Privacy Policy
1. Controller
b-schriftung, Dietmar Brennemann
Huberweg 31
94522 Wallersdorf, Germany
Email: kontakt@klebefux.de
2. Hosting and Server Log Files
The shop runs on a server provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. We have concluded a data processing agreement under Art. 28 GDPR with Hetzner. Whenever a page is requested, the server automatically processes technical data: IP address, date and time, the requested address, the previously visited page, browser and operating system. This is necessary to deliver the pages and to keep the service secure, for example against attacks. The logs are not combined with other data and are deleted after 14 days at the latest. The legal basis is our legitimate interest in a secure and working shop (Art. 6(1)(f) GDPR).
3. Cookies
We only use technically necessary cookies, e.g. for the shopping cart, signing in to your customer account and the language selection. These cookies do not require consent (Section 25(2) no. 2 TDDDG). We do not set cookies for advertising or tracking. If you pay with PayPal or Stripe at checkout, these providers set their own cookies for payment processing and fraud prevention, see section 6.
4. Web Analytics with Matomo
This website uses the open-source web analytics service Matomo to statistically evaluate visits (e.g. pages viewed, visitor origin, shopping carts and orders). For an order we send Matomo the order number, the items ordered and the order value. The order number can be linked to a person in our shop, so this data is pseudonymous, not anonymous. Matomo runs exclusively on our own servers; no data is passed on to third parties. Raw data is deleted after 180 days.
The analysis is cookieless: no tracking cookie is set, and visitors are not re-identified across multiple visits. Your IP address is anonymized before it is stored. The legal basis is our legitimate interest in the needs-based design and ongoing optimization of our website (Art. 6(1)(f) GDPR).
5. Orders, Customer Account and Contract Processing
For your order we process the data you enter at checkout: name, address, email address, phone number where given, the items ordered and the payment method chosen. You can order as a guest or create a customer account, which keeps your addresses and orders until you ask us to delete it. Once the contract has been fully processed, your data is blocked from further processing and deleted after the statutory retention periods under tax and commercial law (up to ten years) have expired. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for the retention.
6. Payment Service Providers
If you pay with PayPal, we pass the data needed for the payment (name, address, email address, order amount and order number) to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg. If you pay by credit card or another payment method offered through Stripe, this data goes to Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter the payment details themselves (account or card details) directly with the payment service provider; we do not receive them.
For this, the payment service providers load their own scripts at checkout and set cookies to process the payment and prevent fraud. Both may also transfer data to affiliated companies in the USA. This is based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, under which both companies are certified, and on standard contractual clauses. The legal basis for passing on the data is Art. 6(1)(b) GDPR. For details see the privacy notices of PayPal and Stripe.
7. Shipping with DHL
For delivery, we pass your name and delivery address to DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany (Art. 6(1)(b) GDPR). If you agree at checkout, we also pass on your email address and phone number so that DHL can notify you of the delivery and you can arrange the delivery date (Art. 6(1)(a) GDPR). You can withdraw this consent at any time with effect for the future; an email to us is sufficient. Without consent, the parcel is still delivered, just without notification from DHL.
8. Contact Form and Email
If you write to us via the contact form or by email, we process your details to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if the enquiry concerns an order, otherwise our legitimate interest in answering it (Art. 6(1)(f) GDPR). We delete the enquiry once it has been dealt with and no retention obligation applies.
9. Protection Against Spam and Abuse
We protect the registration and the contact form with Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Only on these two pages does your browser load a script from Cloudflare. It checks whether the form is being submitted by a human or by an automated program. In doing so, Cloudflare processes technical data of your visit, in particular your IP address and characteristics of your browser and device. When you submit the form, we have Cloudflare confirm the result of this check. Turnstile does not set a cookie on our site for this.
Cloudflare processes this data on our behalf to carry out the check. According to Cloudflare, it also uses the data under its own responsibility to improve its detection of automated access. The legal basis is our legitimate interest in protecting our forms against spam and abuse (Art. 6(1)(f) GDPR). Reading the browser and device information is strictly necessary for submitting the form, which you have requested (Section 25(2) no. 2 TDDDG). Cloudflare may transfer data to the USA. This is based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, under which Cloudflare is certified. For details see Cloudflare's Turnstile privacy notice.
If a login to your customer account fails, we store a check value calculated from your email address and your IP address for 15 minutes, not the addresses themselves. After five failed attempts within this time, we block further logins for five minutes to prevent passwords from being guessed. The legal basis is our legitimate interest in the security of customer accounts (Art. 6(1)(f) GDPR).
10. Newsletter
You only receive our newsletter if you explicitly sign up for it. After signing up, we send you an email with a confirmation link; you are only subscribed once you have opened it (double opt-in). We store your email address as well as the time and IP address of the sign-up so that we can prove it. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time, via the link in every issue or by email to us. We then remove your address from the mailing list.
11. Rights of the Data Subject
You have the right to access, rectification, erasure, restriction of processing, data portability, and objection to the processing of your personal data. You can withdraw any consent you have given at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.
12. SSL/TLS Encryption
The shop is delivered exclusively over encrypted HTTPS connections. You can recognise this by "https://" in the address bar and the padlock icon in your browser. Data you send to us, for example at checkout, therefore cannot be read by third parties.