Data protection and data security

If you voluntarily provide us with personal data, for example via our contact form, by email or in the course of using our online shop, we process that data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Name and contact details of the body responsible for the processing:
Connox GmbH Krauss-Maffei-Str. 3
30880 Laatzen
Germany
Email: [email protected]

Data protection officer
Email: [email protected]

Disclosure of data

Your data is in good hands with us. We expressly assure you: we do not sell your personal data, nor do we rent it out to other companies for advertising purposes.
We only disclose your personal data to third parties if:

you have given us your express consent to do so in accordance with Art. 6(1)(1)(a) GDPR;
this is necessary in accordance with Art. 6(1)(1)(b) GDPR for the performance of contractual relationships with you (for example to credit institutions, postal, courier and logistics companies);
external service providers process data on our behalf as processors. Your data is subject to the same data protection standards there as it is with us. The receiving body may only use the data for the purposes for which the data was transmitted to it. The external service providers include, in particular, data centres and companies that support us in the maintenance of IT systems and IT applications;
there is a legal obligation for the disclosure in accordance with Art. 6(1)(1)(c) GDPR; or
the disclosure is necessary in accordance with Art. 6(1)(1)(f) GDPR and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed.

For the purpose of processing your enquiry and your orders, it may be necessary to disclose your personal data to affiliated companies within the Connox group of companies .
The affiliated companies of the Connox group of companies and third parties to which we disclose your personal data may only use this data for the purposes stated above. In addition, they are obliged to process the data only in accordance with our instructions and the applicable data protection laws.
Service providers acting on our behalf have been carefully selected and engaged by us and are bound by our instructions. Furthermore, we are contractually entitled to monitor the service providers' compliance with the relevant contractual and statutory rules. The external service providers can be assigned to the following categories:

service providers for the hosting, servicing and maintenance of our website,
service providers in the field of customer service
"dropshippers", i.e. manufacturers that ship the goods directly to you,
banks and other providers of payment services, also for the settlement of
payments,
dispatch providers for email newsletters as well as dispatch providers for catalogues,
service providers for fraud prevention that detect or prevent misuse on our site,
service providers in the field of marketing and web analytics,
service providers for customer enquiries,
service providers for the display of forms on the website.

Where we transfer personal data to recipients in so-called "third countries", i.e. countries outside the European Union ("EU") or the European Economic Area ("EEA") in which a level of data protection comparable to that in the EU cannot readily be assumed and we are not authorised to make the transfer on the basis of a legal obligation, we ensure that the necessary adequate level of data protection is guaranteed in the respective third country or at the recipients in the third country. This may result in particular from a so-called adequacy decision of the European Commission by which an adequate level of data protection is established for a particular third country as a whole. Alternatively, we may also base the data transfer on the so-called "EU standard contractual clauses" agreed with the recipients or on binding internal data protection rules (so-called Binding Corporate Rules). You can consult the contractual texts of the EU standard contractual clauses at the European Commission. This also applies to adequacy decisions. We will be happy to provide you with further information on the suitable and appropriate safeguards for compliance with an adequate level of data protection on request.
For transfers of data to the USA, the EU-U.S. Data Privacy Framework (EU-U.S. DPF or „DPF“) applies as a matter of priority, which guarantees an adequate level of data protection for a company in the USA certified thereunder. Where the companies concerned are certified thereunder, we point out the DPF-based data protection compliance in each case. In the course of financing our business, we in some cases assign claims arising from the purchase contracts with you - our customers - to third parties. In the course of such an assignment, the personal data required for the identification of the relevant claim is disclosed. The legal basis for the data transfer in this respect is Art. 6(1)(1)(f) GDPR. The assignees process the transferred data under their own responsibility subject to the applicable data protection provisions. For you as a customer, this does not change anything in the performance of your contract with us. Connox remains your direct contact and is entitled to receive your purchase price payments. Please refer to the explanations below for further details on the disclosure of personal data.

TLS encryption

For security reasons, this website uses transport encryption (TLS) in order to protect personal data during transmission. As a result, data is transmitted in encrypted form between your browser and our server and cannot be read by third parties. You can generally recognise an encrypted connection by the padlock symbol in the address bar of your browser.

Personal data

Pursuant to Art. 4(1) GDPR, personal data means any information relating to an identified or identifiable natural person („data subject“). A natural person is regarded as identifiable who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more special characteristics that are an expression of the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Personal data is therefore all data that can be related to you personally, in particular:

Your name, date of birth, gender where applicable, address, email address, and telephone number,
Your sufficiently secure password for your customer account,
Your order details, the products you have purchased, and the services you have used,
Payment information,
Your preferences regarding product types, and data generated when you use our online services, Data that we receive from our service providers in certain cases (e.g. from credit agencies or payment service providers).

Collection and storage of personal data as well as the nature and purpose of its use
We process personal data when you access our website, set up a customer account or place an order with us. We also process your personal data in order to contact you as well as for advertising purposes. In connection with the purposes stated, we make content available to you, analyse the use of our platform and implement necessary security measures. If we ask you to enter certain personal data, you can of course refuse to do so. You have the choice as to which information you give us. However, we may then not be able to offer you certain products and services. Without the provision of a delivery address, for example, no furniture delivery can take place. If certain information is required (mandatory information), we will inform you of this by means of an appropriate marking.

Visiting our website

When you access our website, the browser used on your device automatically sends information to the server of our website. This information is stored temporarily in a so-called log file. The following information is recorded without any action on your part and stored until it is automatically deleted:

IP address of the requesting computer (truncated in the log file),
date and time of access,
name and URL of the file accessed,
website from which the access takes place (referrer URL),
browser used and, where applicable, the operating system of your computer as well as the name of your access provider,
online identifiers (for example device identifiers, session IDs)

The data stated is processed by us for the following purposes:

ensuring a smooth connection of the website,
ensuring a convenient use of our website,
evaluation of system security and stability, and
for further administrative purposes. Connox uses the IP address to protect customers and to prevent or detect misuse of the website. We point out that the IP address is only used and further processed in truncated form in order to exclude a direct reference to a person.

The legal basis for the data processing is Art. 6(1)(1)(f) GDPR. Our legitimate interest follows from the purposes for data collection listed above. Under no circumstances do we use the data collected for the purpose of drawing conclusions about you as a person.
For the customer-oriented management of order processing and optimisation of customer-oriented marketing, we use Google Consent Mode (“GCM”). GCM is a tool that simplifies the management of Google tags while taking into account the website visitor’s consent to or refusal of advertising cookies. With your consent via our cookie banner, Google services are activated and managed via Google Consent Mode (GCM) in accordance with your selection. Google tags are processed depending on the consent you have given. Processing takes place exclusively within the scope of the settings you have selected. In addition, when you visit our website, we use cookies and other services. You will find more detailed explanations below in this privacy policy.

Customer registration

Here Connox processes and uses the data that is voluntarily entered into forms and transmitted to Connox. This is, for example, name, address as well as further contact details such as telephone number and email address, a user name and password (Art. 6(1)(1)(b) GDPR for the performance of contractual relationships). You can also order from us as a guest; your data is then used and stored for the performance of the contractual relationship and for the processing of the order.

Orders in the online shop

Personal data is collected by us when you voluntarily provide it to us of your own accord for the performance of a contract or when opening a customer account. This is, for example, your name, your address, your email address and your payment data. This data is used and stored by us for the performance of the contract and the delivery of your order (Art. 6(1)(1)(b) GDPR for the performance of contractual relationships).

Processing of orders
In order to be able to process and deliver your online shop orders, we disclose the data required for this purpose to the delivery company commissioned with the delivery, for example name and delivery address (Art. 6(1)(1)(b) GDPR for the performance of contractual relationships). In addition, your email address may be disclosed to the delivery company. You will then receive an email so that you can use the shipment tracking service and determine at any time when your parcel will arrive. The data disclosed in this way may only be used by the receiving body to fulfil its task. Any other use of the information is not permitted. In order to be able to process product recalls or have spare parts delivered directly by manufacturers, we disclose the data required for this purpose to the respective manufacturers, for example name and delivery address (Art. 6(1)(1)(b) GDPR for the performance of contractual relationships). In addition, your email address may be disclosed to the manufacturers. The data disclosed in this way may only be used by the recipients to fulfil their respective task. Any other use of the information is not permitted.

Newsletter registration and dispatch

Where you have expressly consented in accordance with Art. 6(1)(1)(a) GDPR and have registered for our newsletter dispatch (double opt-in procedure), we use your email address and, where applicable, further personal data provided by you in order to send you our newsletters on a regular basis. Providing your email address is sufficient for receiving the newsletter. You can unsubscribe at any time, for example via a link at the end of each newsletter. You can also send us an email at any time in order to unsubscribe. The data is then deleted and no longer used for the newsletter dispatch. Data collected in newsletters and in the shop may be processed and analysed in anonymised form with the help of third parties, for example in order to optimise advertising processes.

Advertising by postal mail

On the basis of our legitimate interest in personalised direct advertising, we reserve the right to store your personal data, in particular first and last name and your postal address, in accordance with Art. 6(1)(1)(f) GDPR and to use it for sending offers and information about our products and offers by postal mail. The advertising mailings are provided in the course of processing on our behalf, among others by optilyz GmbH, Neue Schönhauser Str. 19, 10178 Berlin, Germany, to which we disclose your data for this purpose. You can object to the storage and use of your data for this purpose at any time by sending us an appropriate message.

Contacting us via the contact form and by email

For questions of any kind, we offer you the possibility of contacting us via a form provided on the website or of sending us an email. In this context, providing a name as well as a valid email address in the contact form is required so that we know who the enquiry comes from and can process it. Further information can be provided voluntarily. The processing of your personal data takes place, depending on the nature of your enquiry, in accordance with Art. 6(1)(1)(a) GDPR in the case of voluntary contact, in accordance with Art. 6(1)(1)(b) GDPR in the case of contract-related or pre-contractual enquiries and otherwise on the basis of our legitimate interest in processing your enquiry in accordance with Art. 6(1)(1)(f) GDPR. Your information is stored and used exclusively for processing your contact. The personal data collected in the course of using the contact form is deleted after the final processing of your enquiry, unless statutory retention obligations preclude this. Where statutory retention obligations exist, the processing is restricted or the data is blocked instead.

Product review

In the course of the comment function / customer reviews on our website, in addition to your comment, information on the time at which the comment was created and the comment name selected by you is stored and published on our website. Furthermore, your truncated IP address is also logged and stored. This storage of the IP address takes place for security reasons and in the event that the data subject infringes the rights of third parties or provides unlawful content by means of a comment submitted. We need your email address in order to contact you in the event that a third person objects to your published content as unlawful. The legal bases for the storage of your data are Art. 6(1)(b) and (f) GDPR. We reserve the right to delete comments if third parties object to them as unlawful. Every consumer review is checked for authenticity before it is published, so that it is ensured that reviews only come from consumers who have in fact also purchased the products reviewed. The check takes place by making the possibility of submitting a review dependent on a previous purchase. Before publication, the reviews are manually checked for text passages that do not comply with the law and approved.

Credit assessment and scoring

In the case of insecure payment methods (for example purchase on account), we reserve the right to carry out a credit assessment on the basis of mathematical-statistical procedures in order to safeguard our legitimate interests (protection against payment defaults) - including in the case of existing customers. We transmit the personal data necessary for a credit assessment in accordance with Art. 6(1)(1)(f) GDPR to the following service provider: For customers from Germany: Creditreform Boniversum GmbH, Hellersbergstraße 11, D-41460 Neuss. You will find the information pursuant to Art. 14 GDPR on the data processing taking place at Creditreform Boniversum GmbH here: www.boniversum.de/EU-DSGVO. For customers from Austria: CRIF GmbH Diefenbachgasse 35, A-1150 Vienna, Austria. You will find the information pursuant to Art. 14 GDPR on the data processing taking place at CRIF GmbH Austria here: https://www.crif.at/konsumenten/informationen-zur-dsgvo/. For customers from Switzerland: CRIF AG, Hagenholzstrasse 81, 8050 Zurich, Switzerland. A transfer to Switzerland is generally possible on the basis of Art. 45 GDPR pursuant to the applicable adequacy decision of the European Commission. The credit report may contain probability values (so-called score values). Where score values are included in the result of the credit report, these are based on a scientifically recognised mathematical-statistical procedure; address data, among other things, is included in the calculation of the score values. We use the result of the credit assessment with regard to the statistical probability of payment default for the purpose of deciding on the establishment, performance or termination of a contractual relationship.

Payment providers

Payment providers from Germany and other EU Member States

legal basis Art. 6(1)(b) GDPR
data processing takes place under the providers' own responsibility

Payment providers U.S.A.

data processing takes place under the providers' own responsibility
for the U.S.A., the EU-U.S. Data Privacy Framework (EU-U.S. DPF) applies as a matter of priority

Payment via Amazon Pay

If the payment method "Amazon Pay" is selected, the payment is processed via the payment service provider Amazon Payments Europe s.c.a., 5 Rue Plaetis, L-2338 Luxembourg (hereinafter: „Amazon Payments“), to which we disclose the information provided by you in the course of the ordering process together with the information about your order in accordance with Art. 6(1)(1)(b) GDPR. Your data is disclosed exclusively for the purpose of payment processing with the payment service provider Amazon Payments and only to the extent that this is necessary for that purpose. At the internet address below you will receive further information about the data protection provisions of Amazon Payments: https://pay.amazon.com/de/help/201751600

Payment via PAYONE

If you decide on a payment method by credit card, the payment is processed via the service provider BS PAYONE GmbH, Lyoner Straße 9, 60528 Frankfurt/Main, „PAYONE“ (Art. 6(1)(1)(b) GDPR for the performance of contractual relationships). PAYONE is certified in accordance with the Payment Card Industry Data Security Standard (PCI DSS). If you enter your credit card data into the corresponding form on our website, the credit card data is collected and processed directly by PAYONE. We do not receive this data. For more detailed information about data protection at PAYONE and your rights in this respect, please refer to the data protection provisions of PAYONE: https://www.bspayone.com/downloads/BSPAYONE\_Information-zur-Datenverarbeitung-gem-Art14-DSGVO.pdf

Payment via PayPal

In the case of payment via the payment service provider PayPal, credit card via PayPal, direct debit via PayPal or - if offered - "purchase on account" via PayPal, we disclose your payment data in the course of the payment processing to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal") (Art. 6(1)(1)(b) GDPR for the performance of contractual relationships). For the payment methods credit card via PayPal, direct debit via PayPal or - if offered - "purchase on account" via PayPal, PayPal reserves the right to carry out a credit report. PayPal uses the result of the credit assessment with regard to the statistical probability of payment default for the purpose of deciding on the provision of the respective payment method. The credit report may contain probability values (so-called score values). Where score values are included in the result of the credit report, these are based on a scientifically recognised mathematical-statistical procedure. Address data, among other things, is included in the calculation of the score values. For further data protection information, including about credit reports on the part of PayPal, please refer to PayPal's privacy policy:
https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Sofort-Überweisung

In the case of payment via the online payment service provider Sofortüberweisung, your contact details are transmitted to Sofortüberweisung in the course of the order triggered in this way. Sofortüberweisung is an offering of SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany. The personal data transmitted to Sofortüberweisung is generally first name, last name, address, telephone number, IP address, email address or other data that is necessary for order processing, as well as data related to the order (Art. 6(1)(1)(b) GDPR for the performance of contractual relationships). Under certain circumstances, the personal data transmitted to Sofortüberweisung is transmitted by Sofortüberweisung to credit agencies. This transfer serves the purpose of identity and credit checks with regard to the order placed by you. You can find out which data protection principles Sofortüberweisung applies when processing your data from the data protection notices that are displayed to you by Sofortüberweisung during the payment process.

Google Pay

In the course of your use of Google Pay, we process the personal data necessary for the provision of the service. (Art. 6 GDPR) This includes, among other things, the virtual credit card data (so-called token), authentication data as well as the respective device data and the transaction data associated with the use of the respective services.
For further information regarding the processing and any necessary transfer of your personal data to Google Ireland Limited, Gordon House, Barrow Street, Dublin, Ireland (hereinafter „Google“), please refer to the terms of use for Google Pay - https://policies.google.com/terms - here in particular section 5 (data protection), https://payments.google.com
The data processing within Google Pay generally takes place on the basis of the terms of use and data protection provisions of the party responsible within the meaning of data protection law (thus Google).

Apple Pay

We have integrated the payment service Apple Pay on our website. The provider is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland (hereinafter „Apple“). Nature and purpose of the processing If you decide on the payment method „Apple Pay“, the payment data entered by you is transmitted to Apple via an encrypted interface. Apple processes this information in order to validate the payment, for fraud prevention and in order to process the transaction with your credit institution. Legal responsibility When carrying out the payment, Apple acts as an independent controller within the meaning of the GDPR. Apple decides itself on the means and purposes of the data processing (for example security checks). Our responsibility is limited to the integration of the interface and the associated transfer of the data necessary for initiating the payment process. Legal basis Your data is disclosed to Apple on the basis of Art. 6(1)(1)(b) GDPR (performance of a contract), since the processing is necessary in order to carry out the payment method selected by you and thus in order to perform the purchase contract. Data transfer to third countries As a globally operating company, Apple may transfer data to its parent company Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA. Since Apple is a company of a third country, the transfer takes place on the basis of standard contractual clauses pursuant to Art. 46(2) GDPR in order to ensure compliance with European data protection standards. You will find further information on this in the EU-Lex register on Decision (EU) 2021/914. Further information For further details on the handling of your data as well as on your rights vis-à-vis Apple, please refer to Apple's official data protection notices at: Overview of security and data protection in Apple Pay – Apple Support (DE)

Shopify

For the provision of our online shop and the processing of your payments, we work together with the service provider Shopify International Limited, Victoria Buildings 1-2, Haddington Road, Dublin 4, D04 XN32, Ireland („Shopify“). Shopify enables us to operate our online shop via Shopify's cloud computing infrastructure and, in addition, processes payments for us. The relevant data concerning you is transmitted to Shopify in Ireland. From there, it may be forwarded to the parent company Shopify Inc. in Canada. For Canada there is an adequacy decision of the European Commission certifying an adequate level of data protection pursuant to Art. 45 GDPR. Where data is transferred beyond this to the USA and stored there, the company relies, according to Shopify's guidelines for international data transfers, on strict contractual safeguards. These include the standard contractual clauses (SCCs) approved by the EU Commission, which oblige US service providers to comply with European data protection standards. In addition, many of the US infrastructure providers used by Shopify are certified under the current EU-US Data Privacy Framework pursuant to Art. 45 GDPR. Shopify is used for the provision of our online shop and for the processing of your payments. The legal basis for this is the performance of a contract or the carrying out of pre-contractual measures pursuant to Art. 6(1)(b) GDPR as well as our legitimate interest in a secure and efficient provision of our online offering pursuant to Art. 6(1)(f) GDPR. Depending on the processing activity, Shopify acts here either as our processor or as an independent controller. You will find further information on the data processing and notices on data protection by Shopify in the Shopify Privacy Policy at https://www.shopify.com/legal/privacy.

Klarna

If you select a payment method from Klarna - such as payment immediately or within 30 days, payment in three interest-free instalments or a financing arrangement - via Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden („Klarna“), your personal data necessary for the payment processing is transmitted to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden („Klarna“). This data includes in particular your contact and identification data as well as your payment information. This data is transmitted to Klarna on the basis of Art. 6(1)(b) GDPR, since it is necessary in order to carry out the payment method selected by you and thus in order to perform the contract. Following the transfer, Klarna processes your data as an independent controller under data protection law. For the purpose of its own fraud and risk assessment, Klarna may carry out a credit assessment. For this purpose, Klarna may transmit your data to credit agencies (such as, among others, SCHUFA, Boniversum or Arvato Infoscore). The legal basis for this assessment is the legitimate interest of Klarna as well as of our online shop in avoiding payment defaults pursuant to Art. 6(1)(f) GDPR. You will find further details and notices on data protection at Klarna in Klarna's data protection provisions at https://www.klarna.com/de/datenschutz/.

Mollie

If, in the course of the ordering process, you select a payment method offered by Mollie (for example credit card), your personal data collected in the course of the ordering process (in particular identification, contact and transaction data) is transmitted to the payment service provider. This data is transmitted exclusively for the purpose of payment processing and on the basis of Art. 6(1)(1)(b) GDPR (performance of a contract and pre-contractual measures). A disclosure only takes place to the extent that this is strictly necessary in order to carry out the payment. Following the transfer, Mollie B.V. processes your data as an independent controller within the meaning of Art. 4(7) GDPR. The provider of the payment service is Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands. You can object to the processing of your data at any time by means of an informal notification to us or directly to Mollie. The lawfulness of the processing for the purpose of the contractual payment processing as well as statutory retention obligations of Mollie remain unaffected by an objection.

You can access the supplementary data protection notices as well as detailed information about the data processing by the payment service provider in Mollie's privacy policy at https://www.mollie.com/at/privacy.

Information on cookies and third-party tools

The technologies described below are used, insofar as they are technically necessary, on the basis of Art. 6(1)(1)(f) GDPR. Where cookies or similar technologies are used for marketing or analysis purposes, processing takes place exclusively on the basis of your consent pursuant to Art. 6(1)(1)(a) GDPR in conjunction with Section 25 TDDDG.

Cookies

Connox uses so-called cookies on some web pages to enable web-based applications to manage the status of an online visit, to permit smooth navigation between the individual services and content on the website, and to provide internet users with recurring settings on Connox’s website on a permanent basis. A cookie is a small data file transferred by Connox to the user’s computer when the user browses Connox’s website. A cookie contains only information that Connox itself sends to the website visitor’s computer; private data cannot be read with a cookie. If users accept cookies, Connox has no access to their personal information. Connox can, however, identify the user’s computer with the help of cookies.

Necessary cookies

Necessary cookies are cookies that ensure the functionality of our website. Without strictly necessary cookies, the website cannot be used as intended. They are required, for example, to provide you with the shopping cart function across several pages or to ensure that registered users remain logged in when accessing different subpages of a website and do not have to re-enter their login details every time they open a new page. Necessary cookies are only Connox cookies; all information stored in the cookies is sent only to Connox and is not passed on to third parties. The legal basis for the use of necessary cookies on our website is Art. 6(1)(f) GDPR (legitimate interest, here in the technically flawless provision of our website and the services offered through it). Access to your terminal equipment for the storage and retrieval of necessary cookies is permitted without prior consent insofar as this is strictly necessary to provide a service expressly requested by you. Depending on the purpose, we base the processing of the personal data arising in this context in particular on Art. 6(1)(b) or (f) GDPR. You can deactivate necessary cookies altogether via your browser settings (see the information on managing your consents in this section); however, this may result in functional restrictions in connection with the use of our website. The provisions of Section 25 TDDDG also apply.

Marketing cookies

Marketing cookies collect information about how our website is used in order to improve its attractiveness, content and functionality. These cookies help us determine whether, which, how often and for how long subpages of our website are visited and which content users are particularly interested in. We also record movements, “clicks” and scrolling with the computer mouse in order to understand which areas of our website are of particular interest to users. The information collected is aggregated and does not enable us to draw any direct conclusions about you. It is used solely to compile statistics in order to tailor the content of our website more specifically to the needs of our users, improve the user experience and optimise our offering. Marketing cookies are also used to collect information about the websites visited by users, to create targeted advertising for users and to display advertisements tailored to their interests. They are also used to limit the frequency with which an advertisement is displayed and to measure the effectiveness of advertising campaigns. These cookies may send information to Connox or to another website to which the cookie belongs (third-party cookie). The legal basis for the use of marketing cookies is Art. 6(1)(a) GDPR in conjunction with your consent. Connox uses “session-based” cookies that are not stored permanently on the website visitor’s computer. These temporary cookies are discarded after the page is left. With the help of the information collected, Connox can analyse website usage patterns and structures. In this way, the website is continuously optimised by improving its content and simplifying its use. Connox uses “persistent” cookies. These cookies remain on customers’ computers in order to simplify shopping and registration services on their next visit. For example, the cookies may record which items customers have selected for purchase while continuing to shop. In addition, customers only have to enter passwords once on websites that require registration. Persistent cookies can be removed manually by users. The persistent cookies used by Connox are stored on your terminal equipment for up to 1000 days. They are then automatically deleted. Most browsers accept cookies by default. In the security settings, temporary and stored cookies can be permitted or prohibited independently of one another. If cookies are prohibited, certain features on Connox’s pages may not be available and some websites may not be displayed correctly. Session-based cookies must be permitted in order to use Connox’s shopping cart and checkout. If a customer generally does not want to or cannot accept cookies, they can also place orders with Connox by email, telephone or fax. Connox uses certain partner companies to make its online offering and websites more interesting for users. Accordingly, cookies from partner companies are also stored on your terminal equipment when you visit the websites. These cookies are “persistent” cookies. They remain on users’ computers and are automatically deleted after the specified lifespan. The lifespan is up to 1000 days.

Our partner companies also process the data collected exclusively in pseudonymised form. As a rule, they cannot directly draw conclusions about you. Nor are these pseudonymous data combined with your personal data. The pseudonymous data include, for example, data about which products were searched for or which products users viewed or purchased. The sole purpose of these data is to enable our partner companies, for example, to display advertising that may actually be of interest to users or to prevent users from seeing the same advertising repeatedly. The data processed through cookies are necessary for the stated purposes to safeguard our legitimate interests and the interests of third parties under Art. 6(1)(1)(f) GDPR or pursuant to Art. 6(1)(1)(b) GDPR for the performance of the contract. Most browsers accept cookies automatically. You can configure your browser so that no cookies are stored on your computer or so that a notice always appears before a new cookie is created. However, completely disabling cookies may mean that you cannot use all the functions of our website. The cookie consent management tool is used on the website. Further information about the tool and the use of cookies is available through our cookie settings. The specific CMP configuration, including the provider, Consent ID and storage period, must be confirmed before publication.

Use of social media, online marketing, web analytics and tracking services, and tools provided by other service providers

Insofar as cookies or similar technologies are used for marketing or analysis purposes, processing takes place exclusively on the basis of your consent pursuant to Art. 6(1)(1)(a) GDPR in conjunction with German data protection law, in particular Section 25 TDDDG. Through these measures and the associated statistical recording and evaluation of the use of our website, we seek to ensure and achieve a needs-based design and continuous optimisation of our website as well as optimal marketing of our website. The described data processing operations may also be based, pursuant to Art. 6(1)(1)(f) GDPR, on the legitimate interests of the individual providers, for example when displaying personalised advertising or informing other users of social networks about your activities on our website.

Data protection information for Friendly Captcha

This data protection information is provided by us as the website operator and relates to the “Friendly Captcha” service used by us. Our website uses the “Friendly Captcha” service provided by Friendly Captcha GmbH, Am Anger 3-5, 82237 Wörthsee, Germany (www.friendlycaptcha.com). Friendly Captcha GmbH acts as our processor. Friendly Captcha is a novel, privacy-friendly protection solution designed to make it more difficult for automated programmes and scripts (so-called “bots”) to use our website. Friendly Captcha thereby protects our website against misuse.

How it works
In certain areas of our website (for example, a contact form), we have integrated programme code from Friendly Captcha (“protective software”). This causes the visiting person’s terminal equipment, in connection with the protected area (for example, when submitting a contact form), to establish a connection to Friendly Captcha’s servers. The visiting person’s browser receives a computational challenge from Friendly Captcha. The complexity of the computational challenge depends on various risk factors. Depending on this, we can treat access to our website or individual functions as human or potentially automated.

Purpose of use
All the data mentioned is used exclusively to detect and handle potential bots and risks as described above. The purpose of processing is therefore to ensure the security and functionality of our website. We do not use the data to identify a natural person or for marketing purposes.

Storage period
If personal data is stored, it is deleted within 30 days.

Processed data
The following data is processed exclusively for the security purposes stated above:

Connection data:

HTTP request data, i.e. data arising each time the website is accessed (for example, user agent, browser type and operating system), as well as the referring website, logs and ports used.
IP address: Friendly Captcha stores IP addresses only in hashed (one-way encrypted) form, and neither we nor Friendly Captcha can draw conclusions about an individual person from them.
Connection exchange data: technical information about how a connection was established between the browser and the Friendly Captcha server.
Network statistics, for example bandwidth

Environmental data:

Browser properties and settings (for example, preferred language, installed fonts and local time)
Device data (for example, available storage, screen resolution and operating system)
Technical data concerning the execution of programme code (for example, error codes and browser events)

Interaction data

Times, frequencies and statistics of keystrokes, without enabling conclusions to be drawn about specific text entries, for example by taking into account only functional keys such as Enter or Delete.
Scrolling and mouse movements
Window adjustments, for example changes in size

Functional data, for example:

Version, status and configuration data of the protective software
Software components used
Random figures (for example, session ID)
Technical counters (for example, number of repeated connection attempts)
Data for executing programme code
Solutions to the computational challenges

The following data is stored only for the duration of the browser session in the browser’s SessionStorage and is strictly necessary to ensure the security of the website: a random Session ID (frc_sid), the number of times the protective software modules are loaded (frc_sc), the number of requests and repeated connection attempts (frc_rc), and the solutions to the computational challenges and their solution context (frc_sol). We do not set HTTP cookies and do not use tracking technologies.

Legal basis under the GDPR
Insofar as the data can be related to an individual, the legal basis for processing is our legitimate interest in protecting our website against misuse through bots, namely protection against spam and attacks (for example, mass requests), pursuant to Art. 6(1)(1)(f) GDPR.

Data recipients
Friendly Captcha acts as our processor on an instruction- and purpose-bound basis. For the hosting and delivery of content, Friendly Captcha uses hosting services provided by Hetzner Online GmbH, based in Germany, and SCALEWAY S.A.S, based in France.

Further information
Further information, in particular about our contact details as the controller under data protection law and the contact details of our data protection officer, as well as your rights under the GDPR, can be found in the data protection notices on our website on which we have integrated Friendly Captcha.

Criteo Retargeting

We use the “Criteo” web analytics tool, operated by Criteo SA, 32 rue blanche, 75009 Paris, France. Through Criteo, information about the surfing behaviour of website visitors is collected and stored in anonymised form for marketing purposes. With the help of Criteo, the surfing behaviour is analysed on the basis of an algorithm, so that targeted product recommendations can subsequently be displayed as personalised advertising banners on other websites (so-called publishers). Criteo uses cookies to create pseudonymous usage profiles and display personalised advertising. Processing takes place exclusively on the basis of your consent pursuant to Art. 6(1)(1)(a) GDPR in conjunction with German data protection law, in particular Section 25 TDDDG. You can object to the completely anonymous analysis of your surfing behaviour on this page by visiting The algorithm analyses surfing behaviour so that targeted product recommendations can subsequently be displayed as personalised advertising banners on other websites (so-called publishers). Criteo uses cookies to create pseudonymous usage profiles and display personalised advertising. Processing takes place exclusively on the basis of your consent pursuant to Art. 6(1)(1)(a) GDPR in conjunction with German data protection law, in particular Section 25 TDDDG. You can object to the completely anonymous analysis of your surfing behaviour on this page by visiting https://www.criteo.com/privacy/ .

Kelkoo Sales Tracking

We use the Kelkoo Sales Tracking of our technology partner Kelkoo Group (hereinafter “Kelkoo”); data host: Kelkoo Group; country of data storage: Netherlands; contact in Germany: Kelkoo Deutschland GmbH, Mattentwiete 1, 20457 Hamburg. The Kelkoo technology used enables the respective user actions to be tracked and evaluated after a redirect from a Kelkoo domain to our website.

This tracking pixel interacts with Kelkoo and makes it possible to track user actions by establishing a connection between a user’s click on an advertisement (touchpoint) on Kelkoo and a completed order on our website. When an order is completed, the visitor’s browser sends an HTTP request to Kelkoo’s server via a JavaScript-based tracking pixel, transmitting certain information.

This information includes:

User ID
Time of interaction
URL of interaction
IP address • Location data
User-agent data
Sales transaction data
Transaction details (if provided by the merchant)

In addition, the order number and the shopping cart of your order are transmitted to and stored by Kelkoo. Processing takes place only with your consent pursuant to Art. 6(1)(1)(a) GDPR in conjunction with Section 25 TDDDG. Further information is available at:https://www.kelkoo.co.uk/company-pages/privacy-policy/. Please also note Google’s cookie policy:https://policies.google.com/privacy?hl=en-US. On this website, technologies of Interactive Performance Deutschland GmbH (www.interactiveperformance.de) and its technology partners are used to collect and store data about your usage behaviour on our website for optimisation and marketing purposes. This data is used to analyse visitor behaviour and to create pseudonymous usage profiles. For this purpose, cookies are used that enable an internet browser to be recognised on a subsequent visit. The usage profiles collected using Interactive Performance technology are not combined with personal data about the person behind the pseudonym without express consent. Visitors’ IP addresses are truncated before storage, so that no direct personal reference remains. Further information can be found in the privacy policy of Interactive Performance Deutschland GmbH. Website visitors can object to the collection and storage of data by Interactive Performance technology for this website at any time with effect for the future by opting out at Cookies are used that enable an internet browser to be recognised on a subsequent visit. The usage profiles collected using Interactive Performance technology are not combined with personal data about the person behind the pseudonym without express consent. Visitors’ IP addresses are truncated before storage, so that no direct personal reference remains. Further information can be found in the privacy policy of Interactive Performance Deutschland GmbH. Website visitors can object to the collection and storage of data by Interactive Performance technology for this website at any time with effect for the future by opting out at https://www.interactiveperformance.de/datenschutz/ .

Perplexity Enterprise Pro

We use “Perplexity Enterprise Pro”, an AI-supported analysis and reporting tool of Perplexity AI, Inc., USA, to create automated reports, analyses and alerts in the area of marketing and performance evaluation. In the course of its use, data from connected systems (for example, Google Sheets as a data interface to Google Ads, Google Analytics, Microsoft Ads, idealo, Criteo or similar) is processed. This primarily concerns aggregated performance and campaign data, in particular:

Impressions
Click counts
Costs
Conversions
Conversion values
Account, campaign, advertisement, target-group, keyword or asset names or IDs

The transfer of personal data (for example, customer IDs, IP addresses or other identifiable user data) is not intended.

Possible personal reference

However, we point out that, pursuant to Art. 4(1) GDPR, personal data means any information relating to an identified or identifiable natural person. Pseudonymised data may also constitute personal data if re-identification is possible within the organisational sphere (see CJEU, judgment of 4 September 2025, Case No. C-413/23 P). Insofar as a personal reference cannot be completely excluded in an individual case, processing takes place exclusively in compliance with the applicable data protection requirements.

Technical and organisational measures (Art. 5(1)(f) GDPR)

Processing takes place in compliance with the principles of integrity and confidentiality pursuant to Art. 5(1)(f) GDPR.
This means in particular:

Access restricted to authorised persons
Role-based authorisation concepts
Encrypted data transmission (TLS)
Contractually agreed technical and organisational measures pursuant to Art. 28 GDPR
Assurance by the provider that data is not used to train AI models

As part of the Enterprise model, Perplexity states that neither Perplexity nor any third-party LLM partners use the transmitted data to train their own models.

Legal basis
Processing takes place on the basis of Art. 6(1)(1)(f) GDPR (legitimate interest). Our legitimate interest lies in the efficient analysis, evaluation and optimisation of our marketing and business processes as well as the group-wide management of economic indicators. Insofar as personal data is processed in an individual case, this takes place exclusively to the extent necessary.

Processing by a processor
Insofar as personal data is processed, this takes place on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Transfer to a third country (USA)
Perplexity AI, Inc. is certified under the EU-U.S. Data Privacy Framework (DPF). On 10 July 2023, the European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework. Insofar as personal data is transferred to the USA, the transfer is primarily based on the adequacy decision pursuant to Art. 45 GDPR in conjunction with the company’s active certification under the EU-U.S. DPF. Further information is available from the US Department of Commerce or online at https://www.dataprivacyframework.gov.

Google Ads Remarketing

On our website, we use the remarketing function of Google Ads, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). This function enables us to address users of our website with interest-based advertising on other websites within the Google advertising network.

Nature and scope of processing
Google Ads Remarketing uses cookies and similar technologies to recognise which content you have accessed on our website. This enables personalised advertising to be displayed to you when you visit other websites. For this purpose, Google processes in particular:

Pseudonymous cookie IDs
Pages visited
Interactions on our website
Technical device information
Approximate location data

You are not identified. The data is processed exclusively in pseudonymised form.

Legal basis
The use of Google Ads Remarketing takes place exclusively on the basis of your consent pursuant to Art. 6(1)(1)(a) GDPR. You can withdraw your consent at any time via our cookie consent tool.

Transfer of data to the USA
Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) is certified under the EU-U.S. Data Privacy Framework (DPF). Accordingly, an adequate level of data protection exists for transfers of data to the USA pursuant to Art. 45 GDPR. In addition, Google bases data transfers on EU standard contractual clauses.

Processing by a processor
We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR.

Withdrawal and opt-out options
You can withdraw your consent at any time via our cookie consent tool. Google also offers the following opt-out options:

Google advertising settings: https://www.google.com/settings/ads
Network Advertising Initiative (NAI) opt-out: https://www.networkadvertising.org/managing/opt_out.asp

Further information on data processing by Google is available at: https://policies.google.com/privacy

Google Ads Conversion Tracking

On our website, we use Google Ads conversion tracking, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Conversion tracking enables us to determine whether users perform certain actions on our website after clicking on a Google advertisement.

Nature and scope of processing
If you reach our website via a Google advertisement and have consented in the cookie banner, Google sets a cookie or uses similar technology (for example, Local Storage). In particular, the following data is processed:

Pseudonymous cookie or device IDs
Click behaviour on advertisements
Pages visited
Technical device information
Time of conversion

This information enables us to measure the effectiveness of our advertising campaigns. Google provides us exclusively with anonymised statistics; we do not receive data that would enable us to identify individual users.

Legal basis
The use of Google Ads Conversion Tracking takes place exclusively on the basis of your consent pursuant to Art. 6(1)(1)(a) GDPR. You can withdraw your consent at any time via our cookie consent tool.

Processing by a processor
We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR.

Withdrawal and opt-out options
You can withdraw your consent at any time via our cookie consent tool. Google also offers the following opt-out options:

Google advertising settings: https://www.google.com/settings/ads
Network Advertising Initiative (NAI) opt-out: https://www.networkadvertising.org/managing/opt\_out.asp (networkadvertising.org in Bing)

Further information on data processing by Google is available at: https://policies.google.com/privacy

Google Analytics 4

On our website, we use “Google Analytics 4” (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics 4 enables us, provided that you have given your consent, to analyse the use of our website in order to improve our offering and make it more user-friendly.

Nature and scope of processing
Google Analytics 4 uses cookies and similar technologies that enable an analysis of your user behaviour. In particular, the following data is processed:

Page views and interactions
Time spent and click paths
Device and browser information
Referrer URL
Location data (based on anonymised IP information)
Technical event data (for example, loading times)

Google Analytics 4 does not store complete IP addresses. Google uses the IP address exclusively to derive an approximate location and then immediately deletes it. The IP address is not stored.

User ID (cross-device analysis)
If you have a customer account and are logged in, we may, provided that you have consented, use a pseudonymous User ID assigned by us. This enables several sessions and interactions to be assigned to a user profile in order to evaluate cross-device use (for example, smartphone, tablet, desktop). Google cannot assign this User ID to a specific person.

Legal basis
The use of Google Analytics 4 takes place exclusively on the basis of your consent pursuant to Art. 6(1)(1)(a) GDPR. You can withdraw your consent at any time via our cookie consent tool.

Storage period
The storage period for usage data specified by us is 14 months. Event data may be stored for a shorter period, depending on our settings.

Processing by a processor
We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR, which ensures that Google processes personal data only in accordance with our instructions.

Transfer of data to the USA
Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) is certified under the EU-U.S. Data Privacy Framework (DPF). Accordingly, an adequate level of data protection exists for transfers of data to the USA pursuant to Art. 45 GDPR. If further transfers take place in an individual case, Google additionally bases them on EU standard contractual clauses.

Withdrawal of consent
You can withdraw the processing of your data by Google Analytics 4 at any time by changing your settings in the cookie consent tool. In addition, you can prevent your data from being collected by installing the browser add-on for deactivating Google Analytics: https://tools.google.com/dlpage/gaoptout/ Further information on data processing by Google is available at: Further information on data processing by Google is available at: https://policies.google.com/privacy When using this service, personal data may be transferred to providers in the USA. The transfer takes place on the basis of standard contractual clauses (SCCs) adopted by the European Commission pursuant to Art. 46 GDPR, which are intended to contractually ensure an adequate level of protection. Alternatively, you can prevent Google from processing the data by clicking on the following link: Click here, to opt out of Google Analytics measurement. Please note that this website uses Google Analytics, including Universal Analytics, with the data protection-compliant extension “_anonymizeIp()” and therefore processes IP addresses only in truncated form in order to exclude direct identification of a person.

Google Customer Match

We use the Google Customer Match function on our website, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Customer Match enables us to display personalised advertising to existing customers within Google services, for example in Google Search, on YouTube, in Gmail or in the Google Display Network.

Nature and scope of processing
For Customer Match, provided that you have given your consent, we transmit certain customer data to Google, for example:

Email address
Telephone number
Name or address (optional)

Google hashes this data, compares it with existing Google accounts and then uses it to create target groups. Google provides us exclusively with aggregated and anonymised analyses. We cannot identify individual persons. Google may additionally use cookies or advertising IDs to optimise the delivery of advertisements.

Legal basis
The use of Google Customer Match takes place exclusively on the basis of your consent pursuant to:

Art. 6(1)(1)(a) GDPR (processing of personal data)
Section 25 TDDDG

You can withdraw your consent at any time via our cookie consent tool. Transfer of data to the USA Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) is certified under the EU-U.S. Data Privacy Framework (DPF). Accordingly, an adequate level of data protection exists for transfers of data to the USA pursuant to Art. 45 GDPR. In addition, Google bases data transfers on EU standard contractual clauses. Processing by a processor We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR.

Withdrawal

You can withdraw your consent at any time via our cookie consent tool. The lawfulness of processing carried out up to the withdrawal remains unaffected. Further information on data processing by Google is available at: https://support.google.com/google-ads/answer/6334160 and https://policies.google.com/privacy

Mouseflow

We use Mouseflow, a web analytics service provided by Mouseflow ApS, Flaesketorvet 68, 1711 Copenhagen, Denmark. Mouseflow enables us to analyse visitors' behaviour on our website in order to improve user-friendliness.

Nature and scope of processing

Mouseflow records randomly selected visits if you have given your consent to this. In particular, the following data may be processed:

truncated IP address
mouse movements, scrolling behaviour, clicks
technical information (browser, device, screen resolution)
pages visited and interactions
duration of the visit
form interactions (excluding entered data)

Mouseflow creates the following from this data:

heat maps
session replays
technical error analyses
interaction statistics

The data is processed in pseudonymised form. It is not possible to identify individual persons.

Legal basis

The processing is carried out exclusively on the basis of your consent pursuant to:

Art. 6 para. 1 sentence 1 lit. a GDPR
Section 25 TDDDG

You can withdraw your consent at any time via our cookie consent tool.

Data processing agreement

We have concluded a data processing agreement with Mouseflow pursuant to Art. 28 GDPR.

Transfers to third countries

Mouseflow may use sub-processors outside the EU. In such cases, the transfer is based on:

EU Standard Contractual Clauses pursuant to Art. 46 GDPR
and suitable technical and organisational measures

Opt-out option

In addition to withdrawing your consent via our cookie consent tool, you can globally deactivate Mouseflow at: https://mouseflow.com/opt-out/. Further information on data processing by Mouseflow can be found at: https://mouseflow.com/privacy/

OWAPro

We use the web analytics and marketing controlling system OWAPro on our website, a service provided by Hurra Communications GmbH, Wollgrasweg 27, 70599 Stuttgart, Germany. OWAPro is used to analyse user behaviour and optimise our online marketing activities.

If you have given your consent, OWAPro processes in particular online identifiers, device and browser information, referrer data, transaction and conversion data. Cookies may be used for this purpose to enable recognition of your browser. OWAPro processes exclusively pseudonymised data; the IP address is also automatically anonymised. The processing is based on your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR and Section 25 TDDDG. You can withdraw your consent at any time via our cookie consent tool. We have concluded a data processing agreement with Hurra Communications GmbH pursuant to Art. 28 GDPR. OWAPro may use sub-processors outside the EU; in such cases, the transfer is based on the EU Standard Contractual Clauses. You can also deactivate OWAPro for your browser at: http://ssl.hurra.com/opt-out?cid=985&ln=de Further information can be found at: https://www.hurra.com/privacy

ParticularAudience

We use ParticularAudience, a service provided by Anamantic Pty Ltd, Level 1, 85 William Street, Darlinghurst, NSW 2010, Sydney, Australia, to display product recommendations. Cookies may be used to process pseudonymous information about your usage behaviour in order to show you similar or suitable products. The service may only be used with your consent if access to your device or the processing is not strictly necessary. Further information can be found at https://particularaudience.com/privacy. Whether ParticularAudience is actually used on the German website must be confirmed against the current tag and CMP scan before publication.

Microsoft Advertising

We use Microsoft Advertising conversion tracking on our website, a service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Microsoft). Microsoft Ireland is the entity responsible under data protection law for users in the European Economic Area. If you reach our website via a Microsoft advertisement and have consented in the cookie banner, Microsoft places a cookie or uses a similar technology to measure the performance of our advertising campaigns. Thought. We use "Enhanced Conversions." If the user has given consent, Microsoft's Enhanced Conversions extend the existing conversion tags with first-party data (e.g., email addresses). The data is hashed and sent to Microsoft Advertising. This allows Microsoft to match the hashed customer data to the relevant Microsoft Advertising campaign and improve conversion metrics.

Nature and scope of processing

Microsoft Advertising may process the following data in particular:

pseudonymous cookie and device IDs
IP address (truncated)
browser and device information
referrer URL
pages visited and interactions
time and type of conversion

We receive only aggregated and anonymised analyses, for example how many users reached our website via a Microsoft advertisement. It is not possible for us to identify individual persons.

Legal basis

The processing is carried out exclusively on the basis of your consent pursuant to:

Art. 6 para. 1 sentence 1 lit. a GDPR
Section 25 TDDDG

You can withdraw your consent at any time via our cookie consent tool.

Transfers to the US

Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA, may gain access to data as part of the service. Microsoft is certified under the EU-US Data Privacy Framework (DPF), meaning that an adequate level of data protection exists pursuant to Art. 45 GDPR. Microsoft also uses EU Standard Contractual Clauses for further transfers.

Data processing agreement

We have concluded a data processing agreement with Microsoft pursuant to Art. 28 GDPR.

Withdrawal and opt-out

You can withdraw your consent at any time via our cookie consent tool. Microsoft also offers the following opt-out option: https://account.microsoft.com/privacy/ad-settings. Further information on data processing by Microsoft can be found at: https://privacy.microsoft.com/de-de/privacystatement

Microsoft Clarity

We use the Microsoft Clarity web analytics service on our website, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA, may also be involved in certain processing activities. Clarity enables us to analyse usage behaviour on our website, including through heat maps, session recordings and other interaction metrics. This serves to optimise our website, improve our offering and evaluate marketing activities. Clarity uses first-party and third-party cookies and comparable technologies for analysis. In particular, the following data may be processed:

usage behaviour (e.g. pages visited, clicks, scrolling behaviour, time spent)
technical information (e.g. browser, device type, operating system, screen resolution)
pseudonymised or truncated IP address
referrer URL and timestamp
The processing is carried out exclusively on the basis of your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR; Section 25 TDDDG (for cookies and similar technologies)

You can withdraw your consent at any time with effect for the future via our cookie consent tool.

Microsoft processes the data in part as a processor pursuant to Art. 28 GDPR. In addition, Microsoft may process the data for its own purposes (e.g. to improve its own products and services) and is therefore an independent controller within the meaning of Art. 4 no. 7 GDPR.

Transfers to the US

For the transfer of personal data to the USA, Microsoft relies on certification under the EU-US Data Privacy Framework (DPF) pursuant to Art. 45 GDPR. Microsoft Corporation is certified under the DPF and is therefore a recipient of an adequacy decision by the EU Commission. Certification is available at: https://www.dataprivacyframework.gov/s/participant-search If, in an individual case, transfers take place that are not covered by the DPF, Microsoft additionally uses the EU Standard Contractual Clauses pursuant to Art. 46 GDPR. Further information on data processing by Microsoft can be found in Microsoft's privacy statement at: https://privacy.microsoft.com/de-de/privacystatement

Moebel.de

We use conversion tracking from moebel.de on our website, a service provided by moebel.de Einrichten & Wohnen AG, Gertrudenstrasse 3, 20095 Hamburg. Conversion tracking is used to measure, attribute and bill advertising services. It tracks whether users reached our website via an advertising medium from moebel.de (e.g. a banner or text link) and carried out a particular action there (e.g. placing an order).

Processed data

The following information in particular is processed as part of conversion tracking:

a pseudonymous ID of the partner websites involved in the advertising services,
information on the scope of any order placed,
the order number of the advertising medium clicked (e.g. banner or text link).

This data does not enable your identity to be directly identified, but it constitutes pseudonymous personal data within the meaning of the GDPR.

Legal basis

The use of conversion tracking is carried out exclusively on the basis of your prior, expressly given consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR in conjunction with Section 25 TDDDG. Without your consent, no conversion tracking cookies or comparable technologies are set or read.

Withdrawal of consent

You can withdraw or change your consent at any time with effect for the future. This is possible via the cookie settings on our website. General deactivation of cookies via your browser settings does not constitute a legal basis for the use of tracking technologies, but it can additionally be used to further restrict processing. Further information on data processing by moebel.de can be found at: https://www.moebel.de/datenschutz

Shopping24 conversion tracking

We use conversion tracking from Shopping24 on our website, a service provided by shopping24 Gesellschaft für multimediale Anwendungen mbH, An der Alster 45, 20099 Hamburg. Conversion tracking is used to measure, attribute and bill advertising services. It tracks whether users reached our website via an advertising medium from Shopping24 (e.g. a banner or text link) and carried out a particular action there (e.g. placing an order).

Processed data

The following information in particular is processed as part of conversion tracking:

a pseudonymous ID of the partner websites involved in the advertising services,
information on the scope of any order placed,
the order number of the advertising medium clicked (e.g. banner or text link) and of the advertised product.
This data does not enable your identity to be directly identified, but it constitutes pseudonymous personal data within the meaning of the GDPR.

Legal basis

The use of Shopping24 conversion tracking is carried out exclusively on the basis of your prior, expressly given consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR in conjunction with Section 25 TDDDG. Without your consent, no conversion tracking cookies or comparable technologies are set or read.

Withdrawal of consent

You can withdraw or change your consent at any time with effect for the future. This is possible via the cookie settings on our website. General deactivation of cookies via your browser settings does not constitute a legal basis for the use of tracking technologies, but it can additionally be used to further restrict processing. Further information on data processing by Shopping24 can be found at: https://www.shopping24.de/datenschutz

Conversion tracking by Solute GmbH

We use conversion tracking by Solute GmbH on our website, Zeppelinstraße 15, 76185 Karlsruhe, Germany. Conversion tracking is used to attribute, measure and bill referred transactions and to statistically evaluate the success of advertising measures carried out via billiger.de or other partner websites of Solute GmbH.

Processed data

For this purpose, a tracking pixel is used to process and transmit the following information to Solute GmbH:

a pseudonymous identifier of the referring partner website,
the value of the shopping basket of any order placed,
an assigned order number.

No directly identifying personal data (e.g. name or contact details) is processed in this context. However, the processed information constitutes pseudonymous personal data within the meaning of the GDPR.

Legal basis

The use of conversion tracking by Solute GmbH is carried out exclusively on the basis of your prior, expressly given consent pursuant to. Art. 6 para. 1 sentence 1 lit. a GDPR in conjunction with Section 25 TDDDG. Without your consent, no tracking pixels or comparable technologies are used or read.

Withdrawal of consent

You can withdraw or change your consent at any time with effect for the future. This is possible via the cookie settings on our website. General deactivation of cookies via your browser settings does not constitute a legal basis for the use of tracking technologies, but it can additionally be used to further restrict processing. Further information on data processing by Solute GmbH can be found in its privacy statement at: https://www.solute.de/ger/datenschutz/

Pinterest Tag

We use the so-called Pinterest Tag on our website, a service provided by Pinterest Europe Ltd., 2nd Floor, Palmerston House, Fenian Street, Dublin 2, Ireland (Pinterest). The Pinterest Tag enables us to measure the success of our Pinterest advertising campaigns, optimise them and show users interest-based advertising on Pinterest. It tracks whether users reached our website via a Pinterest advertisement and carried out certain actions there (e.g. page views or orders).

Processed data

The following information in particular is processed as part of using the Pinterest Tag:

a truncated IP address,
device information (e.g. device type, operating system),
information on the browser used,
the time of the website visit,
information on interaction with our Pinterest campaigns (e.g. clicks or conversions).

This data does not enable your identity to be directly identified, but it constitutes pseudonymous personal data within the meaning of the GDPR.

Legal basis

The use of the Pinterest Tag is carried out exclusively on the basis of your prior, expressly given consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR in conjunction with Section 25 TDDDG. Without your consent, the Pinterest Tag is not loaded and no corresponding data processing takes place.

Withdrawal of consent

You can withdraw or change your consent at any time with effect for the future by adjusting the cookie settings on our website. General deactivation of cookies via your browser settings does not constitute a legal basis for the use of tracking technologies, but it can additionally be used to further restrict processing.

Disclosure of data and transfer to third countries

The data processed when using the Pinterest Tag is transferred to Pinterest Europe Ltd. and may also be forwarded to Pinterest, Inc., USA, a company affiliated with Pinterest, for further processing. This may involve the transfer of personal data to the USA, a third country outside the European Union or the European Economic Area. Pinterest, Inc. is listed in the US Department of Commerce's EU-US Data Privacy Framework (DPF). The transfer of data is based on the European Commission's adequacy decision pursuant to Art. 45 GDPR. Pinterest also uses suitable contractual and technical safeguards to ensure an adequate level of data protection. Pinterest may also use the processed data for its own advertising and analytics purposes and disclose it to third parties insofar as this is permitted under its own privacy policy. Further information on data processing and your setting and objection options can be found in Pinterest's privacy statement at: https://www.pinterest.com/about/privacy/

Facebook Pixel(Meta Pixel)

We use the so-called Facebook Pixel (also known as Meta Pixel) on our website, a service provided by Meta Platforms Ireland Limited, Merrion Road Dublin 4, D04 X2K5 Ireland (Meta). The Facebook Pixel enables us to measure the success of our Facebook and Instagram advertisements, optimise them and show users interest-based advertising. It tracks whether users were redirected to our website after clicking an advertisement and carried out certain actions there (e.g. page views or orders).

Processed data

The following information in particular is processed when using the Facebook Pixel:

a truncated IP address,
device and browser information (e.g. device type, operating system, browser),
the time of the website visit,
information on interactions with our advertisements (e.g. clicks, conversions),
Meta-specific identifiers, where applicable, that enable recognition and attribution.

This data does not enable us to directly identify you, but it constitutes pseudonymous personal data within the meaning of the GDPR. Meta may link this data to an existing Facebook or Instagram user account and use it for its own advertising and analytics purposes.

Legal basis

The use of the Facebook Pixel is carried out exclusively on the basis of your prior, expressly given consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR in conjunction with Section 25 TDDDG. Without your consent, the Facebook Pixel is not loaded and no corresponding data processing takes place.

Withdrawal of consent

Transfers to third countries

The data collected by the Facebook Pixel is transferred to Meta Platforms Ireland Limited and may also be passed on from there to the parent company Meta Platforms, Inc., USA. This may involve the transfer of personal data to a third country (USA). Meta Platforms, Inc. is listed in the US Department of Commerce's EU-US Data Privacy Framework (DPF). The transfer of data is based on this framework pursuant to Art. 45 GDPR (adequacy decision by the European Commission). Further information on data processing by Meta can be found in Meta's privacy statement: :https://www.facebook.com/privacy/policy/

Squarelovin

We use Squarelovin to display product-related Instagram posts as shoppable content on our website. When you view these posts, Squarelovin processes the content we have selected (such as images, captions, and linked products) and technical usage data (such as IP address, device and browser information, and interaction data). Squarelovin processes this data on our behalf under Article 28 GDPR, and a data processing agreement is in place. The processing is based on our legitimate interest in presenting attractive, product-related content (Art. 6(1)(f) GDPR). Where cookies or similar technologies that require consent are used, processing takes place only with your consent (Art. 6(1)(a) GDPR and § 25 TDDDG). Where data is transferred to countries outside the EU/EEA, appropriate safeguards are applied in accordance with Art. 44 et seq. GDPR. You have the right to access, rectification, erasure, restriction of processing, data portability, and objection (Art. 15 to 21 GDPR), as well as the right to lodge a complaint with a supervisory authority. For questions, please contact us using the details in this privacy policy.

Facebook plugins

Plugins of the social network Facebook are integrated into our website, a service provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (Meta). Our website is configured so that no automatic connection is established between your browser and Meta's servers when you access our website. Data is only transferred to Meta when you actively click on a Facebook plugin and thereby consciously activate it. Only when the plugin is activated does Meta receive information that the visitor's browser has accessed the relevant subpage of our website. If you are logged into your Facebook user account at that time, Meta can assign the visit to your user account. If you do not want this, you must log out of your Facebook user account before activating the relevant plugin. Please note that this measure does not replace consent to tracking or analytics procedures; it only affects the direct attribution of your visit to your Facebook profile. We have no influence on the scope of the data collected by Meta or its further processing. Further information on the purpose and scope of data collection and on the further processing and use of data by Meta can be found in Meta's privacy statement at: https://www.facebook.com/privacy/policy/

Facebook and Instagram fan pages (joint controllership)

We operate Facebook and/or Instagram fan pages in order to communicate with users, interested parties and customers and to provide information about our offers. When visiting our fan pages, Meta processes users' personal data (e.g. IP address, device information, interactions). Meta provides us, as the operator of the fan pages, with anonymised statistical analyses (Page Insights) of the use of our fan pages, which we use to optimise our information and communication offering.

Joint controllership (Art. 26 GDPR)

For data processing in connection with Page Insights, we and Meta are joint controllers within the meaning of Art. 26 GDPR. Meta assumes primary responsibility for processing the Insights data and for exercising data subject rights. Meta provides the agreement on joint controllership (Page Insights Joint Controller Addendum) at the following link: https://www.facebook.com/legal/terms/page\_controller\_addendum

Legal basis

The processing of personal data in connection with visits to our fan pages is based on Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interest in up-to-date information and communication). If Meta uses tracking or analytics procedures beyond this, it does so under its own responsibility and, where required, on the basis of consent obtained by Meta.

Transfers to third countries

Data processing by Meta may involve the transfer of personal data to the parent company Meta Platforms, Inc., USA. Meta Platforms, Inc. is listed in the EU-US Data Privacy Framework (DPF). The transfer of data is based on the European Commission's adequacy decision pursuant to Art. 45 GDPR.

Rights of data subjects

If you wish to exercise your data subject rights (e.g. access, erasure, objection) in connection with the use of Facebook or Instagram fan pages, we recommend contacting Meta directly, as Meta has access to the processed data and can implement the relevant measures. We will be happy to support you where possible.

Pinterest plugins

Plugins of the social network Pinterest (e.g. the Pin it button) are integrated into our website, a service provided by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland (Pinterest). Our website is configured so that no automatic connection is established between your browser and Pinterest's servers when you access our website. Data is only transferred to Pinterest when you actively click on a Pinterest plugin and thereby consciously activate it. Only when the plugin is activated does Pinterest receive information that the visitor's browser has accessed the relevant subpage of our website. If you are logged into your Pinterest user account at that time, Pinterest can assign the visit to your user account. If you do not want this, you must log out of your Pinterest user account before activating the relevant plugin. Please note that this measure does not replace consent to tracking or analytics procedures; it only affects the direct attribution of your visit to your Pinterest profile. We have no influence on the scope of the data collected by Pinterest or its further processing. Further information on the purpose and scope of data collection and on the further processing and use of data by Pinterest can be found in Pinterest's privacy statement at: https://www.pinterest.com/about/privacy/

Transfers to third countries

Pinterest may also transfer personal data to its parent company Pinterest, Inc., USA. Pinterest, Inc. is listed in the US Department of Commerce's EU-US Data Privacy Framework (DPF). The transfer of data is based on the European Commission's adequacy decision pursuant to Art. 45 GDPR.

XING Share Button

The XING Share Button of the social network XING is integrated into our website, a service provided by New Work SE, Baumwall 7, 20459 Hamburg, Germany. Our website is configured so that no automatic connection is established between your browser and XING's servers when you access our website. Data is only transferred to XING when you actively click on the XING Share Button and thereby consciously activate it. Only when the button is activated does XING receive information that the visitor's browser has accessed the relevant page of our website. We have no influence on the scope of the data collected by XING or its further processing. According to XING, use of the Share Button does not create user profiles, store cookies or allow us as the website operator to analyse user behaviour. Direct attribution to your XING user account only takes place as part of using the XING platform itself. Further information on data protection for the XING Share Button and additional information can be found in XING's privacy information at: https://dev.xing.com/plugins/share_button/privacy_policy

Tracdelight

Affiliate and content marketing via tracdelight. We work with tracdelight GmbH to evaluate and bill content, influencer and affiliate marketing campaigns. The provider is tracdelight GmbH, Arabellastrasse 23, 81925 Munich, Germany (tracdelight). tracdelight acts as a marketing and agency platform and integrates selected publishers, creators and content partners. Tracking technologies may be used for this purpose to determine whether users reached our website via a tracdelight partner and carried out a particular action there.

Processed data

The following information in particular is processed as part of our cooperation with tracdelight:

a pseudonymous identifier of the referring content or publisher partner,
information on the time of the click on an advertising or content link,
information on any transaction triggered (e.g. order value or transaction-related reference number).

Your identity is not directly identified. However, the processed information constitutes pseudonymous personal data within the meaning of the GDPR. We do not receive personal data of individual users from tracdelight, but only aggregated analysis and billing information.

Legal basis

The use of tracking technologies as part of our cooperation with tracdelight is carried out exclusively on the basis of your prior, expressly given consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR in conjunction with Section 25 TDDDG. Further information on data processing by tracdelight can be found at: https://www.tracdelight.com/privacy-policy

Voucher offers from Sovendus GmbH

We offer the opportunity to use voucher offers from Sovendus GmbH on our website. The provider is Sovendus GmbH, c/o Design Offices Karlsruhe Bahnhofplatz, Bahnhofplatz 12, 76137 Karlsruhe, Germany (Sovendus). If you are interested in a voucher offer from Sovendus and click on the relevant voucher banner, we transmit the following data to Sovendus in encrypted form to prepare and provide the voucher:

title
first and last name
email address

Data is only transferred when you take an active action (clicking on the voucher banner).

Processed data and purposes

When the voucher banner is opened, your IP address is already transmitted to Sovendus. Sovendus uses this exclusively for data security purposes and generally anonymises it after no more than seven days. In addition, we transmit the following information to Sovendus in pseudonymised form for billing and verification purposes:

order number
order value including currency
session ID
coupon code used, if applicable
timestamp

We do not directly identify you on the basis of this data.

Legal basis

The transfer of your data takes place:

to carry out pre-contractual measures in connection with the voucher offer pursuant to
Art. 6 para. 1 sentence 1 lit. b GDPR, and
on the basis of our legitimate interest in carrying out and billing voucher campaigns pursuant to
Art. 6 para. 1 sentence 1 lit. f GDPR.

If consent is required to integrate the relevant technologies, we obtain it pursuant to Art. 6 para. 1 lit. a GDPR and - for access to your device - pursuant to Section 25 para. 1 TDDDG.

Further processing by Sovendus

The further processing of your data is carried out by Sovendus under its own responsibility. We have no influence on the scope or further use of the data by Sovendus. Further information on data processing by Sovendus can be found in Sovendus's privacy statement at: https://www.sovendus.de/datenschutz

Exponea

For sending, analysing and personalising our newsletters and supporting online marketing activities, we use Bloomreach Engagement, a service provided by Bloomreach B.V., Fred. Roeskestraat 109, 1076 EE Amsterdam, Netherlands (Bloomreach). Bloomreach Engagement is the successor platform to Exponea. With Bloomreach, we can evaluate whether and how our newsletters are opened and used (e.g. open rates and clicks on links contained in them). The aim is to measure success, optimise our content and improve our marketing activities.

Processed data

The following data in particular is processed when using Bloomreach Engagement:

email address
information on when the newsletter was accessed
information on interaction with the newsletter (e.g. clicks)
pseudonymous usage and device identifiers, where applicable

Where possible, processing is carried out using pseudonymous usage profiles.

Allocation of roles

Bloomreach processes personal data exclusively on our behalf and in accordance with our instructions. A data processing agreement pursuant to Art. 28 GDPR is in place. Bloomreach does not use the data for its own purposes and does not disclose it to unauthorised third parties.

Legal basis

The processing of your data in connection with sending and evaluating newsletters is carried out exclusively on the basis of your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. If cookies or comparable technologies are used for this purpose, they are only used after you have given your consent pursuant to Section 25 TDDDG. The transfer of personal data to recipients in third countries, in particular the USA, cannot be ruled out. Bloomreach uses appropriate safeguards for this purpose, in particular the EU-US Data Privacy Framework and the EU Standard Contractual Clauses approved by the European Commission pursuant to Art. 45 and Art. 46 GDPR.

Withdrawal of consent

You can withdraw your consent at any time with effect for the future by:

using the unsubscribe link in the newsletter or
adjusting your cookie settings on our website.

After unsubscribing, you will not receive any further newsletters from us.

Retention period

Bloomreach data is stored only for as long as required for the respective purpose, agreed contractually or required by statutory retention obligations. The specific retention period depends on the function used and its configuration. Transfers to third countries and further information: Bloomreach may use sub-processors. Transfers to third countries take place only under the conditions of Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision or appropriate safeguards such as EU Standard Contractual Clauses. Further information on Bloomreach and its data protection safeguards can be found at https://www.bloomreach.com/en/legal/privacy-policy and https://documentation.bloomreach.com/engagement/docs/security-DSGVO. Role and data processing: Bloomreach Discovery is generally used as a processor pursuant to Art. 28 GDPR insofar as Connox determines the purposes and means of processing. To the extent that Bloomreach pursues its own purposes, Bloomreach is independently responsible for this. The details arise from the data processing agreement concluded with Bloomreach and the configuration of the service. Legal basis and consent: If Bloomreach Discovery is required exclusively to perform a contract or provide a shop function expressly requested by you, processing is based on Art. 6 para. 1 sentence 1 lit. b GDPR or - for technically necessary access to your device - Section 25 para. 2 TDDDG. For non-essential analytics, personalisation or marketing functions and for cookies and comparable technologies, we obtain your prior consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR and Section 25 para. 1 TDDDG. You can change or withdraw your consent at any time with effect for the future via the cookie consent tool. The purpose of processing is to display relevant search results and product recommendations, improve shop navigation, analyse use of the shop and optimise the findability of our products. Data is only combined with a customer account or used for personalised delivery where this is necessary for the respective function and covered by consent. We also use Bloomreach Discovery, a service provided by Bloomreach B.V., Fred. Roeskestraat 109, 1076 EE Amsterdam, Netherlands (Bloomreach Discovery), for search, navigation, product recommendations and personalisation in our online shop. Bloomreach Discovery may process search queries, products viewed, clicks, basket and purchase interactions, as well as technical device and usage data. Pseudonymous identifiers and - if provided for in the configuration and legally permissible - customer or user identifiers may be used. Further information on data processing by Bloomreach can be found at: https://www.bloomreach.com/en/legal/privacy

Trustpilot

We offer you the opportunity to rate our service via Trustpilot. The provider is Trustpilot A/S, Pilestræde 58, 5, 3rd floor, 1112 Copenhagen, Denmark. If you submit a review using a Unique Link provided by us, we transmit your name, email address and order number to Trustpilot in encrypted form as a unique reference. Further information on the Unique Link can be found at https://support.trustpilot.com/hc/en-us/articles/204953148-The-Unique-Link. Trustpilot's privacy information can be found at http://legal.trustpilot.com/end-user-privacy-terms. The specific legal basis and integration must be reconciled with the current review process before publication.

zenloop GmbH

We work with zenloop GmbH, Brunnenstrasse 196, 10119 Berlin, Germany (zenloop) to collect and evaluate customer feedback. zenloop is a business-to-business software-as-a-service platform that enables us to collect and evaluate customer feedback and use it to improve our products, services and customer communication.

Nature and scope of data processing

When the feedback tool is used, zenloop processes the following data in particular on our behalf:

information on the page accessed from which the feedback is submitted,
usage and interaction data in connection with the feedback tool,
a truncated or anonymised IP address,
device and browser information in anonymised or aggregated form.

In addition, zenloop processes the survey responses you provide voluntarily. If we transmit your email address to zenloop as part of a survey, this takes place exclusively after your express consent.

Cookies and similar technologies

zenloop uses cookies and so-called page tags to create aggregated statistical analyses of use of the feedback tool. This information helps us better understand which areas of our website receive feedback and how the tool is used.

Page tags only enable anonymised or pseudonymous analysis of the use of individual page areas.

Allocation of roles

zenloop processes personal data exclusively on our behalf and in accordance with our instructions. A data processing agreement pursuant to Art. 28 GDPR is in place. zenloop does not use the data for its own purposes and does not disclose it to unauthorised third parties.

Legal basis

The processing of personal data as part of the feedback tool is carried out

on the basis of our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, insofar as processing is technically necessary and serves to evaluate anonymised or pseudonymous usage data, and/or
on the basis of your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR if you actively participate in a survey or voluntarily provide personal data such as your email address.

If consent is required for the use of cookies or comparable technologies, they are only used after you have given your consent pursuant to Section 25 TDDDG. Further information on data processing by zenloop can be found in zenloop's privacy statement at: https://www.zenloop.com/de/legal/privacy

YouTube

We embed videos from the YouTube platform on our website. The controller in the European Economic Area (EEA) is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google). The parent company is Alphabet Inc. (formerly Google Inc.), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Nature and scope of data processing

YouTube videos are embedded using the so-called enhanced privacy mode. According to Google, no information about visitors to our website is initially stored as long as the embedded video is not played. If you actively start a YouTube video, YouTube may process personal data, in particular:

your IP address,
device and browser information,
information about usage behaviour in connection with the video.

YouTube may use cookies or comparable technologies to collect information about user behaviour, e.g. to create video statistics, improve user-friendliness or prevent misuse.

If you are logged into YouTube or Google, this data may be assigned to your user account. If you do not want this, you must log out of your YouTube or Google account before playing the video.

Legal basis

The embedding of YouTube videos and the associated access to information on your device takes place exclusively after you have given your consent pursuant to:

Art. 6 para. 1 sentence 1 lit. a GDPR and
Section 25 TDDDG.

No YouTube videos are loaded without your consent.

Transfers to third countries

The use of YouTube may involve the transfer of personal data to third countries, in particular the USA. The transfer of data is based on the EU-US Data Privacy Framework (DPF) pursuant to Art. 45 GDPR and - where required - on the EU Standard Contractual Clauses approved by the European Commission pursuant to Art. 46 GDPR. Further information on data processing by Google and YouTube can be found at: https://policies.google.com/privacy?hl=de

Zendesk

We use services provided by Zendesk International Ltd., 55 Charlemont Place, Saint Kevin's, Dublin D02 F985, Ireland (Zendesk) to process customer enquiries and operate our live chat system. The parent company is Zendesk, Inc., 989 Market Street, San Francisco, CA 94103, USA. Zendesk acts exclusively as a processor on our behalf pursuant to Art. 28 GDPR. Nature and scope

Data processing

The following data in particular may be processed when using the live chat and support functions:

communication content (e.g. chat messages, support enquiries),
contact details, if provided by you (e.g. name, email address),
technical metadata (e.g. time of enquiry, truncated IP address, device and browser information).

Zendesk processes this data exclusively in accordance with our instructions and not for its own purposes.

Purpose of processing

Processing takes place for the purpose of:

handling support and service enquiries,
improving our customer communication and service quality.

Legal basis

The processing of personal data takes place:

pursuant to Art. 6 para. 1 sentence 1 lit. b GDPR insofar as it is necessary to handle enquiries in connection with a contract or pre-contractual measures, and
pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR insofar as we have a legitimate interest in efficient and user-friendly customer support.

If cookies or comparable technologies are required to use the live chat widget, they are only used after you have given your consent pursuant to Section 25 TDDDG

Transfers to third countries

The processing of personal data may involve a transfer to third countries, in particular the USA. Zendesk, Inc. is certified under the EU-US Data Privacy Framework (DPF). The transfer of data is based on the European Commission's adequacy decision pursuant to Art. 45 GDPR. In addition, where necessary, the EU Standard Contractual Clauses approved by the European Commission pursuant to Art. 46 GDPR apply. Further information on data processing by Zendesk can be found at: https://www.zendesk.com/company/privacyZendesk is listed in the Data Privacy Framework (DRF) as a certified company. Zendesk processes personal data exclusively as a processor pursuant to Art. 28 GDPR and not for its own purposes

AI/automated processing and its use

We use AI-supported systems in various areas to make content, functions and services more efficient, user-friendly and secure. Artificial intelligence is used in particular to support internal processes, improve our services and optimise customer communication. AI is always used under human supervision and exclusively for the purposes described below.

AI-supported customer service

To support our customer service, we use AI-based functions, particularly as part of our support and ticketing system. AI functions may be used, for example, for:

automatic translation of support messages,
support in formulating suggested replies,
classifying, prioritising and summarising enquiries.

The AI systems are used exclusively to support our employees. No fully automated decision-making or automated processing with legal effect takes place. Decisions are always made by natural persons.

AI-based analysis and optimisation functions

We use AI-supported functions in the areas of newsletter distribution, marketing analysis and personalisation. These may in particular be used to:

analyse interaction and usage data,
optimise content, timing and dispatch logic,
segment user groups on a statistical basis,
improve the relevance of information and communication.

Where possible, processing is pseudonymised or aggregated. Processing for marketing or tracking purposes only takes place on the basis of appropriate consent where this is legally required.

AI-supported research and analysis assistance

The use is in particular for:

supporting research and analysis tasks,
summarising publicly available information,
internal decision-making and preparation processes.

You are not used to make automated decisions about users, create profiles or independently process customer data. Personal data is not used to train public or generally available AI models.

No automated decisions within the meaning of Art. 22 GDPR

There is no solely automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you. In particular, there are:

no automated contractual decisions,
no automated creditworthiness or risk assessments,
no fully automated performance or rejection decisions.

Legal bases for the use of AI

The processing of personal data in connection with AI-supported systems is carried out - depending on the particular application - on the basis of:

Art. 6 para. 1 sentence 1 lit. b GDPR, insofar as processing is necessary for the performance of a contract or pre-contractual measures,
Art. 6 para. 1 sentence 1 lit. f GDPR, on the basis of our legitimate interest in efficient, secure and high-quality processes,
Art. 6 para. 1 sentence 1 lit. a GDPR, if prior consent is required (e.g. for marketing or analytics purposes). If the use of AI involves access to devices, this takes place exclusively in accordance with Section 25 TDDDG.

Data processing agreement and transfers to third countries

If AI-supported functions are provided by external service providers, this takes place exclusively within the framework of data processing pursuant to Art. 28 GDPR.

A transfer of personal data to third countries, in particular the USA, cannot be ruled out in individual cases. In such cases, the transfer of data only takes place in compliance with the statutory requirements, in particular on the basis of:

an adequacy decision by the European Commission (e.g. the EU-US Data Privacy Framework) or
appropriate safeguards pursuant to Art. 46 GDPR (e.g. Standard Contractual Clauses).

Supplement: retention period for AI-supported processing

Personal data processed in connection with the use of AI-supported systems is stored only for as long as required for the respective purposes. Storage beyond this period only takes place where statutory retention obligations exist or consent has been given. Otherwise, the retention periods stated in the respective sections of this privacy statement apply. The supervisory authority responsible for Connox GmbH is generally: The State Commissioner for Data Protection of Lower Saxony, Prinzenstraße 5, 30159 Hanover, Germany, telephone: +49 (0) 511 120-4500, email: [email protected], https://www.lfd.niedersachsen.de. You may also contact the supervisory authority at your usual place of residence or work. In addition to the General Data Protection Regulation (GDPR), the processing of personal data is governed in particular by the German Federal Data Protection Act (BDSG), the Telecommunications and Digital Services Data Protection Act (TDDDG), the Act Against Unfair Competition (UWG), insofar as direct advertising is concerned, Section 26 BDSG for employee data, and the retention requirements under commercial and tax law. For cookies and comparable technologies, we observe in particular Section 25 TDDDG.

Applications and careers

If you apply to us, we process the application data you submit exclusively to carry out the application process and decide whether to establish an employment relationship. The legal basis is Art. 6 para. 1 lit. b GDPR and, where applicable, Section 26 BDSG. Processing may also take place electronically, in particular if you send application documents by email. If we do not establish an employment relationship with you, we generally delete your application documents no later than six months after notification of the rejection, unless other legitimate interests - in particular the necessary duty to provide evidence in proceedings under the General Equal Treatment Act - oppose deletion. If we conclude an employment contract, we store the data for carrying out the employment relationship and in accordance with statutory retention obligations.

Hosting and content delivery

The specific providers for hosting, content delivery and technical infrastructure are not named in the present reference version. This section must be supplemented before publication on the basis of the infrastructure actually used. Until confirmation, no providers or server locations are asserted in this regard.

Consent Management and Cookie Settings with Usercentrics

We use the Consent Management Platform (CMP) provided by Usercentrics on our website. The provider is Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany.

The Usercentrics CMP is used to obtain, manage and document your consent to the processing of personal data and the use of cookies and similar technologies. It also enables you to manage, change or withdraw your consent decisions at any time.

When using the Usercentrics CMP, the following data may in particular be processed:

information relating to your consent decision (e.g. consents granted or refused, the date and time of the decision and the consent status);
information about the device and browser you use;
IP address;
HTTP referrer; and
technical information regarding the configuration and version of the consent banner.

The processing of personal data in connection with the Usercentrics CMP is carried out, where applicable, on the basis of Art. 6(1)(c) GDPR in order to comply with legal obligations concerning the documentation and proof of consent. Where the processing is necessary for the management and documentation of your consent decisions, it serves in particular to provide evidence of consent in accordance with Art. 7(1) GDPR.

The Usercentrics CMP stores your consent decision so that it can be taken into account during subsequent visits to our website and so that we can demonstrate whether and, where applicable, to what extent you have given or refused consent. You can change or withdraw your consent at any time via the privacy or cookie settings available on our website. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

According to the information provided by Usercentrics, consent data processed through the CMP is stored within the European Union. The specific retention period depends on the configuration of the Usercentrics CMP implemented on our website and the applicable legal requirements.

Further information on the processing of personal data by Usercentrics can be found in the provider's privacy policy: Datenschutzerklärung | Usercentrics

Retention periods

We store personal data only for as long as required for the respective purpose. We then delete the data unless statutory retention obligations or other legitimate reasons require further storage. The statutory retention periods apply in particular to documents relevant under commercial and tax law. The specific periods for individual systems and data categories are defined in a deletion concept and must be reconciled with the systems actually configured before publication.

Competitions and marketing campaigns

The present reference version does not describe any specific competitions or other marketing campaigns. Such processing activities are therefore not added as a blanket provision. If competitions or campaigns are carried out, a separate section specifying the purpose, data categories, legal basis, recipients, retention period and conditions of participation must be added before publication.

Competent supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular with the authority responsible for your usual place of residence, your place of work or the registered office of our company, if you believe that the processing of your personal data violates data protection law. The supervisory authority responsible for Connox GmbH is the State Commissioner for Data Protection of Lower Saxony, Prinzenstraße 5, 30159 Hanover, Germany.

Erasure and blocking of personal data

We process and store personal data only for the period required to achieve the storage purpose (e.g. proper business processing) or corresponding to a statutory storage or retention period. If the storage purpose no longer applies or a statutory storage or retention period expires, we delete the personal data. If statutory storage or retention obligations continue to apply, for example after proper business processing or final response to your enquiries, we restrict processing, for example by blocking your data. After this period expires, we retain the information required under commercial and tax law relating to the contractual relationship for the periods prescribed by law. During this period (generally ten years from conclusion of the contract), the data is processed again solely in the event of an audit by the tax authorities. We delete the data collected and stored in connection with the customer account no later than when the storage purpose no longer applies or you notify us that your customer account should be deleted. However, early deletion of your personal data is not possible if and insofar as the data is still required for contract processing or statutory provisions require us to retain it for longer.

Rights of data subjects

As a data subject, you have the right:

pursuant to Art. 15 GDPR, to request information about your personal data processed by us. In particular, you may request information about the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned retention period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected from us, and the existence of automated decision-making, including profiling, and, where applicable, meaningful information about its details;
pursuant to Art. 16 GDPR, to request without undue delay the rectification of inaccurate or completion of your personal data stored by us;
pursuant to Art. 17 GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
pursuant to Art. 18 GDPR, to request restriction of the processing of your personal data insofar as the accuracy of the data is contested by you, the processing is unlawful but you reject its erasure and we no longer need the data, you need it for the establishment, exercise or defence of legal claims or you have objected to processing pursuant to Art. 21 GDPR;
pursuant to Art. 20 GDPR, to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller;
pursuant to Art. 7 para. 3 GDPR, to withdraw at any time the consent you have given to us. This means that we may no longer continue the data processing based on this consent in the future, and
pursuant to Art. 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority at your usual place of residence or work or at our registered office.

Right to object

If your personal data is processed on the basis of legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, you have the right under Art. 21 GDPR to object to the processing of your personal data if there are grounds relating to your particular situation or if the objection is directed against direct advertising by us. In the latter case, you have a general right to object, which we will implement without requiring you to state a particular situation. If you exercise your right to object, we will stop processing the data concerned. Further processing remains reserved if we can demonstrate compelling legitimate grounds for the processing that override your interests and rights or if the processing serves to establish, exercise or defend legal claims. If you wish to exercise any of the rights described above, sending us an email is sufficient.

Amendments to the privacy statement

We reserve the right to update this privacy statement from time to time. Updates to this privacy statement will be published on our website. Changes apply from the time they are published on our website. We therefore recommend that you visit this website regularly to keep informed about any updates that may have been made.

Data protection and data security

Disclosure of data

TLS encryption

Personal data

Visiting our website

Customer registration

Orders in the online shop

Newsletter registration and dispatch

Advertising by postal mail

Contacting us via the contact form and by email

Product review

Credit assessment and scoring

Payment providers

Information on cookies and third-party tools

Cookies

Use of social media, online marketing, web analytics and tracking services, and tools provided by other service providers

Data protection information for Friendly Captcha

Criteo Retargeting

Kelkoo Sales Tracking

Perplexity Enterprise Pro

Possible personal reference

Technical and organisational measures (Art. 5(1)(f) GDPR)

Google Ads Remarketing

Google Ads Conversion Tracking

Google Analytics 4

Google Customer Match

Withdrawal

Mouseflow

OWAPro

ParticularAudience

Microsoft Advertising

Microsoft Clarity

Moebel.de

Shopping24 conversion tracking

Conversion tracking by Solute GmbH

Pinterest Tag

Facebook Pixel(Meta Pixel)

Squarelovin

Facebook plugins

Pinterest plugins

XING Share Button

Tracdelight

Voucher offers from Sovendus GmbH

Processed data and purposes

Further processing by Sovendus

Exponea

Trustpilot

zenloop GmbH

YouTube

Zendesk

AI/automated processing and its use

Applications and careers

Hosting and content delivery

Consent Management and Cookie Settings with Usercentrics

Retention periods

Competitions and marketing campaigns

Competent supervisory authority

Erasure and blocking of personal data

Amendments to the privacy statement

For newsletter subscribers only: 24 days, 24 prizes

Popular products

Popular collections

Popular categories

Popular brands