Privacy notice

1. Privacy at a glance

The following information gives an overview of what happens to your personal data when you visit this website. Personal data means information that can identify you personally. Further details are provided in the sections below.

The website operator processes data on this website. Contact details are given under “Controller” below. Some data is provided by you, for example through a contact form. Other data is collected automatically, or after your consent, by our IT systems when you visit. This is mainly technical data, such as browser, operating system or time of access.

Some data is collected to ensure the website works correctly. Other data may be used to analyse user behaviour. You may request free information about the origin, recipients and purpose of stored personal data, and request correction or deletion. Consent may be withdrawn for the future at any time. In certain circumstances you may request restriction of processing. You also have a right to complain to the competent supervisory authority. Please contact us with questions about these rights or data protection.

2. Hosting

Our website content is hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (“All-Inkl”). Details: All-Inkl privacy information.

Use of All-Inkl is based on Article 6(1)(f) GDPR, reflecting our legitimate interest in reliable website provision. Where relevant consent has been requested, processing is based exclusively on Article 6(1)(a) GDPR and section 25(1) TDDDG insofar as consent covers storing cookies or accessing information on your device, such as device fingerprinting. Consent may be withdrawn at any time.

We have concluded a data processing agreement with this provider. This legally required agreement ensures that it processes website visitors’ personal data only on our instructions and in accordance with the GDPR.

3. General information and mandatory disclosures

We treat your personal data confidentially and in accordance with data protection legislation and this statement. This statement explains which data is collected, how it is used and for what purposes. Internet data transmission, including email, may have security gaps. Complete protection against third-party access cannot be guaranteed.

Controller

The controller identified in the published statement is:
Stat-X Deutschland GmbH
Schivelbeiner Strasse 48
10439 Berlin, Germany
Telephone: +49 30 4471 9701
Email: mailbox.de@stat-x.biz

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data, such as names or email addresses.

Retention period

Unless a more specific period is stated here, personal data remains with us until its processing purpose no longer applies. If you make a valid deletion request or withdraw consent, data is deleted unless other legally permissible grounds for retaining it exist, such as tax or commercial retention requirements. In that case it is deleted once those grounds cease.

Legal bases for processing

Where you consent, we process data under Article 6(1)(a) GDPR, or Article 9(2)(a) where special categories of data are involved. Express consent to transfer data to third countries also provides a basis under Article 49(1)(a) GDPR. Consent to storing cookies or accessing information on your device also provides a basis under section 25(1) TDDDG and may be withdrawn at any time.

Data required for a contract or pre-contractual measures is processed under Article 6(1)(b) GDPR. Processing needed to comply with legal obligations is based on Article 6(1)(c). Processing may also be based on our legitimate interests under Article 6(1)(f). The applicable basis in each case is explained below.

Recipients of personal data

We work with external parties in our business activities. Data is disclosed only where necessary to perform a contract, required by law, justified by a legitimate interest under Article 6(1)(f) GDPR, or permitted by another legal basis. Processors receive data only under a valid data processing agreement. Where there is joint controllership, a joint-controller agreement is concluded.

Withdrawal of consent

Many processing operations require your express consent. You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

Right to object, including to direct marketing (Article 21 GDPR)

If processing is based on Article 6(1)(e) or (f) GDPR, you may object at any time on grounds relating to your particular situation, including to profiling based on those provisions. The applicable legal basis is stated in this privacy notice. Following an objection, we will no longer process the affected data unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or processing serves the establishment, exercise or defence of legal claims.

If your personal data is processed for direct marketing, you may object at any time to processing for that purpose, including profiling insofar as related to direct marketing. Following your objection, the data will no longer be used for direct marketing.

Right to lodge a complaint

If the GDPR is infringed, you may complain to a supervisory authority, particularly in the Member State of your habitual residence, place of work or the alleged infringement. This right is without prejudice to other administrative or judicial remedies.

Data portability

You may receive data we process automatically on the basis of consent or to perform a contract in a commonly used, machine-readable format, or have it transmitted to a third party. Direct transmission to another controller occurs only where technically feasible.

Access, correction and deletion

Within the applicable statutory provisions, you may obtain free information about your stored personal data, its origin and recipients and the purpose of processing, and request correction or deletion where applicable. Contact us with questions about personal data.

Restriction of processing

You may request restriction in the following circumstances: while we verify data whose accuracy you dispute; if processing is unlawful and you request restriction instead of deletion; if we no longer need the data but you need it to establish, exercise or defend legal claims; or while it is being determined whether our legitimate grounds override yours following an Article 21(1) objection.

Restricted data may, apart from storage, be processed only with your consent, for legal claims, to protect another person’s rights, or for important public-interest reasons of the EU or a Member State.

SSL or TLS encryption

This website uses SSL or TLS encryption for security and to protect confidential transmissions, such as orders or enquiries. An encrypted connection is indicated by “https://” and the browser’s security indicator. Data transmitted through an encrypted connection cannot be read by third parties in transit.

Objection to unsolicited advertising emails

We object to the use of contact details published to fulfil legal notice obligations for unsolicited advertising or information. The operators reserve the right to take legal action against unsolicited advertising, including spam.

4. Data collection on this website – cookies

Cookies are small data files and do not damage your device. Session cookies are deleted at the end of your visit. Persistent cookies remain until you or your browser deletes them. Cookies may be set by us or by third parties. Third-party cookies enable certain third-party services, such as payment processing.

Cookies serve different purposes. Some are technically necessary for functions such as shopping baskets or videos; others may analyse behaviour or serve advertising. Cookies required for electronic communication, requested functions or website optimisation are stored under Article 6(1)(f) GDPR unless another basis is stated. We have a legitimate interest in technically correct and optimised provision. Where consent is requested, processing occurs exclusively under Article 6(1)(a) GDPR and section 25(1) TDDDG; consent can be withdrawn at any time.

You can configure your browser to notify you about cookies, permit them case by case, reject them in specified cases or generally, and delete them automatically when closing the browser. Disabling cookies may limit website functionality. The cookies and services used are described in this statement.

Server log files

The provider automatically records information transmitted by your browser: browser type and version, operating system, referrer URL, requesting host name, time of the server request and IP address. These data are not combined with other sources. Collection is based on Article 6(1)(f) GDPR and our legitimate interest in technically correct presentation and optimisation of the website.

Contact form

When you send an enquiry through the contact form, the information and contact details you provide are stored to process it and any follow-up questions. We do not disclose these data without your consent.

Processing is based on Article 6(1)(b) GDPR if the request relates to a contract or pre-contractual measures. Otherwise it is based on our legitimate interest in effectively handling enquiries under Article 6(1)(f), or your consent under Article 6(1)(a) where requested. Consent may be withdrawn at any time.

Data remains until you request deletion, withdraw consent to storage, or the purpose no longer applies, for example after the enquiry has been completed. Mandatory statutory provisions, particularly retention periods, remain unaffected.

Enquiries by email, telephone or fax

Your enquiry and the personal data it contains, such as your name and request, are stored and processed to handle your concern. We do not disclose these data without consent. The legal bases are Article 6(1)(b) GDPR for contractual or pre-contractual requests, Article 6(1)(f) for our legitimate interest in effective enquiry handling, or Article 6(1)(a) where consent is requested. Consent is withdrawable at any time.

Data remains until you request deletion, withdraw consent or the storage purpose no longer applies. Mandatory statutory retention requirements remain unaffected.

5. Newsletters

To receive a newsletter, you must provide an email address and information enabling us to verify that you own it and consent to receiving the newsletter. Other data is not collected or is voluntary. These data are used exclusively to send the requested information and are not disclosed to third parties.

Processing of newsletter registration data is based exclusively on consent under Article 6(1)(a) GDPR. You may withdraw consent to storing and using your data and email address at any time, for example through the unsubscribe link. Withdrawal does not affect earlier lawful processing.

Newsletter data is retained by us or the mailing provider until you unsubscribe or the purpose ends, then deleted from the distribution list. We may remove or block addresses at our discretion within our legitimate interest under Article 6(1)(f). Data stored for other purposes remains unaffected.

After unsubscribing, your address may be retained in a blacklist to prevent future mailings where necessary. It is used only for that purpose and is not combined with other data. This serves your interest and our legitimate interest in compliance with newsletter laws under Article 6(1)(f). Blacklist retention is not time-limited. You may object if your interests override our legitimate interest.

Newsletters to existing customers

If you order goods or services and provide an email address, we may subsequently use it for newsletters if we inform you in advance. Such messages advertise only our own similar goods or services. You may unsubscribe at any time using the link in each newsletter. The legal basis is Article 6(1)(f) GDPR together with section 7(3) UWG.

After unsubscribing, your address may be retained indefinitely in a blacklist solely to prevent future mailings, without combination with other data. This serves your interest and our legitimate interest in compliance under Article 6(1)(f). You may object if your interests outweigh ours.

6. Plugins and tools – YouTube with enhanced privacy

This website embeds YouTube videos. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Visiting a page with embedded YouTube establishes a connection to its servers and informs YouTube which page you visited. If you are signed in to YouTube, your browsing behaviour can be associated with your profile; signing out prevents this association.

We use enhanced privacy mode. According to YouTube, videos viewed in this mode are not used to personalise browsing on YouTube, and associated advertisements are not personalised. Cookies are not set in this mode; however, local-storage elements may be used that store personal information and enable recognition in a similar way. Details: YouTube enhanced privacy mode. Further processing outside our control may occur after activating a video.

YouTube is used in the interest of presenting our online content attractively, a legitimate interest under Article 6(1)(f) GDPR. Where consent has been requested, processing is based exclusively on Article 6(1)(a) GDPR and section 25(1) TDDDG insofar as consent covers cookies or access to device information. Consent can be withdrawn at any time.

Further information: Google privacy policy. The published German statement records Google’s certification under the EU–US Data Privacy Framework (DPF), an arrangement for compliance with European data protection standards when processing in the USA. Provider details: Data Privacy Framework entry.

7. eCommerce and payment providers – customer and contract data

We collect, process and use personal customer and contract data to establish, structure and modify contractual relationships. Data about use of this website is processed only insofar as necessary to enable or charge for use of the service. The legal basis is Article 6(1)(b) GDPR.

Customer data is deleted after completion of the order or termination of the business relationship and expiry of applicable statutory retention periods. Statutory retention requirements remain unaffected.