Privacy Policy Data Protection
This privacy policy explains how we handle your personal data. We comply with applicable data protection law, in particular the General Data Protection Regulation (GDPR). With the exception of the service providers and third-party providers named in this privacy policy, we do not share your data with third parties. If you have any questions, please feel free to contact us.
Contents
- Responsible
- General information
- Data processing when accessing the website
- Cookies, tracking pixels and mobile identifiers
- Contact
- Orders and payment processing
- Other third-party services
- Rights of affected persons
Responsible
The entity responsible for data processing is
the cabinet GmbH
Kaiserstraße 8
60311 Frankfurt
General information
Provision of data
Generally, neither legally nor contractually required to provide personal data is necessary to use our website. However, if providing data is required for entering into a contract, or if the user is obligated to provide personal data, we will inform you of this fact and the consequences of not providing it in this privacy policy.
Data transfer to third countries
It is possible that we use service providers and third-party vendors located in countries outside the European Union and the European Economic Area. The transfer of personal data to such third countries is based on an adequacy decision by the European Commission (Art. 45 GDPR) or we have implemented appropriate safeguards to ensure data protection (Art. 46 GDPR). Where an adequacy decision by the European Commission exists for the data transfer to a third country, we will indicate this in this privacy policy. Furthermore, users can obtain a copy of the appropriate safeguards from us, provided these are not already included in the privacy policies of the service providers or third-party vendors.
Automated decision-making
Should we engage in automated decision-making, including profiling, we will inform you of this fact, the logic involved, and the scope and intended effects of such processing in this privacy policy. Otherwise, no automated decision-making takes place.
Processing for other purposes
Data is generally processed only for the purposes for which it was collected. If, in exceptional cases, it is to be processed for other purposes, we will inform you of these other purposes before such processing and provide all other relevant information (Art. 13 para. 3 GDPR).
Data processing when accessing the website
Each time our website is accessed, the user's browser transmits various data. The following data is processed for the duration of the visit and stored in log files even after the connection ends:
- Browser type and version used
- operating system
- Pages and files accessed
- Amount of data transferred
- Date and time of retrieval
- User's provider
- IP address
• Referrer URL
Processing this data is necessary to deliver the website to the user and optimize it for their device. Storing it in log files serves to improve the security of our website (e.g., protection against DDoS attacks).
The legal basis for processing is Article 6(1)(f) GDPR. Our legitimate interest lies in providing the website and improving website security. Log files are automatically deleted after 30 days.
The design and operation of our website is handled by the providers WordPress and WooCommerce.
Cookies, tracking pixels and mobile identifiers
We use technologies on our website to recognize the device being used. These may include cookies, tracking pixels and/or mobile identifiers.
Recognizing a device can be done for various purposes. It may be necessary to provide certain functions on our website, such as a shopping cart. Furthermore, these technologies can be used to track user behavior on the site, for example, for advertising purposes. We describe the specific technologies we use and their purposes in more detail in this privacy policy.
For a better understanding, we explain below in general terms how cookies, tracking pixels and mobile identifiers work:
• Cookies are small text files that contain certain information and are stored on the user's device. They usually consist of an identification number assigned to a device (cookie ID).
• A tracking pixel is a transparent graphic file that is embedded on a page and enables log file analysis.
• A Mobile Identifier is a unique number (Mobile ID) that is stored on a mobile device and can be read by a website.
Cookies may be necessary for our website to function properly. The legal basis for the use of such cookies is Article 6(1)(f) GDPR. Our legitimate interest lies in providing the functions of our website.
We use cookies that are not essential for the operation of our website to make our services more user-friendly or to understand how our website is used. The legal basis for this depends on whether we need to obtain the user's consent or whether we can rely on a legitimate interest. Users can withdraw their consent at any time, for example, by adjusting their browser settings.
Users can prevent and object to the processing of data using cookies by adjusting their browser settings. If you object, some features of our website may not be available. We provide further information on how to object to the processing of personal data via cookies in this privacy policy. Where applicable, we provide links labeled "Opt-Out" to which you can declare your objection.
Contact
In the event of contact, we process the user's information, date and time for the purpose of processing the request, including any follow-up questions.
The legal basis for data processing is Article 6(1)(f) GDPR. Our legitimate interest lies in responding to inquiries from our users. An additional legal basis is Article 6(1)(b) GDPR if the processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract.
The data will be deleted as soon as the request, including any follow-up questions, has been answered. We regularly review, at least every two years, whether data collected in connection with contact requests needs to be deleted.
Orders and payment processing
When you place an order in our online shop, we process the data you provide, such as your name, bank details, and payment information, to process your order. We only share payment information with our payment service providers to the extent necessary for processing the payment.
The legal basis for processing order data is Article 6(1)(b) GDPR. If the user stores their order data in a user account, the legal basis is Article 6(1)(a) GDPR. Otherwise, processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in processing refunds and pursuing claims.
Order and payment data will be deleted as soon as they are no longer required for processing the order, including any payment reversals (e.g., due to a cancellation or withdrawal from the contract) and handling warranty claims, and provided there are no legal retention obligations. If the user has saved their order data in their user account for future orders, the data will be deleted along with the user account when it is no longer needed for processing a specific order.
PayPal
When paying via PayPal, payment processing is handled by PayPal (Europe) S.à rl et Cie, SCA, 22-24 Boulevard Royal, L-2449 Luxembourg.
Stripe
When paying via Stripe, payment processing is handled by Stripe Payments Europe Ltd., C/OA & L Goodbody, Ifsc, North Wall Quay Dublin D01 H104, Ireland.
Other third-party services
Amazon Cloudfront
We use the Amazon CloudFront content delivery network (CDN). Provider: Amazon Web Services Inc., PO Box 81226, Seattle, WA 98108-1226.
Content is loaded from the CDN's servers. To establish a connection, it is technically necessary to transmit the user's IP address.
The legal basis for the processing is Article 6(1)(f) GDPR. Our legitimate interest lies in improving the speed and availability of our website.
Amazon CloudFront Privacy Policy
Google Fonts
We use Google Fonts on our website. Provider: Google Ireland Ltd., Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.
Fonts are loaded from the Google server. To establish a connection to the server, it is technically necessary to transmit the user's IP address.
The legal basis for the processing is Article 6(1)(f) GDPR. Our legitimate interest lies in reducing loading times and ensuring a uniform display on different devices.
Rights of affected persons
If a user's personal data is processed, they are a data subject within the meaning of the GDPR. Data subjects have the following rights:
Right of access: The data subject has the right to request confirmation as to whether personal data concerning him or her are being processed. Where personal data are being processed, the data subject has the right to free access to the personal data undergoing processing and to a copy of the data.
Right to rectification: The data subject has the right to request the immediate rectification of inaccurate or the completion of incomplete personal data.
Right to erasure: The data subject has the right to request the immediate erasure of personal data concerning him or her, in accordance with the legal provisions.
Right to restriction of processing: The data subject has the right, in accordance with the legal provisions, to request a restriction of the processing of personal data concerning him or her.
Right to data portability: The data subject has the right to receive the personal data concerning him or her in a structured, commonly used and machine-readable format or to request its transmission to another controller.
Right to object: The data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1) of the GDPR, including profiling based on those provisions. Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Right to withdraw consent: The data subject has the right to withdraw their consent at any time.
Right to lodge a complaint: The data subject has the right to lodge a complaint with a supervisory authority.
Privacy policy last updated: November 26, 2020