Table of Contents
As of September 2026
- Name and address of the controller
- Contact details of the data protection officer
- General information on data processing
- Rights of the data subject
- Provision of the website and creation of log files
- Use of cookies
- Webshop
- Ordering in the webshop
- Payment methods
- Shipping service providers
- Email contact
- Contact form
- Affiliate programs
- Review portal
- Email dispatch
- Content Delivery Networks
- Use of Matomo Analytics Software
- Use of Google Analytics
- Use of LiveChat
- Use of Meta Tracking Pixel
- Plugins used
1. Name and address of the controller
The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is:
myfolie GmbH
Von-Stauffenberg-Str, 27
82008 Unterhaching
Germany
2. Contact details of the data protection officer
The controller's data protection officer is
DataCo GmbH
Dachauer Straße 65
80335 Munich
Germany
+49 89 / 7400 45840
www.dataguard.de
3. General information on data processing
I.) Scope of the processing of personal data
As a matter of principle, we process our users' personal data only insofar as this is necessary to provide a functional webshop as well as our content and services. The processing of our users' personal data is generally carried out only with the user's consent. An exception applies in cases where it is not possible to obtain consent in advance for factual reasons and the processing of the data is required by legal provisions.
II.) Legal basis for the processing of personal data
Insofar as we obtain the consent of the data subject for processing operations involving personal data, Art. 6 para. 1 sentence 1 lit. a GDPR serves as the legal basis.
When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 sentence 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.
Insofar as the processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 para. 1 sentence 1 lit. c GDPR serves as the legal basis.
In the event that vital interests of the data subject or another natural person make the processing of personal data necessary, Art. 6 para. 1 sentence 1 lit. d GDPR serves as the legal basis.
If the processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not override the aforementioned interest, Art. 6 para. 1 sentence 1 lit. f GDPR serves as the legal basis for the processing.
III.) Data deletion and storage period
The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Data may be stored beyond this period if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the controller is subject. The data will also be blocked or deleted when a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or performance of a contract.
4. Rights of the data subject
If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:
I.) Right of access (Art. 15 GDPR)
You have the right to request confirmation from us as to whether personal data concerning you is being processed.
- If this is the case, you have the right to access this data and the following information:
- Purposes of processing
- Categories of personal data
- Recipients or categories of recipients
- The planned duration of storage or the criteria for determining this duration
- the existence of rights to rectification, erasure or restriction or to object
- Right to lodge a complaint with the competent supervisory authority
- If applicable, the origin of the data (if collected from a third party)
- If applicable, the existence of automated decision-making, including profiling, with meaningful information about the logic involved, the scope and the expected effects
- If applicable, the transfer of personal data to a third country or international organization
II.) Right to rectification (Art. 16 GDPR)
If your personal data is incorrect or incomplete, you have the right to request the immediate correction or completion of your personal data.
III.) Right to restriction of processing (Art. 18 GDPR)
If one of the following requirements is met, you have the right to request restriction of the processing of your personal data:
- You dispute the accuracy of your personal data, for a period enabling us to verify the accuracy of the personal data.
- In the context of unlawful processing, you refuse the deletion of the personal data and instead request the restriction of the use of the personal data.
- We no longer need your personal data for the purposes of processing, but you require your personal data for the establishment, exercise or defense of legal claims, or
- after you have objected to processing, for the duration of the verification as to whether our legitimate grounds override your grounds.
IV.) Right to erasure ("right to be forgotten") (Art. 17 GDPR)
If one of the following reasons applies, you have the right to request the immediate deletion of your personal data:
- Your data is no longer necessary for the processing purposes for which it was originally collected.
- You withdraw your consent and there is no other legal basis for the processing.
- You object to the processing and there are no overriding legitimate grounds for the processing, or you object pursuant to Art. 21 para. 2 GDPR.
- Your personal data is being processed unlawfully.
- Erasure is necessary to fulfill a legal obligation under Union law or the law of the member state to which we are subject.
- The personal data was collected in relation to information society services offered pursuant to Art. 8 para. 1 GDPR.
Please note that the above-mentioned reasons do not apply insofar as processing is necessary:
- For exercising the right to freedom of expression and information;
- For compliance with a legal obligation or for the performance of a task carried out in the public interest and to which we are subject.
- For reasons of public interest in the area of public health.
- For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
- for the establishment, exercise or defense of legal claims.
V.) Right to notification
If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to inform all recipients to whom the personal data concerning you has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right vis-à-vis the controller to be informed about these recipients.
VI.) Right to data portability (Art. 20 GDPR)
You have the right to receive your personal data in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller.
VII.) Right to object to certain data processing (Art. 21 GDPR)
You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6 para. 1 sentence 1 lit. e or f GDPR. This also applies to profiling based on these provisions. Where personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to profiling insofar as it is related to such direct marketing.
VIII.) Right to withdraw consent under data protection law
You have the right to withdraw your consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
IX.) Automated decision-making in individual cases, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This shall not apply if the decision is necessary for entering into or performance of a contract between you and the controller, is authorized by Union or member state law to which the controller is subject and that law contains suitable measures to safeguard your rights and freedoms and your legitimate interests, or is based on your explicit consent.
However, these decisions must not be based on special categories of personal data pursuant to Art. 9 para. 1 GDPR, unless Art. 9 para. 2 lit. a or b GDPR applies and suitable measures have been taken to protect rights and freedoms as well as your legitimate interests. With regard to the cases mentioned in a. and c., the controller shall take suitable measures to safeguard the rights and freedoms as well as your legitimate interests, which include at least the right to obtain human intervention on the part of the controller, to express your own point of view and to contest the decision.
X.) Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data concerning you infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Art. 78 GDPR. A list of the locally competent supervisory authorities in Germany can be accessed on the website of the Federal Commissioner for Data Protection at the following link:
https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html
5. Provision of the website and creation of log files
I.) Description and scope of data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.
The following data is collected:
- Information about the browser type and version used
- The user's operating system
- The user's Internet service provider
- The user's IP address
- Date and time of access
- Websites from which the user's system reaches our website
- Websites accessed by the user's system via our website
This data is stored in the log files of our system. This data is not stored together with other personal data of the user.
II.) Purpose of data processing
The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.
Storage in log files is carried out to ensure the functionality of the website. The data also serves to optimize the website and ensure the security of our information technology systems. The data is not analyzed for marketing purposes in this context.
These purposes also constitute our legitimate interest in data processing pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR.
III.) Legal basis for data processing
The legal basis for the temporary storage of the data and the log files is Art. 6 para. 1 sentence 1 lit. f GDPR.
IV.) Duration of storage
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of data collection for the provision of the website, this is the case when the respective session has ended.
In the case of data storage in log files, this is the case after seven days at the latest. Further storage is possible. In this case, the users' IP addresses are deleted or altered so that it is no longer possible to identify the accessing client.
V.) Possibility of objection
The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website. The user may object to this. Whether the objection is successful must be determined as part of a balancing of interests.
6. Use of cookies
I.) Description and scope of data processing
When you visit our website, we use technical aids for various functions, in particular cookies, which may be stored on your end device. When you access our website and at any later time, you can choose whether to generally allow cookies to be placed or which individual additional functions you would like to select. You can make changes in your browser settings or via our consent manager. Cookies are text files or information in a database that are stored on your hard drive and assigned to the browser you use, so that certain information can flow to the entity that sets the cookie. Below we describe the type of cookies we use: We use technically necessary cookies that are required for the technical structure of the website. Without these cookies, our website may not be displayed (completely correctly) or the support functions may not be available.
The following data is stored and transmitted by the technically necessary cookies:
- Session ID
- Cookie settings
We also use cookies on our website that enable an analysis of users' browsing behavior.
In this way, the following data may be transmitted:
The user data collected in this way is pseudonymized through technical precautions. It is therefore no longer possible to assign the data to the accessing user without additional information. The data is not stored together with other personal data of the users.
II.) Purpose of data processing
The purpose of using technically necessary cookies is to ensure the functionality of our website. Some functions of our website cannot be offered without the use of cookies. For these functions, it is necessary for the browser to be recognized again after a page change.
The technically necessary cookies are required for the following applications:
- Shopping cart
- Functionality of the website
- Cookie settings
III.) Legal basis for data processing
The provisions of the Telecommunications and Telemedia Data Protection Act (TTDSG) apply to the storage of information in the end user's terminal equipment and/or access to information already stored in the end user's terminal equipment. If the setting and reading of cookies is technically necessary, this is done to ensure the functionality of our website. In this case, the storage of and access to cookies on your end device is based on § 25 para. 2 no. 2 TTDSG. This storage and access to the information on your end device serve to make it easier for you to use our website and to offer you our services as requested. Some functions of our website also do not work without the use of these cookies and could therefore not be offered. Cookies are generally deleted after the end of the session (e.g. logging out or closing the browser) or after the expiry of a specified period. Information about deviating storage periods for cookies can be found in the following sections of this privacy policy.
IV.) Duration of storage, possibility of objection and removal
The user has the option to withdraw consent to the processing of personal data at any time. Cookies are stored on the user's computer and transmitted by it to our website. As a user, you therefore also have full control over the use of cookies. By changing the settings in your Internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be automated. If cookies are disabled for our website, it may no longer be possible to use all the functions of the website to their full extent.
The transmission of Flash cookies cannot be prevented via the browser settings, but can be prevented by changing the Flash Player settings.
If you use a Safari browser version 12.1 or later, cookies are automatically deleted after seven days. This also applies to opt-out cookies that are set to prevent tracking measures.
7. Webshop
We offer a webshop on our website. For this purpose, we use specially developed webshop software.
The website and the webshop are hosted on our own servers. Third parties do not have access to server log files.
The servers automatically collect and store information in so-called server log files, which your browser automatically transmits when you visit the website. The stored information is:
- Browser type and browser version
- Operating system used
- Referrer URL
- Hostname of the accessing computer
- Date and time of the server request
- IP address
No merging of this data with other data sources takes place. This data is collected on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of its website; the server log files must be recorded for this purpose. The website server is geographically located in Germany.
7.1. Customer account and storage of designs
I.) Description and scope of data processing
You have the option of creating a customer account on our website.
In particular, the following personal data is processed as part of the registration and use of the customer account:
- First and last name
- Email address
- Password (stored in encrypted form)
- Billing and delivery address
- Telephone number (optional)
- Order history
- Payment status
- Uploaded designs, graphics and print data
- Saved drafts and configurations
For business customers (B2B), the following may also be processed:
- Company name
- Contact person
- VAT identification number
- Internal reference numbers, if applicable
Uploaded designs are stored as part of contract performance and for reuse by the customer.
II.) Purpose of data processing
Processing is carried out for:
Setting up and managing the customer account
Processing and handling orders
Storing designs for reuse
Processing complaints
Fulfilling statutory retention obligations
III.) Legal basis
Processing is based on:
- Art. 6 para. 1 sentence 1 lit. b GDPR (performance of a contract)
- Art. 6 para. 1 sentence 1 lit. c GDPR (legal obligations)
- Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interest in providing a user-friendly customer account)
Insofar as designs are stored beyond the mere processing of the contract, processing may also be based on consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR.
IV.) Storage of designs and uploaded content
Designs, graphics and print data uploaded by customers are stored:
- for producing the ordered products
- to enable repeat orders
- for processing warranty and complaint cases
If a customer account exists, saved designs remain stored until the customer account is deleted, unless statutory retention obligations or technical requirements prevent this.
After the customer account has been deleted, personal data and saved designs are deleted unless statutory retention obligations apply.
Deletion from backup copies takes place as part of the usual technical deletion cycles.
V.) Responsibility for uploaded content
The user is responsible for ensuring that the uploaded content:
- does not infringe the rights of third parties (e.g. copyrights, trademark rights, personal rights)
- does not contain special categories of personal data pursuant to Art. 9 GDPR unless a separate legal basis exists for this
- We only conduct random checks of the content of uploaded designs or review them for production-related reasons.
8. Ordering in the webshop
I.) Description and scope of data processing
We offer our customers the opportunity to design their own motifs and texts online and order them as adhesive film. After completion of the ordering process, we receive personal data that we require to process the order. Mandatory information required for processing the contracts is marked separately; other information provided to us by uploading photos or contact details that are to be printed on the ordered adhesive film is voluntary. The personal data printed on the adhesive film may be forwarded to external service providers such as graphic designers. All other personal data is not transmitted to service providers outside the company.
II.) Purpose of data processing
The transmission of the personal data you provide voluntarily serves to process the contract and create the product when you purchase adhesive film.
III.) Legal basis for data processing
The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR, as the processing of the data is necessary to process the concluded purchase contract.
IV.) Duration of storage
We delete graphics/photos that you upload so that they can be printed on the adhesive film after expiry of the statutory retention obligations (for refund/warranty reasons).
All payment data and data relating to any chargebacks that may occur are stored only for as long as they are required for payment processing, the possible processing of returned direct debits and debt collection, and the prevention of misuse.
Payment data may also be stored beyond this period if and for as long as this is necessary to comply with statutory retention periods or to investigate a specific case of misuse.
Your personal data will be deleted when the statutory retention obligations expire, i.e. after 10 years at the latest.
9. Payment methods
I.) Description and scope of data processing
We offer our customers various payment methods for processing their orders. Depending on the payment method, we redirect customers to the platform of the relevant payment service provider. After the payment process has been completed, we receive the customers' payment data from the payment service providers or our bank and process it in our systems for the purposes of invoicing and accounting.
Payment via Amazon Pay
It is possible to process the payment transaction using the payment service provider AmazonPay. AmazonPay enables online payments to third parties by accessing the payment and shipping information stored in your Amazon account.
The European operating company of AmazonPay is Amazon Payments Europe s.c.a., 38 avenue J.F. Kennedy, L-1855 Luxembourg. If you already have an Amazon.de customer account, you can pay immediately using the payment method stored there, either by direct debit or credit card. Registration with your Amazon account is required for this purpose.
Further information and your order overview for payments via AmazonPay can be found at https://pays.amazon.de. When paying via Amazon Pay, all personal data communicated to or collected by Amazon Pay is primarily processed by Amazon Payments s.c.a. and secondarily by Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, all three located at 5, Rue Plaetis L 2338, Luxembourg. Further information on the processing of your data by Amazon as part of AmazonPay can be found in the Amazon Pay privacy policy at:https://pay.amazon.com/de/help/201751600
Payment by credit card
It is possible to complete the payment transaction by credit card.
If you have selected payment by credit card, payment data is passed on to payment service providers for payment processing. All payment service providers comply with the requirements of the "Payment Card Industry (PCI) Data Security Standards" and have been certified by an independent PCI Qualified Security Assessor.
The following data is generally transmitted as part of payment by credit card:
- Purchase amount
- Date and time of purchase
- First name and surname
- Address
- Email address
- Credit card number
- Credit card validity period
- Security code (CVC)
- IP address
- Telephone/mobile phone number
Payment data is passed on to the following payment service provider:
- Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Netherlands
Further information on the privacy policies as well as objection and removal options vis-à-vis the payment service providers can be found here: https://www.adyen.com/de_DE/legal/terms-and-conditions
Payment via Billie (B2B invoice purchase)
We offer the option of purchasing on account via the payment service provider Billie GmbH.
The provider is Billie GmbH, Charlottenstraße 4, 10969 Berlin, Germany
If you select purchase on account via Billie, personal data is transmitted to Billie for the purpose of conducting a credit check and processing the payment.
This includes in particular:
- First name and surname
- Billing and delivery address
- Company data (for B2B orders)
- Email address
- IP address
- Purchase amount
- Date of birth, if applicable
- Other data required for payment processing, if applicable
Billie carries out a risk assessment including a credit check. Probability values (score values) may be calculated in this process. The processing is carried out for the purpose of deciding on the establishment, performance or termination of the contractual relationship.
Further information on data processing by Billie can be found at:
https://www.billie.io/datenschutz/
Payment via Klarna (purchase on account)
We offer the option of purchasing on account via the payment service provider Klarna.
The provider is Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden.
If you select purchase on account via Klarna, personal data is transmitted to Klarna for the purpose of conducting a credit check and processing the payment.
This includes in particular:
- First name and surname
- Billing and delivery address
- Email address
- Telephone number (if applicable)
- IP address
- Purchase amount
- Date of birth (where required)
- Information on the order and, where applicable, other data required for payment processing
Klarna carries out a risk and credit assessment to decide whether to provide purchase on account. Probability values (score values) may be calculated in this process. The processing is carried out for the purpose of deciding on the establishment, performance and handling of the contractual relationship.
Further information on data processing by Klarna can be found in Klarna's privacy policy: https://www.klarna.com/de/datenschutz/
Payment via PayPal
It is possible to process the payment transaction using the payment service provider PayPal.
The provider of this payment service is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.
If you select PayPal as your payment method, the data required for payment processing is transmitted to PayPal.
This generally includes:
- First name and surname
- Billing and delivery address
- Email address
- IP address
- Purchase amount
- Date and time of purchase
- Payment method
- Other data required for payment processing, if applicable
PayPal reserves the right to conduct a credit check. Probability values (score values) may be calculated in this process. Further information on data processing by PayPal can be found at:
https://www.paypal.com/de/webapps/mpp/ua/privacy-full
Payment in advance
If you have selected payment in advance, we do not process any data other than the data transmitted by your bank. This data is used solely to verify receipt of payment.
II.) Purpose of data processing
The transmission of payment data to payment service providers serves to process the payment, e.g. when you purchase a product and/or use a service.
III.) Legal basis for data processing
The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR, as the processing of the data is necessary to process the concluded purchase contract.
IV.) Duration of storage
All payment data and data relating to any chargebacks that may occur are stored only for as long as they are required for payment processing, the possible processing of returned direct debits and debt collection, and the prevention of misuse.
Payment data may also be stored beyond this period if and for as long as this is necessary to comply with statutory retention periods or to investigate a specific case of misuse.
Your personal data will be deleted when the statutory retention obligations expire, i.e. after 10 years at the latest.
V.) Cessation of the legal basis
The payment service provider used remains entitled to process your payment data insofar as and for as long as this is necessary to process the payment in accordance with the contract. Statutory retention periods may also apply.
10. Shipping service providers
I.) Description and scope of data processing
If you order products or services on our website for which a shipping service provider is used for delivery, you will receive your order and shipping confirmation by email and, depending on the respective shipping service provider, notification that your shipment has arrived and/or notification of the parcel announcement and possible delivery options.
The data is transmitted to the following service providers:
- DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn
- General Logistics Systems Germany GmbH & Co. OHG, GLS Germany-Straße 1 - 7, DE-36286 Neuenstein
- United Parcel Service Deutschland S.à r.l. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany
The data transmitted generally includes:
II.) Purpose of data processing
The purpose of processing personal data and transmitting address data to shipping service providers is to process the concluded purchase contract and deliver the goods.
III.) Legal basis for data processing
The legal basis for transmitting your address data (first name, surname, address) to the respective shipping service provider is Art. 6 para. 1 sentence 1 lit. b GDPR, as the processing of the data is necessary to process the concluded purchase contract.
IV.) Duration of storage
The transmitted data is deleted by the respective shipping service provider once the parcel has been successfully delivered.
V.) Possibility of objection and removal
The notification service provided by the shipping service provider can be canceled by the data subject at any time. For this purpose, each email contains a corresponding opt-out link.
11. Email contact
I.) Description and scope of data processing
It is possible to contact us via the email address provided on our website. In this case, the user's personal data transmitted with the email is stored.
The data is used exclusively to process the conversation.
In connection with data processing, the data is passed on to the service provider: Zendesk Inc.
The data processing agreement with Zendesk includes so-called EU standard data protection clauses (Art. 46 para. 2 sentence 1 lit. c GDPR). These are classified as a suitable guarantee for protecting the transfer and processing of personal data outside the EU.
Further information on the processing of data by Zendesk can be found here: https://www.zendesk.de/company/agreements-and-terms/privacy-notice/
II.) Purpose of data processing
In the event of contact by email, this also constitutes the necessary legitimate interest in processing the data.
III.) Legal basis for data processing
The legal basis for processing the data transmitted in the course of sending an email is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in answering your inquiry sent by email in the best possible manner. If the email contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 para. 1 lit. b GDPR.
IV.) Duration of storage
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected and statutory retention periods no longer require the data to be retained. For personal data sent by email, this is the case when the respective conversation with the user has ended. The conversation is deemed to have ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.
V.) Possibility of objection
If the user contacts us by email, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.
Currently none, as contacting us is voluntary and purpose-specific and is only intended for customers or interested parties; deletion under the GDPR can be requested by email
All personal data stored in the course of contacting us will be deleted in this case.
12. Contact form
I.) Description and scope of data processing
A contact form is available on our website, which can be used for electronic contact. If a user takes advantage of this option, the data entered in the input mask is transmitted to us and stored.
At the time the message is sent, the following data is stored:
- Email address
- IP address of the accessing computer
- Date and time the form was submitted
- Order number & postal code if it concerns an existing order, for verification;
- Other data transmitted by the user as a message
Alternatively, it is possible to contact us via the email address provided. In this case, the user's personal data transmitted with the email is stored.
The data is used exclusively to process the conversation.
In connection with data processing, the data is passed on to the service provider: Zendesk Inc.
The data processing agreement with Zendesk includes so-called EU standard data protection clauses (Art. 46 para. 2 sentence 1 lit. c GDPR). These are classified as a suitable guarantee for protecting the transfer and processing of personal data outside the EU.
Further information on the processing of data by Zendesk can be found here: https://www.zendesk.de/company/agreements-and-terms/privacy-notice/
II.) Purpose of data processing
We process the personal data from the input mask solely for the purpose of handling the contact request. In the event of contact by email, this also constitutes the necessary legitimate interest in processing the data.
The other personal data processed during submission serves to prevent misuse of the contact form and to ensure the security of our information technology systems.
III.) Legal basis for data processing
The legal basis for processing the data transmitted when a contact form is submitted is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest lies in answering your inquiry submitted via the contact form in the best possible manner. If contacting us via the contact form is aimed at concluding a contract, the additional legal basis for processing is Art. 6 para. 1 sentence 1 lit. b GDPR.
IV.) Duration of storage
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected and statutory retention periods no longer require the data to be retained. For the personal data from the input mask of the contact form and the data sent by email, this is the case when the respective conversation with the user has ended. The conversation is deemed to have ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.
V.) Possibility of objection
The user has the option to withdraw consent to the processing of personal data at any time. If the user contacts us by email, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.
All personal data stored in the course of contacting us will be deleted in this case.
13. Affiliate programs
We also use the services of the following affiliate programs:
Belboon GmbH: Weinmeisterstraße 12-14, 10178 Berlin
The controller has integrated components from Belboon on this website. Belboon is a German affiliate network that offers affiliate marketing. If you click on an advertisement containing an affiliate link, Belboon places a cookie on your computer for conversion tracking. The cookies serve the purpose of correct billing within the affiliate program by recording the success of an advertising medium. The cookies recognize that you clicked on the advertisement and enable the source of the order at the advertiser to be traced. Belboon also uses tracking pixels. These can be used to analyze information such as visitor traffic to the pages.
The information generated by the cookies and tracking pixels about the use of this website (including the IP address) and the delivery of advertising formats is transmitted to and stored on a Belboon server. Among other things, Belboon can recognize that the affiliate link on this website was clicked. Belboon may, under certain circumstances, pass on this (anonymized) information to contractual partners; however, data such as the IP address is not merged with other stored data.
Where legally required, we have obtained your consent pursuant to Art. 6 para. 1 lit. a GDPR for the processing of your data described above. You may withdraw your consent at any time with effect for the future. If you wish to block the analysis of user behavior via cookies, you can set your browser to inform you about the setting of cookies and decide individually whether to accept them, or exclude the acceptance of cookies in certain cases or generally.
via an Internet browser or other software programs.
Further information on the processing of your personal data by Instagram and the corresponding options for objection can be found here:
Belboon: https://www.belboon.com/de/ueber-uns/datenschutz/
Firstlead GmbH (Adcell): Rosenfelder Str. 15-16, 10315 Berlin.
The controller has integrated components from Adcell on this website. Adcell is a German affiliate network that offers affiliate marketing. If you click on an advertisement containing an affiliate link, Adcell places a cookie on your computer for conversion tracking. The cookies serve the purpose of correct billing within the affiliate program by recording the success of an advertising medium. The cookies recognize that you clicked on the advertisement and enable the source of the order at the advertiser to be traced. Adcell also uses tracking pixels. These can be used to analyze information such as visitor traffic to the pages.
The information generated by the cookies and tracking pixels about the use of this website (including the IP address) and the delivery of advertising formats is transmitted to and stored on an Adcell server. Among other things, Adcell can recognize that the affiliate link on this website was clicked. Adcell may, under certain circumstances, pass on this (anonymized) information to contractual partners; however, data such as the IP address is not merged with other stored data.
Where legally required, we have obtained your consent pursuant to Art. 6 para. 1 lit. a GDPR for the processing of your data described above. You may withdraw your consent at any time with effect for the future. If you wish to block the analysis of user behavior via cookies, you can set your browser to inform you about the setting of cookies and decide individually whether to accept them, or exclude the acceptance of cookies in certain cases or generally.
Further information on the processing of your personal data by Adcell and the corresponding options for objection can be found here: https://www.adcell.de/agb#sector_6
14. Review portal
Trust-Pilot review
We participate in the review process of the provider Trustpilot A/S, Pilestræde 58, 5, 1112 Copenhagen, Denmark.
Trustpilot offers users the opportunity to review our services. Users who have used our services are asked to consent to receiving a review request. If users have given the corresponding consent (by clicking a checkbox after completing the order), they receive a review request with a link to a review page. To ensure that users have actually used our services, we transmit the data required for this purpose to Trustpilot with regard to the user and the service used (this includes the name, email address, an order number and the order date). This data is used solely to verify authenticity and contact the user.
The legal basis for processing the user's data as part of the review process is consent pursuant to Art. 6 para. 1 lit. a GDPR.
To submit a review, it is possible to open a customer account with Trustpilot. In this case, Trustpilot's terms and privacy notices apply. To maintain the neutrality and objectivity of the reviews, we have no direct influence on the reviews and cannot delete them ourselves. In this regard, we ask users to contact Trustpilot.
Further information on the processing of their data by Trustpilot as well as their rights to object and other data subject rights can be found by users in Trustpilot's privacy policy: https://de.legal.trustpilot.com/end-user-privacy-terms.
15. Email dispatch
Mandrill
We use Mandrill from Mailchimp, provided by The Rocket Science Group, LLC, 512 Means Street, Suite 404 Atlanta, GA 30318 United States.
Mandrill is used when an order is completed to send you an order confirmation as well as any payment reminders and other emails. In this process, we or our hosting provider process inventory data, contact data, content data, contract data, usage data, and meta and communication data of customers. The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR, as the processing of the data is necessary to process the concluded purchase contract.
The data processing agreement with Mandrill includes so-called EU standard data protection clauses (Art. 46 para. 2 sentence 1 lit. c GDPR). These are classified as a suitable guarantee for protecting the transfer and processing of personal data outside the EU.
Further information about Mandrill and data protection at Mandrill can be found here:http://mailchimp.com/legal/privacy/
16. Content Delivery Networks
I.) Description and scope of data processing
On our website, we use functions of the Content Delivery Network KeyCDN from proinity LLC, Reichenauweg 1, 8272 Ermatingen Switzerland. A Content Delivery Network (CDN) is a network of regionally distributed servers connected via the Internet, used to deliver content, particularly large media files such as videos. KeyCDN offers web optimization and security services, which we use to improve the loading times of our website and protect it against misuse. When you access our website, a connection is established to the servers of proinity LLC in order to retrieve content, for example. As a result, personal data may be stored and analyzed in server log files, particularly the user's activity (in particular which pages were visited) and device and browser information (in particular the IP address and operating system).
Further information on the collection and storage of data by proinity LLC can be found here: https://www.keycdn.com/privacy
II.) Purpose of data processing
The functions are used to deliver and accelerate online applications and content.
III.) Legal basis for data processing
This data is collected on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of its website; the server log files must be recorded for this purpose.
IV.) Duration of storage
Your personal information is stored for as long as necessary to fulfill the purposes described in this privacy policy or as required by law.
V.) Possibility of objection and removal
Information on options for objection and removal vis-à-vis proinity LLC can be found at: https://www.keycdn.com/privacy
17. Use of Matomo
I.) Scope of the processing of personal data
We use the open-source tracking tool Matomo (https://matomo.org/) to analyze the browsing behavior of our users. Matomo places a cookie on your computer for this purpose. Matomo's functions can be used to store and analyze personal data, in particular the user's activity (especially which pages were visited and which elements were clicked), device and browser information (especially the IP address and operating system), data about the advertisements displayed (especially which advertisements were displayed and whether the user clicked on them) and data from advertising partners (especially pseudonymized user IDs). The software is configured so that IP addresses are not stored in full; instead, 2 bytes of the IP address are masked for anonymization (e.g.: 192.168.xxx.xxx). This means that it is no longer possible to assign the shortened IP address to the accessing computer. The data is stored in our MySQL database; logs or report data are not sent to Matomo servers. Further information on the processing of data by Matomo can be found here:https://matomo.org/privacy-policy/
II.) Purpose of data processing
The processing of users' personal data enables us to analyze our users' browsing behavior. By analyzing the data collected, we are able to compile information about the use of the individual components of our online presence. This helps us to continuously improve our online presence and its user-friendliness.
III.) Legal basis for the processing of personal data
The legal basis for processing users' personal data is generally the user's consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR.
IV.) Duration of storage
Your personal information is stored for as long as necessary to fulfill the purposes described in this privacy policy or as required by law, e.g. for tax and accounting purposes.
V.) Possibility of withdrawal and removal
You have the right to withdraw your consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. You can prevent the collection and processing of your personal data by Matomo by preventing the storage of third-party cookies on your computer, using the "Do Not Track" function of a compatible browser, disabling the execution of script code in your browser or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser. You can deactivate the processing of your personal data by Matomo using the following link: https://matomo.org/privacy-policy/ Further information on options for objection and removal vis-à-vis Matomo can be found at: https://matomo.org/privacy-policy/
18. Use of Google Analytics (GA4)
I.) Scope of the processing of personal data
We use Google Analytics 4 ("GA4") to analyze user behavior on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The transfer of data to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, cannot be excluded.
Google Analytics uses cookies and processes information about the use of our website, in particular:
shortened IP address (IP anonymization / IP is not stored permanently)
Date and time of access
Pages visited / click paths
Referrer URL
Device and browser information
Approximate location data (region)
Events / conversions (e.g. completed purchase)
II.) Purpose of data processing
The processing enables us to analyze the use of our website and to optimize the functionality, user guidance and economic efficiency of our online offering.
III.) Legal basis for the processing of personal data
The legal basis is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR in conjunction with § 25 para. 1 TTDSG (setting/reading non-essential cookies). You give your consent via our consent manager and can withdraw it at any time with effect for the future.
IV.) Duration of storage
The storage period is based on the retention periods configured in Google Analytics. Data is deleted as soon as it is no longer required for the stated purposes. Further information on storage periods can be found in the settings of our consent manager or in the relevant information in the cookie settings.
V.) Possibility of withdrawal and removal
You can withdraw your consent at any time via our consent manager. You can also prevent cookies from being stored by adjusting the settings of your browser software; however, we point out that in this case you may not be able to use all functions of this website to their full extent.
Further information on data processing by Google can be found at: https://policies.google.com/privacy
19. Use of LiveChat
On our website, we use the live chat system of the provider LiveChat Inc., 1 International Pl, STE 1400 Boston, MA 02110 - 2619, USA, which is represented in the European Union by LiveChat Software SA. ul. Zwyci?ska 47, 53 - 033 Wroclaw, Poland, hereinafter referred to simply as "LiveChat". In our live chat, you have the opportunity to contact myfolie employees directly and ask questions and receive answers in a real-time chat. Data processing is based on your consent (Art. 6 para. 1 lit. a GDPR). If you do not agree to this processing, you have the option of preventing the installation of cookies by adjusting the relevant settings in your Internet browser. Details can be found above under "Privacy & Cookie Settings".
You can withdraw this consent at any time here; however, we point out that in this case you may not be able to use all functions of this website to their full extent. The lawfulness of data processing operations that have already taken place remains unaffected by the withdrawal.
Your personal data is also transferred to the USA. Since July 10, 2023, an adequacy decision, "EU-U.S. Data Privacy Framework", pursuant to Art. 45 III GDPR has been in place for the USA. The European Commission has adopted the EU-US data protection framework and determined in its decision that the United States ensures an adequate level of protection for personal data. However, the transfer of personal data to the United States only applies if the respective US data recipient is also certified under the EU-US Data Privacy Framework by the US Department of Commerce. A list of certified companies can be viewed at the following link: https://www.dataprivacyframework.gov/s/participant-search
Live Chat Inc. is certified under the Data Privacy Framework. Further information on the processing of their data by Trustpilot as well as their rights to object and other data subject rights can be found by users in LiveChat's privacy policy https://www.livechatinc.com/legal/privacy-policy/#main
20. Use of Meta Pixel
I.) Scope of the processing of personal data
We use the Meta Pixel of Meta Platforms Inc., 1601 Willow Road, Menlo Park, CA 94025, USA and its representative in the Union, Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal H , D2 Dublin, Ireland (hereinafter: Meta) on our online presence. With its help, we can track the actions of users after they have seen or clicked on a Meta advertisement. As a result, personal data may be stored and analyzed, in particular the user's activity (especially which pages were visited and which elements were clicked), device and browser information (especially the IP address and operating system), data about the advertisements displayed (especially which advertisements were displayed and whether the user clicked on them), and data from advertising partners (especially pseudonymized user IDs). This enables us to measure the effectiveness of Meta advertisements for statistical and market research purposes. Data may be transmitted to Meta servers in the USA. The data collected in this way is anonymous to us, which means that we do not see the personal data of individual users. However, this data is stored and processed by Meta. Meta may link this data to your Meta account and also use it for its own advertising purposes in accordance with Meta's Data Use Policy. Further information on the processing of data by Meta can be found here:https://de-de.facebook.com/policy.php
II.) Purpose of data processing
The Meta Pixel is used to analyze and optimize advertising activities.
III.) Legal basis for the processing of personal data
The legal basis for processing users' personal data is generally the user's consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR.
IV.) Duration of storage
Your personal information is stored for as long as necessary to fulfill the purposes described in this privacy policy or as required by law, e.g. for tax and accounting purposes.
Exercising your rights
You have the right to withdraw your consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. You can prevent the collection and processing of your personal data by Meta by preventing the storage of third-party cookies on your computer, using the "Do Not Track" function of a compatible browser, disabling the execution of script code in your browser or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser. Further information on options for objection and removal vis-à-vis Meta can be found at:https://de-de.facebook.com/policy.php
21. Plugins used
We use plugins for various purposes. The plugins used are listed below:
Microsoft Advertising (formerly Bing Ads)
Google Ads
- Provider: Google Ireland Ltd., Ireland (transfer to the USA possible)
- Purpose: Conversion tracking
- Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR (consent)
- Third-country transfer: USA possible
- Privacy information:
https://policies.google.com/privacy?gl=DE&hl=de
Google Ads Remarketing
Google Tag Manager
Google Analytics (GA4)
- Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (transfer to Google LLC, USA possible)
- Purpose: Web analysis / statistical evaluation of user behavior / website optimization
- Data processed (in particular): shortened IP address, device and browser information, referrer URL, page views, click behavior, approximate location data, conversions
- Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR (consent) in conjunction with § 25 para. 1 TTDSG
- Third-country transfer: USA possible
- Privacy information:
https://policies.google.com/privacy
https://business.safety.google/gdpr/
I.) Duration of storage
Your personal information is stored for as long as necessary to fulfill the purposes described in this privacy policy or as required by law.
II.) Transfers to third countries
When using plugins marked as involving third-country transfers or the USA, personal data may be transferred to servers in third countries outside the EU, such as the USA. The legal basis for this transfer is consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. The United States of America does not offer an adequate level of data protection based on a decision of the European Union. The material risk of the transfer lies in the obligation of plugin providers, under certain circumstances, to make user data accessible to US authorities. We currently have data processing agreements with all providers containing standard contractual clauses in order to make the transfer to third countries as data-protection-friendly and secure as possible. We are currently seeking adjustments to the judgment of the CJEU of July 16, 2020 (Schrems II, Case C-311/18), including additional security measures. A copy of the standard data protection clauses can be requested from us by informal email.
III.) Possibility of withdrawal
You have the right to withdraw your consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
You can prevent the collection and processing of your personal data by the respective providers by preventing the storage of third-party cookies on your computer, using the "Do Not Track" function of a compatible browser, disabling the execution of script code in your browser or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser.
IV.) Notice of risks
Your personal data is also transferred to the USA. There is no adequacy decision pursuant to Art. 45 para. 3 GDPR for the USA. We would like to point out that transferring data without an adequacy decision entails certain risks, which we are permitted to inform you about below: US intelligence services use certain online identifiers (such as the IP address or unique identification numbers) as a starting point for monitoring individuals. In particular, it cannot be ruled out that these intelligence services have already collected information about you that could be used to link the data transferred here to you. Providers of electronic communications services headquartered in the USA are subject to monitoring by US intelligence services pursuant to 50 U.S. Code § 1881a ("FISA 702"). Accordingly, providers of electronic communications services headquartered in the USA are obliged to provide personal data to US authorities pursuant to 50 U.S. Code § 1881a, without you potentially having any legal remedies available. Even encryption of the data in the data centers of the electronic communications service provider cannot provide adequate protection, as an electronic communications service provider has a direct obligation with regard to imported data in its possession, custody or control to grant access to or disclose it. This obligation may expressly also extend to the cryptographic keys without which the data cannot be read. The fact that this is not merely a "theoretical risk" is demonstrated by the judgment of the CJEU of July 16, 2020 (Case C 311/18, "Schrems II"). With Google, we have concluded guarantees in the form of standard data protection clauses pursuant to Art. 46 para. 2 lit. c GDPR. A copy of the standard data protection clauses can be requested from us.
