Privacy policy

As Legamaster International BV and operator of this website, we take the protection of your data very seriously. In the following, we would like to inform you to what extent and for what purpose we collect and process your personal data on this website (hereinafter referred to as “website”).

1. general information; definitions

Our privacy policy is based on the terms used in the General Data Protection Regulation (GDPR). We use the following terms, among others, in this privacy policy

Personal data means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (cf. Art. 4 No. 1 GDPR).

Processing means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (cf. Art. 4 No. 2 GDPR).

Controller or controller responsible for the processing is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data (cf. Art. 4 No. 7, half-sentence 1 GDPR).

Processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller (cf. Art. 4 No. 8 GDPR).

Third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data (cf. Art. 4 No. 10 GDPR).

Consent is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her (see Art. 4 No. 11 GDPR).

2. responsibility and contact

The controller for the data processing described below is the body named in the legal notice.

With this privacy policy, we comply with our information obligations regarding the scope and purposes of the processing of your personal data in accordance with Art. 12 - 14 GDPR.

If you wish to view and update your personal data or have any questions about data protection on our website, you can contact us at any time by email at datenschutz@edding.de.

Our external data protection officer will be happy to provide you with information on the subject of data protection using the following contact details

datenschutz nord GmbH
Sechslingspforte 
22087 Hamburg

Web: www.datenschutz-nord-gruppe.de

E-Mail: office@datenschutz-nord.de

If you contact our data protection officer directly, please also indicate the responsible body named in the legal notice.

3. processing of your personal data

The scope and type of processing of your personal data differs depending on whether you wish to contact us via our website, order something in our online store, register on our website or use our website for information purposes only. With regard to the data processing processes described below, you can assert your rights as a data subject at any time (see section 7).

3.1 Collection of data with your cooperation

We collect and store your personal data in connection with the use of this website when you provide it to us, e.g. when you create a customer account. It is always your free decision whether you provide us with your data for the relevant purposes.

3.1.1 Enquiries via email and customer service

If you send us an email, your email address and any personal content contained in the message will be stored by us (legal basis is Art. 6 para. 1 f) GDPR). We only do this in order to be able to process your request.

If your request is product-related (e.g. clarification of concerns about your customer account, damage reports, complaints, returns processing, order and delivery research, etc.), we process your personal data to initiate or execute a contractual relationship (legal basis: Art. 6 para. 1 b) GDPR).

After the purpose has ceased to apply, we will delete the relevant data. With regard to this data processing, you can also assert your rights as a data subject at any time (see section 7), in particular object to the corresponding data processing.

3.1.2 Enquiries via contact form

If you contact us via one of our contact forms, the personal data you enter in the corresponding input fields will be collected and stored. This includes the following information in particular:

Country,
Product category,
customer type,
product,
Subject and message in the text field (depending on the entry)*,
Seller,
date of purchase,
Product images (max. 3 MB),
Salutation,
first name,
surname*,
e-mail address*,
telephone number,
postal address.

The details marked with an * symbol are mandatory fields, without which it is not possible to process your request.

This personal data is stored exclusively for the purpose of processing your request and in the event that follow-up questions arise. To answer the request, the request can be forwarded by e-mail to the respective internal contact person (legal basis is Art. 6 para. 1 f) or Art. 6 para. 1 b) GDPR, if your request is product-related).

After the purpose has ceased to apply, we will delete the relevant data. With regard to this data processing, you can also assert your rights as a data subject at any time (see section 7), in particular object to the corresponding data processing.

3.1.3 Shopping in the Legamaster Shop
3.1.3.1 Orders as a guest

We require personal data from you in order to conclude and execute your contract or order as a guest. This includes in particular the following personal data:

  • First name and surname*,
  • Billing and delivery address*,
  • e-mail address*,
  • billing and payment data,

If you are a business customer, we also collect and process the following information:

  • Company*,

It is not possible to register without providing the data marked with an * in the registration form. Your data is processed in order to identify you as a customer, to process, fulfill and process your order, to correspond with you, to issue invoices, to process any liability claims and to assert any claims. It is therefore unfortunately not possible to complete the order process without providing this data. The legal basis for this is Art. 6 para. 1 b) GDPR, i.e. you provide us with the data on the basis of the contractual relationship between you and edding.

If we do not use your personal data to send you a newsletter (see section 3.1.4), we will store your data collected for contract processing until the expiry of the statutory or possible contractual warranty and guarantee rights. After expiry of this period, we retain the information required under commercial and tax law for the contractual relationship for the periods specified by law. For this period (regularly ten years from the conclusion of the contract), the data is processed again solely in the event of an audit by the tax authorities, for economic and tax audit purposes and to investigate possible criminal offenses.

3.1.3.2 Creation of a customer account

In order to provide you with the greatest possible convenience when shopping, we offer you the permanent storage of your personal data in a password-protected customer account. Registration for this is voluntary. To register, you must enter a password of your choice in addition to the data requested when placing an order (see section 3.1.3.1). This is used together with your e-mail address to access your customer account. Once a customer account has been set up, it is no longer necessary to enter data again to place an order. It is not possible to create a customer account without providing the personal data specified under 3.1.3.1.

Following registration, a confirmation email is sent, which completes the creation of the customer account. A further confirmation is not required. Your personal customer number will then be assigned to you and the medium of your registration will also be saved. In addition, your purchases (date, article, article number, quantity, price, currency, type of transaction) will be registered and saved.

A permanent cookie can be set when you log in. This function allows you to conveniently access your customer account for 365 days after your first login without having to re-enter your password. For security reasons, access to parts of the “My account” area as well as orders and changes to your address and payment details are still password-protected. If you do not wish to use this function, please log out at the end of your visit to our website using the logout button.

The legal basis for processing is Art. 6 para. 1 f) GDPR. Our legitimate interest follows from the provision of a convenient use of our website and a simplification of the ordering process. Registration is voluntary. You can also place an order on our website as a guest at any time.

You can view and change the data stored about you in your customer account at any time or delete your customer account. You can also send an email to datenschutz@edding.com to delete your customer account. Please note that the deletion of your customer account only causes a deletion in our webshop system. Deletion in downstream systems is not necessarily associated with this. However, your data will be restricted for further processing and finally deleted after expiry of the retention periods under tax and commercial law, unless you have consented to the further processing of your data (e.g. in the newsletter dispatch) or we reserve the right to further data processing, which is permitted by law and about which we have informed you in this privacy policy.

3.1.3.3 Direct advertising

If you create a customer account on our website, we may also use the e-mail address you provide to us in this way to send you advertising e-mails. In such a case, we use the email to send direct advertising for our own similar goods or services. In this case, the legal basis for sending advertising emails is Section 7 (3) of the German Act against Unfair Competition [UWG] and Art. 6 (1) f) GDPR. This takes place regardless of whether you have subscribed to the newsletter or not.

If you do not wish to receive advertising emails, you can unsubscribe from these advertising emails at any time and thus object to the processing of your email address for this purpose (Art. 21 GDPR). To do this, either follow the unsubscribe link in the respective advertising email or send us an email to
datenschutz@edding.de.

3.1.3.4 Fraud prevention

The data you provide when placing an order can be used to check whether an atypical ordering process has taken place (e.g. simultaneous ordering of a large number of goods to the same address using different customer accounts). In principle, we have a legitimate interest in carrying out such a check. Our legitimate interest arises from the possibility of avoiding fraud attempts to our detriment and thus preventing economic disadvantages for us (legal basis Art. 6 para. 1 f) GDPR).

You can object to the processing of your data at any time (Art. 21 GDPR). However, we must point out that further orders in our online store may no longer be possible.

3.1.3.5 Payment methods
(1) Credit card

If you wish to pay for your order in the edding store by credit card, we need the following personal data to process the payment:

Credit card number*
Name of the credit card holder*
Validity period of the credit card*
Check digit*

The details marked with an * symbol are mandatory details without which payment by credit card is not possible.

We check the data entered together with the data of your order in order to be able to recognize misuse of the credit card or the payment option by credit card at an early stage and use the data after successful verification to process the agreed payment by credit card.

The legal basis for the associated data processing is Art. 6 para. 1 b) GDPR, i.e. the processing of your data is necessary for the fulfillment of the agreement to pay for your purchase by credit card.

The above data will be stored by us for a maximum period of 24 months in order to be able to compare it with other credit card payments to combat fraud and abuse, and will then be deleted. 

The storage of the data beyond payment processing is based on our legitimate interests in being able to offer you an effective and secure payment option and in this context to prevent credit card misuse and fraud (legal basis: Art. 6 para. 1 f) GDPR).

(2) PayPal

If you use the online payment service PayPal of PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”), the following personal data will be automatically transmitted to PayPal so that you can authorize the payment to us via PayPal:

  • First and last name
  • delivery address
  • e-mail address
  • IP address
  • the shopping cart details (e.g. order value, product group, value of goods, delivery method if applicable)

This is the only way PayPal can correctly assign your order and you have all relevant order information at a glance when confirming the payment with PayPal.

By selecting this payment option, the transmission of the data is required for contractual payment processing (legal basis: Art. 6 para. 1 b) GDPR). If you do not wish your data to be passed on to PayPal, you can select a different payment method at any time.

PayPal reserves the right to carry out a credit check. For this purpose, your payment data may be passed on to credit agencies on the basis of PayPal's legitimate interest (legal basis: Art. 6 para. 1 f) GDPR) in determining your solvency. PayPal uses the result of the credit check with regard to the statistical probability of non-payment for the purpose of deciding on the provision of the respective payment method. The credit report may contain probability values (so-called score values). If score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of the score values includes, but is not limited to, address data. Further data protection information, including information on the credit agencies used, can be found in PayPal's privacy policy here;

You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for contractual payment processing.

3.1.3.6 Transmission of data to TOF

To deliver orders, we work with the external shipping service provider trans-o-flex Express GmbH & Co; KGaA, Hertzstraße 10
69469 Weinheim, Germany (hereinafter referred to as “TOF”). This shipping service provider receives the following data from us for the execution of the respective order

First and last name
delivery address
If applicable, e-mail address (if the shipping service provider would like to inform you by e-mail about the expected delivery date)

Your personal data will be passed on to the respective shipping service provider for the purpose of executing the contractual relationship (legal basis: Art. 6 para. 1 b) GDPR).

We will only transmit your e-mail address to GLS for the purpose of announcing and coordinating the delivery if you have given your express consent to this (legal basis: Art. 6 para. 1 a) GDPR).

Declaration of consent for notification of delivery

I have read and understood the privacy policy. I agree that Legamaster International BV may transmit the e-mail address I entered when ordering to the shipping service provider in accordance with section 3.1.3.6 of the privacy policy. I can revoke this consent at any time.

In order to document the submission of your declaration of consent, we also store your IP address and the time of submission of your consent. You can of course revoke this consent at any time for the future. Revocation does not affect the legality of the processing (until revocation).

If you do not consent to the forwarding of your e-mail address, the delivery will be made accordingly without notification of the delivery or coordination of the delivery date by GLS.

If you no longer wish to receive delivery notifications after giving your consent, you can object to receiving delivery notifications at any time (Art. 21 GDPR) or revoke the underlying consent (Art. 7 para. 3 GDPR) and thus unsubscribe. To do this, click on the link contained in the delivery notification. You will then be guided through the unsubscribe process. Alternatively, you can also send us your objection to receiving delivery notifications by email to datenschutz@edding.de.

3.1.3.7 Anti-terrorist list comparison

The EU regulations on combating terrorism (EC) No. 2580/2001 and (EC) No. 881/2002 require that no customer, supplier, service provider or employee of edding belongs to the group of suspected terrorists defined in centrally maintained lists (terror lists). It is therefore necessary for edding to compare your personal data transmitted to us with the so-called terror lists before the respective business transaction is concluded (legal basis: Art. 6 para. 1 c) GDPR).

3.1.4 Subscription to our newsletter
3.1.4.1 Subscription to the newsletter

edding offers a newsletter on the website that provides information about products, services and promotions. You can subscribe to the newsletter by ticking a checkbox and confirming the “Send” button with the following text:

Newsletter consent form

I have read and understood the privacy policy. I agree that the data I have entered may be processed for the purpose of sending the newsletter in accordance with section 3.1.4 of the privacy policy.  This consent is voluntary and can be revoked by me at any time.

If you have ordered the newsletter and thus given your consent to the processing of your data (legal basis: Art. 6 para. 1 a) GDPR), we will process your personal data as follows:

When you register for the newsletter, your e-mail address and your first and last name are stored. We use this data for internal statistical purposes and to tailor the content of our newsletter more precisely to you.

We use the so-called double opt-in procedure to subscribe to our newsletter. After registering for the newsletter, we will send you an email to the email address you have provided, in which we ask you to confirm that you have requested to receive the newsletter. If you confirm your registration, the newsletter will be sent to your e-mail address permanently. However, if you do not confirm your registration, your registration will be automatically deleted after 48 hours.

3.1.4.2 Mailchimp

We use the service provider Mailchimp, which is operated by the US provider Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA, to design the content, send and analyze the response to our newsletter. For this purpose, we have concluded an order processing agreement with Mailchimp, which ensures that Mailchimp processes your personal data exclusively in accordance with our instructions and in compliance with applicable data protection law. To ensure a level of data protection in line with the EU, we have concluded EU standard contractual clauses (Art. 46 para. 2 c) GDPR) with Mailchimp, according to which Mailchimp undertakes to comply with European data protection law.

When you subscribe to our newsletter (see section 3.1.4.1), Mailchimp stores your IP address and the time of your subscription to document your declaration of consent and when you subscribe to and confirm the newsletter. In addition, your email address and any other personal data provided by you for the purpose of personalizing the newsletter will therefore be stored on Mailchimp's servers in the USA. Mailchimp uses this information to send our newsletter and to analyze user behavior when receiving the newsletter. As part of the usage analysis, Mailchimp collects technical information, in particular the browser used, the IP address and the time of retrieval. Mailchimp determines whether and when a newsletter or links contained therein are opened. This information is used exclusively to better assess the expectations of newsletter recipients and to adapt the content accordingly. Mailchimp is also able to use this data to optimize or improve its own services, for example to make the newsletter dispatch more effective by recording the set language, location information or time zones. At no time will Mailchimp write to you on the basis of your personal data for its own purposes or pass your data on to third parties.

Further information can be found in the privacy policy (https://mailchimp.com/legal/privacy/) and the general terms and conditions of the Rocket Science Group.

We use the services of Mailchimp as a processor on the basis of our legitimate interest Art. 6 para. 1 f) GDPR. Our legitimate interest here is the centrally coordinated offer of a newsletter that is both legally compliant and specific to your interests by a professional provider.

If you no longer wish to receive the newsletter, you can object to receiving the newsletter at any time (Art. 21 GDPR) or revoke the underlying consent (Art. 7 para. 3 GDPR) and thus unsubscribe from the newsletter. To do this, click on the link contained in every newsletter. You will then be guided through the unsubscribe process. Alternatively, you can also send us your objection to receiving the newsletter by email to datenschutz@edding.de.

3.1.5 Competitions via social media

When organizing competitions via our social media channels (Instagram and Facebook), edding collects personal data from the participants in the course of the competition. Depending on the individual case and where necessary, this includes the following data in particular

  • First name and surname
  • Account name
  • e-mail address
  • Date of birth
  • postal address
  • Telephone number
  • Contribution to the competition

The personal data will be stored, processed and used for the purpose of carrying out and processing the respective competition (legal basis: Art. 6 para. 1 b) GDPR). According to this, we may process your personal data to the extent necessary for the implementation of the competition, which includes in particular the assessment of the entry, the verification of compliance with the terms of use and the notification and delivery of the prize.

If necessary for this purpose, your data may be passed on to our shipping service providers (see 3.1.3.6) in compliance with applicable data protection law when the competition is carried out.

Insofar as the winner(s) are announced on the organizer's websites / social media channels after the conclusion of the competition, this is done on the basis of Art. 6 para. 1 f) GDPR. Our overriding legitimate interest is to communicate the successful completion of the competition to the community in an effective advertising manner. You can object to this at any time by sending an informal message to edding (Art. 21 GDPR).

We will delete your data if it is no longer required for the aforementioned purposes and we are not legally obliged or entitled to continue storing the data, in particular for verification purposes in connection with participation in the competition. In this case, we will block the data for all other purposes and restrict access rights accordingly.

For the use of the social media platform Facebook, the data processing process as in section 3.3.2 and for Instagram as in section 3.3.3 applies.

3.2 Collection of data without your involvement

We collect and use personal data automatically generated by your visit to our website to provide our services.

3.2.1 Log files and (session) cookies

When you visit our website, our servers temporarily record the following personal data in log files

IP address of your computer
File request of the client (file name and URL)
http status code
Website from which you are visiting us

We process your personal data on the basis of our overriding legitimate interest in the detection of misuse (spam, viruses, etc.) and for the detection and elimination of malfunctions (legal basis: Art. 6 para. 1 f) GDPR).

In addition, our website uses “cookies” in several places, which serve to make our offer more user-friendly and effective. Cookies are small text files that our website places on your computer or other internet-enabled devices such as tablets or smartphones. If your browser settings accept cookies, your browser adds the text in a small file.

Unless otherwise stated in this privacy policy, the cookies we use are necessary for the functionality and performance of our website. Two different types of cookies can be used on the pages, so-called “session cookies” and “permanent cookies”. Session cookies are temporary cookies that remain on your device until you leave the website. A permanent cookie, on the other hand, remains on your device for a certain period of time, even after you have left the website, or until you delete it manually. (How long a cookie remains on your device depends on the “lifespan” of this cookie). This includes, for example, cookies that enable you to log in to the secure area of our website.  We use the information stored in the necessary cookies exclusively to provide you with the services and functions you have requested.

Cookies do not cause any damage to your computer per se and do not contain viruses. You have the option of setting your browser so that these cookies are not stored in the first place or that the cookies are deleted at the end of your Internet session. Please note, however, that in this case you may not be able to use all the functions of our website.

Here you will find an overview of all cookies that are set on our website.

3.2.2 Google tracking and marketing tools

We use various tracking and marketing tools from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, (hereinafter referred to as “Google”) on our website.

If you have your habitual residence in the European Economic Area or Switzerland, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is the controller responsible for your data.

If you have expressly consented to the respective data processing described in sections 3.2.3.1 to 3.2.3.3 (Art. 6 para. 1 a) GDPR), Google generates the information required for its service through the use of cookies. The data is usually transferred to a Google server in the USA and stored there. To ensure a level of data protection in line with the EU, we have concluded EU standard contractual clauses with Google (Art. 46 para. 2 c) GDPR), according to which Google undertakes to comply with European data protection law.

You can prevent the installation of cookies in various ways:

  • by setting your browser software accordingly; in particular, the suppression of third-party cookies means that you will not receive any ads from third-party providers. We would like to point out that in this case you may not be able to use all the functions of our website to their full extent;

  • by installing the plug-in provided by Google under the following link: https://www.google.com/settings/ads/plugin;
    by deactivating the interest-based ads of the providers that are part of the “About Ads” self-regulation campaign via the link http://www.aboutads.info/choices, whereby this setting is deleted when you delete your cookies.Y

You can find more information on data protection when using Google Analytics at https://support.google.com/analytics/answer/2838718?hl=de&ref_topic=6010376. You can also find more information on protecting your data when using Google services at the following links:

  • https://www.google.com/analytics/terms/de.html
  • https://policies.google.com/?hl=de

3.2.2.1 Google Analytics

Google Analytics is used on our website. Google Analytics stores cookies in your web browser for a period of two years from your last visit. As a result, the following data is recorded when you visit our website and transmitted to a Google server in the USA and stored there

  • Browser type/version,
  • Operating system used,
  • Referrer URL (the previously visited page),
  • Host name of the accessing computer (IP address),
  • time of the server request,
  • the achievement of “website goals” (e.g. contact requests),
  • Your behavior on the pages (e.g. clicks, scrolling behavior and length of stay)
  • Your approximate location (country and city),
  • technical information such as browser, internet provider, end device and screen resolution,
  • the source of your visit (i.e. which website or advertising medium you came to us from)

In particular, the IP address transmitted by your browser will not be merged with other Google data. We have also added the code “anonymizeIP” to Google Analytics on this website. This guarantees that your IP address is masked. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there.

The cookies used by Google Analytics also contain a randomly generated user ID with which you can be recognized on future visits to the website. The information generated by the cookies is stored together with the randomly generated user ID, which makes it possible to analyze pseudonymous user profiles. This user-related data is automatically deleted after 540 days at the latest. Other data remains stored in aggregated form indefinitely.

Google uses the information obtained through the use of cookies to analyze your use of our website, to compile reports on website activity and to provide us with other services relating to website activity and internet usage. In this way, we can improve our offer and make it more interesting for you as a user. We also receive information about the functionality of our website (e.g. to identify navigation problems).

In addition, Google is entitled to process the information obtained for its own purposes. For this reason, we only use Google's services on our website if you consent to the processing of your personal data (legal basis is Art. 6 para. 1 a) GDPR).  Once you have given your consent, you can of course revoke it at any time for the future as described above under section 3.2.3. You will also receive an opt-out cookie here, which you can install to prevent data collection by Google, which is particularly helpful in cases where the deactivation add-on does not work, e.g. on mobile devices. If you use our website with different browsers/end devices, you must carry out the steps described for all browsers/end devices.

Further information on the protection of your data when using Google services can also be found under the following links:

https://www.google.com/analytics/terms/de.html
https://policies.google.com/?hl=de

3.2.2.2 Google Ads Conversion

We use the “Google Ads Conversion” service to draw attention to our attractive offers with the help of advertising material (so-called Google Ads) on external websites. We can determine how successful the individual advertising measures are in relation to the advertising campaign data. We are interested in showing you advertising that is of interest to you, making our website more interesting for you and achieving a fair calculation of advertising costs.

These advertisements are delivered by Google via so-called “ad servers”. For this purpose, we use ad server cookies, through which certain parameters for measuring success, such as the display of ads or clicks by users, can be measured. If you access our website via a Google ad, Google Ads will store a cookie on your device. These cookies lose their validity after 540 days at the latest and are not intended to identify you personally. This cookie usually contains the following analysis values

  • Unique cookie ID,
  • Number of ad impressions per placement (frequency),
  • last impression (relevant for post-view conversions) and
  • opt-out information (marking that the user no longer wishes to be addressed)

are stored. These cookies enable Google to recognize your browser. If you visit certain pages of an Ads customer's website and the cookie stored on your computer has not yet expired, Google and we can recognize that you clicked on the ad and were redirected to this page. A different cookie is assigned to each Ads customer. Cookies can therefore not be tracked via the websites of Ads customers.

We ourselves do not collect and process any personal data in the aforementioned advertising measures. Google only provides us with statistical evaluations. Based on these evaluations, we can recognize which of the advertising measures used are particularly effective. We do not receive any further data from the use of the advertising material; in particular, we cannot identify users on the basis of this information.

If you have expressly consented to the data processing described (Art. 6 para. 1 a) GDPR), your browser automatically establishes a direct connection with the Google server due to the marketing tools used. We have no influence on the scope and further use of the data collected by Google through the use of this tool and therefore inform you according to our level of knowledge: By integrating Ads Conversion, Google receives the information that you have accessed the corresponding part of our website or clicked on an advertisement from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, there is a possibility that Google will find out your IP address and store it.

3.2.2.3 Google Ads Remarketing

Within Google Ads, we also use the remarketing function if you have given your express consent (Art. 6 para. 1 a) GDPR). With the remarketing function, we can present users of our website with advertisements based on their interests on other websites within the Google advertising network (in Google Search or on YouTube, so-called “Google Ads” or on other websites). For this purpose, your interaction as a user of our website is analyzed, e.g. which offers you were interested in, in order to be able to show you targeted advertising on other sites even after you have visited our website. To enable the analysis, Google stores cookies on your device when you visit Google services or websites in the Google Display Network. These cookies lose their validity after 540 days at the latest (this only applies to cookies that are set via this website). These cookies make it possible to identify your browser, which can be used to record your visits to the respective website. The cookies are used exclusively to identify the web browser on a specific end device and not to identify a person.

3.2.3 Google Tag Manager

This website uses Google Tag Manager. Google Tag Manager is a solution that allows us to manage website tags via an interface. The tool itself (which implements the tags) is a cookie-less domain and does not collect any personal data. The tool triggers other tags (e.g. Google Analytics - see section 3.2.3), which in turn may collect data. Google Tag Manager does not access this data. If deactivation has been carried out at domain or cookie level, this remains in place for all tracking tags that are implemented with Google Tag Manager.

3.2.4 Facebook Pixel

For further analysis and optimization and for the economic operation of our offer, we also use “Facebook Pixel” of the social network Facebook, which is operated by Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter “Facebook”).

To ensure a level of data protection in line with the EU, we have concluded EU standard contractual clauses with Facebook (Art. 46 (2) c) GDPR), according to which Facebook undertakes to comply with European data protection law.

Facebook Pixel is directly integrated into our website by Facebook and can store a cookie on your device if you have given your express consent (Art. 6 (1) a) GDPR). If you subsequently log in to Facebook or visit Facebook while logged in, your visit to our website will be noted in your profile. The data collected about you is anonymous to us, so it does not allow us to draw any conclusions about your identity. However, the data is stored and processed by Facebook so that a connection to the respective user profile is possible and can be used by Facebook and for its own market research and advertising purposes. If we transmit data to Facebook for comparison purposes, it is encrypted locally on the browser and only then sent to Facebook via a secure https connection. This is done for the sole purpose of creating a comparison with the data that is also encrypted by Facebook.

With the help of the Facebook pixel, Facebook is also able to determine the visitors to our website as a target group for the display of ads (so-called “Facebook ads”). Accordingly, we use the Facebook pixel to display the Facebook ads placed by us only to those Facebook users who have also shown an interest in our online offering or who have certain characteristics (e.g. interest in certain topics or products determined on the basis of the websites visited) that we transmit to Facebook (so-called “custom audiences”). With the help of the Facebook pixel, we also want to ensure that our Facebook ads correspond to the potential interest of users and are not annoying. With the help of the Facebook pixel, we can also track the effectiveness of Facebook ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook ad (so-called “conversion”).

Furthermore, we use the additional function “extended comparison” when using the Facebook pixel. Here, data for the creation of target groups (“Custom Audiences” or “Look Alike Audiences”) is transmitted to Facebook in encrypted form.

We only use Facebook Pixel on our website if you consent to this processing of your personal data (Art. 6 para. 1 a) GDPR). You can, of course, withdraw your consent at any time with future effect. Revocation does not affect the lawfulness of the processing (until revocation).

You can find more information on the collection and use of data by Facebook as well as your rights in this regard and options for protecting your privacy in Facebook's privacy policy at https://www.facebook.com/about/privacy/.

Alternatively, you can deactivate the remarketing function “Custom Audiences” at https://www.facebook.com/settings/?tab=ads#_=_. You must be logged in to Facebook to do this.

To set which types of ads are displayed to you within Facebook, you can go to the page set up by Facebook and follow the instructions on the settings for usage-based advertising. The settings are platform-independent, i.e. they are adopted for all devices such as desktop computers or mobile devices. You can also object to the use of cookies for reach measurement and advertising purposes via the deactivation page of the Network Advertising Initiative and additionally via the US website aboutads.info or the European website youronlinechoices.com.

3.2.7 Microsoft Advertising

We use the Microsoft Advertising service on our website, which is provided and operated by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (“Microsoft”).

If you have your habitual residence in the European Economic Area or Switzerland, Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521, is the controller responsible for your data.

To use Microsoft services, we have implemented a so-called Universal Event Tracking (UET) tag from Microsoft on our website. This is a code that can be used in conjunction with a cookie to collect and store information about the use of our website. Microsoft collects and processes personal data via the cookie, from which usage profiles are created for us using pseudonyms. In this way, we can learn more about the user behavior of the users of our website with the help of Microsoft. When Microsoft provides the services, data is also transferred to Microsoft servers in the USA, which is why we have concluded EU standard contractual clauses with Microsoft that oblige Microsoft to guarantee an appropriate level of data protection.

Microsoft only sets a cookie on your end device if you have given your express consent (legal basis Art. 6 para. 1 a) GDPR) and have reached our website via a Microsoft ad (e.g. via Bing).

In this case, we receive in particular statistical information about which keywords or which ad users came to us via, what users click on our website, how many users visit our website via Microsoft Ads and how long users stay on our website. The information collected is stored for up to 390 days.

Microsoft also uses the data for its own purposes, e.g. to optimize its own advertising and other services. If you have a Microsoft account yourself, the data collected may also be linked to your account. For example, Microsoft may recognize and store your IP address. In addition, Microsoft may be able to track your usage behavior across several of your electronic devices through so-called cross-device tracking and is thus able to display personalized advertising on or in Microsoft websites and apps.

f you do not want information about your user behavior to be processed by Microsoft as explained above, you can refuse the setting of a cookie required for this, for example via browser settings, which you can use to generally deactivate or manage the setting of cookies or delete cookies that have been set. You can also prevent the collection of your data by Microsoft using cookies by declaring your objection under the following Link

Further information on data protection and the cookies used by Microsoft can be found on the Microsoft website.

4. disclosure of data to other third parties

In addition to the tools and features used on our website, we must also pass on some data to third parties in strict compliance with applicable data protection law.

4.1 Disclosure to external service providers

It may be necessary for external service providers to have access to personal data (in particular IT service providers) for the content-related technical support and design of our online presence.

In this case, your personal data will be handled exclusively in accordance with our express instructions and on the basis of an agreement on commissioned processing in accordance with Art. 28 GDPR. With this agreement, the service provider guarantees us that the service provision complies with applicable data protection law. The involvement of professional providers of corresponding services is expressly provided for by law and serves our legitimate interest in professionalizing our offer for you and being able to offer it in a commercially viable manner (legal basis: Art. 6 para. 1 f) GDPR). We remain responsible for the protection of your data even in this case. In this context, we forward your data to the following service providers

4.2 Disclosure due to legal obligation

We reserve the right to disclose your personal data if we are legally obliged to do so or if we are requested to do so by authorities or law enforcement agencies. Beyond this, we do not pass on any data to third parties.

5. place of data processing and data security

Your data is mainly processed in Germany. Your data will only be transferred to a country outside the European Union or the European Monetary Area if an adequate level of protection within the meaning of Art. 45 para. 2 GDPR has been established for this country. Data collected on our website may be transferred on this basis to the United States (e.g. to the Rocket Science Group, the provider of Mailchimp). In order to protect your data from unauthorized access and misuse, we have taken extensive, state-of-the-art technical and organizational security precautions in accordance with European data protection law (Art. 32 GDPR) and, in the case of order processing, have concluded an agreement in accordance with Art. 28 GDPR.

6. deletion and blocking of personal data

We process and store personal data of the data subject only for the period necessary to achieve the purpose of storage or, if provided for by law, until a relevant storage period has expired.

If the storage purpose no longer applies or if a legally prescribed storage period expires, the personal data will be blocked or deleted in accordance with the statutory provisions, unless the data subject has given us consent for storage and further processing.

7. rights of data subjects

Right to information You can request information free of charge at any time about the scope, origin and recipients of the stored data and the purpose of the storage (Art. 15 GDPR). If you wish to exercise your right to information, you can contact an edding employee or the data protection officer at any time.

Right to data portability You may receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format (Art. 20 GDPR), provided that (1) the processing is based on consent pursuant to Art. 6 (1) a) GDPR or Art. 9 (2) a) GDPR or on a contract pursuant to Art. 6 (1) b) GDPR and (2) the processing is carried out by automated means.

Right to rectification Any person affected by the processing of personal data has the right to request the immediate rectification of inaccurate personal data concerning them (Art. 16 GDPR). Furthermore, taking into account the purposes of the processing, the data subject has the right to request the completion of incomplete personal data.

Right to erasure (right to be forgotten): Any person concerned by the processing of personal data has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay where one of the following grounds applies and insofar as the processing is not necessary (Art. 17 GDPR): (1) The personal data have been collected or otherwise processed for such purposes for which they are no longer necessary. (2) The data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing. (3) The data subject objects to the processing and there are no overriding legitimate grounds for the processing. (4) The personal data have been processed unlawfully. (5) The deletion of the personal data is necessary to fulfill a legal obligation.

Right to object: Any person affected by the processing of personal data has the right to object at any time to the processing of personal data concerning them (Art. 21 GDPR).

In the event of an objection, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims. If we process personal data for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing.

Right to withdraw consent under data protection law: Any person affected by the processing of personal data has the right to withdraw consent to the processing of personal data at any time (Art. 7 para. 3 GDPR).

Right to lodge a complaint with a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR (Art. 77 GDPR).

If you assert your rights against us, we will examine your claim and, insofar as there are no other legal regulations to the contrary, we will comply with it. We will inform you of the result.

No special form is required to assert your rights as a data subject. For example, write an email to datenschutz@edding.de or use the contact options on our website.

8. updating and changes

Parts of this Privacy Policy may be changed or updated by us without prior notice to you. Please check the privacy policy before you use our website to ensure that you are up to date with any changes or updates.