Privacy Policy

The controller within the meaning of data protection laws, in particular the EU General Data Protection Regulation (GDPR), is:

BavaRoi Kultur+Produkt GmbH, Lindwurmstraße 88, 80337 Munich, Germany; Tel.: +49 (0)89 55263455; Email: info@bavaroi.de ; represented by its Managing Director: Moritz Gauger.

Your Rights as a Data Subject

Applicable data protection law grants you comprehensive rights as a data subject vis-à-vis the controller with regard to the processing of your personal data, in particular rights of access and intervention, about which we inform you below.

You may exercise the following rights at any time using the contact details provided for our data protection contact person:

Right of access to the personal data processed by us pursuant to Art. 15 GDPR,
Right to rectification of inaccurate or incomplete personal data pursuant to Art. 16 GDPR,
Right to erasure of your personal data stored by us pursuant to Art. 17 GDPR, provided that no statutory retention obligations or other legal grounds prevent erasure,
Right to restriction of processing of your personal data pursuant to Art. 18 GDPR,
Right to notification regarding recipients to whom a rectification or erasure of personal data or restriction of processing has been communicated pursuant to Art. 19 GDPR,
Right to data portability of the personal data concerning you in a structured, commonly used and machine-readable format pursuant to Art. 20 GDPR, provided that the legal requirements for this are met,
Right to object to the processing of your personal data pursuant to Art. 21 GDPR, provided that the processing is carried out on the basis of Art. 6 para. 1 lit. e or lit. f GDPR,
Right to withdraw consent granted pursuant to Art. 7 para. 3 GDPR. The withdrawal applies with effect for the future and does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal,
Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR, in particular in the Member State of your place of residence, your place of work or the place of the alleged infringement. For us, the competent authority is generally the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, telephone: +49 981 180093-0, email: poststelle@lda.bayern.de, www.lda.bayern.de.

Purposes of Data Processing by the Controller and Third Parties

We process your personal data only for the purposes stated in this Privacy Policy. Your personal data will not be transferred to third parties for purposes other than those stated. We only disclose your personal data to third parties if:

you have given your express consent to this,
processing is necessary for the performance of a contract with you,
processing is necessary for compliance with a legal obligation,
processing is necessary to safeguard legitimate interests and there is no reason to assume that you have an overriding legitimate interest in the non-disclosure of your data.

Storage Period and Erasure of Personal Data

The duration of storage of personal data is determined by the respective legal basis, the purpose of processing and, where applicable, additionally by the respective statutory retention period, for example retention periods under commercial and tax law.

When personal data is processed on the basis of express consent pursuant to Art. 6 para. 1 lit. a GDPR, this data is stored until the data subject withdraws their consent.

If statutory retention periods exist for data that is processed within the scope of contractual or quasi-contractual obligations on the basis of Art. 6 para. 1 lit. b GDPR, this data will be routinely erased after expiry of the retention periods, provided that it is no longer required for the performance or initiation of a contract and/or we no longer have a legitimate interest in continued storage.

When personal data is processed on the basis of Art. 6 para. 1 lit. f GDPR, this data is stored until the data subject exercises their right to object pursuant to Art. 21 para. 1 GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.

When personal data is processed for the purpose of direct marketing on the basis of Art. 6 para. 1 lit. f GDPR, this data is stored until the data subject exercises their right to object pursuant to Art. 21 para. 2 GDPR.

Unless otherwise stated in the other information contained in this Privacy Policy regarding specific processing situations, stored personal data will otherwise be erased when it is no longer necessary for the purposes for which it was collected or otherwise processed.

Collection of General Information When Visiting Our Website

When you access our website, the web server automatically processes access data. This includes, in particular, IP address, date and time of access, page accessed, referrer URL, browser type, browser version and operating system used. This is technical access data required for the operation and security of the website. We do not combine this data with other data sources unless this is necessary to investigate security incidents.

This information is technically necessary in order to correctly deliver website content requested by you and is inevitably generated when using the internet. It is processed in particular for the following purposes:

ensuring a smooth connection setup of the website,
ensuring convenient use of our website,
evaluating system security and stability, and
for further administrative purposes.

Processing is carried out pursuant to Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. We do not use your data to draw conclusions about your person. Recipients of the data are only the controller and, where applicable, processors. Technical information of this kind may be statistically evaluated by us in order to optimise our website and the technology behind it.

The server log files are stored for 14 days and then erased, unless longer storage is required to investigate security incidents.

Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use so-called cookies on various pages. Cookies are small text files that are stored on your device. Some of the cookies used by us are deleted again after the end of the browser session, i.e. after closing your browser, so-called session cookies. Other cookies remain on your device and enable us or our partner companies to recognise your browser on your next visit, so-called persistent cookies. If cookies are set, they collect and process certain user information, such as browser and location data as well as IP address values, to an individual extent. Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can find the duration of the respective cookie storage in the overview of the cookie settings of your web browser.

In some cases, cookies are used to simplify the ordering process by storing settings, for example remembering the contents of a virtual shopping cart for a later visit to the website. If personal data is also processed by individual cookies used by us, the processing is carried out pursuant to Art. 6 para. 1 lit. b GDPR either for the performance of the contract, pursuant to Art. 6 para. 1 lit. a GDPR in the event of consent having been granted, or pursuant to Art. 6 para. 1 lit. f GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the website visit.

Where cookies or similar technologies are stored on or read from your device, this is done, where required, on the basis of your consent. Technically necessary cookies are used to enable the operation of the website.

Please note that you can set your browser so that you are informed about the setting of cookies and decide individually whether to accept them, or exclude the acceptance of cookies for certain cases or in general. Each browser differs in the way it manages cookie settings. This is described in the help menu of each browser, which explains how you can change your cookie settings. You can find these for the respective browsers under the following links:

Please note that if you do not accept cookies, the functionality of our website may be limited.

Following cookies are being used:

session
sw-cache-hash
sw-states
timezone

SSL Encryption

To protect the security of your data during transmission, we use encryption methods in line with the current state of the art, such as SSL via HTTPS.

Comment Function

When users leave comments on our website, in addition to this information, the time at which the comment was created and the username previously selected by the website visitor are stored. This serves our security, as we may be held liable for unlawful content on our website, even if it was created by users.

Contact Form

When you contact us, for example via contact form or email, personal data is collected. Which data is collected when using a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your enquiry or for contacting you and the associated technical administration. The legal basis for processing this data is our legitimate interest in responding to your enquiry pursuant to Art. 6 para. 1 lit. f GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 para. 1 lit. b GDPR. Your data will be erased after final processing of your enquiry. This is the case if it can be inferred from the circumstances that the matter concerned has been conclusively clarified and provided that no statutory retention obligations prevent erasure.

Data Processing When Opening a Customer Account

Pursuant to Art. 6 para. 1 lit. b GDPR, personal data continues to be collected and processed if you provide it to us for the performance of a contract or when opening a customer account. Which data is collected can be seen from the respective input forms. Deletion of your customer account is possible at any time and can be carried out by sending a message to the above-mentioned address of the controller. We store and use the data provided by you for contract processing. After complete performance of the contract or deletion of your customer account, your data will be restricted in processing with due regard to tax and commercial retention periods and erased after expiry of these periods, unless you have expressly consented to further use of your data or we have reserved the right to further data use permitted by law.

Data Processing for Order Processing

For the processing of your order, we work with the service providers listed below, who support us in whole or in part in the performance of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

Use of Special Service Providers for Order Processing and Handling:

Billbee:

Order processing is carried out via the service provider “Billbee” (Billbee GmbH, Paulinenstrasse 54, 32756 Detmold, Germany). Name, address and, where applicable, further personal data are passed on to Billbee exclusively for the purpose of processing the online order pursuant to Art. 6 para. 1 lit. b GDPR. Your data is only passed on to the extent that this is actually necessary for processing the order. Further information on data processing by Billbee can be found in Billbee’s privacy notices at www.billbee.io.

Use of Payment Service Providers:

PayPal:

When paying via PayPal, credit card via PayPal, direct debit via PayPal or, if offered, “purchase on account” or “payment by instalments” via PayPal, we pass on your payment data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, hereinafter “PayPal”, as part of the payment processing. The transfer is carried out pursuant to Art. 6 para. 1 lit. b GDPR and only to the extent necessary for payment processing.

PayPal reserves the right to carry out a credit check for the payment methods credit card via PayPal, direct debit via PayPal or, if offered, “purchase on account” or “payment by instalments” via PayPal. For this purpose, your payment data may be passed on to credit agencies pursuant to Art. 6 para. 1 lit. f GDPR on the basis of PayPal’s legitimate interest in determining your solvency. PayPal uses the result of the credit check with regard to the statistical probability of payment default for the purpose of deciding whether to provide the respective payment method. The credit report may contain probability values, so-called score values. Where score values are included in the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. Address data, among other things but not exclusively, is included in the calculation of the score values. Further data protection information, including information on the credit agencies used, can be found in PayPal’s Privacy Policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

You may object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still remain entitled to process your personal data if this is necessary for contractual payment processing.

Disclosure of Personal Data to Shipping Service Providers:

For the delivery of your order, we pass on the personal data required for this purpose, in particular name and delivery address, to our shipping service provider DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany. The transfer is carried out for the purpose of contract processing on the basis of Art. 6 para. 1 lit. b GDPR. If we transmit your email address or telephone number to DHL, this is done for shipment notification, shipment tracking or delivery coordination only insofar as this is necessary for contract processing or you have consented to it. The legal basis is Art. 6 para. 1 lit. b GDPR or, in the case of consent, Art. 6 para. 1 lit. a GDPR. Further information on data processing by DHL can be found in DHL’s privacy notices.

Use of Google Analytics

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Analytics 4 enables us to evaluate and statistically analyse the behaviour of visitors to our website. In doing so, information about the use of our website, technical information about the device and browser used, approximate geographical origin, pages accessed, length of stay, interactions and events on the website may be processed, among other things. Google Analytics 4 uses cookies and comparable technologies for this purpose, which enable an analysis of the use of our website.

Google Analytics 4 is used exclusively on the basis of your prior consent pursuant to Art. 6 para. 1 lit. a GDPR and, insofar as information is stored on or read from your device, pursuant to Section 25 para. 1 TDDDG. You can withdraw or change your consent at any time with effect for the future via the cookie settings on our website.

As part of the use of Google Analytics 4, personal data is transmitted to Google. According to Google, Google initially processes data from users in the EU via servers within the European Union; however, further processing by Google may also take place in the USA or other third countries. For data transfers to the USA, Google states that it relies, among other things, on the adequacy decision of the EU Commission regarding the EU-U.S. Data Privacy Framework and, where necessary, on the EU Commission’s standard contractual clauses.

We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR. The storage period for user and event data stored by us in Google Analytics 4 is 2 months. Thereafter, the data is erased or anonymised. The specific storage period depends on the settings we have configured in Google Analytics 4.

Further information on data processing by Google can be found in Google’s privacy notices and in the information on Google Analytics. Google explains, among other things, that in Google Analytics 4 IP addresses are not logged or stored, but may be used to derive approximate location data.

Use of Script Libraries (Google Web Fonts)

For the uniform and attractive presentation of our website, we use so-called Google Web Fonts. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When you access our website, your browser loads the required fonts directly from Google servers in order to display texts and fonts correctly. This enables Google to become aware that our website was accessed via your IP address. In particular, your IP address, technical information about your browser and device as well as the date and time of access may be processed.

The integration of Google Web Fonts is carried out for the uniform presentation of our website. Insofar as information is stored on or read from your device for this purpose, or personal data is transmitted to Google, the use takes place only on the basis of your consent pursuant to Section 25 para. 1 TDDDG and Art. 6 para. 1 lit. a GDPR. You can withdraw or change your consent at any time with effect for the future via the cookie settings on our website.

As part of the use of Google Web Fonts, a transfer of personal data to Google LLC in the USA or to other third countries cannot be ruled out. According to Google, data transfers to the USA are based, among other things, on the adequacy decision of the EU Commission regarding the EU-U.S. Data Privacy Framework and, where necessary, on the EU Commission’s standard contractual clauses.

Further information on Google Web Fonts can be found in Google’s privacy notices.

Adobe Fonts / Adobe Typekit

For the uniform and attractive presentation of our website, we use Adobe Fonts, formerly Adobe Typekit. The provider is Adobe Systems Software Ireland Limited, 4–6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland. When you access our website, your browser loads the required fonts directly from Adobe servers so that the fonts used by us can be displayed correctly. This enables Adobe to become aware that our website was accessed via your IP address. In particular, your IP address, technical information about your browser and device as well as the date and time of access may be processed.

The integration of Adobe Fonts is carried out for the uniform presentation of our website. Insofar as information is stored on or read from your device for this purpose, or personal data is transmitted to Adobe, the use takes place only on the basis of your consent pursuant to Section 25 para. 1 TDDDG and Art. 6 para. 1 lit. a GDPR. You can withdraw or change your consent at any time with effect for the future via the cookie settings on our website.

As part of the use of Adobe Fonts, a transfer of personal data to Adobe companies in the USA or to other third countries cannot be ruled out. According to Adobe, Adobe bases data transfers to third countries on suitable safeguards, in particular the EU Commission’s standard contractual clauses.

Further information on Adobe Fonts can be found in Adobe’s privacy notices.

Hosting

Our website is hosted by an external service provider. The server is located in Germany.

The hosting provider processes personal data generated when you visit our website—in particular the technical access data mentioned in the section “Collection of General Information When You Visit Our Website”—on our behalf. The processing is carried out for the purpose of providing our website in a secure, stable, and efficient manner.

The legal basis for the processing is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure, reliable, and high-performance provision of our online services.

We have entered into a data processing agreement with the hosting provider in accordance with Article 28 of the GDPR.

Social Media Links

Links to our profiles on social networks are embedded on our website. These links are identified by the respective symbol of the social network.

When you access our website, this mere linking does not yet establish a connection to the servers of the respective social networks. Only when you click on such a link will you be forwarded to the website of the respective provider. In this process, personal data, in particular your IP address, technical information about your browser and device, as well as the information that you have visited our website, may be transmitted to the respective provider.

We have no influence on which data the providers of social networks collect after clicking the link and how this data is processed. This applies in particular if you are already logged in to the respective social network. The processing of your personal data by the respective provider is governed by that provider’s privacy notices.

The integration of social media links is carried out on the basis of Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in providing you with an easy way to contact us and obtain information about our social media presence.

We link to the following social media services:

Facebook: The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Privacy notices: https://www.facebook.com/privacy/policy/

Instagram: The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Privacy notices: https://privacycenter.instagram.com/policy/

A transfer of personal data to third countries, in particular to the USA, cannot be ruled out when using the linked services. Further information can be found in the privacy notices of the respective providers.

Amendment of Our Privacy Policy

We reserve the right to adapt this Privacy Policy so that it always complies with current legal requirements or to implement changes to our services in the Privacy Policy, for example when introducing new services. The new Privacy Policy will then apply to your next visit.

Right to Object

If we process your personal data on the basis of our overriding legitimate interest as part of a balancing of interests, you have the right at any time, for reasons arising from your particular situation, to object to this processing with effect for the future.

If you exercise your right to object, we will cease processing the data concerned. Further processing remains reserved, however, if we can demonstrate compelling legitimate grounds for the processing which override your interests, fundamental rights and freedoms, or if the processing serves the establishment, exercise or defence of legal claims.

If your personal data is processed by us for the purpose of direct marketing, you have the right at any time to object to the processing of personal data concerning you for the purposes of such advertising. You may exercise the objection as described above.

If you exercise your right to object, we will cease processing the data concerned for direct marketing purposes.

Questions for the Data Protection Contact Person

If you have any questions about data protection, please send us an email or contact directly: Moritz Gauger, info@bavaroi.de