PRIVACY POLICY

‍

We, Duffle Travel Retail Platform GmbH, take protection of your personal data very seriously. We treat personal data confidentially and in accordance with the legal rules of the relevant data protection laws, in particular the European General Data Protection Regulation (GDPR).

This privacy policy covers the use of the digital offerings of Duffle Travel Retail Platform GmbH, including our social media profiles, via all internet-enabled end devices.

Our digital offerings may contain links to other websites of third party service providers to which this privacy statement does not apply.

‍

1. CONTROLLER

The controller for the processing of your personal data is
Duffle Travel Retail Platform GmbH
Strassburger Str. 55
10405 Berlin

E-mail: hello@dtrp.io

If you have any questions about our data protection policy, please write us at the above postal address or at the e-mail address provided, with the addition of "Data Protection".

‍

2. PURPOSE OF THE PROCESSING OF PERSONAL DATA

‍

2.1 Data processing for the provision of contractual services

We process personal data in order to process the contractual relationships as well as to be able to submit needs-based contract offers. The data is collected in particular for the conclusion or implementation of a contract.

For all forms, we only collect the personal data that is absolutely necessary for the processing of the contractual relationships or for your request for information. The collection of data that is not absolutely necessary, but in which we have an interest in order to optimize the fulfillment of the purpose, is only optional. In this case, you decide on a voluntary basis whether and which data you want to give us.

The basis for data processing is Art. 6 (1) p. 1 lit. b GDPR, which permits the processing of data for the fulfillment of a contract or pre-contractual measures.
‍

2.2 Data processing for communication purposes

In addition to contractual data, we process your communication data (name, address, telephone number, e-mail address) in order to process your inquiries and/or to be able to contact you. Personal data provided to us by e-mail or in another way will only be processed for correspondence with you or only for the purpose for which the data was provided to us.

The processing of this data is based on Art. 6 (1) lit. b GDPR, if the request is related to the performance of a contract or is necessary for the performance of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the requests addressed to us (Art. 6 (1) (f) GDPR) or on consent (Art. 6 (1) (a) GDPR), provided that consent has been obtained in this regard.
‍

2.3 Newsletter

With your consent, you can subscribe to our newsletter, with which we inform you about our current interesting offers and developments. The respective content of a newsletter is explained in the respective declaration of consent. If you would like to receive a newsletter offered by us, we require an e-mail address from you as well as information that allows us to verify that you are the owner of the e-mail address provided and that you agree to receive the newsletter. For this purpose, we will send you an e-mail with a confirmation link (double opt-in) to the e-mail address you have entered. If you do not confirm your registration, your information will be blocked and automatically deleted after one month.

Your e-mail address is the only mandatory information for sending the newsletter. The entering of further, separately marked data is voluntary and will be used to address you personally. In addition, we store the IP addresses you use and the dates of registration and confirmation. The purpose of the procedure is to prove your registration and, if necessary, to clarify any possible misuse of your personal data. We do not collect any further data in this context. We use these data exclusively for the dispatch of the requested newsletter. Insofar as we use an order processor to send the newsletter, we will of course comply the applicable data protection laws.

Data processing takes place on the basis of your consent pursuant to Art. 6 Para. 1 lit. a GDPR. You can revoke your consent to the sending of a newsletter at any time and cancel the respective subscription. You can declare your revocation by clicking on the link provided in every e-mail or by sending us a message via the contact details mentioned under point 1. The legality of the data processing operations that have already taken place remains unaffected by the revocation.

‍

2.4 --

2.5 Freshworks Freshmarketer Newsletter

With your consent, you can subscribe to our newsletter, with which we inform you about our current interesting offers and news. If you would like to receive a newsletter offered by us, we require an e-mail address from you as well as information that allows us to verify that you are the owner the specified e-mail address and agree to receive the newsletter. For this purpose, we will send you an e-mail to the entered e-mail address with a confirmation link after your entry (double-opt-in). If you do not confirm your registration, your information will be blocked and automatically deleted after one month at the latest.

When you register, we store the data you provide and in each case your IP address, the time of registration and the time of confirmation. Purpose of this procedure is to be able to prove your registration and, if necessary, to clarify any possible misuse of your personal data. We do not collect any other data in this context. We use this data exclusively for sending the requested newsletter.

For sending our newsletter, we use Freshmarketer as order processor of Freshworks Inc. with headquarters at 2950 S. Delaware Street, Suite 201, San Mateo CA 94403 USA or with a branch office of Freshworks GmbH, Neue Grünstraße 17 in 10179 Berlin.

Freshmarketer is a service with which, among other things, the sending of newsletters can be organized and analyzed. If you enter data for the purpose of receiving newsletters (e.g. e-mail address), this data will be stored on Freshworks' servers in the USA, among other places. With the help of Freshmarketer, we can analyze our newsletter campaigns. When you open an email sent with Freshmarketer, a file contained in the email (so-called web-beacon) connects to the servers in the USA. This makes it possible to determine whether a newsletter message has been opened and which links, if any, have been clicked. In addition, technical information is recorded (e.g. time of retrieval, IP address, browser type and operating system). This information cannot be assigned to the respective newsletter recipient. It is used exclusively for the statistical analysis of newsletter campaigns. The results of these analyses can be used to better adapt future newsletters to the interests of the recipients. For more details, please refer to Freshworks' privacy policy at: https://www.freshworks.com/privacy/.

Important in context of data processing in the USA: the data protection standard in the USA is insufficient according to the European Court of Justice and there is a risk that your data will be processed by US authorities, for control and monitoring purposes and possibly without any legal remedy.

The data processing described above is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR in conjunction with. Art. 49 para. 1. p. 1 lit. a GDPR. You can revoke this consent at any time by unsubscribing from the newsletter. The legality of the data processing operations already carried out remains unaffected by the revocation.

The data you have provided to us for the purpose of receiving the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted from our servers as well as from the servers of Freshworks after you unsubscribe from the newsletter.

‍

2.6 Cookies

We may use so-called cookies to provide website-specific services. Cookies are small text files that are stored on a visitors' computer and contain data about the respective user in order to provide access to various functionalities.

Websites may use both session cookies and persistent cookies. A session cookie is temporarily stored on the computer used while navigating through the website. A session cookie is deleted as soon as the Internet browser is closed or as soon as the session has expired after a certain time. A persistent cookie remains on the computer until it is deleted.

We may work with third parties on some of our offers and therefore cookies from partner companies may also be stored when you visit such a website (third-party cookies). We may inform you in advance about the use of such cookies and the scope of the data stored or retrieved in each case. Data subjects may receive additional information on the cookies used in each case via the cookie tool we use and the explanations provided there.

We may use cookies that are necessary to enable us to provide the services owed by us or to ensure the functionality of our services. The legal basis for the use of these cookies is § 25 para. 2 no. 2 TTDSG. Any processing of personal data carried out in this context is then based on Art. 6 para. 1 p. 1 lit. b GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures, or on Art. 6 para. 1 p. 1 lit. f GDPR, which permits data processing to safeguard the legitimate interests of the controller, unless the interests or the fundamental rights and freedoms of the data subject override the interest of the controller in the data processing. Our interest then lies in ensuring the provision of the functions of our services.

For the use of other, non-essential cookies, we may obtain your consent. The cookies are then used on the basis of the consent pursuant to §25 para. 1 TTDSG, and any processing of personal data carried out in this context pursuant to Art. 6 para. 1 p. 1 lit. a GDPR. Data subjects can revoke their consent at any time - among other things via the cookie tool we may have integrated. The lawfulness of the data processing already carried out on the basis of consent remains unaffected by the revocation.

‍

2.7 Finsweet Cookie Consent Manager

This website uses the Cookie Consent Manager of Finsweet Inc. 2774 Harbor Road, Merrick, New York 11566, United States of America, which sets a technically necessary cookie to store the cookie preference of your browser. With this cookie, the selected preference is saved, which was selected when entering the website via the browser you use.

If you want to revoke these preferences for the specific browser, simply delete the cookies in your browser. When you re-enter/reload the website, you then will be asked again for cookie preference. For more information about Finsweet Cookie Consent Manager's privacy policy, please visit https://www.finsweet.com/cookie-consent/#legal.

‍

2.8 Google Analytics

This website may use Google Analytics - integrated via the Google Tag Manager, a web analysis service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (hereinafter referred to as "Google"), if you have consented to this data processing. Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of this website is usually transferred to a Google server and stored there, and may also be transferred to the servers of Google LLC in the USA.

However, since IP anonymisation is activated on our website when using Google Analytics, your IP address will be shortened by Google in member states of the European Union or in other signatory states to the Agreement on the European Economic Area before this is done. Only in exceptional cases will the full IP address be transferred to a Google LLC. server in the USA and shortened there. Google will use this information for the purpose of evaluating your use of the website in question, compiling reports on website activity and providing other services relating to website activity and internet usage.

For more information on terms of use and data protection, please visit https://www.google.com/analytics/terms/ and select your language or https://policies.google.com/. We would like to point out once again that on this website Google Analytics has been extended by the code "anonymizeIp" to ensure an anonymized collection of IP addresses (so-called IP-Masking).

Important in context of data processing in the USA: According to the European Court of Justice, the data protection standard in the USA is insufficient and there is a risk that your data will be processed by US authorities, for control and monitoring purposes and possibly without any possibility of legal recourse.

The data processing explained above is be based on your consent pursuant to Art. 6 para. 1 p. 1 lit. a GDPR in conjunction with. Art. 49 para. 1. p. 1 lit. a GDPR. You can revoke your consent at any time. You can declare the revocation by making the appropriate setting in the consent management tool used, if applicable. The legality of the data processing operations already carried out remains unaffected by the revocation.

‍

2.9 Google Remarketing Tags

We may use Google Remarketing Tags on some of our websites. Provided that you have consented to this data processing. These are Google services that use cookies, which are stored on your computer and allow an analysis of your use of the website. The information collected by the cookie about your use of this website is usually transferred to a Google server as explained in the previous paragraph and stored there. This may also involve a transfer to the servers of Google LLC in the USA. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Third party providers, including Google, place advertisements on Internet sites on the Internet. Third parties, including Google, use stored cookies to serve ads based on a user's previous visits to this website. Google will not associate your IP address with any other data held by Google. You may object to the collection and storage of data at any time with effect for the future. You can deactivate the use of cookies by Google by visiting the page for deactivating Google advertising. However, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. You can object to the collection and storage of data at any time with effect for the future. You can find further information on Google's regulations here (https://policies.google.com/).

As an alternative to the browser plugin or within browsers on mobile devices, please click on the following link to set an opt-out cookie that will prevent Google Analytics from collecting data within this website in the future (this opt-out cookie only works in this browser and only for this domain, if you delete your cookies in this browser, you will have to click this link again): Disable Google Analytics

For more information on terms of use and data protection, please visit https://www.google.com/analytics/terms/ or https://policies.google.com/.

Important in context of data processing in the U.S.: The data protection standard in the U.S. is insufficient according to the European Court of Justice and there is a risk that your data will be processed by U.S. authorities, for control and monitoring purposes and possibly without any legal remedy.

The storage of Google cookies and the evaluation for statistical purposes is based on your consent in accordance with Art. 6 para. 1 p. 1 lit. a GDPR in conjunction with. Art. 49 para. 1. p. 1 lit. a GDPR. You can revoke your consent at any time. You can declare the revocation by clicking on the aforementioned opt-out link, or by sending a message to the contact details mentioned under point 1 (e.g. e-mail, fax, letter). The legality of the data processing operations already carried out remains unaffected by the revocation.

2.10 Google Double-Click (including Floodlight and Spotlight), Google AdWords Conversion, Google Dynamic Remarketing

On some of our websites we also use Google Analytics to evaluate data from the Google services AdWords and DoubleClick for statistical purposes. This enables us to analyse what happens after a user clicks on our advertisement, e.g. whether the user has bought our product or called up the advertisement from a mobile phone, in order to improve our offers. You will also receive interest-based advertising through these services. If you do not wish to receive these ads, you can deactivate them using Google's Ads Preferences Manager.

DoubleClick sets a cookie on your computer to record (track) your surfing behavior on various websites and to display interest-based advertising. If you want to disable this permanently, you can download a plug-in from the following link to deactivate the DoubleClick cookie.

Information collected using the conversion cookie is used to generate conversion statistics for AdWords customers who have opted in to conversion tracking. This tells us the total number of users who have clicked on an ad from us and been directed to a page with a conversion tracking tag. We do not receive information that personally identifies users. If you do not wish to participate in tracking, you can opt-out of this use by slightly disabling the Google Conversion Tracking cookie on your web browser under User Preferences, or by disabling it through the aforementioned plug-ins or settings.

The storage of Google cookies and the evaluation for statistical purposes is based on your consent pursuant to Art. 6 para. 1 p. 1 lit. a GDPR in conjunction with. Art. 49 para. 1. p. 1 lit. a GDPR. You can revoke your consent at any time. You can declare the revocation by clicking on the aforementioned opt-out link, or by sending a message to the contact details mentioned in section 1 (e.g. e-mail, fax, letter). The legality of the data processing operations already carried out remains unaffected by the revocation.

2.11 Phrase

On our website, we use the service "Phrase" of Memsource GmbH ABC-Strasse 4, 20354 Hamburg, Germany or Memsource a.s. in Spálená 108/51, 110 00 Prague 1, Czech Republic.

Phrase is a software localization platform and translation software. It is used for translation of languages and cultural adaptation of the websites content in order to guarantee a consistent and comprehensible access. This ensures cross-border and user-friendly services for the benefit of the user.

Within the services, an exchange takes place with the servers of Memsource GmbH/ Memsource a.s. or Phrase.

In addition, via so-called usage metrics, information on the activity usage is stored. This includes anonymized information on the use of the various end device operating systems (e.g. iOS and Android) and the respective language and country.

Phrase is used in the interest of a consistent and appealing presentation of our online offers and is necessary for the correct presentation in your language area. This represents a legitimate interest within the meaning of Art. 6 para. 1 p. 1 lit. f GDPR.

You can find more information about Phrase at https://phrase.com/ and in Phrase's privacy policy at https://phrase.com/privacy/.

2.12 Data processing in the context of our Facebook and Instagram pages.

We operate a company page (fan page) on the social network facebook.com ("Facebook") and a page/profile on the social network Instagram ("Instagram") of the company Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. For the operation of the aforementioned pages, we are jointly responsible with Meta Platforms Ireland Limited ("Meta") within the meaning of Art. 4 No. 7 GDPR. Linked here are Facebook's terms of use and policies (https://www.facebook.com/legal/terms) as well as the responsibility agreement (https://www.facebook.com/legal/terms/page_controller_addendum) pursuant to Art. 26 GDPR.

The type and scope of the personal data processed and the information provided, if any, the associated purposes of the data processing, its lawfulness as well as information on the exercise of data subject rights can be found in the privacy notices of Facebook as well as further information provided by Meta on the processing of "Insights data" (see above). Meta provides us with so-called page insights for our site. Page Insights (e.g. https://www.facebook.com/business/a/page/page-insights) are summarized data that provide us with information about how people interact with our site. The generation and provision of these page insights is the responsibility of Facebook, we have no influence on it. This also applies to the data processing, which is carried out exclusively for the purposes of Meta Platforms Ireland Limited. Meta also assumes all obligations under the GDPR with regard to the processing of Insights data (including Articles 12 and 13 GDPR, Articles 15 to 22 GDPR and Articles 32 to 34 GDPR).

The purpose of the data processing of the provided data by us is the statistical evaluation of the use of our company pages. This enables us, for example, to determine preferred visiting and posting times and to use them to optimize our posts and our company pages. In addition, we process personal data made publicly available there (e.g. clear names in the user profile) as well as data directly related to activities on our company pages (e.g. contributions, posts, likes, marks), also for the purpose of communication.

The basis for data processing is Art. 6 (1) p. 1 lit. b GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures, insofar as the data are processed in accordance with the Facebook or Instagram terms of use, otherwise, insofar as there is a data protection responsibility on our part, Art. 6 (1) p. 1 lit. f GDPR, which permits the processing of data for the protection of the legitimate interests of the controller, insofar as the interests or fundamental rights and freedoms of the data subject are not overridden. Our interest lies in providing content and communicating with users of the social networks and improving the reach and effectiveness of our posts.

Please assert your rights to information, correction, deletion, restriction of processing and data transferability of your stored Insights data vis-à-vis Facebook, as Facebook has assumed the corresponding obligations:

Meta Platforms Ireland Limited
4 Grand Canal Square
Dublin 2, Ireland
Privacy Policy: https://www.facebook.com/about/privacy/

2.13 Data processing in the context of our LinkedIn company page

We have a company page on the social network linkedin.com of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn") and are provided with so-called page analytics by LinkedIn. We are jointly responsible with LinkedIn for this operation of the LinkedIn company page within the meaning of Art. 26 GDPR.

The type and scope of the information processed or provided by LinkedIn, the associated purposes of the data processing by LinkedIn, its lawfulness as well as information on the exercise of data subject rights can be found in LinkedIn's data privacy policy at the URL https://www.linkedin.com/legal/privacy-policy and in the joint responsibility agreement, which can be found at the URL https://legal.linkedin.com/pages-joint-controller-addendum. Page analytics involves aggregated data that allows us to understand how people interact with our pages. The generation and provision of these page analytics is the responsibility of LinkedIn, over which we have no control. LinkedIn assumes all obligations under the GDPR with regard to the processing of insights data (including Articles 12 and 13 GDPR, Articles 15 to 22 GDPR and Articles 32 to 34 GDPR).

The purpose of the data processing by us of the data provided by LinkedIn is the statistical evaluation of the use of our company page. This enables us, for example, to determine preferred visiting and posting times and to use this data to optimise our posts and our company page. In addition, we process personal data made publicly available on LinkedIn (e.g. clear names in the user profile) as well as data directly related to activities on our company page (e.g. contributions, posts, likes, marks), also for the purpose of communication.

The basis for the above data processing is nature 6 para. 1 p. 1 lit. a GDPR. Insofar as a corresponding consent has been given to LinkedIn, this consent can be revoked at any time with effect for the future. Insofar as consent has been granted to us in this regard, this consent can be revoked at any time with effect for the future. Otherwise, the basis for our data processing is nature 6 para. 1 p. 1 lit. f GDPR, which permits the processing of data to protect the legitimate interests of the controller, provided that the interests or fundamental rights and freedoms of the data subject are not overridden. Our interest is to provide content and communication with LinkedIn users and to improve the reach and effectiveness of our posts.

The rights of access, rectification, deletion, restriction of processing and data portability of stored insights data can be asserted against LinkedIn, as LinkedIn has assumed the corresponding obligations:

LinkedIn Ireland Unlimited Company
Wilton Place
Dublin 2
Ireland
Privacy policy https://www.linkedin.com/legal/privacy-policy

‍

2.14 Online presence in other social networks

We have set up online presences in various social networks to communicate with you, interested parties and customers and to inform them about our services and current offers. In addition to our interaction with you, the social networks process data from visitors to their websites for the purpose of market research and advertising, i.e. that from the respective visit or usage behaviour and the preferences and interests of a visitor derived from this, a user profile may be created by the respective operator of the social network.

Such user profiles can be used, among other things, to display advertisements within the respective social network and possibly on other websites, which are individually adapted to the respective user profile. Cookies (see above) may be stored on the visitors' devices, with the help of which data on usage behaviour can be collected. The collection of this data can, especially in the case of logged-in members of the respective social network, also be realized across several browsers and/or end devices used by a user. Even if a visitor does not have a profile with the respective social network, it cannot be ruled out that personal data on this visitor will be stored when visiting the respective website. Requests for information regarding the data stored in social networks via our online presence or the use of other relevant rights of data subjects can be addressed to the provider of the respective service. Only the providers of the social networks have access to the respective data stored there and can provide the corresponding information, etc. With regard to the purpose and scope of data processing by the various social networks, we refer additionally to their respective data protection notices and the respective contact options:

Twitter Inc.
One Cumberland Place
Fenian Street
Dublin 2, D02 AX07, Ireland
Privacy policy: https://twitter.com/en/privacy

The processing of data in the context of our online presence in social networks is done, insofar as we are responsible under data protection law, on the basis of our legitimate interest in effective information and direct communication with interested parties. The basis for data processing is Article 6 (1) S. 1 lit. f GDPR. Our interest is to provide content and communicate with users of the respective social networks and to improve the reach and effectiveness of our posts.

‍

2.15 Data processing for job applications

Job Applications for our company can be sent to us via our websites and the contact data stored there. Insofar as personal data is transmitted to us in this way or by other means when applications are submitted, we process this data for the purpose of reviewing, processing and responding to the application and, if necessary, for preparing the employment relationship.

The basis for the data processing is either Article 88 (1) GDPR, Section 26 (1) BDSG which permits the processing of data for the decision on the establishment, for the establishment as well as for the implementation of employment relationships or - if the data subject has given consent - Article 6 (1) sentence 1 lit. a GDPR. Data subjects may revoke their consent at any time with effect for the future. For this purpose, an informal communication by e-mail to us is sufficient. The legality of the data processing operations already carried out remains unaffected by the revocation.

‍

2.16 Data processing for protection of legitimate interests

We also process your data if it is necessary to protect the legitimate interests of us or third parties. This may be the case in particular to ensure IT security and IT operation, in particular also for support enquiries, to be able to understand and prove facts in the event of legal disputes, to statistically evaluate the use of our website, for advertising other products from us or our cooperation partners.

The basis for data processing is Art. 6 para. 1 s. 1 lit. f GDPR. We have a legitimate interest in the above-mentioned data processing. Our interest is either in IT security, in ensuring support for better usability of our website or in our legal interest or in our evaluation and advertising interest.

‍

2.17 Data processing for advertising purposes

We use the information you provide to send you recommendations and information about our products and services by post.

In addition, we may use your data for product recommendations or enquiries about the products or services you have ordered by e-mail, notifications or SMS if you have already ordered something from us. You will receive these recommendations or enquiries from us regardless of whether you have subscribed to a newsletter. In this way, we want to send you information about our range of products and services that may be of interest to you based on your last order with us or to improve our products and services and the quality of our employees and sales partners.

We also use your telephone number to provide you with recommendations and information about our products and services by telephone, whereby we naturally also comply with the legal requirements in this respect.

If you no longer wish to receive recommendations, enquiries or any promotional messages from us, you can object to this at any time. A notification in text form to the contact data mentioned under point 1 (e.g. e-mail, fax, letter) is sufficient for this purpose.

The basis for data processing is Art. 6 para. 1 s. 1 lit. f GDPR, which permits the processing of data to protect the legitimate interests of the controller, provided that the interests or fundamental rights and freedoms of the data subject are not overridden. Our interest is economic and lies in the promotion and sale of our products and services.

‍

2.18 Other data processing based on consent

It may also happen that we ask for your consent to process personal data. Any granting of consent and the relevant data processing is voluntary and you will not suffer any disadvantages if you do not consent.

The data processing is then carried out on the basis of your consent in accordance with Art. 6 para. 1 s. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future. An informal notification to us is sufficient for this purpose. The legality of the data processing operations already carried out remains unaffected by the revocation.

‍

2.19 Log files

Each time our websites are accessed, usage data is transmitted by the respective Internet browser and stored in log files, the so-called server log files. The data records stored in this process contain the following data:

- the page from which the page was requested (so-called referrer URL)

- the name and URL of the requested page

- the date and time of the request

- the description of the type, language and version of the web browser used

- the IP address of the requesting computer

- the amount of data transferred

- the operating system

- the message whether the call was successful (access status/http status code)

- the GMT time zone difference

These data cannot be assigned to specific persons. This data will not be merged with other data sources. We reserve the right to subsequently check this data if we become aware of concrete indications of illegal use.

The data processing is based on Art. 6 para. 1 lit. f GDPR, which permits the processing of data to safeguard the legitimate interests of the data controller, provided that the interests or fundamental rights and freedoms of the data subject do not prevail.‍

‍

2.20 Data processing for the fulfilment of legal obligations

In addition, we process your data to fulfil legal obligations (e.g. regulatory requirements, commercial and tax storage and proof obligations).

The basis for data processing is Art. 6 para. 1 lit. c GDPR, which permits processing to fulfil a legal obligation.

‍

2.21 Data processing for WhatsApp Business/ WhatsApp Channel

Data Collection: We collect information you provide such as your name, phone number, and messages. Indirect data like device information may also be collected.

Consent for Communication: By accepting, you agree to be connected with us for future communications via our WhatsApp channel. This may include updates, promotions, and feedback requests.

Use of Information: Your information is used to deliver and improve our services, communicate with you, and ensure security. We do not share your data with third parties, except as required by law or for necessary business processes.

GDPR Compliance: For EU citizens, GDPR grants rights including access, rectification, erasure, restriction, objection, and data portability of your personal data. Requests for these rights can be made directly to us.

Data Security: We take data security seriously but remind users that no method of transmission or storage is infallible.

Children's Privacy: Our service is not for those under 16 years old. We do not knowingly collect data from children under this age.

Policy Changes: We may update this policy and will notify users of significant changes through our WhatsApp channel or other means.

Contact: For questions or concerns about our Privacy Policy or data practices, please contact us directly.

‍

3. CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Your personal data will only be passed on to third parties or otherwise transmitted if this is necessary for the purpose of contract processing or billing or if you have given your prior consent or if there is a legal basis for the passing on of such data.

Your contractual and communication data will be forwarded to the responsible office and the responsible employees within our company for the purpose of answering your inquiries, for communication or for the execution of the order or for the fulfillment of contractual obligations.

Insofar as it is necessary for the purpose of contract processing or for the dispatch and delivery of products or to provide our services, data will be passed on to partner companies which have been commissioned to support contract processing. Our partners undertake to comply with and observe the provisions of data protection law. Furthermore, our partners are not permitted to use the data in any other way than to process the contract.

The basis for this is Art. 6 para. 1 p. 1 lit. b GDPR, which permits the processing of data for the fulfillment of a contract or pre-contractual measures.

We transfer personal data to third parties who process personal data on their own responsibility (so-called controllers, Art. 4 (7) GDPR), such as postal and delivery services, house bank, tax advisor/auditor or authorities within the scope of legal permissibility and necessity.

Service providers who support us in providing our service to you are sales and marketing partners, software (SaaS) providers, IT service providers, in particular service providers for software and hardware maintenance, hosting providers, e-commerce platform providers, email service providers and newsletter service providers.

‍

4. DURATION OF DATA STORAGE

In principle, we delete your data as soon as it is no longer required for the above-mentioned purposes, unless temporary storage is still necessary. We store your data on the basis of legal proof and storage obligations, which result among other things from the German Commercial Code and the German Tax Code, according to which the storage periods are up to ten full years. In addition, we keep your data for the period during which claims can be asserted against our company (statutory limitation period of three or up to thirty years).

‍

5. RIGHTS OF DATA SUBJECT

Within the framework of the applicable legal provisions, you have the right to access information free of charge at any time about your stored personal data, its origin and recipients and the purpose of the data processing and, if applicable, a right to rectification, restriction or erasure of this data. You can request information about your personal data stored by us and under certain conditions request the correction or erasure of your data by contacting us via our contact data given above. You may also have the right to restrict the processing of your data and to have the data you provide disclosed in a structured, common and machine-readable format. If you have given us your consent to process personal data for specific purposes, you can revoke your consent at any time with effect for the future. You may object to the processing of your data for direct marketing purposes. If we process your data to protect legitimate interests, you may object to such processing for reasons arising from your particular situation. You can also contact a data protection supervisory authority and file a complaint.