1) Introduction and Contact Details of the Controller
1.1 We are pleased that you are visiting our website and thank you for your interest. The following explains how we handle your personal data when you use our website. Personal data means any data by which you can be personally identified.
1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Nicole Grewe, MerZ IT-SerVice, Am Berndebach 35A, 57439 Attendorn, Germany, tel.: 02722631363, email: info@merz-it-service.de. The controller responsible for processing personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.
2) Data Collection When You Visit Our Website
2.1 When you use our website for information purposes only, meaning that you do not register or otherwise provide us with information, we collect only the data that your browser transmits to the website server (known as "server log files"). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:
- The page on our website that you visited
- Date and time of access
- Amount of data transmitted in bytes
- Source/referral from which you reached the page
- Browser used
- Operating system used
- IP address used (in anonymised form, where applicable)
Processing takes place in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not disclosed or used for other purposes. However, we reserve the right to review the server log files retrospectively if there are specific indications of unlawful use.
2.2 For security reasons and to protect the transmission of personal data and other confidential content (such as orders or enquiries to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string “https://“ and the padlock symbol in your browser's address bar.
3) Cookies
To make visiting our website appealing and enable certain features, we use cookies: small text files stored on your device. Some of these cookies are automatically deleted when you close your browser (known as "session cookies"), while others remain on your device for longer and allow website preferences to be stored (known as "persistent cookies"). For the latter, you can find the storage period in your web browser's cookie settings overview.
Where individual cookies we use also process personal data, processing takes place under Article 6(1)(b) GDPR for the performance of a contract, under Article 6(1)(a) GDPR where consent has been given, or under Article 6(1)(f) GDPR to safeguard our legitimate interests in the best possible website functionality and a customer-friendly, effective browsing experience.
You can configure your browser to inform you when cookies are set, allowing you to decide individually whether to accept them, or to reject cookies in specific cases or in general.
Please note that refusing cookies may restrict the functionality of our website.
4) Contacting Us
4.1 ShopVote
For review reminders, we use the services of the following provider: Blickreif GmbH, Schulstraße 46, 80634 München, Germany
Only on the basis of your express consent under Article 6(1)(a) GDPR do we transmit your email address and, where applicable, other customer data to the provider so that it can contact you by email with a review reminder.
You may withdraw your consent at any time with future effect by notifying us or the provider.
We have entered into a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.
4.2 When you contact us (for example, via a contact form or email), personal data is processed solely to handle and respond to your enquiry, and only to the extent necessary for that purpose.
The legal basis for processing this data is our legitimate interest in responding to your enquiry under Article 6(1)(f) GDPR. If your enquiry concerns entering into a contract, Article 6(1)(b) GDPR provides an additional legal basis for processing. Your data will be deleted when the circumstances indicate that the matter has been conclusively resolved, provided that no statutory retention obligations prevent this.
5) Data Processing When Opening a Customer Account
Under Article 6(1)(b) GDPR, personal data is also collected and processed to the extent necessary when you provide it to us when opening a customer account. The input fields of the relevant form on our website indicate which data is required to open an account.
You may have your customer account deleted at any time by sending a message to the controller at the address above. After your customer account is deleted, your data will be deleted, provided that all contracts concluded through the account have been fully performed, no statutory retention periods prevent deletion and we no longer have a legitimate interest in continued storage.
6) Use of Customer Data for Direct Marketing
6.1 Subscribing to Our Email Newsletter
If you subscribe to our email newsletter, we will regularly send you information about our offers. The only information required to receive the newsletter is your email address. Providing further data is voluntary and allows us to address you personally. We use the double opt-in procedure for newsletter subscriptions. This ensures that you receive newsletters only after expressly confirming your consent by clicking a verification link sent to the email address you provided.
By activating the confirmation link, you consent to our use of your personal data under Article 6(1)(a) GDPR. We store the IP address assigned by your internet service provider (ISP), together with the date and time of registration, so that any misuse of your email address can be traced at a later date. The data we collect when you subscribe to the newsletter is used strictly for its intended purpose.
You may unsubscribe from the newsletter at any time using the link provided in the newsletter or by sending a corresponding message to the controller named at the beginning of this policy. Once you unsubscribe, your email address will be removed from our newsletter mailing list without delay, unless you have expressly consented to further use of your data or we reserve the right to continue using your email address for advertising purposes as permitted by law and as explained in this policy.
After you unsubscribe from the newsletter, your email address may be stored in a suppression list and compared against recipient lists for future newsletters to technically prevent further newsletters requiring consent from being sent to you. This processing is based on our legitimate interest in preventing unwanted advertising under Article 6(1)(f) GDPR.
6.2 Sending Email Newsletters to Existing Customers
If you provided us with your email address when purchasing goods or services, we reserve the right to send you regular email offers for goods or services from our range that are similar to those you have already purchased. Under Section 7(3) of the German Act Against Unfair Competition (UWG), we do not need to obtain separate consent from you for this. Data processing is based solely on our legitimate interest in personalised direct marketing under Article 6(1)(f) GDPR. If you objected to the use of your email address for this purpose at the outset, we will not send you such emails.
You are entitled to object at any time, with future effect, to the use of your email address for the advertising purpose described above by notifying the controller named at the beginning of this policy. You will incur only transmission costs at the basic rates. Once we receive your objection, we will stop using your email address for advertising purposes without delay.
6.3 CleverReach
Our email newsletters and other promotional email communications are sent through this provider: CleverReach GmbH & Co. KG, Mühlenstr. 43, 26180 Rastede, Germany
On the basis of our legitimate interest in effective, user-friendly email marketing, we pass the data you provide when subscribing to this provider under Article 6(1)(f) GDPR so that it can send emails on our behalf.
Subject to your express consent under Article 6(1)(a) GDPR, the provider also statistically evaluates the success of email campaigns using web beacons or tracking pixels in the emails sent, which can measure opening rates and specific interactions with newsletter content. Device information (such as the time of access, IP address, browser type and operating system) is also collected and analysed, but is not combined with other datasets.
You may withdraw your consent to email tracking at any time with future effect.
We have entered into a data processing agreement with the provider that protects our website visitors' data and prohibits disclosure to third parties.
7) Data Processing for Order Fulfilment
7.1 Where necessary to perform the contract for delivery and payment purposes, the personal data we collect is passed to the commissioned transport company and financial institution under Article 6(1)(b) GDPR.
If, under a corresponding contract, we are obliged to provide you with updates for goods with digital elements or for digital products, we process the contact details you supplied when ordering to inform you personally as part of our statutory information obligations under Article 6(1)(c) GDPR. Your contact details are used strictly for notifications about updates we are obliged to provide, and we process them for this purpose only to the extent necessary for the respective notification.
7.2 Use of Payment Service Providers
- Paypal
This website offers one or more online payment methods from the following provider: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg
If you select a payment method from this provider under which you pay in advance, the payment details you supply during the ordering process (including your name, address, bank and payment card information, currency and transaction number), together with information about the contents of your order, are transmitted to the provider under Article 6(1)(b) GDPR. In this case, your data is disclosed solely to process payment with the provider and only to the extent necessary for that purpose.
If you choose a payment method under which we provide our performance before receiving payment, you will also be asked during checkout to provide certain personal details (first and last name, street, house number, postcode, town, date of birth, email address, telephone number and, where applicable, details of an alternative payment method).
To safeguard our legitimate interest in establishing your ability to pay in such cases, we forward this data to the provider for a credit check under Article 6(1)(f) GDPR. Based on the personal details you provide and other data (such as your shopping cart, invoice amount, order history and payment experience), the provider checks whether your selected payment option can be offered in view of payment and/or debt default risks.
The credit report may contain probability values (known as credit scores). Where credit scores are included in the result of the credit report, they are based on a scientifically recognised mathematical and statistical procedure. Address data is among the information used to calculate credit scores, but is not the only information used.
You may object to this processing of your data at any time by notifying us or the provider. However, the provider may remain entitled to process your personal data where this is necessary to process payment in accordance with the contract.
- Paypal Checkout
This website uses PayPal Checkout, an online payment system from PayPal that combines PayPal's own payment methods with local payment methods from third-party providers.
When paying by PayPal, credit card via PayPal, direct debit via PayPal or, where offered, "Pay Later" via PayPal, we disclose your payment details to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal") as part of payment processing. Disclosure takes place under Article 6(1)(b) GDPR and only to the extent necessary to process payment.
PayPal reserves the right to obtain a credit report for payment by credit card via PayPal, direct debit via PayPal or, where offered, "Pay Later" via PayPal. For this purpose, your payment details may be passed to credit reference agencies under Article 6(1)(f) GDPR on the basis of PayPal's legitimate interest in establishing your ability to pay. PayPal uses the result of the credit check regarding the statistical probability of payment default to decide whether to offer the respective payment method. The credit report may contain probability values (known as credit scores). Where credit scores are included in the result of the credit report, they are based on a scientifically recognised mathematical and statistical procedure. Address data is among the information used to calculate credit scores, but is not the only information used. You may object to this processing of your data at any time by notifying PayPal. However, PayPal may remain entitled to process your personal data where this is necessary to process payment in accordance with the contract.
If the PayPal "Purchase on Invoice" payment method is available and selected, your payment details are first transmitted to PayPal to prepare payment. PayPal then forwards them to Ratepay GmbH, Franklinstraße 28-29, 10587 Berlin ("Ratepay") to process payment. The legal basis in each case is Article 6(1)(b) GDPR. In this case, RatePay carries out an identity and credit check in its own name to establish your ability to pay, following the principle described above, and passes your payment details to credit reference agencies on the basis of its legitimate interest in establishing your ability to pay under Article 6(1)(f) GDPR. A list of the credit reference agencies Ratepay may use is available here: https://www.ratepay.com/legal-payment-creditagencies/
If you use a payment method from a local third-party provider, your payment details are first passed to PayPal under Article 6(1)(b) GDPR to prepare payment. Depending on the available local payment method you select, PayPal then transmits your payment details to the relevant provider under Article 6(1)(b) GDPR to process payment:
- Apple Pay (Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
- Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)
- iDeal (Currence Holding BV, Beethovenstraat 300 Amsterdam, Netherlands)
- bancontact (Bancontact Payconiq Company, Rue d'Arlon 82, 1040 Brussels, Belgium)
- blik (Polski Standard Płatności sp. z o.o., ul. Czerniakowska 87A, 00-718 Warsaw, Poland)
- eps (PSA Payment Services Austria GmbH, Handelskai 92, Gate 2
1200 Vienna, Austria)
- MyBank (PRETA S.A.S, 40 Rue de Courcelles, F-75008 Paris, France)
- Przelewy24 (PayPro SA, Kanclerska 15A, 60-326 Poznań, Poland)
For further data protection information, please refer to PayPal's privacy policy: https://www.paypal.com/de/legalhub/paypal/privacy-full
8) Web Analytics Services
Google Analytics 4
This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which enables analysis of your use of our website.
By default, Google Analytics 4 sets cookies when you visit the website. These are stored on your device as small text files and collect certain information. This information includes your IP address, although Google truncates its final digits to prevent direct identification of an individual.
The information is transmitted to Google's servers and processed there. It may also be transmitted to Google LLC, based in the USA.
Google uses the information collected on our behalf to evaluate your use of the website, compile reports on website activity for us and provide other services relating to website and internet use. The truncated IP address transmitted by your browser through Google Analytics is not combined with other Google data. Data collected through the use of Google Analytics 4 is stored for two months and then deleted.
All the processing described above, particularly the placing of cookies on your device, takes place only if you have given us your express consent under Article 6(1)(a) GDPR.
Without your consent, Google Analytics 4 will not be used during your visit. You may withdraw your consent at any time with future effect. To exercise your right of withdrawal, please disable this service using the cookie consent tool provided on the website.
We have entered into a data processing agreement with Google that ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.
Further legal information about Google Analytics 4 is available at https://business.safety.google/intl/de/privacy/, https://policies.google.com/privacy?hl=de&gl=de and at https://policies.google.com/technologies/partner-sites
Demographics
Google Analytics 4 uses the special "Demographics" feature to generate statistics about website visitors' ages, genders and interests. This involves analysing advertising and information from third-party providers, allowing target audiences for marketing activities to be identified. However, the data collected cannot be attributed to a specific person and is deleted after being stored for two months.
Google Signals
As an extension to Google Analytics 4, this website may use Google Signals to generate cross-device reports. If you have enabled personalised advertising and linked your devices to your Google account, Google may, subject to your consent to the use of Google Analytics under Article 6(1)(a) GDPR, analyse your usage behaviour across devices and create database models, including models of cross-device conversions. We receive no personal data from Google, only statistics. If you wish to stop cross-device analysis, you can disable "Personalised advertising" in your Google account settings. Follow the instructions on this page: https://support.google.com/My-Ad-Center-Help/answer/12155764?hl=de
Further information about Google Signals is available at the following link: https://support.google.com/analytics/answer/7532985?hl=de
UserIDs
As an extension to Google Analytics 4, this website may use the "UserIDs" feature. If you have consented to the use of Google Analytics 4 under Article 6(1)(a) GDPR, created an account on this website and signed in to that account on different devices, your activities, including conversions, may be analysed across devices.
For transfers of data to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with European data protection standards on the basis of an adequacy decision by the European Commission.
9) Website Features
9.1 Youtube
This website uses plugins to display and play videos from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland
Data may also be transmitted to: Google LLC., USA
When you access a page on our website containing such a plugin, your browser establishes a direct connection to the provider's servers to load the content, at the latest when the video starts playing. Certain information, including your IP address, is transmitted to the provider in this process.
If playback of embedded videos is started through the plugin, the provider also uses cookies to collect information about user behaviour, compile playback statistics and prevent misuse.
If you are logged into a user account with the provider during your visit, your data is assigned directly to your account when you click a video. If you do not want it assigned to your account, you must log out before pressing the play button.
All the processing described above, particularly the use of cookies to read information on your device, takes place only if you have given us your express consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time with future effect by disabling this service through the cookie consent tool provided on the website.
For transfers of data to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with European data protection standards on the basis of an adequacy decision by the European Commission.
9.2 ShopVote Graphics
Our website embeds graphical elements from the following provider to display external customer reviews and/or an externally awarded quality seal: Blickreif GmbH, Schulstraße 46, 80634 München, Germany
When you access a page of our website containing such graphical elements, your browser establishes a direct connection to the provider's servers to load the elements correctly. Certain browser information, including your IP address, is transmitted to the provider in this process.
Where personal data is also processed, this takes place under Article 6(1)(f) GDPR on the basis of our legitimate interest in optimally marketing our services and presenting our website attractively.
10) Tools and Miscellaneous
Cookie Consent Tool
This website uses a cookie consent tool to obtain valid user consent for cookies and cookie-based applications that require consent. When users access the website, the tool appears as an interactive interface in which they can consent to specific cookies and/or cookie-based applications by ticking the relevant boxes. The tool ensures that all cookies/services requiring consent are loaded only when the respective user has ticked the corresponding consent boxes. This ensures that such cookies are placed on the user's device only where consent has been given.
The tool sets technically necessary cookies to store your cookie preferences. As a rule, no personal user data is processed in this context.
If, in an individual case, personal data (such as an IP address) is nevertheless processed to store, assign or record cookie settings, this takes place under Article 6(1)(f) GDPR on the basis of our legitimate interest in legally compliant, user-specific and user-friendly cookie consent management and, consequently, a legally compliant website.
A further legal basis for processing is Article 6(1)(c) GDPR. As the controller, we are legally obliged to make the use of cookies that are not technically necessary dependent on the respective user's consent.
Where required, we have entered into a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.
Further information about the operator and configuration options of the cookie consent tool can be found directly in the corresponding interface on our website.
11) Rights of the Data Subject
11.1 Applicable data protection law grants you the following rights against the controller concerning the processing of your personal data (rights of access and intervention). Please refer to the legal basis cited for the conditions governing the exercise of each right:
- Right of access under Article 15 GDPR;
- Right to rectification under Article 16 GDPR;
- Right to erasure under Article 17 GDPR;
- Right to restriction of processing under Article 18 GDPR;
- Right to notification under Article 19 GDPR;
- Right to data portability under Article 20 GDPR;
- Right to withdraw consent under Article 7(3) GDPR;
- Right to lodge a complaint under Article 77 GDPR.
11.2 RIGHT TO OBJECT
WHERE, FOLLOWING A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME WITH FUTURE EFFECT ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FUNDAMENTAL FREEDOMS, OR IF PROCESSING SERVES TO ESTABLISH, EXERCISE OR DEFEND LEGAL CLAIMS.
IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING. YOU MAY EXERCISE YOUR RIGHT TO OBJECT AS DESCRIBED ABOVE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.
12) Duration of Storage of Personal Data
The duration of storage of personal data is determined by the respective legal basis, the purpose of processing and, where applicable, the relevant statutory retention period (for example, retention periods under commercial and tax law).
Where personal data is processed on the basis of express consent under Article 6(1)(a) GDPR, the data concerned is stored until you withdraw your consent.
Where statutory retention periods apply to data processed in connection with contractual or similar obligations on the basis of Article 6(1)(b) GDPR, this data is routinely deleted after the retention periods expire, provided that it is no longer necessary for performing or initiating a contract and/or we no longer have a legitimate interest in continued storage.
Where personal data is processed on the basis of Article 6(1)(f) GDPR, it is stored until you exercise your right to object under Article 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or processing serves to establish, exercise or defend legal claims.
Where personal data is processed for direct marketing on the basis of Article 6(1)(f) GDPR, it is stored until you exercise your right to object under Article 21(2) GDPR.
Unless otherwise specified in the other information in this policy concerning particular processing situations, stored personal data is otherwise deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.
