Privacy policy

Privacy Policy

Name and contact details of the controller and the external data protection officer

This privacy information applies to data processing by:

Controller: EBROM, Thomas Schmolinski & Sven Wiechers GbR, Forststraße 4a, 83123 Amerang, Tel.: +49/8074/9176911, E-Mail: info@ebrom.de

 

2. Collection and storage of personal data as well as the nature and purpose of their use
3. a) When visiting the website

When you simply access our website www.ebrom.de, information is automatically sent to our website's server by the browser used on your device, i.e., without any action on your part. This information is temporarily stored in a log file. The following information is collected without your intervention and stored until automatic deletion:

IP address of the requesting computer, date and time of access, name and URL of the accessed file, website from which access is made (referrer URL), content of the request, browser used and, if applicable, the operating system of your computer as well as the name of your access provider, language and version of the browser software, time zone difference to Greenwich Mean Time (GMT)

The aforementioned data is processed by us for the purpose of technically enabling the viewing of the website and ensuring its stability and security.

The IP addresses are stored in the log files in an anonymized form. By deleting the last few digits of the IP addresses, any personal reference is removed.

The legal basis for data processing is Art. 6(1) sentence 1 lit. f GDPR. Our legitimate interest follows from the data collection purposes listed above. In no case do we use the collected data for the purpose of drawing conclusions about your person.

According to Art. 6(1) lit. c), Art. 32 GDPR, we are obliged to ensure data security and also base data processing on this aspect.

Insofar as the sole purpose of storing information in the end user's terminal equipment (e.g., a cookie on their computer) or the sole purpose of accessing information already stored in the end user's terminal equipment is strictly necessary for us to provide the telemedia service expressly requested by the user (e.g., our website/our shop), the legal basis is Section 25(2) TDDDG.

 

1. b) When using our contact form

For questions of any kind, we offer you the possibility to contact us via a form provided on the website. Providing a valid email address and name is required so that we know who the request is from and to be able to respond to it. Further information can be provided voluntarily.

Data processing for the purpose of establishing initial contact with us takes place according to Art. 6(1) sentence 1 lit. f GDPR on the basis of our legitimate economic interest in enabling new customers to contact us easily. Furthermore, the contact request enables us and our customers to carry out pre-contractual measures and fulfill contracts according to Art. 6(1) sentence 1 lit. b) GDPR. In addition, the processing of data from the contact form can be based on your consent according to Art. 6(1) sentence 1 lit. a GDPR, provided it is obtained.

The personal data collected by us for the use of the contact form will be automatically deleted after your request has been settled.

1. c) Use of our web shop

If you would like to order from our web shop, it is necessary for the conclusion of the contract that you provide your personal data, which we need for the processing of your order. Mandatory information required for the execution of the contracts is marked separately; further information is voluntary. We process the data you provide to process your order. For this purpose, we may pass on your payment data to our principal bank. The legal basis for this is Art. 6(1) sentence 1 lit. b GDPR.

You can voluntarily create a customer account, in which your data is saved for further purchases. You can request the deletion of your customer account and your personal data. Statutory retention obligations, especially for already completed orders and invoices, remain unaffected by this.

We use Shopify for our web shop. You can find Shopify's general privacy policy at the following link https://www.shopify.com/de/legal/datenschutz and the privacy policy for customers at https://www.shopify.com/de/legal/privacy/customers

VAT identification number and invoicing

If you provide a VAT identification number for a cross-border business order, we will process it to check the VAT treatment of your order. Shopify checks the number via the European VAT Information Exchange System (VIES). A successfully validated number can be saved in the Shopify customer profile for future orders.

We also process the order, company, address, and tax data required for order processing and invoicing in our order management system, PlentyONE. The legal bases are Art. 6(1) lit. b GDPR for contract execution and Art. 6(1) lit. c GDPR for the fulfillment of relevant tax law obligations.

We may also process the data provided by you to inform you about other interesting products from our portfolio or to send you emails with technical information.

We store the data required for contract execution and invoicing as long as necessary for these purposes. Where statutory commercial or tax retention obligations exist, the retention period depends on the respective type of document and the applicable statutory deadline. Once the purpose of processing ceases to exist, the data will be deleted, provided there is no retention obligation or other legal basis to the contrary.

To prevent unauthorized access by third parties to your personal data, especially financial data, the ordering process is encrypted using TLS technology.

1. d) Contacting via email, telephone, or fax

If you contact us via email, telephone, or fax, your request, including all personal data resulting therefrom (name, request), will be stored and processed by us for the purpose of handling your concern. We do not pass on this data without your consent.

The processing of this data takes place on the basis of Art. 6(1) lit. b GDPR, provided your request is related to the fulfillment of a contract or is necessary for the performance of pre-contractual measures. In all other cases, processing is based on your consent (Art. 6(1) lit. a GDPR) and/or our legitimate interests (Art. 6(1) lit. f GDPR), as we have a legitimate interest in effectively handling requests addressed to us.

The data you send to us via contact requests remains with us until you request deletion, revoke your consent for storage, or the purpose for data storage no longer applies (e.g., after your request has been processed). Mandatory statutory provisions – especially statutory retention periods – remain unaffected.

1. e) Use of Google Web Fonts

Our website uses Google Web Fonts, provided by Google, for the uniform and better display of fonts. When calling up a page, your browser loads the required web fonts (types) into your browser cache to display text and fonts correctly.

For this purpose, your internet browser will establish a connection to Google's servers. Through this, Google may become aware that our website has been accessed via the IP address assigned to you by your provider.

The use of Google Web Fonts is in the interest of ensuring the perfect technical function of the page layout and in the sense of a uniform and good presentation of our online offer. This results in a legitimate interest within the meaning of Art. 6(1) lit. f GDPR.

If your browser does not support web fonts, a standard font from your computer will be used.

Further information on Google Web Fonts can be found at https://developers.google.com/fonts/faq and in Google's privacy policy: https://www.google.com/policies/privacy/.

3. Cookies/data stored on the user's terminal equipment

Our website uses cookies. The use of cookies serves to make our offer more pleasant and, if applicable, to identify you for subsequent visits.

 

We use Shopify to operate our online shop. Cookies are used for the shop to function; you can find precise information about what data is stored in the browser by Shopify cookies at https://www.shopify.com/de/legal/cookies. These cookies ensure the functionality and security of the shop.

 

Detailed general information about cookies can be found at https://de.wikipedia.org/wiki/HTTP-Cookie

 

Cookies are small text files that are stored on your hard drive, assigned to the browser. Information flows to the entity setting the cookie. Cookies cannot execute programs or transmit viruses to your computer. They serve to make the overall offer more user-friendly and effective.

 

There are two different types of cookies: transient cookies and persistent cookies. These cookies differ both in how they can be deleted and in their function:

 

Persistent cookies are deleted automatically after a specified duration, which depends on the cookie. You can delete persistent cookies at any time in your browser's security settings.

 

Transient cookies are deleted automatically when you close the browser. This includes, in particular, session cookies. These store a so-called session ID, with which various requests from your browser can be assigned to the joint session. This allows your computer to be recognized when you return to our website. The session cookies are deleted when you log out or close the browser.

 

We recommend that you regularly delete your cookies and browser history manually to hinder the monitoring and tracking of your page visits.

 

You can configure your browser settings according to your wishes and, for example, refuse the acceptance of third-party cookies or all cookies. However, it may happen that you might not be able to use all the functions of this website.

 

Cookies are generally stored on the legal basis of Art. 6(1) sentence 1 lit. a GDPR, i.e., only with your consent. This consent to the storage of information on your device is also required according to Section 25(1) TDDDG.

The legal basis is Art. 6(1) sentence 1 lit. f GDPR, with our legitimate interest arising from the aforementioned purposes. Within the scope of contract fulfillment (shop), we can rely on Art. 6(1) sentence 1 lit. b GDPR. Furthermore, storage is also possible according to Section 25(2) TDDDG if we can only provide our service under this condition.

 

A Consent Manager is used by us to obtain this consent. This records all cookies and plugins used.

 

We use the Consentmo GDPR application on our website to obtain your consent to store certain cookies on your device or to use certain technologies and to document this in a data-protection-compliant manner.

The data processing agreement for Consentmo GDPR can be found at https://www.consentmo.com/data-processing-addendum

EU Withdrawal Button (Anviara)

To fulfill our legal obligation to provide an electronic withdrawal function (Section 356a BGB), we use the "EU Withdrawal Button" app from the provider Anviara LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA. If you declare a withdrawal via this function, the data you enter (name, email address, order or contract number, possibly reason for withdrawal, language, and a timestamp) will be processed to receive your withdrawal, send you an acknowledgment of receipt on a durable medium, and notify us as the merchant. The legal basis is Art. 6(1) lit. c GDPR (fulfillment of a legal obligation). Anviara processes the withdrawal data as a data processor. According to the provider, app servers, databases, and encrypted backups are operated in Germany by Hetzner in Falkenstein. This concerns the app data stored there. Further service providers are used for transmission, email sending, and support if necessary, in particular Cloudflare (USA) for transmission, MailerSend (USA, EU data region Belgium) for confirmation emails and merchant notifications, and Zoho (USA, EU data centers Netherlands/Ireland, possible support access from India) for support. The provider identifies appropriate safeguards for this, in particular EU standard contractual clauses. Processing is therefore not exclusively limited to Germany. You can find the provider's privacy policy at https://anviara.com/apps/eu-withdrawal-button/policy/.

 

Mandatory functions technically necessary for displaying the website: The technical structure of the website requires us to use techniques, especially cookies. Without these techniques, our website cannot be displayed (fully correctly), or support functions could not be enabled. These are generally transient cookies, which are deleted after the end of your website visit, at the latest when your browser is closed. These cookies cannot be deselected if you wish to use our website. The individual cookies are visible in the Consent Manager. The legal basis for this processing is Art. 6(1) sentence 1 lit. f GDPR.

 

 

 

 

 

 

Optional cookies upon granting your consent: We only set various cookies after your consent, which you can select via the so-called Cookie Consent Tool during your first visit to our website. The functions are only activated in the event of your approval and can, in particular, serve to allow us to analyze and improve visits to our website, to make operation via different browsers or devices easier for you, to recognize you upon a visit, or to serve advertising (possibly also to orient advertising to interests, measure the effectiveness of advertisements, or show interest-based advertising). The legal basis for this processing is Art. 6(1) sentence 1 lit. a GDPR. Revocation of your consent is possible at any time, without affecting the legality of the processing until the revocation.

 

 

4. Disclosure of data, particularly to shipping and payment service providers

A transmission of your personal data to third parties for purposes other than those listed below does not take place.

We only pass on your personal data to third parties if:

• You have given your express consent to this pursuant to Art. 6(1) sentence 1 lit. a GDPR,
• The disclosure pursuant to Art. 6(1) sentence 1 lit. f GDPR is required for the assertion, exercise, or defense of our legal claims and there is no reason to assume that you have an overriding legitimate interest in the non-disclosure of your data,
• In the event that there is a legal obligation for the disclosure pursuant to Art. 6(1) sentence 1 lit. c GDPR, as well as
• This is legally permissible and required pursuant to Art. 6(1) sentence 1 lit. b GDPR for the processing of contractual relationships with you; this applies in particular to the transfer of data to mail-order service providers, such as transporters, freight forwarders, as well as postal and parcel service providers
• For the processing of payments, we pass on the necessary payment data to the credit institution commissioned with the payment and, if applicable, to payment service providers commissioned by us or to the payment service selected by you in the ordering process. This is done for the fulfillment of contractual obligations pursuant to Art. 6(1) lit. b GDPR if you select the corresponding payment method. Regarding the payment services in detail:

Payment is made via Shopify Payments and PayPal, to be selected upon completion of the order.

• Services from Shopify Payments:

We offer you the services of Shopify Payments as shown at https://www.shopify.com/de/payments and under the conditions of Shopify Payments. When using the payment service provider "Shopify Payments," payment processing is carried out by Shopify International Limited, Victoria Buildings, 2nd Floor

1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, subject to the Shopify Terms of Service, available at https://www.shopify.com/de/legal/terms-payments-de. This involves the transfer of data to this company. You can find the privacy policy for Shopify Payments at https://www.shopify.com/de/legal/datenschutz.

• Services provided by PayPal: PayPal, PayPal Plus services
  
  We offer you the services of PayPal Plus as shown at https://www.paypal.com/de/webapps/mpp/paypal-plus and under the terms and conditions of PayPal; this includes PayPal, direct debit, credit card, payment on invoice, and installment payment.
  When using the "PayPal" payment service provider, payment processing is handled by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, subject to the PayPal Terms of Use, available at www.paypal.com. This requires, among other things, that the customer opens a PayPal account or already has such an account. This involves the transfer of data to this company. You can find the PayPal privacy policy at https://www.paypal.com/de/webapps/mpp/ua/privacy-full
  
  

5. Newsletter

You can subscribe to our newsletter, through which we inform you about our current interesting offers, by declaring your consent. The goods and services advertised are named in the declaration of consent.1

We use the so-called double opt-in procedure for registration for our newsletter. This means that after you register, we will send an email to the email address provided, in which we ask you to confirm that you are the owner of the email address provided and that you wish to receive the notifications. If you do not confirm your registration within 24 hours, your information will be blocked and automatically deleted after one month. In addition, we store the IP addresses you used and the times of registration and confirmation. The purpose of the procedure is to be able to verify your registration and, if necessary, to clarify any possible misuse of your personal data.2

The only mandatory information for sending the newsletter is your email address. The provision of further, separately marked data is voluntary and is used to be able to address you personally. After your confirmation, we store your email address for the purpose of sending the newsletter. The legal basis is Art. 6 (1) sentence 1 lit. a GDPR.4

You can revoke your consent to receive the newsletter at any time and unsubscribe from the newsletter. You can declare the revocation by clicking on the link provided in every newsletter email, by sending an email to info@ebrom.de, or by sending a message to the contact details provided in the legal notice.

 

 

 

 

6. Rights of the data subject

You have the right:

• to request information about your personal data processed by us in accordance with Art. 15 GDPR. In particular, you can request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your data if it was not collected by us, as well as the existence of automated decision-making, including profiling, and, if applicable, meaningful information about its details;
• to request the immediate rectification of inaccurate or completion of your personal data stored by us in accordance with Art. 16 GDPR;
• to request the erasure of your personal data stored by us in accordance with Art. 17 GDPR, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims;
• to request the restriction of the processing of your personal data in accordance with Art. 18 GDPR, insofar as the accuracy of the data is contested by you, the processing is unlawful but you oppose its erasure, and we no longer require the data, but you require it for the establishment, exercise, or defense of legal claims, or you have objected to the processing in accordance with Art. 21 GDPR;
• to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format or to request transmission to another controller in accordance with Art. 20 GDPR;
• to revoke your consent at any time in accordance with Art. 7 (3) GDPR. As a result, we are no longer allowed to continue the data processing based on this consent for the future; and
• to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company headquarters for this purpose.

7. Right to object

If your personal data is processed on the basis of legitimate interests in accordance with Art. 6 (1) sentence 1 lit. f GDPR, you have the right to object to the processing of your personal data in accordance with Art. 21 GDPR, provided there are reasons for this arising from your particular situation or the objection is directed against direct marketing. In the latter case, you have a general right to object, which we will implement without you needing to specify a particular situation.

If you would like to exercise your right of revocation or objection, an email to info@ebrom.de is sufficient.

 

 

8. Right to withdraw consent

If the processing of your data is based on consent given to us, you can withdraw this at any time. Such a withdrawal affects the permissibility of processing your personal data after you have communicated it to us.

If you would like to exercise your right to withdraw consent, an email to info@ebrom.de is sufficient.

9. Data security

During your website visit, we use the widespread SSL (Secure Socket Layer) method in conjunction with the highest level of encryption supported by your browser. As a rule, this is 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can tell whether an individual page of our website is transmitted in encrypted form by the closed representation of the key or lock symbol in the lower status bar of your browser.

Otherwise, we use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.

11. Updates and changes to this privacy policy

This privacy policy is currently valid. Status is 30.08.2023

Due to the further development of our website and offers or due to changed legal or official requirements, it may become necessary to change this privacy policy. The current privacy policy can be accessed and printed by you at any time on the website at https://ebrom24.de/en/pages/datenschutz.