art. 6(1)(c) GDPR in conjunction with Arts. 15 to 22 GDPR and Section 34(2) BDSG.

7. Your Rights

As a data subject, you have the right to assert your rights against us. In particular, you have the following rights:

• Under Art. 15 GDPR and Section 34 BDSG, you have the right to request information about whether we process personal data relating to you and, if so, to what extent.
• Under Art. 16 GDPR, you have the right to request the rectification of your data.
• Under Art. 17 GDPR and Section 35 BDSG, you have the right to request the erasure of your personal data.
• Under Art. 18 GDPR, you have the right to request that processing of your personal data be restricted.
• Under Art. 20 GDPR, you have the right to receive personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and to transmit those data to another controller.
• If you have given us separate consent to data processing, you may withdraw that consent at any time in accordance with Art. 7(3) GDPR. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
• If you believe that processing of personal data concerning you violates the GDPR, you have the right to lodge a complaint with a supervisory authority under Art. 77 GDPR.

8. Right to Object

Under Art. 21(1) GDPR, you have the right to object, on grounds relating to your particular situation, to processing based on Art. 6(1)(e) or (f) GDPR. If we process personal data relating to you for direct marketing purposes, you may object to such processing in accordance with Art. 21(2) and (3) GDPR.

9. Data Protection Officer

You can contact our data protection officer using the following details:

Email: datenschutzbeauftragter@bestsales-online.de

Herting Oberbeck Datenschutz GmbH
Hallerstr. 76, 20146 Hamburg
https://www.datenschutzkanzlei.de

II. Data Processing on Our Website

When you use our website, we collect information that you provide yourself. We also automatically collect certain information about your use of our website during your visit. As a rule, an IP address is also considered personal data under data protection law. An internet service provider assigns an IP address to every device connected to the internet so that the device can send and receive data.

1. Processing of Server Log Files

When you use our website solely for information purposes, general information transmitted by your browser to our server is initially stored automatically (i.e. without registration). This normally includes your browser type/version, operating system, page accessed, previously visited page (referrer URL), IP address, date and time of the server request, and HTTP status code.

Processing is carried out to safeguard our legitimate interests and is based on Art. 6(1)(f) GDPR. It serves the technical administration and security of the website. Stored data is deleted automatically unless there are specific indications giving rise to a reasonable suspicion of unlawful use that requires further examination and processing of the information. We are unable to identify you as a data subject on the basis of the stored information. Consequently, Arts. 15 to 22 GDPR do not apply pursuant to Art. 11(2) GDPR.

2. Hosting by Shopify

We use the Shopify shop system to host and display our website. Shopify is provided by Shopify International Limited (Ireland, EU). All data collected on our website is processed on our behalf on servers operated by Shopify International Limited.

Further information about data protection at Shopify is available in Shopify's Privacy Policy at https://www.shopify.de/legal/datenschutz.

3. Online Shop

If you order a product through our website, we process personal data solely to fulfil the contract or to provide you with the product you have ordered. During the booking or ordering process, we process only the data you enter into the relevant form and, where applicable, payment information. In order to deliver the products you have ordered, we transmit the data necessary for delivery to one of the shipping service providers specified in the order. The legal basis for processing is Art. 6(1)(b) GDPR in each case. All fields marked as mandatory are necessary to process your order. If you do not provide this information, we will be unable to process your order.

Providing additional data is voluntary. We process such voluntarily provided data on the basis of Art. 6(1)(f) GDPR.

You have the option of registering for a customer account in our online shop. If you register for a customer account, your stored data will automatically be entered into the order form when you order a product in our shop. You can also use your customer account to check the status of your orders and save products to a wish list. You do not need to register for a customer account to place an order in our online shop.

The information required for registration is shown in the registration form. You must provide the information marked as mandatory in order to complete registration. A valid email address is required for registration. To confirm registration, you will first receive a registration email containing a link that you must click to confirm your registration (double opt-in). Once registered, you can log in to your customer account using your email address and chosen password. Processing of the data provided during registration and use of the customer account is based on Art. 6(1)(b) GDPR.

4. Payment Service Providers

You can choose from various payment methods when paying for products ordered in our online shop. To this end, we work with Shopify International Limited (Ireland, EU) as our primary payment provider. Shopify International Limited acts as our processor and processes your payment data on our behalf.

We transmit payment data provided by you during the ordering process to the payment service providers to the extent necessary to carry out the payment transaction.

The legal basis for this transmission is Art. 6(1)(b) GDPR.

Please note that the respective payment service providers otherwise process payment information under their own responsibility.

We use the following payment service providers:

Stripe

If you pay for your order by credit card, payment is processed through Stripe, a service offered by Stripe Payments Europe Ltd. (Ireland, EU). Further information about data protection at Stripe can be found at https://stripe.com/de/privacy#translation.

PayPal / PayPal Express Checkout

You can pay using the PayPal service provided by PayPal Europe S.a.r.l. et Cie s.c.a. (Luxembourg, EU). In this case, PayPal may transmit the address data you have stored with PayPal to us, which we process exclusively for the performance of the contract. Further information on data protection at PayPal is available at https://www.paypal.com/webapps/mpp/ua/privacy-full.

Klarna (Purchase on Account)

We offer payment by invoice in cooperation with Klarna AB (publ) (Sweden, EU). Klarna must carry out an identity and credit check for this purpose. When you select this payment method, additional data (such as your date of birth, gender and telephone number) is collected and transmitted to Klarna; details can be found in Klarna's terms and conditions. The legal basis for transmission to Klarna is Art. 6(1)(b) GDPR. In other respects, Klarna processes the data under its own responsibility. Further information about data protection at Klarna is available at https://www.klarna.com/de/datenschutz/.

5. Newsletter

On our website, you can subscribe to our newsletter. After subscribing, we will regularly inform you about news and updates relating to our offers. A valid email address is required to subscribe. To verify your email address, you will first receive a registration email containing a link that you must click to confirm your subscription (double opt-in). If you subscribe to the newsletter on our website, we process personal data such as your email address and name on the basis of the consent you have given. Processing is based on Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, for example by using the "Unsubscribe" link in the newsletter or by contacting us through the channels specified above. Withdrawal does not affect the lawfulness of data processing already carried out.

When you subscribe to the newsletter, we also store your IP address and the date and time of registration. Processing this data is necessary to provide evidence of the consent given. The legal basis is our legal obligation to document your consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

We also analyse the reading behaviour and open rates of our newsletter. On the one hand, we evaluate data generated when our emails are delivered and accessed in aggregated and anonymised form (delivery rate, open rate, click-through rates, unsubscribe rate, bounce rate, visits and conversions) in order to measure email use and success. The legal basis for analysing our newsletter is Art. 6(1)(f) GDPR, and processing serves our legitimate interest in optimising our newsletter. You may object to this at any time by contacting us through one of the channels listed above.

On the other hand, we also evaluate data generated when you access and use these emails (time opened, hyperlinks clicked, documents downloaded), as well as behavioural data on subsequent websites, on an individual basis in connection with your email address. This allows us to provide you with personalised information in the future that takes your interests and needs into account as closely as possible. We use the anonymised and personal data collected to provide personalised content and tailored information in our advertising emails and on subsequent websites. The legal basis for data processing in connection with emails is Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, for example by using the "Unsubscribe" link in the newsletter or contacting us through the channels specified above.

For subscription management, sending newsletters and analysis, we use the service Klaviyo, provided by Klaviyo, Inc. (USA). We therefore transmit your email address to this service provider. If you do not want this service provider to process your data, you should not subscribe to the newsletter, or you should unsubscribe.

Please also see the information in the section "Transfers of Data to Third Countries".

6. Product Reviews and Satisfaction Surveys

You have the opportunity to review our products and services and to participate in satisfaction surveys. After completing your order, you will receive a link through which you can share your feedback with us.

We use Judge.me, provided by Judge.me Ltd (UK), to collect and display product reviews. Judge.me acts as our processor and processes your personal data according to our instructions. Product reviews submitted through Judge.me are published in our online shop under the reviewed product. Your name is displayed in abbreviated form so that visitors to the online shop can see only the initials of your first and last name, together with your review and the date of the review.

In some cases, we may also invite you to participate in a satisfaction survey. If so, we will send you an email with further information about the survey. We use Klaviyo, provided by Klaviyo, Inc. (USA), to send these emails. We therefore transmit your email address to this service provider. Please also see the information in the "Newsletter" section.

When you review our products or participate in satisfaction surveys, your personal data may be transferred to third countries. Please therefore see the information in the section "Transfers of Data to Third Countries".

7. Cookies

We use cookies and comparable technologies ("cookies") on our website. Cookies are small data records stored by your browser when you visit a website. They identify the browser being used and enable web servers to recognise it. You have full control over the use of cookies through your browser. You can delete cookies at any time using your browser's security settings. You can generally object to the use of cookies through your browser settings, either entirely or in specific cases.

Some cookies are technically necessary for the operation of our website and may therefore be used without your consent. We may also use cookies to provide special features and content and for analytics and marketing purposes. These may include cookies from third parties (so-called third-party cookies). We use such technically non-essential cookies only with your consent pursuant to Section 25(1) TDDDG and, where applicable, Art. 6(1)(a) GDPR. Details of the purposes, providers, technologies used, data stored and retention periods of individual cookies can be found in the cookie settings of our consent management tool. You can reopen these settings at any time via the "Data Settings" link in the footer of our website.

8. Consent Management Tool

This website uses the Pandectes consent management tool provided by Pandectes OÜ (Estonia, EU) to manage cookies and the processing of personal data.

The consent banner allows users of our website to give consent to certain data processing activities or to withdraw consent previously given. By confirming the "I Accept" button or saving individual cookie settings, you agree to the use of the associated cookies.

The legal basis under data protection law is your consent pursuant to Art. 6(1)(a) GDPR.

The banner also helps us document that consent has been given. For this purpose, we process information about your consent declaration and additional log data relating to that declaration. Cookies are also used to collect this data. Processing this data is necessary in order to provide evidence of the consent given. The legal basis is our legal obligation to document your consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

You may withdraw your consent to cookies at any time using the "Data Settings" link in the footer of our website.

9. Analysis of Our Website

a) Hotjar

We use Hotjar, a service provided by Hotjar Ltd. (Malta, EU), on our website to analyse movements on our website using so-called "heatmaps". These heatmaps show, for example, how far users scroll and which buttons they click and how often. The tool also makes it possible to obtain feedback directly from website users. This provides us with valuable information that helps us make our website faster and more user-friendly. With Hotjar, we can track only which buttons are clicked, mouse movements, how far users scroll, the screen size of the device, the device type and browser information. We also receive information about your geographical location (country) and your preferred language for displaying our website. Areas of the website that display personal data relating to you or third parties are automatically masked by Hotjar and therefore cannot be tracked by the tool at any time.

Your data is processed on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

Cookies are placed on your device to integrate the service. Cookies are placed, and information stored on your device is accessed, with your consent, which you may withdraw at any time with effect for the future through our consent management tool. Further information on data protection at Hotjar can be found in Hotjar's Privacy Policy at https://www.hotjar.com/legal/policies/privacy/.

10. Tracking & Retargeting

a) Google Analytics

We use Google Analytics, a service provided by Google Ireland Limited (Ireland, EU), on our website.

Google Analytics is a web analytics service that enables us to collect and analyse data about users' behaviour on our website. Google Analytics allows us to measure interaction data across different devices and sessions. This enables us to place individual user actions in context and analyse long-term relationships.

Google Analytics uses cookies to analyse the use of our website. Personal data in the form of IP addresses, device identifiers and information about interactions with our website is also processed. Some of this data consists of information stored on the device you are using. In addition, the cookies used store further information on your device.

Google Ireland processes the data collected in this way on our behalf in order to evaluate users' use of our website, compile reports on activities within our website, and provide us with other services relating to website and internet use. Pseudonymous user profiles may be created from the data processed.

Cookies are placed, and the further processing of personal data described here is carried out, with your consent. The legal basis for data processing in connection with Google Analytics is therefore Art. 6(1)(a) GDPR. You may withdraw this consent at any time with effect for the future through our consent management tool.

We use Google Analytics only with IP anonymisation enabled. This means that Google Ireland shortens users' IP addresses within Member States of the European Union or other countries party to the Agreement on the European Economic Area. The IP address transmitted by a user's browser is not merged with other data. IP addresses are shortened on servers in the EU.

Data about user actions is stored for two months and then automatically deleted. Data whose retention period has expired is automatically deleted once a month.

We also use Google Analytics advertising features (remarketing). Together with Google's cross-device functions, this feature enables us to display advertisements in a more targeted way and show users ads that are relevant to their interests. Remarketing allows users to be shown advertisements and products in which they have shown interest on other websites in the Google Network. This feature enables us to link advertising audiences created through Google Analytics remarketing with the cross-device functions of Google Ads. In this way, interest-based, personalised advertising messages adapted to a user's previous usage and browsing behaviour on one device (e.g. a mobile phone) may also be displayed on another device belonging to the user (e.g. a tablet or PC).

If you have given the appropriate consent, Google will link your web and app browsing history with your Google Account for this purpose. This means that the same personalised advertising messages can be displayed on any device on which you sign in to your Google Account. The combination of collected data in your Google Account takes place exclusively on the basis of consent that you give to, or withdraw from, Google. For these linked services, data is then collected through Google Analytics for advertising purposes. To support remarketing, Google Analytics collects users' Google-authenticated IDs, which are temporarily linked to our Google Analytics data. This is used to define and create audiences for cross-device advertising.

Further information about how Google uses data from websites or apps for advertising purposes is available at www.google.com/policies/technologies/ads/.

b) Meta Pixel

We use the Meta Pixel, a Meta Business Tool provided by Meta Platforms Ireland Limited (Ireland, EU), on our website. Contact details for Meta Platforms Ireland Ltd. and its data protection officer can be found in Meta Platforms Ireland Ltd.'s Data Policy at https://www.facebook.com/about/privacy.

The Meta Pixel is a snippet of JavaScript code that allows us to track the activities of visitors to our website. This tracking is known as conversion tracking. For this purpose, the Meta Pixel collects and processes the following information (known as event data):

• Information about actions and activities of visitors to our website, such as searching for or viewing a product or purchasing a product;
• Specific pixel information, such as the pixel ID and Facebook cookie;
• Information about buttons clicked by website visitors;
• Information contained in HTTP headers, such as IP addresses, web browser information, page location and referrer;
• Information about whether ad tracking has been disabled or restricted.

Some of this event data consists of information stored on the device you are using. The Meta Pixel also uses cookies to store information on your device. The Meta Pixel stores information on your device or accesses information already stored on it only with your consent pursuant to Section 25(1) TDDDG.

The event data collected through the Meta Pixel is used to target our advertising, improve ad delivery on Meta products such as the social media platforms Facebook and Instagram, personalise features and content, and improve and secure Meta products. For these purposes, the event data collected on our website through the Meta Pixel is transmitted to Meta Platforms Ireland Ltd. We and Meta Platforms Ireland Ltd. collect and transmit this event data as joint controllers. We have entered into a joint controllership agreement with Meta Platforms Ireland Ltd. setting out the allocation of data protection obligations between us and Meta Platforms Ireland Ltd. Under this agreement, we and Meta Platforms Ireland Ltd. have agreed, among other things, that:

• We are responsible for providing you with all information required under Arts. 13 and 14 GDPR regarding the joint processing of personal data;
• Meta Platforms Ireland Ltd. is responsible for enabling the exercise of data subjects' rights under Arts. 15 to 20 GDPR in relation to personal data stored by Meta Platforms Ireland Ltd. following the joint processing.

You can access the agreement between us and Meta Platforms Ireland Ltd. at https://www.facebook.com/legal/controller_addendum.

Meta Platforms Ireland Ltd. is the sole controller for subsequent processing of transmitted event data. Further information about how Meta Platforms Ireland Ltd. processes personal data, including the legal basis it relies on and how to exercise your rights against Meta Platforms Ireland Ltd., can be found in its Data Policy at https://www.facebook.com/about/privacy.

We have also engaged Meta Platforms Ireland Ltd. to use event data collected through the Meta Pixel to prepare reports on the effectiveness of our advertising campaigns and other online content (campaign reports), and to provide analyses and insights into users and their use of our website, products and services (analyses). For this purpose, we transmit personal data contained in the event data to Meta Platforms Ireland Ltd. Meta Platforms Ireland Ltd. processes the personal data transmitted as our processor in order to provide us with the campaign reports and analyses.

We collect and transmit personal data to Meta Platforms Ireland Ltd., and Meta Platforms Ireland Ltd. processes personal data on our behalf to prepare analyses and campaign reports, only if you have given your prior consent. The legal basis for processing personal data is therefore Art. 6(1)(a) GDPR.

c) Snap Pixel

We use the Snap Pixel provided by Snap Camera GmbH (Germany) on our website. The Snap Pixel enables us to identify visitors to our website as a target audience for advertisements on the social media platform Snapchat ("Snapchat Ads"). Accordingly, we use the Snap Pixel to show our Snapchat Ads only to Snapchat users who have demonstrated an interest in our online offering or who exhibit certain characteristics (e.g. interest in particular topics or products, determined on the basis of websites visited) that we transmit to Snapchat.

The Snapchat Pixel also helps us ensure that our Snapchat Ads are relevant to users' potential interests and are not perceived as intrusive. We can also use the Snapchat Pixel to measure the effectiveness of Snapchat advertisements for statistical and market research purposes by determining whether users were redirected to our website after clicking on a Snapchat ad.

Your data is processed on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

Cookies are placed on your device to integrate the service. Cookies are placed, and information stored on your device is accessed, with your consent, which you may withdraw at any time with effect for the future through our consent management tool. The transfer of your data to the United Kingdom cannot be ruled out when using this service. We base transfers of data to the United Kingdom on the European Commission's adequacy decision under Art. 45 GDPR. Further information about data protection at Snap Group Limited can be found in its Privacy Policy at https://www.snap.com/de-DE/privacy/privacy-policy/#european-union-users.

d) Google Ads

We use Google Ads, the online advertising programme provided by Google Ireland Limited (Ireland, EU), on our website to place advertisements in Google's search engine. If you reach our website through a Google advertisement, Google places a cookie ("conversion cookie") on your device. Each Google Ads customer is assigned a different conversion cookie, so cookies cannot be tracked across the websites of different Ads customers. The information collected using the cookie is used to compile conversion statistics. In this way, we learn the total number of users who have clicked on one of our Google advertisements. However, we do not receive information that would enable us to identify individual users personally.

Your data is processed on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

Cookies are placed with your consent, which you may withdraw at any time with effect for the future through our consent management tool. The transfer of your data to the USA cannot be ruled out when using this service. Please see the information in the section "Transfers of Data to Third Countries". Further information about data protection at Google is available in Google's Privacy Policy at https://policies.google.com/privacy#infocollect.

11. External Media and Third-Party Services

a) Cloudflare

We use Cloudflare, a service provided by Cloudflare Inc. (USA), to display content on our website. Processing your IP address is technically necessary for such integration so that content can be sent to your browser. Your IP address is therefore transmitted to Cloudflare. You may object to this data processing at any time through the settings of your browser or certain browser extensions. Please note that doing so may restrict the functionality of the website.

Your data is processed on the basis of Art. 6(1)(f) GDPR and our legitimate interest in optimising our website and operating it economically.

The transfer of your data to the USA cannot be ruled out when using this service. Please see the information in the section "Transfers of Data to Third Countries". Further information about data protection at Cloudflare can be found in Cloudflare's Privacy Policy at https://www.cloudflare.com/privacypolicy/.

12. Use of Contact Data for Customer Matching

a) Google Customer Match

We use the Customer Match feature as part of Google Ads, a service provided by Google Ireland Ltd. (Ireland, EU). This feature allows us to display more targeted advertising in Google services on the basis of customer lists, thereby making advertising more relevant to users. If we have previously collected this data from you, we transmit your email address, telephone number, postal address and mobile device ID to Google Ireland Ltd. (Google). Before transmitting data to Google, we apply one-way encryption using the SHA-256 algorithm. Google then automatically compares the resulting hash strings with the hash strings of the corresponding information from existing Google Accounts. If there is a match, the relevant Google Account is added to a customer list created for us. If the data does not match, Google may still use it as part of policy compliance checks. Once matching and policy compliance checks have been completed, Google deletes the data.

Your data is processed on the legal basis of Art. 6(1)(f) GDPR and our legitimate interest in delivering more targeted advertising.

As a Google user, you can control which advertisements you see on Google services through Google's ad settings. This also applies to advertisements using the Customer Match feature. Information about data protection in connection with Google Ads Customer Match can be found at https://support.google.com/google-ads/answer/6379332?hl=de. General information about data protection at Google is available at https://policies.google.com/privacy?hl=de.

b) Facebook Custom Audiences

We use the personal data you provide for customer matching through the Custom Audiences feature offered by Meta Platforms Ireland Limited (Ireland, EU).

The Custom Audiences feature allows us to create target groups (known as "Custom Audiences") from users of Meta services on the basis of customer lists, so that we can display more targeted advertising in Meta services such as Facebook and thereby increase the relevance of advertising for users. For this purpose, we transmit your email address, telephone number and address to Meta Platforms Ireland Limited (Meta). We use this personal data to create audiences for advertisements. Before Meta uses the data for matching, it is hashed using one-way encryption and thereby pseudonymised. Meta then automatically compares these hash strings with the hash strings of corresponding data it already holds about users of Meta services. If there is a match, users are added to the audience. Once Meta has created the Custom Audience, the hashed data is deleted regardless of whether a match was found. Further information about the Custom Audiences feature can be found here.

Your data is processed on the legal basis of Art. 6(1)(f) GDPR and our legitimate interest in delivering more targeted advertising.

Meta Platforms Ireland Limited's general privacy information is available at https://de-de.facebook.com/privacy/explanation.

III. Data Processing on Our Social Media Pages

We maintain company pages on several social media platforms. We use these pages to provide further information about our company and offer additional opportunities for communication. Our company has pages on the following social media platforms:

• Facebook, operated by Meta Platforms Ireland Limited (Ireland, EU), referred to below as "Meta";
• Instagram, operated by Meta Platforms Ireland Limited (Ireland, EU).

When you visit or interact with a profile on a social media platform, personal data about you may be processed. Information associated with the social media profile used also generally constitutes personal data. This includes messages and statements made using the profile. In addition, certain information about your visit to a social media profile is often collected automatically and may also constitute personal data.

1. Visiting a Social Media Page

When you visit our social media page, on which we present our company or individual products from our range, certain information about you is processed. The operators of the social media platforms are solely responsible for this processing of personal data. Further information about the processing of personal data can be found in their privacy policies, linked below:

• Meta (https://www.facebook.com/privacy/explanation). Meta provides options for objecting to certain data processing activities; information and opt-out options are available at https://www.facebook.com/settings?tab=ads.

The operators of the social media platforms collect and process event data and profile data and provide us with anonymised statistics and insights for our pages. These help us understand the types of actions people take on our pages (known as "Page Insights"). Page Insights are generated on the basis of certain information about people who have visited our pages. The social media operators and we process this personal data as joint controllers. This processing serves our legitimate interest in evaluating the actions taken on our pages and improving them based on these findings. The legal basis for this processing is Art. 6(1)(f) GDPR.

We cannot assign information obtained through Page Insights to individual user profiles that interact with our pages. We have entered into joint controllership agreements with the operators of the social media platforms setting out the allocation of data protection obligations between us and the operators. Details of the processing of personal data to create Page Insights and of our agreements with the operators can be found at the following links:

• Meta (https://www.facebook.com/legal/terms/information_about_page_insights_data).

You may also exercise your rights against the platform operators. Further information is available at:

• Meta (https://www.facebook.com/privacy/explanation).

We have agreed with Meta that the Irish Data Protection Commission is the lead supervisory authority responsible for overseeing the processing of Page Insights. You always have the right to lodge a complaint with the Irish Data Protection Commission (see www.dataprotection.ie) or any other supervisory authority.

2. Communication via Social Media Pages

We also process information that you provide to us through our company page on the respective social media platform. Such information may include your username, contact details or a message to us. We are the sole controller for this processing. We process this data on the basis of our legitimate interest in communicating with people who contact us. The legal basis for data processing is Art. 6(1)(f) GDPR. Further processing may take place if you have given your consent (Art. 6(1)(a) GDPR) or where necessary to comply with a legal obligation (Art. 6(1)(c) GDPR).

IV. Further Data Processing Activities

1. Contact by Email

If you send us a message to the contact email address provided, we process the transmitted data in order to respond to your enquiry. We process this data on the basis of our legitimate interest in communicating with people who contact us. The legal basis for data processing is Art. 6(1)(f) GDPR. If the enquiry relates to a contract already concluded with you or one that is to be concluded, the legal basis is Art. 6(1)(b) GDPR.

2. Use of Email Addresses for Marketing Purposes

We may use the email address you provided when registering or placing an order to inform you about similar products and services that we offer.

The legal basis is Art. 6(1)(f) GDPR in conjunction with Section 7(3) of the German Act Against Unfair Competition (UWG). You may object to this at any time without incurring any costs other than transmission costs at the basic rates. You can unsubscribe by clicking the unsubscribe link included in every marketing email.

3. Notice for Data Subjects in Switzerland

If you are a data subject within the scope of the Swiss Federal Act on Data Protection, the additional information in this section applies.

For data subjects in Switzerland, references to legislation in this Privacy Information are to be understood in accordance with comparable provisions of the Swiss Federal Act on Data Protection. This applies in particular to the rights of data subjects under Arts. 25-29 and 32 of the Swiss FADP.

Data processing also takes place in the following countries outside Switzerland:

• Germany (EU);
• Denmark (EU);
• Austria (EU);
• Ireland (EU);
• Malta (EU);
• Estonia (EU);
• United States of America;
• United Kingdom.

We ensure an appropriate level of data protection. This is guaranteed by:

• A determination that the recipient country offers an adequate level of data protection pursuant to Art. 16(1) of the Swiss FADP;
• Standard data protection clauses that have been approved, issued or recognised in advance by the Swiss Federal Data Protection and Information Commissioner (FDPIC), in particular the European Commission's Standard Contractual Clauses;
• An international treaty governing an appropriate level of data protection.

4. AI-Powered Customer Service

To respond more quickly to enquiries from customers and prospective customers, we use the "melibo" AI assistance system provided by ThinkingTech GmbH (Germany). The system supports us as an AI chatbot in our online shops and as an AI assistance system for processing customer support emails.

When you interact with our customer service via the chatbot or by email, we process your email address, the content of your chat or email message, information relating to your order (e.g. order number, order details, status and delivery address), as well as technically necessary data (IP address, user ID, session ID and log files). Order data from our systems is retrieved by the AI system only after the order number has been checked against the associated email address. Please do not enter sensitive data (e.g. information concerning health, religion or bank details) into the chatbot or send us such information by email.

In order to integrate the chatbot into our online shops, it is necessary to store information on your device. For this purpose, the chatbot widget stores your user ID and session ID in your browser's local storage in particular. The legal basis for this is your consent pursuant to Section 25(1) TDDDG. Where personal data is processed in this context, the legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

If your enquiry concerns an order, shipping, a return or an offer, the legal basis is generally Art. 6(1)(b) GDPR. In other cases (e.g. general advice or service improvements), processing serves our legitimate interest in providing prompt customer service pursuant to Art. 6(1)(f) GDPR.

The AI does not make decisions within the meaning of Art. 22 GDPR. For matters involving decisions that may have an effect on you (e.g. claims, refunds or complaints), the AI merely prepares a suggested response, which is reviewed by an employee on a case-by-case basis. For simple enquiries that do not involve such decisions, such as checking an order or shipment status, the AI may also independently draft and send a response to you.

You may object at any time, by stating your reasons, to processing based on Art. 6(1)(f) GDPR. To do so, please use the contact details provided in this Privacy Information. Your objection will then be reviewed by our data protection team. In the chat, you may also request to be transferred to our customer service team at any time.

Data processing takes place within the EU or the European Economic Area (EEA). Your personal data is not used to train AI models. However, we may use anonymised data to improve our workflows. We delete chat histories no later than 30 days after the conversation, while we are required to retain emails for at least six years for commercial and tax law purposes (Section 147(3) of the German Fiscal Code (AO) and Section 257(5) of the German Commercial Code (HGB)).

Last updated: [2.0, 03.11.2026]