Privacy Policy
We appreciate your interest in our online store. Protecting your privacy is very important to us. Below, we provide detailed information about how we handle your data, what rights you have, and how you can exercise those rights.
I. The data controller
We are the responsible body in accordance with Art. 4 No. 7 of the GDPR
Roast Market GmbH
Represented by the directors: Matthias Sickinger
Stephanstraße 1-3
60313 Frankfurt am Main
Germany
Email: [email protected]
To contact our data protection team, please refer to: [email protected]
II. Data processing for the provision of services in connection with the platform
In this section, we inform you about how we process your personal data when you use our services through the platform.
Our platform is not intended for individuals under the age of 14. To the extent that the processing of personal data is based on consent, under Spanish law, such consent will only be valid for individuals under the age of 14 once they have turned 14. For individuals under the age of 14, the consent of their legal guardians is required (Art. 7 LOPDGDD).
1.Creation of a customer account and contract processing
a) Description and scope of data processing
We offer you the option of registering on our platform with a customer account. For this purpose, we require the following personal data, which we ask you to provide via an input form:
Form of address
First name, last name
Email
In order for you to place orders, we also need the following personal data from you:
Address
Credit card details
b) Legal basis for data processingThe legal basis for the processing of your personal data, which is collected and further processed in connection with the creation of a customer account and contract fulfillment, is Article 6(1)(b) of the GDPR.
c) Purpose of data processing
The purpose of data processing is contract fulfillment, in particular order processing.
d) Retention period
We delete your personal data when it is no longer necessary for the purpose of processing. This is usually the case after the expiry of the limitation period, which begins at the end of the year in which the contractual relationship ends, e.g. when your customer account is deleted. After the limitation period has expired, your data will be blocked and deleted after the expiry of the statutory storage obligations (see VII. Storage periods).
2. Transfer of data to shipping providers and suppliers
a) Description and scope of data processing
In order to deliver the goods you have ordered, we will disclose your name and address or the name and address of the recipient you have specified in the ordering process to the shipping company or our suppliers responsible for delivery, to the extent necessary for the delivery of the goods you have ordered.
If you have selected this option, we will pass on your telephone number to the shipping company you have selected.
b) Legal basis for data processing
The disclosure of your address and name to the transport company is based on Article 6(1)(b) of the GDPR. The disclosure of your telephone number is based on your consent in accordance with Article 6(1)(a) of the GDPR.
c) Purpose of data processing
The purpose of data processing is contract fulfillment. The transfer of your telephone number to the transport company prior to delivery is for the purpose of contacting you to announce or arrange the delivery.
d) Storage period
We delete your personal data when it is no longer necessary for the purpose of processing. This is usually the case after the expiry of the limitation period, which begins at the end of the year in which the order was placed. After the limitation period has expired, your data will be blocked and deleted after the expiry of the statutory storage obligations (see VII. Storage periods).
e) Revocation pursuant to Art. 7 GDPR
You may revoke your consent to the processing of your telephone number at any time in accordance with Article 7 of the GDPR. You can do this by sending a message to [email protected]. The revocation does not affect the legality of the processing carried out on the basis of the consent until then. In the event of revocation, your personal data will no longer be processed and will be deleted, unless you have expressly consented to further use of your data or we reserve the right to further use data that is lawful and about which we inform you in this statement.
3. Shipping Logistics and Shipment Tracking via Seven Senders
a) Description and Scope of Data Processing
To carry out international shipments of goods and to optimize shipment management, we use Seven Senders GmbH, Dircksenstraße 4, 10179 Berlin, Germany (“Seven Senders”). To this end, we transmit the personal data necessary for shipment management to Seven Senders.
Seven Senders assists us in organizing and carrying out cross-border shipments, tracking shipments, communicating information about delivery status, and coordinating with contracted shipping service providers in the destination country.
In this context, the following data may be processed in particular:
First and last name,
Delivery address,
Email address,
Phone number (if provided),
Order number,
Shipping and tracking numbers,
Information on the shipment status.
As part of shipping management, data may also be transferred to the shipping service providers responsible for delivery in the destination country.
b) Legal basis for data processing
The purpose of processing personal data is to execute and fulfill the sales contract entered into with you, in accordance with Article 6(1), first sentence, letter b) of the GDPR.
To the extent that shipping and delivery data is processed for the purposes of analyzing and optimizing shipping processes, such processing is based on our legitimate interest in efficient and customer-oriented shipping management, in accordance with Article 6(1), first sentence, letter f) of the GDPR.
c) Purpose of Data Processing
The purpose of data processing is:
to organize and carry out the international shipment of the ordered products,
to track shipments and provide information on the current delivery status,
to coordinate with contracted shipping service providers,
and to improve and optimize shipping processes.
d) Duration of Storage
We retain your personal data only for as long as necessary to fulfill the contract, process any inquiries or complaints, and comply with legal retention obligations.
Otherwise, we delete the data as soon as it is no longer necessary to achieve the aforementioned purposes and there are no legal retention obligations preventing its deletion.
e) Recipients of the data
The recipients of your personal data are:
Seven Senders GmbH, Dircksenstraße 4, 10179 Berlin, Germany,
and the shipping service providers responsible for delivery in the destination country.
If shipping service providers outside the European Economic Area are used, the transfer of personal data will only take place in compliance with the legal requirements of Articles 44 et seq. of the GDPR.
4. Use of Deutsche Post ADDRESSFACTORY
a) Description and scope of data processing
In connection with the delivery of the ordered goods, we transfer your name and address or the name and address of the recipient you specified in the ordering process to Deutsche Post Direkt GmbH, Junkersring 57, 53844 Troisdorf, Germany, a company of Deutsche Post AG, (hereinafter: Deutsche Post Direkt) for the purpose of address verification. This is to ensure that your or the recipient's data is up to date and that no unnecessary costs for postage or returns are incurred when shipping to an address that is no longer current. In addition, we allow Deutsche Post Direkt to compare the above data for our security in the event that a third party registers on our website without your knowledge or misuses your personal data when ordering goods.
b) Legal basis for data processing
The transfer of your address and name to the transport company is carried out in accordance with Art. 6 (1) (f) of the GDPR.
c) Purpose of data processing
The purpose of data processing is address comparison. This serves to verify your information and the deliverability of the order, avoid unnecessary costs due to incorrect deliveries, and prevent misuse. This is also our legitimate interest.
d) Storage period
We delete your personal data when it is no longer necessary for the purpose of processing. This is usually the case after the expiry of the limitation period, which begins at the end of the year in which the order was placed. After the limitation period has expired, your data will be blocked and deleted after the expiry of the statutory retention obligations (see VII. Storage periods).
e) Right to object and erasure pursuant to Article 21 of the GDPR
Objection to the disclosure of your name and address is excluded, as this is done to prevent misuse.
5. Use of Klarna as a payment method
a) Description and scope of data processing
If you choose Klarna AB's payment service "Klarna invoice" as your payment option, you consent to us transferring your personal data, such as your first and last name, billing and delivery address, email address, and information about goods/services, to Klarna AB, located at Sveavägen 46, 111 34 Stockholm.
The information you have provided will be checked and assessed by Klarna, which means that Klarna will also pass on the information to other companies and credit reference agencies. According to Klarna's own information, your data will be processed in accordance with applicable data protection regulations, which you can read in Klarna's privacy policy: https://www.klarna.com/international/privacy-policy/.
In addition, Klarna collects personal data from you in connection with payment processing for the purpose of detecting and preventing fraud.
b) Legal basis for data processing
The use of Klarna and the associated data processing is based on your consent in accordance with Article 6(1)(a) of the GDPR. The payment processing for the fulfillment of contractual obligations is based on Article 6(1)(b) of the GDPR.The additional data collected is processed in accordance with Article 6(1)(f) of the GDPR.
c) Purpose of data processing
Klarna processes your data to verify your identity, check personal data and contact details, and to carry out internal and external credit checks. We need this information to complete a purchase on invoice, in particular to assess which payment methods we can offer you. A list of the credit agencies used by Klarna can be found at https://cdn.klarna.com/1.0/shared/content/legal/terms/0/en_gb/credit_rating_agencies
If you withdraw your consent to Klarna, Klarna may still be entitled to process, use, and transfer your personal data. This serves the purpose of contractual payment processing, if necessary.
The processing also serves to remedy technical and administrative errors, as well as to carry out risk analyses, prevent fraud, and manage risk. These purposes also constitute our legitimate interest in processing your personal data.
d) Storage period
According to Klarna, the data we transfer is only stored for as long as is necessary to fulfill the contract entered into with you. This is usually the case after the expiry of the limitation period, which begins at the end of the year in which the order was placed. After the expiry of the limitation period, your data will be blocked and deleted after the expiry of the statutory retention obligations (see VII. Storage periods). In addition, Klarna may be legally obliged to continue to store your data. Such obligations may arise from anti-money laundering laws, accounting and tax laws, and consumer protection rules.
e) Withdrawal pursuant to Article 7 of the GDPR
You may withdraw your consent to data processing at any time in accordance with Article 7 of the GDPR. Please contact us at [email protected] or Klarna directly at [email protected]. The withdrawal does not affect the lawfulness of the processing carried out on the basis of the consent until then. In the event of revocation, your personal data will no longer be processed and will be deleted, unless you have expressly consented to further use of your data or we reserve the right to further use data that is legally permitted and about which we inform you in this statement.
f) Right to object and erasure Art. 21 GDPR
You may object at any time to Klarna's processing of your personal data for fraud prevention purposes, unless there are compelling legitimate grounds for the processing. Please contact [email protected].
6. Use of PayPal as a payment method
a) Description and scope of data processing
If, in connection with a payment process on our website, you choose to pay with the online payment service PayPal, your personal data, such as first and last name, address, email address, IP address, telephone number, information about goods/services, historical information, information about your previous purchases, payment history, any rejections, financial information, information about payment notes, device information, and geographic information will be transferred to PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.
Your personal data may also be disclosed by PayPal to service providers, subcontractors, or other affiliated companies to the extent necessary to fulfill the contractual obligations related to your order or if the personal data is to be processed on your behalf.
You can find an overview of these third parties at the following link: https://www.paypal.com/es/legalhub/paypal/home?country.x=ES&locale.x=en_ES.
b) Legal basis for data processing
Payment processing for the fulfillment of contractual obligations is carried out in accordance with Art. 6 (1) (b) GDPR. The additional data collected is processed in accordance with Art. 6 (1) (f) GDPR.
c) Purpose of data processing
The processing of your personal data is necessary to process your order using your chosen payment method, in particular to verify your identity and manage your payment.
Depending on the payment method you choose with PayPal, your personal data will be processed by credit agencies for the purpose of identity and credit checks. Information about which credit agencies are involved, what data PayPal generally processes, and further information about the purpose and scope of data processing can be found in PayPal's privacy policy at the following link: https://www.paypal.com/uk/legalhub/paypal/privacy-full.
d) Retention period
If you close your PayPal account, PayPal will mark it as closed. However, your account information will not be deleted. PayPal does this to prevent fraudulent activity.In this case, PayPal will not use your personal data for other purposes, and your personal data will not be sold or disclosed to third parties unless PayPal can thereby prevent fraudulent activities or the company is legally obliged to do so.
e) Right to object and erasure under Article 21 of the GDPR
You may object to the processing of your personal data by PayPal at any time by following the instructions provided in the "Your Privacy Settings" section of your PayPal account.
7. Use of credit cards as a payment method
a) Description and scope of data processingIf you choose to pay by credit card during a payment process on our website, we will process your first and last name, card type (VISA, Master Card, or American Express), credit card number, its expiration date, and card verification number. The amount to be paid and the date and time of the payment will also be processed.
In order to accept and execute the payment, this data is forwarded to our bank, depending on the type of payment. In order to authorise the payment, the data is also forwarded to the respective payment card system. Depending on the type of card you use for payment, this may result in the processed data being transferred to a third country.
Information about the processing of your data by the payment card system can be found at the following links:
Mastercard Europe SA, Chaussée de Tervuren 198A, 1410 Waterloo, Belgium, for "Mastercard": https://www.mastercard.com/global/en/privacy-notice.html
Visa Europe Management Services Limited, German Branch, Neue Mainzer Strasse 66-68, 60311 Frankfurt for "Visa": https://www.visa.com/en-us/legal/privacy-policy https://www.visa.co.uk/legal/global-privacy-notice.html
American Express Europe S.A. (Germany branch), Theodor-Heuss-Allee 112, 60486, Frankfurt am Main, for American Express: https://www.americanexpress.com/en-gb/company/legal/privacy-centre/online-privacy-statement/
b) Legal basis for data processing
The legal basis for data processing in connection with payment processing is the fulfillment of contractual obligations pursuant to Article 6(1)(b) of the GDPR.
c) Purpose of data processing
The processing of your personal data is necessary to process your order using your chosen payment method, in particular to verify your identity and manage your payment.
d) Storage period
The data we process is only stored for as long as is necessary to fulfill the contract entered into with you. This is usually the case after the expiry of the limitation period, which begins at the end of the year in which the order was placed. After the limitation period has expired, your data will be blocked and deleted after the expiry of the statutory retention obligations (see VII. Storage periods).
8. Use of giropay as a payment method
a) Description and scope of data processing
If you choose to pay with giropay during a payment process on our website, we will transfer your first and last name, your IBAN number, and the BIC code to paydirekt GmbH, Stephanstr. 14-16, 60313 Frankfurt am Main, Germany. Paydirekt GmbH collects this data on behalf of your bank in order to initiate the payment with your bank. Paydirekt GmbH then informs us on behalf of your bank about the initiated payment using a so-called giropay ID. This is a transaction number that allows your payment to be assigned within the payment procedure. Paydirekt GmbH does not collect any other transaction data.
Further information on data processing by paydirekt GmbH can be found at the following link: https://www.girocard.eu/datenschutz/.
b) Legal basis for data processing
The use of giropay and the associated data processing is based on your consent in accordance with Art. 6 (1) (a) GDPR. The legal basis for data processing in connection with payment processing is the fulfillment of contractual obligations pursuant to Art. 6 (1) (b) GDPR.
c) Purpose of data processing
The processing of your personal data is necessary to process your order using your chosen payment method, in particular to verify your identity and manage your payment.
d )Storage period
The data we process is only stored for as long as is necessary to fulfill the contract concluded with you. This is usually the case after the expiry of the limitation period, which begins at the end of the year in which the order was placed. After the limitation period has expired, your data will be blocked and deleted after the expiry of the statutory retention obligations (see VII. Storage periods).
e) Revocation pursuant to Art. 7 GDPR
You may revoke your consent to data processing in accordance with Art. 7 GDPR at any time. Please contact us at [email protected]. The revocation does not affect the legality of the processing carried out on the basis of the consent until then. In the event of revocation, your personal data will no longer be processed and will be deleted, unless you have expressly consented to further use of your data or we reserve the right to further use data that is legally permissible and about which we inform you in this declaration.
9. Use of prepayment as a payment method
a) Description and scope of data processing
If you choose to pay by prepayment during the payment process on our website, we will process your first and last name and your email address in order to send you information about the bank transfer by email after you have placed your order. After receiving the payment, we will process your account information.
b) Legal basis for data processing
The use of the prepayment option and the associated data processing is based on your consent in accordance with Art. 6 (1) (a) GDPR. The legal basis for data processing in connection with payment processing is the fulfillment of contractual obligations pursuant to Art. 6 (1) (b) GDPR.
c) Purpose of data processingThe processing of your personal data is necessary to process your order using your chosen payment method, in particular to verify your identity and manage your payment.
d) Storage period
The data we process is only stored for as long as is necessary to fulfill the contract concluded with you. This is usually the case after the expiry of the limitation period, which begins at the end of the year in which the order was placed. After the limitation period has expired, your data will be blocked and deleted after the expiry of the statutory retention obligations (see VII. Storage periods).
e) Revocation pursuant to Art. 7 GDPR
You may revoke your consent to data processing in accordance with Article 7 of the GDPR at any time. Please contact us at [email protected]. The revocation does not affect the legality of the processing carried out on the basis of the consent until then. In the event of revocation, your personal data will no longer be processed and will be deleted, unless you have expressly consented to further use of your data or we reserve the right to further use data that is legally permissible and about which we inform you in this declaration.
10. Amazon Marketplace
We offer you the opportunity to purchase our products via Amazon Marketplace. The processing of personal data in this context (your first and last name, billing and delivery address, details of the purchased product, payment method) is carried out by the companies belonging to Amazon Europe, which are responsible to you.
Further information about Amazon's processing of your personal data can be found at: https://www.amazon.es/gp/help/customer/display.html?nodeId=GX7NJQ4ZB8MHFRNJ&language=en_GB
11. Sending review reminders via email
a) Description and scope of data processingIf you have given your consent during or after your order, we will pass on your email address to Trusted Shops GmbH, Subbelrather Str. 15c, 50823 Cologne, Germany (https://www.trustedshops.eu/), so that they can send you a review reminder by email.
b) Legal basis for data processing
Data processing is based on your consent in accordance with Art. 6 (1) (a) GDPR.
c) Purpose of data processing
The purpose of sharing your email address is to increase awareness of our online store through as many reviews as possible and thus attract new customers.
d) Storage period
The data we pass on is only stored for as long as necessary. It is deleted immediately after you have submitted your review.
e) Revocation in accordance with Article 7 of the GDPR
This consent can be revoked at any time by sending a message to [email protected] or directly to Trusted Shops. The revocation does not affect the legality of the processing carried out on the basis of the consent until then. In the event of revocation, your personal data will no longer be processed and will be deleted, unless you have expressly consented to further use of your data or we reserve the right to further use data that is lawful and about which we inform you in this declaration.
12. Coupons and special offers
a) Description and scope of data processing
As an existing customer on our platform, we offer you the opportunity to take advantage of coupon offers from Sovendus GmbH, Hermann-Veit-Str. 6, 76135 Karlsruhe, Germany (Sovendus). To prepare the coupons, we transfer the following data to Sovendus:
Your IP address
Hash value of your email address (pseudonymized and encrypted)
Order number (pseudonymized)
Order value including currency (pseudonymized)
Session ID
Coupon code
Timestamp
If you are interested in a coupon offer from Sovendus, have not objected to advertising being sent to your email address, and click on the coupon banner displayed, we will transfer the following data to Sovendus in encrypted form for the purpose of preparing the coupon:
Form of address
First name
Postal code
Country
Email
Sovendus processes the data we transfer as an independent responsible body. Further information about Sovendus' processing of your data can be found in the online data protection declaration at https://web.sovendus.com/privacy.
b) Legal basis for data processing
Data processing is based on your consent in accordance with Art. 6 (1) (a) GDPR.
c) Purpose of data processing
Data processing in connection with the provision of vouchers serves to retain existing customers on our platform and to acquire new customers. The pseudonymized hash value of the email address is used to take into account any objection to advertising. Your IP address is used exclusively for data security purposes. In addition, we transfer pseudonymized order numbers, order value with currency, session ID, coupon code, and timestamp to Sovendus for billing purposes.
d) Storage period
The data we transfer is only stored for as long as necessary. The IP address is anonymized by Sovendus after seven days. The data transferred for billing purposes is stored by Sovendus in accordance with the statutory retention periods, i.e. for a maximum of five years. If a voucher has been requested, Sovendus will store the title, name, and email address until Sovendus receives your objection to the processing of your data for advertising purposes.
e) Revocation of consent pursuant to Article 7 of the GDPR
You can revoke your consent to the processing of your data in accordance with Art. 7 GDPR at any time. You can do this by deleting the previously set cookie via the cookie consent tool or in your browser settings. This does not affect the legality of the processing carried out on the basis of the consent until then. In the event of revocation, your personal data will no longer be processed and will be deleted or blocked.
13. Note for existing customers
a) Description and scope of data processing
When you, as a customer on our platform, have purchased goods, we will send you information about similar goods by email. To send the information, we process the following data:
Form of address
First name and last name
Email
b) Legal basis for data processing
Data processing is based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR / Article 21(2) of the LSSI-CE.
c) Purpose of data processing
Data processing in connection with sending information about similar products serves to retain existing customers on our platform. This is also our legitimate interest.
d) Retention period
Personal data will be deleted when it is no longer necessary for the purpose for which it was collected, because you have objected to receiving such emails. Your first and last name and your email address will be deleted immediately.
e) Objection pursuant to Article 21 of the GDPR and right to object pursuant to Section 7(3) of the UWG
You may object at any time to the processing of your personal data for the purpose of sending information about similar goods by email without incurring any costs other than the applicable transmission costs according to the order prices. To do so, please contact [email protected] by email or Roast Market GmbH, Stephanstraße 1-3, 60313 Frankfurt am Main, Germany by post.
14. Postal advertising
a) Description and scope of data processing
When you, as a customer on our platform, have purchased goods or services or participated in our free bonus program "roastmarket Coffee Club," we will send you information about our wide range of goods and services, including coupons and special offers.
To prepare and send the advertising, we process the following data:
Form of address
First name and last name
Street and house number
Postal code and city
The optilyz application, a service provided by optilyz GmbH, Neue Schönhauser Str. 19, 10178 Berlin, Germany is used to prepare and send postal advertising. To ensure an adequate level of data protection, we have entered into a data processing agreement with this service provider.
b) Legal basis for data processing
Data processing is based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR.
c) Purpose of data processing
Data processing in connection with the sending of coupons and special offers serves to retain existing customers on our platform and to attract new customers. This is also our legitimate interest.
d) Storage period
We store the above data for the purpose of sending advertising until you object to receiving advertising by post.
e) Objection pursuant to Art. 21 of the GDPR
You can object to the processing of your personal data for direct marketing purposes at any time. To do so, please contact us by email at [email protected] or by post at Roast Market GmbH, Stephanstraße 1-3, 60313 Frankfurt am Main, Germany. Objecting to receiving direct marketing by mail does not affect your participation in the "roastmarket Coffee Club" bonus program.
15. Email newsletter
a) Description and scope of data processing
On our website, we offer you the opportunity to subscribe to our free newsletter. In order for us to send it to you, we need your email address when you register. In addition, we process your IP address, the date and time of your registration. No further data is processed. During the registration process, your consent to the processing of your personal data is obtained and reference is made to this data protection declaration.
We use the so-called double opt-in procedure for registration. After registering, you will receive an email with a confirmation link that you must click on to complete your registration.
If you purchase goods or services on our website or participate in our free bonus program "roastmarket Coffee Club" and provide your email address in this context, we may process this data for the purpose of sending you a newsletter. In such cases, the newsletter will only contain direct advertising for our own similar goods or services. We use a service provider to prepare and send the email newsletter. To ensure an adequate level of data protection, we have entered into a data processing agreement with this service provider.
b) Legal basis for data processing
The legal basis for the processing of your personal data after subscribing to the newsletter is your consent in accordance with Art. 6 (1) sentence 1 lit. a GDPR. The processing of your IP address, the date and time of your subscription is based on Art. 6 (1) lit. f GDPR. The sending of the newsletter as a result of the sale of goods or services or participation in our free bonus program "roastmarket Coffee Club" is carried out in accordance with Article 21.2 of the LSSI-CE (Law on Information Society Services).
c) Purpose of data processing
The processing of your email address serves to send you the newsletter. We check the email address you have provided to ensure that you are the actual owner or that the owner of the email address has consented to receiving the newsletter. We process your IP address and the date and time of your registration for security reasons, in case a third party registers on our website without your knowledge or misuses your personal data. This is also our legitimate interest. If you receive the newsletter after purchasing goods or services on our website or participating in our free bonus program "roastmarket Coffee Club," we will send it to you for commercial purposes to inform you about our wide range of goods and services.
d) Storage period
Personal data is deleted when it is no longer necessary for the purpose for which it was collected, because you have unsubscribed. Your email address is deleted immediately, while the other data collected during registration, such as your IP address and the date and time of your registration, is usually deleted after 30 days.
e) Revocation pursuant to Art. 7 GDPR
You can revoke your consent to the processing of your data, its use for sending the newsletter, and the subscription to this newsletter itself at any time in accordance with Art. 7 GDPR. If you no longer wish to receive our newsletter, you can unsubscribe at any time by clicking on the unsubscribe link in each mailing or via your customer account. In addition, you can notify us of your wish to unsubscribe at any time in text form at or by emailing [email protected]. This does not affect the legality of the processing carried out on the basis of your consent up to that point. In the event of revocation, your personal data will no longer be processed and will be deleted or blocked. Revocation of your consent has no influence on your participation in the "roastmarket Coffee Club" bonus program.
f) Right to object and erasure pursuant to Art. 21 GDPR
Objection to the processing of your IP address and the date and time of your registration is excluded, as this is done to prevent misuse.
16. Conducting the prize draw
a) Description and scope of data processing
On our website, we occasionally offer you the opportunity to participate in a prize draw. To conduct the prize draw and contact the winner, we process the personal data of the participants, in particular their email address and, at the relevant time, the winner's address. The information is not passed on to third parties.
b) Legal basis for data processing
The legal basis for the processing of your personal data for the purpose of conducting the prize draw and contacting the winner is Article 6(1)(b) of the GDPR.
c) Purpose of data processing
We need the above data to register participants, notify the winner, and deliver the prize. This data is necessary for the conclusion of the contract, i.e., participation in the prize draw, insofar as the information in our registration form is mandatory (rather than voluntary). The winner's address, which is collected subsequently, is necessary for the delivery of the prize.
d) Storage period
For the purpose of conducting the prize draw, we store the participants' personal data until the prize draw has been completed and the winner has been notified, plus a reasonable storage period in case the prize has to be redrawn among the other participants if the winner does not respond. We also store the winner's personal data – including the winner's address, which is collected at the relevant time – for the purpose of further processing the delivery of the prize. After the end of the competition, i.e. when the winner has received the prize, all participants' personal data, with the exception of their specified email address, will be deleted immediately.
e) Disclosure of email address
The email address provided for participation in the prize draw will be further processed for the purpose of receiving and sending the newsletter, as described in section 7.
17. Newsletter tracking using Emarsys Webextend
a) Description and scope of data processing
We use cookies/pixel tags from Webextend to create newsletters that are tailored to you and your interests. For this purpose, we use existing information, such as email receipt and read confirmations, information about your computer and internet connection, operating system and platform, your browser history, the date and time of your visit to the website, and products/articles you have viewed. We use this information primarily in pseudonymized form, but also, where relevant, to send you newsletters that match your areas of interest.
b) Legal basis for data processing
The legal basis for data processing is Article 6(1)(a) of the GDPR.
c) Purpose of data processing
The cookie/pixel tag enables us to see when an email has been opened and which link the recipient has followed. We use this information to continuously improve our newsletters and tailor them to your personal preferences and needs.
d) Storage period
The data stored in connection with this tracking is deleted as soon as the purpose has been fulfilled, e.g. when you unsubscribe from the newsletter.
e9 Revocation pursuant to Art. 7 GDPR
You can revoke your consent to the processing of your data at any time in accordance with Art. 7 GDPR. You can do this by deleting the previously set cookie via the cookie consent tool or in your browser settings. This does not affect the legality of the processing carried out on the basis of the consent until then. In the event of revocation, your personal data will no longer be processed and will be deleted or blocked.
18. Use of parcelLab
a) Description and scope of data processingWe use the parcelLab service from the logistics provider parcelLab GmbH, Kapellenweg 6, 81371 Munich, Germany ("parcelLab") to send you shipping notifications for your orders. In this context, the order information you have provided, including the shipping number, your first and last name, your address, and your email address, is transferred to parcelLab. Here, parcelLab evaluates the click and opening behavior in connection with email messages.
b) Legal basis for data processing
The legal basis for the use of parcelLab is your consent in accordance with Article 6(1)(a) of the GDPR.
c) Purpose of data processing
We send you shipping notifications so that you have an overview of when you will receive your order.
d) Storage periodYour personal data is automatically and continuously deleted after 90 days.
e) Revocation pursuant to Article 7 of the GDPR
You can revoke your consent to data processing at any time in accordance with Art. 7 of the GDPR. Please contact: [email protected]. The revocation does not affect the legality of the processing carried out on the basis of the consent until then.
19. Termination of subscription agreements via the "Terminate agreements" button
a) Description and scope of data processing
On our website, we offer you the option of terminating subscription agreements for the delivery of goods via the "Terminate agreements here" button. For this purpose, the information you have entered in the input mask on the subsequent confirmation page is collected and processed.
The following data is collected at the time of your entry (entry-related data):
Your first and last name
Your email address
Your customer number
The number of your subscription agreement/order number
Any date on which the termination is to end the contractual relationship
Additional information that you have entered in the input mask
When you click on the confirmation button, your termination will be submitted and sent to us. At the time of sending your termination, the following data (technical data) will also be processed:
Your IP address
Date and time of submission of your entry or declaration of termination
Date and time of receipt of the termination
Once you have submitted your cancellation by clicking on the confirmation button, you will receive an email from us to the email address you provided. In the email, we will confirm the content of your entry, the date and time of receipt of your notice of termination, and the date on which the contractual relationship will end as a result of the termination.
b) Legal basis for data processing
The legal basis for the processing of the data entered is Article 6(1)(b) of the GDPR. The legal basis for the processing of technical data is Article 6(1)(f) of the GDPR.
c) Purpose of data processing
We only process your personal data for the purpose of processing your termination.The processing of your IP address and the date and time of your entry during the submission process is carried out to protect us in the event that the contact options provided are misused or our IT systems are adversely affected by the contact. We do not collect any further data.
In addition, the date and time of submission of your termination and its receipt are processed for the purpose of processing and checking your termination.These purposes also constitute our legitimate interest in the processing of your personal (technical) data.
d) Retention period
We delete your personal data when it is no longer necessary for the purpose of processing. This is usually the case after the expiry of the limitation period, which begins at the end of the year in which the contractual relationship ends due to valid termination. After the limitation period has expired, your data will be blocked and deleted after the expiry of the statutory retention obligations (see VII. Storage periods). The IP address, which is further processed during the dispatch process, will be deleted after a period of 30 days.
e) Right to object and erasure pursuant to Article 7 of the GDPR
It is not possible to object to the processing of technical data, as the processing of this data is necessary to document the time of termination and to prevent misuse.
20. Use of external repair service
a) Description and scope of data processing
If it is necessary to have your purchased item (e.g., coffee machine) serviced and/or repaired, we will send it to one of our contractual partners who acts as an external repair service, if necessary. In this context, we disclose the following personal data to our contractual partner:
Your first and last name
Address details (street, house number, postal code, city)
Phone
b) Legal basis for data processing
The disclosure of personal data is carried out for the purpose of implementing the underlying maintenance and repair agreement on the basis of Article 6(1)(b) of the GDPR.
c) Purpose of data processing
The purpose of data processing is to perform maintenance or repair of the goods you have purchased (e.g., coffee machine) through the external repair service.
d) Storage period
We will delete your personal data when it is no longer necessary for the purpose of processing. This is usually the case after the expiry of the limitation period, which begins at the end of the year in which the maintenance or repair was carried out. After the limitation period has expired, your data will be blocked and deleted after the expiry of the statutory retention obligations (see VII. Storage periods).
21. Coffee Club PLUS membership
a) Description and scope of data processing
We offer you the opportunity to take out a paid membership of our "roastmarket Coffee Club PLUS". In this context, you will receive various benefits that result from the applicable conditions of participation for roastmarket Coffee Club PLUS. In this context, we process your personal data, which we already process in connection with your account opening and order processing, now for a different purpose, namely for the implementation of your membership and your services within the framework of roastmarket Coffee Club PLUS. This concerns your information:
Form of address
First name and last name
Street and house number
Postal code and city
Email
Purchase and order information (type and number of products purchased, price, time and date of purchase)
b) Legal basis for data processing
We process your personal data on the basis of the contractual relationship referred to in Article 6(1)(b) of the GDPR, which forms the basis of the bonus program.
c) Purpose of data processing
The processing of personal data serves to administer your membership of roastmarket Coffee Club PLUS and to provide the services to which you are entitled under the applicable terms and conditions of participation in roastmarket Coffee Club PLUS.
d) Retention period
We will delete your personal data when it is no longer necessary for the purpose of processing. This is usually the case after the expiry of the limitation period, which begins at the end of the year in which the contractual relationship ends, e.g. when you unsubscribe from the bonus program on your customer account. After the limitation period has expired, your data will be blocked and deleted after the expiry of the statutory retention obligations (see VII. Storage periods).
22. Data protection information for personalized advertising offers
a) Description and scope of data processing
We offer you the option of personalized advertising on our platform. For this purpose, you can voluntarily store the following data in your customer account:
Your favorite coffee
Your Coffee Corner setup (your coffee machine and coffee grinder)
Your coffee preferences (e.g., aroma profile and price categories)
If you also provide your date of birth, we will send you a coupon on your birthday.You will receive the personalized offer by email, so we also process your name and the email address associated with your customer account.
b) Legal basis for data processing
Data processing is based on your consent in accordance with Article 6(1)(a) of the GDPR.
c) Purpose of data processing
The data processing serves to send you advertising tailored to your individual needs and wishes. In this way, we want to give you the opportunity to receive only advertising that interests you, in particular product recommendations tailored to you.
d) Storage period
The personal data will be deleted when it is no longer necessary for the purpose for which it was collected. This is the case if you no longer wish to receive personalized advertising and have therefore revoked your consent or deleted your customer account. The information you have stored for personalized advertising is usually deleted 30 days after the revocation of your consent or the deletion of your customer account.
e) Withdrawal of consent pursuant to Article 7 of the GDPR
You may revoke your consent to data processing at any time in accordance with Art. 7 GDPR. Please contact us at [email protected]. The revocation does not affect the legality of the processing carried out on the basis of the consent until then. In the event of revocation, your personal data will no longer be processed and will be deleted, unless you have expressly consented to further use of your data or we reserve the right to further use data that is legally permissible and about which we inform you in this declaration.
23. WhatsApp newsletter
We use the WhatsApp solution from https://chatarmin.com/en for customer communication, to send current information and offers, and for customer support, provided that you give us your consent in accordance with Art. 6 (1) (a) GDPR. Consent is given via the chat by selecting the "START" button. This consent can be revoked at any time by typing "STOP" in the chat.In this context, we process the following personal data: phone number, WhatsApp profile name, and communication and click behavior in the chat. https://chatarmin.com/en is a communication tool from the company chatarmin.com GmbH, based in Vienna, which is based on the WhatsApp API. An API is an interface. A contract has been concluded with chatarmin.com GmbH for order processing in accordance with Art. 28 of the GDPR.In this context, your phone number is also transferred to WhatsApp Ireland Limited and other companies affiliated with WhatsApp in third countries. These are currently located primarily in the USA. A new adequacy decision, the so-called Data Privacy Framework, has been in force for the USA since July 2023.We store your data until you revoke your consent. After revoking your consent, your data will no longer be used to send information via WhatsApp and will be anonymized.
24. WhatsApp delivery tracking
a) Description and scope of data processing
With shipment tracking, you can track shipments addressed to you or sent by you and see the expected delivery time. In order to perform shipment tracking via WhatsApp, it is necessary to provide your phone number associated with WhatsApp. The following data is processed in connection with shipment tracking: Shipment number, name and address of the sender, name and address of the recipient, email address of the sender/recipient (if applicable), name and address of the substitute recipient (if applicable), customer data of the sender, product or service description, shipment history, recipient's signature.
The WhatsApp messages are sent via the chat service provided by https://chatarmin.com/en GmbH (hereinafter referred to as chatarmin). A contract has been concluded with chatarmin for order processing in accordance with Art. 28 of the GDPR. In this context, your phone number is also passed on to WhatsApp Ireland Limited and other companies affiliated with WhatsApp in third countries. These are currently located primarily in the USA. A new adequacy decision, the so-called Data Privacy Framework, has been in force for the USA since July 2023.
b) Legal basis for data processing
The processing of the data is based on your consent in accordance with Article 6(1)(a) of the GDPR.
c) Purpose of data processing
The purpose of data processing is the optional tracking of shipment status via WhatsApp.
d) Storage period
We delete your personal data when it is no longer necessary to fulfill the purpose of the processing. This is usually the case after the expiry of the limitation period, which begins at the end of the year in which the order was placed. After the expiry of the limitation period, your data will be blocked and deleted after the expiry of the statutory retention obligations (see VII. Storage periods).
e) Revocation pursuant to Art. 7 GDPR
You may revoke your consent to the processing of your personal data at any time in accordance with Article 7 of the GDPR. You can do this by sending a message to [email protected]. The revocation does not affect the legality of the processing carried out on the basis of the consent until then. In the event of revocation, your personal data will no longer be processed and will be deleted, unless you have expressly consented to further use of your data or we reserve the right to further use data that is lawful and about which we inform you in this statement.
25. Use of a Discount System (VCHFY)
a) Description and scope of data processing
On our website, we integrate a discount and deal management system provided by VCHFY GmbH in order to display vouchers and sales promotions within our online shop. The processing particularly includes information relating to orders and shopping carts (e.g. order number, item values and order values) as well as, depending on the situation, technical access data such as the IP address.
b) Legal basis for data processing
The processing is carried out on the basis of Art. 6(1)(b) GDPR, as it is necessary for the initiation, performance and handling of purchase contracts. The display of discounts serves to determine the specific purchase conditions and is therefore directly necessary for the performance of the contract within the online shop.
c) Purpose of data processing
The purpose of the processing is to determine and display dynamic discounts as well as to technically manage discount vouchers and promotional content within the online purchasing process. This is intended to enable the conclusion and performance of purchase contracts.
d) Storage period
The personal data processed in connection with the discount system will be deleted after 24 hours as soon as it is no longer required for the aforementioned purposes. No further storage will take place.
26. Use of Geographic Shop Allocation
a) Description and scope of data processing
On our website, we use a function for geographic shop allocation. This function is intended to display the version of our online shop designated for your country or region. For this purpose, we use technically necessary cookies to store the shop or country version you selected. In addition, we use another cookie to store the fact that the notice window relating to country or shop selection has already been shown to you and should therefore not be displayed again.
b) Legal basis for data processing
The storage of information and access to information already stored on your device are carried out in accordance with the applicable rules on information society services, in particular Article 22.2 of the LSSI, insofar as such cookies are technically necessary to provide the website functionalities requested by the user. To the extent that personal data is processed in this context, such processing is based on Article 6(1)(f) GDPR.
c) Purpose of data processing
The purpose of the data processing is to provide the relevant shop version and to store your selection. In addition, the processing serves to make our website more user-friendly by ensuring that a notice window regarding shop or country selection that has already been displayed is not shown again. This also constitutes our legitimate interest.
d) Storage period
The cookies used in this context are stored for a period of 30 days and are then automatically deleted.
e) Right to object and right of removal pursuant to Art. 21 GDPR
You may prevent the storage of cookies at any time by adjusting your browser settings accordingly or delete cookies that have already been stored. In this case, however, it may not be possible to save your shop or country selection, and the notice window relating to shop selection may be displayed again when you visit our website in the future. You may also object at any time, on grounds relating to your particular situation, to the processing of personal data based on Art. 6(1), first sentence, lit. f GDPR in accordance with Art. 21 GDPR.
III. Data processing on the website
If you visit our website for informational purposes without registering on the platform, your personal data will be processed as follows.
1.Processing of your data when you visit our website
a) Description and scope of data processing
We process your personal data to give you access to our website. This includes all information that you enter manually, as well as technical information necessary for communication between your device and our applications. Every time you visit our website, usage data is transferred via the respective internet browser and stored in so-called server log files. The data stored in this case contains the following information:
Your IP address
Information about your browser
Date and time of the call
Information about your browser
All data collected in connection with the use of this website is processed on the servers of a service provider specializing in hosting services. This service provider is located in a country in the European Union or the European Economic Area.
b) Legal basis for data processing
The processing of the above data is based on Article 6(1)(f) of the GDPR.
c) Purpose of data processing
We use the protocol information and log files exclusively for statistical analysis for the purpose of operating, securing, and optimizing our offerings. This is also our legitimate interest.
d) Duration of data processing
We delete your personal data when it is no longer necessary for the purpose of processing. All server log files are deleted no later than 30 days after the end of your visit to the site.
e) Right to object and erasure pursuant to Article 21 of the GDPR
There is no possibility to object to this data processing, as the processing of the data is absolutely necessary in order to make the website available.
2. Integration of Trusted Shops Trustbadge
a) Description and scope of data processing
In order to display our Trusted Shops seal of approval and the reviews collected, and to offer Trusted Shops products to buyers after placing an order, the Trusted Shops Trustbadge is integrated into this website. The Trustbadge and the services advertised with it are an offer from Trusted Shops GmbH, Subbelrather Str. 15C, 50823 Cologne, Germany.
When the Trustbadge is opened, the web server automatically saves a so-called server log file, which contains, for example, your IP address, the date and time of the access, the amount of data transferred and the requesting provider (access data) and documents the access. This access data is not evaluated.
Additional personal data is only transferred to Trusted Shops if you have given your consent, if you decide to use Trusted Shops products after completing an order, or if you have already registered to use them. In this case, the contractual agreement between you and Trusted Shops applies.
b) Legal basis for data processing
The processing of the above data is based on Article 6(1)(f) of the GDPR .
c) Purpose of data processing
Data processing serves to optimally market our offerings , which is also our legitimate interest.
d) Duration of data processing
We will delete your personal data when it is no longer necessary for the purpose of processing. Your data will be automatically overwritten no later than seven days after the end of your visit to the site.
e) Right to object and erasure pursuant to Article 21 of the GDPR
You can object to data processing at any time in accordance with Art. 21 GDPR. Please contact: [email protected].
3. Cookies (general)
We use cookies and similar technologies that are necessary for the operation of the website. The use of essential cookies ensures that you can use the website without any problems. Essential cookies are used on the basis of our legitimate interest, Art. 6 (1) (f) GDPR.In addition, we use non-essential cookies that are placed by us or third-party providers. Such non-essential cookies are only used with your consent pursuant to Art. 6 (1) (a) GDPR, as they are not strictly necessary for the provision of the website. For example, we use non-essential cookies to access information such as the characteristics of your device and certain personal data (IP address, usage behavior), analyze and store this information. The use of non-essential cookies relates in particular to marketing and analysis cookies, which enable us to understand user behavior in order to offer you a relevant user experience or to personalize the content of our website.
The legal basis for the use of cookies that are not technically necessary is Article 22(2) of Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE), in conjunction with Article 6(1)(a) of the GDPR.
You can withdraw your consent to data processing using non-essential cookies at any time by changing your preferences in the cookie settings in the consent tool we use, CCM19 (see section 4 below), and rejecting non-essential cookies. Please note that the revocation is only valid for us, so you may still be tracked by other websites that use the services listed below.Below is a list of data processing related to the use of non-essential cookies.
4. Consent management
a) Description and scope of data processing
We use the consent management service "CCM19" from Papoo Software & Media GmbH, Auguststr. 4, 53229 Bonn, on our website.In this context, the following personal data is stored: Consent data (consent ID, time of consent, opt-in or opt-out, banner language, customer settings in banner – consent data, template); device data (HTTP agent, HTTP referrer, HTTP page); anonymized IP data, IP address in 24-hour rollover in log files; when using extended statistics or other statistical plugins: browser data.We have entered into a data processing agreement with the provider.
b) Legal basis for data processing
The processing of the above data is based on Art. 22.2 of the LSSI-CE / Art. 6(1)(c) of the GDPR.
c) Purpose of data processing
The purpose of data processing is to enable visitors to our website to give or refuse consent to the use of cookies, to document this consent in accordance with the accountability requirement in Art. 5 (2) of the GDPR, to ensure the revocation of consent, and to control the placement of cookies.
d) Duration of data processing
We delete your personal data when it is no longer necessary for the purpose of the processing. This is after three years, calculated from the end of the year in which the data was collected.
e) Withdrawal pursuant to Article 7 of the GDPR
You may withdraw your consent to the processing of your data at any time in accordance with Article 7 of the GDPR. You can do this by deleting the previously set cookie via the cookie consent tool or in your browser settings. This does not affect the lawfulness of the processing carried out on the basis of the consent until then. In the event of revocation, your personal data will no longer be processed and will be deleted or blocked.You can change your cookie settings at any time by clicking on the following button: https://www.roastmarket.com/en-us?cmpscreen=
5. Google Analytics and Tag Manager
a) Description and scope of data processing
Our website uses Google Analytics 4 (GA4) and Google Tag Manager. These are web analytics services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").
We use GA4 – provided you have given your consent – to analyze your use of the website, whereby information about your usage behavior is collected and aggregated pseudonymously. IP addresses are not stored by GA4; access by EU users is via European servers from Google, where the IP address is used only for rough localisation and then immediately deleted. Other personal characteristics (e.g. exact location or device data) are also only recorded to a limited extent by GA4 as standard. GA4 identifies returning visitors to the website primarily via a randomly generated client ID that is stored in a first-party cookie on your device. This cookie ("_ga" with property ID) has a lifetime of 2 years.
Google Tag Manager is used to integrate GA4 and other tags into our website. It does not create usage profiles itself and does not store data, but triggers the data transfer to the respective integrated services (such as GA4).
The data collected via GA4 (e.g., pseudonymous cookie ID, information about your browser, device type, approximate city location, and your usage behavior on our website) is pseudonymized and forwarded to Google's servers in the United States. Google uses this information on our behalf to evaluate your use of our website, compile reports on website activity, and provide us with additional services.
In this context, Google acts as our data processor, and we have entered into a data processing agreement with Google in accordance with Article 28 of the GDPR. Further information can be found at: https://policies.google.com/privacy?hl=en. A possible data transfer to the USA between Google and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, cannot be ruled out. This is secured through the EU-U.S. Data Privacy Framework.
b) Legal basis for data processing
The legal basis for data processing is your consent in accordance with Article 22.2 of the LSSI-CE / Article 6(1), first sentence, subparagraph (a) of the GDPR.
c) Purpose of data processing
The processing is carried out for the purpose of measuring the reach and analyzing user behavior on our website. This enables us to continuously optimize our website and our offerings and improve the user experience. If necessary, we also use the collected statistical data to evaluate and adapt the effectiveness of marketing measures.
d) Storage period
The user and event data relevant for evaluating website usage has a preset maximum storage period of 14 months and is deleted by us immediately when it is no longer needed. The _ga cookie, which recognizes your repeat visits, is stored on your device for a maximum of 2 years, unless you delete it manually before then. In addition, you can uninstall the cookies installed by Google Analytics yourself and thus delete the stored data. In the following section, we explain how you can delete these via your browser settings.
e) Revocation pursuant to Art. 7 GDPR
You can revoke your consent to data processing at any time in accordance with Art. 7 GDPR. To do so, you can change the tracking settings in our cookie consent tool or contact: [email protected]. The revocation does not affect the legality of the processing carried out on the basis of the consent until then. In the event of revocation, your personal data will no longer be processed and will be deleted.You can freely prevent the installation of cookies by changing the settings in your browser. For this purpose, Google offers a deactivation add-on for the most common browsers, which gives you more control over what data Google collects from the websites you visit. The add-on informs JavaScript (ga.js) from Google Analytics that no information about website visits should be transferred to Google Analytics. However, the deactivation add-on for browsers from Google Analytics does not prevent information from being transferred to us or to other web analytics services that we may use. Further information on installing the browser add-on can be found at the following link: https://tools.google.com/dlpage/gaoptout?hl=en.
6. Use of Google Ads
a) Description and scope of data processingOn our website, we use the online advertising service Google Ads and, in this context, use the analysis services "Conversion Tracking" and "Remarketing" from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").If you access our website via a Google ad, a conversion tracking cookie will be stored on your computer. If you visit certain subpages of our website, Google and we can see that you clicked on one of our ads and were redirected to that page.
In this context, Google acts as an independent data controller (https://business.safety.google/adscontrollerterms/?hl=en). A transfer to the U.S. to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, U.S., cannot be ruled out. This is protected by the EU-U.S. Privacy Shield Framework.
b) Legal basis for data processing
The legal basis for the use of Google Ads is Art. 22.2 of the LSSI-CE / Art. 6, paragraph 1, sentence 1, subparagraph (a) of the GDPR.
c) Purpose of data processing
The purpose of the processing is to ensure effective marketing.
d) Storage period
We delete your personal data when it is no longer necessary to fulfill the purpose. The cookies used by Google Ads have different storage periods, e.g., 30 days for conversion cookies (gcl_aw) and up to 13 months for advertising cookies (IDE, ANID) in the EU. You can find an overview at: https://business.safety.google/adscookies/.
e) Revocation pursuant to Art. 7 GDPR
You can revoke your consent to data processing at any time in accordance with Article 7 of the GDPR. You can change your tracking settings at https://www.roastmarket.com/en-us?cmpscreen= or contact: [email protected]. The revocation does not affect the legality of the processing carried out on the basis of the consent until then.You can prevent conversion cookies from being installed in your browser settings. You can generally disable the automatic setting of cookies or only block the acceptance of cookies from a specific domain. Further information on this can be found at https://support.google.com/google-ads/answer/32050?hl=en&sjid=17372847451057962680-EU. You can find Google's relevant privacy policy at https://policies.google.com/privacy?hl=en.
7. Google Ads Customer Match
a) Description and scope of data processing
We use the Customer Match feature from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). This feature allows us to show you interest-based advertising when you use Google services such as Google Search, YouTube, Gmail, or the Google Display Network.
For this purpose, we transfer your hashed email address to Google, provided that you have given your consent and entered your email address. Hashing is performed using a secure hashing method, e.g. SHA-256. Google uses this data exclusively to compare it with existing Google user accounts and to create target groups for advertising campaigns.
In this context, Google acts as our data processor, and we have entered into a data processing agreement with Google in accordance with Article 28 of the GDPR (https://business.safety.google/intl/en/adsprocessorterms/). A transfer to the USA to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, cannot be ruled out. This is secured through the EU-U.S. Data Privacy Framework.
Further information can be found in Google's privacy policy: https://policies.google.com/privacy.
b) Legal basis for data processing
The legal basis for the use of Google Customer Match is your consent, in accordance with Article 22.2 of the Law on Information Society Services (LSSI-CE) / Article 6, paragraph 1, sentence 1, subparagraph (a) of the GDPR.
c) Purpose of data processing
The purpose of the processing is to carry out personalized marketing measures and to target existing customers.
d) Duration of storage
We delete your personal data when it is no longer necessary to achieve the purpose. Google states that the uploaded data is only stored for as long as is necessary to compare and create target groups, and is then deleted. Customer Match lists have a maximum validity period of 540 days.
e) Revocation pursuant to Article 7 of the GDPR
You can revoke your consent to data processing at any time in accordance with Art. 7 of the GDPR. You can change your tracking settings at https://www.roastmarket.com/en-us?cmpscreen=or contact: [email protected]. The revocation does not affect the legality of the processing carried out on the basis of the consent until then.
8. Use of Criteo
a) Description and scope of data processing
On this website, information about the surfing behavior of website visitors is collected, stored, and evaluated in pseudonymized form using "cookie" text files using technology from Criteo SA, 32 Rue Blanche, 75009 Paris, France ("Criteo"). Criteo analyzes the surfing behavior using an algorithm and can then display targeted product recommendations as personalized advertising banners on other websites (so-called publishers). There is no other use or disclosure to third parties.
We transfer this data to Criteo as a joint controller with us. A joint controller agreement has been concluded in accordance with Article 26 of the GDPR. Both controllers are responsible for fulfilling the data protection obligations and support each other, in particular with regard to ensuring the rights of data subjects in accordance with Articles 12 ff. of the GDPR.Further information on Criteo's technology can be found in Criteo's data protection provisions: https://www.criteo.com/privacy/.
b) Legal basis for data processing
The legal basis for the use of Criteo is your consent in accordance with Article 22 of the LSSI-CE / Article 6(1), first sentence, subparagraph (a) of the GDPR.
c) Purpose of data processing
The purpose of the processing is to ensure effective marketing.
d) Storage period
We delete your personal data when it is no longer necessary for the purpose of processing. This is usually the case after 24 months. You can uninstall the installed cookies yourself and thus delete the stored data. In the following section, we explain how you can delete these via your browser settings.
e) Revocation pursuant to Art. 7 GDPR
You can revoke your consent to data processing in accordance with Art. 7 GDPR at any time. You can change your tracking settings at https://www.roastmarket.com/en-us?cmpscreen= or contact: [email protected]. The revocation does not affect the legality of the processing carried out on the basis of the consent until then.To prevent data collection and the creation of pseudonymized user profiles in the future, you can download the following opt-out cookie: "Criteo Austragung", see https://www.criteo.com/privacy/.
9. Use of Criteo Cross-Device Parameters
a) Description and scope of data processing
This website uses the cross-device parameter method from Criteo SA, 32 Rue Blanche, 75009 Paris, France ("Criteo"). If you have provided your email address and given your consent, we will transfer hash-encoded email addresses (using a secure hash method, e.g. SHA256) to Criteo in order to target personalized advertising to you on other websites. The hash value is used solely for comparison with existing Criteo user profiles. If Criteo does not already know your email address, no conclusions can be drawn about your identity.
We transfer this data to Criteo as a joint controller with us. A joint controller agreement has been concluded in accordance with Article 26 of the GDPR. Both controllers are responsible for fulfilling the data protection obligations and support each other, in particular with regard to protecting the rights of data subjects in accordance with Articles 12 et seq. of the GDPR.
Further information on Criteo's technology can be found in Criteo's data protection provisions: https://www.criteo.com/privacy/.
b) Legal basis for data processing
The legal basis for the use of Criteo is your consent in accordance with Article 25(1) of the Law on Information Society Services (LSSI-CE) and Article 6(1)(a) of the GDPR.
c) Purpose of data processing
The purpose of the processing is to carry out personalised marketing and to target existing customers.
d) Retention period
We delete your personal data when it is no longer necessary for the purpose of processing. Criteo states that hashed email addresses are deleted after no more than 90 days (https://help.criteo.com/kb/guide/en/the-criteo-privacy-promise-pDIW4yiawH/Steps/775742).
e) Withdrawal pursuant to Art. 7 GDPR
You may revoke your consent to data processing at any time in accordance with Art. 7 GDPR. You can change your tracking settings at https://www.roastmarket.de/enable-cookies or contact: [email protected]. The revocation does not affect the legality of the processing carried out on the basis of the consent until then.To prevent data collection and the creation of pseudonymized user profiles in the future, you can download the following opt-out cookie: "Criteo Austragung", see https://www.criteo.com/privacy/.
10. Use of Microsoft Advertising
a) Description and scope of data processing
This website uses the conversion tracking technology "Microsoft Advertising" from Microsoft Ireland Operations Limited, South County Business Park, Leopardstown, Dublin 18 D18 P521 ("Microsoft"). Microsoft Advertising places a cookie on your computer if you have reached our website via a Microsoft advertisement (e.g. on Bing, Yahoo! or DuckDuckGo). If the user visits certain pages on this website and the cookie has not yet expired, Microsoft and we can see that the user clicked on the ad and was redirected to this page (conversion page).
The information collected using the conversion cookie is used to generate conversion statistics, i.e., to record how many users reach a conversion page after clicking on an ad. This tells us how many users clicked on our ad and were redirected to a page with a conversion tracking tag. However, we do not receive any information that can personally identify users.
In this context, Microsoft acts as our data processor, and we have entered into a data processing agreement with Microsoft in accordance with Article 28 of the GDPR. Further information about Microsoft Advertising can be found at: https://www.microsoft.com/en-us/privacy/privacystatement. A possible data transfer to the USA between Microsoft and Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA, cannot be ruled out. This is secured through the EU-U.S. Data Privacy Framework.
b) Legal basis for data processing
The legal basis for Microsoft's use of your data is your consent in accordance with Article 22(2) of the LSSI-CE and Article 6(1), first sentence, letter a) of the GDPR.
c) Purpose of data processing
In this context, we process the relevant data for the purpose of effective marketing.
d) Storage period
We delete your personal data when it is no longer necessary for the purpose of processing. These cookies expire after a maximum of 400 days.
e) Revocation pursuant to Art. 7 of the GDPR
You can revoke your consent to data processing at any time in accordance with Art. 7 GDPR. You can change your tracking settings at https://www.roastmarket.de/enable- cookies or contact: [email protected]. The revocation does not affect the legality of the processing carried out on the basis of the consent until then.
You can prevent tracking by disabling the Microsoft Advertising Conversion Tracking cookie via your internet browser under user settings. You will then not be included in the conversion tracking statistics. Alternatively, you can use the EU consumer opt-out page https://www.youronlinechoices.com/uk/your-ad-choices to check whether Microsoft advertising cookies are set in your browser and to disable them.
11. Use of Microsoft Advertising – Microsoft List Upload
a) Description and scope of data processing
We use the Microsoft List Upload feature from Microsoft Ireland Operations Limited, South County Business Park, Leopardstown, Dublin 18 D18 P521 ("Microsoft") on our website. With this feature, provided you have given your consent and entered your email address, we transfer your hashed email address (using a secure hashing method, e.g. SHA-256) to Microsoft. Microsoft can compare the hashed email address with its own data to assign you to a target group and show you personalized advertising. This allows you to see interest-based advertising when you use services from the Microsoft Advertising Network (e.g., Bing).
In this context, Microsoft acts as our data processor, and we have entered into a data processing agreement with Microsoft in accordance with Article 28 of the GDPR. Further information can be found in Microsoft's privacy policy: https://www.microsoft.com/en-us/privacy/privacystatement. A possible data transfer to the USA between Microsoft and Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA, cannot be ruled out. This is secured through the EU-U.S. Data Privacy Framework.
b) Legal basis for data processing
The legal basis for the use of Microsoft Customer Match is your consent in accordance with Article 22.2 of the LSSI-CE and Article 6(1)(a) of the GDPR.
c) Purpose of data processing
The purpose of the processing is to carry out personalised marketing and target existing customers.
d) Retention period
We delete your personal data when it is no longer necessary for the purpose. Microsoft deletes hashed email addresses after no more than 390 days.
e) Revocation pursuant to Art. 7 of the GDPR
You may withdraw your consent to data processing at any time in accordance with Art. 7 of the GDPR. You can change your tracking settings at https://www.roastmarket.de/enable-cookies or contact: [email protected]. The withdrawal does not affect the lawfulness of the processing carried out on the basis of the consent until then.
12. Microsoft Clarity
a) Description and scope of data processing
We use Microsoft Clarity, a service provided by Microsoft Ireland Operations Limited, South County Business Park, Leopardstown, Dublin 18 D18 P521, which enables us to analyze the user behavior of visitors to our website. This is done, among other things, by evaluating heat maps that visualize user behavior on our website. In this context, analysis data containing information about user interactions on our website is processed and collected based on various events. This concerns interaction events such as clicks, scrolling, mouse movements, window resizing, selections, and keystrokes. Diagnostic events such as script and image errors, logs, and performance events. Page events such as document sizes, page visibility, page discharge, measurements, and page dimensions. The subject of the data processing is the IP address, user ID, and session ID.
In this context, Microsoft acts as an independent controller in accordance with the GDPR.
b) Legal basis for data processing
The legal basis for data processing is your consent, in accordance with Article 22.2 of the Law on Information Society Services and Article 6(1)(a) of the GDPR.
c) Purpose of data processingWe use the aforementioned service to improve our website. In particular, to identify where visitors encounter barriers when using our website, which can lead to frustration. This enables us to remove these barriers and create offers with as low a threshold as possible.
In addition, we improve our marketing strategy by using the evaluation results to tailor the website and our products to the specific needs of website visitors.
d) Storage period
The data in question is stored for as long as necessary to achieve the purpose. The collected data is stored for 13 months.
e) Revocation pursuant to Article 7 of the GDPR
You can revoke your consent to data processing at any time in accordance with Article 7 of the GDPR. You can change your tracking settings at https://www.roastmarket.de/enable-cookies or contact: [email protected]. The revocation does not affect the legality of the processing carried out on the basis of the consent until then. To disable the use of cookies on your computer, you can set your Internet browser so that cookies cannot be stored on your computer in the future or so that cookies already stored are deleted. However, disabling all cookies may mean that some functions on our websites can no longer be performed.
13. Meta Custom Audience via the Pixel procedure
a) Description and scope of data processing
This website uses "Meta Pixel" from Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Meta"). With your express consent, this can be used to track user behavior after they have viewed or clicked on an advertisement for a Meta service. This procedure serves to evaluate the effectiveness of advertisements for Meta services for statistical and market research purposes and can help to optimize future advertising measures.
The collected data is pseudonymized, and we cannot draw direct conclusions about the identity of users. However, the data is stored and processed by Meta, so it is possible to establish a connection to the user profile in question, and Meta may use the data for its own advertising purposes in accordance with the Meta Data Use Policy (https://www.facebook.com/privacy/policy). This may enable Meta and its partners to display advertisements on and outside of Meta services. A cookie may also be stored on your computer for these purposes.Meta is jointly responsible with us for this processing, and we have entered into an agreement with Meta on joint responsibility in accordance with Article 26 of the GDPR. The information about Meta required under Article 13(1)(a) and (b) of the GDPR, including contact details and data protection officer, can be found in Meta's data protection policy at: https://www.facebook.com/about/privacy. Further information on how Meta processes personal data, including the legal bases on which Meta relies, and your rights vis-à-vis Meta, is also available.The essence of the agreement pursuant to Article 26 of the GDPR: We and Meta have entered into the agreement available at https://www.facebook.com/legal/controller_addendum to determine the respective responsibilities for fulfilling the obligations under the GDPR with regard to joint processing (as defined in the terms of use for the products covered).
Meta is responsible for ensuring your rights as a data subject under Articles 15-20 of the GDPR with regard to the personal data that Meta stores following joint processing.
The transfer of personal data to the United States to Meta Platforms, Inc. cannot be excluded; this is currently ensured through the EU-U.S. Data Privacy Framework.
b) Legal basis for data processing
The legal basis for data processing is your consent, in accordance with Article 22.2 of the Law on Information Society Services and Article 6(1)(a) of the General Data Protection Regulation (GDPR).
c) Purpose of data processing
In this context, we process the data in question for the purpose of effective marketing.
d) Storage periodWe delete your personal data when it is no longer necessary for the purpose of processing. These cookies expire after 180 days.
e) Revocation pursuant to Art. 7 of the GDPR
You can revoke your consent to data processing at any time in accordance with Article 7 of the GDPR. You can change your tracking settings at https://www.roastmarket.de/enable-cookies or contact: [email protected]. The revocation does not affect the legality of the processing carried out on the basis of the consent until then.To disable the use of cookies on your computer, you can set your Internet browser so that no cookies can be stored on your computer in the future or so that cookies already stored are deleted. However, disabling all cookies may mean that some functions on our websites can no longer be performed. You can also deactivate the use of third-party cookies, e.g. Meta, on the following website of the Digital Advertising Alliance: https://www.aboutads.info/choices/. You can also control which advertisements are displayed to you in your Meta account at https://www.facebook.com/settings?tab=ads. Meta customer list.
14. Meta customer list custom audiences
a) Description and scope of data processing
We use the Customer List Custom Audiences feature from Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Meta"). This feature allows us to show you interest-based advertising when you use Meta services.
For this purpose, we transfer your hashed email address to Meta, provided that you have given your consent and entered your email address. Hashing is performed using a secure hashing method, e.g. SHA-256, before the data is transferred to Meta. Meta compares these hash values with its own hashed user information to find matches and create a target group to advertise to ("Custom Audience").
Meta is jointly responsible with us for this processing, and we have entered into an agreement with Meta on joint responsibility in accordance with Article 26 of the GDPR. The information about Meta required under Article 13(1)(a) and (b) of the GDPR, including contact details and data protection officer, can be found in Meta's data protection policy at: https://www.facebook.com/about/privacy. Further information on how Meta processes personal data, including the legal basis on which Meta relies, and your rights vis-à-vis Meta, is also available.The essence of the agreement pursuant to Article 26 of the GDPR:We and Meta have entered into the agreement available at https://www.facebook.com/legal/controller_addendum to define the respective responsibilities for fulfilling the obligations under the GDPR with regard to joint processing (as defined in the terms of use for the products covered).
Meta is responsible for ensuring your rights as a data subject under Articles 15-20 of the GDPR with respect to the personal data that Meta holds following joint processing.
b) Legal basis for data processing
The legal basis for the use of Meta Custom Audiences List Upload is your consent in accordance with Article 22.2 of the LSSI-CE / Article 6(1), first sentence, subparagraph (a) of the GDPR.
c) Purpose of data processing
The purpose of the processing is to carry out personalized marketing and target existing customers.
d) Storage period
We delete your personal data when it is no longer necessary to fulfill the purpose. According to its own information (https://www.facebook.com/business/help/112061095610075?id=2469097953376494&query=about%20engagement%20custom%20audiences), Meta deletes the hashed customer data after the comparison has been completed.
e) Revocation pursuant to Article 7 of the GDPR
You can revoke your consent to data processing at any time in accordance with Art. 7 of the GDPR. You can change your tracking settings at https://www.roastmarket.de/enable-cookies or contact: [email protected]. The revocation does not affect the legality of the processing carried out on the basis of the consent until then.You can also control which ads are shown to you in your Meta account at https://www.facebook.com/settings?tab=ads.
15. TikTok pixel
a) Description and scope of data processing
We use the "TikTok pixel" from TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland ("TikTok") on our website.
This application enables us, provided you have given your consent, to track your usage behavior when you visit our website after you have viewed or clicked on an advertisement. This procedure serves to evaluate the effectiveness of advertisements for statistical and market research purposes and can help to optimize future advertising measures. The evaluated data is pseudonymized, so we cannot draw any direct conclusions about the identity of users. However, the data is stored and processed by TikTok so that it is possible to establish a connection to the user profile in question, and TikTok may use the data for its own advertising purposes in accordance with TikTok's data policy (https://www.tiktok.com/legal/page/eea/privacy-policy/en). A cookie may also be stored on your computer for these purposes.
In this context, personal data is transferred to various third countries, including countries for which an adequacy decision has been made, e.g. the United Kingdom. Such a decision ensures that there is an adequate level of data protection when processing data in that country. If there is no adequacy decision for the third country in question, as is the case for the United States and Singapore, TikTok ensures an adequate level of protection through standard contractual clauses, see https://www.tiktok.com/legal/page/eea/transferee-countries/en. We expressly point out that even with the use of standard contractual clauses for the USA, it cannot be completely ruled out that US authorities may in individual cases gain access to personal data. We have entered into relevant agreements with TikTok regarding the use of the TikTok pixel.
b) Legal basis for data processing
The legal basis for data processing is your consent in accordance with Article 6(1)(a) of the GDPR.
c) Purpose of data processing
In this context, we process the data in question for the purpose of effective marketing.
d) Storage period
We delete your personal data when it is no longer necessary for the purpose of processing. These cookies expire after 180 days.
e) Revocation pursuant to Article 7 of the GDPR
You may revoke your consent to data processing at any time in accordance with Article 7 of the GDPR. Please contact: [email protected].The revocation does not affect the lawfulness of the processing carried out on the basis of the consent until then. To disable the use of cookies on your computer, you can set your Internet browser so that cookies cannot be stored on your computer in the future or so that cookies already stored are deleted. However, disabling all cookies may mean that some functions on our websites can no longer be performed.
16. TikTok Advanced Matching for Web
a) Description and scope of data processing
We use the advanced matching feature from TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland ("TikTok"). This feature allows us to show you interest-based advertising when you use TikTok services. For this purpose, provided you have given your consent and entered your email address, we transfer your hash-encoded email address (using a secure hash method, e.g. SHA-256) to TikTok. The hash value is used exclusively for comparison with existing TikTok user profiles and is not stored in plain text.TikTok acts as an independent controller in this context. A transfer to third countries (e.g., the USA, Singapore) may take place via TikTok. TikTok ensures an adequate level of data protection through standard contractual clauses and additional protective measures. Further information can be found in TikTok's data protection declaration: https://www.tiktok.com/legal/page/eea/privacy-policy/en.
b) Legal basis for data processing
The legal basis for the use of TikTok Customer Match is your consent in accordance with Article 22(2) of the LSSI-CE / Article 6(1), first sentence, subparagraph (a) of the GDPR.
c) Purpose of data processing
The purpose of the processing is to carry out personalised marketing and target existing customers.
d) Storage period
We delete your personal data when it is no longer necessary for the purpose. TikTok deletes hashed email addresses after the comparison is complete, but no later than after 13 months.
e) Revocation pursuant to Art. 7 of the GDPR
You may revoke your consent to data processing at any time in accordance with Art. 7 of the GDPR. You can change your tracking settings at https://www.roastmarket.de/enable-cookies or contact: [email protected]. The revocation does not affect the legality of the processing carried out on the basis of the consent until then.
17. Google reCAPTCHA
a) Description and scope of data processing
In order to check whether certain entries on our website are actually made by natural persons and are not misused by machine and automated processing, we use the reCAPTCHA function from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google") on our website. This service includes sending the IP address and any additional data that Google needs for the reCAPTCHA service to Google.
In this context, personal data is transferred to the USA. To ensure an adequate level of data protection, we have entered into a data processing agreement with Google that contains standard contractual clauses.
Further information about Google reCAPTCHA and Google Inc.'s privacy policy can be found at: https://policies.google.com/privacy?hl=en.
b) Legal basis for data processing
The legal basis for the processing is Article 6(1)(f) of the GDPR.
c) Purpose of data processing
We process your personal data to prevent misuse and spam, which is also in our legitimate interest.
d) Storage period
We delete your personal data when it is no longer necessary for the purpose of processing. This is usually the case when you have entered your information on our website.
e) Right to object and erasure pursuant to Article 21 of the GDPR
There is no possibility to object to this data processing, as the processing of the data is absolutely necessary for the security and availability of the website.
18. Use of YouTube
a) Description and scope of data processing
Our website uses video components from YouTube LLC, 901 Cherry Ave., 94066 San Bruno, CA, USA, hereinafter referred to as "YouTube," which is a company of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.
We use the "extended data protection mode" option provided by YouTube. According to YouTube, this mode does not store any information about you when you simply visit the subpage where the YouTube video is embedded. Only when you play the embedded YouTube video will cookies be installed on your device and personal data transferred to YouTube. If you are logged into your YouTube account when you play the YouTube video, your internet behavior will be linked to your personal YouTube profile.
The scope of data collected by YouTube is not known to us in detail. According to its own information, YouTube collects location-related data, such as the IP address, and uses cookies to uniquely identify your browser or Google account. The data collected by YouTube may be shared with the services in the Google network. Since YouTube transfers the collected data to servers in the USA, we have entered into standard contractual clauses with YouTube to ensure an adequate level of data protection.Further information on the scope of data processing by YouTube and Google can be found at: https://policies.google.com/privacy?hl=en.
b) Legal basis for data processing
The legal basis for processing is Article 6(1)(f) of the GDPR.
c) Purpose of data processing
Your personal data is processed to give you access to the relevant video uploaded to YouTube.
d) Storage period
We have no knowledge of the duration of storage of the personal data collected by YouTube and cannot influence this.
e) Revocation pursuant to Article 7 of the GDPR
You can revoke your consent at any time with future effect. The data processing carried out up to that point will not be affected by the revocation. If you do not want YouTube to link the data collected via our website directly to your YouTube account, you can log out of your account beforehand. You can also completely prevent the use of the YouTube plugin with add-ons for your browser, e.g. with the script blocker "NoScript" (https://noscript.net/). The revocation does not affect the legality of the data processing carried out until the revocation.
19. Use of Pingdom
a) Description and scope of data processing
Our website uses video components from YouTube LLC, 901 Cherry Ave., 94066 San Bruno, CA, USA, hereinafter referred to as "YouTube", a company belonging to Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.
On this website, information about the use of our website is collected, stored, and analyzed using "cookie" text files using the "Pingdom" technology from SolarWinds Worldwide, LLC, Unit 1101, Building 1000, City Gate, Mahon, Cork, Ireland, telephone: +353 21 5002900, fax: +353 212 380 232 (EU headquarters), using cookie text files that collect, store, and analyze information about the use of our website (hereinafter referred to as "SolarWinds"). SolarWinds analyzes and monitors the function and performance of our website based on the information collected. In this context, your IP address and data about your use of the website may be processed. This data is transferred to SolarWinds and stored.
Further information about SolarWinds' technology can be found in SolarWinds' data protection provisions: https://www.solarwinds.com/legal/privacy
b) Legal basis for data processing
The legal basis for the use of Pingdom is your consent in accordance with Article 6(1)(a) of the GDPR.
c) Purpose of data processing
By using Pingdom, we monitor the function and performance of our website and also try to increase the user-friendliness of our website.
d) Retention period
We delete your personal data when it is no longer necessary for the purpose of processing. The cookies that SolarWinds uses to analyze website usage have a preset storage period that we neither know nor can influence. You can uninstall the installed cookies yourself and thus delete the stored data. In the following section, we explain how this deletion can be carried out via the browser settings.
e) Revocation pursuant to Art. 7 GDPR
You can revoke your consent to data processing in accordance with Art. 7 GDPR at any time. Please contact: [email protected]. The revocation does not affect the legality of the processing carried out on the basis of the consent until then. To prevent the collection and transmission of your IP address and user data, you must deactivate Java Script in your browser or install the "NoScript" add-on.
20. Use of Cloudflare
a) Description and scope of data processing
We use the services of Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA ("Cloudflare") to increase the security and performance of our website. Cloudflare acts as a Content Delivery Network (CDN) and a protection system against DDoS attacks and malicious bots. When you visit our website, requests are routed through Cloudflare's servers. In this context, the following data in particular is processed:
IP address
Device information (operating system, device type)
Referrer URL
Name and URL of the downloaded file
Date and time of the request
Amount of data transferred
Status information
System configuration information
This data is necessary to prevent attacks and ensure the secure delivery of content. Cloudflare processes this data on our behalf (order processing), and we have entered into a corresponding order processing agreement with Cloudflare. Personal data is transferred to the United States. Cloudflare is certified under the EU-U.S. Data Privacy Framework, which ensures an adequate level of data protection.
b) Legal basis for data processing
The legal basis is our legal obligation to ensure the security of personal data processing in accordance with Article 6(1)(c), in conjunction with Article 5(1)(f), in conjunction with Article 32 of the GDPR.
c) Purpose of data processing
The purpose of the processing is to ensure IT security, in particular the protection of our website against attacks (e.g. DDoS) and the secure delivery of content.
d) Storage period
Cloudflare stores log data, which may contain IP addresses, only for a limited period of time in order to analyze security incidents and ensure the stability of the service. According to Cloudflare, this data is stored "for a limited period of time" and then deleted or anonymized.
21. Appointment scheduling via Calendly
a) Description and scope of data processing
We use the "Calendly" service from Calendly LLC, 115 E Main St., Ste A1B, Buford, GA 30518, USA ("Calendly") to make it easy and efficient for you to schedule consultation times.
When you book an appointment via Calendly, the data you have provided (e.g., name, email address, telephone number) is processed. This data is necessary for planning and carrying out the appointment.
Calendly acts as a data processor in this context. Data processing is based on a data processing addendum (DPA) that contains the EU's standard contractual clauses. Personal data is transferred to the United States. Calendly is certified under the EU-U.S. Data Privacy Framework, which ensures an adequate level of data protection. Further information can be found in Calendly's privacy policy: https://calendly.com/legal/privacy-notice.
b) Legal basis for data processing
The legal basis for the processing is your consent pursuant to Article 6(1)(a) of the GDPR.
c) Purpose of data processing
The purpose of the processing is to arrange and manage appointments for advisory meetings.
d) Retention period
We will delete your personal data as soon as it is no longer necessary for the purpose.
e) Revocation pursuant to Article 7 of the GDPR
You can withdraw your consent at any time with effect for the future. Please contact: [email protected]. The legality of the processing carried out to date remains unaffected.
22. Pinterest tag
a) Description and scope of data processing
We use "Pinterest tags" from Pinterest Europe Ltd. Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland ("Pinterest") on our website. Pinterest tags are pieces of code that are integrated into our website. This application allows us, provided you have given your consent, to track your usage behavior when you visit our website after you have seen an advertisement in connection with the use of a service from Pinterest. In this case, we collect pseudonymized data about your use of our website, such as your clicks on individual elements. This procedure serves to evaluate the effectiveness of advertisements for statistical and market research purposes and can help optimize future advertising measures. The evaluated data is pseudonymized, so we cannot draw any direct conclusions about your identity.
At the same time, the data is transferred to Pinterest and processed by Pinterest Europe as an independent controller for its own purposes, so that it is possible to establish a connection to your Pinterest profile and Pinterest can use the data for its own advertising purposes in accordance with the Pinterest data use policy (https://policy.pinterest.com/de/privacy-policy#section-we-collect-information-in-a-few-different-ways).
The transfer of personal data to the United States to Pinterest Inc. (United States) cannot be ruled out; this is currently ensured through the EU-U.S. Data Privacy Framework.
b) Legal basis for data processing
The legal basis for data processing is your consent, in accordance with Article 22.2 of the Law on Information Society Services and Article 6(1)(a) of the GDPR.
c) Purpose of data processing
The purpose of the processing is to ensure effective marketing.
d) Retention period
We will delete your personal data when it is no longer necessary for the purpose of processing.
e) Revocation pursuant to Article 7 of the GDPR
You may withdraw your consent to data processing at any time in accordance with Article 7 of the GDPR. You can change your cookie settings at https://www.roastmarket.de/enable-cookies or contact: [email protected].The withdrawal does not affect the lawfulness of the processing carried out on the basis of the consent until then.
23. Pinterest Enhanced Match
a) Description and scope of data processing
We use the "Enhanced Match" feature in the Pinterest tag from Pinterest. This feature allows us to show you interest-based advertising when you use Pinterest services.
For this purpose, we transfer your hashed email address to Pinterest, provided that you have given your consent and entered your email address. The hashing is done using a secure hashing method, e.g. SHA-256, before the data is transferred to Pinterest. Pinterest compares these hash values with its own hashed user information to find matches and create a target group to advertise to ("Custom Audience").
The data is processed by Pinterest Europe as an independent controller for its own purposes, so that it is possible to establish a connection to your Pinterest profile and Pinterest can use the data for its own advertising purposes in accordance with the Pinterest data use policy (https://policy.pinterest.com/en/privacy-policy#section-we-collect-information-in-a-few-different-ways).
b) Legal basis for data processing
The processing is based on your consent in accordance with Art. 22.2 of the LSSI-CE / Art. 6, paragraph 1, sentence 1, letter a) of the GDPR.
c) Purpose of data processing
In this context, we process the relevant data for the purpose of effective marketing.
d) Duration of storage
The hashed data is used exclusively for comparison purposes and is deleted immediately if there is no match. In the event of a successful comparison, only the internal Pinterest ID is stored, but not the original hash values. The resulting target group can be used by us until manual deletion after the purpose has been achieved.
e) Revocation pursuant to Art. 7 GDPR
You can revoke your consent to data processing at any time in accordance with Art. 7 of the GDPR. You can change your tracking settings at https://www.roastmarket.de/enable-cookies or contact: [email protected].The revocation does not affect the legality of the processing carried out on the basis of the consent until then.
24. Connexity Pixel
a) Description and scope of data processing
We use Connexity Pixel from Connexity, Inc., Colorado Ave. 2120, Suite 400, Santa Monica, CA 90404, USA ("Connexity") on our website.
Pixels are small graphics that are automatically loaded when a website is opened and enable user behavior to be tracked. With this application, it is possible for us, provided you have given your consent, to track your user behavior when you visit our website after you have come to our website via a link from a Connexity service. This procedure serves to understand how many sales originate from Connexity services and, based on this, to improve marketing processes. The evaluated data is pseudonymized so that we cannot draw any direct conclusions about the identity of users. Connexity receives pseudonymized data from us about the number of purchases and the value of the shopping cart for users who have come to us via Connexity services. Connexity processes this data in accordance with Connexity's privacy policy (https://www.connexity.com/privacy-policy/).
In this context, Connexity acts as an https://www.connexity.com/merchant-privacy-terms/. In this context, personal data is transferred to a third country outside the European Economic Area (USA). Connexity ensures an adequate level of data protection by means of standard contractual clauses, see https://www.connexity.com/merchant-privacy-terms/. We expressly point out that even with the use of standard contractual clauses for the USA, it cannot be completely ruled out that US authorities may access personal data in individual cases. We have entered into relevant agreements with Connexity regarding the use of Connexity Pixel.
b) Legal basis for data processing
The legal basis for data processing is your consent in accordance with Art. 22.2 of the LSSI-CE / Art. 6, para. 1, sentence 1, subparagraph (a) of the GDPR.
c) Purpose of data processing
The purpose of the processing is to ensure effective marketing.
d) Storage period
We will delete your personal data when it is no longer necessary for the purpose of processing.
e) Revocation pursuant to Article 7 of the GDPR
You may withdraw your consent to data processing at any time in accordance with Article 7 of the GDPR. You can change your tracking settings at https://www.roastmarket.de/enable-cookies or contact: [email protected].The revocation does not affect the lawfulness of the processing carried out on the basis of the consent until then.
25. Solute GmbH Conversion Tracking
a) Description and scope of data processing
We use "billiger.de / solute.de Conversion Tracking" from solute GmbH, Zeppelinstraße 15, 76185 Karlsruhe, Germany ("billiger.de") on our website.
This application enables us, provided you have given your consent, to track your usage behavior when you visit our website after you have arrived at our website via a link from a billiger.de service. This procedure serves to understand how many sales originate from billiger.de services and, based on this, to improve marketing processes. The evaluated data is pseudonymised so that we cannot draw any direct conclusions about the identity of users. Billiger.de receives pseudonymized data from us about the number of purchases and shopping cart values from users who have come to us via billiger.de services. These are processed by billiger.de in accordance with billiger.de's privacy policy (https://company.billiger.de/service/datenschutzunterrichtung/).
b) Legal basis for data processing
The legal basis for data processing is your consent in accordance with Article 22.2 of the Law on Information Society Services and Article 6(1)(a) of the GDPR.
c) Purpose of data processing
The purpose of the processing is to ensure effective marketing.
d) Storage period
We will delete your personal data when it is no longer necessary for the purpose of processing.
e) Revocation pursuant to Article 7 of the GDPR
You may withdraw your consent to data processing at any time in accordance with Article 7 of the GDPR. You can change your tracking settings at https://www.roastmarket.de/enable-cookies or contact: [email protected].The withdrawal does not affect the lawfulness of the processing carried out on the basis of the consent until then.
26. RTB House
a) Description and scope of data processing
We use the marketing tool from RTB House S.A., Złota Street 61/101, 00-819 Warsaw, Poland ("RTB House") on our website.
This application enables us, provided you have given your consent to , to track your use of our website after you have arrived at our website via a link in an advertisement from an RTB House service. This procedure serves to understand how many sales originate from RTB House services. The evaluated data is pseudonymized so that we cannot draw direct conclusions about the identity of users. RTB House receives pseudonymized data from us about the number of purchases and shopping cart values from users who have come to us via RTB House services. RTB House processes this data in accordance with RTB House's privacy policy (https://www.rtbhouse.com/privacy-center#5). An agreement has been concluded with RTB House on data processing in accordance with Article 28 of the GDPR.
b) Legal basis for data processing
The legal basis for data processing is your consent in accordance with Article 22.2 of the LSSI-CE and Article 6(1)(a) of the GDPR.
c) Purpose of data processing
The purpose of the processing is to ensure effective marketing.
d) Retention period
We will delete your personal data when it is no longer necessary for the purpose of processing.
e) Revocation pursuant to Article 7 of the GDPR
You may withdraw your consent to data processing at any time in accordance with Article 7 of the GDPR. You can change your tracking settings at https://www.roastmarket.de/enable-cookies or contact: [email protected].The lawfulness of the processing carried out on the basis of the consent until then is not affected by the revocation.
27. Yotpo Pixel
a) Description and scope of data processing
We use Yotpo Pixel from Yotpo Inc., New York, 400 Lafayette St., NY, USA ("Yotpo") on our website.
This application enables us, provided you have given your consent, to track your usage behavior when you visit our website after you have come to our website via a link in an advertisement for a Yotpo service. This procedure serves to track how many sales originate from Yotpo services. The evaluated data is pseudonymized so that we cannot draw any direct conclusions about the identity of users. Yotpo receives pseudonymized data from us about the number of purchases and shopping cart values from users who have come to us via Yotpo services. Yotpo processes this data in accordance with the Yotpo Data Policy (https://www.yotpo.com/privacy-policy/).
To the extent that Yotpo transfers personal data to the United States, there is an adequacy decision under the EU-US Data Privacy Framework from the European Commission pursuant to Article 45 of the GDPR (see https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en). Yotpo is certified under the EU-US Data Privacy Framework, which means that the usual level of protection under the GDPR applies to the transfer.
b) Legal basis for data processing
The legal basis for data processing is your consent in accordance with Article 22.2 of the Law on Information Society Services and Article 6(1)(a) of the GDPR.
c) Purpose of data processing
The purpose of the processing is to ensure effective marketing.
d) Retention period
We will delete your personal data when it is no longer necessary for the purpose of processing.
e) Revocation pursuant to Article 7 of the GDPR
You may withdraw your consent to data processing at any time in accordance with Article 7 of the GDPR. You can change your tracking settings at https://www.roastmarket.de/enable-cookies or contact: [email protected]. The lawfulness of the processing carried out on the basis of the consent until then is not affected by the revocation.
28. Shopcaddy / Beslist
a) Description and scope of data processing
We use the Shopcaddy service and Beslist from Beslist.nl b.v., Meander 825, 6825 MH Arnhem, Netherlands ("Beslist") on our website.
This application enables us, provided you have given your consent, to track your usage behavior when you visit our website after arriving at our website via a link from a Beslist service. Beslist operates the platforms shopcaddy.de and beslist.nl, where various online shops (including the Roastmarket online shop) are linked. This procedure serves to track how many sales originate from Beslist websites and, based on this, to improve marketing processes. The evaluated data is pseudonymised so that we cannot draw any direct conclusions about the identity of users. Beslist receives pseudonymised data from us about the number of purchases and the value of the shopping cart for users who have come to us via Beslist websites. Beslist processes this data in accordance with the Beslist data policy (https://www.shopcaddy.de/information/dateschutzerklarung.html).
b) Legal basis for data processing
The legal basis for data processing is your consent, in accordance with Article 22.2 of the Law on Information Society Services and Article 6(1)(a) of the GDPR.
c) Purpose of data processing
The purpose of the processing is to ensure effective marketing.
d) Storage period
We will delete your personal data when it is no longer necessary for the purpose of processing, at the latest after 12 months.
e) Revocation pursuant to Art. 7 of the GDPR
You may withdraw your consent to data processing at any time in accordance with Article 7 of the GDPR. You can change your tracking settings at https://www.roastmarket.de/enable-cookies or contact: [email protected].The revocation does not affect the legality of the processing carried out on the basis of the consent until then.
29. Uppr cookie
a) Description and scope of data processing
We use cookies from uppr GmbH, Linkstr. 21, 59519 Möhnesee, Germany ("uppr") on our website.
This application enables us, provided you have given your consent, to track your usage behavior when you visit our website after you have arrived at our website via a link from an uppr service. This procedure serves to track which interactions on our website (e.g., a purchase in the online store or a newsletter registration) originate from uppr services (e.g., an advertisement on third-party sites) and, based on this, to improve our marketing processes. For this purpose, technical data from your browser and computer, as well as your IP address, is transferred via a cookie (transferred data).The transferred data is pseudonymized so that we cannot draw any direct conclusions about the identity of users. Uppr receives the transferred data in pseudonymized or, as far as possible, anonymized form. Uppr processes this data in accordance with Uppr's privacy policy (https://www.uppr.rocks/datenschutz).
b) Legal basis for data processing
The legal basis for data processing is your consent in accordance with Article 22.2 of the Law on Information Society Services and Article 6(1)(a) of the GDPR.
c) Purpose of data processing
The purpose of the processing is to ensure effective marketing.
d) Storage period
We will delete your personal data when it is no longer necessary for the purpose of processing, at the latest after 30 days.
e) Revocation pursuant to Art. 7 GDPR
You may withdraw your consent to data processing at any time in accordance with Article 7 of the GDPR. You can change your tracking settings at https://www.roastmarket.de/enable-cookies or contact: [email protected].The withdrawal does not affect the lawfulness of the processing carried out on the basis of the consent until then.
30. Kelkoo
a) Description and scope of data processing
Our website integrates the service provided by Kelkoo SAS, 64-66 Rue des Archives, 75003 Paris, France ("Kelkoo"). Kelkoo is a price and product comparison platform that enables us to display our products to potential customers via their network. Kelkoo helps us determine whether you have come to our site via a Kelkoo service – and whether you have subsequently made a purchase. This is called conversion tracking. In connection with this integration, personal data may be recorded (user ID, time of interaction, URL of interaction, IP address, user agent data, browser information, geographic location, purchase activities). This is done via cookies and similar tracking technologies that can be set when you visit our website, if you have given your consent.The data is transferred to Kelkoo and processed by Kelkoo on its own responsibility in accordance with Kelkoo's privacy policy (https://www.kelkoogroup.com/en/privacy-policy/).
b) Legal basis for data processing
The legal basis for data processing is your consent in accordance with Article 22.2 of the LSSI-CE / Article 6(1), first sentence, subparagraph (a) of the GDPR.
c) Purpose of data processing
The purpose of the processing is to ensure effective marketing.
d) Storage period
The data in question will be stored for as long as necessary to achieve the purpose. The data collected will be stored for a maximum of 12 months.
e) Revocation pursuant to Art. 7 GDPR
You may revoke your consent to data processing at any time in accordance with Article 7 of the GDPR. You can change your tracking settings at https://www.roastmarket.de/enable-cookies or contact: [email protected]. The revocation does not affect the legality of the processing carried out on the basis of the consent until then.To disable the use of cookies on your computer, you can set your Internet browser so that cookies cannot be stored on your computer in the future or so that cookies already stored are deleted. However, disabling all cookies may mean that some functions on our websites can no longer be performed.
31. Algolia
a) Description and scope of data processing
On our website, we use the external search service provided by Algolia SAS, 55 Rue d'Amsterdam, 75008 Paris, France ("Algolia").
When you use our search function, your query is sent to Algolia's server in real time. The search terms you enter, technical information (browser type, device used, operating system) and network data from the query are processed. In particular, your IP address is recorded, but it is shortened to protect your privacy.
In addition, Algolia assigns each search query a random identifier ("user token") to recognize multiple queries from the same person (within a session). This user token is reset by default for each page visit. In order to recognize returning users beyond individual sessions—e.g., for search analysis or personalized results—Algolia may use a persistent identifier. This only happens on our website if you have consented to the use of Algolia in the cookie banner. In this case, a browser- e cookie is set that contains a unique pseudonymous user token. The use of cookies is not technically necessary for the pure search function; without consent, Algolia will therefore either not set a cookie or only use volatile tokens per page view.If you have given your consent, Algolia collects not only the search term itself but also usage events (so-called "events") – e.g., which search results you click on, which products you add to your shopping cart or purchase. We send this event data to Algolia to continuously improve the relevance of search results and, where applicable, product recommendations. Algolia aggregates these events into statistics (e.g., click and conversion rates for specific search terms) and uses them to optimize future search results pages for all users. In addition, the service creates an individual profile for returning users, provided that consent has been given. Here, your previous actions (e.g., tags or categories that you frequently view) are collected in an interest profile so that future searches will primarily show products that match your profile.
The processing is carried out on our behalf by Algolia in accordance with Article 28 of the GDPR; we have entered into a corresponding contract with Algolia for data processing.
b) Legal basis for data processing
The legal basis for data processing is your consent in accordance with Article 22.2 of the Information Society Services Act and Article 6(1)(a) of the GDPR, insofar as it concerns the storage of information on your end device via a cookie and the analysis of your usage behavior.
Without your consent, Algolia will only be used to the extent that it is strictly technically necessary (i.e., the search query is transmitted to Algolia, but without permanent tracking), which is necessary to implement measures prior to entering into a contract pursuant to Article 6(1)(b) of the GDPR.
c) Purpose of data processing
The integration of Algolia serves to provide you with a convenient product search on our website. In addition, we use – insofar as you have given your consent – Algolia's analysis and personalization features to better tailor our offerings to your interests.
d) Storage period
The personal data generated in connection with Algolia is not stored permanently, but is routinely deleted once the purpose has been fulfilled. Search analysis data (e.g., search queries, click statistics) and event data (e.g., clicks and purchase actions for personalized recommendations) are deleted from the Algolia servers after 90 days at the latest. Personalization profiles (if created with your consent) are not subject to a fixed maximum period, as they grow over multiple visits. However, we regularly check which user profiles are still current. After 12 months of inactivity at the latest, we remove the profile in question from Algolia.
e) Revocation pursuant to Art. 7 GDPR
You can revoke your consent to data processing at any time in accordance with Art. 7 of the GDPR. You can change your tracking settings at https://www.roastmarket.de/enable-cookies or contact: [email protected]. The revocation does not affect the legality of the processing carried out on the basis of the consent until then.To disable the use of cookies on your computer, you can set your Internet browser so that cookies cannot be stored on your computer in the future or so that cookies already stored are deleted. However, disabling all cookies may mean that some functions on our websites can no longer be performed.
32. FactFinder
a) Description and scope of data processing
On our website, we use the external search service FACT-Finder from Omikron Data Quality GmbH, Habermehlstraße 17, 75172 Pforzheim, Germany ("FACT-Finder") to provide you with a fast and relevant product search.
When you use our search function, your search query is sent to FACT-Finder's servers. The processing of search queries for customers in the European Union takes place exclusively on servers within the European Union (server location is Frankfurt am Main). FACT-Finder stores the following information, which is absolutely necessary for technical operation and functionality:
IP address of the shop (or, when using WebComponents, the client IP address of the person performing the search, as the queries are sent directly from the browser).
A user and/or session ID, if this is transferred from our shop (for the Tracking, Analytics, and Personalization modules).
Information about the search query and the time of the query.
Possibly the geolocation transmitted from the shop as the starting point for the search (when using geosearch).
Special feature when using personalization: When the "Personalization" module is used, additional information from the log data is stored based on the user and/or session ID transferred from the store in order to enable a personalized search result. This includes:
The transferred user and/or session ID.
The interactions in the search result associated with this ID.
The stored data remains on FACT-Finder's servers. Omikron cannot link the stored data to natural persons, as anonymized user and/or session IDs are transmitted. The processing is carried out on our behalf by FACT-Finder in accordance with Art. 28 of the GDPR; we have concluded a corresponding contract with FACT-Finder for order processing. The personal data in question is used by FACT-Finder exclusively to ensure the operation and fulfillment of the hosted services and is not used for other purposes or sold.
b) Legal basis for data processingThe processing and storage of the data necessary for the technical operation of the search function are necessary for the fulfillment of contractual obligations (use of the search function) in accordance with Article 6(1), first sentence, letter b) of the GDPR. To the extent that FACT-Finder’s personalization and analytics features require the storage of information on your device (e.g., cookies) or the analysis of your usage behavior beyond technically necessary search queries, this is based on your consent in accordance with Article 22(2) of the LSSI-CE and Article 6(1), first sentence, letter a) of the GDPR.
c) Purpose of data processing
The integration of FACT-Finder serves to provide you with a convenient and efficient product search on our website. If you have given your consent, we use the personalization and analysis functions to improve the relevance of search results and to better tailor our offerings to your interests.
d) Duration of storage
The data generated during the operation of the application is stored and retained for the entire duration of the contract with Omikron. The data is deleted 3 months after the end of the contract.
e) Withdrawal pursuant to Art. 7 GDPR
You may withdraw your consent to data processing at any time in accordance with Article 7 of the GDPR. You can change your tracking settings at https://www.roastmarket.de/enable-cookies or contact: [email protected].The revocation does not affect the legality of the processing carried out on the basis of the consent until then. To disable the use of cookies on your computer, you can set your Internet browser so that cookies cannot be stored on your computer in the future or so that cookies already stored are deleted. However, disabling all cookies may mean that some functions on our websites can no longer be performed.
IV. Data processing for customer service
In this section, we inform you about how we process your personal data when you contact our customer service via the website.
1. Contact options
a) Description and scope of data processing
On our website, we give you the option of contacting us via a contact form. For this purpose, the information you have provided in the contact form is transferred and processed in order to process your enquiry.
The following data is collected at the time of your inquiry (inquiry-related data):
Your name
Your email address
Your telephone number
When your inquiry is sent, the following data is also processed (technical data):
Your IP address
Date and time of sending your request
If you contact us via the email address provided, the personal data you have transmitted with the email will be processed. The information will not be passed on to third parties.
b) Legal basis for data processing
The legal basis for the processing of the inquiry-related data is Art. 6 (1) (a) GDPR. The legal basis for the processing of the technical data is Art. 6 (1) (f) GDPR.
c) Purpose of data processing
We only process your personal data for the purpose of processing your inquiry and contacting you. The processing of other personal data during the sending process is done to protect us in case the contact options provided are misused or our IT systems are negatively affected by the contact. We do not collect any further data.These purposes also constitute our legitimate interest in processing your personal data.
d) Retention period
We delete your personal data when it is no longer necessary for the purpose of the processing. For personal data sent to us in connection with your inquiry via the contact form, this is the case when the relevant conversation with you has been concluded. The conversation is concluded when it is clear from the circumstances that the matter in question has been resolved. The personal data that is further processed during the dispatch process is deleted after a period of 30 days.
e) Withdrawal pursuant to Article 7 of the GDPR
You may revoke your consent to the transfer of your email address at any time in accordance with Article 7 of the GDPR. Please contact: [email protected]. The revocation does not affect the legality of the processing carried out on the basis of the consent until then.
f) Right to object and erasure pursuant to Article 21 of the GDPR
You have the right to object to the processing of your personal data at any time. In this case, the conversation cannot be continued. Please address your objection to [email protected]. The personal data processed in connection with the communication will then be deleted.
2. Customer feedback
a) Description and scope of data processing
We work with zenloop GmbH, Pappelallee 78/79 10437 Berlin ("zenloop"). Through zenloop, we are able to collect and analyze feedback from our customers in the form of surveys via various channels. This allows us to tailor and improve our offerings to the needs of our customers. When the feedback tool is used, zenloop records the value of the item, the payment provider through which the payment was made, the IP address, and device and browser data. In addition, zenloop also uses cookies and similar technologies to collect your data in order to compile reports or benchmarks for us.For the purpose of customer reviews and our own quality management, we use the email address you provided during the purchase to request a review of your order via the review system we use.
b) Legal basis for data processing
The legal basis for the processing of your data in connection with customer surveys is Article 6(1), first sentence, letter f) of the GDPR. The disclosure of your email address is based on your consent in accordance with Article 6(1), first sentence, letter a) of the GDPR.
c) Purpose of data processing
We only process your personal data for the purpose of improving our offerings and services.
d) Storage period
We delete your personal data when it is no longer necessary for the purpose of processing. This usually happens immediately after the completion of the project to which the survey relates. Your data will be deleted at the latest after the completion of the survey and after we have evaluated the content of your assessment.
e) Right to object and erasure under Article 21 of the GDPR
You have the right to object to the processing of your personal data at any time. Please send your objection to [email protected].
f) Revocation in accordance with Article 7 of the GDPR
You may withdraw your consent to the transfer of your email address at any time in accordance with Article 7 of the GDPR. Please contact: [email protected]. The withdrawal does not affect the lawfulness of the processing carried out on the basis of the consent until then.
V. Data processing when visiting the store
If you visit our store, the following personal data may be processed.
1. Video surveillance
a) Description of data processing
We have installed cameras in various locations in our store to monitor the sales area.
b) Legal basis for data processing
The legal basis for data processing in connection with camera surveillance is our legitimate interest pursuant to Article 6(1)(f) of the GDPR.
c) Purpose of data processing
We have installed camera surveillance in the exercise of our domiciliary rights to protect the goods in the sales area from theft and damage (protection of property) and to deter the commission of possible criminal offenses (prevention of vandalism).
d) Storage period
The video recordings are stored for 72 hours and then deleted.
e) Right to object and erasure pursuant to Article 21 of the GDPR
There is no possibility to object to this data processing, as the processing of the data is absolutely necessary to exercise our property rights for the purpose of protecting property rights.
2. Payment processing
a) Description of data processing
To operate the card readers, we use the services of Unzer GmbH, Schöneberger Str. 21 a, 10963 Berlin, which provides POS terminals for the store and operates the network to which the terminals are connected, and for the cash register system we use the services of Tillhub GmbH, Schöneberger Str. 21 a, 10963 Berlin. The following data is processed in connection with payment processing:
Transaction data such as IBAN, card number, card expiry date and card serial number, date, amount, time, identification number of the card reader in question and verification information from your card-issuing bank.
Verification and validation of account and card details.
In addition, we offer you the option of paying by credit card, for which we use Clearhaus A/S, P. O. Pedersens Vej 2, DK-8200 Aarhus N, Denmark, as the so-called acquirer, which handles the secure forwarding and settlement of credit card transactions with international credit card companies (e.g., Visa, V-Pay, MasterCard, Maestro).
b) Legal basis for data processing
The processing of personal data is based on the agreement entered into pursuant to Article 6(1)(b) of the GDPR and, with regard to the verification and validation of account and card details, on our legitimate interest pursuant to Article 6(1)(f) of the GDPR.
c) Purpose of data processing
The data is processed on the one hand for the technical processing of cashless payments via a technical infrastructure, e.g. secure communication between a payment terminal and your card-issuing bank. On the other hand, data processing is carried out for the purpose of fraud prevention, which is our legitimate interest.
d) Storage period
We delete your personal data when it is no longer necessary for the purpose of processing. This is usually the case after the expiry of the limitation period, which begins at the end of the year in which the purchase was completed. After the limitation period has expired, your data will be blocked and deleted after the expiry of the statutory retention obligations (see VII. Retention obligations).
e) Right to object and erasure pursuant to Article 21 of the GDPR
There is no possibility to object to this data processing, as the processing of the data is absolutely necessary to prevent fraud.
VI. Your rights
This section informs you of your rights and how you can exercise them.
1. Right of access
Under Article 15 of the GDPR, you have the right to obtain information about the processing of your personal data free of charge at any time. Such information includes an overview of the data relating to you and a copy of this data. We will make your personal data available in a commonly used electronic format.
2. Right to rectification
If data is or becomes incorrect, we are obliged to correct the information in accordance with Article 16 of the GDPR at your request.
3. Right to erasure ("right to be forgotten")
You may request the erasure of data at any time in accordance with Article 17 of the GDPR.
4. Right to restriction of processing
When we cannot erase your data (e.g. due to legal storage obligations), we restrict the processing of the data in question in accordance with Article 18 of the GDPR. Processing is also restricted if you believe that the data we have stored is incorrect or if there is disagreement about the legality of the processing.
5. Right to data portability
You may request us at any time in accordance with Article 20 of the GDPR to transfer your personal data to you or a third party of your choice.
6. Automated decision-making in individual cases, including profiling
Under Article 22 of the GDPR, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
7. Right to object
Under Article 21 of the GDPR, you have the right to object to the processing of your personal data if this processing is based on a legitimate interest under Article 6(1)(f) of the GDPR.
8. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data is in breach of the Data Protection Regulation. You have the right to lodge a complaint with the supervisory authority in your place of residence.
You have the right to file a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the General Data Protection Regulation. As a general rule, you may contact the supervisory authority in your place of residence.
The supervisory authority in Spain with jurisdiction is:
Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6
28001 Madrid
EspañaTel.: +34 901 100 099 / +34 912 663 517
Website: https://www.aepd.es
Email: [email protected]
Alternatively, you can contact the German data protection authority here:Der Hessische Beauftragte für Datenschutz und InformationsfreiheitGustav-Stresemann-Ring 165189 Wiesbaden10969 BerlinTlf.: +49 (0) 611 14080Fax: +49 (0) 611-1408 611E-mail: [email protected]
9. Withdrawal of consent
Pursuant to Article 7(3) of the GDPR, you have the right to withdraw your consent to us at any time. If you withdraw your consent, we will no longer process your personal data from the time of withdrawal. However, the withdrawal does not affect the lawfulness of previous processing. If you wish to withdraw your consent that you have given us, please contact one of the responsible persons using the above contact details or send your request to: [email protected]. Alternatively, you can use the functions available in our applications to withdraw your consent, if possible.
VII. Storage periods
If you no longer use our services and send us a request for deletion, we will delete all personal data with the exception of certain categories in order to comply with our legal storage obligations. This data will be deleted immediately after the expiry of the storage period, without you having to request deletion again.
If it is necessary to retain your personal data, it will be for the following purposes and in compliance with the following laws:
1.Compliance with the retention periods set forth in commercial and tax laws, which refer to the following laws:
Records are retained to comply with the legal obligations established in Spanish commercial and tax laws, in particular the Commercial Code, Law 58/2003 (General Tax Law), Law 37/1992 on Value-Added Tax (VAT), as well as the relevant regulations regarding invoicing and accounting (for example, Royal Decree 1619/2012).
Legal retention and documentation obligations typically range from four to six years, but in specific cases may be longer.
2. Ensuring adequate disaster recovery and conducting IT audits:
Processing and retention are carried out to ensure the security and integrity of the systems, as well as to comply with accountability and evidence obligations regarding data protection, in accordance with Article 5(2), Article 24, and Article 32 of the GDPR.
The retention period is governed by the applicable statutory limitation periods under the Spanish Civil Code, which are typically up to five years.
3. Claims Management and Evidence:
Personal data is processed and retained for the purpose of asserting, exercising, or defending legal rights in accordance with Article 6(1)(f) of the GDPR. The retention period is governed by the relevant civil statute of limitations under Spanish law, specifically the Civil Code. The standard statute of limitations for personal claims is generally up to five years from the date the debt becomes due.