1 Introduction

We, Wortmann Fashion Retail GmbH & Co. KG, as the operator of the online service, are the data controller responsible for processing the personal data of users of the online service. You can find our contact information in the legal notice (Impressum) of the online service; the contact persons for questions regarding the processing of personal data are listed directly in this Privacy Policy.

We take the protection of your privacy and your personal data very seriously. We collect, store, and use your personal data solely in accordance with the terms of this Privacy Policy and applicable data protection regulations, in particular the European General Data Protection Regulation (GDPR) and national data protection laws.

Through this Privacy Policy, we inform you of the scope and purposes for which personal data is processed in connection with the use of our online services.

1.1 Personal Data

Personal data is information relating to an identified or identifiable natural person. This includes all information concerning your identity, such as your name, email address, or mailing address. Information that cannot be linked to your identity (such as, for example, statistical data on the number of users of the online service) is not considered personal data.

You can generally use our online service without revealing your identity or providing personal data. In this case, we collect only general information about your visit to our online service. However, for certain services we offer, we will collect personal data from you. We will then process this data primarily for the purpose of using this online service, in particular to provide the requested information. When collecting personal data, only the data that is strictly necessary must be provided. In addition, you may choose to provide other information, which is then provided on a voluntary basis. We will indicate in each case whether a field is required or optional. We will then provide you with specific details in the corresponding section of this Privacy Policy.

No automated decision-making based on your personal data takes place in connection with the use of our online services.

1.2 Processing of Personal Information

We store your information on highly secure servers located within the European Union. These servers are protected by technical and organizational measures against the loss, destruction, unauthorized access, alteration, or disclosure of your data by unauthorized persons. Access to your data is restricted to a limited number of authorized individuals. These individuals are responsible for the technical, commercial, or editorial support of the servers. However, despite regular checks, it is not possible to provide complete protection against all risks.

Your personal data is transmitted over the Internet in encrypted form. We use SSL (Secure Socket Layer) encryption for data transmission.

1.3 Disclosure of Personal Data to Third Parties

We generally use your personal information solely to provide the services you have requested. To the extent that we use external service providers in connection with the provision of services, their access to the data is also limited exclusively to the purpose of providing the service. Through technical and organizational measures, we ensure compliance with data protection requirements and also require our external service providers to comply with them.

Furthermore, we do not transfer data to third parties without your explicit consent, particularly not for advertising purposes. Your personal data will only be transferred if you yourself have consented to the transfer of data or to the extent that we are authorized or required to do so under legal provisions and/or administrative or judicial orders. This may include, in particular, providing information for the purposes of criminal prosecution, preventing hazards, or enforcing intellectual property rights.

To the extent that we transfer your personal data—either directly or through service providers—to countries outside the European Union, we comply with the specific requirements of Articles 44 et seq. of the GDPR in this regard and also require our service providers to comply with these regulations. We will therefore only transfer your data to countries outside the European Union if the level of protection guaranteed by the GDPR is ensured. This level of protection is ensured in particular by an adequacy decision of the European Commission or by appropriate safeguards in accordance with Article 46 of the GDPR.

1.4 Legal Bases for Data Processing

To the extent that we obtain consent for the processing of your personal data, Article 6(1)(a) of the GDPR serves as the legal basis for data processing.

To the extent that we process your personal data because it is necessary for the performance of a contract or in the context of a quasi-contractual relationship with you, Article 6(1)(b) of the GDPR constitutes the legal basis for data processing.

To the extent that we process your personal data to comply with a legal obligation, Article 6(1)(c) of the GDPR serves as the legal basis for the processing of your data.

Article 6(1)( f) of the GDPR is also considered the legal basis for data processing if the processing of your personal data is necessary to safeguard a legitimate interest of our company or a third party, and your interests, fundamental rights, and freedoms do not override the protection of personal data.

In this Privacy Policy, we always specify the legal basis on which we rely for the processing of your personal data.

1.5 Data Deletion and Retention Period

In principle, we delete or block your personal data as soon as the purpose for which it was retained no longer applies. However, data may be retained beyond this period if required by legal obligations to which we are subject, such as legal retention and documentation requirements. In such cases, we will delete or block your personal data once the relevant requirements have expired.

To delete your account, please contact our customer service at [email protected]

2 Use of Our Online Services

2.1 Information About Your Device

Each time you access our online service—regardless of whether you are registered—we collect the following information about your device: your device’s IP address, your browser’s request, and the time of that request. In addition, the status and the amount of data transferred as part of this request are recorded. We also collect information about the product and version of the browser used, as well as the device’s operating system. Furthermore, we record the website from which access to the online service occurred. Your device’s IP address is retained only for the duration of your use of the online service and is subsequently deleted or anonymized by truncation. The other data is retained for a limited period.

We use this data to operate the online service, in particular to detect and eliminate errors, to determine the usage rate of the online service, and to make adjustments or improvements. These purposes also constitute our legitimate interest in processing the data in accordance with Article 6(1)(f) of the GDPR.

2.2 Use of Cookies

Our online service—like many websites—uses cookies. Cookies are small text files that are stored on your device and record certain settings and data to be exchanged with our online service via your browser. A cookie typically contains the name of the domain from which the cookie file was sent, as well as information about the cookie’s age and an alphanumeric identifier.

Cookies allow us to recognize your device and immediately make any presets and preferences available. The cookies we use are—as far as possible—so-called session cookies, which are automatically deleted at the end of the browser session. Occasionally, cookies with a longer retention period may also be used so that your settings and preferences can be taken into account the next time you visit our website.

Most browsers are configured to automatically accept cookies. However, you can disable the storage of cookies or configure your browser to notify you whenever cookies are sent. It is also possible to manually delete cookies that have already been stored via your browser settings. Please note that you may only be able to use our online service to a limited extent, or not at all, if you refuse to accept cookies or delete necessary cookies.

Since cookies are not necessary for our online service, we ask for your consent to the use of cookies when you first visit the online service. With regard to non-essential third-party cookies, you will find a more detailed description of the third-party services we use below. The legal basis for the associated data processing, including any potential data transfers, is your consent pursuant to Article 6(1)(a) of the GDPR. Once given, consent may be withdrawn at any time with future effect, in particular by changing the selected settings.

The legal basis for the use of necessary cookies is our legitimate interest in the proper provision of our online service within the meaning of Article 6(1)(f) of the GDPR f) of the GDPR and—to the extent that contracts are concluded or performed via our online service—the performance of the contract within the meaning of Article 6(1)(b) of the GDPR.

3 Integration of Third-Party Services

For certain features of our online service, we use third-party services. The services in question are primarily optional features that must be explicitly selected or used by you. We have entered into contractual agreements with the respective providers for the provision or integration of their services and, to the best of our ability, ensure that third-party providers also provide transparent information regarding the scope of personal data processing and comply with data protection regulations.

3.1 Google Analytics

We use Google Analytics for statistical analysis. Google Analytics is a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (hereinafter: “Google”). As part of Google Analytics, Google uses, among other things, cookies for analysis. The type and scope of the use and analysis of cookies are determined by Google. The information generated by the cookies regarding your use of the online service is transmitted to a Google server and stored there. In this context, it cannot be ruled out that data may be transferred to the United States, which may allow government authorities to access this data.

However, thanks to standard IP anonymization, your IP address is first truncated by Google on servers within the European Union.

On our behalf, Google uses this information to evaluate your use of the online service, to compile reports on website activity, and to provide us with other services related to website and internet usage as the operator of the online service. In addition, Google may use the data for its own purposes. For these purposes, Google may, for example, profile user behavior or link the data to other data, such as an existing Google account. We have no influence over these data processing operations. The IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. For more information, please refer to Google’s privacy policy, linked below.

We also use the “demographics” feature of Google Analytics. This allows us to generate reports containing information about the age, gender, and interests of website visitors. This data is derived from Google’s interest-based advertising as well as visitor data from third-party providers. You can disable this feature at any time via the ad settings in your Google account or generally prevent Google Analytics from collecting your data as described in the following paragraph. Additional information about the “demographics” feature can be found on Google at https://support.google.com/analytics/answer/2799357?hl. Additional information about Google Analytics can be found at http://tools.google.com/dlpage/gaoptout?hl or http://www.google.com/intl/de/analytics/privacyoverview.html. Please note that on our websites, Google Analytics has been extended with the code “anonymizeIp();” to anonymize IP addresses by deleting the last octet.

The legal basis for data processing is your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect, for example by adjusting your browser’s cookie settings or by setting preferences in our cookie consent tool. Otherwise, the collected data will be retained until the purpose for which it was collected no longer applies or until you request that we delete it. Mandatory statutory retention periods remain unaffected.

3.2 Commanders Act

As part of our online offering, we also use Commanders Act, a service provided by Fjord Technologies, 3 rue Saint-Georges, 75009 Paris. This is a management tool for marketing campaigns. We use the service as a consent management tool and for editing metadata. By using this service, we are able to provide our services to you as a user.

Commanders Act processes and stores information about your user behavior on our website. To this end, Commanders Act uses, among other things, cookies—small text files that are stored locally in your web browser’s cache on your device and enable an analysis of your use of our website.

The legal basis for managing your consent settings is, on the one hand, our legitimate interest in optimally designing our online offering. In addition, data processing takes place to obtain and document the legally required consents for the use of certain technologies, in accordance with Article 6(1)(c) of the GDPR.

For any further data processing by Commanders Act, the legal basis is your consent in accordance with Article 6(1)(a) of the GDPR.

Additional information on data processing by Commanders Act can be found at https://www.commandersact.com/de/datenschutz/.

3.3 BrowseAid

For our online offering, we use the BrowseAid service provided by Machinas Ecommerce SRL, Sector 3, Str. DECEBAL, No. 25–29, Level 9, 030965 Bucharest, Romania (hereinafter: “Machinas”).

BrowseAid helps us analyze and improve our online offering by removing digital barriers and ensuring the accessibility of our content. We are required to do so under the Act on the Improvement of Accessibility (BFSG); Further information can be found on our website at https://capriceshoes.com/de-DE/barrierefreiheitserklaerung/accessibility-declaration-caprice.html. When you use our services, your IP address is recorded and cookies are placed on your device. Further information on data processing by Machinas can be found at https://browseaid.com/privacy-policy.

The legal basis for data processing is the fulfillment of our legal obligations pursuant to Art. 3, para. 1, sentence 1 of the BFSG in conjunction with Art. 6, para. 1, letter c) of the GDPR[HM1].

3.4 Microsoft Clarity

For statistical analysis, we use the Microsoft Clarity service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, United States (hereinafter: “Microsoft”) on our online platform.

To analyze user behavior, Microsoft also uses cookies, among other methods. The information generated in this way regarding your use of our online service is transferred to Microsoft’s servers and stored there. In this context, it cannot be ruled out that data may be transferred to the United States, which may allow government authorities to access this data. We have configured the default technical settings so that data is pseudonymized by Microsoft before being transmitted to Microsoft’s servers, specifically through IP masking (pseudonymization of the IP address).

The analysis of user behavior is based on a pseudonymous user identifier.

In addition, other pseudonymized data such as usage data (e.g., access times, content viewed), metadata and communication data (e.g., IP address, devices used), location data (e.g., information about the device’s geographic location), and motion data (e.g., mouse movements and scrolling) are used.

Data processing is carried out to evaluate the use of our online service. According to Microsoft, the information stored on Microsoft’s servers may also be used for advertising purposes. We have no influence over Microsoft’s further processing of the data. Further information on data processing at Microsoft can be found at: https://clarity.microsoft.com/ and https://privacy.microsoft.com/de-de/privacystatement.

The legal basis for data processing is your consent in accordance with Art. 6, para. 1, letter a) of the GDPR.

3.5 Mapp Intelligence

We use the services of Mapp Digital Germany GmbH (formerly Webtrekk), Schönhauser Allee 148, 10435 Berlin (“Mapp Digital”) for statistical analysis. When you visit our website, the information transmitted by your browser is collected and analyzed for our web analytics. Data collection is carried out via a pixel embedded on each web page, as well as through the use of cookies, provided that you have consented to the use of cookies.

Additional information can be found at https://mapp.com/de/datenschutz/ and at https://mapp.com/privacy-mapp-cloud/.

The data collected is used to create anonymous usage profiles, which serve as the basis for web statistics. However, there is no personal identification of individual users, nor is the data merged with other data. The creation of web statistics constitutes our legitimate interest in data processing pursuant to Art. 6, para. 1, letter f) of the GDPR; to the extent that data is collected using cookies, the legal basis is your consent in accordance with Art. 6, para. 1, letter a) of the GDPR[HM3]. You may withdraw your consent at any time with future effect, for example by adjusting your browser’s cookie settings or by setting preferences in our cookie consent tool. Otherwise, the collected data will be retained until the purpose of the data collection no longer applies or until you request that we delete it. Mandatory statutory retention periods remain unaffected.

3.6 Amplitude

On our website, we also use the Amplitude analytics service, provided by Amplitude Inc., 501 2nd Street, Suite 100, San Francisco, CA 94107, United States, to evaluate usage.

When using this service, your order number and your IP address in anonymized form are recorded. In addition, the service records various metrics, such as clicks and page views, to evaluate the usage of our online offering. This statistical data is used to analyze the usage of our online offering and thereby optimize your user experience. If the order number is not recorded, only analyses without any personal references are performed.

For more information on privacy at Amplitude, please visit: https://amplitude.com/privacy.

The legal basis for the use of Amplitude is your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect. If the order number is not recorded, the legal basis is our legitimate interest in the optimal design of our online offering pursuant to Article 6(1)(f) of the GDPR[HM0].

3.7 A/B Tasty

We use the A/B Tasty tool from AB Tasty SAS, 17-19 Rue Michel-le-Comte, 75003 Paris, France, for A/B testing and the continuous improvement of our online offering. The cookies used allow us to modify the page and analyze the changes. The Privacy Policy and further explanations regarding the use of cookies can be found here https://www.abtasty.com/de/datenschutzerklarung/ and here https://support.abtasty.com/hc/en-us/articles/6416315967004-Cookies-Privacy. A more detailed explanation of opt-out options can be found at https://support.abtasty.com/hc/en-us/articles/6397541297820.

The legal basis for data processing is your consent in accordance with Art. 6, para. 1, letter a) of the GDPR. You may withdraw your consent at any time with future effect, for example by adjusting the cookie settings in your browser or by setting preferences in our cookie consent tool. Otherwise, the collected data will be retained until the purpose of the data collection no longer applies or until you request that we delete it. Mandatory legal retention periods remain unchanged. [HM4]

3.8 Use of Salesforce (Commerce Cloud & Einstein)

To operate our online offering and manage our customer relationships, we use the services of salesforce.com Germany GmbH (Erika-Mann-Str. 31, 80636 Munich; hereinafter: “Salesforce”). Salesforce Commerce Cloud (formerly Demandware) is a cloud-based B2C platform for managing our online store. This includes providing the store system, optimizing for mobile devices, and personalizing the shopping experience. In doing so, data such as order history, shopping carts, and interaction data is processed. To manage existing and potential customer contacts and to organize sales and communication processes, we consolidate customer data in the Salesforce Cloud. We use the Salesforce Einstein service for image recognition and natural language processing (NLP). This helps us refine search queries, automate content, and provide you with personalized product recommendations. When using Salesforce services, it cannot be ruled out—due to technical processes—that (personal) data may be stored on Salesforce, Inc.’s servers in the United States in this context and that U.S. security authorities may have access to the data. However, Salesforce, Inc. is an active participant in the EU-U.S. Data Privacy Framework (DPF), which ensures an adequate level of data protection. In addition, Salesforce has adopted Binding Corporate Rules (BCR) to ensure the protection of personal data even during transfers within the Salesforce group of companies. You can view these rules online at https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/Salesforce-Processor-BCR.pdf. The use of Salesforce services is based on our legitimate interests in accordance with Article 6(1)(f) of the GDPR. Our legitimate interests lie in the effective management of our customer relationships, the provision of a secure and high-performance online store, and the continuous optimization of our service offerings. Further information on data processing by Salesforce can be found at https://www.salesforce.com/de/company/privacy/.

Cookies are also used when using Salesforce. The legal basis for the use of cookies is your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect, for example by adjusting your browser’s cookie settings or by setting other preferences in our cookie consent tool. Otherwise, the collected data will be retained until the purpose for which the data was collected no longer applies or until you request that we delete it. Mandatory legal retention periods remain unaffected. [HM5]

3.9 Bloomreach

For our online offering, we use the Bloomreach service provided by Bloomreach Inc., 700 E El Camino Real 130, Mountain View, CA 94041, United States. Bloomreach is a cloud-based e-commerce experience platform and a B2B service specializing in marketing automation, product search, and content management systems. We use Bloomreach to centralize, consolidate, and store customer data. This increases transparency across various customer touchpoints throughout the customer journey and creates a database for the targeted and personalized implementation of additional customer service measures.

The personal data processed by Bloomreach, as well as the content of the online offering, is stored on Bloomreach’s servers. The personal data processed may include information such as names, contact details, job titles, account identifiers, billing information, IP addresses, device and browser data, location data, online activities, interaction and transaction history, user preferences, and other data provided directly by you or collected during your visit to our website. In particular, this data may be used to determine the content of the online offering that is relevant to the user and to analyze and evaluate user behavior. It cannot be ruled out that data may be transferred to the United States in this context and that U.S. security authorities may have access to the data. All data processed in this context is used exclusively for the processing purposes specified by us. This processing is based on our legitimate interests pursuant to Article 6(1)(f) of the GDPR, which arise from the processing purposes in this regard. Further information on data protection at Bloomreach can be found at: https://www.bloomreach.com/de/legal/privacy.

Cookies are also used when using Bloomreach. The legal basis for the use of cookies is your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect, for example by adjusting the cookie settings in your browser. Otherwise, the collected data will be retained until you ask us to delete it, or until you delete the cookies set by Bloomreach yourself, or until the purpose for retaining the data no longer applies. Mandatory statutory retention periods remain unaffected.[HM6]

3.10 Use of SAP Emarsys (Scarab Research)

For our online offering, we use the SAP Emarsys (Scarab Research) service, a company of Emarsys Interactive Services GmbH (Stralauer Allee 6, 10245 Berlin), which is part of the SAP Group. This service is used to analyze user behavior in order to optimize our website and display personalized content and product recommendations (recommendation engine). Pseudonymized data about your interactions with our website (e.g., products viewed, shopping cart contents) is collected and analyzed.

As part of this service, cookies are stored on your device. This includes, in particular, the Scarab Research tracking cookie, which is used in connection with the website’s content delivery network (CDN). This cookie is used for technical control and the efficient delivery of personalized content via the CDN, as well as for identifying visitors across different sessions. Data processing is based on your explicit consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect, for example by adjusting the cookie settings in your browser or by setting preferences in our cookie consent tool. Otherwise, the collected data will be retained until the purpose of the data collection no longer applies or until you request that we delete it. Mandatory legal retention periods remain unchanged. Further information on data processing by SAP Emarsys can be found in the Emarsys Privacy Policy at https://emarsys.com/de/privacy-policy/ and in SAP’s general privacy notices at https://www.sap.com/germany/about/legal/privacy.html.[HM7]

3.11 Prismic

On our online platform, we use the Prismic service provided by New Prismic SAS (9, Rue de la Pierre Levée, 75011 Paris, France; hereinafter: “Prismic”). Prismic is a cloud-based headless content management system (CMS) that includes a content delivery network (CDN), which helps us efficiently manage content and deliver it quickly across various digital channels.

By using Prismic, the presentation layer of our website is separated from content management, enabling centralized and efficient content delivery. Technical data such as your IP address, as well as device and browser information, are processed to properly deliver the requested content. Our use of Prismic is based on our legitimate interests in accordance with Article 6(1)(f) of the GDPR. Our legitimate interests lie in the stable, fast, and cross-media delivery of our website’s content and in the efficient management of our content workflow. Further information on data protection at Prismic can be found at https://prismic.io/legal/privacy.

Cookies are also used when you use Prismic, allowing us to recognize your browser and optimize your experience with the features we offer. The legal basis for the use of these cookies is your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect, for example by adjusting the cookie settings in your browser or by setting preferences in our cookie consent tool. Otherwise, the collected data will be retained until the purpose of the data collection no longer applies or until you request that we delete it. Mandatory statutory retention periods remain unaffected[HM8].

3.12 Use of Minubo

In our online offering, we use the Minubo service provided by minubo GmbH, Schwanenwik 24, 22087 Hamburg. Minubo primarily supports us in the statistical analysis of key e-commerce metrics such as order values, orders, returns, cancellations, and other customer data. To this end, Minubo consolidates our end customers’ (personal) data from various sources and third-party services (such as the online store, the ERP or CRM system, or Google Analytics) into a central environment in order to provide us with statistical analyses for the business management of our company in a clear format. This use is based on our legitimate interests pursuant to Art. 6(1)(f) of the GDPR, which consist of analyzing and optimizing our online offering to improve our profitability.

Minubo also uses cookies and other web technologies for this purpose. The legal basis for Minubo’s use of cookies is your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect, for example by adjusting the cookie settings in your browser. Otherwise, the collected data will be retained until you ask us to delete it, until you delete the cookies set by Minubo yourself, or until the purpose for retaining the data no longer applies, with mandatory legal retention periods remaining unchanged.

Further details can be found in the privacy policy of minubo GmbH at: https://www.minubo.com/de/datenschutzerklaerung.[HM9]

3.13 Retargeting and Remarketing

Retargeting or remarketing refers to technologies through which users who have previously visited a certain website are still shown relevant advertisements after leaving that website. To do this, it is necessary to recognize Internet users beyond the respective website, which is why cookies from the relevant service providers are used; in addition, users’ previous behavior is taken into account. For example, if a user views certain products, those products or similar products may later be presented to them as ads on other websites. This is personalized advertising tailored to the needs of individual users. For this personalized advertising, it is not necessary to identify the user beyond recognizing them. Consequently, we do not merge the data used for retargeting or remarketing with any other data.

We use these technologies to place ads on the Internet. To place these ads, we rely on third-party providers. Among other things, we use Google services that enable the automatic display of products of interest to the Internet user. This feature is implemented using cookies. It cannot be ruled out that, during this process, data may be transferred to Google in the United States and that U.S. security authorities may have access to the corresponding data.

Further information on this technology can be found in Google’s Privacy Policy at https://policies.google.com/privacy?hl=de. The installation of cookies for Google Remarketing and Google AdWords Conversion Tracking can be completely prevented from the outset by adjusting the respective browser settings at http://www.google.com/policies/privacy/ads/ and changing the appropriate setting. Regardless of the above options to prevent data processing using cookies in connection with Google Remarketing and Google AdWords Conversion Tracking, our use of corresponding cookies or these services is subject to your explicit consent.

3.14 Affiliate Marketing

As part of our online offering, we also use affiliate marketing. This is a form of online sales in which providers of other online offerings (often referred to as “merchants” or “advertisers”) link to our online offering. If the link results in a page view or a purchase on our online platform, compensation may be paid in the form of a commission per click or per sale. For affiliate marketing, we work with a service provider.

The service provider uses cookies to track activity. The tracking cookie does not store any personal data; it stores only an affiliate ID—that is, the partner who refers the potential customer—and an order number. The purpose of storing this data is to process commission payments. The legal basis is your consent in accordance with Art. 6, para. 1, letter a) of the GDPR.[HM10] Once given, consent may be withdrawn at any time with future effect, in particular by changing the selected settings.

3.15 Google Maps

We use the Google Maps mapping service for our online offering. Google Maps is a service provided by Google. Only technically necessary cookies are set for the maps embedded in our online offering.

To comply with data protection regulations, the terms of use for the mapping service include data protection provisions designed to protect you. Google’s terms of use for the mapping service can be found at https://www.google.com/intl/de_US/help/terms_maps.html, and Google’s general explanations regarding data protection are available at https://policies.google.com/privacy?hl=de&gl=de.

The legal basis for integrating the mapping service is Article 6(1)(f) of the GDPR; our legitimate interest lies in providing mapping material to help you navigate. Our legal basis for setting cookies in connection with the use of Google Maps is your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect, for example by adjusting the cookie settings in your browser or by setting preferences in our cookie consent tool. Otherwise, the collected data will be retained until the purpose of the data collection no longer applies or until you request that we delete it. Mandatory statutory retention periods remain unaffected[HM11].

3.16 Use of Web Fonts

For our online offering, web fonts from Google (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland) and Adobe (Adobe Systems Software Ireland Limited: 4-6 Riverwalk, City West Business Campus, Saggart, Dublin 24, Ireland) are used as external fonts. These web fonts are integrated via a server request, typically to a Google or Adobe server. Through this process, information about which pages of our website you have visited is transmitted to the server. The IP address of the user’s device browser is also recorded by Google or Adobe. It cannot be ruled out that data may be transferred to the United States in this context and that U.S. security authorities may have access to the data. Further information on data processing by Google or Adobe can be found in Google’s and Adobe’s privacy policies, which you can view here:

www.google.com/fonts#AboutPlace:about

www.google.com/policies/privacy/

www.adobe.com/de/privacy/policies/typekit.html

The legal basis for the integration of web fonts is Article 6(1)(f) of the GDPR; our legitimate interest is the optimization of our online offering[HM12].

3.17 Use of YouTube

YouTube videos are embedded in our online offering; to play these videos, we use a plugin from the YouTube service operated by Google (hereinafter: “YouTube”). The service provider is Google. We use the YouTube service in enhanced privacy mode to protect your privacy as much as possible. When you visit a page on our website where a YouTube video is embedded, Google initially receives only the information necessary for the embedding, and no usage analytics cookies are set. Only when you play the embedded video does Google receive additional information; Google may also set cookies to analyze your user behavior. When you play the video, Google’s YouTube servers are informed, for example, of which page of our website you are playing the video from.

If you are signed in to your Google account, you allow Google or YouTube to associate your browsing behavior directly with your personal Google profile. We therefore recommend that you only play embedded YouTube videos if you agree to the associated data processing by Google. You can prevent data from being associated with your Google profile by signing out of your YouTube account. Further information on the processing of user data can be found in Google’s Privacy Policy at https://www.google.de/intl/de/policies/privacy/, which also applies to YouTube.

We use YouTube to show you videos and thereby better inform you about us and our services. The legal basis for embedding the videos is our legitimate interest within the meaning of Art. 6, para. 1, let. f) of the GDPR; however, the playback of videos and the associated further processing of data take place only on the basis of your consent within the meaning of Art. 6, para. 1, letter a) of the GDPR. You may withdraw your consent at any time with future effect, for example by adjusting the cookie settings in your browser or by setting preferences in our cookie consent tool. Otherwise, the collected data will be retained until the purpose of the data collection no longer applies or until you request that we delete it. Mandatory statutory retention periods remain unaffected[HM13].

3.18 Embedding Videos via bunny.net

Videos are embedded in our online offering via the bunny.net service using the native video player or an iframe. The service provider is BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia (hereinafter: “Bunny”).

When you access a web page on our online service where a video is embedded via Bunny, a connection to Bunny’s servers is established. The video or the content of the iframe is transmitted by Bunny directly to your browser and embedded in the page. The server is informed, for example, of which web pages of our online offering you have visited. If you interact with the video, this information is also transmitted to Bunny’s servers.

Further information on data protection at Bunny can be found in Bunny’s privacy policy at https://bunny.net/privacy/.

We use Bunny to show you videos and provide you with information about us and our services. The legal basis for embedding the videos is our legitimate interest within the meaning of Art. 6(1)(f) of the GDPR.[HM14]

3.19 Use of Syte.AI

To make it easier to find similar products, we use Syte.AI. This is a service provided by Syte Visual Conception Ltd., 20 Haharash Street, Tel Aviv, 6761310 Israel (hereinafter: “Syte”).

If you use the “Find Similar Products” feature in our online store and select a specific product, Syte analyzes the product you have selected in terms of its shape and appearance. It then suggests products with similar visual characteristics. In order to provide this service, Syte must use your IP address. If you do not wish to use the service, your data will not be transferred to Syte.

The legal basis for the processing is your consent in accordance with Art. 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect, for example by adjusting the cookie settings in your browser or by setting preferences in our cookie consent tool. Otherwise, the collected data will be retained until the purpose of the data collection no longer applies or until you request that we delete it. Mandatory statutory retention periods remain unchanged[HM15].

4 Order Processing

We use your personal data for orders solely within our company and its affiliates, as well as with companies contracted to process orders.

4.1 Data Retention and Transfer for Orders

To process orders, we work with various companies responsible for payment processing and logistics. We ensure that our partners also comply with data protection regulations. For example, we transmit your address data (name and address) to the respective shipping company that delivers the products you ordered. The legal basis for this is Article 6(1)(b) of the GDPR. The processing of your personal data is necessary to fulfill the contract with you.

We will retain the data for as long as necessary to fulfill the contract. In addition, we retain this data to fulfill post-contractual obligations and in accordance with commercial and tax law retention periods for the legally prescribed period. This retention period is generally 10 years from the end of the corresponding calendar year.

4.2 Processing of Payments for Orders, PayPal

Depending on the payment method you choose, payment processing for orders may be carried out by a service provider.

When paying by credit card, your necessary data—such as your name, address, and purchase details—are transmitted to the respective credit card company.

When paying via PayPal, you will be redirected to the PayPal website via a link. Your personal data will be processed there. This includes your name, address, email address, possibly your phone number, as well as your bank account or credit card information. Please note the General Terms and Conditions, Terms of Use, and Privacy Policy of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, available on the website www.paypal.com.

As a precaution, please be advised that PayPal reserves the right to perform a credit check for payments made via PayPal credit card, PayPal direct debit, or “purchase on account” through PayPal. Your payment data will be shared with credit bureaus based on PayPal’s legitimate interests in verifying your identity and creditworthiness in accordance with Article 6(1)(f) of the GDPR. The result of the credit check is generally a “score,” which describes your statistical probability of default and is used by PayPal to decide whether—and, if so, which—payment method to offer you. Further information on credit checks at PayPal can be found at https://www.paypal.com/de/legalhub/paypal/creditchk.

Please note that PayPal also uses cookies and other tracking technologies. These are used to ensure the functionality and security of the payment process, as well as for marketing purposes. Data processing is based on your consent in accordance with Art. 6, para. 1, letter a) of the GDPR (this applies in particular to marketing cookies) or on the basis of legitimate interests pursuant to Art. 6, para. 1, let. f) of the GDPR (such as ensuring technical functionality, but above all for fraud prevention). If you use PayPal, you can always adjust your cookie preferences in PayPal at https://www.paypal.com/myaccount/privacy/cookiePrefs?locale=de_DE. PayPal account holders can also disable personalized advertising in the “Data & Privacy” section or withdraw any consent you have given (e.g., for marketing cookies) with future effect. Further information can be found in PayPal’s statement on cookies and other tracking technologies at https://www.paypal.com/de/legalhub/paypal/cookie-full.

If you select a Klarna service for payment, your necessary data—in particular your name, contact information, and other identifying information, as well as payment information and credit details—will be transmitted to and processed by Klarna Bank AB, Sveavägen 46, 11134 Stockholm, Sweden (“Klarna”). Information about Klarna’s data protection practices can be found at https://www.klarna.com/de/datenschutz/ and https://www.klarna.com/international/privacy-policy/.

For purchases on account, a credit check is performed as part of the ordering process; we provide more detailed information about this below. If the credit check is approved, you will receive the corresponding invoice from our service provider, which you can pay by bank transfer to our account. If you pay in advance, no assessment by service providers takes place; shipment occurs after we receive your payment.

The legal basis for processing payments is Article 6(1)(b) of the GDPR. The processing of your personal data is necessary to fulfill the contract with you, and you are free to choose your preferred payment method.

4.3 Credit Check

Depending on the payment method you choose, a credit check may be necessary. In this case, subject to your consent to the credit check, we engage external service providers to whom we transmit your data (name, address, date of birth, order value). We transmit the data for this purpose to REAL Solution Factoring GmbH, Normannenweg 32, 20537 Hamburg[HM16].

The legal basis for the credit check is Article 6(1)(a) of the GDPR. If you do not wish to give your consent to the credit check, you may need to select a different payment method.

As part of the credit check, an assessment is made regarding the probability of default on our claim arising from the order. We receive only a probability value (score) from our service provider, but no other details. Based on this value, we then determine whether the desired payment method can be offered. Once the check is complete, we delete the score value, and it is not stored as part of the order data. Therefore, we are also unable to determine retrospectively why, for example, a certain payment method was not available.

5 Customer Account

You may voluntarily create a customer account for our online services. The customer account centrally manages all information about you and your use of the various services. This allows you to manage, update, and, if necessary, delete all data. The legal basis for data processing during registration, with your consent, is Article 6(1)(a) of the GDPR. If you register with us for the purpose of performing or entering into a contract, the legal basis for data processing is also Article 6(1)(b) of the GDPR.

5.1 Customer Account Registration

You can register for a customer account online. To create a customer account, you only need to provide your name, an email address, and a password. We reserve the right to offer other registration options in addition to online registration, in which case the relevant regulations apply accordingly.

To use all features of the customer account, it may be necessary to verify the email address provided during registration. To do so, we will send a confirmation link to the email address you provided, which you must click. This procedure serves, on the one hand, to ensure the security of your data and, on the other hand, to ensure that communications regarding services, delivery status, or payment status are sent to a valid email address.

5.2 Data Collection via the Customer Account

All data regarding the use of online services is stored in your customer account provided that you log in to your customer account. This includes, in particular, personal data (name, age, addresses, shipping and payment information), gift cards, wish lists, purchase history, communication history, search and browsing behavior, consent to individual services (e.g., newsletters), discount preferences, and information about primary interests provided explicitly or implicitly by the customer. We may create segments based on this data and assign customers to these segments. Membership in these segments is also stored in the customer account. Location-based data, such as your shipping addresses or your geographic location, will be recorded—provided you have given your consent to do so.

Your current geographic location may be used to provide you with location-based offers. If you do not want data to be stored in your customer account in specific cases, you can use the respective services without using your customer account. If you wish to completely stop storing data in your customer account, you can have your customer account deleted.

5.3 Social Login

We offer you the option to use your existing profile on Meta social networks (formerly Facebook; Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, United States) and Google (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland) to register and log in to our online service. To do so, you can click on the corresponding Facebook or Google icons during registration or login. Clicking on the respective icon opens a new window where you can log in with the respective provider. There, you will also be informed about the data that will be transmitted for authentication and for registration or login. Based on your consent, it is also possible that other data from your profile may be transmitted to us. We then use this data (such as your age or “Like” behavior) to optimize our offerings, including tailoring them to your interests. The legal basis for data processing is your consent in accordance with Article 6(1)(a) of the GDPR.

To perform authentication, a connection is established between your device and the respective provider’s servers. Through this process, the provider obtains, in particular, your IP address and, possibly, other information about your device. We have no influence over the provider’s processing of data in this regard. The privacy policies of the respective provider apply here at http://www.facebook.com/policy.php or https://policies.google.com/privacy.

5.4 Use of Customer Account Data

We use the stored data to manage our business relationship with you and—if you have given the appropriate consent—to present you with interesting and relevant offers through all the communication channels you use. Based on the stored data, we attempt to determine which offers are relevant to you.

We will contact you in connection with our business relationship using the contact information you provided when using individual services. For example, you will automatically receive order notifications or information about delivery status; we will notify you according to the preferences you have selected. Contact may be made via email, through messages on your smartphone, or via other digital communication channels. In addition, you can choose optional communication channels and opportunities; this includes, in particular, special newsletters and in-app messages.

5.5 Retention Period and Deletion

Data generated during the use of the customer account is generally retained for the duration of the customer account’s existence, but may also be deleted prematurely upon request. Much of the data can be viewed directly online and—with the exception of the email address—modified or deleted. You can delete your customer account at any time by notifying us of your wish to do so, for example via the general contact form. In the event of immediate deletion, the data may not be recoverable later if you re-register. [HM17]

6 Contacting Us

You can contact us in various ways, including via the contact form on our website. We would also be happy to keep you informed regularly through our email newsletter.

6.1 Contact Form

If you wish to use the contact form on our website, we collect the personal data you provide in the contact form, specifically your name and email address. We also record the IP address as well as the date and time of the request. We process the data transmitted via the contact form exclusively for the purpose of responding to your inquiry or concern.

You can decide for yourself what information you provide to us via the contact form. The legal basis for processing your data is your consent in accordance with Article 6(1)(a) of the GDPR.

After we have processed your inquiry, the data will initially be retained in case of any follow-up questions. You may request the deletion of the data at any time; otherwise, the data will be deleted once the matter has been fully resolved; legal retention obligations remain unaffected.

6.2 Newsletter

The CAPRICE newsletter is sent by Wortmann Fashion Retail GmbH & Co. KG, Klingenbergstraße 1-3, D-32758 Detmold, and Wortmann KG Internationale Schuhproduktionen, Klingenbergstraße 1-3, D-32758 Detmold, under joint responsibility for data protection. The two aforementioned companies may thus send you the CAPRICE newsletter that you requested as part of your consent, either jointly or independently of one another. In accordance with data protection regulations, the two companies have entered into an agreement to define their respective responsibilities. You may exercise your rights as a data subject—in particular, the right to withdraw your consent to receive the newsletter—with respect to either of the two companies, using the contact information provided in this Privacy Policy for that purpose.[HM18]

When you subscribe to our newsletter, your email address is used for our own marketing purposes until you unsubscribe. You will receive regular updates via email on current topics as well as emails for special occasions, such as special promotions. The emails may be personalized and tailored based on the information we have about you.

To subscribe to our newsletter, unless you have given us your written consent, we use the so-called double opt-in procedure, which means that we will only send you a newsletter via email if you have first expressly confirmed that we should activate the newsletter delivery. We will then send you a notification email and ask you to confirm that you wish to receive our newsletter by clicking on a link contained in that email.

When you view the newsletter and click on individual links within it, the information that is automatically transmitted is collected and analyzed. For this purpose, a cookie with an unlimited duration is set when a link in the newsletter is accessed for the first time. If the cookie has been deleted in the meantime or if you use a different browser, the cookie will be set again. The cookie is used to recognize you and to analyze your user behavior on our websites. The data collected is used to create personal user profiles. In this way, we strive to continuously improve our service for you and to provide you with even more personalized information about tailored offers and promotions. The links in the newsletter contain a random but unique identification number. We or external service providers acting on our behalf may collect and store this number when you access these links via your computer to retrieve additional information from our website. The number in the links is not combined with your name or other personally identifiable information without your explicit consent. You can object to the collection and analysis of link usage described above by clicking on [Opt-Out Link]. If you exercise this option, an anonymous opt-out cookie will be stored in your browser, indicating your objection and thereby preventing data collection. The opt-out cookie remains active in the browser you are using until you delete it using that browser’s tools. However, if you delete the cookie or use a different browser or computer, we will no longer be able to recognize that you have expressed such an objection. The analysis of newsletter usage and your consent to receive the newsletter are not affected by this.

The legal basis for the processing of your data is your consent pursuant to Article 6(1)(a) of the GDPR if you have explicitly subscribed to the newsletter. In accordance with legal requirements, it is also possible that you may receive our newsletter from us without explicit consent because you have ordered goods or services from us, we have received your email address in this context, and you have not objected to receiving information via email. In this case, our legitimate interest in sending direct marketing pursuant to Article 6(1)(f) of the GDPR shall be considered the legal basis.

If you no longer wish to receive newsletters from us, you may withdraw your consent at any time with future effect or object to receiving future newsletters without incurring any costs other than standard transmission fees. Simply use the unsubscribe link included in each newsletter or send a message to us or to our Data Protection Officer.

6.3 Review Platforms

If you have been satisfied with our services, we invite you to rate us on the relevant platforms. Of course, you may also submit justified criticism via the review platforms, but it is generally more helpful to contact us directly to clarify the situation.

6.3.1 Use of eKomi

We have provided links on our website to the eKomi platform operated by eKomi Holding GmbH, Zimmerstraße 11, D-10969 Berlin, which lead directly to the relevant page and display our current rating. To display the current rating, it is technically necessary for the respective content to be loaded directly from the respective platform. The platform’s privacy policy applies to its content and external websites; this policy can be viewed at https://www.ekomi.de/de/datenschutz/.

We believe that displaying current reviews promotes transparency and constitutes our legitimate interest within the meaning of Article 6(1)(f) of the GDPR. If you wish to submit a review on the review platform pages or read previous reviews, accessing the linked websites simultaneously constitutes the legal basis for the associated data processing by the respective provider[HM19].

7 Social Media

In addition to our online presence, we also use various social media channels to share information and communicate; you will find links to these on our website. Specifically, we use Facebook, Pinterest, Instagram, and YouTube. You can recognize these links by the respective provider’s logo.

Clicking on these links will open the corresponding social media pages, to which this Privacy Policy does not apply. Please refer to the respective privacy policies of the individual providers for more details on the provisions applicable there; you can find them at:

Facebook: http://www.facebook.com/policy.php

YouTube: https://www.google.de/intl/de/policies/privacy/ (YouTube)

Instagram: https://help.instagram.com/155833707900388

Pinterest: https://about.pinterest.com/de/privacy-policy

No personal information is transmitted to the respective providers before you access the corresponding links. Your access to the linked page simultaneously constitutes the basis for data processing by the respective providers.

The following notes regarding the processing of your personal data in connection with our use of the social media channels Facebook, Instagram, and Pinterest also apply.

If you have any questions regarding our use of your personal data in connection with the use of social media channels, you can contact us and our Data Protection Officer at any time. If you have general questions about data protection related to social media channels, please contact the respective providers directly; their contact information is provided below.

We would also like to point out here that the Federal Office for Information Security (BSI) provides general information on the safe use of social media on its website at https://www.bsi.bund.de/DE/Topics/Consumers/Information-and-Recommendations/Online-Communication/Social-Networks/social-networks_node.html.

7.1 Facebook Fan Page

In addition to our own online presence, we also maintain a Facebook Fan Page. Through the Fan Page, we provide information about our activities and offer a communication channel. The operator of the Facebook social network is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (hereinafter: “Meta”). In this regard, we rely on Meta’s technical platform and services.

7.1.1 Limitation of Liability

Please note that you use the Fan Page and its features at your own risk, particularly with regard to interactive features such as commenting, sharing, or rating. Alternatively, you can also access the information provided via the Fan Page on our homepage.

To the extent possible within the capabilities provided by Facebook, we strive to ensure the protection of your privacy and your personal data. To the extent that we process your personal data in connection with your visit to the Fan Page, the provisions of this Privacy Policy apply without restriction. Due to the integration of the Fan Page into Facebook’s platform, it should also be noted that personal data is simultaneously processed by Meta. When you visit the Fan Page, Meta collects, among other things, your IP address and other information, which may be stored as cookies on the device you are using or in the respective browser. We have no influence over Meta’s processing of data; in particular, Facebook does not act as a data processor on our behalf under our responsibility. For the processing of data by Facebook, Facebook’s guidelines—at least according to Meta—apply, which are available at https://de-de.facebook.com/policy.php. Please note that the data collected about you by Meta in this context may also be transferred outside the European Union.

From a data protection perspective, it should be assumed that Meta and we share joint responsibility for the operation of the Fan Page and the analysis of user data when users visit the Fan Page. In accordance with data protection requirements, we have entered into an internal agreement with Meta to define our respective responsibilities.

7.1.2 Facebook Insights

Meta offers Fan Page operators the ability to gain insight into the use of the Fan Page and its users via the Page Insights feature. In particular, statistical data can be viewed and analyzed via Page Insights. We use Page Insights data to make the Fan Page as attractive and effective as possible. To this end, Meta provides us with data that Meta itself has generated. Further information on the operation and responsibility for the Page Insights feature is provided by Facebook at https://www.facebook.com/legal/terms/page_controller_addendum.

7.1.3 Messenger

Users registered on Facebook also have the option to communicate directly via Facebook Messenger. If you contact us via Messenger, the data transmitted will be stored and used by us exclusively to respond to your inquiry. The legal basis for the processing of your data is your consent pursuant to Art. 6(1)(a) of the GDPR, as well as our legitimate interest pursuant to Art. 6(1)(f) of the GDPR. Our legitimate interest lies in recording and processing customer inquiries, evaluating customer inquiries, and preventing abuse.

The data will be deleted as soon as it is no longer necessary to fulfill the purpose for which it was collected. For your personal data, this is the case when the respective conversation has ended. For us, the conversation is considered ended when it can be inferred from the circumstances that the relevant facts have been definitively clarified. You may withdraw your consent to the processing of your personal data at any time; in this case, we will immediately delete the data unless there is a legal basis for further retention.

7.1.4 Additional Information About Facebook

If you have any questions regarding our use of your personal data in connection with the use of the Facebook Fan Page, you can contact us and our Data Protection Officer at any time. Contact information and communication channels are provided in our Privacy Policy. If you have questions about data protection at Facebook, please contact Meta directly.

7.2 Instagram Account

We also have an account on the Instagram social network. Through our Instagram account, we provide information about our activities via our own posts and offer another channel for communicating with us. The Instagram social media platform is operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (hereinafter: “Meta”).

Please keep in mind that you use Instagram and its features at your own risk, particularly with regard to interactive features such as commenting, sharing, or rating.

7.2.1 Responsibility for Data Protection

To the extent permitted by Instagram, we strive to ensure the protection of your privacy and personal data. To the extent that we process your personal data in connection with your visit to the Instagram account, the provisions of this Privacy Policy apply without restriction. Due to the integration of the account into Meta’s platform, it should also be noted that personal data is simultaneously processed by Meta. When you view our Instagram content, Meta collects, among other things, your IP address and other information, which may be stored as cookies on the device you are using or in your browser. We have no influence over Instagram’s processing of data; in particular, Meta does not act as a data processor on our behalf under our responsibility. For data processing by Facebook, Meta’s guidelines—at least according to Meta—apply, which are available at https://www.facebook.com/help/instagram/155833707900388. Please note that the data collected about you by Meta in this context may also be transferred outside the European Union.

From a data protection perspective, it should be assumed that Meta and we each have distinct responsibilities regarding the operation of the Instagram account and the associated communication and analytics features. To the extent that we process your personal data in connection with your visit to our Instagram page and we alone determine the purposes and means of such data processing, we are responsible for that data processing. This is generally the case if you communicate directly with us via the “Instagram Direct Messaging” feature and provide us with your data in the process. To the extent that your personal data is processed by Meta and Meta alone determines the purposes and means of such data processing, Meta is solely responsible for this data processing. This applies in particular to Meta’s analysis of user behavior for its own purposes.

7.2.2 Instagram Statistics (Instagram Insights)

Meta offers Instagram account operators the ability to gain insight into account usage and user activity through the “Instagram Insights” feature. In particular, statistical data can be viewed and analyzed via Instagram Insights. We use data from Instagram Insights to make the Instagram account as attractive and effective as possible. To this end, Meta provides us with data that Meta itself has generated under its own responsibility. The data we receive from Meta consists primarily of anonymized data and statistics. To the extent that we receive personal data in this context, we are responsible for our further processing of this data to evaluate the use of our Instagram account.

Further information about Instagram Insights is provided by Meta at https://help.instagram.com/1533933820244654.

7.2.3 Instagram Direct Messaging

On Instagram, you have the option to communicate directly with us via the “Instagram Direct Messaging” feature. If you contact us via Instagram Direct Messaging, the data transmitted will be stored and used by us exclusively to respond to your inquiry. The legal basis for the processing of your data is your consent pursuant to Art. 6(1)(a) of the GDPR, as well as our legitimate interest pursuant to Art. 6(1)(f) of the GDPR. Our legitimate interest lies in recording and processing customer inquiries, evaluating customer inquiries, and preventing abuse.

The data will be deleted as soon as it is no longer necessary to fulfill the purpose for which it was collected. For your personal data, this is the case when the respective conversation has ended. For us, the conversation is considered ended when it can be inferred from the circumstances that the relevant facts have been definitively clarified. You may withdraw your consent to the processing of personal data at any time; in this case, we will immediately delete the data unless there is a legal basis for further retention.

7.2.4 Additional Information About Instagram

If you have any questions regarding our use of your personal data in connection with the use of our Instagram account, you can contact us or our Data Protection Officer at any time. Contact information and communication channels are provided in our Privacy Policy. If you have any questions regarding data protection related to the Instagram social network provided by Meta, please contact Meta directly.

7.3 Pinterest Profile

We also have an account on the social network Pinterest. Through this account, we provide information about our activities and offer an additional communication channel. The social network Pinterest is operated by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland (hereinafter: “Pinterest”). Please note that you use the social network and its features at your own risk. This applies in particular to the use of interactive features.

7.3.1 Processing of Personal Data

The data collected about you when using the service is processed by Pinterest and may be transferred to countries outside the European Union. The data processed includes, among other things, data you voluntarily provide, such as your name, username, email address, and phone number; content you create, upload, or receive, such as photos and videos; your IP address, information about the device you use, information about the websites and content you visit, as well as your location. We have no influence over the type and scope of data processed by Pinterest, the type of processing and use, or the transfer of this data to third parties. Information about what data is processed by Pinterest and for what purposes it is used can be found in Pinterest’s privacy policy at https://policy.pinterest.com/de/privacy-policy.

We process the data you enter on Pinterest—in particular, your username and the content published under your account—to the extent that we may include your posts in our service by pinning or linking to them, or by creating our own posts that reference your account. The data you freely publish and share on Pinterest is thus included in our service and made available to our subscribers.

You can restrict the processing of your data in the general settings of your Pinterest account. Additionally, on mobile devices, you can restrict Pinterest’s access to your data in the settings options. However, this depends on the operating system used.

7.3.2 Pinterest Analytics

Pinterest offers Pinterest account operators the ability to gain insight into account usage and its users. In particular, statistical data can be viewed and analyzed using the analytics features. We use this data to make the Pinterest account as attractive and effective as possible. To this end, Pinterest provides us with data that Pinterest has generated on its own responsibility. The data we receive from Pinterest consists mostly of anonymized data and statistics. To the extent that we receive personal data in this context, we are responsible for our further processing of this data to evaluate the use of our Pinterest account. Further information on this topic is provided by Pinterest at https://business.pinterest.com/de/analytics-and-measurement.

7.3.3 Messenger

On Pinterest, you have the option to communicate directly with us via Messenger. If you contact us through this feature, the data transmitted will be stored and used by us exclusively to respond to your inquiry. The legal basis for the processing of your data is your consent pursuant to Art. 6(1)(b) of the GDPR, as well as our legitimate interest pursuant to Art. 6(1)(f) of the GDPR. Our legitimate interest lies in recording and processing customer inquiries, evaluating customer inquiries, and preventing abuse.

The data will be deleted as soon as it is no longer necessary to fulfill the purpose for which it was collected. For your personal data, this is the case once the respective conversation has ended. For us, the conversation is considered ended when it can be inferred from the circumstances that the relevant facts have been definitively clarified. You may withdraw your consent to the processing of personal data at any time; in this case, we will immediately delete the data unless there is a legal basis for further retention.

7.3.4 Additional Information About Pinterest

If you have any questions regarding our use of your personal data in connection with the use of the Pinterest account, you can contact us or our Data Protection Officer at any time. Contact information and communication channels are provided in our Privacy Policy. If you have questions about data protection at Pinterest, please contact Pinterest directly.

8 Your Rights and Contact Information

We place great importance on explaining the processing of your personal data as transparently as possible and on informing you of your rights. If you would like more information or wish to exercise your rights, you can contact us at any time so that we can process your request.

8.1 Rights of Data Subjects

You have extensive rights regarding the processing of your personal data. First, you have a right of full access and may request the rectification and/or erasure or restriction of your personal data if necessary. You may also request a restriction on processing and have the right to object. With regard to the personal data you have provided to us, you also have the right to data portability.

If you wish to exercise any of your rights and/or receive further information about them, please contact our customer service department. Alternatively, you may also contact our Data Protection Officer.

8.2 Withdrawal of Consent and Objection

Once you have given your consent, you may freely withdraw it at any time with future effect. Withdrawal of consent does not affect the lawfulness of processing based on consent that took place prior to such withdrawal. The points of contact for this matter are also our customer service team and our Data Protection Officer.

If the processing of your personal data is not based on consent but is carried out on another legal basis, you may object to such data processing. Your objection will trigger a review and, if necessary, the cessation of data processing. You will be informed of the outcome of the review and—if the data processing is to continue nonetheless—you will receive further information from us regarding the reasons why the data processing is permitted.

8.3 Data Protection Officer and Contact Information

We have appointed an external Data Protection Officer who assists us with data protection matters and whom you may also contact directly. For questions regarding our processing of personal data or for further information on data protection topics, our Data Protection Officer and his team are available to assist you:

Dr. Sebastian Meyer, Esq., LL.M.
c/o BRANDI Rechtsanwälte
Adenauerplatz 1, 33602 Bielefeld
Phone: 0521 / 96535-812
Email: [email protected]

If you would like to contact our Data Protection Officer personally by email, you can also reach him at [email protected].

8.4 Complaints

If you believe that our processing of your personal data does not comply with this Privacy Policy or applicable data protection regulations, you have the right to file a complaint with the supervisory authority. You may also submit your complaint to our Data Protection Officer. The Data Protection Officer will then review the matter and inform you of the outcome of the review.

9 Additional Information and Changes

9.1 Links to Other Websites

Our online offering may contain links to other websites. These links are generally marked as such. We have no influence over the extent to which applicable data protection regulations are observed on the linked websites. We therefore recommend that you also review the respective privacy policies on those other websites.

9.2 Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy at any time with future effect. Amendments are made in particular in the event of technical adjustments to the online service or changes to data protection requirements. The currently valid version of the Privacy Policy can always be accessed directly via the online service. We recommend that you check this Privacy Policy regularly for any changes.

Last updated: February 2026