Privacy policy

We, Gebr. Märklin & Cie. GmbH, as the operator of the website at https://www.maerklin-messagewagons.com/de/ (also "website" or "online store"), are responsible in the sense of the applicable data protection law, in particular the General Data Protection Regulation ("DSGVO"), for the personal data of the user ("you") of this website.

In the following, we inform you clearly within the scope of our information obligations (Art. 13 et seq. DSGVO) about which data is processed when you visit our website and on which legal basis this is done. You will also receive information about your rights vis-à-vis us and the competent supervisory authority.

1. Information about the person in charge

Gebr. Märklin & Cie. GmbH
Stuttgarter Straße 55-57
73033 Göppingen, Germany

Phone: +49 7161 608 222
Fax: +49 7161 608 344
E-mail: service@maerklin.de

2. Data protection officer

We have appointed a company data protection officer.

Andreas Zimmermann
Liststraße 4
73035 Göppingen, Germany

Phone: +49 7161 9880478
E-mail: a.zimmermann@maerklin.de

3. Informational use of our website

When you call up our website merely to visit it, so-called log files are processed by being automatically recorded by our system.

The following log files are processed automatically:

  • IP address of the requesting computer
  • Type of Internet browser used
  • Language of the Internet browser used
  • Version of the Internet browser used
  • Pages called
  • Date and time of the visit
  • Time zone difference from Greenwich Mean Time (GMT)
  • Access status/http status code
  • Amount of data transferred
  • Success or error of the loading process
  • Referrer
  • Websites that are called up by the visitor's system via our website
  • Internet service provider of the user

The log files contain your IP address and possibly other personal data. Therefore, an assignment to you is possible in principle. However, we only store your data temporarily and in particular not together with other personal data.

The processing of the above data is necessary for the provision of our website. We also store the data for the purpose of the security of our information technology systems. In these purposes is also our legitimate interest to process the data on the legal basis Art. 6 para. 1 sentence 1 lit. f DSGVO. The log files, which also contain your IP address, are deleted or anonymized immediately after they are no longer required to achieve the aforementioned purposes.

4. Newsletter

We offer you on our website that you register free of charge for our newsletter. In addition to your declaration of consent, we need your e-mail address. Further information, e.g. your name, is voluntary and serves to address you personally.

We will only send you the newsletter if you first confirm your registration via a confirmation e-mail sent to you for this purpose by clicking on the link provided for this purpose. In this way, we want to ensure that only you can subscribe to the newsletter. Your confirmation in this regard must be made promptly after receipt of the confirmation e-mail, otherwise your newsletter registration will be automatically deleted from our database.

The legal basis for the newsletter dispatch as well as voluntary additional information is Art. 6 para. 1 sentence 1 lit. a DSGVO. By sending the newsletter registration, you agree to the processing of your data by us. In addition, we store the time (date and time) of transmission of your data to us, as well as your IP address within the scope of your newsletter registration. The processing of this data corresponds to our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f DSGVO to ensure the security of our systems and to prevent misuse.

Your data will be processed exclusively in connection with the sending of newsletters. The purpose of processing your e-mail address is to be able to send you the newsletter. Further data within the scope of the registration process serve either to address you personally or also to ensure the security of our services and to prevent misuse of the e-mail address used.

Your data will only be stored for as long as is necessary to achieve the purpose. Your e-mail address will therefore be stored for the period of your active newsletter subscription if you have given your consent for this. The data that we additionally collect automatically during your subscription (IP address, date and time) will be deleted at the latest when you end your newsletter subscription.

OPPORTUNITY TO OPPOSE

You can unsubscribe or cancel our newsletter at any time. You will find the link at the end of each newsletter. By doing so, you revoke your consent or object to further use of your data for the purpose of sending the newsletter.

5. Orders

When you place an order on our website, we need the following data to fulfill the contract with you:

  • First name, last name and (billing and shipping) address to send you your order and invoice.
  • E-mail address to send you the order confirmation and provide you with contract documents immediately after the order.
  • Phone number to be able to contact you in case of ambiguity about the order
  • Date of birth to verify your age, because we sell the items only to adult collectors.
  • Your payment information to process the payment of your order

We also process the data required in each case in order to reverse our contract after a revocation or return for any other reason or to check claims. In addition, we store your aforementioned data in order to be able to display your order history on our website.

The legal basis for the processing of the data is Art. 6 para. 1 sentence 1 lit. b and f DSGVO. The data will be stored as long as it is necessary for the order processing as well as within the scope of our obligations from any website user contract with you. It is in line with our legitimate interests to enable you to track your current and previous orders on our website. Furthermore, we only store your data in order to comply with our legal obligations (e.g. tax obligations) (Art. 6 para. 1 sentence 1 lit. c DSGVO). In this case, we block your data to the extent that it is only processed for the necessary purposes.

In order to send you your order, we pass on your address data to our shipping or logistics service provider for the purpose of delivery.

Legal bases for this data processing are Art. 6 para. 1 sentence 1 lit. b and f DSGVO. It is in our legitimate interests to use a specialized shipping or logistics service provider to ship your orders.

In addition to the aforementioned data, we store the time (date and time) of transmission of your data to us, as well as your IP address. The processing of this data corresponds to our legitimate interest (Art. 6 para. 1 sentence 1 lit. f DSGVO) to ensure the security of our systems and to counteract misuse. This additional data is deleted as soon as it is no longer required, at the latest when the contract with you has been processed.

Payment methods

If you select a payment provider on our site for payment, this provider also receives your personal data, for example your name, address and bank account details. In addition, our house bank receives your bank connection data when an electronic payment is received. The legal basis for the processing of your personal data for payment purposes is Art. 6 para. 1 sentence 1 lit. b and f DSGVO.

PayPal: If you pay on our website with PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A. 22-24 Boulevard Royal L-2449 Luxembourg), PayPal receives your payment data for payment processing and it may be that PayPal performs a credit check. Information on this can be found at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE#rAnnex.

Credit card: If you pay on our website with your credit card, your credit card provider receives the information that you have placed an order with us. It may be that your credit card provider performs a credit check. You can find more information about this on the respective website of your credit card provider.

GooglePay: If you pay on our website with GooglePay (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), GooglePay receives your payment data for payment processing and it may be that GooglePay performs a credit check. Information about this can be found at: https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de#:~:text=F%C3%BCr%20the%20
security%20of%20your%20Google,and%20your%20personal%20data%20to access.

ApplePay: If you pay on our website with ApplePay (Apple Inc., 1 Apple Park Way Cupertino, California, 95014-0642 United States), ApplePay receives your payment data for payment processing and it may be that PayPal performs a credit check. Information on this can be found at: https://www.apple.com/de/legal/privacy/data/de/apple-pay/

6. Contact us by e-mail, phone or fax

You have the possibility to contact us by phone, e-mail or fax. Your personal data transmitted in this way will be stored by us. The data will be processed exclusively to handle your contact. The legal basis for the processing of your personal data is Art. 6 para. 1 sentence 1 lit. f DSGVO. The data will be stored until they are no longer required to achieve the purpose of the conversation with you and the matter of your contact has been comprehensively clarified.

If your contact aims to conclude a contract with us, the additional legal basis for the processing of your personal data is Art. 6 para. 1 sentence 1 lit. b DSGVO. This data will be stored as long as it is necessary for the execution of the contract or the pre-contractual measures. Beyond that, we only store your data in order to comply with legal obligations (e.g. tax obligations) (Art. 6 para. 1 sentence 1 lit. c DSGVO).

In addition to the data that you voluntarily provide to us, we may receive the time (date and time) of transmission of your data to us, as well as your IP address. The processing of this data corresponds to our legitimate interest (Art. 6 para. 1 sentence 1 lit. f DSGVO) to ensure the security of our systems and to counteract misuse. This data, which we additionally collect during your contact, will be deleted as soon as it is no longer needed, at the latest when the matter of your contact has been comprehensively clarified.

You can inform us at any time (see point 1 above) that you would like us to delete the data provided during the conversation. In this case, all personal data of the conversation will be deleted, if permissible, and a continuation of the conversation is not possible.

7. Links to social networks

On our website, we use small icons and other links, each of which refers to our web presence on third-party platforms (Facebook, Instagram, YouTube). These are hyperlinks in each case, so no data is transferred from you automatically, but only when you click on the icons or the corresponding link and a new window opens in your browser with the website of the third-party provider.

a. Facebook fan page

We operate a fan page on the social media platform Facebook (Facebook Inc., Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland (hereinafter: "Facebook")), which we link to on our website via the Facebook icon. As long as you do not click on the link, Facebook does not receive any data from you. If you click on the link, for example to view our company presence on Facebook or to "like" our page, Facebook will receive data from you (which data Facebook receives also depends on whether you are logged in to Facebook with your user profile while you click on the page or not). In addition, Facebook uses so-called cookies, which are stored on your end device when you visit our fan page, even if you do not have your own Facebook profile or are not logged into it during your visit to our fan page. These cookies allow Facebook to create user profiles based on your preferences and interests and to show you advertising (inside and outside of Facebook) that is tailored to these preferences and interests. Cookies remain on your terminal device until you delete them. You can find more information about the cookies used by Facebook at https://www.facebook.com/policies/cookies/.

According to its own information, Facebook uses this data for a wide variety of purposes and transmits it worldwide, both internally to other Facebook companies and to a wide variety of external partners. Facebook relies on various legal bases for this data processing, which you can find in detail in Facebook's data policy. The data policy can be found at the following link: https://www.facebook.com/policy.php

While Facebook uses this data under its own responsibility for various purposes, we can only see aggregated data, i.e. statistics, on our company homepage (e.g. user growth, user demographics, use of individual functionalities), which no longer have any personal reference. These are called "Page Insights". More information about Page Insights can be found at the following link: https://www.facebook.com/legal/terms/information_about_page_insights_data

According to the requirements of the GDPR, we are jointly responsible with Facebook for the data processing on our Fan Page (Art. 26 GDPR). Accordingly, we have entered into an agreement with Facebook, provided by Facebook, in which this joint responsibility is regulated. You can find the agreement in German under the following link: https://www.facebook.com/legal/terms/page_controller_addendum

It follows that Facebook is primarily responsible for the aggregated Insight Data. In addition, Facebook will comply with all obligations under the GDPR with respect to the processing of Insight Data (including Articles 12, 13 GDPR, Articles 15-22 GDPR and Articles 32-34 GDPR). If you send us a request regarding our Facebook fan page, we will inform Facebook in a timely manner. Facebook will respond to the request according to our agreement.

Our legitimate interests in the processing of personal data lie in the use and linking of different communication channels, marketing via high-reach social media platforms, and the analysis and evaluation of the success of our communication and marketing efforts. The legal basis for the processing is Art. 6 (1) sentence 1 lit. f DSGVO. If you consent to the data processing (in particular to the setting of cookies), the processing is also based on Art. 6 (1) sentence 1 lit. a DSGVO.

If you use our Facebook fan page to contact us (for example, by creating your own posts, responding to one of our posts or by sending us private messages), we process the data you provide exclusively in order to process your contact. The legal basis for the processing of your personal data is thus Art. 6 para. 1 sentence 1 lit. f DSGVO. It is our legitimate interest to process your data transmitted to us in order to contact you. The data will be stored until they are no longer required to achieve the purpose of the conversation with you and the matter of your contact has been comprehensively clarified. You can inform us at any time (see point 1 above) that you would like us to delete the data provided during the conversation. In this case, all personal data of the conversation will be deleted, if permissible, and a continuation of the conversation is not possible.

b. Internet presence on Instagram

We operate a company presence on the social media portal Instagram. The operator of Instagram is Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, whereby the platforms Facebook and Instagram share the technical infrastructure according to their own information. In the following, the term "Instagram" is used for the social media portal, the term "Facebook" for the operator of this portal

On our website, we link to our company presence on Instagram with the Instagram icon. As long as you do not click on the link, Facebook does not receive any data from you. If you click on the link, for example to view or subscribe to our corporate presence on Instagram, Facebook will receive data from you (which data Facebook receives also depends on whether you are logged in to Instagram with your user profile while you click on the page or not). In addition, Facebook uses so-called cookies that are stored on your end device when you visit our company website, even if you do not have your own Instagram profile or are not logged into it during your visit to our company website. These cookies allow Facebook to create user profiles based on your preferences and interests and to show you advertising (within and outside of Instagram) tailored to these. Cookies remain on your terminal device until you delete them. You can find more information about the cookies used by Facebook at https://help.instagram.com/1896641480634370?ref=ig.

According to its own information, Facebook uses this data for a wide variety of purposes and transmits it worldwide, both internally to other Facebook companies and to a wide variety of external partners. Facebook relies on various legal bases for this data processing, which you can find in detail in Instagram's privacy policy and Facebook's data policy. You can find Instagram's privacy policy at the following link: https://www.instagram.com/legal/privacy/ The data policy of Facebook, which is also to be applied to Instagram, can be found at https://www.facebook.com/policy.

While Facebook uses this data under its own responsibility for various purposes, we can only see aggregated data, i.e. statistics (e.g. user growth, user demographics, use of individual functionalities) on our company website, which no longer have any personal reference. These are called "Page Insights". You can find more information about Page Insights on the corresponding information page of Facebook, which refers to all Facebook products (and thus also to Instagram). You can access this information page at the following link: https://www.facebook.com/legal/terms/information_about_page_insights_data

According to the requirements of the GDPR, we are jointly responsible with Facebook for the data processing on our Instagram company website (Art. 26 GDPR). Accordingly, we have entered into an agreement with Facebook provided by Facebook that governs this joint responsibility. You can find the agreement in German under the following link: https://www.facebook.com/legal/terms/page_controller_addendum

It follows that Facebook is primarily responsible for the aggregated Insight Data. In addition, Facebook will comply with all obligations under the GDPR with respect to the processing of Insight Data (including Articles 12, 13 GDPR, Articles 15-22 GDPR and Articles 32-34 GDPR). If you send us a request regarding our Instagram company presence, we will inform Facebook about it in a timely manner. Facebook will respond to the request in accordance with our agreement.

Our legitimate interests in the processing of personal data lie in the use and linking of different communication channels, marketing via high-reach social media platforms, and the analysis and evaluation of the success of our communication and marketing efforts. The legal basis for the processing is Art. 6 (1) sentence 1 lit. f DSGVO. If you consent to the data processing (in particular to the setting of cookies), the processing is also based on Art. 6 (1) sentence 1 lit. a DSGVO.

If you use our Instagram presence to contact us (for example, by creating your own posts, responding to one of our posts or by sending us private messages), we process the data you provide exclusively to process your contact. The legal basis for the processing of your personal data is thus Art. 6 para. 1 sentence 1 lit. f DSGVO. It is our legitimate interest to process your data transmitted to us in order to contact you. The data will be stored until they are no longer required to achieve the purpose of the conversation with you and the matter of your contact has been comprehensively clarified. You can inform us at any time (see point 1 above) that you would like us to delete the data provided during the conversation. In this case, all personal data of the conversation will be deleted, if permissible, and a continuation of the conversation is not possible.

c. Internet presence on YouTube

We operate a corporate presence on the video sharing platform YouTube. The operator of YouTube is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In the following, the term "YouTube" is used for the video sharing platform, the term "Google" for the operator of the platform.

On our website, we link to our company presence on YouTube with the YouTube icon. As long as you do not click on the link, Google does not receive any data from you. If you click on the link, for example to view or subscribe to our corporate presence on YouTube, Google will receive data from you (which data Google receives also depends on whether you are logged in to YouTube with your user profile while you click on the page or not). In addition, Google uses so-called cookies, which are stored on your end device when you visit our company website, even if you do not have your own YouTube profile or are not logged into it during your visit to our company website. These cookies allow Google, among other things, to collect and analyze data on target group interactions and website statistics (within and outside of YouTube). Cookies remain on your terminal device until you delete them. More information about the cookies used by Google can be found at https://policies.google.com/technologies/cookies?hl=de&utm_source=ucb.

According to its own information, Google uses this data for a wide variety of purposes and transfers it worldwide, both internally to affiliated companies and to companies, organizations or persons outside Google. Google relies on various legal bases for this data processing, which you can find in detail in Google's privacy policy. Google's privacy policy can be found at the following link: https://policies.google.com/privacy?hl=de.

While Google uses this data under its own responsibility for various purposes, we can only see aggregated data, i.e. statistics (e.g. playbacks, playback times and types of access sources) on our company website, which no longer have any personal reference. This performance data is analyzed using the "YouTube Analytics" tool. More information about the performance data can be found on the corresponding information page of Google under the following link: https://support.google.com/youtube/answer/9002587?hl=de

Our legitimate interests in the processing of personal data lie in the use and linking of different communication channels, marketing via high-reach social media platforms, and the analysis and evaluation of the success of our communication and marketing efforts. The legal basis for the processing is Art. 6 (1) sentence 1 lit. f DSGVO. If you consent to the data processing (in particular to the setting of cookies), the processing is also based on Art. 6 (1) sentence 1 lit. a DSGVO.

If you use our YouTube presence to contact us (for example, by creating your own posts, responding to one of our posts or by sending us private messages), we process the data you provide exclusively to process your contact. The legal basis for the processing of your personal data is thus Art. 6 para. 1 sentence 1 lit. f DSGVO. It is our legitimate interest to process your data transmitted to us in order to contact you. The data will be stored until they are no longer required to achieve the purpose of the conversation with you and the matter of your contact has been comprehensively clarified. You can inform us at any time (see point 1 above) that you would like us to delete the data provided during the conversation. In this case, all personal data of the conversation will be deleted, if permissible, and a continuation of the conversation is not possible.

8. Social media plugins (with shariff function)

Social media plug-ins from social networks are integrated on our website (Facebook, Instagram, YouTube). However, data is not directly activated to the respective social media platforms when you call up our website, but only when you become active yourself by clicking on the respective share button (Shariff function).

If you are already logged in to the social media platform at the time you click the button, a window appears that allows you to confirm whether you want to share the post on the respective platform. If you are not already logged in, the log-in field appears on the platforms.

9. Other third-party content and services that are integrated on our website

a. YouTube

We integrate videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for the purpose of making our website more appealing. In the following, the term "YouTube" is used for the video portal, the term "Google" for the operator of this portal.

When integrating YouTube videos, we use the extended data protection mode, in which, according to the provider, information about you is only shared with Google if you activate the video by clicking on the play button of the video.

If you activate the video, Google may use cookies to collect information for analysis purposes and to improve the user experience. According to Google, the data is processed pseudonymously. However, especially if you are logged into your Google or YouTube account, the data may be directly linked to these accounts.

According to its own information, Google uses this data for a wide variety of purposes and transmits it to a wide variety of recipients, including those not located within the EU. Google relies on various legal bases for this data processing. In this respect, an overview is provided by Google's privacy policy, which can be accessed via the following link: https://policies.google.com/privacy?hl=de.

The legal basis for the integration of the YouTube service on our website and the associated processing of your data is Art. 6 para. 1 sentence 1 lit. f DSGVO. Our legitimate interests lie in the appealing design of our website and the use of a specialized, external service for hosting and displaying videos.

If YouTube sets cookies when you actively click and play a YouTube video on our site, we process your data on the basis of consent (Art. 6 para. 1 sentence 1 lit. a DSGVO) as well as on the basis of our legitimate interests (Art. 6 para. 1 sentence 1 lit. f DSGVO). You can revoke your consent at any time by deleting the cookies from your browser. Our legitimate interests in this respect also lie in the appealing design of our website and the use of a specialized, external service for hosting and displaying videos.

10. Use of service providers

a. General notes

We would like to point out that when processing your personal data, we may use service providers with whom we have concluded order processing agreements (e.g. for website hosting). If processors in a third country (not within the EU) perform the data processing, we ensure that the level of protection of your data guaranteed by the GDPR is not undermined (Art. 44 et seq. GDPR). The legal basis for the use of service providers is Art. 6 para. 1 p. 1 lit. f DSGVO. The engagement of service providers (specialists or other service providers in areas that we cannot serve ourselves) is in our legitimate interest. If you would like to receive a copy of the appropriate or adequate guarantees, please let us know (see point 1 above).

b. Amazon Web Services

Our website uses Amazon Web Services (hereinafter "AWS"), a cloud computing environment provided by with Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855, Luxembourg. AWS's servers are used to connect your device to the content in our website and databases. We use the AWS Europe (Frankfurt) region for this purpose. This means that personal data collected on our website is stored on servers located within the European Union. This may be IP addresses, contact requests, meta and communication data, contract data, contact data, names, website accesses and other data generated via a website.

AWS is used for the purpose of fulfilling contracts with our potential and existing customers (Art. 6 para. 1 sentence 1 lit. b DSGVO) and in the interest of a secure, fast and efficient provision of our online offer by a professional provider (Art. 6 para. 1 sentence 1 lit. f DSGVO).

We have concluded an order processing agreement with Amazon. In the event that, exceptionally, personal data is transferred to the USA to Amazon's parent company, Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA, we have also concluded so-called standard contractual clauses (SCC) with Amazon. Amazon has thus undertaken to guarantee the European data protection principles and the local level of data protection also in the context of data processing taking place in the USA. For more information, please visit https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf (AWS-DSGVO Data Processing Addendum ("DPA")) and https://d1.awsstatic.com/Supplementary_Addendum_to_the_AWS_GDPR_DPA.pdf (AWS Supplement to the DPA).

c. Shopify

Our website uses Shopify (hereinafter "Shopify"), a platform that enables the sale of products and is provided by Shopify International Ltd. , c/o Intertrust Ireland, 2nd Floor 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify's servers are used to connect your device to the content in our website and databases. This means that the personal data collected on our website is stored on servers located within the European Union and also in Canada. This may be IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses and other data generated through a website.

We use the following Shopify services:

  • Shopify CDN: Shopify CDN is a content delivery network that is used to make the content used in the store load faster.
  • Shopify Cloud: The Shopify Cloud application is a storage solution that stores data processed as part of using Shopify in the cloud.

Shopify is used for the purpose of fulfilling contracts with our potential and existing customers (Art. 6 para. 1 sentence 1 lit. b DSGVO) and in the interest of a secure, fast and efficient provision of our online offer by a professional provider (Art. 6 para. 1 sentence 1 lit. f DSGVO).

Your data will also be sent to other Shopify locations and to service providers located in other regions, such as Canada (where Shopify is based) and the United States. If you are located in Europe, your personal data is protected by Canadian law when sent to Canada. The European Commission has determined that this provides an adequate level of protection for your data. In the event that, exceptionally, personal data is transferred to the USA by the Canadian Spotify, Inc. in the process, we would like to point out that, according to the case law of the European Court of Justice, there is currently no adequate level of protection for the transfer of data. This involves various risks in connection with data processing (e.g., official access to the data). Shopify states that it transfers this data in accordance with the requirements of the Canadian Personal Information Protection and Electronic Documents Act ("PIPEDA"), which has been determined to be adequate by the European Commission, and subject to specific contractual arrangements that are substantially similar to those in the Data Processing Addendum that we have entered into with Shopify.

The Data Processing Addendum that we have entered into with Shopify is available here: https://www.shopify.com/legal/dpa Information on onward transfers by Shopify can be found at https://help.shopify.com/pdf/cross-border-whitepaper.pdf Further information on data processing by Shopify can be found here https://www.shopify.de/legal/datenschutz

d. Shopify Apps

Our website uses apps from Hextom (hereinafter "Hextom"), a provider of apps offered through the Shopify App Store, to, among other things, process orders and make shipments ready for shipment. The Apps are provided by Hextom Inc, 702-5255 Yonge St, North York ON, M2N 6P4, Canada.

The following apps are used on our website:

Hextom's servers are used to connect your device to the content in our website and our databases. This means that the personal data collected on our website is stored on servers located within the European Union and also in Canada. This may be IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses and other data generated through a website.

Hextom is used for the purpose of fulfilling contracts with our potential and existing customers (Art. 6 para. 1 sentence 1 lit. b DSGVO) and in the interest of a secure, fast and efficient provision of our online offer by a professional provider (Art. 6 para. 1 sentence 1 lit. f DSGVO).

Your information will also be sent to other Hextom locations and to service providers located in other regions, such as Canada (where Hextom is based) and the United States. If you are located in Europe, your personal data is protected by Canadian law when sent to Canada. The European Commission has determined that this provides adequate protection for your data. In the event that, exceptionally, personal data is transferred to the USA in the process, we would like to point out that, according to the case law of the European Court of Justice, there is currently no adequate level of protection for the transfer of data. This involves various risks in connection with data processing (e.g. official access to the data).

Further information on data processing by Hextom can be read here: https://hextom.com/privacy-policy/

e. Google Fonts

So-called fonts are integrated on our website, which are offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland for users from the European Economic Area and Switzerland and by Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA for all other users. When you visit our site, your browser establishes a connection to Google's server in order to request the display of the font. In the process, various information, such as browser and device data as well as your IP address, is transmitted to Google.

The legal basis for the processing of your data for the automated retrieval of fonts is Art. 6 (1) sentence 1 lit. f DSGVO. It is in our legitimate interest to use Google Fonts for the purpose of appealing design and for faster accessibility and availability of our website.

Google is still certified under the Privacy Shield, but we cannot rely on it for data transfers. Information on the Privacy Shield can be found at: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI as well as https://policies.google.com/privacy/frameworks?hl=de&gl=de

For data transfers to countries that do not have an adequate level of data protection, Google relies on the EU standard contractual clauses. Information can be found at: https://policies.google.com/privacy?hl=de&gl=de#intro and https://policies.google.com/privacy/frameworks?hl=de&gl=de.

f. CDN tool (Cloudflare)

On our website, we use Cloudflare, a content delivery network tool provided by Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). With the help of Cloudflare's Content Delivery Network and the web security services offered by Cloudflare, we can optimize the delivery speed as well as the security of our website.

For this purpose, Cloudflare receives information about how you interact with our website. The information processed may include your IP address, system configuration information, and device and application information, and information about your network.

The legal basis for the processing of your data is Art. 6 (1) sentence 1 lit. f DSGVO, as it is our legitimate interest to optimize the security and performance of our website by using Cloudflare.

We have entered into an order processing agreement with Cloudflare. Cloudflare is still certified under the Privacy Shield, but for data transfers Cloudflare now relies on the standard contractual clauses.

For more information about Cloudflare's standard contractual clauses and how Cloudflare processes your data, please visit https://www.cloudflare.com/cloudflare_customer_SCCs-German.pdf and https://www.cloudflare.com/de-de/privacypolicy/ and https://www.cloudflare.com/de-de/gdpr/introduction/.

g. Google Marketing (DoubleClick)

On our website, we integrate the online marketing solution Google Marketing Platform (formerly DoubleClick), which is offered to users from the European Economic Area, Switzerland and Liechtenstein by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland and to all other users by Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA (hereinafter "Google Marketing Platform"). This tool enables us to place personalized digital advertisements on our website and to analyze their success later. At the same time, this allows us to avoid showing you advertisements again that you have already been able to view on another page.

For this purpose, Google Marketing Platform sets cookies through which the respective page views can be recorded. Google Marketing Platform sets cookies that store the following information:

  • Referrer (previously visited website)
  • Your IP address
  • How you use our website
  • the number of page views
  • Keywords you used for the searchers

Before we set the cookies, we obtain your consent for this (Art. 6 para. 1 sentence lit. a DSGVO).

You can prevent the collection of data generated by the cookie and related to your use of the website (including your (anonymized) IP address) to Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link (https://support.google.com/ads/answer/7395996).

You can either prevent the storage of Google cookies directly in your browser settings yourself, or prevent the processing of your data by clicking on the following link: https://adssettings.google.com/anonymous?hl=de

Google's privacy policy can be found at the following link: https://policies.google.com/privacy?hl=de.

We have concluded an order processing agreement with Google. Google is still certified under the Privacy Shield, but for data transfers Google now relies on the standard contractual clauses (available at https://privacy.google.com/businesses/processorterms/mccs/).

You can read about how Google uses data from Google Marketing Platform advertising products here: https://support.google.com/displayvideo/answer/7621162?hl=de

More information on the Privacy Shield can be found here: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI and
https://policies.google.com/privacy/frameworks?hl=de&gl=de.

11. Your rights

If we process your data, you are a "data subject" within the meaning of the GDPR. You have the following rights: right to information, right to rectification, right to restriction of processing, right to erasure, right to information and right to data portability. In addition, you have a right of objection, a right of revocation and the right to complain to the supervisory authority.

Below you will find some details about the individual rights:

a. Right to information

You have the right to request confirmation from us as to whether we are processing your personal data. If we process your personal data, you have the right to obtain information in particular about the processing purposes, categories of personal data, recipients or categories of recipients, storage period, if applicable.

b. Right of rectification

You have the right to correct and/or complete the data we have stored about you if this data is incorrect or incomplete. We will carry out the correction or completion without delay.

c. Right to restrict processing

Under certain circumstances, you have the right to request that we restrict the processing of your personal data. An example of this is if you dispute the accuracy of your personal data and we need to verify the accuracy for a certain period of time. For the duration of the verification, your data will only be processed in a restricted manner. Another example of restriction is if we no longer need your data, but you need it for a legal dispute.

d. Cancellation right

In certain situations, you have the right to request that we delete your personal data immediately. This is the case, for example, if we no longer need your personal data for the purposes for which we collected the data or if we have processed your data unlawfully. Another example would be if we process your data based on your consent, you revoke your consent and we do not process the data based on any other legal basis. However, your right to erasure does not always exist. For example, we may process your personal data to comply with a legal obligation or because we need it for litigation.

e. Right to information

If you have exercised your right to rectify, erase or restrict the processing of your data, we are obliged to notify all recipients to whom we have disclosed your personal data of the rectification, erasure or restriction of the processing of your data, unless this proves impossible or involves a disproportionate effort.

f. Right to data portability

Under certain conditions, you have the right to receive the personal data you have provided to us in a structured, common and machine-readable format and the right to have this data transferred to another controller. This is the case if we process the data either on the basis of your consent or on the basis of a contract with you and that we process the data using automated processes.

You have the right to request that we transfer your personal data directly to another controller, insofar as this is technically feasible and does not affect the freedoms and rights of other persons.

This right to data portability does not apply if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

g. RIGHT OF OBJECTION

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6 (1) lit. e or lit. f DSGVO. This also applies to profiling based on these provisions.

We will no longer process your personal data after an objection, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

If we process your personal data for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for the purpose of such marketing. This also applies to profiling, insofar as it is related to direct advertising. If you object to the processing of your personal data for direct marketing purposes, we will no longer process it for these purposes.

h. Right of withdrawal

Pursuant to Art. 7 (3) DSGVO, you have the right to revoke your consent at any time. The withdrawal of consent does not retroactively invalidate the lawfulness of the processing.

i. Right of complaint to a supervisory authority

You have the right to lodge a complaint with a supervisory authority, without prejudice to any other administrative or judicial remedy. In particular, you may exercise your right to lodge a complaint in the Member State of your residence, workplace or the place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR.

An overview of the respective state data protection commissioners of the federal states as well as their contact details can be found under the following link:

https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html

12. Status and up-to-dateness of this data protection information

Status: MAY 2022

Tailor-made data protection. www.datenschutz-stuttgart.com

Cookie information

Please note the following: You can ensure yourself that no cookies are stored on your computer at all, or that the storage of only certain cookies is permitted. You can select this in your internet browser settings. You can also view and delete the stored cookies there.

If you block all cookies, you may not be able to use all the features of our website.

We use cookies on our website. Cookies are text files that are sent to your browser by our web server when you visit our website and are stored on your computer for later retrieval. Through a cookie, your internet browser can therefore be identified when you call up the website again.

There are session cookies, which are those that delete themselves when you close the browser, and there are persistent cookies, which are stored on the hard drive until their preset expiration date is reached or until they are actively removed by you.

Some of the cookies we use on our website come from third parties that help us analyze the impact of our website content and visitors' interests, measure the power and performance of our website, or serve customized advertising and other content to our website or other websites. As part of our website, we use both first party cookies (only visible from the domain you are visiting) and third party cookies (visible across domains and regularly set by third parties).

In this context, we set the following types of cookies:

Technically necessary cookies: These are absolutely necessary to navigate the website, use basic functions and ensure the security of the website; they do not collect information about you for marketing purposes nor do they store which web pages you have visited. The legal basis for setting technically necessary cookies is Section 25 (2) TTDSG or, if personal data is contained in the cookies, Article 6 (1) sentence 1 lit. f DSGVO.

Optional cookies: We also use so-called analysis and marketing cookies on our website. Analysis cookies collect information about how you use our website, which pages you visit and, for example, whether errors occur during website use. Marketing cookies are used to show you tailored advertisements on the website or offers from third parties and to measure the effectiveness of these offers. These are cookies that are not technically necessary. The legal basis for the setting of these cookies is thus your consent pursuant to Section 25 (1) TTDSG or, if personal data is contained in the cookies, Article 6 (1) sentence 1 lit. a DSGVO.

Possibility of revocation and removal

As communicated in the introduction to this section, you can enable or restrict the transfer of cookies by changing the settings in your Internet browser. Cookies that have already been stored by your Internet browser can be deleted there at any time. If cookies are restricted or disabled for our website, it may not be possible to use all functionalities.

(1) Technically necessary cookies:

We use the following technically necessary cookies on our website:

Name

Purpose

Storage duration

_shopify_m

Used to manage the privacy settings of customers

365 days

_shopify_tm

For managing the privacy settings of customers

1 day

_shopify_tw

Used to manage the privacy settings of customers

14 days

_tracking_consent

Tracking settings

365 days

cart_currency

Used in conjunction with the shopping cart.

14 days

cart_ts

Used in conjunction with the checkout.

14 days

cart

Used in conjunction with the shopping cart.

14 days

localization

 

14 days

secure_customer_sig

Used in connection with customer registration.

2 years

test_cookie

Doubleclick.net

1 day

tms-session-storage

Shopify cookie

Session cookie

tms-util-storage

Shopify cookie

Session cookie

 

(2) Optional cookies:

We use the following optional cookies on our website:

Name

Purpose

Storage duration

_landing_page

Track landing pages

Session cookie

_orig_referrer

Track landing pages

Session cookie

_s

Shopify Analytics

Session cookie

_shopify_e

Shopify Analytics

Session cookie

_shopify_evids

Shopify Analytics

Session cookie

_shopify_s

Shopify Analytics

Session cookie

_shopify_sa_p

Shopify analytics related to marketing and referrals

Session cookie

_shopify_sa_t

Shopify analytics related to marketing and referrals

Session cookie

_shopify_y

Shopify Analytics

Session cookie

_y

Shopify Analytics

Session cookie

1P_JAR

Collects website usage statistics and measures conversions, i.e. when a user becomes a buyer. The cookie is also used to display relevant ads to users. Furthermore, the cookie prevents a user from being shown the same ad multiple times.

1 month

CONSENT

Google consent cookie

2 years

NID

NID is used by Google to customize ads to your Google search and generate tailored ads. The cookie contains a unique ID that Google uses to collect personal settings of the user for advertising purposes.

6 months

CONSENT

Youtube consent cookie

2 years

VISITOR_INFO1_LIVE

Youtube uses this cookie to calculate the bandwidth used by the user.

6 months

YSC

Youtube analytics cookie to store and track communication.

Session cookie

 

(3) Status and up-to-dateness of this cookie information

Status: May 2022