Privacy Notice

1. Data protection at a glance

General information
The following notes provide a simple overview of what happens to your personal data when you visit this website or our stores. Personal data are all data with which you can be personally identified. For detailed information on data protection, please refer to our data protection notes listed below this text.

2. Hosting

Bunny.net (CDN)
We use the content delivery network “Bunny.net”. The provider is BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia (hereinafter “Bunny.net”). Bunny.net is a globally distributed content delivery network. Technically, the information transfer between your browser and our website is routed via Bunny.net’s network. This allows us to increase the global availability and performance of our website and to serve as a filter between our servers and potentially malicious traffic from the internet. Bunny.net records your IP address, which is anonymised.

The use of Bunny.net is based on our legitimate interest in providing our web offering as reliably and securely as possible (Art. 6(1)(f) GDPR).

Further information on data protection at Bunny.net can be found here: https://bunny.net/privacy/.

We have concluded a data processing agreement (DPA) for the use of the service mentioned above. This is a contract required under data protection law that ensures that personal data of our website visitors are processed only on our instructions and in compliance with the GDPR.

JQUERY
JavaScript code from jquery.com (JSFoundation, Inc., Attn: Privacy Office, 1 Letterman Drive, San Francisco, CA 94129, USA) may be integrated on our pages.

The use of the JavaScript code from jquery.com is carried out in the interest of an attractive and fast presentation of our online offers. This represents a legitimate interest within the meaning of Art. 6(1)(f) GDPR.

When you visit our pages, a direct connection is established between your browser and the servers of jquery.com. jquery.com thereby receives the information that you are visiting our site with your IP address.

Further information on the handling of user data can be found in the privacy notices of the JSFoundation at: https://js.foundation/about/governance/privacy-policy

3. General notes and mandatory information

Data protection
The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with legal data protection regulations and this privacy notice.

If you use this website or buy items in our store, various personal data will be collected. Personal data are data with which you can be personally identified. This privacy notice explains which data we collect and what we use them for. It also explains how and for what purpose this happens.

Please note that data transmission over the internet (e.g. when communicating by e-mail) may have security vulnerabilities. Complete protection of data from access by third parties is not possible.

Note on the controller
The controller responsible for data processing on this website and in our stores is:

session GmbH & Co. KG
Wiesenstraße 2-6
69190 Walldorf
Telephone: +49 6227 603 0
E-mail: info@session.de

Legal succession / takeover of MP Musikhandel GmbH & Co. KG
MP Musikhandel GmbH & Co. KG (brand “Musik Produktiv”, online shop musik-produktiv.de including its language sub-shops, retail store in Ibbenbüren) has been merged into session GmbH & Co. KG; it was previously a 100% subsidiary. session GmbH & Co. KG is therefore the legal successor and assumes responsibility for the personal data previously collected by MP Musikhandel GmbH & Co. KG. These data will continue to be processed for the same purposes (in particular customer service, contract processing, warranty, accounting and service history). The legal basis for this is Art. 6(1)(b) and (f) GDPR (continuation of existing contractual and business relationships). There is no change of purpose incompatible with the original data collection. Existing consents – for example for receiving newsletters – remain valid within the scope of the legal succession; the affected persons will be informed separately about the change of owner.

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, e-mail addresses or similar).

Storage period
Unless a more specific storage period is stated within this privacy notice, your personal data will remain with us until the purpose for data processing ceases to apply. If you assert a legitimate request for deletion or revoke a consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. tax or commercial retention periods); in the latter case, deletion will take place after these reasons cease to apply.

General notes on the legal bases of data processing on this website
If you have given consent to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR if special categories of data pursuant to Art. 9(1) GDPR are processed. In the case of an express consent to the transfer of personal data to third countries, data processing also takes place on the basis of Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or access to information on your end device (e.g. via device fingerprinting), data processing is carried out additionally on the basis of § 25(1) TDDDG. Consent can be revoked at any time. If your data are necessary for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, we process your data if this is necessary to fulfil a legal obligation on the basis of Art. 6(1)(c) GDPR. Data processing may also be carried out on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. The specific legal bases applicable in individual cases are explained in the following paragraphs of this privacy notice.

Data protection officer
We have appointed a data protection officer for our company.

DEUDAT GmbH
Zehntenhofstr. 5b
65201 Wiesbaden
Telephone: +49 611 950008 40
E-mail: datenschutz@session.de

Website: https://www.deudat.de/home

Requests that are intended to reach only the data protection officer and not the data protection team should be sent to session@deudat.de.

Withdrawal of your consent to data processing
Many data processing operations are only possible with your express consent. You can withdraw any consent you have given at any time. The lawfulness of the data processing carried out up to the time of withdrawal remains unaffected by the withdrawal.

Right to object to data collection in specific cases and to direct advertising (Art. 21 GDPR)
If data processing is carried out on the basis of Art. 6(1)(e) or (f) GDPR, you may object to the processing of your personal data at any time for reasons arising from your particular situation; this also applies to profiling based on these provisions. The respective legal basis on which processing is based can be found in this privacy notice. If you object, we will no longer process your affected personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (objection pursuant to Art. 21(1) GDPR).

If your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such advertising; this also applies to profiling to the extent that it is related to such direct advertising. If you object, your personal data will no longer be used for direct advertising purposes (objection pursuant to Art. 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority
In the event of violations of the GDPR, data subjects have a right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or the place of the alleged infringement. This right to lodge a complaint is without prejudice to any other administrative or judicial remedy.

Right to data portability
You have the right to receive data that we process automatically on the basis of your consent or in fulfilment of a contract, in a commonly used, machine-readable format and to have these data transferred to another controller. If you request direct transmission to another controller, this will only be done to the extent technically feasible.

SSL or TLS encryption
For security reasons and to protect the transmission of confidential content, such as orders or inquiries that you send to us as site operators, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the change in the address line of the browser from "http://" to "https://" and by the padlock symbol in your browser line.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Encrypted payment transactions on this website
If there is an obligation to give us your payment data (e.g. account number for direct debit) after conclusion of a paid contract, this data is required for payment processing. Payment transactions via common payment methods (Visa/MasterCard, direct debit) are carried out exclusively via an encrypted SSL or TLS connection. You can recognise an encrypted connection by the change in the address line of the browser from "http://" to "https://" and by the padlock symbol in your browser line. With encrypted communication, your payment data that you transmit to us cannot be read by third parties.

Access, deletion and correction
Under the applicable legal provisions, you have the right at any time to obtain free information about your stored personal data, their origin and recipients and the purpose of the data processing and, if necessary, a right to correction or deletion of these data. For this purpose and for further questions on the subject of personal data, you can contact us at any time.

Right to restriction of processing
You have the right to request restriction of the processing of your personal data. You can contact us at any time for this purpose. The right to restriction of processing exists in the following cases:

If you dispute the accuracy of your personal data stored with us, we generally need time to verify this. For the duration of the verification, you have the right to request restriction of the processing of your personal data.
If the processing of your personal data was/ is unlawful, you may request restriction of processing instead of deletion.
If we no longer need your personal data, but you require them for the establishment, exercise or defence of legal claims, you have the right to request restriction of processing instead of deletion.
If you have filed an objection pursuant to Art. 21(1) GDPR, a balance must be made between your interests and ours. As long as it is not yet clear whose interests prevail, you have the right to request restriction of the processing of your personal data.
If you have restricted the processing of your personal data, these data may – apart from their storage – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or a Member State.

Objection to advertising e-mails

The use of contact data published within the framework of the imprint obligation for the purpose of sending unsolicited advertising and information materials is hereby objected to. The operators of the pages expressly reserve the right to take legal action in the event of unsolicited sending of advertising information, for example by spam e-mails.

4. Data collection on this website

Cookies
Our websites use so-called "cookies". Cookies are small text files and do not harm your end device. They are either temporarily stored for the duration of a session (session cookies) or permanently (persistent cookies) on your end device. Session cookies are automatically deleted after your visit. Persistent cookies remain stored on your device until you delete them yourself or until automatic deletion by your web browser takes place.

In some cases, cookies from third parties may also be stored on your device when you visit our site (third-party cookies). These enable us or you to use certain services of the third party (e.g. cookies for processing payment services). Cookies have different functions. Many cookies are technically necessary because certain website functions would not work without them (e.g. the shopping cart function or the display of videos). Other cookies are used to analyse user behaviour or to display advertising. Cookies that are necessary for the execution of the electronic communication process (necessary cookies) or to provide certain functions requested by you (functional cookies, e.g. for the shopping cart function) or to optimise the website (e.g. cookies for web audience measurement) are stored on the basis of Art. 6(1)(f) GDPR, unless another legal basis is stated. The site operator has a legitimate interest in storing cookies for the technically error-free and optimised provision of its services. If consent to the storage of cookies has been requested, the storage of the respective cookies is carried out exclusively on the basis of this consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG); consent can be revoked at any time.

You can set your browser so that you are informed about the setting of cookies and only allow cookies on a case-by-case basis, exclude the acceptance of cookies for certain cases or in general and activate the automatic deletion of cookies when closing the browser. Disabling cookies may restrict the functionality of this website.

If cookies from third parties or for analysis purposes are used, we will inform you separately in the context of this privacy notice and, if necessary, request your consent.

Consent with Usercentrics
This website uses the consent technology of Usercentrics to obtain your consent to the storage of certain cookies on your end device or the use of certain technologies and to document these in a data protection-compliant manner. The provider of this technology is Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Website: https://usercentrics.com/de/ (hereinafter "Usercentrics").

When you enter our website, the following personal data are transferred to Usercentrics:

Your consent(s) or the withdrawal of your consent(s)
Your IP address
Information about your browser
Information about your end device
Time of your visit to the website

Furthermore, Usercentrics stores a cookie in your browser to be able to assign the consents you gave or their withdrawal. The data collected in this way are stored until you request deletion from us, delete the Usercentrics cookie yourself or the purpose for storing the data ceases to apply. Mandatory statutory retention obligations remain unaffected.

The use of Usercentrics is intended to obtain the legally required consents for the use of certain technologies. The legal basis for this is Art. 6(1)(c) GDPR.

Data processing on behalf
We have concluded a data processing agreement (DPA) for the use of the service mentioned above. This is a contract required under data protection law that ensures that this service processes the personal data of our website visitors only on our instructions and in compliance with the GDPR.

Server log files
The provider of the pages automatically collects and stores information in so-called server log files that your browser automatically transmits to us. These are:

Browser type and browser version
Operating system used
Referrer URL
Hostname of the accessing computer
Time of the server request
IP address

A merging of these data with other data sources will not take place. The collection of these data is based on Art. 6(1)(f) GDPR. The site operator has a legitimate interest in the technically error-free presentation and optimisation of its website – for this purpose server log files must be recorded.

Enquiries by e-mail, telephone, fax or via contact form
If you contact us by e-mail, telephone, fax or via the contact form, your enquiry including all resulting personal data (name, enquiry) will be stored and processed by us for the purpose of processing your request. We will not pass on this data without your consent.

The processing of this data is carried out on the basis of Art. 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective processing of the enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR), if this has been requested. The data you send to us via contact enquiries will remain with us until you request deletion, revoke your consent to storage or the purpose for storing the data ceases to apply (e.g. after your request has been dealt with). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected. Registration on this website You can register on this website to use additional functions on the site. The data entered for this purpose will only be used by us for the purpose of using the respective offer or service for which you registered.

The mandatory information requested during registration must be provided completely. Otherwise we will refuse the registration. For important changes, for example to the scope of the offer or for technically necessary changes, we use the e-mail address provided during registration to inform you. The processing of the data entered during registration is carried out for the purpose of implementing the user relationship created by the registration and, if necessary, for initiating further contracts (Art. 6(1)(b) GDPR). The data collected during registration will be stored by us as long as you are registered on this website and will be deleted afterwards. Statutory retention periods remain unaffected.

5. Analysis tools and advertising

Google Tag Manager
We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The Google Tag Manager is a tool that allows us to integrate tracking or analytics tools and other technologies on our website. The Google Tag Manager itself does not create user profiles, does not store cookies and does not perform independent analyses. It only serves to manage and deploy the tools integrated through it. However, the Google Tag Manager does record your IP address, which can also be transferred to Google's parent company in the United States.

The use of Google Tag Manager is based on Art. 6(1)(f) GDPR. The site operator has a legitimate interest in the quick and uncomplicated integration and management of various tools on its website. If the relevant consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TDDDG, insofar as consent covers the storage of cookies or access to information on the user's end device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.

The company holds a certification under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US aimed at ensuring compliance with European data protection standards for data processing in the US. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt000000001L5AAI&status=Active

Google Analytics
This website uses functions of the web analytics service Google Analytics. Provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the site operator to analyse the behaviour of website visitors. The site operator receives various usage data, such as page views, dwell time, operating systems used and the origin of the user. These data may be combined by Google into a profile that is assigned to the respective user or their device.

Furthermore, we may use Google Analytics to record your mouse and scrolling movements and clicks. Google Analytics also uses various modelling approaches to supplement the data sets collected and uses machine learning technologies in the data analysis.

Google Analytics uses technologies that allow users to be recognised again for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is usually transferred to a Google server in the USA and stored there.

The use of this service is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. Consent can be revoked at any time. Data transfer to the USA is based on the European Commission’s standard contractual clauses. Details can be found here:https://privacy.google.com/businesses/controllerterms/mccs/.

IP anonymisation
We have enabled IP anonymisation on this website. As a result, your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before transmission to the USA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activities and to provide other services related to website usage and internet usage to the site operator. The IP address transmitted by your browser to Google within the scope of Google Analytics will not be merged with other Google data.

Browser plugin
You can prevent Google from collecting and processing your data by downloading and installing the browser plugin available under the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

More information on the handling of user data by Google Analytics can be found in Google's privacy notices: https://support.google.com/analytics/answer/6004245?hl=de.

Data processing on behalf
We have concluded a processing agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

Demographic characteristics in Google Analytics
This website uses the "demographic characteristics" function of Google Analytics to be able to display appropriate ads to website visitors within the Google advertising network. This enables reports to be generated that contain statements about the age, gender and interests of site visitors. These data come from interest-based advertising from Google and visitor data from third-party providers. These data cannot be assigned to any specific person. You can disable this function at any time via the ad settings in your Google account or generally prevent the collection of your data by Google Analytics as described in the section "Objection to data collection".

Google Analytics E-Commerce Tracking
This website uses the "E-Commerce Tracking" feature of Google Analytics. With the help of E-Commerce Tracking, the site operator can analyse the purchasing behaviour of website visitors to improve its online marketing campaigns. Information such as orders placed, average order values, shipping costs and the time from viewing to purchase of a product are recorded. These data can be aggregated by Google under a transaction ID that is assigned to the respective user or their device.

Storage period
Data stored by Google on a user and event level that are linked to cookies, user identifiers (e.g. User ID) or advertising IDs (e.g. DoubleClick cookies, Android advertising ID) are anonymised or deleted after 14 months. Details can be found at the following link: https://support.google.com/analytics/answer/7667196?hl=de

Clarity
This website uses Clarity. Provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 (USA), https://docs.microsoft.com/en-us/clarity/ (hereinafter "Clarity").

Clarity is a tool for analysing user behaviour on this website. Clarity records, in particular, mouse movements and produces a graphical representation of which parts of the website users scroll to most often (heatmaps). Clarity can also record sessions so that we can view page usage in the form of videos. We also receive information about general user behaviour within our website.

Clarity uses technologies that allow the user to be recognised again for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting). Your personal data are stored on Microsoft's servers (Microsoft Azure Cloud Service) in the USA.

The use of Clarity is based on Art. 6(1)(f) GDPR. The site operator has a legitimate interest in effective user analysis. If the relevant consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TDDDG, insofar as consent covers the storage of cookies or access to information on the user's end device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time. Further details on Clarity's data protection can be found here: https://docs.microsoft.com/en-us/clarity/faq.

Data processing on behalf
We have concluded a data processing agreement (DPA) with the provider mentioned above. This is a contract required under data protection law that ensures that the provider processes the personal data of our website visitors only on our instructions and in compliance with the GDPR.

Google Ads
The site operator uses Google Ads. Google Ads is an online advertising programme of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads allows us to display advertisements in the Google search engine or on third-party websites when the user enters certain search terms in Google (keyword targeting). In addition, targeted ads can be shown based on the user data held by Google (e.g. location data and interests) (audience targeting). As the site operator, we can quantitatively analyse these data, for example by analysing which search terms led to the display of our advertisements and how many ads led to corresponding clicks.

The use of this service is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. Consent can be revoked at any time. Data transfer to the USA is based on the European Commission’s standard contractual clauses. Details can be found here: https://policies.google.com/privacy/frameworks and https://privacy.google.com/businesses/controllerterms/mccs/ .

Google Ads remarketing
This website uses the functions of Google Ads remarketing. Provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

With Google Ads remarketing we can assign people who interact with our online offering to specific audiences in order to show them interest-based advertising in the Google advertising network (remarketing or retargeting).

In addition, advertising audiences created with Google Ads remarketing can be linked to Google's cross-device capabilities. This means that interest-based, personalised advertising messages that were tailored to you on one device (e.g. mobile phone) based on your previous usage and browsing behaviour can also be displayed on another of your devices (e.g. tablet or PC).

If you have a Google account, you can object to personalised advertising at the following link: https://www.google.com/settings/ads/onweb/.

The use of this service is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. Consent can be revoked at any time.

Further information and the privacy policy can be found in Google's privacy policy at: https://policies.google.com/technologies/ads?hl=de.

Google Conversion Tracking
This website uses Google conversion tracking. Provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

With the help of Google conversion tracking, Google and we can determine whether the user has performed certain actions. For example, we can evaluate which buttons on our website are clicked how often and which products are viewed or purchased particularly often. This information is used to create conversion statistics. We learn the total number of users who clicked on our ads and which actions they performed. We do not receive any information that would allow us to personally identify the user. Google itself uses cookies or similar recognition technologies for identification.

The use of this service is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. Consent can be revoked at any time.

More information about Google conversion tracking can be found in Google's privacy policy: https://policies.google.com/privacy?hl=de.

Google DoubleClick
This website uses functions of Google DoubleClick. Provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter "DoubleClick").

DoubleClick is used to display interest-based advertisements to you throughout the Google advertising network. The advertisements may be tailored to the interests of the respective viewer using DoubleClick. For example, our advertising can be displayed in Google search results or in advertising banners that are connected with DoubleClick.

In order to show users interest-based advertising, DoubleClick must be able to recognise the respective viewer again and assign their visited websites, clicks and other information about user behaviour to them. To do this, DoubleClick uses cookies or comparable recognition technologies (e.g. device fingerprinting). The information collected is summarised into a pseudonymous user profile in order to display interest-based advertising to the user concerned.

The use of this service is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. Consent can be revoked at any time.

Further information on objection options against ads displayed by Google can be found at the following links: https://policies.google.com/technologies/ads and https://adssettings.google.com/authenticated.

Meta Pixel (formerly Facebook Pixel)
This website uses visitor action pixels from Facebook/Meta for conversion measurement. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. According to Facebook, the data collected are also transferred to the USA and to other third countries.

This allows the behaviour of site visitors to be tracked after they have been redirected to the provider's website via a click on a Facebook ad. This makes it possible to evaluate the effectiveness of Facebook ads for statistical and market research purposes and to optimise future advertising activities.

The data collected are anonymous to us as the operator of this website; we cannot draw conclusions about the identity of users. However, the data are stored and processed by Facebook, so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes in accordance with the Facebook Data Use Policy (https://de-de.facebook.com/about/privacy/). This enables Facebook to allow advertising to be placed on Facebook pages as well as outside of Facebook. This use of the data cannot be influenced by us as the site operator.

The use of this service is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. Consent can be revoked at any time.

Where personal data are collected on our website using the tool described here and forwarded to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art. 26 GDPR). The joint responsibility is limited exclusively to the collection of the data and their transmission to Facebook. The processing carried out by Facebook after forwarding is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in a joint processing agreement. You can find the wording of the agreement at: https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for providing the privacy information when using the Facebook tool and for the data-protection-compliant implementation of the tool on our website. Facebook is responsible for the data security of Facebook products. Data subject rights (e.g. requests for information) regarding the data processed by Facebook can be asserted directly with Facebook. If you assert data subject rights with us, we are obliged to forward them to Facebook.

Data transfer to the USA is based on the European Commission's standard contractual clauses. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

Further information about protecting your privacy can be found in Facebook's data protection notices: https://de-de.facebook.com/about/privacy/.

You can also deactivate the remarketing feature "Custom Audiences" in the ad settings at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. You must be logged into Facebook to do this.

If you do not have a Facebook account, you can opt out of usage-based advertising from Facebook on the website of the European Interactive Digital Advertising Alliance: http://www.youronlinechoices.com/de/praferenzmanagement/.

We use the web analytics service Hotjar on our website provided by Hotjar Ltd. (Level 2, St Julian's Business Centre, 3, Elia Zammit Street, St Julian’s STJ 1000, Malta). Hotjar helps us to better understand user behaviour (e.g. clicks, mouse movements, scroll depth) to make our website more user-friendly. Using technologies such as heatmaps and session replays, we obtain anonymised insights into the interactions of our visitors.

Hotjar stores information such as:

IP address of the device (in anonymised form)
Screen size
Device type and browser information
Geographical location (country only)
Preferred language
Visited pages and date/time of access

Important: Hotjar does not store any personal data such as names, e-mail addresses or payment information. In addition, no inputs in form fields are recorded or stored.

The legal basis for the data processing is your consent pursuant to Art. 6(1)(a) GDPR, which you grant via our consent management tool and can withdraw at any time.

If you do not want your data to be collected by Hotjar, you can opt out of Hotjar via the following link:
https://www.hotjar.com/legal/compliance/opt-out

Further information on data processing by Hotjar can be found in Hotjar's privacy policy:
https://www.hotjar.com/legal/policies/privacy

Trusted Shops
We work with Trusted Shops GmbH, Subbelrather Str. 15c, 50823 Cologne, to evaluate our products and services as well as the online shopping experience.

If you have activated a corresponding checkbox or clicked the "Rate later" button, we transmit your e-mail address for the reminder to leave a review of your purchase to Trusted Shops GmbH so that they can remind you by e-mail of the opportunity to leave a review.

Further information on the handling of user data can be found in Trusted Shops' privacy notices at: https://www.trustedshops.de/impressum-datenschutz/#datenschutz.

The legal basis for using the review reminder is Art. 6(1)(a) GDPR.

We use the review function to analyse the use of our webshop and to be able to improve it regularly. From the statistics obtained we can improve our offering and make it more attractive for you as a user.

The data will be deleted as soon as they are no longer necessary for the purpose for which they were collected. The user's e-mail address is therefore stored for this purpose until a review has been submitted or a withdrawal has taken place.

Your consent given by activating the checkbox or clicking the "Rate later" button can be revoked at any time by sending us a message or directly to Trusted Shops with effect for the future. Withdrawal of consent does not affect the legality of the processing carried out on the basis of the consent. If you revoke your consent, we will delete or have these data deleted and will not send you any more reminder e-mails.

Microsoft Advertising
We use Microsoft Advertising, an advertising service from Microsoft Corporation, to display targeted advertising for our products and services. Microsoft Advertising uses cookies and similar technologies to collect information about your activities on our website and to present you with relevant ads on other websites and platforms. Personally identifiable information such as your name, address or e-mail address is not collected in this process.

The data collected are used solely to better understand your interest in our products and services and to show you relevant advertising. You have the option at any time to object to data collection by Microsoft Advertising by adjusting your browser settings or accessing Microsoft Advertising's opt-out option.

The legal basis for using the review reminder is Art. 6(1)(a) GDPR.

The privacy notices can be found here https://about.ads.microsoft.com/de-de/policies/legal-privacy-and-security.

6. Social media

Data processing by social networks
We maintain publicly accessible profiles on social networks. The social networks used by us in detail can be found further below.

Social networks such as Facebook, Twitter etc. can usually extensively analyse your user behaviour when you visit their website or a website with integrated social media content (e.g. like buttons or advertising banners). Visiting our social media presences triggers numerous data processing operations relevant to data protection.

In detail:
If you are logged into your social media account and visit our social media presence, the operator of the social media portal may assign this visit to your user account. Your personal data may also be collected if you are not logged in or do not have an account with the respective social media portal. In this case, data collection takes place for example via cookies stored on your device or by recording your IP address.

With the help of the data collected in this way, the operators of the social media portals can create user profiles in which your preferences and interests are stored. In this way, interest-based advertising can be displayed to you inside and outside the respective social media presence. If you have an account with the respective social network, the interest-based advertising can be displayed on all devices on which you are logged in or have been logged in.

Please also note that we cannot trace all processing operations on the social media portals. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media portals. For details, please refer to the terms of use and privacy policies of the respective social media portals.

Legal basis
Our social media presences are intended to ensure the most comprehensive possible presence on the internet. This is a legitimate interest within the meaning of Art. 6(1)(f) GDPR. The analysis processes initiated by the social networks may be based on different legal bases which are indicated by the operators of the social networks (e.g. consent within the meaning of Art. 6(1)(a) GDPR).

Controller and asserting rights
If you visit one of our social media profiles (e.g. Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered by this visit. You can in principle assert your rights (information, rectification, deletion, restriction of processing, data portability and complaint) both against us and against the operator of the respective social media portal (e.g. against Facebook).

Please note that despite the joint responsibility with the social media portal operators, we do not have full influence over the data processing operations of the social media portals. Our options are largely determined by the corporate policy of the respective provider.

Storage period
Data collected directly by us via the social media presence will be deleted from our systems as soon as you request deletion, withdraw your consent to storage or the purpose for which the data are stored ceases to apply. Stored cookies remain on your device until you delete them. Mandatory statutory provisions – in particular retention periods – remain unaffected. We have no influence on the storage period of your data which are stored by the operators of the social networks for their own purposes. For details, please refer directly to the operators of the social networks (e.g. in their privacy notices, see below).

Social networks in detail:

Facebook
We have a profile on Facebook. The provider of this service is Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. According to Facebook, the data collected are also transferred to the USA and to other third countries. We have concluded a controller addendum with Facebook. This agreement sets out which data processing operations we or Facebook are responsible for when you visit our Facebook page. You can view this agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum.

You can adjust your advertising settings yourself in your user account. Click on the following link and log in: https://www.facebook.com/settings?tab=ads.

Data transfer to the USA is based on the European Commission’s standard contractual clauses. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

Details can be found in Facebook's privacy notices: https://www.facebook.com/about/privacy/.

Twitter
We use the microblogging service Twitter. Provider is Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland.

You can adjust your Twitter privacy settings yourself in your user account. Click on the following link and log in: https://twitter.com/personalization.

Data transfer to the USA is based on the European Commission’s standard contractual clauses. Details can be found here: https://gdpr.twitter.com/en/controller-to-controller-transfers.html.

Details can be found in Twitter's privacy notices: https://twitter.com/de/privacy.

Instagram
We have a profile on Instagram. Provider is Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA.

Data transfer to the USA is based on the European Commission’s standard contractual clauses. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://help.instagram.com/519522125107875 and https://de-de.facebook.com/help/566994660333381.

Details on how they handle your personal data can be found in Instagram's privacy notices: https://help.instagram.com/519522125107875.

YouTube
We have a profile on YouTube. Provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Details on how they handle your personal data can be found in YouTube's privacy notices: https://policies.google.com/privacy?hl=de.

7. Newsletter

Newsletter data
If you would like to receive the newsletter offered on the website, we need an e-mail address from you and information that allows us to check that you are the owner of the specified e-mail address and agree to receive the newsletter. No further data will be collected except on a voluntary basis. For the handling of the newsletter we use newsletter service providers described below.

Agillic
This website uses Agillic for sending newsletters. Provider is Agillic A/S, Masnedøgade 22, 2100 Copenhagen Ø., Denmark (hereinafter "Agillic"). Agillic is a service that organises and analyses newsletter dispatch. The data you enter for the newsletter (e.g. e-mail address) are stored on Agillic's servers.

Data analysis by Agillic
Newsletters sent by us with Agillic allow us to analyse the behaviour of newsletter recipients. Among other things, it is possible to analyse how many recipients opened the newsletter and how often which link in the newsletter was clicked. Using so-called conversion tracking, it is also possible to analyse whether a predefined action (e.g. purchase of a product on this website) was taken after clicking the link in the newsletter.

Data processing is based on your consent (Art. 6(1)(a) GDPR). You can revoke this consent at any time by unsubscribing from the newsletter. The lawfulness of the data processing already carried out remains unaffected by the revocation.

If you do not want analysis by Agillic, you must unsubscribe from the newsletter. For this purpose we provide an appropriate link in each newsletter message.

The data you provide to us for the purpose of receiving the newsletter will be stored by us until you unsubscribe from the newsletter with us or the newsletter service provider and will be deleted from the newsletter distribution list after unsubscribing. Data stored for other purposes will remain unaffected.

After you have unsubscribed from the newsletter distribution list, your e-mail address will possibly be stored with us or the newsletter service provider in a blacklist if this is necessary to prevent future mailings. The data from the blacklist will be used only for this purpose and will not be merged with other data. This serves both your interest and our interest in complying with the legal requirements for sending newsletters (legitimate interest within the meaning of Art. 6(1)(f) GDPR). The storage in the blacklist is not limited in time. You can object to the storage if your interests outweigh our legitimate interest.

Further information can be found in Agillic's privacy policy at: https://agillic.com/de/datenschutzhinweise/

We have concluded a data processing agreement (DPA) for the use of the service mentioned above. This is a contract required under data protection law that ensures that this service processes the personal data of our website visitors only on our instructions and in compliance with the GDPR.

Legal basis
Data processing is based on your consent (Art. 6(1)(a) GDPR). You can revoke this consent at any time. The lawfulness of the data processing already carried out remains unaffected by the revocation.

Storage period
The data you provide to us for the purpose of receiving the newsletter will be stored by us until you unsubscribe from the newsletter with us or the newsletter service provider and will be deleted from the newsletter distribution list after unsubscribing. Data stored for other purposes will remain unaffected.

After you have unsubscribed from the newsletter distribution list, your e-mail address will possibly be stored with us or the newsletter service provider in a blacklist to prevent future mailings. The data from the blacklist will be used only for this purpose and will not be merged with other data. This serves both your interest and our interest in complying with the legal requirements for sending newsletters (legitimate interest within the meaning of Art. 6(1)(f) GDPR). The storage in the blacklist is not limited in time. You can object to the storage if your interests outweigh our legitimate interest. Further information can be found in Rapidmail's security information at: https://www.rapidmail.de/datensicherheit.

We have concluded a data processing agreement (DPA) with the provider mentioned above. This is a contract required under data protection law that ensures that this provider processes the personal data of our website visitors only on our instructions and in compliance with the GDPR.

8. Plugins and tools

YouTube with extended data protection
This website embeds videos from YouTube. The operator of the pages is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

We use YouTube in extended data protection mode. According to YouTube, this mode ensures that YouTube does not store information about visitors on this website before they watch the video. However, the forwarding of data to YouTube partners is not necessarily excluded by the extended data protection mode. Thus, YouTube – regardless of whether you watch a video – establishes a connection to the Google DoubleClick network.

As soon as you start a YouTube video on this website, a connection to YouTube's servers is established. The YouTube server is informed about which of our pages you have visited.

If you are logged into your YouTube account, you enable YouTube to directly assign your surfing behaviour to your personal profile. You can prevent this by logging out of your YouTube account. In addition, YouTube may store various cookies on your device or use similar recognition technologies (e.g. device fingerprinting) after you start a video. In this way YouTube can obtain information about visitors to this website. This information is used, among other things, to collect video statistics, to improve user friendliness and to prevent fraud attempts. Possibly, further data processing operations may be triggered after starting a YouTube video, over which we have no influence. The use of YouTube is in the interest of an attractive presentation of our online offers. This represents a legitimate interest within the meaning of Art. 6(1)(f) GDPR. If the relevant consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TDDDG, insofar as consent covers the storage of cookies or access to information on the user's end device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.

More information about data protection at YouTube can be found in their privacy notices at: https://policies.google.com/privacy?hl=de.

Google Maps
This site uses the mapping service Google Maps. Provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

To use the functions of Google Maps, it is necessary to store your IP address. This information is usually transmitted to a Google server in the USA and stored there. The provider of this site has no influence on this data transmission. When Google Maps is activated, Google may use Google Web Fonts for the uniform display of fonts. When calling up Google Maps, your browser loads the required web fonts into its browser cache in order to display texts and fonts correctly. The use of Google Maps is in the interest of an appealing presentation of our online offers and an easy findability of the places we have indicated on the website. This represents a legitimate interest within the meaning of Art. 6(1)(f) GDPR. If the relevant consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TDDDG, insofar as consent covers the storage of cookies or access to information on the user's end device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.

Data transfer to the USA is based on the European Commission’s standard contractual clauses. Details can be found here: https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

More information on the handling of user data can be found in Google's privacy notices: https://policies.google.com/privacy?hl=de.

Google reCAPTCHA
To prevent spam and other undesirable activities, we use Google reCAPTCHA on our website. Google reCAPTCHA is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

When our website is accessed, your IP address is transmitted to Google. Google uses this IP address to determine your geographical origin. In addition, your behaviour on our website is analysed. This is necessary to determine whether it is a bot or a human.

The processing of this data is carried out by Google on servers in the USA. Google has nevertheless committed to processing the personal data of users from the EU and the EEA in accordance with the requirements of the GDPR.

The data are stored by Google for a period of 6 months and then deleted.

Userlike with extended privacy mode
To handle user enquiries via our support channels or via live chat systems we use Userlike (hereinafter: "Userlike"). Provider is Userlike UG (limited liability), Probsteigasse 44 – 46, 50670 Cologne.

Messages you send to us may be stored in the Userlike ticket system or answered by our staff in the live chat. If you communicate with us via Userlike, Userlike and we store, among other things, your name and e-mail address if you have provided them and your chat histories. These data are compiled into a profile. Messages addressed to us remain with us until you request deletion or the purpose for storing the data ceases to apply (e.g. after your request has been dealt with). Mandatory statutory provisions – in particular retention periods – remain unaffected.

The use of Userlike is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the fastest, most reliable and efficient processing of your enquiries. If the relevant consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TDDDG, insofar as consent covers the storage of cookies or access to information on the user's end device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.

Userlike is based in the European Union but uses Amazon Web Services servers, so your data may also be transferred to the USA.

Further information is available in Userlike's privacy notices: https://www.userlike.com/de/data-privacy and https://www.userlike.com/de/blog/live-chat-software-datenschutz-dsgvo. We have concluded a data processing agreement (DPA) with the provider mentioned above. This is a contract required under data protection law that ensures that this provider processes the personal data of our website visitors only on our instructions and in compliance with the GDPR.

9. Online marketing and partner programmes

Affiliate programmes on this website
The site operator participates in affiliate partner programmes. If you click on an advertisement on our website that participates in the partner programme and then carry out a transaction (e.g. a purchase), we receive a commission from our affiliate partners for this. For this purpose it is necessary that our affiliate partners can identify you and trace that you accessed the respective product via the advertisement placed with us and carried out the predefined transaction. For this purpose, our affiliate partners use cookies or comparable recognition technologies (e.g. device fingerprinting).

The storage and analysis of the data is based on Art. 6(1)(f) GDPR. The site operator has a legitimate interest in the correct calculation of its affiliate commission. If the relevant consent has been requested (e.g. consent to the storage of cookies), processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TDDDG, insofar as consent covers the storage of cookies or access to information on the user's end device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.

We participate in the following affiliate programmes:

AWIN
The operator of the affiliate network is AWIN AG, Eichhornstraße 3, 10785 Berlin (hereinafter: "AWIN"). We are jointly responsible with AWIN and possibly with the advertiser for the data processing in connection with the partner programme. The obligations incumbent on us jointly have been set out in a joint processing agreement. According to this agreement, you as a data subject can contact any of the controllers with your concern. The first contacted controller will answer your request. Each controller independently provides privacy information pursuant to Art. 13, 14 and 26 GDPR and takes the necessary measures to protect personal data and to comply with the other GDPR provisions in its company. The joint processing agreement can be found in AWIN's terms and conditions at the following link: https://s3.amazonaws.com/docs.awin.com/Legal/Publisher+Terms/2020/DE+Publisher+Terms+GDPR+Annex.pdf.

10. eCommerce and payment providers

Processing of data (customer and contract data)
We collect, process and use personal data only to the extent that they are necessary for establishing, shaping or changing the legal relationship (master data). This is carried out on the basis of Art. 6(1)(b) GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures. Personal data about the use of this website (usage data) are collected, processed and used only to the extent necessary to enable the user to use the service or to bill for it. The collected customer data are deleted after completion of the order or termination of the business relationship. Statutory retention periods remain unaffected.

Data transfer when concluding a contract for online shops, merchants and goods shipment
We only transmit personal data to third parties if this is necessary for contract processing, for example to companies involved in the delivery of goods or the bank entrusted with payment processing. Further transmission of the data will not take place or will only take place if you have expressly consented to the transmission. We do not pass on your data to third parties without your express consent, for example for advertising purposes. The legal basis for data processing is Art. 6(1)(b) GDPR.

Data transfer when concluding a contract for services and digital content
We only transmit personal data to third parties if this is necessary for contract processing, for example to the bank entrusted with payment processing.

Further transmission of the data will not take place or will only take place if you have expressly consented to the transmission. We do not pass on your data to third parties without your express consent, for example for advertising purposes.

The legal basis for data processing is Art. 6(1)(b) GDPR.

Credit checks
When purchasing on account or another payment method for which we provide a service in advance, we may carry out a credit check (scoring). For this purpose we transmit the data you have entered (e.g. name, address, age or bank details) to a credit reference agency. The probability of payment default is calculated on the basis of these data. If an excessively high payment default risk is determined, we may refuse the respective payment method.

The credit check is carried out on the basis of contract fulfilment (Art. 6(1)(b) GDPR) as well as to avoid payment defaults (legitimate interest pursuant to Art. 6(1)(f) GDPR). If consent has been obtained, the credit check is carried out on the basis of this consent (Art. 6(1) GDPR); consent can be revoked at any time.

Payment services
We integrate payment services from third parties on our website. If you make a purchase with us, your payment data (e.g. name, payment amount, bank details, credit card number) will be processed by the payment service provider for the purpose of payment processing. The respective contractual and privacy provisions of the individual providers apply to these transactions. The use of the payment service providers is carried out on the basis of Art. 6(1)(b) GDPR (contract processing) and in the interest of a smooth, comfortable and secure payment process (Art. 6(1)(f) GDPR). If consent is requested for certain actions, Art. 6(1)(a) GDPR is the legal basis for data processing; consents can be revoked at any time with effect for the future.

The following payment services/payment service providers are used on this website:

PayPal
The provider of this payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal"). Data transfer to the USA is based on the European Commission’s standard contractual clauses. Details can be found here: https://www.paypal.com/de/webapps/mpp/ua/pocpsa-full. Details can be found in PayPal's privacy notices: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Klarna
Provider is Klarna AB, Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter "Klarna"). Klarna offers various payment options (e.g. instalment payments). If you choose to pay with Klarna (Klarna checkout solution), Klarna will collect various personal data from you. Klarna uses cookies to optimise the use of the Klarna checkout solution. Details on the use of Klarna cookies can be found at the following link: https://cdn.klarna.com/1.0/shared/content/policy/cookie/de_de/checkout.pdf.

Details can be found in Klarna's privacy policy at the following link: https://www.klarna.com/de/datenschutz/.

Sofortüberweisung
The provider of this payment service is Sofort GmbH, Theresienhöhe 12, 80339 Munich (hereinafter "Sofort GmbH"). Using the "Sofortüberweisung" procedure, we receive a payment confirmation from Sofort GmbH in real time and can begin to fulfil our obligations immediately. If you have chosen the payment method "Sofortüberweisung", you transmit the PIN and a valid TAN to Sofort GmbH, with which it can log in to your online banking account. After logging in, Sofort GmbH automatically checks your account balance and carries out the transfer to us using the TAN you provided. It then immediately sends us a transaction confirmation. After logging in, your transactions, the credit limit of the overdraft facility and the existence of other accounts and their balances are also checked automatically. In addition to the PIN and TAN, the payment data you entered and data about your person are transmitted to Sofort GmbH. The data about your person include first and last name, address, telephone number(s), e-mail address, IP address and, if necessary, further data required for payment processing. The transmission of this data is necessary to unequivocally determine your identity and to prevent fraud. Details on payment with Sofortüberweisung can be found here: https://www.sofort.de/datenschutz.html and https://www.klarna.com/sofort/.

Amazon Pay
The provider of this payment service is Amazon Payments Europe S.C.A., 38 avenue J.F. Kennedy, L-1855 Luxembourg. Details on how your data are handled can be found in Amazon Pay's privacy notices at the following link: https://pay.amazon.de/help/201212490?ld=APDELPADirect.

Unzer
The provider of this payment service is Unzer GmbH, Vangerowstraße 18, 69115 Heidelberg (hereinafter "Unzer"). Details can be found in Unzer's privacy notices: https://www.unzer.com/de/datenschutz/.

Mastercard
The provider of this payment service is Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium (hereinafter "Mastercard"). Mastercard may transfer data to its parent company in the USA. Data transfer to the USA is based on Mastercard's Binding Corporate Rules.

Details can be found here: https://www.mastercard.de/de-de/datenschutz.html and https://www.mastercard.us/content/dam/mccom/global/documents/mastercard-bcrs.pdf.

VISA
The provider of this payment service is Visa Europe Services Inc., London branch, 1 Sheldon Square, London W2 6TT, United Kingdom (hereinafter "VISA").

Great Britain is considered a data-protection-safe third country. This means that the UK has a level of data protection equivalent to that of the European Union. VISA may transfer data to its parent company in the USA. Data transfer to the USA is based on the European Commission’s standard contractual clauses. Details can be found here: https://www.visa.de/nutzungsbedingungen/visa-globale-datenschutzmitteilung/mitteilung-zuzustandigkeitsfragen-fur-den-ewr.html. Further information can be found in VISA's privacy notices: https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html.

11. Audio and video conferences

Data processing
For communication with our customers we use, among others, online conference tools. The tools we use in detail are listed below. When you communicate with us by video or audio conference via the internet, your personal data are collected and processed by us and by the provider of the respective conferencing tool.

The conferencing tools record all data that you provide/use to use the tools (e-mail address and/or your telephone number). In addition, the conferencing tools process the duration of the conference, start and end (time) of participation in the conference, the number of participants and other "context information" related to the communication process (metadata).

Furthermore, the provider of the tool processes all technical data required to handle the online communication. This includes in particular IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or speaker as well as the type of connection.

If content is exchanged, uploaded or otherwise made available within the tool, these are also stored on the servers of the tool providers. Such content includes cloud recordings, chat/instant messages, voicemails, uploaded photos and videos, files, whiteboards and other information shared during use of the service.

Please note that we do not have full influence over the data processing operations of the tools used. Our options are largely determined by the corporate policy of the respective provider. Further information on data processing by the conference tools can be found in the privacy notices of the respective tools, which we have listed below this text.

Purpose and legal bases
The conferencing tools are used to communicate with prospective or existing contractual partners or to provide certain services to our customers (Art. 6(1)(b) GDPR). Furthermore, the use of the tools serves to simplify and accelerate communication with us and our company in general (legitimate interest within the meaning of Art. 6(1)(f) GDPR). To the extent consent has been requested, the use of the relevant tools is based on that consent; consent can be revoked at any time with effect for the future.

Storage period
Data directly collected by us via the video and conference tools will be deleted from our systems as soon as you request deletion, revoke your consent to storage or the purpose for storing the data ceases to apply. Stored cookies remain on your device until you delete them. Mandatory statutory retention periods remain unaffected.

We have no influence on the storage period of your data which are stored by the operators of the conference tools for their own purposes. For details, please refer directly to the operators of the conference tools.

Conference tools used

Microsoft Teams
We use Microsoft Teams. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Details on data processing can be found in Microsoft Teams' privacy statement: https://privacy.microsoft.com/de-de/privacystatement.

12. Own services

Handling of applicant data
We offer you the opportunity to apply to us (e.g. by e-mail, by post or via an online application form). We assure you that the collection, processing and use of your data will be carried out in accordance with applicable data protection law and all other statutory provisions and that your data will be treated as strictly confidential.

Scope and purpose of data collection
If you send us an application, we process the personal data associated with it (e.g. contact and communication data, application documents, notes in the context of job interviews, etc.) insofar as this is necessary to decide on the establishment of an employment relationship. The legal basis for this is § 26 BDSG under German law (initiation of an employment relationship), Art. 6(1)(b) GDPR (general contract initiation) and – if you have given consent – Art. 6(1)(a) GDPR. Consent can be revoked at any time. Your personal data will be passed on within our company only to persons involved in processing your application.

If the application is successful, the data you submitted will be stored in our data processing systems on the basis of § 26 BDSG and Art. 6(1)(b) GDPR for the purpose of carrying out the employment relationship.

Retention period of the data
If we are unable to make you a job offer, you decline a job offer or you withdraw your application, we reserve the right to retain the data you submitted on the basis of our legitimate interests (Art. 6(1)(f) GDPR) for up to 6 months from the end of the application process (rejection or withdrawal of the application). Afterwards the data will be deleted and any physical application documents will be destroyed. Storage is intended in particular for evidentiary purposes in the event of legal disputes. If it is apparent that the data will be required after the expiry of the 6-month period (e.g. due to an imminent or pending legal dispute), deletion will only take place when the purpose for further storage ceases to apply. Longer storage may also take place if you have given a corresponding consent (Art. 6(1)(a) GDPR) or if statutory retention obligations prevent deletion.

13. Services from partners

Piano tuning
For the tuning of acoustic pianos we use external partner companies. Your personal data will be transmitted to our partners solely for the purpose of carrying out and coordinating the tuning service. The transfer is carried out in accordance with applicable data protection laws and is limited to what is necessary to fulfil the order. Our partner companies are contractually obligated to treat your data confidentially and to use them exclusively for the purpose of providing the service.

Status: 06/2026