DE
EN

Privacy Policy.

Thank you for visiting our website or for contacting us by other means. The protection of personal data is of particular importance to us. In principle, our website can be used without providing any personal data. However, if you wish to make use of any of our company’s services online, the processing of personal data may be necessary. Where the processing of personal data is necessary and there is no legal basis for such processing, we generally obtain the consent of the data subject.

 

The processing of personal data, such as the name, address, email address or telephone number of a data subject, is always carried out in accordance with the current German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG), the EU General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG). Through this Privacy Policy, our company aims to provide information about the nature, scope and purpose of the personal data we process and to inform data subjects of the rights to which they are entitled.

 

Our company has implemented numerous technical and organisational measures to ensure the most comprehensive protection possible for the personal data processed. Nevertheless, internet-based data transmissions may generally be subject to security vulnerabilities, meaning that absolute protection cannot be guaranteed.

Table of Contents

 

1. Definitions | 2. Name and Contact Details of the Controller | 3. Data Protection Officer of the Controller | 4. General Information on Data Processing | 5. Provision of the Website and Creation of Log Files | 6. Cookies | 7. Consent Management | 8. Use of hCaptcha | 9. Use of Google Fonts | 10. Use of Google Tag Manager | 11. Use of Google Ads | 12. Advertising with Meta Pixel and Conversion Tracking | 13. Use of Google Analytics | 14. Use of Google Maps | 15. Embedded YouTube Videos  | 16. Use of Vimeo | 17. Contact Form and Email Contact  | 18. Applications  | 19. Newsletter (CleverReach) | 20. Our Social Media Profiles / Channels  | 21. Use of Zendesk | 22. Use of Microsoft Advertising (Microsoft Ads) | 23. Use of Cloudflare | 24. Order Processing | 25. Warranty Registration | 26. Payment Processing via Stripe | 27. Data Subject Rights

1. Definitions

 

Our company’s Privacy Policy is based on the GDPR. Our Privacy Policy is intended to be easy to read and understand. To ensure this, we explain the terms used below:

 

Personal data means any information relating to an identified or identifiable natural person (data subject). A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier or specific characteristics. These characteristics may relate to the physical, genetic, mental, economic, cultural or social identity of that natural person (Art. 4(1) GDPR).

 

Data subject means any identified or identifiable natural person whose personal data is processed by the controller.

 

Processing means any operation performed on personal data, whether or not by automated means. This includes the collection, storage, organisation, adaptation, retrieval, use, transmission, dissemination, alignment, restriction, erasure or destruction of personal data.

 

Restriction of processing means the marking of stored personal data with the aim of limiting its processing in the future.

 

Profiling means the automated processing of personal data to evaluate personal characteristics of a natural person. This includes analysing or predicting aspects such as work performance, financial situation, health, preferences, interests, behaviour or location.

 

Pseudonymisation means the processing of personal data in such a manner that the data can no longer be attributed to a specific person without the use of additional information. This additional information is kept separately and protected by technical and organisational measures to prevent such attribution.

 

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

 

Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

 

Recipient means a natural or legal person, public authority, agency or other body to which personal data is disclosed, whether or not it is a third party. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

 

Third party means a natural or legal person, public authority, agency or other body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or processor, are authorised to process the personal data.

 

Consent means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

2. Name and Contact Details of the Controller

 

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the Member States as well as other applicable data protection provisions is:

 

Coboc GmbH & Co. KG

Am Bahnbetriebswerk 5

69115 Heidelberg

 

E-Mail: contact@coboc.biz 

Website: www.coboc.biz 

3. Data Protection Officer of the Controller

 

For questions or comments regarding data protection, you can contact our Data Protection Officer as follows:

 

BCCO GmbH

Hermann-Köhl-Straße 14

93049 Regensburg 

 

Phone: +49 941 69800800

E-Mail: datenschutz@bcco.de 

4. General Information on Data Processing

 

Scope of the Processing of Personal Data

 

We process personal data only where this is necessary to provide our website, content or services. As a rule, such processing is carried out only with the user’s consent, unless obtaining prior consent is not possible for practical reasons and the processing is permitted by law.

 

Legal Basis for the Processing of Personal Data

 

Where we obtain the data subject’s consent for the processing of personal data, Art. 6(1)(a) GDPR serves as the legal basis.

The processing of personal data for the performance of a contract with the data subject is based on Art. 6(1)(b) GDPR. This also applies to processing operations that are necessary in order to take steps prior to entering into a contract. Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis. Where the processing of personal data is necessary in order to protect the vital interests of the data subject or another natural person, Art. 6(1)(d) GDPR serves as the legal basis. Where processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, and the interests, rights and freedoms of the data subject do not override those interests, the processing is based on Art. 6(1)(f) GDPR.

 

Data Erasure and Retention Period

 

Personal data will be erased or blocked as soon as the purpose for which it was stored no longer applies. Personal data may be retained for a longer period only where this is provided for by the European or national legislator in Union regulations, laws or other provisions to which the controller is subject. The data will also be erased once the statutory retention periods stipulated therein have expired, unless the data is still required for the conclusion or performance of a contract.

5. Provision of the Website and Creation of Log Files

 

Description and Scope of Data Processing 

 

For the operation of this website, we use a hosting service provider whose European servers are used to store the content of our website. The hosting service provider has been carefully selected, and all necessary measures have been taken to ensure that data processing is carried out in compliance with applicable data protection law (for example, by concluding a data processing agreement (DPA)). Each time our website is accessed, our system automatically collects data and information from the computer system of the device accessing the website. The following data is collected:

 

  • The user’s operating system
  • The user’s Internet service provider
  • The user’s IP address
  • Date and time of access
  • Websites from which the user’s system accesses our website
  • Websites accessed by the user’s system via our website
  • The file accessed
  • Amount of data transferred

 

The data is also stored in our system’s log files. This data is not stored together with any other personal data relating to the user.

 

Legal Basis for Data Processing

 

The legal basis for the processing of server log data is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional provision of our website.

 

Purpose of Data Processing

 

The temporary storage of the IP address by the system is necessary in order to deliver the website to the user’s device. For this purpose, the user’s IP address must be stored for the duration of the session. The data is stored in log files in order to ensure the proper functioning of the website. In addition, the data is used for the technical optimisation of the website and to ensure the security of our information technology systems. The data is not analysed for marketing purposes in this context. These purposes constitute our legitimate interest pursuant to Art. 6(1)(f) GDPR.

 

Retention Period

 

The data will be erased as soon as it is no longer required for the purpose for which it was collected. Where data is collected for the purpose of providing the website, this is the case when the respective session has ended. Where data is stored in log files, it will be erased after no more than seven days. Storage beyond this period is possible. In such cases, the users’ IP addresses will be deleted or anonymised so that it is no longer possible to identify the accessing client.

 

Right to Object and Options for Removal

 

The collection of data for the provision of the website and the storage of data in log files are strictly necessary for the operation of the website. Consequently, the user has no right to object to this processing.

6. Cookies

 

Description and Scope of Data Processing

 

Our website uses cookies and similar technologies. Cookies are text files that are stored in or by the internet browser on the user’s computer system. When a user accesses a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is accessed again. We use cookies to ensure the proper functioning of our website. Some elements of our website require the accessing browser to be identifiable even after the user navigates to another page. The following data is stored and transmitted in the cookies:

 

  • Language settings 
  • Items in a shopping cart

 

When accessing our website, the user is informed about the use of cookies for analytics and marketing purposes, and their consent to the processing of personal data used in this context is obtained. In this context, reference is also made to this Privacy Policy.

 

Legal Basis for Data Processing

 

Where you have given us your consent, the legal basis for the processing of personal data using cookies (e.g. for analytics and marketing purposes) is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. The legal basis for the processing of personal data using technically necessary cookies within the meaning of Section 25(2) TDDDG is Art. 6(1)(f) GDPR. You may withdraw your consent at any time with effect for the future by disabling the relevant service in the “Privacy Settings” on this website.

 

Purpose of Data Processing

 

Cookies are set by our website or by external web services in order to maintain the full functionality of our website, improve user-friendliness or pursue the purpose specified in connection with your consent. We may also recognise individual visitors by means of pseudonyms, enabling us to provide more personalised services.

 

Retention Period, Right to Object and Options for Removal

 

Our cookies are stored until they are deleted from your browser or, in the case of a session cookie, until the session expires. Cookies are stored on the user’s device and transmitted from there to our website. As a user, you therefore have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the storage of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, some functions of the website may no longer be fully available.

7. Consent Management

 

Use of Borlabs Cookie

 

Description and Scope of Data Processing

 

When you visit our website for the first time, you will be shown a consent banner. This allows you to decide whether you wish to consent to the use of cookies and similar technologies that require consent. By clicking “Accept all”, you consent to the use of the selected services. You can adjust your selection individually or allow only technically necessary cookies. For consent management, we use Borlabs Cookie, a consent management platform provided by Borlabs GmbH, Hamburger Straße 11, 22083 Hamburg, Germany. Borlabs Cookie sets a technically necessary cookie in order to store your consent or refusal, document your selected privacy settings and maintain the legally required record of the consent given. In particular, the following data may be processed:

 

  • Your consent or refusal,
  • the cookie categories you have selected,
  • the date and time of your decision,
  • an individual consent ID,
  • information about your browser and device, and

the version of the consent settings.

 

The consent data is stored exclusively locally on your device and is used solely for the management and documentation of your consent. This data is not transmitted to Borlabs GmbH. Further information on data protection in connection with Borlabs Cookie can be found at: https://de.borlabs.io/datenschutz/

 

Legal Basis for Data Processing 

 

The legal basis for the use of consent management is Art. 6(1)(c) GDPR for compliance with our legal obligations and Section 25(2) No. 2 TDDDG, insofar as technically necessary information is stored on or accessed from your device.

 

Purpose of Data Processing

 

The purpose of the data processing is to obtain your consent to the use of cookies and similar technologies that require consent, to document such consent in accordance with legal requirements, and to provide you with the option to change or withdraw your consent at any time with effect for the future.

 

Retention Period, Right to Object and Options for Removal

 

The retention period depends on the configuration of the Borlabs Cookie used. Under the current settings, the consent decision is stored for one year.

You can change or withdraw your consent at any time with effect for the future via the “Cookie Settings” link or the corresponding button on our website.

Alternatively, you can delete the cookie set by Borlabs Cookie in your browser settings. The next time you visit our website, you will be asked to make your consent decision again.

8. Use of hCaptcha

 

Description and Scope of Data Processing 

 

To protect our website against abusive automated submissions (spam) and attacks by bots, we use hCaptcha, a service provided by Intuition Machines, Inc., 350 Alabama Street, San Francisco, CA 94110, USA. hCaptcha is used to verify whether entries made on our website are submitted by a natural person or by automated programs. For this purpose, hCaptcha analyses various information relating to the user’s device and browser. In particular, the following data may be processed:

 

  • IP address, 
  • browser and device information, 
  • operating system, 
  • referrer URL, 
  • mouse movements and interactions on the website, 
  • date and time of access, and 
  • other technical information required for bot detection.

 

The data collected is transmitted to hCaptcha servers and processed there. In this context, the transfer of personal data to the USA cannot be ruled out. 

Further information on data protection at hCaptcha can be found at: https://www.hcaptcha.com/privacy

 

Legal Basis for Data Processing

 

The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our website and, in particular, our contact and form functions against misuse, automated attacks and spam. Insofar as hCaptcha stores or accesses technically necessary information on your device, this is carried out on the basis of Section 25(2) No. 2 TDDDG.

 

Purpose of Data Processing 

 

hCaptcha is used to protect our website against automated access, spam and abusive submissions, as well as to ensure the integrity and security of our online services.

 

Retention Period, Right to Object and Options for Removal 

 

We do not store any personal data ourselves in connection with hCaptcha. The retention period for data processed by hCaptcha is governed by the provider’s privacy policy. Insofar as the processing is based on our legitimate interest, you may object to the processing at any time pursuant to Art. 21 GDPR on grounds relating to your particular situation. Please note, however, that it may not be possible to use certain forms without completing the hCaptcha verification.

9. Use of Google Fonts

 

Description and Scope of Data Processing 

 

We use Google Fonts on our website, a service provided by Google Ireland Limited, Google Building Gordon House, Barrow St, Dublin 4, Ireland (hereinafter referred to as “Google”). Google enables us to use external fonts, known as Google Fonts. When you access our website, the required Google Font is loaded by your web browser into the browser cache. This is necessary to enable your browser to display our text in a visually enhanced manner. If your browser does not support this function, a standard font installed on your device will be used instead.

 

These fonts are integrated by means of a server request, generally to a Google server in the USA. As a result, information about which of our web pages you have visited is transmitted to the server. Google also stores the IP address of the browser used on your device. We have no influence over the scope or further use of the data collected and processed by Google through the use of Google Fonts. Third-party provider information: Google Ireland Limited, Google Building Gordon House, Barrow St, Dublin 4, Ireland.

 

Further information on data protection can be found in Google’s Privacy Policy: https://policies.google.com/privacy?hl=en

Further information on Google Web Fonts can be found at https://fonts.google.com/?utm_source and https://fonts.google.com/faq?hl=en&utm_source   

 

Legal Basis for Data Processing

 

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

 

Purpose of Data Processing

 

We use Google Fonts for optimisation purposes, in particular to improve your experience when using our website and to make its design more user-friendly.

 

Retention Period, Right to Object and Options for Removal


We do not store any personal data ourselves in connection with the integration of Google Fonts. We have no influence over the retention period applied by Google. Further information can be found in Google’s Privacy Policy. You may withdraw your consent at any time by reopening our consent management tool.

Further information on how transmitted data is handled can be found in the provider’s privacy information at https://policies.google.com/privacy?hl=en&utm  and https://business.safety.google/privacy/ 


The provider also offers an opt-out option at https://support.google.com/My-Ad-Center-Help/answer/12155451?hl=en&utm 

10. Use of Google Tag Manager

 

Description and Scope of Data Processing

 

We use Google Tag Manager on our website to implement and manage tracking codes and other scripts through a single interface. Google Tag Manager is a solution provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Tag Manager generally does not set any cookies itself. However, it is used to manage other services and tags that may process personal data or use cookies and similar technologies.

 

Legal Basis for Data Processing

 

The legal basis for the processing of personal data is your consent pursuant to Art. 6(1)(a) GDPR, which you have given on our website.

 

Purpose of Data Processing

 

We use Google Tag Manager for optimisation purposes, in particular to improve your experience when using our website and to enhance the effectiveness of our marketing activities.

 

Data Deletion and Retention Period 

 

You may withdraw your consent at any time with effect for the future via the privacy settings on our website.

Further information on data protection can be found on the following Google websites:

 

Privacy Policy: Google Privacy Policy and https://business.safety.google/privacy/ 

11. Use of Google Ads

 

We use Google Ads to draw attention to our products and services through advertisements. If you access our website via a Google advertisement, Google Ads stores a cookie on your device. This only takes place with your consent; the legal basis is therefore Art. 6(1)(a) GDPR. The advertisements are provided via so-called ad servers, which use cookies to measure the success of advertising campaigns (e.g. ad impressions and clicks). The information stored includes, for example, the cookie ID, ad impressions, the most recent impression (for post-view conversions) and opt-out information. These cookies are not used to identify you personally.

Google may recognise your browser. If you visit pages of a Google Ads customer while the cookie is still active, Google can recognise that you clicked on the advertisement and were redirected to the relevant website.

 

Each Google Ads customer is assigned an individual cookie, meaning that tracking across the websites of other customers is not possible. Google may collect data about your visit to our website and, if you are registered with Google, link this data to your account. Even if you are not registered with Google or are not logged in, the provider may obtain and store your IP address.

 

The marketing tools establish a direct connection to Google’s servers. We ourselves do not collect any personal data, but only receive statistical analyses from Google, such as information on which advertisements were clicked, how often they were clicked and at what cost. We are not able to identify individual users.

 

Withdrawal of Your Consent

 

You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to the withdrawal. You can withdraw your consent to the use of cookies via the “Privacy Settings” on this website or:

 

  1. a) adjust the settings in your browser software, e.g. by blocking third-party cookies;
  3. b) block cookies from www.googleadservices.com via https://adssettings.google.de/anonymous (please note that these settings will be reset if you delete your cookies);
  5. c) disable interest-based advertising via https://youradchoices.com (these settings will also be reset if you delete your cookies).
  7. d) permanently disable advertisements in browsers such as Firefox, Chrome or Internet Explorer via https://support.google.com/My-Ad-Center-Help/answer/12155656?visit_id=639220326410536434-860999896&rd=1 . Please note that this may result in certain functions no longer being fully available.

Further information on data protection at Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, can be found at: and Google Site Stats.

12. Advertising with Meta Pixel and Conversion Tracking

 

We use advertising services provided by Meta Platforms Inc. (“Meta”). By integrating the so-called “Meta Pixel” into our website, we are able to display our advertising (“Meta Ads”) to users of our website and users of the social networks operated by Meta and to measure and evaluate the success of these advertising activities (“conversion tracking”). The connection between Meta and our website is technically established via the Meta Pixel. The legal basis for the processing of your data is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, i.e. the integration takes place only with your consent.

 

Due to the marketing tools used, your browser automatically establishes a direct connection to Meta’s servers when you visit our website. We have no influence over the scope and further use of the data collected by Meta through the use of this tool and therefore provide you with the information available to us: By integrating the Meta Pixel, Meta receives information that you have accessed the relevant page of our website or clicked on one of our advertisements. If you are registered with a Meta service, Meta may associate your visit with your account. Even if you are not registered with Meta or are not logged in, the provider may obtain your IP address and other identifying information and use this information to create a profile.

 

The information collected is stored on Meta servers, including servers located in the USA. In such cases, the provider has committed to the EU-U.S. Data Privacy Framework and has undertaken to comply with applicable data protection laws when transferring data internationally. We have also entered into so-called Standard Contractual Clauses with Meta, which are intended to ensure an adequate level of data protection in the third country.

 

You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to the withdrawal. The easiest way to withdraw your consent is via the “Privacy Settings” on this website. In addition, users who are logged in may object via the functionality provided by Meta within the respective social network.

 

Further information on data processing by Meta can be obtained from Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland); Privacy Policy: https://www.meta.com/legal/privacy-policy/ 

13. Use of Google Analytics

 

Description and Scope of Data Processing

 

With your consent, we use Google Analytics on our website, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). Google Analytics uses cookies that enable an analysis of your use of the website. We have entered into a data processing agreement with Google under which Google is obliged to protect the data of our website visitors and to process it exclusively in accordance with our instructions. The information collected about your use of this website, as well as anonymised IP addresses, is generally transmitted to a Google server in the USA and processed there. In such cases, Google participates in the EU-U.S. Data Privacy Framework. In addition, Standard Contractual Clauses have been concluded to ensure an adequate level of data protection for transfers of data to third countries.

 

Legal Basis for Data Processing

 

The processing of personal data in connection with the use of Google Analytics, as well as the storage of and access to information on your device by means of Google Analytics cookies, is carried out exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Google Analytics will not be used during your visit to our website without your consent.

 

Retention Period

 

Personal data collected via Google Analytics is stored only for as long as necessary to achieve the purposes described above. The retention period depends on the settings we have configured in Google Analytics. Once the respective retention period has expired, the data is automatically deleted.

 

Withdrawal of Consent

 

You may withdraw your consent at any time with effect for the future by changing the relevant settings in our consent management banner or by disabling the service in the “Privacy Settings” on this website. Further information on the scope of Google Analytics services can be found at: https://marketingplatform.google.com/about/analytics/terms/gb/?utm 

 

Google provides information on data processing when using Google Analytics at: Google Analytics Privacy Information

 

General information on the processing of personal data by Google can be found in Google’s Privacy Policy: https://support.google.com/analytics/answer/6004245?hl=en&utm


In addition, you can prevent Google Analytics from collecting your data by installing the browser add-on provided by Google to disable Google Analytics:
https://tools.google.com/dlpage/gaoptout?hl=en&utm 

14. Use of Google Maps

 

Description and Scope of Data Processing

 

We use Google Maps, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to display geographical information and make locations easier to find. The service is used exclusively on the basis of your prior consent pursuant to Art. 6(1)(a) GDPR. When Google Maps is loaded, data such as your IP address, location data (where applicable) and technical device information is transmitted to Google. When using the Google service on our website, Google may transmit and process information from other Google services in order to provide background services for the display and data processing of the services provided by Google. This may also involve the transfer of data to Google services such as Google APIs, DoubleClick, Google Cloud, Google Ads and Google Fonts in accordance with Google’s Privacy Policy. This data may also be transferred to Google servers in the USA. Google participates in the EU-U.S. Data Privacy Framework. We have also entered into so-called Standard Contractual Clauses with Google, which are intended to ensure an adequate level of data protection in the third country.

 

Legal Basis for Data Processing 

 

The processing of personal data is carried out exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, for example by adjusting your cookie settings.

 

Retention Period 

 

We do not store any data ourselves in connection with the use of Google Maps. The data is stored and processed by Google. Google collects and stores data in the form of analysable usage profiles, including for users who are not logged in. To exercise your right to object to the creation of such user profiles, please contact Google directly. Further information on data processing by Google can be found in Google’s Privacy Policy: https://policies.google.com/privacy?hl=en&utm 

Google’s Terms of Service can be found at: https://policies.google.com/terms?hl=en&utm

 

The additional Terms of Service for Google Maps can be found at: https://www.google.com/help/terms_maps/?utm

15. Embedded YouTube Videos

 

Description and Scope of Data Processing 

 

YouTube videos are embedded on our website and are only loaded after you have given your consent. With your consent, YouTube’s “Privacy-Enhanced Mode” (Google/YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) is activated. When YouTube videos are loaded, data such as your IP address, location data (where applicable) and technical device information is transmitted to Google. When using the Google service on our website, Google may transmit and process information from other Google services in order to provide background services for the display and data processing of the services provided by Google. This may also involve the transfer of data to Google services such as Google APIs, DoubleClick, Google Cloud, Google Ads and Google Fonts in accordance with Google’s Privacy Policy. This data may also be transferred to Google servers in the USA. In such cases, Google participates in the EU-U.S. Data Privacy Framework. We have also entered into so-called Standard Contractual Clauses with Google, which are intended to ensure an adequate level of data protection in the third country.

 

When you load an embedded video by giving your consent, a connection is established with YouTube and the Google DoubleClick network. According to YouTube, when using “Privacy-Enhanced Mode”, data such as the pages you have visited is only transmitted to the YouTube server when you actually play the video. If you are logged in to YouTube, this information may be associated with your account and your usage behaviour may be analysed. This data may be linked to information from other Google services, such as Google Analytics. In addition, YouTube may use DoubleClick cookies to display personalised advertising on YouTube. In this context, personal data may also be collected and processed. To avoid this, you should log out of your YouTube account before visiting our website. We have no influence over the collection and use of data by YouTube or Google.

 

When you play a video, YouTube stores cookies on your device in Privacy-Enhanced Mode. These do not contain any personally identifiable information unless you are logged in to a Google service. You can prevent these cookies from being stored by adjusting your browser settings or using appropriate browser extensions.

 

Privacy Policy: https://policies.google.com/privacy?hl=en&utm 

 

Opt-out: https://adssettings.google.com/?hl=en 

 

Privacy Settings: https://www.youtube.com/howyoutubeworks/privacy/ 

 

Further information on Google Web Fonts can be found at https://fonts.google.com/ and https://fonts.google.com/faq?hl=en&utm_ 

 

Legal Basis for Data Processing

 

The legal basis for the processing of personal data is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You may withdraw your consent at any time with effect for the future by disabling this service in the “Privacy Settings” on this website.

 

Retention Period

 

You may withdraw your consent at any time with effect for the future by reopening our consent management tool and adjusting your selection accordingly.

Further information on the handling of personal data can be found in Google’s Privacy Policy: https://policies.google.com/privacy?hl=en&utm_ 

 

Further information about YouTube can be found at: https://www.youtube.com/howyoutubeworks/

16. Use of Vimeo

 

Description and Scope of Data Processing

 

We use the video service Vimeo, provided by Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA, to provide and play videos on our website. When you access a page containing an embedded Vimeo video, personal data is transmitted to Vimeo after you have given your consent. In particular, this may include your IP address, information about your browser and device, the website accessed, as well as information about your use of the video player.

 

If you are logged in to Vimeo at the same time, Vimeo may associate your visit to our website with your user account. We have no influence over the nature and scope of any further data processing by Vimeo.

 

Further information on data processing by Vimeo can be found at: https://vimeo.com/legal/privacy/policy 

 

Legal Basis for Data Processing

 

The legal basis for the processing of personal data is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

 

Retention Period, Right to Object and Options for Removal

 

The data collected by Vimeo is processed and stored in accordance with Vimeo’s Privacy Policy. We have no influence over the retention period of this data.

Further information can be found at https://vimeo.com/legal/privacy/policy  or by submitting a request to Vimeo’s European Data Protection Office using the online request form available at https://edpo.com/gdpr-data-request/?utm

17. Contact Form and Email Contact

 

Description and Scope of Data Processing

 

Our website provides a contact form that can be used to contact us electronically. If a user makes use of this option, the data entered in the form is transmitted to us and stored. The following information is mandatory: Title, first name, last name, email address, telephone number, subject and comment.

 

If you provide any additional personal data, such information is provided voluntarily. At the time the message is submitted, the following data is also stored:

(1) The user’s IP address
(2) Date and time of submission

 

During the submission process, reference is made to this Privacy Policy with regard to the processing of the data. Alternatively, you may contact us via the email address provided. In this case, the personal data transmitted with the email will be stored. Service providers engaged by us for the technical provision and processing of enquiries may receive personal data as part of data processing on our behalf.

 

Legal Basis for Data Processing

 

The legal basis for the processing of the data is Art. 6(1)(f) GDPR. If the contact is aimed at entering into a contract, Art. 6(1)(b) GDPR serves as an additional legal basis for the processing.

 

Purpose of Data Processing

 

The personal data entered in the contact form is processed solely for the purpose of handling your enquiry. In the event that you contact us by email, this also constitutes the necessary legitimate interest in processing the data.

Any additional personal data processed during the submission process is used to prevent misuse of the contact form and to ensure the security of our information technology systems.

 

Retention Period, Right to Object and Options for Removal

 

The data will be deleted as soon as it is no longer required for the purpose for which it was collected. With regard to personal data entered in the contact form and personal data transmitted by email, this is the case when the respective conversation with the user has ended. The conversation is deemed to have ended when it can be inferred from the circumstances that the matter in question has been conclusively resolved. Any additional personal data collected during the submission process will be deleted no later than seven days after collection. The user may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. All personal data stored in connection with the contact will be deleted in this case.

18. Applications

 

Description and Scope of Data Processing

 

You have the option of applying for advertised positions via our website or by email. As part of the application process, we process the personal data you provide exclusively for the purpose of conducting the application process and deciding whether to establish an employment relationship.

In particular, the following personal data may be processed:

 

  • first and last name, 
  • contact details (e.g. email address, telephone number), 
  • application documents (e.g. cover letter, CV, references and proof of qualifications), 
  • information about your professional qualifications and previous career history, 
  • any other information that you voluntarily provide to us as part of your application. 

 

Access to your application documents is restricted to those persons within our company who are responsible for conducting the application process.

 

Legal Basis for Data Processing

 

Your personal data is processed for the purpose of deciding whether to establish an employment relationship on the basis of Section 26(1) BDSG and Art. 6(1)(b) GDPR. Where you give us your consent, for example to be included in an applicant pool, the processing is based on Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

 

Purpose of Data Processing

 

Your personal data is processed exclusively for the purpose of conducting the application process, assessing your professional and personal suitability, and deciding whether to establish an employment relationship.

 

Retention Period

 

Your personal data will generally be stored for the duration of the application process. If you are not hired, your application documents will be deleted after completion of the application process, taking into account applicable statutory retention periods and limitation periods, unless you have expressly consented to a longer retention period. If you have consented to your inclusion in an applicant pool, your data will be stored for the period specified in the consent or until you withdraw your consent. If you are hired, the personal data collected during the application process will be transferred to your personnel file insofar as it is required for the employment relationship.

19. Newsletter (CleverReach)

 

Description and Scope of Data Processing

 

If you subscribe to our newsletter, we process the personal data you provide when registering, in particular your email address. If you provide additional information (e.g. your name), this is voluntary. We use CleverReach to send our newsletter, a service provided by CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany.

 

Registration takes place using the so-called double opt-in procedure. This means that after registering, you will receive an email in which you must confirm your subscription by clicking on a confirmation link. This ensures that no one can subscribe using another person’s email address. As part of this procedure, the time of registration, the time of confirmation and the IP address are stored in order to provide evidence of the subscription. Where CleverReach enables us to measure the success of our newsletter campaigns (e.g. opening or click rates), such measurement is carried out exclusively in accordance with the applicable legal requirements.

 

Further information on data protection at CleverReach can be found at: CleverReach Privacy Policy

 

Legal Basis for Data Processing

 

The processing of your personal data for the purpose of sending the newsletter is based on your consent pursuant to Art. 6(1)(a) GDPR. The data collected as evidence as part of the double opt-in procedure is stored in order to comply with our statutory obligations to provide evidence pursuant to Art. 6(1)(c) GDPR and on the basis of our legitimate interest in documenting properly obtained consent pursuant to Art. 6(1)(f) GDPR.

 

Purpose of Data Processing

 

The data is processed for the purpose of sending our newsletter and providing information about our products, services, news and offers. Where statistical analysis is carried out, this serves to analyse and optimise our newsletter offering.

 

Retention Period, Withdrawal of Consent and Options for Removal

 

Your personal data will be stored for as long as you are subscribed to the newsletter. You may withdraw your consent at any time with effect for the future by using the unsubscribe link in the newsletter or by informing us of your withdrawal by other means. After you unsubscribe, your email address will be deleted from the newsletter mailing list, unless statutory retention obligations require otherwise. The data stored as evidence as part of the double opt-in procedure may be retained beyond this period for the duration of the applicable statutory limitation periods.

20. Our Social Media Profiles / Channels

 

We maintain company profiles on various social media platforms. We currently operate profiles on the following platforms:

 

 

Information on the name, address and privacy policies of the respective providers can be found on the linked platforms. For these information services, we use the technical platforms and services provided by the respective providers. Please note that you use our social media profiles and their functions at your own responsibility. This applies in particular to the use of interactive functions (e.g. commenting, sharing or rating content). When you visit our social media profiles, the respective platform operators collect, among other things, your IP address and other information that may be stored on your device in the form of cookies or comparable technologies. This information is used to provide us, as the operator of the social media profiles, with statistical information about the use of our pages (so-called “Insights”).

 

The data collected about you in this context is processed by the platform operators and may also be transferred to countries outside the European Union, in particular to the USA. Where providers transfer personal data to third countries, according to their information, such transfers are carried out in compliance with the applicable legal requirements, for example on the basis of an adequacy decision or appropriate safeguards pursuant to Art. 44 et seq. GDPR. We have no influence over the nature, scope or duration of the data processing carried out by the respective platform operators.

 

Where we jointly determine the purposes and means of processing personal data with the operators of Facebook, Instagram or LinkedIn in connection with our company profiles (in particular in relation to the provision of Page Insights), we are joint controllers pursuant to Art. 26 GDPR. The essential contents of the respective joint controllership arrangements can be found in the privacy information provided by the respective platform operators.

 

Data subject rights may generally be exercised both against us and against the respective platform operator. Please note, however, that we have only limited influence over the data processing carried out by the platform operators. Requests concerning the processing of personal data by the platform operators may therefore be handled more effectively if submitted directly to the respective provider.

 

Comment Function on Our Social Media Channels

 

We regularly publish news and updates on our social media channels. To enable active interaction with you, we have enabled the comment function. We reserve the right to remove inappropriate posts (e.g. racist, offensive, unlawful or comparable content). For this purpose, all comments are reviewed for inappropriate content.

 

In particular, we may process the following data:

 

  • the content of the comment, 
  • the time the comment was posted, 
  • the username and, where applicable, the user ID, and 
  • references to previous posts and comments. 

 

As a general rule, this data is not disclosed to third parties unless we are legally required to do so or a corresponding administrative or court order has been issued.

 

Contacting Us

 

You can contact us via our social media channels, for example by direct message or comment. In this context, we process the data you voluntarily provide (e.g. username and message content) in order to handle your enquiry and communicate with you. The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in responding to enquiries, communicating with users and maintaining our company presence on social networks.

 

Insights Provided by the Platforms

 

The operators of the respective social media platforms provide us with statistical analyses (“Insights”) regarding the use of our social media profiles. These generally consist of aggregated or anonymised information about reach, interactions, target audiences and the use of our content. These analyses help us to better understand how our social media channels are used, provide our content in a targeted manner and continuously improve the information we offer. For information on which personal data is processed by the respective platform operators and for what purposes, please refer to the privacy policies of the respective providers. We have no influence over the nature and scope of this data processing.

 

Reposts

 

Where users publish content and we share (repost) or respond to such posts, we process the information you have made publicly available (e.g. username and published content) in order to interact with you or draw attention to our social media profiles. The legal basis for this processing is Art. 6(1)(f) GDPR.

21. Use of Zendesk

 

Description and Scope of Data Processing

 

We use services provided by Zendesk, Inc., 181 Fremont Street, San Francisco, CA 94105, USA, on our website. Zendesk assists us in providing support and customer services as well as in managing and processing customer enquiries. When you access pages on which Zendesk is integrated, personal data may be processed. This includes, in particular, your IP address, information about the browser and operating system used, the date and time of the page visit, as well as other technically necessary connection data.

 

If you communicate with us via Zendesk, we also process the information you voluntarily provide, such as your name, email address and the content of your enquiry.

Where personal data is transferred to the USA, according to the provider, such transfers are carried out in compliance with the legal requirements for transfers to third countries pursuant to Art. 44 et seq. GDPR.

 

Legal Basis for Data Processing

 

Where Zendesk is used to provide support and communication functions, personal data is processed on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. Our legitimate interest lies in the efficient handling of customer enquiries and the provision of user-friendly customer service. Where Zendesk uses cookies or similar technologies that are not technically necessary, their use is based exclusively on your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

 

Retention Period

 

Personal data processed via Zendesk is stored only for as long as necessary to handle your enquiry or for the respective processing purposes, or for as long as statutory retention obligations apply. Further information on the processing of personal data by Zendesk can be found at: https://zendesk.de/company/agreements-and-terms/privacy-notice/#georedirect 

22. Use of Microsoft Advertising (Microsoft Ads)

 

Description and Scope of Data Processing

 

We use Microsoft Advertising on our website, a service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Microsoft Advertising enables us to analyse the success of our advertising campaigns and measure the effectiveness of our online advertising (conversion tracking). For this purpose, the so-called Universal Event Tracking (UET) is used after you have given your consent. This involves storing cookies or similar technologies on your device and processing information about your use of our website. In particular, the following data may be processed:

 

  • IP address, 
  • browser and device information, 
  • pages visited, 
  • referrer URL, 
  • date and time of the visit, 
  • information about completed conversions, and 
  • other technical usage data. 

 

Microsoft may use the information collected to create pseudonymous usage profiles and to evaluate the success of our advertising activities. Where personal data is transferred to the USA, according to Microsoft, such transfers are carried out in compliance with the legal requirements for transfers to third countries pursuant to Art. 44 et seq. GDPR.

 

Legal Basis for Data Processing

 

The processing of personal data as well as the storage of and access to information on your device is carried out exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

 

Retention Period, Withdrawal of Consent and Options for Removal

 

You may withdraw your consent at any time with effect for the future by adjusting the settings of our consent management tool accordingly.

Further information on the processing of personal data by Microsoft can be found at: https://www.microsoft.com/en-us/privacy/privacystatement   

23. Use of Cloudflare

 

Description and Scope of Data Processing

 

We use services provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, on our website. Cloudflare assists us in providing our website securely and, in particular, protects it against misuse and automated attacks. When you access relevant pages, personal data may be processed. This includes, in particular, your IP address, information about the browser and operating system used, the date and time of the page visit, as well as other technically necessary connection data. The processing is carried out exclusively for the purpose of ensuring the security, stability and availability of our website. Where personal data is transferred to the USA, according to Cloudflare, such transfers are carried out in compliance with the legal requirements for transfers to third countries pursuant to Art. 44 et seq. GDPR.

 

Legal Basis for Data Processing

 

The processing of personal data is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and reliable provision of our website and in protecting it against misuse or automated access.

 

Retention Period

 

The data processed via Cloudflare is stored only for as long as necessary to fulfil the purposes stated above. Further information on the processing of personal data by Cloudflare can be found at: https://www.cloudflare.com/privacypolicy/ 

24. Order Processing

 

Description and Scope of Data Processing

 

When you place an order through our online shop, we process the personal data required for the performance of the contract. Registration or the creation of a customer account is not required; orders are placed exclusively as guest orders. In particular, we process the following personal data:

 

  • first and last name, 
  • billing address and, where applicable, a different delivery address, 
  • email address, 
  • telephone number (if provided), 
  • order and payment data, 
  • information about the selected specialist dealer. 

 

In order to process your order, it may be necessary to disclose personal data to the specialist dealer you have selected. Such disclosure takes place exclusively to the extent necessary to process your order, assign the order and hand over the bicycle to the selected specialist dealer. In addition, personal data may be disclosed to other service providers where this is necessary for the performance of the contract or compliance with legal obligations (e.g. payment service providers or tax advisers).

 

Legal Basis for Data Processing

 

Your personal data is processed for the purpose of taking steps prior to entering into a contract and for the performance of the purchase contract concluded with you on the basis of Art. 6(1)(b) GDPR. Where we store personal data in order to comply with statutory retention obligations, the processing is based on Art. 6(1)(c) GDPR.

 

Purpose of Data Processing

 

Your personal data is processed for the purpose of handling and processing your order, processing payments, communicating with you in connection with your order and handing over the bicycle to the specialist dealer you have selected.

 

Retention Period, Right to Object and Options for Removal

 

We store your personal data only for as long as necessary for the performance of the contract and compliance with statutory retention periods. After expiry of the statutory retention periods, the data will be deleted unless it is still required for the establishment, exercise or defence of legal claims.

25. Warranty Registration

 

Description and Scope of Data Processing 

 

We offer our customers the option of registering their Coboc e-bike via our website for the voluntary manufacturer’s warranty. As part of the warranty registration process, we process the personal data you provide insofar as this is necessary to verify the warranty requirements, issue the warranty certificate and subsequently handle warranty and service cases. In particular, the following personal data may be processed:

 

  • first and last name, 
  • email address, 
  • date of birth, 
  • bicycle model and frame number, 
  • date of purchase, 
  • proof of purchase, including uploaded documents, 
  • information about where the product was purchased or how you became aware of our products, 
  • other information provided voluntarily. 

 

After successful registration, you will receive your personal warranty certificate by email.

 

Legal Basis for Data Processing

 

The processing is carried out for the purpose of providing the voluntary manufacturer’s warranty and the associated services on the basis of Art. 6(1)(b) GDPR, as well as for taking steps prior to entering into a contract and/or performing the warranty contract pursuant to Art. 6(1)(b) GDPR. Where you additionally consent to receiving our newsletter, this processing is based on Art. 6(1)(a) GDPR.

 

Purpose of Data Processing

 

The data is processed for the following purposes:

 

  • verifying the requirements for the manufacturer’s warranty, 
  • issuing and managing the warranty certificate, 
  • handling potential warranty and service cases, and 
  • communicating with you in connection with the warranty. 

 

Retention Period

 

We store your personal data only for as long as necessary to provide the warranty, handle warranty and service cases and comply with statutory retention obligations. The data will subsequently be deleted unless statutory or contractual retention obligations require otherwise.

26. Payment Processing via Stripe

 

Description and Scope of Data Processing

 

For payment processing, we use the payment service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland.

When you make a payment as part of an order, the personal data required to process the payment is transmitted to Stripe. This includes, in particular:

 

  • name, 
  • billing address, 
  • email address, 
  • order and payment data, 
  • information about the selected payment method, and 
  • where applicable, other data required for payment processing. 

 

Stripe processes this data under its own responsibility in order to process the payment, prevent fraud and comply with legal obligations. Depending on the payment method selected, additional payment service providers or financial institutions may be involved in processing the payment. In this case, data is processed in accordance with the privacy policies of the respective payment service provider. Further information can be found at: https://stripe.com/en-de/privacy 

 

Legal Basis for Data Processing

 

The processing is carried out for the purpose of performing the purchase contract on the basis of Art. 6(1)(b) GDPR. Where Stripe processes personal data in order to comply with legal obligations, such processing is based on Art. 6(1)(c) GDPR.

 

Purpose of Data Processing

 

The processing serves to securely process the payment, prevent fraud and perform the purchase contract concluded between you and us.

 

Retention Period

 

We store personal data only for as long as necessary for the performance of the contract and to comply with statutory retention obligations. The retention period applicable to data processed by Stripe is governed by the provider’s privacy policy.

27. Data Subject Rights

 

Where required by law, you have certain rights as a data subject in relation to the processing of your personal data. We would like to inform you about your data subject rights and how you can exercise them:

 

Right of Access (Art. 15 GDPR): You have the right to request information from us as to which personal data we process about you and for what purposes. If a request for access is not made in writing via a contact address already stored in our systems, please understand that we may ask you to provide evidence confirming that you are the person you claim to be.

 

Right to Rectification (Art. 16 GDPR) or Erasure (Art. 17 GDPR): You have the right to have inaccurate or incomplete personal data stored by us rectified or erased if the data is no longer required or if its processing violates data protection law.

 

Right to Restriction of Processing (Art. 18 GDPR): You have the right to request the restriction of the processing of your personal data if you contest the accuracy of the data, the processing is unlawful or you have objected to the processing.

 

Right to Withdraw Consent (Art. 7(3) GDPR): You have the right to withdraw your consent to the processing of personal data at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

 

Right to Data Portability (Art. 20 GDPR): You have the right to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format and to transmit this data to another controller. Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.

 

Right to Lodge a Complaint (Art. 77 GDPR): You also have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

We expressly draw your attention to your:

 

Right to Object

 

You have the right to object to processing pursuant to Art. 21 GDPR where the data processing is based on a legitimate interest and there are grounds relating to your particular situation that oppose such processing. We reserve the right to assess your particular situation and the related data processing. Where personal data is processed on the basis of our legitimate interests for direct marketing purposes, you may object to such processing at any time without giving reasons.

 

Procedure for Exercising Data Subject Rights

 

If you exercise your rights against us, we will process the data you provide to us for the purpose of handling and fulfilling your request. Once your request has been fulfilled, we will retain the data you provided to us and the data provided by us to you in response for documentation purposes until the expiry of the applicable limitation period for administrative offences (three years).