Privacy Policy

PRIVACY POLICY

1) INFORMATION ABOUT THE COLLECTION OF PERSONAL DATA AND CONTACT DETAILS OF THE DATA CONTROLLER

1.1

We are pleased that you are visiting our website and thank you for your interest. Below, we provide information about how we handle your personal data when you use our website. Personal data refers to any information that can be used to personally identify you.

1.2

The data controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Margot & Claire Banff. The data controller responsible for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

1.3

For security reasons and to protect the transmission of personal data and other confidential information (e.g. orders or inquiries sent to the data controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the “https://” prefix and the padlock symbol in your browser’s address bar.

2) DATA COLLECTION WHEN VISITING OUR WEBSITE

When you use our website for informational purposes only, meaning that you do not register or otherwise provide us with information, we only collect data that your browser transmits to our server (so-called “server log files”). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

• The website visited
• Date and time of access
• Amount of data transferred in bytes
• Source/referrer from which you accessed the website
• Browser used
• Operating system used
• IP address used (where applicable: in anonymized form)

The processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be disclosed or used for any other purpose. However, we reserve the right to subsequently review the server log files if there are specific indications of unlawful use.

3) COOKIES

To make your visit to our website more attractive and to enable the use of certain functions, we use so-called cookies on various pages. Cookies are small text files that are stored on your device. Some of the cookies we use are deleted after the end of the browser session, i.e. after you close your browser (so-called “session cookies”). Other cookies remain on your device and enable us or our partner companies (third-party cookies) to recognize your browser on your next visit (persistent cookies).

When cookies are set, they collect and process certain user information to varying degrees, such as browser and location data as well as IP address information. Persistent cookies are automatically deleted after a predefined period, which may vary depending on the cookie.

In some cases, cookies are used to simplify the ordering process by storing settings (e.g. remembering the contents of a virtual shopping cart for a later visit to the website). Where personal data is also processed by individual cookies implemented by us, the processing is carried out in accordance with Art. 6(1)(b) GDPR either for the performance of a contract or in accordance with Art. 6(1)(f) GDPR to safeguard our legitimate interests in ensuring the best possible functionality of the website and providing a customer-friendly and effective website experience.

We may work with advertising partners who help us make our online services more interesting for you. For this purpose, cookies from partner companies may also be stored on your device when you visit our website (third-party cookies). If we work with the aforementioned advertising partners, you will be informed individually and separately in the following sections about the use of such cookies and the scope of the information collected in each case.

Please note that you can configure your browser so that you are informed when cookies are set and can decide individually whether to accept them, or exclude the acceptance of cookies in certain cases or altogether. Each browser differs in the way it manages cookie settings. This is described in the help menu of each browser, which explains how you can change your cookie settings.

• Internet Explorer: https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies
• Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
• Chrome: https://support.google.com/chrome/answer/95647?hl=de&hlrm=en
• Safari: https://support.apple.com/kb/ph21411?locale=de_DE
• Opera: https://help.opera.com/en/latest/web-preferences/#cookies

Please note that if you do not accept cookies, the functionality of our website may be limited.

4) CONTACTING US

When you contact us (e.g. via a contact form or email), personal data is collected. The data collected when using a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your inquiry or contacting you and for the associated technical administration.

The legal basis for processing this data is our legitimate interest in responding to your inquiry in accordance with Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, an additional legal basis for the processing is Art. 6(1)(b) GDPR. Your data will be deleted once your inquiry has been fully processed, provided that there are no statutory retention obligations to the contrary.

5) DATA PROCESSING WHEN OPENING A CUSTOMER ACCOUNT AND FOR CONTRACT PROCESSING

In accordance with Art. 6(1)(b) GDPR, personal data will also be collected and processed if you provide it to us for the purpose of performing a contract or when opening a customer account. The data collected can be seen from the respective input forms. You may delete your customer account at any time by sending a message to the data controller at the address specified above.

We store and use the data you provide for the purpose of processing the contract. After the contract has been fully processed or your customer account has been deleted, your data will be blocked in consideration of applicable tax and commercial retention periods and will be deleted after these periods have expired, unless you have expressly consented to the continued use of your data or we have reserved the right to further use your data as permitted by law, about which we will inform you accordingly below.

6) USE OF YOUR DATA FOR DIRECT MARKETING

6.1 Subscription to Our Email Newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information required to receive the newsletter is your email address. Providing any additional information is voluntary and will be used to address you personally. We use the so-called double opt-in procedure for sending the newsletter. This means that we will only send you an email newsletter once you have expressly confirmed that you consent to receiving newsletters. We will then send you a confirmation email asking you to confirm, by clicking on the corresponding link, that you wish to receive newsletters in the future.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Art. 6(1)(a) GDPR. When you subscribe to the newsletter, we store the IP address registered by your Internet Service Provider (ISP), as well as the date and time of registration, in order to be able to trace any possible misuse of your email address at a later date. The data collected by us when you subscribe to the newsletter will be used exclusively for promotional purposes via the newsletter.

You may unsubscribe from the newsletter at any time by using the link provided in the newsletter or by sending a corresponding message to the data controller named at the beginning of this Privacy Policy. After unsubscribing, your email address will be immediately removed from our newsletter distribution list, unless you have expressly consented to the continued use of your data or we reserve the right to further use your data in a manner permitted by law and about which we inform you in this Privacy Policy.

6.2 Sending Email Newsletters to Existing Customers

If you have provided us with your email address when purchasing goods or services, we reserve the right to regularly send you offers by email for goods or services from our range that are similar to those you have already purchased. We are not required to obtain separate consent from you for this purpose. In this respect, data processing is carried out solely on the basis of our legitimate interest in personalized direct marketing in accordance with Art. 6(1)(f) GDPR.

If you initially objected to the use of your email address for this purpose, we will not send you marketing emails. You have the right to object at any time, with effect for the future, to the use of your email address for the aforementioned advertising purpose by notifying the data controller named at the beginning of this Privacy Policy. Upon receipt of your objection, the use of your email address for advertising purposes will be discontinued immediately.

7) DATA PROCESSING FOR ORDER FULFILMENT

7.1

The personal data collected by us will be passed on to the transport company commissioned with the delivery as part of the contract processing, insofar as this is necessary for the delivery of the goods. As part of payment processing, we will pass on your payment details to the commissioned financial institution, insofar as this is necessary for processing the payment. If payment service providers are used, we will provide explicit information about them below. The legal basis for the transfer of data in this context is Art. 6(1)(b) GDPR.

7.2 Use of Payment Service Providers – PayPal

When paying via PayPal, credit card via PayPal, direct debit via PayPal or, where offered, “Purchase on Account” or “Payment by Instalments” via PayPal, we transfer your payment data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (“PayPal”) as part of the payment processing. The transfer is carried out in accordance with Art. 6(1)(b) GDPR and only to the extent necessary for payment processing.

For the relevant payment methods, PayPal reserves the right to carry out a credit check. For this purpose, your payment data may be transferred to credit agencies in accordance with Art. 6(1)(f) GDPR on the basis of PayPal’s legitimate interest in determining your creditworthiness. PayPal uses the result of the credit check regarding the statistical probability of payment default for the purpose of deciding whether to provide the respective payment method.

Further information: https://www.paypal.com/de/webapps/mpp/ua/privacy-full. You may object to this processing of your data at any time by contacting PayPal. However, PayPal may still be entitled to process your personal data where this is necessary for contractual payment processing.

7.2 Use of Payment Service Providers – SOFORT

If you select the “SOFORT” payment method, payment processing is carried out by SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany (“SOFORT”), to whom we transfer the information you provide during the ordering process, together with information about your order, in accordance with Art. 6(1)(b) GDPR. SOFORT GmbH is part of the Klarna Group (Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden). Your data will be transferred exclusively for payment processing and only to the extent necessary. Further information: https://www.klarna.com/sofort/datenschutz.

8) CONTACT FOR REVIEW REMINDERS

Our Own Review Reminder (Not Sent via a Customer Review System)

We use your email address to send you a one-time reminder to submit a review of your order using the review system we use, provided that you have given us your express consent to do so during or after your order in accordance with Art. 6(1)(a) GDPR. You may withdraw your consent at any time by sending a message to the data controller responsible for data processing.

9) USE OF SOCIAL MEDIA: SOCIAL PLUGINS

9.1 Facebook Plugins Using the Shariff Solution

Any additional customs clearance costs and/or import duties are not included in the price and shall be borne by the customer. Our website uses so-called social plugins (“plugins”) from the social network Facebook, operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA (“Facebook”). To increase the protection of your data, these buttons are incorporated using an HTML link so that no connection to Facebook’s servers is established merely by accessing the page. When you click the button, a new browser window opens and takes you to Facebook, where you can interact with the plugins provided there.

Facebook Inc., based in the USA, is certified under the US-European data protection agreement “Privacy Shield,” which ensures compliance with the level of data protection applicable in the EU. Further information: https://www.facebook.com/policy.php.

9.2 Google+ Plugins Using the Shariff Solution

Our website uses social plugins from the Google+ social network, operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). The buttons are incorporated using an HTML link so that no connection to Google+ servers is established merely by accessing the page. When clicked, a new browser window opens and takes you to Google+, where you can interact with the plugins provided there.

Google LLC, based in the USA, is certified under the US-European data protection agreement “Privacy Shield.” Further information: https://www.google.com/intl/de/policies/privacy/.

9.3 Instagram Plugin Using the Shariff Solution

Our website uses social plugins from Instagram, operated by Instagram LLC, 1601 Willow Rd, Menlo Park, CA 94025, USA (“Instagram”). The buttons are incorporated using an HTML link so that no connection to Instagram’s servers is established merely by accessing the page. When clicked, a new browser window opens and takes you to Instagram, where you can interact with the plugins provided there.

Instagram LLC, based in the USA, is certified under the US-European data protection agreement “Privacy Shield.” Further information: https://help.instagram.com/155833707900388/.

10) ONLINE MARKETING

10.1 DoubleClick by Google

This website uses the online marketing tool DoubleClick by Google, operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“DoubleClick”). DoubleClick uses cookies to display relevant advertisements, improve campaign performance reports, or prevent users from seeing the same advertisements multiple times. The processing is carried out on the basis of our legitimate interest in the optimal marketing of our website in accordance with Art. 6(1)(f) GDPR.

DoubleClick can also use cookie IDs to record conversions related to advertisement requests. Due to the marketing tools used, your browser automatically establishes a direct connection with Google’s server. Through the integration of DoubleClick, Google receives information that you have accessed the relevant part of our website or clicked on one of our advertisements. If you are registered with a Google service, Google may associate the visit with your account.

You can disable cookies for conversion tracking through your browser and advertising settings. Further information: https://www.google.de/policies/privacy/.

10.2 Use of Google AdWords Conversion Tracking

This website uses the online advertising program “Google AdWords” and its conversion tracking service provided by Google LLC. We use Google AdWords to draw attention to our offers on external websites and to assess the success of individual advertising measures. The conversion tracking cookie is set when a user clicks on an AdWords advertisement placed by Google. These cookies generally expire after 30 days and are not used to personally identify users.

Each Google AdWords customer receives a different cookie. The information obtained using the conversion cookie is used to generate conversion statistics. Customers receive aggregate information but no information that can personally identify users. We use Google AdWords on the basis of our legitimate interest in targeted advertising in accordance with Art. 6(1)(f) GDPR.

Further information: https://www.google.de/policies/privacy/. Advertising cookies can be disabled through browser settings or the Google browser plug-in: https://www.google.com/settings/ads/plugin?hl=de.

11) WEB ANALYTICS SERVICES

Google (Universal) Analytics

This website uses Google Analytics, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google Analytics uses cookies that enable an analysis of your use of the website. The information generated by the cookie regarding your use of this website, including your shortened IP address, is generally transmitted to a Google server in the USA and stored there.

This website uses Google Analytics with the “_anonymizeIp()” extension, which anonymizes the IP address by shortening it. In exceptional cases, the full IP address may be transmitted to a Google server in the USA and shortened there. This processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in statistical analysis of user behaviour for optimization and marketing purposes.

On our behalf, Google uses this information to evaluate your use of the website, compile reports on website activity, and provide related services. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

You can prevent cookies from being stored using your browser settings and can prevent Google from collecting and processing the data generated by the cookie by installing the browser plug-in at https://tools.google.com/dlpage/gaoptout?hl=de. This website also uses Google Analytics for cross-device analysis using a User ID. The User ID does not contain personal data and does not transmit such data to Google.

Further information about Universal Analytics: https://support.google.com/analytics/answer/2838718?hl=de&ref_topic=6010376.

12) RETARGETING / REMARKETING / REFERRAL ADVERTISING

Facebook Custom Audience via the Pixel Method

This website uses the “Facebook Pixel” provided by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA (“Facebook”). Where explicit consent has been given, this technology makes it possible to track the behaviour of users after they have viewed or clicked on a Facebook advertisement. This process is used to evaluate advertising effectiveness for statistical and market research purposes and may help optimize future advertising activities.

The data collected is anonymous to us, but Facebook may store and process the data and link it to the respective user profile for its own advertising purposes. These processing activities are carried out exclusively where explicit consent has been given in accordance with Art. 6(1)(a) GDPR. Further information: https://www.facebook.com/about/privacy/ and https://www.aboutads.info/choices/.

Google AdWords Remarketing

Our website uses Google AdWords Remarketing to advertise this website in Google search results and on third-party websites. Google places a cookie in your browser which, using a pseudonymous cookie ID and based on pages visited, enables interest-based advertising. Processing is carried out on the basis of our legitimate interest in the optimal marketing of our website in accordance with Art. 6(1)(f) GDPR.

Further processing takes place where you have agreed with Google that your internet and app browsing history may be linked to your Google Account and used to personalize advertisements. Advertising cookies can be disabled via https://www.google.com/settings/ads/onweb/ or through browser settings. Further information: https://www.google.com/policies/technologies/ads/.

13) RIGHTS OF THE DATA SUBJECT

13.1

The applicable data protection law grants you comprehensive rights as a data subject with regard to the processing of your personal data by the data controller. These include the following rights:

• Right of Access pursuant to Art. 15 GDPR: You have the right to obtain information about the personal data we process concerning you, the purposes and categories of processing, recipients, storage periods, your related rights, the source of data not collected directly from you, automated decision-making including profiling, and safeguards for transfers to third countries.
• Right to Rectification pursuant to Art. 16 GDPR: You have the right to request the immediate correction of inaccurate personal data and/or completion of incomplete data.
• Right to Erasure pursuant to Art. 17 GDPR: You have the right to request erasure where the statutory conditions are met, subject to applicable exceptions.
• Right to Restriction of Processing pursuant to Art. 18 GDPR: You may request restriction of processing in the circumstances provided by the GDPR.
• Right to Notification pursuant to Art. 19 GDPR: Where rectification, erasure or restriction applies, the controller must communicate this to recipients unless impossible or disproportionate; you may request information about those recipients.
• Right to Data Portability pursuant to Art. 20 GDPR: You have the right to receive personal data you provided in a structured, commonly used and machine-readable format or request transmission to another controller where technically feasible.
• Right to Withdraw Consent pursuant to Art. 7(3) GDPR: You may withdraw consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right to Lodge a Complaint pursuant to Art. 77 GDPR: You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.

13.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTERESTS AS PART OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO OBJECT TO SUCH PROCESSING WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING PURPOSES.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

14) DURATION OF STORAGE OF PERSONAL DATA

The duration for which personal data is stored is determined on the basis of the applicable statutory retention periods (e.g. retention periods under commercial and tax law). Once the applicable retention period has expired, the relevant data will be routinely deleted, provided that it is no longer required for the performance or initiation of a contract and/or we no longer have a legitimate interest in continuing to store the data.