Data protection

Disclaimer: This data protection information was automatically translated. In case of doubt, please refer to the German original.

Below we inform you about the processing of your personal data when using our online shop at https://shop.bvb.de as well as in connection with orders, customer accounts, contact enquiries and marketing activities.

I. General Information on Data Processing

We process personal data only to the extent necessary for the provision of our online shop, the initiation and performance of contracts, the handling of your enquiries, the fulfilment of legal obligations, the security of our services, or the other purposes described in this privacy policy. Where we require your consent, processing only takes place after you have given it. You may withdraw your consent at any time with effect for the future. This privacy policy applies to the BVB Online Shop. For other services of the Borussia Dortmund Group, in particular bvb.de, BVB TV, BVB Ticketing and other independent services, the respective privacy notices published there apply.

II. Controller and Data Protection Officer

The controller responsible for the processing of personal data in connection with the operation of the BVB Online Shop is:

BVB Merchandising GmbH
Rheinlanddamm 207–209
44137 Dortmund
Germany
Phone: +49 231 90200
E-mail: [email protected]

You can reach our Data Protection Officer at:

Rechtsanwalt Ulf Haumann, LL.M.
c/o Borussia Dortmund GmbH & Co. KGaA
Rheinlanddamm 207–209
44137 Dortmund
E-mail: [email protected]

III. Your Data in the Online Shop

1. Visiting the Online Shop and Server Log Files

When you access our online shop, our system processes technically necessary data that your browser transmits to our server or to technical service providers engaged by us. This includes in particular the IP address, date and time of access, requested page or file, volume of data transferred, HTTP status code, referrer URL, browser type and version, operating system, and language settings. The processing serves the provision of the online shop, the stability and security of our systems, the prevention of abusive access, and error analysis. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional provision of the online shop. Log data is generally deleted or anonymised after seven days, unless longer storage is required to investigate specific security incidents or to assert, exercise, or defend legal claims.

2. Technically Necessary Technologies

We use cookies and comparable technologies to the extent strictly necessary to provide the functions of the online shop that you have expressly requested. This may include in particular the storage of your privacy settings, the maintenance of a login session, the provision and storage of the shopping cart, fraud prevention, and technical security. Where access to or storage of information on your end device is strictly necessary for these functions, it is based on Section 25(2) No. 2 TDDDG. The subsequent processing of personal data is based, where applicable, on Art. 6(1)(b) GDPR for the initiation or performance of a contract and otherwise on Art. 6(1)(f) GDPR.

3. Consent Management

We use the consent management tool "consentmanager" (https://www.consentmanager.net/de/datenschutz/) provided by consentmanager AB (Håltgelvågen 1b, 72348 Västerås, Sweden, [email protected]) to obtain, manage, and document your consent for optional technologies. In this context, we process in particular your selection decision, timestamps, a consent identifier, technical information about your end device and browser, and where applicable the truncated IP address. The legal basis is Art. 6(1)(c) GDPR to the extent that processing serves as proof of your consent, and Art. 6(1)(f) GDPR for the storage and management of your selection decision. You can change your settings at any time at https://shop.bvb.de/de/?cmpscreencustom=. We store your selection decision for 12 months, unless you delete or change it beforehand via your browser settings or the consent management tool.

4. Customer Account

You can create a customer account to manage orders, save your details for future orders, and use additional shop functions where applicable. In doing so, we process the data requested in the registration form, in particular name, e-mail address, postal address, password in encrypted form, customer ID, time of registration, and technical log data. The legal basis is Art. 6(1)(b) GDPR. The data is required for the provision of the customer account. You can have your customer account deleted at any time via Account Details > Account Settings or by contacting [email protected]. Data that we require for the processing of outstanding contracts or due to statutory retention obligations will only be deleted after these purposes have ceased to apply.

4a. Guest Order

You can also place an order in the BVB Online Shop as a guest without creating a customer account. In this case, we process only the data you provide during the ordering process that is required for the performance of the purchase contract, delivery, and payment processing. This includes in particular salutation, first and last name, billing and delivery address, e-mail address, and the selected payment method. Your data is not permanently stored in a user profile; after completion of the order and expiry of the statutory retention periods, the data will be deleted. The legal basis is Art. 6(1)(b) GDPR.

5. Order and Contract Processing

When you order goods via the online shop, we process the data required for the order, delivery, payment, communication, and handling of warranty, return, or complaint cases. This includes in particular salutation, first and last name, billing and delivery address, e-mail address, phone number, ordered items, order number, payment method, payment status, shipping information, order-related communication, and where applicable personalisation details for a product. The legal basis is Art. 6(1)(b) GDPR. The mandatory information is set out in the respective order form. Without the information required for contract processing, we cannot process your order or dispatch the goods. Information that is not required for contract processing is marked as voluntary. We store contract and invoice data for the duration of the contract processing. Subsequently, we retain it only to the extent and for as long as statutory retention obligations or legitimate interests, in particular the assertion, exercise, or defence of legal claims, require this. Commercial and tax-related documents are generally retained for the statutory periods prescribed by law.

6. Payment

For the processing of payments, we pass on the necessary order, contact, and payment data to the payment service provider you have selected. Data processing is carried out for the purpose of executing the payment process on the basis of Art. 6(1)(b) GDPR. Payment service providers generally process the data as independent controllers in accordance with their own privacy notices. Depending on the payment method offered, the following data may in particular be processed: name, billing address, e-mail address, order number, order amount, currency, payment status, payment identifiers, and the payment data required for the selected payment method.

The following payment methods are available in the BVB Online Shop, for which the service providers listed below are used:

a) PayPal and PayPal Express

We offer payment via PayPal and PayPal Express. The provider is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal"). The payment account is held by BVB Merchandising GmbH with PayPal. If you select a PayPal payment method, the data required for payment processing (in particular name, billing address, e-mail address, order number, order amount, and where applicable delivery address and phone number) will be transmitted to PayPal. PayPal may obtain a credit report to decide on the processing of the payment; further information can be found in PayPal's privacy policy at https://www.paypal.com/de/webapps/mpp/ua/privacy-full. PayPal Express additionally enables accelerated checkout directly via the PayPal account without prior entry of a delivery address in the shop. The legal basis for the data transfer is Art. 6(1)(b) GDPR.

b) Shopify Payments (Credit Cards, Apple Pay, Google Pay, Klarna)

For the processing of card payments and other payment methods, we use Shopify Payments, a service of Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland (hereinafter "Shopify Payments"). The following payment methods are available via Shopify Payments: Visa, Mastercard, Maestro, American Express (AMEX), UnionPay, Apple Pay, Google Pay, and Klarna.

If you select a payment method offered via Shopify Payments, the data required for the respective payment processing (in particular name, billing address, card/payment data, order number, and order amount) will be transmitted to and processed by Shopify Payments. For card payments and Apple Pay as well as Google Pay, authorisation is carried out via the respective card networks or wallet providers (Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which process the data as independent controllers in accordance with their own privacy notices. For Klarna payments, processing is carried out by Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden; Klarna may obtain a credit report to decide on the payment terms. Further information on Klarna can be found at https://www.klarna.com/de/datenschutz/. The legal basis for each data transfer is Art. 6(1)(b) GDPR.

7. Shipping and Delivery Status

To deliver the ordered goods, we transmit the necessary data to the shipping service provider we use. This regularly includes name, delivery address, and where applicable e-mail address and phone number, as well as shipment and order information. The legal basis is Art. 6(1)(b) GDPR. Where we inform you about the shipment status, this is also done for the purpose of contract performance.

The following shipping service providers are used for the delivery of ordered goods:

a) DHL Paket / DHL Express

For domestic and international shipping, we use DHL Paket (standard shipping) and DHL Express (express shipping). The provider is DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany (for DHL Paket), and DHL Express (Germany) GmbH, Heinrich-Brüning-Str. 5, 53113 Bonn, Germany (for DHL Express), both part of Deutsche Post DHL Group. To carry out the delivery, we transmit the necessary data to DHL, in particular first and last name, delivery address, e-mail address, and where applicable phone number, as well as the tracking number. Where you have consented to the transmission of your e-mail address or phone number, or where we are authorised to do so in the context of contract processing, DHL uses these contact details to inform you about the shipment status (e.g. notification of delivery or availability at a Packstation). The legal basis for the data transfer is Art. 6(1)(b) GDPR. To the extent that DHL independently processes personal data in the context of shipment tracking, DHL acts as an independent controller in this regard. Further information on data protection at DHL can be found at https://www.dhl.de/de/privatkunden/hilfe-kundenservice/datenschutz.html.

b) GLS (General Logistics Systems)

For selected shipments, we also use GLS (General Logistics Systems Germany GmbH & Co. OHG, GLS-Germany-Straße 1–7, 36286 Neuenstein, Germany) as a shipping service provider. To carry out the delivery, we transmit the necessary data to GLS, in particular first and last name, delivery address, e-mail address, and where applicable phone number, as well as the tracking number. GLS uses these contact details, where necessary, to inform you about the shipment status and to coordinate delivery (e.g. notification of delivery or availability at a GLS PaketShop). The legal basis for the data transfer is Art. 6(1)(b) GDPR. To the extent that GLS independently processes personal data in the context of shipment tracking, GLS acts as an independent controller in this regard. Further information on data protection at GLS can be found at https://gls-group.com/DE/de/datenschutz.

8. Contact

When you contact us by e-mail, contact form, chat, or any other means, we process the data you provide to handle your enquiry. This regularly includes name, contact details, content of your message, order reference, and technical data required for the prevention of misuse and for security purposes. Where your enquiry relates to the initiation or performance of a contract, Art. 6(1)(b) GDPR serves as the legal basis. Otherwise, we process your data on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper handling of your enquiry. We delete the data after final processing, unless statutory retention obligations or legitimate interests prevent this.

9. Newsletter and Other Promotional Communication

If you subscribe to our newsletter or consent to promotional communication by other means, we process your e-mail address and, where applicable, further voluntarily provided data to personalise the communication. We also store the registration, the confirmation via the double opt-in process, and the timestamp and technical evidence of consent. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, in particular via the unsubscribe link in each newsletter or by contacting [email protected].

Where we use newsletter tracking, in particular tracking of opens, clicks, or comparable interactions, we will explain this separately and, where required, obtain your consent.

IV. Web Analytics, Marketing and Social Media

1. General Principle

We use optional technologies for reach measurement, analysis, personalisation, performance measurement, and the delivery of interest-based advertising only if you have previously consented via our consent management tool. The consent covers, where required, access to or storage of information on your end device pursuant to Section 25(1) TDDDG, as well as the processing of personal data pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time at https://shop.bvb.de/de/?cmpscreencustom= with effect for the future. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal. Without consent, the essential functions of the online shop remain available to you, unless individual optional content technically depends on the respective technology. The following list may only contain services whose use has been confirmed in a technical audit. Services not in use must be removed prior to publication.

2. Analysis and Conversion Optimisation

We use Google Analytics 4 to analyse the use of our online shop. In particular, usage data, page views, interactions, technical information about the end device and browser, approximate location data, online identifiers, and event data may be processed. We only use Google Analytics with your consent. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Information on recipients, third-country transfers, storage periods, deactivated or activated functions — in particular User ID, Google Signals, data import and Google Ads linking — can be found in the consent management tool and at https://shop.bvb.de/de/?cmpscreencustom=.

We use the technology of easy Marketing to attribute advertising contacts, measure campaign performance, and where applicable settle accounts with affiliate and advertising partners. Online identifiers, referrer information, technical browser and device data, timestamps, and transaction-related event data may be processed. Where cookies, comparable identifiers or pixels are used, they are only deployed with your consent on the basis of Section 25(1) TDDDG and Art. 6(1)(a) GDPR. The provider is easy Marketing GmbH, Asselner Hellweg 124, 44319 Dortmund. Further information, storage periods, and opt-out options can be found at https://trck.easy-m.de/privacy-optout.do or https://trck.easy-m.de/privacy-mydata.do.

We use Microsoft Clarity to analyse the use of our online shop, in particular through behavioural metrics, heatmaps, and where applicable session recordings. Usage, interaction, browser, and device information may be processed. Use is exclusively subject to your consent on the basis of Section 25(1) TDDDG and Art. 6(1)(a) GDPR. The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Before activation, technical protective measures — in particular masking of input fields and exclusion of sensitive areas — must be verified.

We use ABlyft to conduct A/B tests and to optimise user navigation. Where information is stored or read on your end device or users are assigned to a variant, use is exclusively subject to your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Provider, data categories, storage period and opt-out link: https://shop.bvb.de/?ablyft_opt_out=true.

3. Advertising, Remarketing and Affiliate Marketing

Where we use technologies for conversion measurement, remarketing, interest-based advertising, or affiliate marketing, access to your end device and further data processing takes place exclusively with your prior consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

Depending on the service, the following data in particular may be processed: cookie and comparable identifiers, IP address, browser and device information, pages visited, referrer, interactions, timestamps, campaign and conversion events, and where applicable pseudonymous transaction data. The respective providers, purposes, data categories, recipient roles, storage periods, third-country transfers, and opt-out options are set out in the consent management tool and in the individual sections below.

3.1.1 Google Ads

We use Google AdWords on our website, an online advertising tool from Google that enables so-called "remarketing". This allows tailored advertising based on your browsing behaviour on other websites in the Google Display Network (Google, so-called "Google Ads" and other websites).

Your browsing behaviour on our website is analysed so that relevant advertising matching your interests can be displayed to you on other websites. For this purpose, Google uses cookies that enable your browser on a specific computer — but not a person or user — to be identified. No personal data is stored.

We only use Google AdWords with IP anonymisation enabled. This means that your IP address is truncated by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. The IP address transmitted by your browser will not be merged with other Google data.

Google Consent Mode v2 is a significant update designed to improve user privacy and data compliance. It is an interface that informs Google of the consent given by users of the website for the use of cookies. This interface is only activated when users have rejected cookies on your website. If they consent, Google uses its cookies for tracking as usual.

You can prevent the storage of cookies by adjusting your browser software settings; you can also prevent Google from collecting the data generated by the cookie and relating to your use of the online service, and from processing such data, by downloading and installing the browser plug-in available at the following link: https://policies.google.com/technologies/ads?hl=de

We also use so-called "conversion tracking", which is also part of Google AdWords. When you click on an advertisement placed by Google, a corresponding cookie is stored on your system. Here too, no personal data or other data that could be used to identify a specific user or person is processed.

The cookie is used to generate statistics on so-called "conversion rates", which, in simplified terms, represent the ratio between visits to a page and successful sales.

Cookies for conversion tracking via Google AdWords become inactive after 30 days. You can find out how to deactivate personalised advertising and conversion tracking by Google here: https://support.google.com/google-ads/answer/9606827?hl=de

3.1.2 Facebook

We use a further conversion tracking and "remarketing" tool for the evaluation of our advertising activities on Facebook, the so-called Facebook Pixel, a service of Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA.

With this service, we and Facebook can track the actions of users after they have clicked on a Facebook advertisement. This allows us to capture and evaluate the effectiveness of advertisements for statistical and market research purposes in order to optimise future advertising activities.

The data collected is anonymous to us, meaning it provides us with no insight into the identity of users. However, the data is stored and processed by Facebook, so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes in accordance with Facebook's Data Use Policy (https://www.facebook.com/about/privacy/). You can enable Facebook and its partners to place advertisements on and outside of Facebook. A cookie may also be stored on your device for these purposes.

We only use the Facebook Pixel where and to the extent that you have given us your express consent to its use. Consent to the use of the visitor activity pixel may only be given by users who are over 13 years of age. If you are younger, we ask you to seek permission from your parent or guardian. If you give your consent, data processing is carried out on the basis of Art. 6(1)(a) GDPR.

You have the right to withdraw any consent you have given at any time with effect for the future.

3.1.3 Microsoft Bing Ads

On our website, data is collected and stored using Bing Ads technologies, from which usage profiles are created using pseudonyms. This is a service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. This service enables us to track the activities of users on our website who have arrived at our website via Bing Ads advertisements. If you arrive at our website via such an advertisement, a cookie is placed on your computer. A Bing UET tag is integrated on our website. This is a code that, in conjunction with the cookie, stores some non-personal data about the use of the website. This includes, among other things, the time spent on the website, which areas of the website were accessed, and via which advertisement users arrived at the website. No information about your identity is collected.

The information collected is transmitted to Microsoft servers in the USA and stored there for a maximum of 180 days as a rule. You can prevent the collection of data generated by the cookie and relating to your use of the website, as well as the processing of such data, by disabling the setting of cookies. This may result in some limitations to the functionality of the website.

In addition, Microsoft may under certain circumstances track your usage behaviour across multiple electronic devices via so-called cross-device tracking, and is thereby able to display personalised advertising on or in Microsoft websites and apps. You can deactivate this behaviour at http://choice.microsoft.com/de-de/opt-out.

Further information on Bing's analytics services can be found on the Bing Ads website (https://help.bingads.microsoft.com/#apex/3/de/53056/2). Further information on data protection at Microsoft and Bing can be found in Microsoft's privacy statement (https://privacy.microsoft.com/de-de/privacystatement).

3.1.4 TikTok Ads

We use a further conversion tracking and "remarketing" tool for the evaluation of our advertising activities on TikTok, the so-called TikTok Pixel. The service provider is the Chinese company TikTok. For the European region, the company TikTok Technology Limited (10 Earlsfort Terrace, Dublin, D02 T380, Ireland) is responsible.

With this service, we and TikTok can track the actions of users after they have clicked on a TikTok advertisement. This allows us to capture and evaluate the effectiveness of advertisements for statistical and market research purposes in order to optimise future advertising activities.

The information collected is processed by TikTok in the USA, among other countries. We point out that, in the opinion of the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. You can prevent the collection of data generated by the cookie and relating to your use of the website, as well as the processing of such data, by disabling the setting of cookies. This may result in some limitations to the functionality of the website.

As the basis for data processing at recipients located in third countries (outside the European Union, Iceland, Liechtenstein, Norway, in particular the USA), or for data transfers to such countries, TikTok uses so-called Standard Contractual Clauses (= Art. 46(2) and (3) GDPR). Standard Contractual Clauses are template provisions provided by the EU Commission and are intended to ensure that your data meets European data protection standards even when transferred to and stored in third countries (such as the USA). By means of these clauses, TikTok undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed, and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding Standard Contractual Clauses, among other places, here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

More information about the Standard Contractual Clauses and the data processed through the use of the TikTok Pixel can be found in the Privacy Policy at https://www.tiktok.com/legal/privacy-policy-eea?lang=de or https://ads.tiktok.com/i18n/official/policy/controller-to-controller.

3.1.5 Easy Marketing – Affiliate Marketing

We process your data using Awin in the context of affiliate marketing. This enables us to track which third-party website, app, or other technology has referred potential customers to our websites and apps ("referrer") and to pay that referrer a commission in exchange for these referrals. We pursue the legitimate interest of running an online advertising campaign that is compensated on a performance basis. We work with Awin, who support us in implementing this affiliate marketing campaign. Awin's privacy policy can be found here: https://easy-m.de/datenschutzerklarung https://www.awin.com/de/rechtliches/privacy-policy-DACH. It contains information about your rights with respect to data processing by Awin. In some cases, Awin may maintain a limited profile relating to you. However, this will not reveal your identity, your online behaviour, or other personal characteristics. This profile serves solely the purpose of determining whether a referral was initiated on one device and completed on another. In some cases, Awin and the referrer of the potential customer may receive and process your personal data in order to implement the affiliate marketing campaign jointly with us. We likewise receive personal data of potential customers from Awin and the referrers, which can be divided into the following categories: cookie data, data relating to the website, app, or technology from which a potential customer was referred to us, and technical information about the device you are using.

3.1.6 Pinterest Tracking

Our website uses the conversion tracking technology of the social network Pinterest (Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland), which enables us to display relevant advertising and offers on Pinterest to website visitors who have already shown interest in our website and content/offers and who are Pinterest members. For this purpose, a so-called conversion tracking pixel from Pinterest is embedded on our pages, through which Pinterest is notified when you visit our website and which parts of our offering you have shown interest in. If you have shown interest in our subscriptions on our website, for example, an advertisement about our subscriptions may be displayed to you on Pinterest.

You can object to the collection of data for the display of interest-based advertising on Pinterest at any time in your Pinterest account settings at https://www.pinterest.de/settings (there, under "Personalisation", deactivate the button "Use info from our partners to make recommendations and ads on Pinterest more relevant to you") or at https://help.pinterest.com/de/article/personalization-and-data#info-ad (there, deactivate the checkbox under "Deactivate personalisation").

The legal basis for data processing is Art. 6(1)(a) and (f) GDPR.

3.1.7 Outbrain Inc.

This website uses the technology of Outbrain Inc. ("Outbrain"). Outbrain provides recommendations in its publisher network that may be paid for by an advertiser. If you give your consent, Outbrain provides recommendations based on how you interact with content on which Outbrain is installed. These recommendations and advertisements appear only on Outbrain advertising spaces, either on Outbrain Engage advertising spaces or in the Outbrain Extended Network. If you would like to know what information Outbrain holds about your interests, you can view your interest profile here and edit your choices (such as withdrawing your consent). You can also visit the Network Advertising Alliance or YourOnlineChoices to learn more about other organisations tracking your online interactions, and to opt out or withdraw your consent to such tracking.

Outbrain's privacy policy also describes how Outbrain collects, uses, and shares your personal information. Outbrain may share some of your personal information with third-party companies to serve advertisements that are more likely to match your interests. Visit your interest profile to withdraw your consent to behavioural advertising and/or to prevent Outbrain from sharing your personal information with third-party providers.

3.1.8 Bounce Commerce GmbH

This website uses the plugin of the professional bounce management service provider Bounce Commerce GmbH, Lindenallee 39, 47608 Geldern.

No personal or personally identifiable data is transmitted to the technical service provider.

Technically necessary cookies are used, which contain purely technical information but no personal data.

Further information on data protection at Bounce Commerce GmbH can be found at https://www.bounce-commerce.de/datenschutz.

3.1.9 Adition

We use Adition conversion tracking on our website. The service provider is Virtual Minds GmbH, Ellen-Gottlieb-Straße 16, D-79106 Freiburg im Breisgau.

Adition processes data such as the IP address and further behavioural data to measure the success of campaigns.

More information on the data processed through the use of Adition conversion tracking can also be found in the privacy policy at https://www.adition.com/datenschutz-plattform/.

You can opt out of tracking via the following link: Opt-Out

3.1.10 LinkedIn Ads

We use the LinkedIn Insight Tag conversion tracking tool on our website. The service provider is the American company LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. For data protection-relevant aspects in the European Economic Area (EEA), the EU, and Switzerland, the company LinkedIn Ireland Unlimited (Wilton Place, Dublin 2, Ireland) is responsible.

LinkedIn processes your data, including in the USA. We point out that, in the opinion of the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This may be associated with various risks to the lawfulness and security of data processing.

As the basis for data processing at recipients located in third countries (outside the European Union, Iceland, Liechtenstein, Norway, in particular the USA) or for data transfers to such countries, LinkedIn uses so-called Standard Contractual Clauses (SCCs), which are template provisions provided by the EU Commission and are intended to ensure that your data meets European data protection standards even when transferred to and stored in third countries (such as the USA). By means of these clauses, LinkedIn undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed, and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding Standard Contractual Clauses, among other places, here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

More information on the Standard Contractual Clauses at LinkedIn can be found at https://de.linkedin.com/legal/l/dpa or https://www.linkedin.com/legal/l/eu-sccs.

Further details about the LinkedIn Insight Tag can be found at https://www.linkedin.com/help/linkedin/answer/a427660. More information on the data processed through the use of the LinkedIn Insight Tag can also be found in the privacy policy at https://www.linkedin.com/legal/privacy-policy.

3.1.11 Snapchat

When you visit this website, personal data is processed. Data categories processed: data on the use of the website and logging of clicks on individual elements. Purpose of processing: analysis of usage behaviour, evaluation of the effectiveness of online marketing measures, and selection of online advertising on other platforms, which is automatically selected by means of real-time bidding based on usage behaviour. Legal basis for processing: your consent pursuant to Art. 6(1)(a) GDPR. Data is transferred to: the independent controller Snap Inc., 3000 31st Street, Santa Monica, CA 90405, USA. The legal basis for data transfer to Snap Inc. is your consent pursuant to Art. 6(1)(a) GDPR. This may also involve the transfer of personal data to a country outside the European Union. By giving your consent, you accept the risk that US authorities may access your data without you being entitled to EU legal remedies. The transfer of data is carried out on the basis of your consent pursuant to Art. 6(1)(a) in conjunction with Art. 49(1)(a) GDPR. Snap Inc.'s privacy policy: https://www.snap.com/de-DE/privacy/privacy-policy.

3.1.12 Reddit Ads

We use a conversion tracking and "remarketing" tool for the evaluation of our advertising activities on Reddit, the so-called Reddit Conversion Pixel. The service provider is the American company Reddit Inc. (548 Market St. #16093, San Francisco, California 94104). For the European region, the company Reddit Ireland Limited (Reddit EU Data Inquiries, 70 Sir John Rogerson's Quay, Dublin 2, Ireland) is responsible.

With the help of the Reddit Pixel, Reddit is able to identify you as a target group for the display of advertisements (so-called "Reddit Ads") through your visit to our online service. To enable this, we use the Reddit Pixel to display the Reddit Ads placed by us only to those Reddit users who have also shown interest in our online service or who exhibit certain characteristics. A specific characteristic could, for example, be an interest in a particular product, which could be determined by the visit to the website. The information collected is transmitted to Reddit (so-called "Customer Audiences"). The data collected is anonymous to us, meaning it provides us with no insight into the identity of the users.

With the help of the Reddit Pixel, we and Reddit can track the actions of users after they have clicked on a Reddit advertisement. This allows us to capture and evaluate the effectiveness of advertisements for statistical and market research purposes in order to optimise future advertising activities.

The use of the Reddit Pixel and the storage of "conversion cookies" only takes place if you have given your consent to the use of cookies and similar technologies when visiting our website. The legal basis is Art. 6(1)(a), Art. 49(1)(a) GDPR. You can withdraw any consent you have given using the general opt-out options.

Further information on the use of cookies by Reddit Ads can also be found at: https://www.redditinc.com/policies/cookies. Reddit is responsible for data processing in connection with the delivery of our advertisements within the social network. Further information on data processing by Reddit can be found at: https://www.redditinc.com/policies/privacy-policy.

4. Links to Social Networks

Our online shop may contain links to profiles on social networks. If you click on such a link, you will leave our online shop. Only then will the privacy policy of the respective provider apply. Where we merely provide a link, no personal data is transmitted by us to the respective platform provider prior to your clicking on the link.

V. Recipients and Data Transfers

1. Service Providers

We engage carefully selected service providers for individual processing operations, in particular for hosting, technical operations, shop software, IT security, customer service, shipping, payment processing, newsletter delivery, and analysis. To the extent that these service providers process personal data on our behalf, we conclude the required agreements pursuant to Art. 28 GDPR and monitor compliance with the agreed technical and organisational measures.

2. Independent Controllers and Joint Controllership

Where we transfer personal data to recipients who themselves decide on the purposes and means of processing, these recipients process the data as independent controllers. This may in particular be the case with payment service providers, shipping service providers, credit agencies, advertising platforms, and social networks. Where we jointly decide with a partner on the purposes and means of individual processing steps, we conclude an agreement pursuant to Art. 26 GDPR and inform you of its essential content.

3. Third-Country Transfers

Where we transfer personal data to recipients outside the European Economic Area, we provide information on the recipient, the recipient country, and the applicable basis for the transfer in the respective processing section. Where no adequacy decision exists, we base the transfer on appropriate safeguards pursuant to Art. 46 GDPR, in particular on Standard Contractual Clauses of the European Commission, and implement additional protective measures where necessary. A copy of the relevant safeguards will be made available to you upon request, provided no statutory confidentiality obligations prevent this.

VI. Storage Period

We delete personal data as soon as it is no longer required for the purposes for which it was collected or processed. Longer storage only takes place to the extent and for as long as statutory retention obligations, in particular commercial and tax law obligations, or legitimate interests, in particular the assertion, exercise, or defence of legal claims, require this. The specific storage periods for cookies and comparable technologies can be viewed in the consent management tool. Information on service-specific storage periods is contained in the respective sections of this privacy policy.

VII. Your Rights

Subject to the applicable legal requirements, you have the following rights:

  • Right of access to your personal data pursuant to Art. 15 GDPR
  • Right to rectification of inaccurate or completion of incomplete personal data pursuant to Art. 16 GDPR
  • Right to erasure of your personal data pursuant to Art. 17 GDPR
  • Right to restriction of processing pursuant to Art. 18 GDPR
  • Right to data portability pursuant to Art. 20 GDPR
  • Right to object to processing based on Art. 6(1)(e) or (f) GDPR pursuant to Art. 21 GDPR. You may object to processing for direct marketing purposes at any time without giving reasons.
  • Right to withdraw consent given with effect for the future pursuant to Art. 7(3) GDPR

To exercise your rights, please contact [email protected] or our Data Protection Officer. You also have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority for the controller is generally the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, https://www.ldi.nrw.de/.