Privacy Policy

Privacy Policy

1. Information on the collection of personal data and contact details of the controller
2. Data collection when visiting our website
3. Cookies
4. Data processing for order processing
5. Data processing when opening a customer account and for contract processing
6. Contact
7. Use of your data for direct marketing
8. Use of social media: Video
9. Web analytics services
10. Use of a live chat system
11. Rights of the data subject
12. Duration of storage of personal data

1. Information on the collection of personal data and contact details of the controller

1.1. Thank you for visiting our website. Below, we would like to inform you about how your personal data is handled when using our website. Personal data is essentially any data that can be used to personally identify you.

1.2. The controller responsible for the processing of data on our website within the meaning of the General Data Protection Regulation (GDPR) is:

HC Arnoldi e.K.
Owner: Hubert Arnoldi
Mühlwiesenstraße 28
55743 Kirschweiler
Germany

1.3. To protect the security of your data during transmission, we use state-of-the-art encryption methods (e.g., SSL or TLS) via HTTPS.

2. Data collection when visiting our website

Every time you access our website, our system automatically collects data and information that your browser transmits to our server (so-called "server log files"). The following data, which is technically necessary for us, is collected:

• The website visited
• Date and time at the moment of access
• Amount of data sent in bytes
• Source/reference from which you reached the page
• Operating system used
• Browser used
• IP address used (if applicable: in anonymized form)

The legal basis for the processing is Art. 6 para. 1 lit. f GDPR due to our legitimate interest in improving the stability and maintaining the functionality of our website. The data is not passed on or used in any other way. The temporary storage of the IP address by the system is necessary to enable the delivery of the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.
We reserve the right to check the server log files retrospectively should there be concrete indications of unlawful use. The data will be deleted as soon as it is no longer required for the purpose of its collection. In the case of data collection for providing the website, this is the case when the respective session has ended.
In the case of data storage in log files, this is the case after seven days at the latest. Storage beyond this is possible. In this case, the IP addresses of the users are deleted or masked, so that an assignment of the calling client is no longer possible. The collection of data for the provision of the website and the storage of data in log files is strictly necessary for the operation of the website. Consequently, there is no possibility for the user to object.

3. Cookies

Our website uses cookies.

Cookies are text files that are stored on the user's terminal device. If a user visits a website, a cookie can be stored on the user's operating system. Some functions of our website cannot be offered without the use of cookies. For this, it is necessary that the browser is recognized even after a page change. The user data collected by technically necessary cookies is not used to create user profiles. Our legitimate interest in the processing of personal data according to Art. 6 para. 1 lit. f) GDPR lies in the aforementioned purposes.

Furthermore, our website uses cookies that allow an analysis of the users' surfing behavior (so-called third-party cookies). More detailed information on the scope, purpose, legal basis, and possibilities to object can be found in the respective sections of the relevant chapter of this privacy policy.

As a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate, restrict, or delete the transmission of cookies. If you deactivate cookies for our website, it is possible that not all functions of the website can be fully utilized. You can prevent the transmission of Flash cookies by changing the setting of the Flash Player.

Help with settings can be found in the respective help menu of your browser under the following links:
Internet Explorer: http://windows.microsoft.com/de-DE/windows-vista/Block-or-allow-cookies
Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Chrome: http://support.google.com/chrome/bin/answer.py?hl=de&hlrm=en&answer=95647
Safari: https://support.apple.com/de-de/guide/safari/sfri11471/mac
Opera: https://help.opera.com/en/latest/web-preferences/#cookies
Some of the cookies used here are deleted after closing your browser (so-called session cookies). Other cookies remain on your terminal device and enable us or our partner companies (third-party cookies) to recognize your browser on your next visit (persistent cookies). If cookies are set, they collect and process specific user information such as browser and location data as well as IP address values to an individual extent. Persistent cookies are automatically deleted after a specified period, which can differ depending on the cookie.

4. Data processing for order processing

4.1. If you wish to order in our webshop, it is necessary for the conclusion of the contract that you provide your personal data, which we need for the processing of your order. We process the data you provide to process your order.

In some cases, we work with external service providers to process your order. For this purpose, we must pass on the necessary personal data.

If we commission transport companies with the delivery of your goods, we pass on your data required for the delivery of the goods to the respective transport company. For the processing of payments, we pass on your data to the commissioned credit institution as far as necessary. If we use payment service providers, you will also be informed about this below.
The legal basis for the transfer of your data is Art. 6 para. 1 lit. b GDPR.

4.2. Use of payment service providers

- Paypal
When selecting the payment method PayPal, credit card via PayPal, direct debit via PayPal or – if offered - "purchase on account" or "installment payment" via PayPal, the payment processing is carried out via PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal").
We pass on your personal data in accordance with Art. 6 para. 1 lit. b GDPR as far as necessary to PayPal. PayPal reserves the right to carry out a credit check for the payment methods credit card via PayPal, direct debit via PayPal or – if offered - "purchase on account" or "installment payment" via PayPal.
For this purpose, your payment data may be passed on to credit agencies in accordance with Art. 6 para. 1 lit. f GDPR based on PayPal's legitimate interest in determining your solvency. PayPal uses the result of the credit assessment with regard to the statistical probability of non-payment for the purpose of deciding on the provision of the respective payment method.
The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, these have their basis in a scientifically recognized mathematical-statistical procedure. The calculation of the score values includes, among other things, but not exclusively, address data.
What other data is collected by PayPal can be found in the respective privacy policy of PayPal. This can be found at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for contractual payment processing.

- SOFORT
When selecting the payment method "SOFORT", payment processing is carried out via the payment service provider SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany (hereinafter "SOFORT").
We pass on your personal data together with information about your order in accordance with Art. 6 para. 1 lit. b GDPR exclusively for the purpose of payment processing and only to the extent necessary to SOFORT.
Sofort GmbH is part of the Klarna Group (Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden).
The data protection provisions of SOFORT can be viewed here: https://www.klarna.com/sofort/datenschutz

- Klarna

In order to be able to offer you Klarna's payment methods, we may transmit your personal data in the form of contact and order data to Klarna at the checkout, so that Klarna can assess whether you qualify for Klarna's payment methods and to adapt these payment methods for you. Your transmitted personal data is processed in accordance with Klarna's privacy policy.

Klarna's privacy policy can be viewed here:

https://www.klarna.com/international/privacy-policy/

5. Data processing when opening a customer account and for contract fulfillment

When you open a customer account with us, personal data is collected and processed in accordance with Art. 6 (1) (b) GDPR. The scope of the data can be seen from the input form. The data you enter will be stored and used by us for the purpose of contract fulfillment.
You can delete your customer account at any time. This can be done by sending a message to the address of the controller or, if offered, directly within the customer account. In this case, we will also block your data with due regard for retention periods under tax and commercial law and delete them after these periods have expired. The only exception to this would be your consent to permanent storage or any further data processing permitted by law on our part.

6. Contacting us

When you contact us via the contact form, the data entered in the input mask will be transmitted to us and stored. The data collected can be found in the respective input mask. When contacting us by email, only the data you provide there will be transmitted to us.
The data will be used exclusively for processing the conversation and your request. The legal basis for processing the data is Art. 6 (1) (a) GDPR if the user has given their consent. The legal basis for processing data transmitted in the course of sending an email is Art. 6 (1) (f) GDPR. If the email contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 (1) (b) GDPR. The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected and provided that there are no statutory retention requirements to the contrary. For the personal data from the contact form input mask and data sent by email, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been finally clarified. The user has the option to revoke their consent to the processing of personal data at any time. If the user contacts us by email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.

7. Use of your data for direct marketing

7.1. Newsletter

On our website, there is the possibility to subscribe to a free newsletter. When you register for the newsletter, the data from the input mask is transmitted to us. The only mandatory information is your email address. If you provide further voluntary information, this will only be used for personal address.

The legal basis for processing your data after registration for the newsletter is Art. 6 (1) (a) GDPR if the user has given their consent. We obtain this consent by sending you a confirmation email after you register for the newsletter, which contains a confirmation link. By clicking on this link, you give your consent to receive the newsletter.
When you register for the newsletter, we store your IP address as well as the date and time of registration. This storage serves to trace possible misuse of your email address.

We use the data collected when you register for the newsletter exclusively for the purpose of sending the newsletter.

You can cancel your newsletter subscription at any time. A corresponding link can be found in every newsletter for this purpose. This also allows you to revoke your consent to the storage of personal data collected during the registration process.

7.2. Advertising by mail

If you have provided your first and last name, postal address, and, if applicable, further personal data due to an order with us, we reserve the right to store this data and send you our offers by mail in order to safeguard our legitimate interest in personalized direct advertising in accordance with Art. 6 (1) (f) GDPR.

You can object to the storage and use of your data for this purpose at any time by sending a corresponding message to the controller.

8. Use of social media: Video

Use of YouTube videos

On this website, we use the YouTube embedding function to display and play videos from the provider "YouTube," which belongs to Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). We use the extended data protection mode, which, according to the provider, only initiates the storage of user information when the video(s) are played. When you start playing embedded YouTube videos, the provider "YouTube" uses cookies to collect information about your user behavior. According to "YouTube," this is used, among other things, to record video statistics, improve user-friendliness, and prevent abusive practices. If you are logged into Google, your data will be directly assigned to your account.

If you do not wish to be associated with your profile on YouTube, you must log out before activating the button. Google stores your data (even for users who are not logged in) as usage profiles and evaluates them. Such an evaluation is carried out in particular in accordance with Art. 6 (1) (f) GDPR based on the legitimate interests of Google in displaying personalized advertising, market research, and/or designing a website in line with requirements. Our legitimate interest in embedding the videos in accordance with Art. 6 (1) (f) GDPR also lies in evaluating user behavior, designing our website according to user interests, and exploiting the financial potential of our website.

You have the right to object to the creation of these user profiles, for which you must contact YouTube. Regardless of whether or not the embedded videos are played, a connection to the Google network "DoubleClick" is established each time this website is accessed, which may trigger further data processing operations without our influence.

Data may also be transmitted to the servers of Google LLC in the USA. In the event that personal data is transferred to Google LLC based in the USA, Google LLC has certified itself for the US-European data protection agreement "Privacy Shield," which ensures compliance with the data protection level applicable in the EU. Further information on data protection at "YouTube" can be found in the provider's privacy policy at: https://www.google.de/intl/de/policies/privacyOpt-out is possible at:
https://adssettings.google.com/authenticated.

9. Web analysis services

9.1. Google Analytics

We use the web analysis service Google Analytics (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland) for this website.
Google Analytics uses "cookies". These are text files that are stored on your computer and enable an analysis of your use of the website.

The information generated about your use of this website (including the shortened IP address) is transmitted to a Google server and stored there; a transfer to the USA is possible.

We use Google Analytics with the extension "_anonymizeIp()", which ensures anonymization of the IP address by shortening it and excludes direct personal reference. Your IP address will therefore be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. In exceptional cases, the full IP address will be transmitted to a Google server, also in the USA, and shortened there.
In these exceptional cases, this processing is carried out in accordance with Art. 6 (1) (a) GDPR, namely your express consent.

On our behalf, Google uses this information to evaluate your website use, to compile reports on website activity, and to provide other services related to website and internet usage to us. Your IP address will not be merged with other Google data.

You can prevent the storage of cookies by adjusting your browser settings accordingly.

You can also prevent the collection of the data generated by the cookie and related to your use of the website (including your IP address) as well as the processing of this data by Google by downloading and installing the following browser plugin:

http://tools.google.com/dlpage/gaoptout?hl=de

Alternatively, you can set an opt-out cookie:
Deactivate Google Analytics

This opt-out cookie only works in this browser and only for this domain. If you delete your cookies in this browser, you must click this link again.

In the event of data transfer to Google LLC based in the USA, Google LLC is certified for the US-European data protection agreement "Privacy Shield," which ensures compliance with the data protection level applicable in the EU.

This website also uses Google Analytics for a cross-device analysis of visitor flows, which is carried out via a User-ID. You can deactivate the cross-device analysis of your usage in your customer account under "My Data," "Personal Data."

Google privacy policy:
https://support.google.com/analytics/answer/6004245?hl=de

9.2. Shopify Analytics

We use the web analysis service from Shopify (Shopify International Limited, Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland).

To safeguard our legitimate interest in the statistical analysis of user behavior for optimization and marketing purposes, Shopify collects, evaluates, and stores pseudonymized visitor data, from which pseudonymized usage profiles can be created and evaluated. Shopify uses cookies to recognize the browser, thus enabling a more accurate determination of statistical data. Your IP address is also collected, but is pseudonymized immediately after collection and before storage, so that personal reference is excluded.

The legal basis is Art. 6 (1) (a) GDPR, namely your express consent.

Shopify does not associate your IP address with other data from Shopify.

To object to the collection of data and the creation of pseudonymized user profiles and the setting of cookies for the future, you can generally deactivate the use of cookies on your computer by setting your internet browser so that no cookies can be stored on your computer in the future or that cookies already stored are deleted. However, switching off all cookies may mean that some functions on our websites can no longer be used in full.

You can also find Shopify's data protection guidelines at:
https://www.shopify.de/legal/datenschutz

10. Use of a live chat system

Zendesk (formerly Zopim)
On this website, we use the live chat system of Zendesk Inc., 1019 Market St, San Francisco, USA (www.zendesk.com).
Anonymous data is collected and stored for the purpose of web analysis and for operating the live chat system to answer live support requests. From this anonymized data, usage profiles can be created under a pseudonym. Cookies may also be used for this purpose. These cookies enable the recognition of the internet browser. Insofar as the information collected in this way has a personal reference, the legal basis for processing is Art. 6 (1) (f) GDPR.

Our legitimate interest lies in effective customer support and the statistical analysis of user behavior for optimization purposes. The data is not used to identify the visitor to this website personally without the express consent of the data subject. No data is merged with personal data about the bearer of the pseudonym.

You can avoid the storage of cookies by setting your internet browser so that no cookies can be stored on your computer in the future or that cookies already stored are deleted. However, this may lead to some functions on our website no longer being executable. You have the option to object to the data collection and storage for the purpose of creating a pseudonymized usage profile at any time with effect for the future. Please send us your objection informally by email to the email address mentioned at the beginning of the privacy policy.

Zendesk Inc., based in the USA, is certified for the US-European data protection agreement "Privacy Shield," which ensures compliance with the data protection level applicable in the EU.

11. Rights of the data subject

11.1. Applicable data protection law grants you comprehensive rights (information and intervention rights) against the controller regarding the processing of your personal data, about which we inform you below:

- Right of access pursuant to Art. 15 GDPR:
You can request confirmation from the controller as to whether personal data concerning you is being processed by the controller. Furthermore, you have the right to information about the purpose, the categories of personal data, the recipients, the planned duration of storage, and the existence of further rights such as the correction of data or the existence of a right to lodge a complaint with a supervisory authority, the origin of your data if not collected by us, the existence of automated decision-making including profiling and, if applicable, meaningful information about the involved logic and the scope and intended effects of such processing for you, as well as your right to be informed of what guarantees exist according to Art. 46 GDPR when your data is forwarded to third countries;

- Right to rectification pursuant to Art. 16 GDPR:
You have the right to immediate rectification of incorrect data concerning you and/or completion of your incomplete data stored by us; the rectification or completion must take place immediately.

- Right to restriction of processing pursuant to Art. 18 GDPR:
You have the right to request the restriction of the processing of your personal data as long as the accuracy of your data is being checked, if you refuse the deletion of your data due to inadmissible data processing and instead request the restriction of the processing of your data, if you need your data for the assertion, exercise, or defense of legal claims after we no longer need this data after the purpose has been achieved, or if you have lodged an objection due to your particular situation, as long as it is not yet certain whether our legitimate reasons outweigh yours;
If the processing of your personal data has been restricted, this data – apart from its storage – may only be processed with your consent or for the assertion, exercise, or defense of legal claims or to protect the rights of another natural or legal person or for reasons of an important public interest of the Union or a Member State. If the restriction of processing has been restricted, you will be informed by the controller before the restriction is lifted.

- Right to erasure pursuant to Art. 17 GDPR:
You have the right to request the immediate erasure of your personal data if the requirements of Art. 17 (1) GDPR are met. However, this right to erasure does not exist, in particular – but not exhaustively – if the processing is necessary for the exercise of the right to freedom of expression and information, for the fulfillment of a legal obligation, for reasons of public interest, or for the assertion, exercise, or defense of legal claims;

- Right to be informed pursuant to Art. 19 GDPR:
If you have exercised your right to rectification, erasure, or restriction of processing, the controller is obliged to communicate this rectification or erasure of data or restriction of processing to all recipients to whom your personal data has been disclosed, unless this proves impossible or involves disproportionate effort. You also have the right to be informed about these recipients.

- Right to data portability pursuant to Art. 20 GDPR:
You have the right to receive your personal data provided to us in a structured, commonly used, and machine-readable format or to request the transfer to another controller, as far as this is technically possible;

- Right to revoke pursuant to Art. 7 (3) GDPR:
You have the right to object at any time to the processing of personal data concerning you, which is carried out on the basis of Art. 6 (1) (e) or (f) GDPR; this also applies to profiling based on these provisions.
You also have the right to revoke your data protection consent declaration at any time with effect for the future. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until the revocation.

- Right to lodge a complaint pursuant to Art. 77 GDPR:
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you are of the opinion that the processing of your personal data violates the GDPR.

11.2. Right to object

You have the right to object to the processing of your data at any time with effect for the future, if we process your data based on our overriding legitimate interest after a balancing of interests.
If you exercise this right to object, we will end the processing of your data, unless there are demonstrable compelling legitimate grounds that override your interests, or if the further processing serves the assertion, exercise, or defense of legal claims.

12. Duration of storage of personal data

The duration of the storage of personal data depends on the respective statutory retention periods.Once they expire, we routinely delete the data if it is no longer required for the fulfillment or initiation of a contract and/or if we have no legitimate interest in continued storage.