Privacy Policy

With our privacy policy, we aim to inform you comprehensively about the processing of personal data when using our websites (www.heidebrenner.de).

When processing personal data, we always do so in accordance with the GDPR and the regulations of the respective countries.

This statement informs you, as a visitor to our website, about the nature, scope, and purpose of the collection, processing, and use of personal data.

We are happy to explain your rights as the data subject.

1. Controller's Contact Information

Controller, as defined by the General Data Protection Regulation ("GDPR"), is:

Heidebrenner GmbH
Am Anger
924534 Neumünster
Phone: +49 (0) 4321 78374 0
Email: info(at)heidebrenner.de

Other applicable data protection laws and relevant provisions with data protection relevance in the EU member states are included.

2. Data Protection Officer's Contact Information

A data protection officer for the controller, as per the GDPR, is not provided due to the number of employees processing data - fewer than 10 persons.

3. Definitions

In our privacy policy, we use terms mentioned in Article 4 of the GDPR to provide you with an easily understandable and clear namespace.

a) "Personal data"

refers to any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific factors expressing the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

b) "Processing"

means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

c) "Restriction of processing"

means the marking of stored personal data with the aim of limiting their processing in the future.

d) "Profiling"

means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning the individual's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

e) "Pseudonymization"

means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

f) "Controller"

means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

g) "Processor"

means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.

h) "Recipient"

means a natural or legal person, public authority, agency, or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.

i) "Third party"

means a natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

j) "Consent"

of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

k) "Personal data breach"

means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

l) "Enterprise"

means a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity.

Purposes for which personal data are processed

The website of Heidebrenner GmbH: www.heidebrenner.de includes elements that require the processing of personal data. We are pleased to introduce them to you.

a) Customer's initiative to contact by email

If you initiate business contact with us via email, we only collect your personal data (name, email address, message text) to the extent provided by you. The data processing is for the purpose of processing and responding to your contact request. If the contact aims at the implementation of pre-contractual measures (e.g., consultation for purchase interest, quotation), or concerns a contract already concluded between you and us, this data processing is based on Art. 6(1)(b) GDPR. If the contact is for other reasons, this data processing is based on Art. 6(1)(f) GDPR, representing our legitimate interest in processing and responding to your inquiry. In this case, you have the right to object to processing based on Art. 6(1)(f) GDPR, for reasons arising from your particular situation, at any time. We only use your email address to process your inquiry. Your data will be deleted in compliance with legal retention periods, unless you have consented to further processing and use.

b) Collection and processing when using the contact form

When using the contact form, we collect your personal data (name, email address, message text) only to the extent provided by you. The data processing serves the purpose of contact. By submitting your message, you consent to the processing of the transmitted data. The processing is based on Art. 6(1)(a) GDPR with your consent. You can revoke your consent at any time by notifying us, without affecting the legality of the processing carried out based on the consent until revocation. We only use your email address to process your inquiry. Your data will be deleted afterwards unless you have consented to further processing and use.

c) Collection of personal data when opening a customer account

When opening a customer account, we collect your personal data to the extent specified there. The data processing serves the purpose of improving your shopping experience and simplifying order processing. The processing is based on Art. 6(1)(a) GDPR with your consent. You can revoke your consent at any time by notifying us, without affecting the legality of the processing carried out based on the consent until revocation. Your customer account will be deleted subsequently.

d) Collection, processing, and disclosure of personal data for orders

When placing an order, we collect and process your personal data only to the extent necessary for the fulfillment and processing of your order as well as handling your inquiries. The provision of data is necessary for the.

deaktiviert zu widersprechen. Nähere Informationen zu Google reCAPTCHA und der dazugehörigen Datenschutzerklärung finden Sie unter: https://www.google.com/recaptcha/intro/android.html.

---

Translation:

g) Use of the email address for the sending of direct advertising

We use your email address, which we have obtained in the context of selling goods or services, for the electronic transmission of advertising for our own goods or services that are similar to those you have already purchased from us, provided that you have not objected to this use. Providing the email address is necessary for the conclusion of the contract. Failure to provide it means that no contract can be concluded. The processing is based on Art. 6 para. 1 lit. f GDPR, due to our predominant legitimate interest in direct advertising. You can object to the use of your email address for this purpose at any time by notifying us. The contact details for exercising the objection can be found in the imprint. You can also use the link provided in the advertising email for this purpose. This incurs no costs other than the transmission costs according to the basic rates.

h) Use of server log files to ensure smooth operation of our website

You can visit our websites without providing any personal information. Each time our website is accessed, usage data is transmitted to us or our web hoster/IT service provider by your internet browser and stored in log data (server log files). This stored data includes, for example, the name of the page accessed, the date and time of access, the IP address, the amount of data transferred, and the requesting provider. The processing is based on Art. 6 para. 1 lit. f GDPR, due to our predominant legitimate interest in ensuring the smooth operation of our website and improving our offering.

i) Use of cookies

Our website uses cookies. Cookies are small text files that are stored in the internet browser or by the internet browser on the user's computer system. When a user calls up a website, a cookie can be stored on the user's operating system. This cookie contains a characteristic string that enables a unique identification of the browser when the website is called up again.

Cookies are stored on your computer. Therefore, you have full control over the use of cookies. By selecting the appropriate technical settings in your internet browser, you can be notified before cookies are set and decide on an individual basis whether to accept them or prevent the storage of cookies and the transmission of the data they contain. Already stored cookies can be deleted at any time. However, we would like to point out that if you do so, you may not be able to use all the functions of this website to their full extent.

You can find information on how to manage (including disable) cookies on the most popular browsers at the following links:

- Chrome Browser: https://support.google.com/accounts/answer/61416?hl=en

- Internet Explorer: https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies

- Mozilla Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences

- Safari: https://support.apple.com/en-us/guide/safari/manage-cookies-and-website-data-sfri11471/mac

ii) Technically necessary cookies

Unless otherwise stated in the data protection declaration below, we only use these technically necessary cookies for the purpose of making our offer more user-friendly, effective, and secure. Furthermore, cookies enable our systems to recognize your browser even after a page change and offer you services. Some functions of our website may not be offered without the use of cookies. For these, it is necessary that the browser is recognized even after a page change.

The use of cookies or similar technologies is based on § 15 para. 3 sentence 1 TMG. The processing of your personal data is based on Art. 6 para. 1 lit. f GDPR, due to our predominant legitimate interest in ensuring the optimal functionality of the website and a user-friendly and effective design of our offer. You have the right to object at any time to the processing of your personal data for reasons arising from your particular situation.

j) Use of PayPal

All PayPal transactions are subject to the PayPal privacy policy. You can find this at https://www.paypal.com/de/webapps/mpp/ua/privacy-full4.

jj) Use of PayPal Express

We use the PayPal Express payment service on our website from PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal"). The data processing serves the purpose of being able to offer you payment via the PayPal Express payment service. To integrate this payment service, it is necessary for PayPal to collect, store, and analyze data when the website is accessed (e.g., IP address, device type, operating system, browser type, location of your device). Cookies may also be used for this purpose. The cookies allow the recognition of your browser.

The use of cookies or similar technologies is based on § 15 para. 3 sentence 1 TMG. The processing of your personal data is based on Art. 6 para. 1 lit. f GDPR, due to our predominant legitimate interest in offering various payment methods that are customer-oriented. You have the right, for reasons arising from your particular situation, to object at any time to the processing of your personal data.

By selecting and using PayPal Express, the data required for payment processing is transmitted to PayPal to fulfill the contract with you using the chosen payment method. This processing is based on Art. 6 para. 1 lit. b GDPR. Further information on data processing when using the PayPal Express payment service can be found in the corresponding privacy policy at www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=en_DE#Updated_PS.

k) Use of Google Analytics

We use the Google Analytics web analytics service on our website from Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"). If you have your usual residence in the European Economic Area or Switzerland, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is the data controller responsible for your data. Google Ireland Limited is therefore the Google affiliated company responsible for processing your data and complying with applicable data protection laws.

Data processing serves the purpose of analyzing this website and its visitors, as well as for marketing and advertising purposes. For this purpose, Google, on behalf of the operator of this website, will use the information collected to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website activity and internet usage to the website operator. The following information may be collected, among other things: IP address, date and time of page access, click path, information about the browser you are using and the device you are using (device), pages visited, referrer URL (website from which you accessed our website), location data, purchase activities. The IP address transmitted by your browser as part of Google Analytics is not combined with other data from Google.

Google Analytics uses technologies such as cookies, web storage in the browser, and tracking pixels that enable an analysis of your use of the website. The information generated by these cookies about your use of this website is usually transmitted to a Google server in the USA and stored there. IP anonymization is activated on this website.

The text you provided appears to be a privacy policy or legal document in German. Here is the English translation:

---

## Objection to Data Processing Based on Article 6(1)(f) GDPR

You have the right to object to the processing of personal data concerning you based on Article 6(1)(f) GDPR. For more information on Google reCAPTCHA and its privacy policy, please visit: [Google reCAPTCHA](https://www.google.com/recaptcha/intro/android.html) and [Google Privacy](https://www.google.com/privacy).

**t) Use of YouTube**

We use the YouTube video embedding function on our website, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "YouTube"), a company affiliated with Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

The function displays videos stored on YouTube in an iFrame on the website with the "Enhanced Privacy Mode" activated. This means that YouTube does not store information about the visitors to the website. Only when you watch a video, information is transmitted to and stored by YouTube. Your data may be transferred to the USA.

The use of cookies or similar technologies is based on § 15(3) sent. 1 TMG. The processing of your personal data is based on Article 6(1)(f) GDPR, representing our legitimate interest in the needs-based and targeted design of the website. You have the right to object to these processing activities concerning your personal data at any time for reasons arising from your particular situation.

For more information on the collection and use of data by YouTube and Google, as well as your rights and options to protect your privacy, please refer to YouTube's privacy policy at [YouTube Privacy](https://www.youtube.com/t/privacy).

**u) Use of Consentmanager**

We use the Consent Management Tool Consentmanager from Jaohawi AB (Håltegelvägen 1b, 72348 Västerås, Sweden; "Consentmanager") on our website.

The tool allows you to give consent to data processing on the website, especially the setting of cookies, and to exercise your right to revoke previously given consents.

Data processing is carried out to obtain necessary consents for data processing, document them, and thus comply with legal obligations.

Cookies may be used for this purpose. The following information may be collected and transmitted to Consentmanager: date and time of page views, information about the browser and device you are using, anonymized IP address, opt-in, and opt-out data. There is no disclosure of this data to other third parties.

Data processing is carried out to fulfill a legal obligation based on Article 6(1)(c) GDPR.

For more information on data protection at Consentmanager, please visit: [Consentmanager Privacy](https://www.consentmanager.net/privacy.php).

**5. Information on Storage Duration**

Heidebrenner GmbH, as the data controller, stores personal data of data subjects only until the purpose is achieved and beyond that only if legal regulations or provisions require it. After that, these data are either deleted manually or automatically.

It may be necessary to block records with personal data, which will then be deleted after the expiration of a legal deadline.

The legal retention period sets the framework for the duration of the storage of personal data and the deadline for deletion.

**6. Data Subject Rights**

The data controller has taken appropriate measures to provide the data subject with all information and communications relating to processing in a concise, transparent, intelligible, and easily accessible form, in clear and plain language. We present here the data subject rights as derived from the European General Data Protection Regulation.

The data subject can, in principle, and at any time, contact the data protection officer (contact details see above) regarding their data subject rights.

**a) Right to Information of the Data Subject**

The data subject has the right to obtain confirmation from the data controller as to whether or not personal data concerning them are being processed; if this is the case, they have the right to information about this personal data. This free information includes:

- the purposes of processing

- the categories of personal data processed

- the recipients or categories of recipients to whom the personal data have been or will be disclosed, especially in the case of recipients in third countries or international organizations

- if possible, the planned duration for which the personal data will be stored, or, if this is not possible, the criteria for determining this duration

- the existence of a right to rectification or erasure of personal data concerning them or to restriction of processing by the data controller or a right to object to such processing

- the existence of a right to lodge a complaint with a supervisory authority

- if the personal data are not collected from the data subject, all available information about the origin of the data

- the existence of automated decision-making, including profiling, in accordance with GDPR Article 22 paragraphs 1 and 4 and – at least in these cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject

If personal data is transferred to a third country or an international organization, the data subject has the right to be informed about the appropriate safeguards in connection with the transfer.

**b) Right to Rectification**

The data subject has the right to demand from the data controller the rectification of inaccurate personal data concerning them without undue delay. Taking into account the purposes of processing, the data subject has the right to request the completion of incomplete personal data, including by means of a supplementary statement.

**c) Right to Erasure "Right to be Forgotten"**

The data subject has the right to request the data controller to erase personal data concerning them without undue delay, and the data controller is obliged to erase personal data without undue delay if one of the following reasons applies:

- The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.

- The data subject withdraws consent on which the processing is based according to GDPR Article 6 paragraph 1 letter a or GDPR Article 9 paragraph 2 letter a, and there is no other legal ground for the processing.

- The data subject objects to the processing pursuant to GDPR Article 21 paragraph 1 and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to GDPR Article 21 paragraph 2.

- The personal data have been unlawfully processed.

- The erasure of personal data is necessary to fulfill a legal obligation under Union law or the law of the Member States to which the data controller is subject.

- The personal data have been collected in relation to the offer of information society services pursuant to GDPR Article 8 paragraph 1.

If the data controller has made the personal data public and is obliged to erase it pursuant to GDPR paragraph 1, taking into account the available technology and the implementation costs, the data controller shall take appropriate measures, including technical measures, to inform the data controllers processing the personal data that a data subject has requested the erasure of all links to this personal data or of copies or replications of this personal data.

**d) Right to Restriction of Processing**

The data subject has the right to request the data controller to restrict processing if one of the following conditions is met:

- The accuracy of the personal data is contested by the data subject, for a period enabling the data controller to verify the accuracy of the personal data.