1. Operation of the shop and server log files

When you visit our shop, technically necessary connection data is processed. This may include, in particular:

• IP address
• date and time of access
• page or URL accessed
• browser and browser version
• operating system and device type
• referrer URL
• technical status and error information

This processing is necessary to make our shop technically available, ensure its stability and security, and detect potential technical faults or abusive access.

Our hosting provider is ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and technically reliable operation of our shop.

2. Customer account and registration

You can create a personal customer account in our shop. We process the data required to set up and use your account. This may include, in particular:

• first and last name
• salutation and title, where applicable
• email address
• encrypted password
• phone number, where provided or required
• billing and delivery address
• order history
• selected payment method

Your customer account allows you to manage your personal details and addresses and view previous orders, among other things. You can also place an order without a customer account.

Legal basis: Article 6(1)(b) GDPR, insofar as processing is necessary to take steps prior to entering into a contract or to perform a contract.

Your customer account data is generally retained for as long as the account exists. Statutory retention obligations, particularly for order and invoice data, remain unaffected.

3. Orders and contract performance

When you place an order, we process the data necessary to carry out and fulfil your order. This includes, in particular, contact, billing, delivery, order and payment data.

We use this data in particular for:

• processing and fulfilling your order
• processing payments
• issuing invoices
• arranging shipping
• communicating about your order
• handling returns, refunds or other claims

Legal basis: Article 6(1)(b) GDPR. Where statutory retention obligations apply, continued storage is based on Article 6(1)(c) GDPR.

4. Shipping and DHL tracking

To deliver your order, we transfer the data required for shipping to our shipping provider:

DHL Paket GmbH
Sträßchensweg 10
53113 Bonn
Germany

This may involve processing your name, delivery address and other shipping and order data necessary for delivery.

We also use DHL shipment tracking. This allows shipping information and shipment status events to be processed, for example when a shipment has been prepared for dispatch, is in transit, is ready for collection, could not be delivered or has been delivered.

We may also use this information to inform you by email about the current status of your order or shipment.

Legal basis: Article 6(1)(b) GDPR, insofar as processing is necessary to carry out and fulfil your order and delivery.

5. Payment processing

Depending on the payment method selected, the data necessary to process the payment is processed and, where applicable, transferred to the relevant payment service provider.

PayPal

For various payment methods, we use services provided by:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

As part of payment processing, your name, billing and delivery address, email address, IP address, payment information and information about your order may, in particular, be transferred to PayPal.

The payment methods available to you are displayed during checkout. In addition to PayPal, these may include credit and debit card payments and other payment methods offered through the payment service provider.

Legal basis: Article 6(1)(b) GDPR.

Apple Pay and Google Pay

Where Apple Pay or Google Pay is offered at checkout and selected by you, the respective wallet and payment services of Apple or Google may also be involved in processing the payment. Processing by these providers is additionally governed by their respective privacy policies.

Legal basis: Article 6(1)(b) GDPR.

Advance payment by bank transfer

If you pay by bank transfer, the banking and transaction data required for payment is processed. This may include, in particular, your name, IBAN, payment amount, payment reference and order number.

Legal basis: Article 6(1)(b) GDPR.

6. Contacting us

If you contact us through our contact form or by email, we process the data you provide to handle your enquiry. This may include, in particular, your name, email address and the contents of your message.

If your enquiry relates to an order or contract, processing is based on Article 6(1)(b) GDPR. General enquiries are processed on the basis of Article 6(1)(f) GDPR. Our legitimate interest is handling and responding to your enquiry.

The data is deleted once your enquiry has been fully dealt with, provided no statutory or contractual retention obligations prevent deletion.

7. Cookies, Local Storage and cookie settings

Our shop uses cookies and comparable technologies such as Local Storage. Information may be stored on your device, or information already stored there may be accessed.

Technically necessary features

Certain cookies and storage technologies are necessary for our shop to function technically. These include, for example, session features, the shopping basket, language settings, security features and payment processing.

Where storing or accessing information on your device is strictly necessary to provide a digital service expressly requested by you, this takes place on the basis of Section 25(2) of the German TDDDG.

Where personal data is processed in this context, the processing is based, depending on its purpose, in particular on Article 6(1)(b) or (f) GDPR.

Optional features

For analytics, marketing and certain convenience features, we obtain your consent through our cookie settings where required by law.

Legal basis: Section 25(1) of the German TDDDG and Article 6(1)(a) GDPR.

You can change your selection or withdraw consent with effect for the future at any time using the “Cookie settings” link in our shop's footer.

8. Shopware Analytics

We use Shopware Analytics to statistically evaluate and analyse the use and performance of our shop.

Depending on your consent, information about your use of the shop may be processed and identifiers may be stored in your browser's Local Storage. Our consent manager uses, in particular, the entries _swa_anonymousId and _swa_userTraits for this purpose.

Processing only takes place within the scope of the cookie or privacy settings you have selected.

Legal basis: Section 25(1) of the German TDDDG and Article 6(1)(a) GDPR, insofar as consent is required.

9. Google Tag Manager, Google Analytics and Google Ads

We use Google services to statistically evaluate the use of our shop, improve its functionality and usability, and measure the effectiveness of our advertising.

The provider for users in the European Economic Area is generally:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Tag Manager

Google Tag Manager is used to technically manage and control various tags and tracking services on our website. In our configuration, the Tag Manager container is generally only loaded after the relevant cookie consent.

Google Analytics

Google Analytics may be used to evaluate information about the use of our shop. This may involve processing page views, interactions, devices and browsers used, and technical connection and usage data, for example.

Google Ads and e-commerce tracking

We use Google Ads and e-commerce tracking to measure the effectiveness of our advertising and certain actions in our shop.

In particular, events such as product views, searches, adding or removing items from the basket or wishlist, starting checkout, shipping and payment method details, and completed purchases may be recorded.

Enhanced Conversions

We also use enhanced conversion measurement. This feature is only used in our shop after the relevant cookie consent.

Customer data collected directly by us, such as email addresses, names and address details, may be processed to improve conversion measurement and attribution and transmitted to Google in hashed form.

Hashing converts the relevant data into a hash value using a one-way process before transmission.

When using Google services, processing outside the European Union or the European Economic Area, particularly in the United States, cannot be ruled out. Google uses the applicable legal transfer mechanisms for this purpose.

Legal basis: Section 25(1) of the German TDDDG and Article 6(1)(a) GDPR, insofar as processing is based on your consent.

You can change or withdraw your consent with effect for the future at any time through our cookie settings.

10. Meta Pixel

We use Meta Pixel to measure and evaluate our advertising on Facebook and Instagram.

The provider for users in the European Economic Area is generally:

Meta Platforms Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland

Meta Pixel can record page views and certain actions in our shop. This allows us, for example, to determine whether users viewed particular pages or products or completed an order after encountering an advertisement.

Meta Pixel is connected to the Shopware Cookie Consent Manager in our shop and is used in accordance with your consent. Advanced matching is currently disabled. The server-side Meta Conversion API is not currently used.

When using Meta services, processing outside the European Union or the European Economic Area cannot be ruled out.

Legal basis: Section 25(1) of the German TDDDG and Article 6(1)(a) GDPR.

You can change or withdraw your consent with effect for the future at any time through our cookie settings.

11. YouTube and Vimeo

Our shop may include embedded videos from YouTube and Vimeo. This content forms part of our optional convenience features.

If you enable the relevant feature and an embedded video is loaded, a connection may be established to the respective provider's servers. In particular, your IP address, technical device and browser information, and information about the page accessed may be processed.

YouTube

The provider for users in the European Economic Area is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Vimeo

The provider is Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA.

Legal basis: Section 25(1) of the German TDDDG and Article 6(1)(a) GDPR.

You can change or withdraw your consent at any time through our cookie settings.

12. Retention period

We retain personal data only for as long as necessary for the respective processing purpose or as required by statutory retention obligations.

If the processing purpose no longer applies and there is no statutory or contractual obligation to retain the data, the data concerned is deleted or, where necessary, blocked from further processing.

13. Your data protection rights

Where we process your personal data, you have the following rights in particular, subject to the applicable statutory conditions:

• right of access under Article 15 GDPR
• right to rectification under Article 16 GDPR
• right to erasure under Article 17 GDPR
• right to restriction of processing under Article 18 GDPR
• right to data portability under Article 20 GDPR
• right to object under Article 21 GDPR
• right to withdraw consent under Article 7(3) GDPR

You can withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, you can contact shop@nena.de at any time.

14. Right to lodge a complaint

You also have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR.

The supervisory authority responsible for our registered office is, in particular, the Hamburg Commissioner for Data Protection and Freedom of Information. You may also contact another competent data protection supervisory authority.

15. Changes to this privacy policy

We update this privacy policy when legal, technical or organisational changes occur or when new services are used in our shop.