Privacy Policy

1) Introduction and Contact Details of the Controller

1.1 We are delighted that you are visiting our website and thank you for your interest. In the following, we inform you about how we handle your personal data when you use our website. Personal data is any data by which you can be personally identified.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Magnets4you e.U., Owner: Mag. Hannes Schmid, Kirchfeldgasse 30, 2102 Klein-Engersdorf, Austria,  e-mail: hello@magnets-4-you.eu The controller responsible for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2) Data collection when visiting our website

2.1 When you use our website purely for informational purposes, i.e. when you do not register or otherwise transmit information to us, we only collect the data that your browser transmits to our server (so-called "server log files"). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

• The website visited
• Date and time of access
• Amount of data sent, in bytes
• Source/referrer from which you arrived at the page
• Browser used
• Operating system used
• IP address used (if applicable, in anonymized form)

Processing takes place in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used in any other way. However, we reserve the right to subsequently check the server log files if there are concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the "https://" prefix and the padlock symbol in your browser bar.

3) Hosting & Content Delivery Network

3.1 Shopify

For hosting our website and displaying page content, we use the system of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify")

Data is also transmitted to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada

All data collected on our website is processed on the provider's servers. We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

3.2 Cloudflare

We use a content delivery network provided by: Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA

This service enables us to deliver large media files, such as graphics, page content, or scripts, more quickly via a network of regionally distributed servers. Processing takes place in order to safeguard our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6(1)(f) GDPR. We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

4) Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your device. Some of these cookies are automatically deleted after you close your browser (so-called "session cookies"); others remain on your device for longer and enable page settings to be saved (so-called "persistent cookies"). In the latter case, you can find the storage period in the overview of your web browser's cookie settings.

Where personal data is also processed by individual cookies we use, processing takes place either in accordance with Art. 6(1)(b) GDPR to perform the contract, in accordance with Art. 6(1)(a) GDPR in the case of consent granted, or in accordance with Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the website visit.

You can set your browser so that you are informed about the setting of cookies and can decide individually whether to accept them, or you can exclude the acceptance of cookies in certain cases or in general.

Please note that if you do not accept cookies, the functionality of our website may be limited.

5) Contacting us

5.1 Judge.me

We use the services of the following provider for review reminders: Judge.me Ltd., c/o Buckworths, 2nd Floor, 1-3 Worship Street, London, England, EC2A 2AB, United Kingdom

Solely on the basis of your explicit consent pursuant to Art. 6(1)(a) GDPR, we transmit your e-mail address and, where applicable, further customer data to the provider so that it can contact you by e-mail with a review reminder.

You may revoke your consent at any time with effect for the future, either to us or to the provider.

We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

For data transfers to the provider's location, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

5.2 Trustpilot

We use the services of the following provider for review reminders: Trustpilot A/S, Pilestraede 58, 1112 Copenhagen, Denmark

Solely on the basis of your explicit consent pursuant to Art. 6(1)(a) GDPR, we transmit your e-mail address and, where applicable, further customer data to the provider so that it can contact you by e-mail with a review reminder.

You may revoke your consent at any time with effect for the future, either to us or to the provider.

We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

5.3 When you contact us (e.g. via contact form or e-mail), personal data is processed exclusively for the purpose of handling and responding to your inquiry, and only to the extent necessary for this purpose.

The legal basis for processing this data is our legitimate interest in responding to your inquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted once it can be inferred from the circumstances that the matter in question has been conclusively clarified, provided no statutory retention obligations stand in the way.

6) Data processing when opening a customer account

In accordance with Art. 6(1)(b) GDPR, personal data continues to be collected and processed to the extent necessary if you provide it to us when opening a customer account. You can find out which data is required to open an account from the input screen of the corresponding form on our website.

You may delete your customer account at any time by sending a message to the controller's address given above. After your customer account has been deleted, your data will be deleted, provided that all contracts concluded through it have been fully processed, no statutory retention periods conflict with this, and we no longer have a legitimate interest in continued storage.

7) Use of customer data for direct marketing

Signing up for our e-mail newsletter

If you sign up for our e-mail newsletter, we will regularly send you information about our offers. The only mandatory information required to send you the newsletter is your e-mail address. Providing any further data is voluntary and is used to address you personally. We use what is known as the double opt-in procedure for sending the newsletter, which ensures that you only receive the newsletter once you have expressly confirmed your consent to receiving it by clicking a verification link sent to the e-mail address provided.

By activating the confirmation link, you grant us your consent to use your personal data pursuant to Art. 6(1)(a) GDPR. In doing so, we store the IP address assigned by your internet service provider (ISP) as well as the date and time of registration, in order to be able to trace any possible misuse of your e-mail address at a later date. The data we collect when you sign up for the newsletter is used strictly for this purpose.

You can unsubscribe from the newsletter at any time via the link provided in the newsletter, or by sending a corresponding message to the controller named at the outset. After unsubscribing, your e-mail address will be deleted from our newsletter distribution list without delay, unless you have expressly consented to further use of your data or we reserve the right to further use of your data that is permitted by law and about which we inform you in this policy.

8) Data processing for order fulfillment

8.1 Transmission of image files for order fulfillment by e-mail

On our website, we offer customers the option of commissioning the personalization of products by sending image files by e-mail. The submitted image is then used as a template for personalizing the selected product.

Using the e-mail address provided on the website, the customer can send us one or more image files from the storage of the device used. We collect, store, and use the files transmitted in this way exclusively for the purpose of producing the personalized product as described in the relevant service description on our website. If the transmitted image files are passed on to specific service providers for the purpose of producing and fulfilling the order, you will be explicitly informed of this in the following paragraphs. No further disclosure takes place. If the transmitted files or the digital images contain personal data (in particular depictions of identifiable persons), all of the processing operations named above take place exclusively for the purpose of fulfilling your online order pursuant to Art. 6(1)(b) GDPR.

Once the order has been fully processed, the transmitted image files are automatically and completely deleted.

8.2 Transmission of image files for order fulfillment via upload function

On our website, we offer customers the option of commissioning the personalization of products by transmitting image files via an upload function. The submitted image is then used as a template for personalizing the selected product.

Using the upload form on the website, the customer can send us one or more image files directly from the storage of the device used, via automated, encrypted data transmission. We collect, store, and use the files transmitted in this way exclusively for the purpose of producing the personalized product as described in the relevant service description on our website. If the transmitted image files are passed on to specific service providers for the purpose of producing and fulfilling the order, you will be explicitly informed of this in the following paragraphs. No further disclosure takes place. If the transmitted files or the digital images contain personal data (in particular depictions of identifiable persons), all of the processing operations named above take place exclusively for the purpose of fulfilling your online order pursuant to Art. 6(1)(b) GDPR.

Once the order has been fully processed, the transmitted image files are automatically and completely deleted.

8.3 Insofar as necessary for contract fulfillment for delivery and payment purposes, the personal data we collect is passed on to the shipping company and the credit institution commissioned, in accordance with Art. 6(1)(b) GDPR.

If we owe you updates for goods with digital elements or for digital products under a corresponding contract, we process the contact details you provided when ordering in order to inform you personally as part of our statutory information obligations pursuant to Art. 6(1)(c) GDPR. Your contact details are used strictly for this purpose, i.e. to communicate updates owed by us, and are processed by us for this purpose only to the extent necessary for the respective communication.

To fulfill your order, we also work with the following service provider(s), who support us fully or partly in carrying out concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

8.4 Disclosure of personal data to shipping service providers

- Deutsche Post

We use the following provider as a shipping service provider: Deutsche Post AG, Charles-de-Gaulle-Strasse 20, 53113 Bonn, Germany

We pass on your e-mail address and/or phone number to the provider prior to delivery of the goods, for the purpose of arranging a delivery date or announcing delivery, pursuant to Art. 6(1)(a) GDPR, provided you have given your explicit consent to this during the order process. Otherwise, for delivery purposes, we only pass on the recipient's name and delivery address to the provider, pursuant to Art. 6(1)(b) GDPR. This disclosure only takes place to the extent necessary for delivery of the goods. In this case, prior coordination of the delivery date with the provider, or advance notice of delivery, is not possible.

Consent may be revoked at any time with effect for the future, either to the controller named above or to the provider.
- DHL

We use the following provider as a shipping service provider: DHL Paket GmbH, Straesschensweg 10, 53113 Bonn, Germany

We pass on your e-mail address and/or phone number to the provider prior to delivery of the goods, for the purpose of arranging a delivery date or announcing delivery, pursuant to Art. 6(1)(a) GDPR, provided you have given your explicit consent to this during the order process. Otherwise, for delivery purposes, we only pass on the recipient's name and delivery address to the provider, pursuant to Art. 6(1)(b) GDPR. This disclosure only takes place to the extent necessary for delivery of the goods. In this case, prior coordination of the delivery date with the provider, or advance notice of delivery, is not possible.

Consent may be revoked at any time with effect for the future, either to the controller named above or to the provider.
- DHL Austria

We use the following provider as a shipping service provider: DHL Paket (Austria) GmbH, Campus 21, Liebermannstrasse F08/401, 2345 Brunn am Gebirge
Austria

We pass on your e-mail address and/or phone number to the provider prior to delivery of the goods, for the purpose of arranging a delivery date or announcing delivery, pursuant to Art. 6(1)(a) GDPR, provided you have given your explicit consent to this during the order process. Otherwise, for delivery purposes, we only pass on the recipient's name and delivery address to the provider, pursuant to Art. 6(1)(b) GDPR. This disclosure only takes place to the extent necessary for delivery of the goods. In this case, prior coordination of the delivery date with the provider, or advance notice of delivery, is not possible.

Consent may be revoked at any time with effect for the future, either to the controller named above or to the provider.
- DPD Austria

We use the following provider as a shipping service provider: DPD Direct Parcel Distribution Austria GmbH, Arbeitergasse 46, Leopoldsdorf 2333, Austria

We pass on your e-mail address and/or phone number to the provider prior to delivery of the goods, for the purpose of arranging a delivery date or announcing delivery, pursuant to Art. 6(1)(a) GDPR, provided you have given your explicit consent to this during the order process. Otherwise, for delivery purposes, we only pass on the recipient's name and delivery address to the provider, pursuant to Art. 6(1)(b) GDPR. This disclosure only takes place to the extent necessary for delivery of the goods. In this case, prior coordination of the delivery date with the provider, or advance notice of delivery, is not possible.

Consent may be revoked at any time with effect for the future, either to the controller named above or to the provider.
- GLS

We use the following provider as a shipping service provider: General Logistics Systems Germany GmbH & Co. OHG, GLS Germany-Strasse 1 – 7, 36286 Neuenstein, Germany

We pass on your e-mail address and/or phone number to the provider prior to delivery of the goods, for the purpose of arranging a delivery date or announcing delivery, pursuant to Art. 6(1)(a) GDPR, provided you have given your explicit consent to this during the order process. Otherwise, for delivery purposes, we only pass on the recipient's name and delivery address to the provider, pursuant to Art. 6(1)(b) GDPR. This disclosure only takes place to the extent necessary for delivery of the goods. In this case, prior coordination of the delivery date with the provider, or advance notice of delivery, is not possible.

Consent may be revoked at any time with effect for the future, either to the controller named above or to the provider.
- GLS Austria

We use the following provider as a shipping service provider: GLS Austria GmbH, Traunuferstrasse 110a, 4052 Ansfelden, Austria

We pass on your e-mail address and/or phone number to the provider prior to delivery of the goods, for the purpose of arranging a delivery date or announcing delivery, pursuant to Art. 6(1)(a) GDPR, provided you have given your explicit consent to this during the order process. Otherwise, for delivery purposes, we only pass on the recipient's name and delivery address to the provider, pursuant to Art. 6(1)(b) GDPR. This disclosure only takes place to the extent necessary for delivery of the goods. In this case, prior coordination of the delivery date with the provider, or advance notice of delivery, is not possible.

Consent may be revoked at any time with effect for the future, either to the controller named above or to the provider.
- Hermes

We use the following provider as a shipping service provider: Hermes Logistik Gruppe Deutschland GmbH, Essener Strasse 89, 22419 Hamburg, Germany

We pass on your e-mail address and/or phone number to the provider prior to delivery of the goods, for the purpose of arranging a delivery date or announcing delivery, pursuant to Art. 6(1)(a) GDPR, provided you have given your explicit consent to this during the order process. Otherwise, for delivery purposes, we only pass on the recipient's name and delivery address to the provider, pursuant to Art. 6(1)(b) GDPR. This disclosure only takes place to the extent necessary for delivery of the goods. In this case, prior coordination of the delivery date with the provider, or advance notice of delivery, is not possible.

Consent may be revoked at any time with effect for the future, either to the controller named above or to the provider.
- Österreichische Post

We use the following provider as a shipping service provider: Österreichische Post Aktiengesellschaft, Rochusplatz 1, 1030 Vienna, Austria

We pass on your e-mail address and/or phone number to the provider prior to delivery of the goods, for the purpose of arranging a delivery date or announcing delivery, pursuant to Art. 6(1)(a) GDPR, provided you have given your explicit consent to this during the order process. Otherwise, for delivery purposes, we only pass on the recipient's name and delivery address to the provider, pursuant to Art. 6(1)(b) GDPR. This disclosure only takes place to the extent necessary for delivery of the goods. In this case, prior coordination of the delivery date with the provider, or advance notice of delivery, is not possible.

Consent may be revoked at any time with effect for the future, either to the controller named above or to the provider.

8.5 Use of payment service providers

- PayPal

One or more online payment methods offered by the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method offered by the provider for which you pay in advance, your payment data provided during the order process (including name, address, bank and payment card information, currency, and transaction number) as well as information about the content of your order will be passed on to the provider pursuant to Art. 6(1)(b) GDPR. In this case, your data is disclosed exclusively for the purpose of processing payment with the provider and only to the extent necessary for this purpose.

If you select a payment method for which we pay in advance, you will also be asked during the order process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, e-mail address, phone number, and, where applicable, data relating to an alternative payment method).

In such cases, in order to safeguard our legitimate interest in determining your ability to pay, this data is forwarded by us to the provider pursuant to Art. 6(1)(f) GDPR for the purpose of a credit check. Based on the personal data you provide as well as further data (such as shopping cart, invoice amount, order history, payment experience), the provider checks whether the payment option you have selected can be granted with regard to payment and/or default risks.

The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. Among other things, but not exclusively, address data is included in the calculation of score values.

You may object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may remain entitled to process your personal data insofar as this is necessary for contractual payment processing.
- Shopify Payments

One or more online payment methods offered by the following provider are available on this website: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

If you select a payment method offered by the provider for which you pay in advance (e.g. credit card payment), your payment data provided during the order process (including name, address, bank and payment card information, currency, and transaction number) as well as information about the content of your order will be passed on to the provider pursuant to Art. 6(1)(b) GDPR. In this case, your data is disclosed exclusively for the purpose of processing payment with the provider and only to the extent necessary for this purpose.

9) Web analytics services

Shopify Analytics

This website uses the web analytics service of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

Data is also transmitted to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada

Using cookies and/or comparable technologies (tracking pixels, web beacons, algorithms for reading device and browser information), the service collects and stores pseudonymized visitor data, including information about the device used, such as the IP address and browser information, in order to evaluate it for statistical analysis of usage behavior on our website and to create pseudonymized usage profiles. Pseudonymization generally rules out direct attribution to a specific person. No merging with clear-text data about your person collected in another way takes place.

All processing operations described above, in particular the reading or storing of information on the device used, are only carried out if you have given us your explicit consent to do so pursuant to Art. 6(1)(a) GDPR. You may revoke your consent at any time with effect for the future by deactivating this service in the "cookie consent tool" provided on the website.

We have concluded a data processing agreement with the provider that protects our website visitors' data and prohibits disclosure to third parties.

For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

10) Website functionalities

10.1 Judge.me

Graphic elements from the following provider are embedded on our website to display external customer reviews and/or an externally awarded quality seal: Judge.me Ltd., c/o Buckworths, 2nd Floor, 1-3 Worship Street, London, England, EC2A 2AB, United Kingdom

When you access a page of our website that contains such graphic elements, your browser establishes a direct connection to the provider's servers in order to load the elements properly. In doing so, certain browser information, including your IP address, is transmitted to the provider.

Insofar as personal data is also processed in this context, this takes place in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in the optimal marketing of our offering and the attractive design of our website.

We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

For data transfers to the provider's location, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

10.2 Trusted Shops Trustbadge

Graphic elements from the following provider are embedded on our website to display external customer reviews and/or an externally awarded quality seal: Trusted Shops AG, Subbelrather Str. 15C, 50823 Cologne, Germany

When you access a page of our website that contains such graphic elements, your browser establishes a direct connection to the provider's servers in order to load the elements properly. In doing so, certain browser information, including your IP address, is transmitted to the provider.

Insofar as personal data is also processed in this context, this takes place in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in the optimal marketing of our offering and the attractive design of our website.

Further processing may take place in the event of an online order with us.

Depending on your explicit consent pursuant to Art. 6(1)(a) GDPR, your order information (order total, order number, product purchased where applicable) as well as your e-mail address are transmitted to the provider in encrypted form via the Trustbadge after an order has been completed, in order to check for an existing registration for the provider's services (in particular "buyer protection") and, where applicable, to enable new registration.

If an existing registration is found, or in the case of a new registration with the provider for its services (in particular buyer protection), your order information (order total, order number, product purchased) as well as your e-mail address are transmitted to the provider on the basis of the contractual agreement with the provider pursuant to Art. 6(1)(b) GDPR and further processed by it in order to provide the services (in particular buyer protection).

We are jointly responsible with the provider for the processing described above pursuant to Art. 26 GDPR. The agreement on joint responsibility can be viewed here: https://help.etrusted.com/hc/de/articles/23970817960082-Vertrag-%C3%BCber-die-gemeinsame-Verantwortlichkeit-nach-DSGVO

10.3 Adobe Fonts (Typekit)

This page uses so-called web fonts from the following provider for the uniform display of fonts: Adobe Systems Incorporated, 345 Park Avenue, San Jose, CA 95110-2704, USA

When you access a page, your browser loads the required web fonts into its browser cache in order to display text and fonts correctly, and establishes a direct connection to the provider's servers. In doing so, certain browser information, including your IP address, is transmitted to the provider.

The processing of personal data in connection with establishing a connection to the font provider is only carried out if you have given us your explicit consent to do so pursuant to Art. 6(1)(a) GDPR. You may revoke your consent at any time with effect for the future by deactivating this service via the "cookie consent tool" provided on the website. If your browser does not support web fonts, a standard font from your computer is used.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

10.4 Google Web Fonts

This page uses so-called web fonts from the following provider for the uniform display of fonts: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

When you access a page, your browser loads the required web fonts into its browser cache in order to display text and fonts correctly, and establishes a direct connection to the provider's servers. In doing so, certain browser information, including your IP address, is transmitted to the provider.

Data may also be transmitted to: Google LLC, USA

The processing of personal data in connection with establishing a connection to the font provider is only carried out if you have given us your explicit consent to do so pursuant to Art. 6(1)(a) GDPR. You may revoke your consent at any time with effect for the future by deactivating this service via the "cookie consent tool" provided on the website. If your browser does not support web fonts, a standard font from your computer is used.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

Further information on Google's data protection provisions can be found here: https://business.safety.google/intl/de/privacy/

11) Tools and other matters

11.1 Cookie consent tool

This website uses a so-called "cookie consent tool" to obtain effective user consent for cookies and cookie-based applications requiring consent. The "cookie consent tool" is displayed to users when they access the site, in the form of an interactive user interface on which consent can be given for specific cookies and/or cookie-based applications by ticking boxes. The use of this tool ensures that all cookies/services requiring consent are only loaded if the respective user has given the corresponding consent by ticking the relevant boxes. This ensures that such cookies are only set on the user's respective device if consent has been given.

The tool sets technically necessary cookies to store your cookie preferences. As a rule, no personal user data is processed in this context.

If, in individual cases, personal data (such as the IP address) is nevertheless processed for the purpose of storing, assigning, or logging cookie settings, this takes place in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in legally compliant, user-specific, and user-friendly consent management for cookies, and thus in the legally compliant design of our website.

Art. 6(1)(c) GDPR is a further legal basis for the processing. As the controller, we are subject to the legal obligation to make the use of technically unnecessary cookies dependent on the respective user's consent.

Where necessary, we have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

Further information about the operator and the setting options of the cookie consent tool can be found directly in the corresponding user interface on our website.

11.2 Judge.me

We use the services of the following provider to verify and publish customer reviews: Judge.me Ltd., c/o Buckworths, 2nd Floor, 1-3 Worship Street, London, England, EC2A 2AB, United Kingdom

If you submit a review on our website, your first and last name, e-mail address, order date and order number, as well as the name and international reference numbers (GTIN/ISDNF) are collected, transmitted to the provider, and evaluated there, in order to decide on the legitimacy of a customer review for a specific order. This processing takes place in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in ensuring the authenticity of customer reviews by ensuring their connection to a transaction and preventing review abuse. Once the review check and approval has been completed, the data is deleted by the provider.

For data transfers to the provider's location, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

12) Data subject rights

12.1 Applicable data protection law grants you the following data subject rights (rights to information and intervention) with respect to the controller regarding the processing of your personal data, whereby the legal basis cited applies to the respective requirements for exercising these rights:

• Right of access pursuant to Art. 15 GDPR;
• Right to rectification pursuant to Art. 16 GDPR;
• Right to erasure pursuant to Art. 17 GDPR;
• Right to restriction of processing pursuant to Art. 18 GDPR;
• Right to notification pursuant to Art. 19 GDPR;
• Right to data portability pursuant to Art. 20 GDPR;
• Right to revoke consent given pursuant to Art. 7(3) GDPR;
• Right to lodge a complaint pursuant to Art. 77 GDPR.

12.2 RIGHT TO OBJECT

IF, AS PART OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME WITH EFFECT FOR THE FUTURE, FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR IF THE PROCESSING SERVES TO ASSERT, EXERCISE, OR DEFEND LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU MAY EXERCISE THIS RIGHT TO OBJECT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

13) Duration of storage of personal data

The duration of storage of personal data is determined by the relevant legal basis, the purpose of processing and, where applicable, additionally by the respective statutory retention period (e.g. retention periods under commercial and tax law).

Where personal data is processed on the basis of explicit consent pursuant to Art. 6(1)(a) GDPR, the data concerned is stored until you revoke your consent.

Where statutory retention periods exist for data processed as part of contractual or quasi-contractual obligations on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted after the retention periods expire, provided it is no longer required for the performance of the contract or contract initiation and/or we no longer have a legitimate interest in continued storage.

Where personal data is processed on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

Where personal data is processed for direct marketing purposes on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(2) GDPR.

Unless otherwise stated in the other information in this policy regarding specific processing situations, stored personal data is otherwise deleted once it is no longer required for the purposes for which it was collected or otherwise processed.