Privacy Policy
General Provisions on Data Processing
This Privacy Policy explains the nature, scope, and purpose of the processing of personal data by the operator in the context of using the website and related services. The operator is committed to complying with applicable data protection laws, in particular the General Data Protection Regulation (GDPR) of the European Union, the German Federal Data Protection Act (BDSG), and the Telecommunications-Telemedia Data Protection Act (TTDSG).
Personal data refers to any information relating to an identified or identifiable natural person. This includes, for example, name, address, email address, or IP address. The processing of such data is always carried out in accordance with legal requirements and the provisions outlined below.
Legal Basis for Data Processing
The processing of personal data by the operator is based exclusively on one or more of the following legal bases under Article 6(1) GDPR:
- a) Consent of the data subject (Art. 6(1)(a) GDPR): where consent is required for specific processing activities.
- b) Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR): for providing services requested by the user or carrying out actions requested by the user.
- c) Compliance with a legal obligation (Art. 6(1)(c) GDPR): where the operator is legally required to process data, for example due to tax regulations or anti-money laundering laws.
- d) Legitimate interests of the operator or a third party (Art. 6(1)(f) GDPR): provided that the interests or fundamental rights and freedoms of the data subject do not override those interests. This may include ensuring IT security or fraud prevention.
Types of Personal Data Processed
The operator may collect and process the following categories of personal data:
Identification data: name, date of birth, and, if applicable, identity document details for verification purposes.
Contact data: email address, postal address, telephone number.
Financial data: payment information, transaction history.
Technical and usage data: IP address, device information, browser type, access times, website usage data.
Communication data: content of correspondence in inquiries or support cases.
Purposes of Data Processing
Personal data is processed for the following purposes:
to provide and maintain the functionality of the website and offered services.
to process transactions and fulfill contractual obligations.
to communicate with users, especially in support requests or when providing important information.
to comply with legal and regulatory requirements, such as age verification, anti-money laundering regulations, and other legal obligations.
to improve user experience and ensure the security of systems and data.
to prevent fraud and misuse.
Data Retention Period
Personal data is stored only for as long as necessary to fulfill the purposes for which it was collected, or as required by statutory retention obligations. After the purpose ceases to apply or legal retention periods expire, the data is routinely deleted or anonymized in accordance with legal requirements. This includes, in particular, commercial and tax retention periods, which in Germany may last up to ten years.
Data Disclosure and Transfer
Personal data is only disclosed to third parties when necessary for contract fulfillment, legal compliance, or safeguarding legitimate interests of the operator. This may include:
service providers acting on behalf of the operator (e.g. payment service providers, IT service providers), who are contractually bound to data protection obligations.
authorities and public institutions, where there is a legal obligation to disclose data (e.g. tax authorities, law enforcement agencies).
when transferring data to countries outside the European Economic Area (EEA), the operator ensures appropriate safeguards in accordance with Articles 44 et seq. GDPR (e.g. EU Standard Contractual Clauses).
Rights of Data Subjects
As a data subject, you have the following rights under the GDPR:
Right of access (Art. 15 GDPR): you may request information about your personal data processed by the operator.
Right to rectification (Art. 16 GDPR): you may request correction of inaccurate or completion of incomplete data.
Right to erasure (Art. 17 GDPR): you may request deletion of your data unless legal retention obligations apply.
Right to restriction of processing (Art. 18 GDPR).
Right to data portability (Art. 20 GDPR).
Right to object (Art. 21 GDPR).
Right to withdraw consent (Art. 7(3) GDPR): consent may be withdrawn at any time with future effect.
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR).
Data Security
The operator implements technical and organizational security measures to protect the data under its management against accidental or intentional manipulation, loss, destruction, or unauthorized access. Security measures are continuously improved in line with technological developments. These include encryption technologies (SSL/TLS), firewalls, and access controls.
