Data protection

Privacy Policy

Thank you for your interest in our website. As a member of the association "sicherer und seriöser Internetshopbetreiber e. V." (Association of Secure and Reliable Internet Shop Operators), the protection of your personal data is a serious matter to us. Below, we inform you transparently and in understandable language, among other things, about data collection and its scope, the purposes for which your data is used, and what rights you have.

You have the right at any time to receive information free of charge regarding the origin, recipient(s), and purpose of your stored personal data. You also have the right to demand the correction, restriction, or deletion, as well as the transfer of this data. For questions regarding this or any other aspect of data protection, you may contact the person responsible for data processing at any time. The person responsible for data processing is named in point 1 of this Privacy Policy. Furthermore, you have the right to lodge a complaint with the competent supervisory authority. You can find your rights in detail and comprehensive explanations regarding them in point 6 of this Privacy Policy.

Your data is collected, stored, and processed in compliance with the relevant legal regulations. Personal data refers to all types of data that can be used to identify you as an individual.

1.) Who is responsible for data processing?

For the purposes of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other data protection provisions, the controller is a natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (names, contact details, etc.).

The controller responsible for data processing on this website is:

Nordwelt-Versand GmbH i.L.
Oliver Bode
An der Windmühle 1
31079 Sibbesse
Email: nordwelt-versand@nordwelt-versand.de

2.) What data is collected and processed on our website?

2.1.1 Automated data collection:

Every time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer in so-called server log files. Some of this data is technically necessary to display our website to you. There is no merging with data from other sources. The following data is collected:

  • The pages accessed
  • Browser types and versions used
  • The operating system used by the accessing system
  • The website from which an accessing system reached our site
  • The date and time of access to the site
  • The internet service provider of the accessing computer
  • The internet protocol address (IP address) used

The legal basis for data processing is Art. 6 (1) (f) of the General Data Protection Regulation (GDPR), which allows us to process data in the case of a legitimate interest. Our legitimate interest in this case is the reliable and error-free functioning of our website. No other processing of this data takes place.

2.2 Collection of personal data

2.2.1 Data collection and processing when opening a customer account and processing contracts

If you open a customer account on our website, this is done voluntarily. Registration is not a prerequisite for entering into a contract. Data is only collected to the minimum extent necessary; mandatory fields are identified in the corresponding input fields. The customer account can be deleted at any time and free of charge. If you wish to delete your account, please contact the person responsible for data processing. This person is named in point 1 of this Privacy Policy.

We use your data only for the purpose for which you registered or to process the contract. The legal basis for data processing is Art. 6 (1) (b) of the General Data Protection Regulation (GDPR), which allows us to process data if this is necessary for the fulfillment of a contract with you or for the implementation of pre-contractual measures.

The collected customer data will be blocked after completion of the order, termination of the business relationship, or deletion of your customer account and deleted after the expiry of tax and commercial law retention periods, unless you have consented to further use of your data.

2.2.2 Data collection and processing when using our email address, contact function, or online cancellation option

In the case of emails or messages via the contact form, we store your data until the processing of your communication is complete. The mandatory information in the contact form mask is identified in the corresponding input fields. The data is used exclusively for processing your request; after the processing is complete, your data will be deleted. The legal basis for data processing is Art. 6 (1) (f) of the General Data Protection Regulation (GDPR), which allows us to process data in the case of a legitimate interest. Our legitimate interest in this case is responding to your message or processing your request.

For emails or messages via the contact form that aim at initiating a contract or its cancellation, the commercial and tax law retention periods of 10 years from the end of the calendar year in which the data was collected apply. After the expiration of these periods, the data is regularly deleted, unless it is still required for initiation or performance of a contract or if we have a legitimate interest in continuing the storage.

In the event of a cancellation, we use the data you provided to confirm your cancellation by email.

The legal basis for data processing in this case is Art. 6 (1) (b) of the General Data Protection Regulation (GDPR), which allows us to process data if this is necessary for the fulfillment of a contract with you, for the implementation of pre-contractual measures, or for the cancellation of the contract.

Since we are legally obligated to offer an electronic cancellation function, the legal basis under Art. 6 (1) (c) of the General Data Protection Regulation (GDPR) also applies, which allows us to process data when a legal obligation exists.

2.2.3 Newsletter function, data processing, and right to object.

2.2.3.1 You have registered for our newsletter subscription:

If you subscribe to our free newsletter, data from the registration mask is transmitted to us. The mandatory information is identified in the corresponding input fields and is limited to the minimum extent necessary (email address). For the processing of your data, consent is obtained during the registration process, and reference is made to this Privacy Policy. The legal basis for data processing is Art. 6 (1) (a) of the General Data Protection Regulation (GDPR), which allows us to process data if you have consented to the processing.

The data is not passed on to third parties but is used exclusively for sending newsletters. Subscription to the newsletter (your consent) can be revoked at any time for the future. To revoke your consent, you will find a link to unsubscribe from the newsletter in every newsletter; optionally, you can also unsubscribe directly via our website. The request to unsubscribe from the newsletter can, of course, also be sent directly to the person responsible for data processing. This person is named in point 1 of this Privacy Policy. After unsubscribing from the newsletter subscription, the data will be deleted unless you have consented to further use, or we have reserved the right to further use (as explained below under 2.2.3.2), which is legally permitted.

2.3 Transfer of data to third parties for contract fulfillment

2.3.1 Transfer to shipping service providers in general and credit institutions

For payment processing and, if applicable, for the delivery of goods, we pass on personal data to the minimum extent necessary to service providers (third parties) if this is necessary for the performance of the contract.

If we pass on your data to a shipping service provider (such as DHL, DPD, UPS, Hermes, or GLS), the legal basis for this is Art. 6 (1) (b) of the General Data Protection Regulation (GDPR), which allows us to process data if this is necessary for the fulfillment of a contract with you or for the implementation of pre-contractual measures.

If we pass on your payment data to the commissioned credit institution, the legal basis for this is Art. 6 (1) (b) of the General Data Protection Regulation (GDPR), which allows us to process data if this is necessary for the fulfillment of a contract with you or for the implementation of pre-contractual measures.

2.3.2 Transfer of email address and/or telephone number to shipping service providers

2.3.2.1 DHL

If your goods are delivered by the shipping service provider DHL, and you have expressly consented during the ordering process to the transfer of your email address, this will be passed on to DHL (Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn) for the purpose of announcing the delivery or coordinating the delivery date. The legal basis for data processing is Art. 6 (1) (a) of the General Data Protection Regulation (GDPR), which allows us to process data if you have consented to the processing. If you do not consent to the transfer of your email address, the delivery will be made according to the terms of paragraph 2.3.1 of this Privacy Policy. An announcement of the delivery or coordination of the delivery date by DHL will then not be possible.

Consent given for data usage can be revoked at any time for the future. Please contact the person responsible for data processing (named in point 1 of this Privacy Policy) or the shipping service provider directly.

2.3.3 Payment service providers

You have the choice of various payment service providers on our website. Below we inform you about which data is passed on and on what legal basis this occurs:

2.3.3.1 Unzer

If you choose this payment service provider, the data necessary for payment will be passed on to Unzer (Unzer Group GmbH, Schöneberger Str. 21 a, 10963 Berlin). The legal basis for this is Art. 6 (1) (a) of the General Data Protection Regulation (GDPR), which allows us to process data if you have consented to the processing, and Art. 6 (1) (b) of the General Data Protection Regulation (GDPR), which allows us to process data if this is necessary for the fulfillment of a contract with you or for the implementation of pre-contractual measures. You have the right to revoke your declaration of consent at any time. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until the revocation.

If you wish to object to the use of your data or wish to communicate changes regarding the stored data, you can contact Unzer directly. At the following internet address, you can also obtain further information about the privacy policies of Unzer:

https://www.unzer.com/de/datenschutz/

2.3.3.2 Klarna

If you choose this payment service provider, order data and your personal data will be passed on to Klarna (Klarna Bank AB (publ), www.klarna.de, Sveavägen 46, 111 34 Stockholm, Sweden). Order data includes information about the items, the delivery method, and the invoice total; your personal data includes your first name, last name, address, telephone number, email address, and date of birth. The legal basis is Art. 6 (1) (a) of the General Data Protection Regulation (GDPR), which allows the processing of data if you have expressly consented to the processing during the ordering process after selecting the Klarna payment method.

When paying by "installment" or "invoice," Klarna may obtain identity and credit information.

A credit check may contain scoring values (= probability values). The so-called scoring values are based on a scientifically recognized mathematical-statistical procedure. Your address data also flows into (but is not limited to) the calculation of these score values.

If you wish to object to the use of your data or wish to communicate changes regarding the stored data, you can contact Klarna directly.

3.) What are cookies and what data is processed?

3.1 Cookies set by our website

Our website uses so-called cookies. Cookies are text files that are stored in the internet browser or by the internet browser on your computer. We use cookies to make our website more user-friendly. Some elements of our website require that the accessing browser can be identified even after a page change. For example, to store and transmit items in your shopping cart or your login information. Most of the cookies we use are so-called "session cookies," which are automatically deleted after closing the browser. Some cookies remain stored on your device and enable recognition on your next visit (so-called persistent cookies). These are automatically deleted after a specified duration. More detailed information on individual cookies can be found in your browser settings.

The legal basis for data processing is either Art. 6 (1) (a) of the General Data Protection Regulation (GDPR), which allows us to process data if you have consented to the processing, or Art. 6 (1) (b) of the General Data Protection Regulation (GDPR), which allows us to process data if this is necessary for the fulfillment of a contract with you or for the implementation of pre-contractual measures, or Art. 6 (1) (f) of the General Data Protection Regulation (GDPR), which allows us to process data in the case of a legitimate interest. Our legitimate interest in this case is to offer you a technically flawless and functionally optimized website.

If we store other cookies (for example, from partner companies or to analyze your surfing behavior) on your device, we will inform you about this in detail below.

You can set your browser so that you are informed about the setting of cookies and then allow these cookies only in individual cases. Please note that if cookies are not accepted, the functionality of our website may be significantly limited.

3.3 Web analysis/Marketing

3.3.1 Google Analytics

We use the analysis tool Google Analytics on our website. The provider of this tool is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

Google Analytics uses so-called "cookies." Cookies are small text files that are stored on your computer and thus enable an analysis of your use of the website. This data, including your IP address, is transferred to Google servers. Your IP address is, however, truncated to exclude a direct connection to you.

On our behalf, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide us with other services related to website and internet usage.

As part of this processing, there may also be a transmission to the servers of Google LLC in the USA. The IP address transmitted by your internet browser as part of Google Analytics will not be merged with other data from Google.

The processing of data and the setting of cookies is carried out on the legal basis for data processing in accordance with Art. 6 (1) (a) of the General Data Protection Regulation (GDPR), which allows us to process data if you have given us your express consent. Without consent, Google Analytics will not be used while you visit our sites.

You can revoke your consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on our sites.

Further information on Google Analytics can be found here: https://policies.google.com/privacy?hl=de&gl=de

3.2 Google Maps

We use Google Maps (API) on our websites. Interactive maps are visually displayed via Google Maps. Google Maps displays our location to you on the map. The provider of this tool is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. When you visit websites where Google Maps is integrated, user data, such as your IP address, is transmitted to Google servers in the USA, where it is stored and analyzed. If you have a Google account and are logged in, this data will be associated with your account. If you wish to avoid such an association, you must log out of your Google account beforehand. Regardless of whether you are logged in or not, Google creates a user profile in any case.

The legal basis for the data processing is Art. 6 (1) lit. f of the General Data Protection Regulation (GDPR), which allows Google to process the data in the event of a legitimate interest. The legitimate interest in this case is the display of personalized advertising and/or the optimization of Google Maps.

If you wish to prevent this data transmission because you do not agree with it, you can completely deactivate Google Maps by disabling "JavaScript" in your browser settings. Please note that the virtual map displaying our location will then also no longer work.

Furthermore, you have a right to object to Google regarding the creation of user profiles. To exercise this right of objection, please contact Google directly.

Otherwise, the data protection and terms of use of Google and Google Maps apply:

https://www.google.com/intl/de_US/help/terms_maps.html
https://policies.google.com/privacy?hl=de&gl=de

3.3 Google reCAPTCHA

We use the Google reCAPTCHA function on our website. This function determines whether the use of our website is by a natural person or by machine. The provider of this tool is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

The processing includes sending your IP address and, if applicable, other data required by Google. Processing takes place on the legal basis for data processing according to Art. 6 (1) lit. f of the General Data Protection Regulation (GDPR), which allows the processing of data in the event of a legitimate interest. The legitimate interest in this case is the prevention of misuse.

You can obtain further information at the following internet address:

https://policies.google.com/privacy?hl=de

4.) How is the data secured?

Personal data is transmitted exclusively in encrypted form via an SSL or TLS connection. This applies to messages sent via our contact function as well as to data regarding your order and payment transactions. Thanks to encryption, your sensitive personal data cannot be intercepted and viewed by unauthorized third parties. You can recognize an encrypted connection by the fact that the address line of the browser begins with "https://" (and by the lock symbol in the browser bar).

The data stored in our website systems is secured by passwords and cannot be viewed by unauthorized third parties.

Data transmission on the internet, for example when sending an email, is not 100% secure and may have security gaps in some cases.

5.) How long is personal data stored?

How long your personal data is stored with us depends in part on the respective statutory retention period. For messages sent via our contact function and/or our email address, your data will be deleted after processing is complete, unless we have a legitimate interest in continuing the storage.

Commercial and tax-related retention periods are 10 years from the end of the calendar year in which the data was collected. Upon expiration of these periods, the data is regularly deleted, unless it is still required for initiating or fulfilling a contract, or we have a legitimate interest in continuing the storage.

6.) What rights do you have regarding the data controller?

Below we list the rights you have under the General Data Protection Regulation (GDPR) regarding the controller for data processing. The controller is mentioned in point 1 of this privacy policy. If your personal data is being processed, you are a "data subject" within the meaning of the General Data Protection Regulation (GDPR).

  • Right to information according to Art. 15 GDPR
  • Right to rectification according to Art. 16 GDPR
  • Right to erasure according to Art. 17 GDPR
  • Right to restriction of processing according to Art. 18 GDPR
  • Right to be informed according to Art. 19 GDPR
  • Right to data portability according to Art. 20 GDPR
  • Right to withdraw granted consent according to Art. 7 GDPR
  • Automated decision-making in individual cases including profiling
  • Right to lodge a complaint with a supervisory authority according to Art. 77 GDPR

+++++++++++++++++++++++++++++

RIGHT TO OBJECT

You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6 (1) lit. e or f GDPR, with effect for the future; this also applies to profiling based on these provisions.

The data controller will no longer process the personal data concerning you unless they can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to profiling insofar as it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

In connection with the use of information society services – notwithstanding Directive 2002/58/EC – you have the option to exercise your right to object by means of automated procedures using technical specifications.

+++++++++++++++++++++++++++++