Privacy policy
1) Introduction and Contact Details of the Controller
**1.1 **We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about how we handle your personal data when you use our website. Personal data means any data by which you can be personally identified.
**1.2 **The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Nikel, Annette und Hauck, Sascha GbR, Wilhelmshöher Allee 182, 34119 Kassel, Germany, Tel.: +49 176 34256374, Email: info@this-is-delulu.com. The controller responsible for processing personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.
2) Data Collection When Visiting Our Website
When you use our website for purely informational purposes, meaning that you do not register or otherwise provide us with information, we only collect data that your browser transmits to the website server, known as “server log files”. When you access our website, we collect the following data, which is technically necessary for us to display the website to you:
- The website visited
- Date and time of access
- Amount of data transmitted in bytes
- Source or referring page from which you accessed the website
- Browser used
- Operating system used
- IP address used, where applicable in anonymised form
The processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not disclosed or used for any other purpose. However, we reserve the right to review the server log files retrospectively if there are specific indications of unlawful use.
3) Hosting & Content Delivery Network
3.1 Shopify
For hosting our website and displaying its content, we use the system of the following provider:
Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”).
Data is also transferred to:
Shopify Inc., 150 Elgin Street, Ottawa, ON K2P 1L4, Canada.
All data collected on our website is processed on the provider’s servers. We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.
For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.
3.2 Cloudflare
We use a content delivery network provided by:
Cloudflare Inc., 101 Townsend Street, San Francisco, CA 94107, USA.
This service enables us to deliver large media files, such as graphics, website content or scripts, more quickly via a network of regionally distributed servers. The processing is carried out pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interest in improving the stability and functionality of our website.
We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.
For data transfers to the United States, the provider has certified itself under the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.
4) Cookies
To make your visit to our website attractive and to enable the use of certain functions, we use cookies, which are small text files stored on your device.
Some of these cookies are automatically deleted after you close your browser, known as “session cookies”. Other cookies remain on your device for a longer period and enable website settings to be saved, known as “persistent cookies”. In the latter case, you can find the storage duration in your web browser’s cookie settings overview.
Where personal data is also processed by individual cookies used by us, the processing is carried out pursuant to Art. 6(1)(b) GDPR for the performance of a contract, pursuant to Art. 6(1)(a) GDPR where consent has been granted, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in ensuring the best possible functionality of the website and a customer-friendly and effective website experience.
You can configure your browser to inform you when cookies are being set and to allow you to decide individually whether to accept them, or to exclude the acceptance of cookies in certain cases or generally.
Please note that the functionality of our website may be limited if cookies are not accepted.
5) Contacting Us
When you contact us, for example via a contact form or email, personal data is processed exclusively for the purpose of handling and responding to your enquiry and only to the extent necessary for this purpose.
The legal basis for processing this data is our legitimate interest in responding to your enquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at entering into a contract, Art. 6(1)(b) GDPR serves as an additional legal basis for processing.
Your data will be deleted once it can be inferred from the circumstances that the matter in question has been conclusively resolved, provided that no statutory retention obligations prevent deletion.
6) Comment Function
When using the comment function on this website, in addition to your comment, information regarding the time the comment was created and the commenter name selected by you will be stored and published on this website.
Your IP address will also be logged and stored. The IP address is stored for security reasons and in case the data subject infringes the rights of third parties or posts unlawful content through a submitted comment.
We require your email address so that we can contact you if a third party objects to your published content on the grounds that it is unlawful.
The legal bases for storing your data are Art. 6(1)(b) and Art. 6(1)(f) GDPR. We reserve the right to delete comments if they are reported by third parties as unlawful.
7) Data Processing When Opening a Customer Account
Pursuant to Art. 6(1)(b) GDPR, personal data will continue to be collected and processed to the extent necessary if you provide it to us when opening a customer account.
The data required to open an account can be found in the input fields of the corresponding form on our website.
You may delete your customer account at any time by sending a message to the controller at the address stated above.
Following deletion of your customer account, your data will be deleted provided that all contracts concluded through the account have been fully processed, no statutory retention periods prevent deletion and we have no continuing legitimate interest in retaining the data.
8) Use of Customer Data for Direct Advertising
Subscription to Our Email Newsletter
If you subscribe to our email newsletter, we will regularly send you information about our offers.
The only mandatory information required to send the newsletter is your email address. Providing any additional data is voluntary and is used to address you personally.
We use the double opt-in procedure for newsletter subscriptions. This ensures that you only receive newsletters after expressly confirming your consent to receive them by clicking a verification link sent to the email address provided.
By activating the confirmation link, you consent to our use of your personal data pursuant to Art. 6(1)(a) GDPR.
In this context, we store the IP address registered by your internet service provider and the date and time of registration so that we can trace any possible misuse of your email address at a later date.
The data collected by us when you subscribe to the newsletter is used strictly for the stated purpose.
You can unsubscribe from the newsletter at any time by using the link provided in the newsletter or by sending a corresponding message to the controller named at the beginning of this privacy policy.
After you unsubscribe, your email address will be deleted immediately from our newsletter distribution list unless you have expressly consented to further use of your data or we reserve the right to use the data beyond this scope where permitted by law and where we inform you of such use in this privacy policy.
9) Data Processing for Order Fulfilment
To the extent necessary for processing the contract for delivery and payment purposes, the personal data collected by us will be transferred pursuant to Art. 6(1)(b) GDPR to the commissioned transport company and the commissioned financial institution.
Where we are required under a corresponding contract to provide you with updates for goods with digital elements or for digital products, we process the contact details provided by you when placing the order in order to inform you personally in accordance with our statutory information obligations pursuant to Art. 6(1)(c) GDPR.
Your contact details will be used strictly for the purpose of communicating updates owed by us and will only be processed by us to the extent necessary for the respective notification.
For the purpose of processing your order, we also cooperate with the service provider or service providers listed below, who assist us wholly or partly in performing the contracts concluded.
Certain personal data is transmitted to these service providers in accordance with the following information.
10) Rights of the Data Subject
10.1 Rights of Access and Intervention
The applicable data protection law grants you the following rights as a data subject in relation to the controller’s processing of your personal data. Reference is made to the respective legal basis for the conditions governing the exercise of each right:
- Right of access pursuant to Art. 15 GDPR
- Right to rectification pursuant to Art. 16 GDPR
- Right to erasure pursuant to Art. 17 GDPR
- Right to restriction of processing pursuant to Art. 18 GDPR
- Right to notification pursuant to Art. 19 GDPR
- Right to data portability pursuant to Art. 20 GDPR
- Right to withdraw consent pursuant to Art. 7(3) GDPR
- Right to lodge a complaint pursuant to Art. 77 GDPR
10.2 RIGHT TO OBJECT
WHERE WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST FOLLOWING A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO SUCH PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.
WHERE YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU MAY EXERCISE YOUR RIGHT TO OBJECT AS DESCRIBED ABOVE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.
11) Duration of Storage of Personal Data
The duration for which personal data is stored is determined on the basis of the respective legal basis, the purpose of processing and, where applicable, the relevant statutory retention period, such as retention periods under commercial and tax law.
Where personal data is processed on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the data concerned will be stored until you withdraw your consent.
Where statutory retention periods apply to data processed in connection with contractual or quasi-contractual obligations on the basis of Art. 6(1)(b) GDPR, this data will routinely be deleted after expiry of the retention periods, provided that it is no longer required for the performance or initiation of a contract and we have no continuing legitimate interest in retaining it.
Where personal data is processed on the basis of Art. 6(1)(f) GDPR, the data will be stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.
Where personal data is processed for direct marketing purposes on the basis of Art. 6(1)(f) GDPR, the data will be stored until you exercise your right to object pursuant to Art. 21(2) GDPR.
Unless otherwise stated in the other information contained in this privacy policy regarding specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.