1. Provision of the shop and server log files

When you access our shop, technically necessary connection data is processed. This may include in particular:

• IP address
• date and time of access
• page or URL accessed
• browser and browser version
• operating system and device type
• referrer URL
• technical status and error information

This processing is necessary to provide our shop technically, ensure its stability and security, and identify possible technical faults or misuse.

Our hosting provider is ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure, stable and technically reliable operation of our shop.

2. Customer account and registration

You can create a personal customer account in our shop. We process the data required to set up and use your customer account. This may include in particular:

• first name and surname
• form of address and, where applicable, title
• email address
• encrypted password
• telephone number, where provided or required
• billing and delivery address
• order history
• selected payment method

Your customer account allows you, among other things, to manage your personal information and addresses and view previous orders. You can also place an order without creating a customer account.

Legal basis: Art. 6(1)(b) GDPR, insofar as the processing is necessary for pre-contractual measures or performance of a contract.

Data relating to your customer account is generally stored for as long as the account exists. Statutory retention requirements, particularly for order and invoice data, remain unaffected.

3. Orders and contract processing

When you place an order, we process the data required to carry out and process your order. This includes in particular contact, billing, delivery, order and payment information.

We use this data in particular for:

• processing and fulfilling your order
• payment processing
• invoicing
• shipping
• communication relating to your order
• processing returns, refunds or other claims

Legal basis: Art. 6(1)(b) GDPR. Where statutory retention obligations apply, continued storage is based on Art. 6(1)(c) GDPR.

4. Shipping and DHL shipment tracking

To deliver your order, we transmit the data required for shipping to our carrier:

DHL Paket GmbH
Sträßchensweg 10
53113 Bonn
Germany

This may include in particular your name, delivery address and other shipping and order information required for delivery.

We also use DHL shipment tracking. Shipment information and shipment status events may be processed, for example when a shipment is being prepared for dispatch, is in transit, is ready for collection, could not be delivered or has been delivered.

We may also use this information to notify you by email about the current status of your order or shipment.

Legal basis: Art. 6(1)(b) GDPR, insofar as the processing is necessary to fulfil and deliver your order.

5. Payment processing

Depending on the payment method you select, the data required to process your payment is processed and may be transmitted to the relevant payment service provider.

PayPal

We use services provided by the following provider for various payment methods:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

In connection with payment processing, information such as your name, billing and delivery address, email address, IP address, payment information and information about your order may be transmitted to PayPal.

The payment methods specifically available to you are displayed during checkout. In addition to PayPal, these may include credit and debit card payments and other payment methods offered through the payment service provider.

Legal basis: Art. 6(1)(b) GDPR.

Apple Pay and Google Pay

Where Apple Pay or Google Pay is offered at checkout and selected by you, the respective Apple or Google wallet and payment services may additionally be involved in payment processing. Processing by these providers is also governed by their respective privacy policies.

Legal basis: Art. 6(1)(b) GDPR.

Advance payment by bank transfer

If you pay by bank transfer, the bank and transaction data required for the payment is processed. This may include your name, IBAN, payment amount, payment reference and order number.

Legal basis: Art. 6(1)(b) GDPR.

6. Contacting us

If you contact us via our contact form or by email, we process the information you provide in order to handle your enquiry. This may include in particular your name, email address and the content of your message.

If your enquiry relates to an order or contract, processing is based on Art. 6(1)(b) GDPR. General enquiries are processed on the basis of Art. 6(1)(f) GDPR. Our legitimate interest is to process and respond to your enquiry.

The data will be deleted once your enquiry has been conclusively dealt with, unless statutory or contractual retention obligations require further storage.

7. Cookies, Local Storage and cookie settings

Our shop uses cookies and comparable technologies such as Local Storage. Information may be stored on your device or information already stored on your device may be accessed.

Technically necessary functions

Certain cookies and storage technologies are necessary for the technical operation of our shop. These include, for example, session and shopping-cart functions, language settings, security functions and payment processing.

Where storing or accessing information on your device is strictly necessary in order to provide a digital service expressly requested by you, this is carried out on the basis of Section 25(2) TDDDG.

Where personal data is processed in this context, depending on the purpose the legal basis is in particular Art. 6(1)(b) or (f) GDPR.

Optional functions

For analytics, marketing and certain convenience functions, we obtain your consent through our cookie settings where this is required by law.

Legal basis: Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

You can change your selection at any time via the “Cookie settings” link in the footer of our shop or withdraw consent with effect for the future.

8. Shopware Analytics

We use Shopware Analytics for statistical evaluation and analysis of the use and performance of our shop.

Depending on your consent, information about the use of the shop may be processed and identifiers may be stored in your browser's Local Storage. In our Consent Manager, this includes in particular _swa_anonymousId and _swa_userTraits.

Processing takes place only within the scope of the cookie and privacy settings you have selected.

Legal basis: Section 25(1) TDDDG and Art. 6(1)(a) GDPR, insofar as consent is required.

9. Google Tag Manager, Google Analytics and Google Ads

We use Google services to statistically analyse the use of our shop, improve its functionality and usability, and measure the effectiveness of our advertising activities.

The provider for users in the European Economic Area is generally:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Tag Manager

Google Tag Manager is used for the technical management and deployment of various tags and tracking services on our website. In our configuration, the Tag Manager container is generally loaded only after the relevant cookie consent.

Google Analytics

Google Analytics may be used to analyse information about how our shop is used. This may include page views, interactions, devices and browsers used, and technical connection and usage data.

Google Ads and e-commerce tracking

We use Google Ads and e-commerce tracking to measure the effectiveness of our advertising activities and certain actions within our shop.

This may include events such as product views, searches, adding or removing items from the shopping cart or wishlist, starting checkout, information relating to shipping and payment methods, and completed purchases.

Enhanced Conversions

We additionally use enhanced conversion measurement. This function is used in our shop only after the relevant cookie consent has been given.

First-party customer data such as email address, name and address information may be processed for improved measurement and attribution of conversions and transmitted to Google in hashed form.

Hashing means that the relevant data is converted into a hash value using a one-way process before transmission.

When Google services are used, processing of data outside the European Union or European Economic Area, particularly in the USA, cannot be ruled out. Google uses the applicable legal transfer mechanisms for this purpose.

Legal basis: Section 25(1) TDDDG and Art. 6(1)(a) GDPR, insofar as the processing is based on your consent.

You can change or withdraw your consent at any time via our cookie settings with effect for the future.

10. Meta Pixel

We use the Meta Pixel to measure and evaluate our advertising activities on Facebook and Instagram.

The provider for users in the European Economic Area is generally:

Meta Platforms Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland

The Meta Pixel may in particular record page views and certain actions within our shop. This enables us, for example, to measure whether users visited certain pages or products or completed an order after interacting with an advertisement.

The Meta Pixel is connected to the Shopware Cookie Consent Manager in our shop and is used in accordance with your consent. Advanced matching is currently disabled. The server-side Meta Conversions API is currently not used.

When Meta services are used, processing of data outside the European Union or European Economic Area cannot be ruled out.

Legal basis: Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

You can change or withdraw your consent at any time via our cookie settings with effect for the future.

11. YouTube and Vimeo

Videos from YouTube and Vimeo may be embedded in our shop. These contents are part of our optional convenience functions.

If you enable the relevant function and an embedded video is loaded, a connection may be established to the servers of the respective provider. In particular, your IP address, technical device and browser information, and information about the page accessed may be processed.

YouTube

The provider for users in the European Economic Area is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Vimeo

The provider is Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA.

Legal basis: Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

You can change or withdraw your consent at any time via our cookie settings.

12. Storage period

We store personal data only for as long as necessary for the respective processing purpose or for as long as statutory retention obligations apply.

Once the purpose of processing no longer applies and there is no statutory or contractual obligation to retain the data, the relevant data is deleted or, where necessary, blocked from further processing.

13. Your data protection rights

Where we process your personal data, you have, subject to the applicable legal requirements, in particular the following rights:

• right of access under Art. 15 GDPR
• right to rectification under Art. 16 GDPR
• right to erasure under Art. 17 GDPR
• right to restriction of processing under Art. 18 GDPR
• right to data portability under Art. 20 GDPR
• right to object under Art. 21 GDPR
• right to withdraw consent under Art. 7(3) GDPR

You may withdraw consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

To exercise your rights, you can contact us at any time at shop@nena.de.

14. Right to lodge a complaint

You also have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.

In particular, the Hamburg Commissioner for Data Protection and Freedom of Information is responsible for our registered office. You may also contact another competent data protection supervisory authority.

15. Changes to this Privacy Policy

We update this Privacy Policy where legal, technical or organisational changes occur or where new services are introduced in our shop.