Privacy Policy

The protection of your data is important to us, which is why we inform you below about how and to what extent we process your personal data when you use our online shop and what rights you have under the GDPR. The processing is carried out exclusively within the framework of legal provisions, in particular the GDPR and the BDSG (Federal Data Protection Act).

1. Controller

The controller for data processing within the meaning of the GDPR is:

TSV München von 1860 Spielbetriebs-GmbH
Represented by the managing director: Thomas Probst
Grünwalder Str. 114
81547 Munich, Germany
Email: vereinsmanagement@tsv1860.org

2. Data Protection Officer

You can reach our Data Protection Officer Werner Bednarsch at:
Email: datenschutz@tsv1860.org

3. General Information on Data Processing

3.1. Scope of Personal Data Processing

We generally process your personal data only to the extent necessary to provide a functional online shop, as well as our content and services. The processing of personal data regularly takes place only with your consent or in cases where prior consent cannot be obtained for factual reasons and the processing is permitted by legal regulations.

3.2. Legal Bases for Processing

Insofar as we obtain your consent for the processing of personal data, Art. 6 Para. 1 lit. a GDPR serves as the legal basis.

For the processing of personal data required for the fulfillment of a contract to which you are a party – such as a purchase agreement in our online shop – Art. 6 Para. 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary for carrying out pre-contractual measures.

Insofar as the processing of personal data is necessary for compliance with a legal obligation to which we are subject (e.g., tax and commercial law retention obligations), Art. 6 Para. 1 lit. c GDPR serves as the legal basis.

If processing is necessary for the purposes of a legitimate interest pursued by us or by a third party, and your interests, fundamental rights and freedoms do not override the first-mentioned interest, then Art. 6 Para. 1 lit. f GDPR serves as the legal basis.

3.3. Storage Duration and Data Deletion

Your personal data will be deleted or blocked as soon as the purpose of storage ceases to apply. Further storage may occur if this has been provided for by the European or national legislator in Union law regulations, laws, or other provisions to which we are subject.

Data will also be blocked or deleted if a storage period prescribed by the aforementioned regulations expires, unless there is a need for further storage of the data for the conclusion or fulfillment of a contract. Specific storage periods for order and payment data can be found in sections 11 and 12.

3.4. Third-Party Items

Our online shop may also offer items from third-party providers (e.g., cooperation partners, licensors, or other merchants). Insofar as you enter into a separate contractual or data processing relationship with the respective third-party provider when purchasing or using such items, the data protection provisions of the respective third-party provider apply to this processing. We recommend that you inform yourself about the data protection notices of the respective third-party provider before purchasing. We are not responsible for data processing by third-party providers; in this respect, your information, rectification, or deletion is governed by the regulations of the respective third-party provider.

4. Provision of the Online Shop

4.1. Description and Scope of Data Processing

Each time our online shop is accessed, information is automatically collected by the web server and stored in so-called server log files. This may include, in particular, the following data:

• Connection data: IP address, name of the internet service provider
• Time information: Date and time of access, time zone difference to Greenwich Mean Time (GMT)
• Access and request data: Access status/HTTP status code, content of the request (specific page), amount of data transferred, referrer URL
• Device and software information: Browser and operating system used, language and version of the browser software

The data is stored in the log files of our system or our shop provider. This data is not stored together with other personal data of the user.

4.2. Legal Basis for Data Processing

The legal basis for the temporary storage of data and log files is Art. 6 Para. 1 lit. f GDPR.

4.3. Purpose of Data Processing

The temporary storage of the IP address by the system is necessary to enable the delivery of the online shop to the user's device. For this purpose, the user's IP address must remain stored for the duration of the session.

Storage in log files takes place to ensure the functionality of the online shop. In addition, the data serves us to optimize the shop and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.

Our legitimate interest in data processing according to Art. 6 Para. 1 lit. f GDPR also lies in these purposes.

4.4. Duration of Storage

The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. In the case of data collection for the provision of the online shop, this is the case when the respective session has ended. Further storage is only possible if the users' IP addresses are deleted or anonymized, so that an assignment to the calling user is no longer possible.

4.5. Right to Object and Removal Options

The collection of data for the provision of the online shop and the storage of data in log files is absolutely necessary for the operation of the shop. Consequently, there is no possibility for objection.

5. Cookies

5.1. Description

Cookies are used in our online shop. These are small text files that your browser stores on your device and which contain certain information or settings for using the shop, for example, to maintain an ongoing session or to store the content of your shopping cart. The use of cookies serves to ensure and continuously improve the user-friendliness, security, and functionality of our offer.

5.2. Technically Necessary Cookies

Certain cookies are necessary to ensure the provision, security, and basic functions of our online shop. These include, in particular, cookies for storing shopping cart content, maintaining the order and login session, and storing your consent decision (see section 7.2 for more details). The legal basis is Section 25 (2) No. 2 TDDDG in conjunction with Art. 6 (1) lit. f GDPR. These cookies cannot be deselected.

5.3. Non-Essential Cookies and Similar Technologies

The use of all non-technically necessary cookies and similar technologies (e.g., for marketing purposes or for integrating external content) only takes place with your prior consent. We base the storage and reading of these technologies on Art. 6 para. 1 lit. a GDPR.

We use a consent management tool to obtain and manage your consent. When you visit our online shop, you have the option to consent to or reject the processing by non-essential cookies and similar technologies. Your selection is saved so that it does not have to be asked again on subsequent visits.

Your consent is voluntary and not required for using the shop. You can revoke a given consent at any time with effect for the future or change your selection by revisiting the cookie settings. The revocation does not affect the lawfulness of the processing carried out until the revocation.

5.4. Control via Browser Settings

You have the option to individually control or deactivate the storage of cookies via your browser settings. Please note, however, that in this case, not all functions of our online shop may be fully available.

6. Hosting and Shop System (Shopify)

6.1. Scope and Purpose of Processing

We operate our online shop based on the shop system of the service provider Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"). All data collected in our shop is processed on Shopify's servers. This may include, in particular, IP addresses, order and contact data, meta and communication data, contract data, names, and other data generated via the shop.

6.2. Processor Agreement

We have concluded a data processing agreement with Shopify in accordance with Art. 28 GDPR. This is a contract required by data protection law that ensures Shopify processes the personal data of our shop visitors only according to our instructions and in compliance with the GDPR.

6.3. Further Processing on Our Behalf

As part of the aforementioned services, data may also be transmitted for further processing on our behalf to Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada, to Shopify Data Processing (USA) Inc., to Shopify Payments, or to Shopify (USA) Inc. In the event of data being transmitted to Shopify Inc. in Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

Further information on Shopify's data protection can be found at: https://www.shopify.de/legal/datenschutz.

6.4. Duration of Storage

Your data will only be stored for as long as necessary to fulfill the stated purposes or due to statutory retention obligations. Otherwise, the information on storage duration in the respective sections of this privacy policy applies.

7. Analysis and Tracking by Shopify

7.1. Description

Our online shop is operated on the Shopify platform (see section 6). Shopify uses its own cookies and similar technologies, which work independently of the third-party services described in sections 13 to 15. Some of these technologies are technically necessary for the operation of the shop, while others serve to analyze user behavior and assign orders to origin sources.

7.2. Technically Required Functions

Technologies for storing shopping cart content, maintaining the order and checkout session, logging into your customer account, and storing your consent decision are particularly necessary for the operation of the shop. Without these functions, you would not be able to use the shop as intended.

7.3. Analysis and Order Assignment

If you have given your consent, Shopify also processes information about which page you reached our shop from, which pages you visit within the shop, and whether a visit leads to an order. This information is combined for evaluations, which are made available to us in aggregated form in the administration area of our shop. The collection takes place technically via Shopify's web pixel interface and via pixels integrated by us or by used extensions.

7.4. Fraud Prevention

As part of order processing, Shopify conducts an automated risk assessment to detect fraudulent orders. This involves processing order, payment, and device information in particular. This is not an exclusively automated decision with legal effect on you within the meaning of Art. 22 GDPR; we make a final decision on the acceptance or rejection of an order.

7.5. Legal Bases

For the technically required functions according to Section 7.2, the legal basis is Section 25 (2) No. 2 TDDDG in conjunction with Art. 6 (1) lit. f GDPR. Our legitimate interest lies in the functional and secure provision of the shop. The storage and reading of the technologies mentioned in Section 7.3 only take place with your consent in accordance with Section 25 (1) TDDDG, the subsequent processing of the data thus collected is based on Art. 6 (1) lit. a GDPR. We base the risk assessment according to Section 7.4 on Art. 6 (1) lit. f GDPR and, insofar as it serves to fulfill the purchase contract, on Art. 6 (1) lit. b GDPR.

7.6. Withdrawal and Further Information

You can withdraw your consent at any time with effect for the future via the cookie settings. An up-to-date overview of the cookies and comparable technologies used in our shop, including their purposes and storage duration, can be found in the cookie settings. Further information on data protection at Shopify can be found at https://www.shopify.de/legal/datenschutz.

8. Use of the Online Shop

8.1. Viewed Products

While you visit our online shop, we display products you have recently viewed so that you can easily reorder them if interested.

8.2. Technical data during shop visits

In addition, we record your approximate location, your IP address and your browser type in order to technically provide the shop and protect it against misuse.

8.3. Legal Basis and Purpose

The legal basis for the aforementioned processing is Art. 6 Para. 1 lit. f GDPR. Our legitimate interest lies in the comfortable and secure usability of our online shop.

9. Contact Form

9.1. Collected Data

When using our contact form, the following information is stored:

• Email address
• Name, gender (if provided by you)
• Phone number (if provided by you)
• IP address
• Date and time of the request

Only your name and email address are mandatory for using our contact form. The provision of further, separately marked data is voluntary and is used to address you personally.

9.2. Legal Basis

The legal basis is Art. 6 Para. 1 lit. b GDPR, insofar as your request is aimed at the conclusion or fulfillment of a contract, otherwise Art. 6 Para. 1 lit. f GDPR. Our legitimate interest lies in the proper processing of your request.

9.3. Storage Duration

The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. For the personal data from the input mask of the contact form as well as the data sent by e-mail, this is the case when the respective conversation with you has ended. The conversation is ended when it can be inferred from the circumstances that the matter concerned has been conclusively clarified. The personal data additionally collected during the sending process will be deleted at the latest after a period of seven days.

10. Newsletter

10.1. Double Opt-in Procedure

If you subscribe to our newsletter, we use the so-called double opt-in procedure. This means that after your registration, we send an email to the address you provided, asking you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, your data will be blocked and automatically deleted after one month.

10.2. Collected Data

For sending the newsletter, we only need your email address. Additionally, we store the IP address of the accessing system as well as the date and time of registration and confirmation.

10.3. Legal Basis

The legal basis for the processing of data after your registration for the newsletter is Art. 6 Para. 1 lit. a GDPR, if your consent is present.

10.4. Withdrawal and Unsubscription

You can revoke your consent to receive the newsletter and unsubscribe from it at any time. You will find a corresponding unsubscribe link at the end of each newsletter. Alternatively, you can send your revocation to the contact address mentioned in section 1 at any time.

10.5. Storage Duration

The data will be deleted after you unsubscribe. Data that we need for other purposes (e.g., within the scope of an existing order according to section 11) remain unaffected by this.

11. Order Process and Customer Account

11.1. Data Collected During an Order

When you make a purchase from us, we collect the information necessary for processing the purchase, in particular your name, billing and shipping address, email address, telephone number, and payment details. To process the shipment, we pass on the necessary data (in particular name, shipping address, email address, and, if applicable, telephone number for package delivery) to our fulfillment partner (see Section 11.6 for more details). Further details on payment processing can be found in Section 12.

11.2. Optional Customer Account

If you create an account in our shop, we additionally store optional account information such as username and password, as well as your name, address, email address, and telephone number. This information will be used to pre-fill payment information for future orders.

11.3. Purposes of Processing

We use the aforementioned information for the following purposes:

• Processing your purchase
• Sending information about your account and order
• Responding to your inquiries, including refunds and complaints
• Processing payment transactions and preventing fraud
• Setting up and managing your account in our shop
• Complying with legal obligations, such as tax calculation
• Improving our shop offering
• Sending marketing messages, if you have consented to this

11.4. Legal Basis

The legal basis is Art. 6 para. 1 lit. b GDPR for contract fulfillment, Art. 6 para. 1 lit. c GDPR for compliance with legal obligations, Art. 6 para. 1 lit. f GDPR for fraud prevention and shop improvement, and Art. 6 para. 1 lit. a GDPR, insofar as you have consented to receive marketing messages.

11.5. Duration of Storage

We store information about you for as long as we need it for the purpose of collection and use and are legally obliged to store it. Order information – including name, email address, and billing and shipping address – is stored for tax reasons for ten (10) years (§ 147 AO) or for commercial law reasons for six (6) years (§ 257 HGB) after the end of the respective calendar year. After the statutory retention periods have expired, the data will be deleted, unless there is another legal basis for continued storage.

11.6. Shipping and Fulfillment

We have outsourced the storage, picking, and shipping of goods ordered in our online shop to an external fulfillment partner:

PVS Europe GmbH & Co. OHG
Address: Heinz-Nixdorf-Str. 2, 74172 Neckarsulm

To process the shipment, we transmit the necessary personal data to our fulfillment partner, in particular name, shipping address, email address, and, if applicable, telephone number for package delivery, as well as order information. Data processing is carried out exclusively for the purpose of contract fulfillment (goods shipment). The legal basis is Art. 6 para. 1 lit. b GDPR.

We have concluded a data processing agreement with the fulfillment partner in accordance with Art. 28 GDPR, which ensures that the processing of your personal data is carried out exclusively according to our instructions and in compliance with the GDPR. Insofar as a transfer of personal data to shipping service providers (e.g., DHL, DPD, Hermes) is necessary for package delivery, this also takes place on the basis of Art. 6 para. 1 lit. b GDPR.

12. Payment Processing

12.1. Shopify Payments

We use the payment service provider "Shopify Payments", 3rd Floor, Europa House, Harcourt Building, Harcourt Street, Dublin 2, Ireland.

12.2. Technical Service Provider Stripe

If you choose a payment method offered by the payment service provider Shopify Payments, the technical payment processing is carried out via Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to whom we transmit your information provided during the ordering process, along with information about your order (name, address, account number, bank sort code, credit card number if applicable, invoice amount, currency, and transaction number) in accordance with Art. 6 para. 1 lit. b GDPR. Your data will be passed on exclusively for the purpose of payment processing and only to the extent necessary for this.

Further information on data protection at Shopify Payments can be found at https://www.shopify.com/legal/privacy, and data protection information regarding Stripe Payments Europe Ltd. at https://stripe.com/de/privacy.

13. Analysis and Tracking Services (Google Analytics)

13.1. Description and Scope of Data Processing

If you have consented via our consent management tool (Section 5.3), we use Google Analytics, a web analysis service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies that enable an analysis of your use of our online shop. The information generated by the cookie about the use of this shop is usually transmitted to a Google server and stored there.

13.2. IP Addresses

We use Google Analytics in the GA4 version. In GA4, IP addresses are not fully stored by default; Google only collects IP addresses briefly for geolocation and then discards them. Permanent storage of full IP addresses does not take place.

13.3. Purpose

We use Google Analytics to evaluate the use of our shop, compile reports on shop activities, and receive other related services. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

13.4. Legal Basis and Revocation

The legal basis is your consent in accordance with Art. 6 para. 1 lit. a GDPR, which you can give via our consent management tool (Section 5.3). Without this consent, Google Analytics will not be loaded. You can revoke your consent at any time for the future via the cookie settings.

14. Google Maps

14.1. Description

If you have consented via our consent management tool, we use Google Maps from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in our online shop. This allows us to show you interactive maps (e.g., directions) directly in the shop.

14.2. Data Processing by Map Access

By accessing the corresponding subpage, Google receives the information that you have accessed it. In addition, your IP address as well as the date and time of the request are transmitted. This happens regardless of whether you are logged in to Google with a user account. If you are logged in to Google, your data will be directly assigned to your account. If you do not want this assignment, you must log out of Google before activating the map.

14.3. Legal Basis

The legal basis is your consent in accordance with Art. 6 para. 1 lit. a GDPR, which you can give via our consent management tool (Section 5.3). Further information on the purpose and scope of data collection can be found in Google's privacy policy at https://www.google.de/intl/de/policies/privacy.

15. Social Media and Plugins

15.1. Integrated Plugins

Social plugins of the social network Instagram are integrated into our online shop. You can recognize the plugins by the Instagram logo. If you have consented via our consent management tool, your browser establishes a direct connection with the servers of the respective social network when you access a page with such a plugin.

15.2. Scope of Data Transmission

We do not have knowledge of the data transmitted between your browser and the Instagram network. To prevent Instagram from collecting data about you during your visit to our online shop, you can log out there before your visit or refuse consent via our consent management tool.

15.2a. Joint Responsibility

Insofar as personal data is transmitted to Meta Platforms Ireland Limited when the Instagram social plugin is integrated during a page visit, there may be joint responsibility within the meaning of Art. 26 GDPR. Our responsibility is limited to the integration of the plugin and the associated initial collection and transmission of data. The subsequent processing by Meta is its sole responsibility. Further information can be found in Instagram/Meta's privacy policy at https://privacycenter.instagram.com/policy.

15.3. Legal Basis

The integration of the plugins takes place only after your consent in accordance with Art. 6 para. 1 lit. a GDPR, which you can give via our consent management tool (Section 5.3).

15.4. Further Information

Information on the purpose and scope of data collection by social networks, further processing and use of the data, as well as your related rights and setting options, can be found in the privacy policies of the respective network.

16. Data Transfer to Third Countries

As part of the hosting and operation of our online shop via Shopify (Section 6), personal data may be transferred to Shopify Inc. based in Canada and to companies affiliated with Shopify in the USA. An adequacy decision by the European Commission exists for transfers to Canada.

In connection with payment processing (Section 12), Shopify Payments and Stripe Payments Europe Ltd. process data within the EU/Ireland; any further transfer to third countries is governed by the data protection notices of the respective providers.

In connection with the use of Google Analytics and Google Maps (Sections 13 and 14), if you have consented to this, data may be transferred to Google Ireland Limited and, within the scope of intra-group processing, to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF). Thus, the adequacy decision of the European Commission of July 10, 2023, serves as the legal basis for the data transfer.

In connection with the Instagram social plugin integrated in Section 15, after you have given your consent, data may be processed by Meta Platforms Ireland Limited or its parent company Meta Platforms Inc. in the USA. Meta Platforms Inc. is certified under the EU-U.S. Data Privacy Framework (DPF); the data transfer is therefore based on the adequacy decision of the European Commission of July 10, 2023. Further information can be found in Meta's privacy policy at https://privacycenter.instagram.com/policy.

17. Your Rights

The GDPR grants you the following rights regarding the processing of your personal data:

In addition, your data may be passed on to the following categories of recipients as part of contract fulfillment: fulfillment and shipping service providers (Section 11.6), payment service providers (Section 12), hosting and shop system operators (Section 6), analysis and tracking services (Sections 13 and 14), social networks (Section 15), and – where legally required – tax authorities and other public bodies.

17.1. Right of Access, Art. 15 GDPR

As a data subject, you can request confirmation as to whether personal data concerning you is being processed. If this is the case, you have the right to request access to this data and the following information:

• purposes of the processing
• categories of personal data processed
• categories of recipients
• duration of storage
• the existence of a right to rectification or erasure of personal data concerning them, or to restriction of processing by the controller, or to object to such processing
• the existence of a right to lodge a complaint with a supervisory authority
• where the personal data are not collected from the data subject, any available information as to their source
• the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject
• any data processing abroad

17.2. Right to Rectification, Art. 16 GDPR

As a data subject, you can demand that inaccurate personal data concerning you be rectified without undue delay and that incomplete personal data be completed.

17.3. Right to Erasure, Art. 17 GDPR

You have the right to demand the immediate erasure of your personal data. We are obliged to comply with this request if one of the following reasons applies:

• Your personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
• You withdraw your consent on which the processing is based according to Art. 6 para. 1 sentence 1 lit. a or Art. 9 para. 2 lit. a GDPR, and there is no other legal ground for the processing.
• You object to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing. Alternatively, you object to the processing pursuant to Art. 21 para. 2 GDPR.
• Your personal data have been unlawfully processed.
• Erasure is necessary for compliance with a legal obligation in Union or Member State law to which the controller is subject.
• Your personal data have been collected in relation to the offer of information society services referred to in Art. 8 para. 1 GDPR.

A right to erasure does not exist insofar as processing is necessary:

• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• for reasons of public interest in the area of public health in accordance with Art. 9 para. 2 lit. h and i as well as Art. 9 para. 3 GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 para. 1 GDPR, insofar as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing;
• for the establishment, exercise or defense of legal claims.

17.4. Right to Restriction of Processing, Art. 18 GDPR

You have the right to request the restriction of data processing if one of the following conditions is met:

• if you contest the accuracy of the personal data concerning you, for a period enabling us to verify the accuracy of the personal data.
• if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead.
• if the controller no longer needs the personal data for the purposes of the processing, but you as the data subject require them for the establishment, exercise or defense of legal claims.
• if you have objected to processing pursuant to Art. 21 para. 1 GDPR pending the verification whether the legitimate grounds of the controller override yours.

Where processing has been restricted in accordance with paragraph 1, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If you have obtained restriction of processing, we will inform you before the restriction is lifted.

17.5. Notification Obligation, Art. 19 GDPR

We shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. We shall inform you about those recipients if you request it.

17.6. Right to Data Portability, Art. 20 GDPR

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and the right to transmit this data to another controller without hindrance from the controller to whom the personal data has been provided, provided that

• the processing is based on consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 lit. b GDPR and
• the processing is carried out by automated means.

In exercising this right, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

This right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

17.7. Right to object, Art. 21 GDPR

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6 para. 1 lit. e or f GDPR. This also applies to profiling based on these provisions.

We will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims.

Where personal data are processed for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning you for such marketing; this includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data will no longer be processed for these purposes.

You also have the right to object, on grounds relating to your particular situation, to processing of personal data concerning you for scientific or historical research purposes or statistical purposes pursuant to Article 89 para. 1, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

17.7a. Right to withdraw consent, Art. 7 para. 3 GDPR

Insofar as the processing of your personal data is based on your consent (Art. 6 para. 1 lit. a GDPR), you have the right to withdraw this consent at any time with future effect. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. You can address your withdrawal to the contact details mentioned in item 1 or – where consent-based cookies and similar technologies are concerned – declare it via the cookie settings of our shop.

17.8. Automated individual decision-making, Art. 22 GDPR

You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you.

This shall not apply if the decision

1. is necessary for entering into, or performance of, a contract between you and us as the controller,
2. is authorised by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or
3. is based on your explicit consent.

In the cases referred to in a) and c), we shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on our part, to express your point of view and to contest the decision.

17.9. Right to lodge a complaint with a supervisory authority, Art. 77 GDPR

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes this Regulation.

The supervisory authority with which the complaint has been lodged shall inform you on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

The competent supervisory authority is the Bavarian State Office for Data Protection Supervision (BayLDA) in Ansbach.

18. Data Security

We take appropriate technical and organizational measures to ensure the protection of your personal data and the security of our IT systems. The measures taken are regularly reviewed and continuously adapted to the current state of the art to ensure an adequate level of protection.

19. Right to make changes

We reserve the right to adapt this privacy policy if necessary, particularly if this is required due to the further development of the website or the services offered, as well as due to changed legal, official or judicial requirements. The version of the privacy policy published at the time of your visit to the website shall apply.

Status: 26.08.2026