Data Protection
Controller responsible for data processing:
Eichmüller OHG
Blieskastelstr. 6
Munich
Germany
Email: datenschutz@eichmueller.de
Phone: 089 17959600
Thank you for your interest in our online shop. Protecting your privacy is very important to us. Below we provide detailed information on how we handle your data.
1. Access Data and Hosting
You can visit our websites without providing any personal information. Each time a website is accessed, the web server automatically stores what is known as a server log file, which includes the name of the requested file, your IP address, date and time of access, amount of data transferred, and the requesting provider (access data), and documents the access. These access data are evaluated exclusively to ensure the trouble-free operation of the site and to improve our offer. This serves to safeguard our legitimate interests in the correct presentation of our offer in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR. All access data will be deleted no later than seven days after the end of your visit to the site.
1.2. Hosting
Hosting services and website display are partly provided by our service providers as part of processing on our behalf. Unless otherwise explained in this privacy policy, all access data and all data collected in forms provided on this website are processed on their servers. If you have any questions about our service providers and the basis of our cooperation with them, please refer to the contact option described in this privacy policy.
2. Data Processing for Contract Fulfillment and Contact
2.1. Data Processing for Contract Fulfillment
For the purpose of contract processing (including inquiries and handling of any existing warranty and performance issues as well as legal update obligations) in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR, we collect personal data if you voluntarily provide it to us as part of your order. Mandatory fields are marked as such, because we need the data to process the contract and cannot send the order without it. What data is collected can be seen from the respective input forms.
Further information on the processing of your data, especially regarding the transfer to our service providers for order, payment, and shipping processing, can be found in the following sections of this privacy policy. After the complete processing of the contract, your data will be restricted for further processing and deleted after the expiry of tax and commercial retention periods in accordance with Art. 6 para. 1 sentence 1 lit. c GDPR, unless you have expressly consented to further use of your data pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR or we reserve the right to use the data beyond this, which is legally permitted and about which we inform you in this policy.
Merchandise Management System
For order and contract processing, we use merchandise management systems of external service providers. Our service providers operate on our behalf under a processing agreement. If you have questions about our service providers and the basis of our cooperation with them, please refer to the contact option described in this privacy policy.
2.2. Customer Account
If you have given your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR by deciding to open a customer account, we will use your data for the purpose of opening and maintaining the customer account and storing your data for future orders on our website. Deletion of your customer account is possible at any time and can be done either by sending a message to the contact option described in this privacy policy or via a function provided in the customer account. After deleting your customer account, your data will be deleted unless you have expressly consented to further use of your data pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR or we reserve the right to use the data beyond this, which is legally permitted and about which we inform you in this policy.
2.3. Contact
As part of customer communication, we collect personal data to process your inquiries in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR if you voluntarily provide us with this data when contacting us (e.g., via contact form or email). Mandatory fields are marked as such because we need the data to process your request. What data is collected can be seen from the respective input forms. After your request has been fully processed, your data will be deleted unless you have expressly consented to further use of your data pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR or we reserve the right to use the data beyond this, which is legally permitted and about which we inform you in this policy.
Live Chat Tool WhatsApp
For the purpose of customer communication, we use the live chat tool provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“WhatsApp”). This serves to safeguard our overriding legitimate interest in effective and improved customer communication pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR. WhatsApp acts on our behalf. The phone numbers stored on our mobile device are automatically processed on servers of Meta companies with headquarters at 1601 Willow Road, Menlo Park, California 94025, USA. Only phone numbers of customers who have previously contacted us via WhatsApp and who have therefore already accepted WhatsApp’s terms of use and privacy policy are stored.
Our service providers are located and/or use servers in the following countries, for which the European Commission has determined an adequate level of data protection by decision: USA, Israel, United Kingdom.
An adequacy decision by the European Commission is in place for the USA as a basis for data transfers to third countries, provided that the respective service provider is certified. Such certification exists.
Our service providers are located and/or use servers in the following countries: Singapore. For these countries, there is no adequacy decision by the European Commission. Our cooperation with them is based on the standard contractual clauses of the European Commission.
3. Data Processing for Shipping Purposes
To fulfill the contract pursuant to Art. 6 para. 1 sentence 1 lit. b GDPR, we pass on your data to the shipping service provider entrusted with the delivery, insofar as this is necessary for the delivery of ordered goods.
Data Transfer to Shipping Providers for Shipment Notification
If you have given your express consent during or after your order pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR, we will pass on your email address to the selected shipping provider so that they can contact you before delivery for the purpose of delivery notification or coordination.
You may revoke your consent at any time by sending a message to the contact address mentioned in this privacy policy or directly to the shipping provider at the contact address listed below. After revocation, we will delete your data provided for this purpose unless you have expressly consented to further use of your data or we reserve the right to use it further, as legally permitted and explained in this policy.
General Logistics Systems Germany GmbH & Co. OHG
GLS Germany-Straße 1 - 7
DE-36286 Neuenstein
Germany
DHL Paket GmbH
Sträßchensweg 10
53113 Bonn
Germany
DPD Deutschland GmbH
Wailandtstraße 1
63741 Aschaffenburg
Germany
4. Data Processing for Payment Transactions
We work with the following partners to process payments in our online shop: technical service providers, credit institutions, payment service providers.
4.1. Data Processing for Transaction Handling
Depending on the selected payment method, we pass on the data necessary for processing the payment transaction to our technical service providers acting on our behalf, or to the commissioned credit institutions or the selected payment service provider, to the extent required for the payment process. This serves to fulfill the contract pursuant to Art. 6 para. 1 sentence 1 lit. b GDPR. Some payment providers collect the necessary data themselves, e.g., via their own website or through a technical integration into the order process. In this respect, the privacy policy of the respective payment provider applies.
If you have questions about our payment processing partners and the basis of our cooperation with them, please refer to the contact option described in this privacy policy.
4.2. Data Processing for Fraud Prevention and Payment Optimization
We may provide our service providers with additional data that they, together with the data necessary for payment processing, use as our processors for the purpose of fraud prevention and optimization of our payment processes (e.g., invoicing, handling of disputed payments, support for accounting). This serves to safeguard our overriding legitimate interests in protection against fraud and efficient payment management pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR.
4.3. Identity and Credit Check for Purchase on Account via PayOne
If you choose the payment method "purchase on account" (offered via PayOne GmbH, Lyoner Str. 9, 60528 Frankfurt a. M., Germany (hereinafter referred to as PayOne)), we ask for your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR to transmit the data required for payment processing and identity and credit checks to PayOne. In Germany, the credit agencies listed in the PayOne privacy policy may be used for identity and credit checks. The information received about the statistical probability of default is used by PayOne for a balanced decision on the initiation, execution, or termination of the contractual relationship. You may revoke your consent at any time by contacting the address provided in this privacy policy. This may result in us being unable to offer you certain payment options.
4.4. Identity and Credit Check for Purchase on Account via PayPal and Ratepay
If you choose the payment method "purchase on account" (offered via Ratepay GmbH, Franklinstraße 28-29, 10587 Berlin (hereinafter Ratepay) and PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg (hereinafter PayPal)), we ask for your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR to transmit the data required for payment processing and identity and credit checks to Ratepay. In Germany, the credit agencies listed in the Ratepay privacy policy may be used for identity and credit checks. The information received about the statistical probability of default is used by Ratepay for a balanced decision on the initiation, execution, or termination of the contractual relationship. You may revoke your consent at any time by contacting the address provided in this privacy policy. This may result in us being unable to offer you certain payment options. Additional information on PayPal’s data protection can be found here.
5. Advertising via Email, Postal Mail
5.1. Email Newsletter with Registration
If you sign up for our newsletter, we will use the data required for this purpose or separately provided by you to regularly send you our email newsletter based on your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR. You can unsubscribe from the newsletter at any time, either by sending a message to the contact option described below or via a link provided in the newsletter. After unsubscribing, we will delete your email address from the mailing list unless you have expressly consented to further use of your data pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR or we reserve the right to further use your data as permitted by law and about which we inform you in this declaration.
5.2. Email Newsletter Without Registration and Your Right to Object
If we receive your email address in connection with the sale of a product or service and you have not objected, we reserve the right to regularly send you offers for similar products from our range by email based on § 7 para. 3 UWG. This serves to protect our overriding legitimate interests in advertising communication with our customers. You can object to the use of your email address at any time by sending a message to the contact option described in this privacy policy or via a link provided in the promotional email, without incurring any costs other than the transmission costs according to the basic rates. After unsubscribing, we will delete your email address from the mailing list unless you have expressly consented to further use of your data pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR or we reserve the right to further use your data as permitted by law and about which we inform you in this declaration.
5.3. Newsletter Delivery
The newsletter may also be sent by our service providers as part of processing on our behalf. If you have questions about our service providers and the basis of our cooperation with them, please contact the option described in this privacy policy.
5.4. Postal Advertising and Your Right to Object
We also reserve the right to use your first and last name and your postal address for our own advertising purposes, e.g., to send you interesting offers and information about our products by regular mail. This serves to protect our overriding legitimate interests in advertising communication with our customers pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR. You can object to the storage and use of your data for these purposes at any time by sending a message to the contact option described in this privacy policy.
Advertising mail is provided as part of processing on our behalf by a service provider to whom we pass on your data for this purpose.
6. Cookies and Other Technologies
General Information
To make your visit to our website attractive and to enable the use of certain functions, we use technologies including so-called cookies on various pages. Cookies are small text files that are automatically stored on your device. Some of the cookies we use are deleted after the browser session ends, i.e., after you close your browser (session cookies). Other cookies remain on your device and enable us to recognize your browser on your next visit (persistent cookies).
Privacy Protection on Devices
When using our online service, we use technologies that are absolutely necessary to provide the explicitly requested telemedia service. In this regard, storing information on your device or accessing information already stored on your device does not require your consent.
For functions that are not strictly necessary, storing or accessing information on your device requires your consent. Please note that if you do not grant consent, parts of the website may not be fully usable. Any consent you have granted will remain effective until you adjust or reset the relevant settings on your device.
Subsequent Data Processing by Cookies and Other Technologies
We use technologies that are strictly necessary for the use of certain website functions (e.g., shopping cart function). These technologies collect and process IP address, time of visit, device and browser information, and data on your use of our website (e.g., contents of the shopping cart). This is done to protect our legitimate interests in providing an optimized presentation of our services pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR.
We also use technologies to fulfill legal obligations we are subject to (e.g., to demonstrate consent to the processing of your personal data) as well as for web analytics and online marketing purposes. You can find further details, including the legal basis for data processing, in the following sections of this privacy policy.
You can find cookie settings for your browser under the following links: Microsoft Edge™ / Safari™ / Chrome™ / Firefox™ / Opera™
If you have consented to the use of technologies pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR, you may withdraw your consent at any time by sending a message to the contact option described in the privacy policy.
7. Use of Cookies and Other Technologies
If you have given your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR, we use the following cookies and other technologies from third-party providers on our website. After the purpose no longer applies and the respective technology is no longer used by us, the data collected in this context will be deleted. You can revoke your consent at any time with effect for the future. More information about your revocation options can be found in the section "Cookies and other technologies." Further details, including the legal basis of our cooperation with individual providers, are available in the descriptions of the technologies. If you have questions about the providers or the legal basis of our cooperation with them, please contact us using the contact information provided in this privacy policy.
Use of Google Services
We use the technologies listed below from Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The information automatically collected by Google technologies about your use of our website is usually transferred to a server of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and stored there. Unless stated otherwise for individual technologies, data processing takes place on the basis of an agreement between joint controllers in accordance with Art. 26 GDPR. Further information about data processing by Google can be found in Google's privacy policy.
Our service providers are located and/or use servers in countries outside the EU and EEA for which the European Commission has determined an adequate level of data protection by decision.
Our service providers are located and/or use servers in countries outside the EU and EEA for which there is no adequacy decision by the European Commission. Our cooperation with them is based on standard data protection clauses issued by the European Commission.
Google Fonts
To ensure a uniform presentation of content on our website, data (IP address, time of visit, device and browser information) is collected via the "Google Fonts" script code, transmitted to Google, and then processed by Google. We have no influence on this subsequent data processing.
YouTube Video Plugin
To include third-party content, data (IP address, time of visit, device and browser information) is collected via the YouTube video plugin in the extended data protection mode we use, transmitted to Google, and then processed by Google, but only when you play a video.
8. Integration of the Trusted Shops Trustbadge / Other Widgets
If you have given your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR, Trusted Shops widgets are integrated on this website to display Trusted Shops services (e.g., trustmark, collected reviews) and to offer Trusted Shops products to buyers after an order.
The Trustbadge and the associated services are an offering of Trusted Shops AG, Subbelrather Str. 15C, 50823 Cologne ("Trusted Shops"), with whom we are jointly responsible for data protection according to Art. 26 GDPR. Below, we inform you about the essential content of the joint responsibility agreement in accordance with Art. 26 para. 2 GDPR.
Within the framework of joint responsibility with Trusted Shops AG, please contact Trusted Shops primarily for data protection questions and to assert your rights, using the contact information provided in the privacy policy of Trusted Shops. Regardless, you can always contact the data controller of your choice. If necessary, your inquiry will be forwarded to the other responsible party.
8.1. Data Processing When Integrating the Trustbadge / Other Widgets
The Trustbadge is provided by a U.S. content delivery network (CDN) provider. An adequate level of data protection is ensured via an adequacy decision by the EU Commission, which can be accessed here. U.S. service providers used are generally certified under the EU-U.S. Data Privacy Framework (DPF). More information is available here. If service providers are not certified under the DPF, standard contractual clauses are used as appropriate safeguards.
When the Trustbadge is accessed, the web server automatically saves a so-called server log file that also contains your IP address, date and time of access, transferred data volume, and the requesting provider (access data) and documents the access. The IP address is anonymized immediately after collection so the stored data cannot be linked to your person. The anonymized data is used especially for statistical purposes and error analysis.
8.2. Data Processing After Order Completion
If you have given your consent, the Trustbadge accesses order information stored on your device (order total, order number, possibly purchased product) as well as your email address after order completion. Your email address is hashed using a cryptological one-way function. The resulting hash value is then transmitted to Trusted Shops together with the order information in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR. This is used to check whether you are already registered for Trusted Shops services. If you are, further processing takes place according to the contractual agreement made between you and Trusted Shops. If you are not yet registered or do not give your consent to automatic recognition via the Trustbadge, you will be given the opportunity afterward to register manually for the use of the services or to complete the protection as part of your possibly existing user contract.
The Trustbadge accesses the following information stored on the device you use after you complete your order: order total, order number, and email address. This is necessary so that we can offer you buyer protection. Data will only be transmitted to Trusted Shops if you actively decide to complete the buyer protection by clicking the appropriately labeled button in the so-called Trustcard. If you choose to use the services, further processing is based on the contractual agreement with Trusted Shops pursuant to Art. 6 para. 1 lit. b GDPR, in order to complete your registration for buyer protection, secure the order, and, if applicable, send you review invitations via email afterward.
Trusted Shops uses service providers in hosting, monitoring, and logging. The legal basis is Art. 6 para. 1 lit. f GDPR to ensure smooth operation. Processing may occur in third countries (USA and Israel). An adequate level of data protection is ensured by adequacy decisions of the EU Commission, which can be accessed here for the USA and here for Israel. Service providers from the USA are generally certified under the EU-U.S. Data Privacy Framework (DPF). More information is available here. If service providers are not certified under the DPF, standard contractual clauses have been agreed upon as an appropriate safeguard.
9. Social Media
9.1. Social Plugins from Instagram (by Meta), WhatsApp
Social buttons from social networks are used on our website. These are only embedded as HTML links on the page, so no connection to the servers of the respective provider is established when you visit our website. If you click on one of the buttons, the website of the respective social network opens in a new browser window where you can, for example, press the Like or Share button.
9.2. Our Online Presence on Facebook (by Meta), Instagram (by Meta), YouTube
If you have given your consent according to Art. 6 para. 1 sentence 1 lit. a GDPR to the respective social media operator, your data will be automatically collected and stored during visits to our online presences on the aforementioned social media platforms for market research and advertising purposes. Usage profiles are created using pseudonyms. These can be used to display advertising on and off the platforms that presumably correspond to your interests. Cookies are generally used for this purpose. Detailed information about the processing and use of data by the respective social media operator, as well as contact options and your rights and settings to protect your privacy, can be found in the privacy policies linked below. If you need help in this regard, you can contact us.
Facebook (by Meta) is an offering of Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland (“Meta Platforms Ireland”). The information automatically collected by Meta Platforms Ireland about your use of our online presence on Facebook (by Meta) is usually transmitted to a server of Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025, USA, and stored there. Data processing in connection with visiting a Facebook (by Meta) fan page is based on an agreement between joint controllers pursuant to Art. 26 GDPR. More information (including insights data) can be found here.
Our service providers are located and/or use servers in the following countries, for which the European Commission has established an adequate level of data protection by decision: USA, Canada, Japan, South Korea, New Zealand, United Kingdom, Argentina.
There is an adequacy decision by the European Commission for the USA as a basis for third-country transfers, provided the respective service provider is certified. Certification is present.
Our service providers are located and/or use servers in these countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Brazil, Mexico.
For these countries, there is no adequacy decision by the European Commission. Our cooperation with you is based on these guarantees: standard data protection clauses of the European Commission.
Instagram (by Meta) is an offering of Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland (“Meta Platforms Ireland”). The information automatically collected by Meta Platforms Ireland about your use of our online presence on Instagram is usually transmitted to a server of Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025, USA, and stored there. Data processing in connection with visiting an Instagram (by Meta) fan page is based on an agreement between joint controllers pursuant to Art. 26 GDPR. More information (including insights data) can be found here.
Our service providers are located and/or use servers in the following countries, for which the European Commission has established an adequate level of data protection by decision: USA, Canada, Japan, South Korea, New Zealand, United Kingdom, Argentina.
There is an adequacy decision by the European Commission for the USA as a basis for third-country transfers, provided the respective service provider is certified. Certification is present.
Our service providers are located and/or use servers in these countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Brazil, Mexico.
For these countries, there is no adequacy decision by the European Commission. Our cooperation with you is based on these guarantees: standard data protection clauses of the European Commission.
YouTube is an offering of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The information automatically collected by Google about your use of our online presence on YouTube is usually transmitted to a server of Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA, and stored there.
Our service providers are located and/or use servers in countries outside the EU and EEA, for which the European Commission has made an adequacy decision ensuring an adequate level of data protection.
Our service providers are located and/or use servers in countries outside the EU and EEA. For these countries, no adequacy decision by the European Commission exists. Our cooperation with them is based on standard contractual clauses of the European Commission.
10. Contact Options and Your Rights
10.1. Your Rights
As a data subject, you have the following rights:
- According to Art. 15 GDPR, the right to request information about the personal data we process about you to the extent specified there;
- According to Art. 16 GDPR, the right to request immediate correction of incorrect or completion of your personal data stored with us;
- According to Art. 17 GDPR, the right to request the deletion of your personal data stored with us, unless further processing is necessary
- to exercise the right to freedom of expression and information;
- to comply with a legal obligation;
- for reasons of public interest; or
- to assert, exercise, or defend legal claims;
- According to Art. 18 GDPR, the right to request restriction of processing of your personal data, insofar as
- the accuracy of the data is disputed by you;
- processing is unlawful, but you oppose deletion;
- we no longer need the data, but you require it for the assertion, exercise, or defense of legal claims; or
- you have objected to the processing pursuant to Art. 21 GDPR;
- According to Art. 20 GDPR, the right to receive your personal data provided to us in a structured, commonly used, and machine-readable format or to request transmission to another controller;
- According to Art. 77 GDPR, the right to lodge a complaint with a supervisory authority. Usually, you can contact the supervisory authority of your usual place of residence, place of work, or our company headquarters.
|
Right to Object To the extent that we process personal data as explained above to safeguard our overriding legitimate interests in the context of a balancing of interests, you may object to this processing with effect for the future. If the processing is for direct marketing purposes, you can exercise this right at any time as described above. If the processing is for other purposes, you have the right to object only if there are reasons arising from your particular situation. After you exercise your right to object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing serves to assert, exercise, or defend legal claims. This does not apply if the processing is for direct marketing purposes. In that case, we will no longer process your personal data for this purpose. |
10.2. Contact Options
If you have any questions about the collection, processing, or use of your personal data, about information, correction, restriction, or deletion of data, as well as revocation of consent given or objection to specific data use, please contact us directly using the contact details in our imprint.
Privacy Policy created with the Trusted Shops legal text generator.
