Privacy Policy
The protection of your personal data is important to us. In this Privacy Policy, we explain which personal data is processed when you visit our online shop, register, place an order or contact us, and which rights you have in relation to the processing of your data.
Privacy Policy
The Controller in the meaning of the European General Data Protection Regulation (GDPR) and other national data protection legislation as well as other data protection regulations is:
Managing Director: Gabriele Kerner
Jakobikirchhof 8
20095 Hamburg
Germany
Tel: +49 40 / 69909249
Email:
shop@nena.de
Website:
www.shop.nena.de
I. Provision of our Website and Log Files
1. Scope of Processing of Personal Data
If you access our website, your browser will establish a connection with the web server of our host ALL-INKL.COM – Neue Medien Münnich, Owner Rene Münnich, Hauptstr. 68, 02742 Friedersdorf. In the process, connection data will be created and this will be stored by ALL-INKL.COM in "log files".
Log files contain:
- Time / date of the request
- Your operating system and browser type
- The URL being requested
- Your IP address
2. Purpose of the Data Processing
ALL-INKL.COM uses the data on our behalf for the presentation and delivery of our content as well as for statistical purposes.
Legal basis for the temporary storage of data and log files is Article 6 (1) point (f) of the GDPR.
Your IP address and other data will be stored by ALL-INKL.COM for 10 days.
The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. As a result, the user does not have any option to object.
II. Registration
1. Scope of Processing of Personal Data
On our website, we offer users the opportunity to register by submitting their personal data. This involves the entering of data into an input screen and sending it to us, where it will be stored. Sharing of data with third parties will not take place during the registration process.
The following data is collected and stored in this respect:
- First name, surname
- Salutation and/or gender
- Title
- Email address
- Password (encrypted)
- Telephone number
- Billing address
- Delivery address
- Type of device with which you are accessing our web shop
- Time of your registration
- Time of your last visit
- Payment method
In the event that your email address contains personal data which differs from the existing data, we shall also store this data.
After registration, you can change your registration details under the menu item "My Account" and also manage other details, such as the payment method. Furthermore, you can also view your already completed orders there.
You can of course also purchase goods from us, even if you do not want to first register with us and set up a user account. The purchase will then be done using Paypal Direct.
2. Purpose of the Data Processing
Data collection and storage in the context of pure registration is done for purposes of pre-contractual measures.
The legal basis for processing of data in the case of pure registration – without placing an order – is the provision of your consent in accordance with Article 6 (1) point (a) of the GDPR.
We shall store the data for as long as you maintain the registration.
You can send an email to us any time at shop@nena.de, in order to delete the data stored in your account completely and/or partly, and hence revoke your consent.
In addition, you can also personally undertake some changes and partial deletion of your data using the "My Account" menu function.
If the data is required for the fulfilment of a contract or for carrying out pre-contractual measures, then premature full deletion of the data will only be possible if there are no contractual and legal obligations which preclude such a deletion. This can be the case, for instance, if you have placed an order.
III. Orders
1. Scope of Processing of Personal Data
If you place an order with us, we shall use the data mentioned in section II above to process the transaction with you.
The personal data you submitted to us in connection with a goods order will be shared with third parties within the context of contract processing by the service partners engaged by us, namely DHL Paket GmbH, Kruppstr. 74, 45145 Essen.
We process personal data in connection with the processing of payment. The exact nature of personal data processed will vary depending on the payment method.
PayPal
We offer PayPal as a payment method. PayPal is an online payment service provider that operates independently of us. PayPal makes it possible to send payments online to third parties, or also to receive payments. PayPal also assumes a trustee role and offers buyer protection services.
The company that operates PayPal in Europe is PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxemburg.
Provided that you select PayPal as your payment method, your data will automatically be transmitted to PayPal.
The personal data sent to PayPal generally includes first name, surname, address, postal address, email address, IP address, telephone number, mobile telephone number or other data necessary for payment processing.
Personal data associated with the respective order is also necessary for the processing of the applicable order(s).
PayPal will share the personal data with affiliated companies and service providers or subcontractors, provided this is necessary for the fulfilment of contractual obligations, or if the data has to be processed on PayPal's behalf.
Pre-payment by Bank Transfer
If you opt for a pre-payment by bank transfer within the context of the payment process, your bank will transmit your personal data to us, and this includes your first name, surname, your IBAN and BIC as well as the amount of money involved.
The data will not be shared with third parties.
You can also place orders without registering. To do this, you simply place items in the shopping cart and then use the "PayPal" option directly.
In this case your data will be sent to us by Paypal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxemburg, which data shall include your billing and delivery address, together with your first name and surname, as well as your email address.
2. Purpose of the Data Processing
The collection and storage of data is done in order to identify you as a customer, to enable the processing, fulfilment and completion of your order together with your payment, to conduct correspondence or telephone calls with you, to deliver invoices and to process claims against you.
The processing of the data takes place based on your order and in accordance with Article 6 (1) point (b) of the GDPR.
We shall store your data for as long as your account exists with us in the scope indicated and/or up to the expiry of the stipulated legal retention period.
Deletion of the order details through the deletion of your account undertaken by you is only possible in the event that no contractual and legal obligations precluding such deletion exist.
IV. Contact Form / Email Contact
1. Description and Scope of Data Processing
There is a contact form on our website which can be used for contacting us electronically. If you decide to use this option, data entered into the input screen will be transmitted to us and stored.
The data processed is: Salutation, first name, surname, email address as well as any other personal data found in your message.
When you press the "Send" button, an email message will be generated and sent to us. In this process other data is generated and stored by us, for instance the time you made contact with us.
Alternatively, it is possible to make contact using the email address provided. In this case, the personal data transmitted through the email is stored.
In this connection, no sharing of data with third parties takes place. The data is used exclusively for processing the conversation.
The legal basis for processing of the data is Article 6 (1) point (a) of the GDPR – provided you have given your consent.
The legal basis for the processing of data transmitted in the process of sending an email message to us is Article 6 (1) point (f) of the GDPR.
If the time of email contact is based on the conclusion of the contract, the supplementary legal basis for the processing shall be Article 6 (1) point (b) of the GDPR.
3. Purpose of the Data Processing
The processing of personal data from the input screen is used by us for the sole purpose of processing the inquiry.
If we are contacted via email, we necessarily also have a legitimate interest in processing the data.
The data will be erased as soon as it is no longer required for fulfilment of the intended purpose of their collection.
For personal data from the input screen of the contact form and that sent to us by email, this erasure will then take place when the conversation exchange with you has ended.
The conversation shall be deemed to have ended if it can be deduced from the circumstances that the issue raised has been clarified.
You have the option of revoking your consent for the processing of personal data any time by sending an email message to shop@nena.de.
If you contact us by email, you can revoke consent to the storage of your personal data at any time. In such cases, the conversation cannot be continued.
All personal data which was collected and stored during the process of making contact will be erased in this case.
V. Cookies
1. General Description
Our website uses cookies. Cookies are text files that are stored on the Internet browser or stored by the Internet browser on the user's computer system.
When a user accesses a website, a cookie can be stored on the user's operating system. This cookie contains a characteristic string that enables the browser to be clearly identified the next time the website is accessed.
We use cookies to make our website more user-friendly. Some elements of our website require the requesting browser to be recognised even after you have moved to a different page.
To this end, the following data is stored in the cookies and transmitted:
- Items in a shopping basket
- Log-in information relating to your user account
2. Purpose of the Data Processing
The purpose of using these technically necessary cookies is to make it easier for users to navigate websites.
Some functions of our website are not available without the use of cookies. These functions require the browser to be recognised even after you have moved to a different page.
Art. 6 (1) (f) GDPR provides the legal basis for processing the personal data with the use of cookies.
Cookies are stored on the user's computer and transmitted by it to our website. As a user, you therefore have full control over the use of cookies.
You can disable or restrict the transmission of cookies by adjusting the settings in your Internet browser accordingly.
Cookies that have already been stored can be erased at any time. This can also occur automatically.
If cookies are disabled for our website, not all of the functions of this website may be fully available to you.
VI. Your Rights
If your personal data is being processed, then you are a data subject in the meaning of the GDPR and you can assert the following rights against the Controller:
1. The Right to Information
You can demand confirmation from the Controller as to whether we process personal data relating to you. If such processing is taking place, you can then demand information about the following aspects from the Controller:
- The purpose for which the personal data is being processed.
- Categories of personal data being processed.
- Recipients and/or categories of recipients to whom your personal data was disclosed or is still being disclosed.
- The planned duration of storage of your personal data or, in case it is not possible to get concrete information on this, criteria for determining the storage duration.
- The existence of a right to rectification or erasure of your personal data, a right to restriction of processing by the Controller or a right to object to this processing.
- The existence of the right to complain to a supervisory authority.
- All available information about the origin of the data, if the personal data was not collected from the data subject.
- The existence of an automated decision making process, including profiling, pursuant to Article 22 (1 and 4) of the GDPR, and – at least in these cases – meaningful information about the logic involved as well as the scope and desired effect of such processing on the data subject.
You have the right to demand information as to whether your personal data is being transmitted to third countries or to an international organisation. In this connection, you can demand to be informed about appropriate guarantees, pursuant to Article 46 of the GDPR, in relation to this transmission of data.
2. Right to Correction of Data
You have the right to demand correction and/or completion of your data from the Controller, provided the processed personal data relating to you is false or incomplete. The Controller must undertake the correction without delay.
3. Right to Restriction of Data Processing
You can demand the restriction of processing of your personal data on the following conditions:
- If you have been disputing the correctness of your personal data for some time, a fact which enables the Controller to check the correctness of the personal data.
- If the processing is unlawful and yet you reject the deletion of the personal data, but instead demand restriction on the use of the personal data.
- If the Controller no longer needs the personal data for the intended purposes of the processing, but you need them for purposes of asserting, exercising or defending legal claims.
- If you have raised objection against the processing in accordance with Article 21 (1) of the GDPR, and it has not yet been established whether the Controller's legitimate reasons override yours.
If the processing of your personal data was restricted, then this data may – except for its storage – only be processed with your consent or for purposes of asserting, exercising or defending legal claims, or for the protection of the rights of another natural person or legal entity, or for important reasons of public interest of the Union or any other Member State.
If the processing of the data was restricted on the above-mentioned conditions, you will be informed by the Controller before the restriction is lifted.
4. Right to Deletion of Data
a. Obligation to Delete
You can demand from the Controller that your personal data be deleted immediately, and the Controller is obliged to delete this data without undue delay, as long as one of the following reasons applies:
- Your personal data is no longer required for the purposes for which it was collected or otherwise processed.
- You are revoking your consent upon which the processing was based and there is no other legal basis for the processing.
- You are raising a complaint against the processing and there are no overriding legitimate reasons for the processing.
- Your personal data was unlawfully processed.
- The deletion of your personal data is necessary for the fulfilment of a legal obligation.
- Your personal data was collected in relation to services offered by the information society.
b. Information to Third Parties
If the Controller has disclosed your personal data and if he is obliged to delete it in accordance with Article 17 (1) of the GDPR, he shall take appropriate measures, even of a technical nature, taking into consideration the available technology and the costs of implementation, to inform the person responsible for data processing and who processes the personal data that you as the data subject have demanded from them the deletion of all links to this personal data or of all copies or replications of this personal data.
c. Exceptions
The right to deletion of data does not arise, provided the processing is necessary:
- For exercising the right to freedom of expression and information.
- For the fulfilment of a legal obligation which demands that the processing be done according to the legislation of the Union or of Member States.
- For reasons of public interest in the area of public health.
- For purposes of archives, scientific or historical research purposes or for statistical purposes.
- For purposes of asserting, exercising or defending legal claims.
5. Right to Being Informed
If you have asserted the right to correction, deletion or restriction of processing against the Controller, the latter is obliged to inform all recipients to whom your personal data was disclosed about this deletion, correction or restriction of processing, unless this turns out to be impossible or is associated with disproportionate expenses.
You have the right to demand from the Controller that you be informed about these recipients.
6. Right to Transfer of Data
You have the right to receive your personal data, which you submitted to the Controller, in a structured, standard and machine-readable format.
You also have the right to transfer the data to another Controller without hindrance from the Controller to whom the personal data was submitted, provided the processing is based on consent or on a contract and the processing is done using automated methods.
In exercise of this right, you furthermore have the right to cause the direct transfer of your personal data from one Controller to another, provided that this is technically feasible.
7. Right of Objection
You have the right, for reasons arising from your particular situation, to raise objection at any time against the processing of your personal data which is being done in accordance with Article 6 (1) point (e or f) of the GDPR; this also applies to profiling based on these provisions.
The Controller will not process your personal data anymore, unless he can cite compelling legitimate reasons for the processing which override your interests, rights and freedoms, or unless the processing serves the purpose of asserting, exercising or defending legal claims.
If your personal data is being processed for purposes of direct advertising, you have the right at any time to raise objection against the processing of your personal data for such direct advertising purposes. This also applies to profiling, provided it is associated with such direct advertising.
If you object to processing for direct advertising purposes, your personal data will no longer be processed for such purposes.
You have the option, within the framework of using the services of the information society – Directive 2002/58/EC notwithstanding – to exercise your right to objection through automated methods, for which technical specifications are used.
8. The Right to Revoke Consent to Provisions of the Privacy Policy
You have the right to revoke your consent to provisions of the privacy policy at any time.
The legality of the processing done up to the time of revocation, and based on your consent, will not be affected by this revocation of consent.
9. Automated Decisions on a Case-by-Case Basis Including Profiling
You have the right to reject being subjected to a decision exclusively based on automated processing – including profiling – which has legal implications on you or affects you considerably in any similar way.
This does not apply if the decision is required for the conclusion or fulfilment of a contract between you and the Controller, is permissible on the basis of legal provisions, or happens with your express consent.
Nevertheless, these decisions are not to be based on special categories of personal data in accordance with Article 9 (1) of the GDPR, as long as the relevant legal exceptions do not apply and appropriate measures have been taken to protect your rights and freedoms, as well as your legitimate interest.
The Controller shall take appropriate measures to safeguard your rights and freedoms and your legitimate interest, which includes at least the right to cause the intervention of a person on the part of the Controller, to present one's own point of view and to contest the decision.
10. The Right to Complain to a Supervisory Authority
Other administrative or judicial measures of redress notwithstanding, you have the right to complain to a supervisory authority, in particular in the Member State of your residence, your place of work or place of alleged infringement, if you believe that the processing of your personal data constitutes a breach of the GDPR.
The supervisory authority to which the complaint is submitted shall inform the complainant about the status and outcome of the complaint, including the possibility of legal redress in accordance with Article 78 of the GDPR.