Data Protection & Security

A. Information applicable across all sales channels

1. Controller and content of this Privacy Policy

We, JEANS.CH AG (Bruggacherstrasse 8, 8117 Fällanden, Switzerland), operate JEANS.CH - THE DENIM STORE (the "retail store") as well as the online shop at www.jeans.ch (hereinafter the "Website") and, unless otherwise stated, are responsible for the data processing activities described in this Privacy Policy.

To inform you about which personal data we collect from you and for what purposes we use it, please take note of the information below. Our data protection practices are governed primarily by Swiss data protection law, in particular the Swiss Federal Act on Data Protection (FADP) and the Data Protection Ordinance (DPO). Where the EU General Data Protection Regulation (EU GDPR) applies to a processing activity, we also comply with its requirements. Where legal bases under Art. 6 EU GDPR are mentioned below, these references relate to processing activities that fall within the scope of the EU GDPR.

Please note that the information below is reviewed and amended from time to time. We therefore recommend that you consult this Privacy Policy regularly. In addition, for certain processing activities described below, other companies may be responsible for data protection matters either independently or jointly with us. In such cases, the information provided by those providers is also relevant.

2. Data protection contact

If you have any questions about data protection or wish to exercise your rights, please contact our data protection contact by e-mail at: [email protected]

3. Your rights

Subject to the applicable legal requirements, as a person affected by data processing you have the following rights:

Right of access: You have the right to request, at any time and free of charge, access to the personal data we store about you where we process such data. This enables you to verify which personal data we process about you and whether we use it in accordance with the applicable data protection provisions.

Right to rectification: You have the right to have inaccurate or incomplete personal data corrected and to be informed of the correction. In this case, we will inform recipients of the affected data about the changes made, unless doing so is impossible or involves disproportionate effort.

Right to erasure: You have the right to have your personal data erased under certain circumstances. In individual cases, in particular where statutory retention obligations apply, the right to erasure may be excluded. If the relevant requirements are met, the data may instead be blocked.

Right to restriction of processing: You have the right to request that the processing of your personal data be restricted.

Right to data portability: You have the right to receive from us, free of charge and in a readable format, the personal data that you have provided to us.

Right to object: You may object to data processing at any time, in particular to processing in connection with direct marketing (e.g. marketing e-mails).

Right to withdraw consent: In principle, you have the right to withdraw consent that you have given at any time. However, processing activities carried out in the past on the basis of your consent do not become unlawful as a result of your withdrawal.

To exercise these rights, please send us an e-mail at: [email protected]

Right to lodge a complaint: You have the right to lodge a complaint with a competent supervisory authority, for example regarding the way in which your personal data is processed.

4. Data security

We use appropriate technical and organisational security measures to protect the personal data stored by us against loss and unlawful processing, in particular against unauthorised access by third parties. Our employees and the service providers engaged by us are obliged to maintain confidentiality and comply with data protection requirements. In addition, access to personal data is granted to these persons only to the extent necessary for the performance of their duties.

Our security measures are continuously adapted in line with technological developments. However, the transmission of information via the Internet and electronic means of communication always entails certain security risks, and we cannot provide an absolute guarantee for the security of information transmitted in this way.

5. Contacting us

If you contact us via our contact addresses and channels (e.g. by e-mail, telephone or contact form), your personal data will be processed. We process the data that you provide to us, such as your company name, your name, your role, your e-mail address or telephone number and the content of your request. The time at which the request is received is also recorded. Mandatory fields in contact forms are marked with an asterisk (*).

We process this data solely in order to deal with your request (e.g. providing information about a product, assisting with contract performance such as product returns, incorporating your feedback into the improvement of our services, etc.). The legal basis for this processing is our legitimate interest within the meaning of Art. 6(1)(f) EU GDPR in dealing with your request or, where your request concerns the conclusion or performance of a contract, the necessity of taking the required steps within the meaning of Art. 6(1)(b) EU GDPR.

6. Use of your data for marketing purposes

6.1 Central storage and analysis of data in the CRM system

Where your data can be clearly linked to you, we will store and combine in a central database the data described in this Privacy Policy, in particular your personal details, your contacts with us, your contract data and your browsing behaviour on our Websites. This serves the efficient management of customer data, allows us to respond appropriately to your requests and enables us to provide the services you request and process the related contracts efficiently. The legal basis for this processing is our legitimate interest within the meaning of Art. 6(1)(f) EU GDPR in the efficient management of user data.

We analyse this data in order to further develop our offers in line with customer needs and to display and suggest information and offers that are as relevant as possible to you. We also use methods that may predict interests and future orders based on your use of the Website. The legal basis for these processing activities is our legitimate interest within the meaning of Art. 6(1)(f) EU GDPR in carrying out marketing activities.

6.1.1 Voyado (CRM, loyalty and marketing automation)

For central customer management, segmentation, loyalty functions, marketing automation and personalised communication, we use Voyado Engage provided by Voyado AB, Lumaparksvägen 9, 120 31 Stockholm, Sweden. In Voyado, in particular master and contact data, customer and membership status, transactions and purchase history, segment assignments, loyalty points and rewards as well as interactions with our communications may be processed and linked. As a rule, Voyado processes this data on our behalf as a processor. Where Voyado uses sub-processors or transfers data to third countries, the requirements for international disclosures described in Section 8 apply.

6.2 E-mail marketing and newsletter

If you register for our e-mail newsletter (e.g. when opening or within your customer account), the following data is collected. Mandatory information is marked with an asterisk (*) in the registration form:

• E-mail address
• Title / salutation
• First and last name

To prevent misuse and ensure that the owner of an e-mail address has personally given consent, we use a so-called double opt-in procedure for registration. After submitting your registration, you will receive an e-mail from us containing a confirmation link. To complete your newsletter registration, you must click this link. If you do not click the confirmation link within the specified period, your data will be deleted again and no newsletter will be sent to that address.

By registering, you consent to the processing of this data so that we can send you messages about our company, our offers in the fashion and clothing sector and related products and services. This may also include invitations to participate in competitions or to review any of the above-mentioned products and services. Collecting your title and name allows us to verify whether the registration can be linked to an existing customer account and to personalise the content of our e-mails. Linking the registration to a customer account helps us make the offers and content in the newsletter more relevant to you and better tailored to your potential needs.

We use your data to send e-mails until you withdraw your consent. You may withdraw your consent at any time, in particular by using the unsubscribe link contained in all of our marketing e-mails.

Our marketing e-mails may contain a so-called web beacon, 1x1 pixel (tracking pixel) or similar technical tools. A web beacon is an invisible graphic linked to the user ID of the respective newsletter subscriber. For each marketing e-mail sent, we receive information about which addresses have not yet received the e-mail, which addresses it was sent to and for which addresses delivery failed. We may also see which addresses opened the e-mail, for how long, and which links were clicked. Finally, we also receive information about which addresses have unsubscribed. We use this data for statistical purposes and to optimise our marketing e-mails in terms of frequency, timing, structure and content. This enables us to better tailor the information and offers in our e-mails to the individual interests of recipients.

The web beacon is deleted when you delete the e-mail. To prevent the use of web beacons in our marketing e-mails, configure your e-mail program so that HTML content in messages is not displayed, if this is not already the default setting. The help section of your e-mail software contains information on how to configure this setting, for example for Microsoft Outlook.

By registering for the newsletter, you also consent to the statistical analysis of user behaviour for the purpose of optimising and adapting the newsletter. This consent constitutes our legal basis for processing the data within the meaning of Art. 6(1)(a) EU GDPR.

We use Voyado Engage to send and analyse our marketing e-mails. In particular, delivery status, opens, clicks, bounces, unsubscribes and other interaction data may be processed and linked to the customer profile in order to manage and optimise communications. Further information about central customer management using Voyado can be found in Section 6.1.1. Marketing e-mails are sent only where the necessary requirements are met; any consent given can be withdrawn at any time via the unsubscribe link or the available preference settings.

7. Disclosure to third parties and third-party access

Without the support of other companies, we would not be able to provide our offers in the desired form. In order to use the services of these companies, it is also necessary, to a certain extent, to disclose your personal data. Such disclosure takes place in particular where this is necessary to perform the contract requested by you, for example to logistics or transport companies that deliver the requested products, or to a manufacturer that is to fulfil a warranty claim. For such disclosures, necessity for the performance of the contract within the meaning of Art. 6(1)(b) EU GDPR is the legal basis.

Data is also disclosed to selected service providers and only to the extent necessary to provide the relevant service. Various third-party service providers are also expressly mentioned elsewhere in this Privacy Policy, for example in the sections concerning marketing. These may include IT service providers (such as providers of software solutions), advertising agencies and consulting firms. The legal basis for this disclosure is our legitimate interest within the meaning of Art. 6(1)(f) EU GDPR in obtaining services from third parties.

In addition, your data may be disclosed, in particular to authorities, legal advisers or debt collection companies, if we are legally obliged to do so or if this is necessary to safeguard our rights, in particular to enforce claims arising from our relationship with you. Data may also be disclosed if another company intends to acquire our company or parts of it and such disclosure is necessary for a due diligence review or to complete the transaction. The legal basis for these disclosures is our legitimate interest within the meaning of Art. 6(1)(f) EU GDPR in safeguarding our rights and complying with our obligations or in selling our company.

8. Transfer of personal data abroad

We may disclose personal data to recipients abroad where this is necessary to carry out the processing activities described in this Privacy Policy, in particular in connection with IT, analytics, marketing and communication services. If the recipient is located in a country, territory or sector for which Switzerland recognises an adequate level of data protection, the disclosure may be based on that adequacy. Since 15 September 2024, an adequate level of protection also applies to transfers to US companies certified under the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF). Where no adequate level of data protection exists, we base the disclosure in particular on recognised contractual safeguards, such as standard contractual clauses, and implement additional protective measures where required. In exceptional cases provided for by law, a disclosure may also be permissible without such safeguards.

9. Retention periods

We store personal data only for as long as is necessary to carry out the processing activities explained in this Privacy Policy within the scope of our legitimate interests. For contract data, retention is required by statutory retention obligations. Requirements obliging us to retain data arise in particular from accounting and tax law. Under these provisions, business correspondence, concluded contracts and accounting records must in particular be retained for up to 10 years. Where we no longer need this data to provide services to you, the data is blocked. This means that it may then be used only where this is necessary to comply with retention obligations or to defend and enforce our legal interests. The data is deleted once there is no longer any retention obligation and no legitimate interest in retaining it.

B. Special information for our Website

10. Log file data

When you visit our Website, the servers of our hosting provider (Profihost GmbH, Expo Plaza 1, 30539 Hannover, Germany) temporarily record each access in a log file. The following data is collected without any action on your part and stored by us until it is automatically deleted:

• the IP address of the requesting device,
• the date and time of access,
• the name and URL of the file accessed,
• the website from which the access originated, where applicable including the search term used,
• the operating system of your device and the browser you use (including type, version and language settings),
• device type in the case of access via mobile devices,
• the city or region from which access is made,
• the name of your Internet access provider.

This data is collected and processed in order to enable use of our Website (establishing the connection), to ensure the ongoing security and stability of the systems, and for error and performance analysis, thereby enabling us to optimise our Website (see also Section 13 in relation to the latter purposes).

In the event of an attack on the Website’s network infrastructure or suspected other unauthorised or abusive use of the Website, the IP address and the other data will be analysed for investigation and defence purposes and, where appropriate, may be used in criminal proceedings to identify the users concerned and to take civil and criminal legal action against them.

Our legitimate interest in processing the data within the meaning of Art. 6(1)(f) EU GDPR lies in the purposes described above.

Finally, when you visit our Website, we use cookies as well as applications and tools that are based on the use of cookies. In this context, the data described here may also be processed. Further information can be found in the subsequent sections of this Privacy Policy, in particular Section 11.

10.1 Cloudflare (CDN, security and, where applicable, Web Analytics)

To provide our Website more quickly, reliably and securely, we use services from Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA ("Cloudflare"). In doing so, Cloudflare may process in particular connection, device and security data, such as the IP address, browser and device information, requested URLs, timestamps and technical event and security information. Depending on the function used, Cloudflare may act as a processor on our behalf or under its own responsibility under data protection law.

The CDN and security functions are used in particular to defend against attacks and to ensure the stability and performance of our Website. If we use optional Cloudflare analytics functions such as Web Analytics or Insights, additional technical usage data may be processed; where consent is required for this, the processing is governed by your settings in the cookie banner. Section 8 applies to any international transfers.

11. Cookies

Cookies are information files that your web browser stores on the hard drive or in the memory of your computer when you visit our Website. Cookies are assigned identification numbers that allow your browser to be identified and the information contained in the cookie to be read.

Among other things, cookies help to make your visit to our Website easier, more pleasant and more useful. We use cookies for various purposes that are required for your requested use of the Website, i.e. are "technically necessary". For example, we use cookies to identify you as a registered user after you have logged in, so that you do not have to log in again when navigating between different subpages. The shopping cart and ordering functions also rely on cookies. Cookies also perform other technical functions required to operate the Website, such as load balancing, i.e. distributing the site’s processing load across different web servers to reduce server load. Cookies are also used for security purposes, for example to prevent unauthorised posting of content. Finally, we also use cookies in connection with the design and programming of our Website, for example to enable scripts or code to be loaded.

The legal basis for these processing activities is our legitimate interest within the meaning of Art. 6(1)(f) EU GDPR in providing a user-friendly and up-to-date Website.

Most Internet browsers accept cookies automatically. When you access our Website, we inform you about the technically non-essential cookies we use, in particular third-party cookies for marketing purposes. You can make your desired choices using the corresponding buttons in the cookie banner. Details about the services and processing activities associated with the individual cookies can be found in the cookie banner and in the subsequent sections of this Privacy Policy.

You may also be able to configure your browser so that no cookies are stored on your computer or so that a notice always appears when you receive a new cookie. The following pages explain how you can configure the handling of cookies in selected browsers.

• Microsoft Edge™
• Safari™
• Chrome™
• Firefox™
• Opera™

Disabling cookies may mean that you cannot use all functions of our Website. Cookie settings can be changed again via the cookie banner.

11.1 Consent management with Cookiebot

To manage, store and document your consents and refusals, we use the Cookiebot consent management platform, a service provided by Usercentrics GmbH, Sendlinger Strasse 7, 80331 Munich, Germany. In particular, your consent status, the time and version of the consent, technical identifiers as well as browser and device information are processed; where technically necessary, IP-related information may also be processed.

Cookiebot is used to document your choices and to control non-essential analytics and marketing services in accordance with your decision. Where the EU GDPR applies, processing is carried out to comply with legal obligations and to safeguard our legitimate interest in demonstrable consent management (Art. 6(1)(c) and (f) EU GDPR). You may change your choices at any time with effect for the future via the cookie banner settings.

12. Tracking and web analytics tools

12.1 General information on tracking

For the purpose of designing our Website in line with user needs and continuously optimising it, we use the web analytics services listed below. In this context, pseudonymised usage profiles are created and cookies are used (see also Section 11). The information generated by the cookie about your use of this Website is generally transferred, together with the log file data listed in Section 10, to a server of the service provider, where it is stored and processed. This may also involve a transfer to servers abroad, for example in the USA (see Section 8, in particular regarding the safeguards applied).

By processing the data, we receive, among other things, the following information:

• the navigation path followed by a visitor on the site (including content viewed and products selected or purchased),
• the time spent on the Website or a subpage,
• the subpage from which the Website is left,
• the country, region or city from which access is made,
• the device (type, version, colour depth, resolution, browser-window width and height), and
• whether the visitor is returning or new.

On our behalf, the provider will use this information to evaluate use of the Website, compile reports on Website activities for us, and provide other services related to use of the Website and Internet use for market research and needs-based design of these Internet pages. For these processing activities, we and the providers may, to a certain extent, be regarded as joint controllers under data protection law.

For the following technically non-essential tools, the legal basis for these processing activities – where the EU GDPR applies – is your consent within the meaning of Art. 6(1)(a) EU GDPR. You may change or withdraw your consent at any time with effect for the future via the settings of our cookie banner (Cookiebot). Where a service also offers its own opt-out or account settings, you may use those as well.

For further processing of the data by the respective provider as an independent controller under data protection law, including any disclosure of this information to third parties such as authorities on the basis of national legal provisions, please refer to the respective provider’s privacy information.

12.2 Google Analytics 4

We use Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and other Google companies may be involved in providing the service ("Google").

GA4 processes event and usage data relating to the use of our Website, for example pages viewed, clicks, purchases and other interactions, referrer information, browser and device data, approximate location information and pseudonymous identifiers. For data from Switzerland, the EEA and the United Kingdom, Google states that IP-based location lookups are performed regionally and that IP addresses are not logged or made accessible for additional purposes after this processing. The specific processing depends on our GA4 settings and your consent settings.

GA4 is used on our Website only in accordance with the consents given in the cookie banner. You may change or withdraw your consent at any time via the cookie banner. In addition, you may use the privacy and advertising settings of your Google account as well as opt-out options provided by Google.

Further information about data processing by Google can be found in Google’s privacy information. Section 8 applies to any transfers of data to the USA or other third countries.

12.3 Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited and/or Google LLC on our Website. Tag Manager is used to centrally manage and trigger other tags, pixels and scripts in accordance with our configuration. Whether and which personal data is processed by the services integrated through it depends on the respective service and your consent settings. Google states that, apart from standard HTTP server logs, Tag Manager itself processes only limited and predominantly aggregated diagnostic information about tag firing and does not independently use our Website visitors’ data for analytics or advertising purposes.

Technically non-essential tags are triggered via Google Tag Manager only where the required consent has been given. The use of Google Tag Manager therefore does not replace either the data protection assessment or the consent required for the respective analytics and marketing services integrated through it.

12.4 Google Signals

Where Google Signals is enabled in GA4 and the required consent and account settings are in place, Google may link Analytics data with information from users signed in to Google, in particular to provide cross-device reports as well as reports on demographic characteristics and interests. As a rule, we receive only aggregated reports and do not have access to individual Google accounts. However, the fact that reports are displayed to us in aggregated form does not exclude the possibility that Google processes personal or pseudonymous data in providing the service.

We use these functions for analysis and – where authorised – to optimise advertising. Their use is governed by the consent signals you have provided, our Google settings and the settings in your Google account. You may withdraw consent at any time via our cookie banner; you may also change the corresponding settings in your Google account.

For further processing of the data by Google, please refer to Google’s privacy policy: www.google.com/intl/de_de/policies/privacy .

12.5 Google reCAPTCHA

To protect our forms against misuse, automated access and spam, we may use Google reCAPTCHA provided by Google Ireland Limited and/or Google LLC. reCAPTCHA analyses technical information and interactions in order to distinguish automated access from human use. In particular, the IP address, browser and device data, referrer information, interaction data as well as existing Google cookies or identifiers may be processed.

The service is used to ensure the security and functionality of our Website. Where the EU GDPR applies, we generally rely on our legitimate interest pursuant to Art. 6(1)(f) EU GDPR. Where, in the specific configuration, reCAPTCHA uses non-essential cookies or comparable technologies for which consent is required, the service is activated only after the corresponding approval has been given via the cookie banner.

We do not use reCAPTCHA to analyse the content that you enter into form fields for our own analytics or marketing purposes. However, Google may process technical and interaction data generated in connection with use of the service in accordance with its own privacy terms.

For any transfers of personal data to Google in the USA or other third countries, the transfer mechanisms described in Section 8 apply, in particular – where the respective requirements are met – the Swiss-U.S. Data Privacy Framework or other recognised safeguards.

Where the use of reCAPTCHA depends on your consent, you may withdraw that consent at any time via the settings of our cookie banner. Completely blocking JavaScript or certain security functions in your browser may result in individual forms or functions of our Website being unavailable.

Further information can be found in Google’s Privacy Policy.

12.6 Microsoft Clarity

This Website uses Microsoft Clarity, an analytics and session-recording service from Microsoft. Clarity does not create a video recording of your screen; instead, it reconstructs sessions on the basis of page structures (DOM) and interaction events such as clicks, scrolling and mouse movements. In particular, IP and location information, browser and device data, pages visited, timestamps, interaction data and pseudonymous identifiers may be processed. According to Microsoft, privacy-sensitive input fields are masked; nevertheless, the information processed may still be personal or pseudonymous. We use Clarity to analyse and improve user-friendliness only in accordance with your consent in the cookie banner. Processing is carried out by Microsoft Ireland Operations Limited and/or Microsoft Corporation; Section 8 applies to international transfers.

12.7 Server-side tagging with Stape

We use Stape for server-side tagging. Depending on the selected hosting region and contractual configuration, the service may be provided by Stape Europe OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia, or by Stape, Inc., 8 The Green, Suite 12892, Dover, DE 19901, USA. Server-side tagging means that certain measurement and event data is first transmitted to a tagging server controlled by us or operated for us and is then forwarded from there – in accordance with our configuration and your consent – to selected analytics and advertising services.

In particular, the IP address, URL and referrer information, browser and device data, pseudonymous identifiers, event and transaction data and – where expressly configured and permissible – hashed customer data may be processed. Server-side tagging allows us to exercise greater control over the data disclosed to individual providers, but it does not replace the consents required for the respective destination systems. Section 8 applies to transfers to third countries.

13. Social media

13.1 Social media profiles

Our Website contains links to our profiles on the social networks of the following providers:

• Meta Platforms Ireland Limited, Merrion Road, Ballsbridge, Dublin D04 X2K5, Ireland (Facebook and Instagram);
• Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland;
• LinkedIn Unlimited Company, Wilton Place, Dublin 2, Ireland.
• YouTube, provided by Google Ireland Limited and/or Google LLC.

If you click the icons of the social networks, you will automatically be redirected to our profile on the respective network. A direct connection is then established between your browser and the server of the respective social network. This informs the network that you visited our Website using your IP address and clicked the link.

If you click a link to a network while logged into your user account with that network, the content of our Website may be linked to your profile, allowing the network to assign your visit to our Website directly to your account. If you wish to prevent this, you should log out before clicking the relevant links. A connection between your access to our Website and your user account will in any event be established if you log in to the respective network after clicking the link. The respective provider is the controller responsible under data protection law for the associated processing. Please therefore consult the information on the network’s website.

The legal basis for any processing attributable to us is our legitimate interest within the meaning of Art. 6(1)(f) EU GDPR in using and promoting our social media profiles.

13.2 Social media plugins

On our Website, you may use social plugins from the providers listed below:

• Meta Platforms Ireland Limited, Merrion Road, Ballsbridge, Dublin D04 X2K5, Ireland (Facebook and Instagram), privacy information;
• Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland, privacy information;
• LinkedIn Unlimited Company, Wilton Place, Dublin 2, Ireland, privacy information;
• TikTok, TikTok Information Technologies UK Limited, 6th Floor, One London Wall, London, EC2Y 5EB, United Kingdom; TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, privacy information.
• YouTube, provided by Google Ireland Limited and/or Google LLC, privacy information.

We use social plugins to make it easier for you to share content from our Website. Social plugins help us increase the visibility of our content on social networks and thus contribute to improved marketing.

The plugins are deactivated by default on our Websites and therefore do not send any data to social networks merely when our Website is accessed. To increase data protection, we have integrated the plugins in such a way that a connection to the networks’ servers is not established automatically. Only when you activate the plugins and thereby consent to the transfer and further processing of data by the social-network providers does your browser establish a direct connection to the servers of the respective social network.

The content of the plugin is transmitted directly by the social network to your browser and integrated into the Website by your browser. As a result, the respective provider receives information that your browser has accessed the corresponding page of our Website, even if you do not have an account with that social network or are not currently logged in. This information (including your IP address) is transmitted directly by your browser to a server of the provider (usually in the USA) and stored there. We have no influence over the scope of the data collected by the provider through the plugin, although from a data protection perspective we and the providers may, to a certain extent, be regarded as joint controllers.

If you are logged into the social network, it may directly assign your visit to our Website to your user account. If you interact with the plugins, the corresponding information is likewise transmitted directly to a server of the provider and stored there. The information (e.g. that you like one of our products) may also be published on the social network and, in some cases, displayed to other users of the social network. The social-network provider may use this information for advertising purposes and to design the respective service in line with user needs. For this purpose, usage, interest and relationship profiles may be created, for example to evaluate your use of our Website in relation to advertisements shown to you on the social network, to inform other users about your activities on our Website and to provide other services associated with use of the social network. For information about the purpose and scope of data collection, the further processing and use of the data by the social-network providers, and your related rights and settings for protecting your privacy, please refer directly to the privacy information of the respective provider.

If you do not want a provider to associate data collected via our Website with your user account, you may also log out of the respective network before activating the relevant function. Where social plugins or comparable embedded functions require consent, that consent – where the EU GDPR applies – constitutes the legal basis pursuant to Art. 6(1)(a) EU GDPR. You may withdraw your consent at any time via our cookie banner; in addition, the privacy and account settings of the respective provider are available to you.

14. Online advertising and targeting

14.1 General

We use services from various companies to present you with offers of interest online. Your usage behaviour on our Website and on websites of other providers is analysed so that individually tailored online advertising can subsequently be displayed to you.

Most technologies used to track your usage behaviour ("tracking") and display targeted advertising ("targeting") use cookies (see also Section 11), which enable your browser to be recognised across different websites. Depending on the service provider, it may also be possible to recognise you online when you use different devices (e.g. laptop and smartphone). This may be the case, for example, if you have registered for a service that you use on several devices.

In addition to the data already mentioned that is generated when websites are accessed ("log file data", see Section 10) and when cookies are used (Section 11), and which may be made available to companies participating in advertising networks, the following data in particular may be taken into account when selecting advertising that is potentially most relevant to you:

• information about you that you provided when registering for or using a service of an advertising partner (e.g. your gender, your age group);
• usage behaviour (e.g. search queries, interactions with advertising, types of websites visited, products viewed and purchased, newsletters subscribed to).

We and our service providers use this data to determine whether you belong to a target group that we wish to address and take this into account when selecting advertisements. For example, after you have visited our site, you may be shown advertisements for products you viewed when you access other sites ("retargeting"). Depending on the scope of the data, a user profile may also be created and evaluated automatically, with advertisements selected according to the information stored in the profile, such as membership of certain demographic segments or potential interests or behaviours. Such advertisements may be presented to you across various channels, including not only our Website or app (as part of onsite and in-app marketing), but also advertisements delivered through the online advertising networks we use, such as Google.

The data may subsequently be evaluated for billing with the service provider and to assess the effectiveness of advertising measures, helping us better understand the needs of our users and customers and improve future campaigns. This may also include information indicating that a particular action (e.g. visiting certain sections of our Websites or submitting information) can be attributed to a particular advertisement. We also receive aggregated reports from service providers about advertising activities and information on how users interact with our Website and our advertisements.

Where the EU GDPR applies, the legal basis for these processing activities is your consent within the meaning of Art. 6(1)(a) EU GDPR. You may change or withdraw your consent at any time with effect for the future via the settings of our cookie banner (Cookiebot). In addition, you may use the privacy and advertising settings of the respective providers.

14.1.1 Account linking and data matching

For analytics, campaign management and conversion measurement, we may – where technically configured and legally permissible – link accounts and services, in particular Google Analytics 4 with Google Ads and Google Merchant Center, and Microsoft Advertising with other Microsoft services. This may allow, for example, campaign information, conversion events, audience information and aggregated analytics values to be exchanged between linked accounts. Linking accounts does not mean that all data is automatically shared; the specific data flow depends on the respective settings, the functions used and your consent settings.

14.2 Google Ads

We use Google Ads provided by Google Ireland Limited and/or Google LLC for online advertising and conversion measurement. Depending on your consent and our configuration, Google tags, cookies and other identifiers may be used to measure advertising interactions, Website visits and conversions, optimise campaigns and create audiences. In particular, online identifiers, browser and device data, interaction and conversion data as well as transaction information may be processed.

Where the EU GDPR applies, the use of Google Ads for technically non-essential measurement and advertising purposes is based on your consent pursuant to Art. 6(1)(a) EU GDPR. You may withdraw this consent at any time via our cookie banner. Section 8 applies to any international transfers.

14.2.1 Google Enhanced Conversions and offline conversion import

To improve conversion measurement, we may use Google Enhanced Conversions. First-party data provided by you, in particular your e-mail address, telephone number and, depending on the configuration, your name and parts of your address, may be normalised, hashed using SHA-256 and transmitted to Google in order to better attribute conversions to advertising interactions. For offline conversions and subsequent conversion adjustments, we may also transmit conversion or order identifiers, timestamps, values and information about returns, cancellations or refunds to Google so that the measured advertising impact can be corrected retrospectively.

These functions are used only where the necessary legal requirements are met and the required consents have been obtained. Under its terms, Google uses the transmitted data in particular for matching, measurement, attribution and campaign optimisation.

14.2.2 Google Customer Match / customer matching

Where permissible and enabled by us, we may use Google Customer Match to reach existing customers in Google advertising services or exclude them from campaigns. For this purpose, data that you have provided directly to us, in particular your e-mail address, telephone number and, where applicable, name, country and postal code, may be transmitted to Google. Contact information may be hashed using SHA-256 before transmission. Google matches this data against Google accounts and, according to its own information, uses uploaded customer data only for Customer Match and related policy-compliance checks.

14.3 Google Remarketing

We may use Google Ads Remarketing to display interest-based advertising to visitors to our Website on Google services and partner sites. Cookies, online identifiers and event data may be used to create pseudonymous audiences and tailor advertisements to previous interactions with our Website. Remarketing is used only in accordance with your consent in the cookie banner. In addition, you may manage the settings for personalised advertising in your Google account.

14.4 YouTube videos

Content from YouTube may be embedded on our Website. For users in Switzerland, YouTube is provided in particular by Google Ireland Limited and/or Google LLC. When a video is loaded or played, Google and/or YouTube may process connection, device, usage and cookie data and, where applicable, associate this data with a Google account. Where consent is required to load embedded YouTube content, the connection is established only after the corresponding approval has been given via our cookie banner.

Where consent is required for embedded YouTube content, processing is based – where the EU GDPR applies – on your consent pursuant to Art. 6(1)(a) EU GDPR. You may change or withdraw this consent at any time with effect for the future via the settings of our cookie banner (Cookiebot).

Further information on the purpose and scope of data processing by Google and/or YouTube and on your settings options can be found in Google’s Privacy Policy. Section 8 applies to any transfers abroad.

14.5 Microsoft Advertising (Bing Ads)

We use Microsoft Advertising (Bing Ads) for displaying advertising, conversion measurement and remarketing. The service is provided by Microsoft Ireland Operations Limited and Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA. Through the Microsoft UET tag and other measurement functions, cookies or online identifiers may – depending on your consent – be set, and interactions with advertisements, Website visits and conversions may be measured.

In particular, the IP address, cookie and online identifiers, browser and device data, pages visited, interactions with advertising materials, conversion and transaction data as well as campaign-attribution information may be processed. Where Microsoft services or advertising accounts are linked, data may be exchanged between these services in accordance with the respective account settings.

Microsoft may process the data under its own responsibility under data protection law for the provision, measurement and security of its advertising services. We receive in particular campaign and conversion analyses; where possible, these are provided in aggregated or pseudonymous form.

Microsoft may also process data outside Switzerland and the EEA, in particular in the USA. Microsoft Corporation participates in the Swiss-U.S. Data Privacy Framework; where this framework or an adequacy decision does not apply, other recognised transfer mechanisms such as standard contractual clauses may be used. Section 8 also applies.

The retention period depends on the respective Microsoft services, our account settings and the retention periods applicable there. We therefore avoid specifying fixed retention periods where these may be changed by Microsoft.

Where processing is based on your consent, you may withdraw it at any time via our cookie banner. In addition, you may use the privacy and advertising settings of your Microsoft account.

Further details on data processing can be found in Microsoft Corporation’s privacy policy: privacy.microsoft.com/en-us/PrivacyStatement

14.6 Meta (Facebook & Instagram Ads)

For advertising, retargeting and conversion measurement, we use services from Meta Platforms Ireland Limited, Merrion Road, Ballsbridge, Dublin D04 X2K5, Ireland ("Meta"), in particular the Meta Pixel and – where used – the Meta Conversions API. This enables us to measure whether users visit our Website or perform certain actions such as making a purchase after interacting with an advertisement, and to create audiences for advertising on Facebook and Instagram.

The pixel transmits browser-side events to Meta; the Conversions API may additionally transmit events server-side. Depending on the configuration, this can enable more reliable measurements and attribution to advertising contacts. Technically non-essential browser- and server-side marketing transmissions are carried out only in accordance with your consent and the consent signals set by us.

In particular, the IP address, cookie and online identifiers, browser and device data, location information, usage and interaction data, product and shopping-cart information, conversion and transaction data as well as – where configured – hashed contact data such as the e-mail address may be processed.

Meta may also process data outside Switzerland and the EEA. For such transfers, the recognised transfer mechanisms used by Meta and the requirements under Section 8 apply. Where Meta or participating US companies are certified under the Swiss-U.S. Data Privacy Framework, the transfer may be based on that framework; otherwise, contractual safeguards in particular may be used.

Where Meta and we are joint controllers for individual measurement or event data, the allocation of responsibilities is governed by the applicable terms with Meta on joint controllership. Where processing is based on your consent, you may withdraw it at any time via our cookie banner. In addition, you may use the advertising and privacy settings in your Facebook or Instagram account.

14.7 Pinterest Ads

For advertising, conversion measurement and remarketing on Pinterest, we use services provided by Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland, and Pinterest, Inc., 651 Brannan St., San Francisco, CA 94107, USA. Through the Pinterest Tag and comparable measurement functions, the IP address, browser and device data, online identifiers, pages visited, product and shopping-cart information, conversion and transaction data as well as interactions with Pinterest advertisements may be processed – in accordance with your consent.

Where Enhanced Match is enabled, contact data provided by you, in particular your e-mail address and, depending on the configuration, additional contact or address data, may be hashed using SHA-256 before transmission and sent to Pinterest in order to improve attribution of conversions and audiences. Technically non-essential Pinterest measurement and marketing functions are used only in accordance with your consent in the cookie banner. Section 8 applies to international transfers.

14.8 OpenAI / ChatGPT Ads – conversion tracking

Where we place advertising in ChatGPT, we may use OpenAI’s conversion tools to measure performance. For customers in Switzerland, OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, is the relevant OpenAI contracting entity. Conversion measurement may be carried out via the OpenAI Pixel, the Conversions API or comparable measurement tools provided by OpenAI. Website events and transaction data, online identifiers, the click-reference value appended by OpenAI to an advertising click URL, as well as browser and device data may be processed.

Where Advanced Matching is enabled and legally permissible, first-party contact data provided by you may additionally be normalised, hashed and transmitted to OpenAI in order to better attribute conversions to advertising clicks. Under OpenAI’s current terms, OpenAI and we may act as independent controllers for certain processing activities; for certain limited matching activities, OpenAI processes data as a processor. We use these functions only in accordance with the required consents and legal requirements. Section 8 applies to any international transfers.

14.9 Sovendus

Vouchers and special offers: As a thank-you for orders, we give you access via Sovendus, an offering of our partner adfocus GmbH based in Baar, Switzerland, to vouchers and special offers for purchases and other services from other providers on the Internet. To provide you with this access, when an order is completed on our Website we integrate a corresponding notice from adfocus via an encrypted connection, through which data such as in particular your Internet Protocol (IP) address, which may constitute personal data, is exchanged with adfocus. Any personal data exchanged in this context is used exclusively to enable Sovendus to be offered on an ongoing, secure and reliable basis (legal bases under the GDPR, where and to the extent applicable: Art. 6(1)(b) and (f) GDPR). Further information on the nature, scope and purpose of the processing can be found in the Sovendus privacy policy.

14.10 Push notifications

If you activate push notifications for this Website, a function of your Internet browser or mobile operating system is used to provide the notifications to you. Only anonymous or pseudonymous data is transmitted for sending messages. Depending on the Website configuration, this may include:

• Pseudonymous user identifier: a randomly generated value stored in a tracking cookie ID
• Pseudonymous digital fingerprints, pseudonymous mobile device identifiers and, where applicable, pseudonymous cross-device identifiers

This data is processed only to deliver the notifications to which you have subscribed and to manage notification-related settings. We ask for your consent to store this data. In this case, the legal basis for processing is Art. 6(1)(a) GDPR. You may object to receiving notifications at any time via the settings of your browser or mobile device.

15. Trusted Shops / Trusted Badge

To display our Trusted Shops trustmark and, where applicable, collected reviews, and to offer Trusted Shops products to buyers after an order, the Trusted Shops Trustbadge is integrated into this Website. Where the EU GDPR applies, this serves our overriding legitimate interests, following a balancing of interests, in optimally marketing our offering pursuant to Art. 6(1)(f) EU GDPR. The Trustbadge and the services promoted through it are provided by Trusted Shops SE, Subbelrather Straße 15c, 50823 Cologne, Germany. When the Trustbadge is accessed, the web server automatically records a server log file containing, for example, your IP address, the date and time of access, the volume of data transmitted and the requesting provider (access data), and documents the access. This access data is processed in accordance with the rules applicable to the service. Other personal data may be transferred to Trusted Shops if you have consented to this, if you decide to use Trusted Shops products after an order or if you are already registered to use them. In that case, the applicable contractual arrangements and privacy information between you and Trusted Shops also apply.

16. Use of our appointment-booking function

To manage appointment bookings, we use the SimplyBook.me booking service provided by SimplyBook.me Ltd, Nafpliou 28, Medical Court, Floor 4, Office 401, 3025 Limassol, Cyprus. The data you enter when booking an appointment (name, e-mail address, telephone number and any other information) is processed to manage and administer the appointment. Further information on how SimplyBook.me processes your data can be found in the SimplyBook.me Privacy Policy.

17. Freshdesk customer service software

We use Freshdesk, customer service software provided by Freshworks Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA. The service helps us coordinate and process customer enquiries, orders and e-mails within our team. In particular, contact, communication and case data may be processed. Further information on Freshworks’ processing of data can be found in the Freshworks Privacy Notice. Section 8 applies to any transfers abroad.

18. Use of our chat function

If you contact us via chat, your personal data is processed. We process the data you provide to us, for example the name of your company, your name, your position, your e-mail address and your enquiry. The time at which the enquiry is received is also recorded. Mandatory fields are marked with an asterisk (*).

We process this data exclusively to handle your enquiry (e.g. to provide information about a product, support you with contract performance, such as returning products, or take your feedback into account when improving our services). To provide the chat function, we use a service from Freshworks Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA. Freshworks may access the data processed in connection with the chat where this is necessary to provide, operate and support the service. Section 8 applies to any transfers abroad.

Where the EU GDPR applies, the legal basis for this processing is our legitimate interest pursuant to Art. 6(1)(f) EU GDPR in using modern communication technologies or, where your request concerns the conclusion or performance of a contract, Art. 6(1)(b) EU GDPR.

19. Registration for a customer account

If you open a customer account on our Website, we collect the following data, with mandatory fields marked with an asterisk (*) in the relevant form:

• Personal details:
• Title / salutation
• Last name
• First name
• Billing and delivery address
• Date of birth
• Company, company address
• Login details:
• E-mail address
• Password
• Additional information:
• Languages
• Gender

We use your personal details to establish your identity and verify the requirements for registration. Your e-mail address and password together serve as login details and thus help ensure that the correct person uses the Website under your details. We also need your e-mail address to verify and confirm the opening of the account and for future communications with you that are required for contract performance. This data is also stored in the customer account for future contracts. For this purpose, we also allow you to store additional information in your account.

We also use the data to provide an overview of products ordered and services used (see in particular Sections 20 and 25), to provide an easy way for you to manage your personal data, and for the administration of our Website and contractual relationships, i.e. to establish, define, perform and amend contracts concluded with you via your customer account.

We process information about language and gender in order to display on the Website offer recommendations tailored as closely as possible to your profile and personal needs, to record and evaluate the selected offers statistically and thereby optimise our recommendations and offers.

The legal basis for processing your data for the above purpose is your consent pursuant to Art. 6(1)(a) EU GDPR. You may withdraw your consent at any time by removing the information from your customer account again, deleting your customer account, or asking us to delete it.

To prevent misuse, you must always keep your login details confidential and should close the browser window when you have finished communicating with us, especially if you share the computer with others.

20. Ordering products

If you wish to order products or book services on the Website, we require various data to process the contract. If you do not log in with your customer account (see Section 19), we collect – depending on the product or service – the following data, with mandatory fields marked with an asterisk (*) in the relevant form:

• Title / salutation
• Last name
• First name
• Billing and delivery address
• E-mail address
• Date of birth
• Company, company address
• Telephone number

We use the data to establish your identity before concluding a contract. We also need your e-mail address to confirm your order and for future communications with you that are required for contract performance. We store your data together with the order metadata (e.g. time, order number, etc.), the data relating to the products/services ordered or booked (e.g. designation, price and product characteristics; "product data"), payment data (e.g. selected payment method, confirmation of payment and time; see also Section 21) and information relating to the processing and performance of the contract (e.g. product returns, use of service or warranty benefits, etc.) in our CRM database (see Section 6.1) so that we can ensure correct order processing and contract performance.

Where this is necessary for contract performance, we will also disclose the required information to any third-party service providers involved (e.g. transport companies).

The legal basis for these processing activities is the performance of the contract with you pursuant to Art. 6(1)(b) EU GDPR.

Providing data that is not marked as mandatory is voluntary. We process this data in order to tailor our offer as closely as possible to your personal needs, facilitate contract processing, contact you via an alternative communication channel where necessary in connection with contract performance, or record and evaluate data statistically in order to optimise our offers. The legal basis for this processing is your consent within the meaning of Art. 6(1)(a) EU GDPR. You may withdraw your consent at any time by notifying us.

21. Online payment processing

If you purchase paid services or products on our Website, additional data may be required depending on the product or service and the desired payment method, in addition to the information referred to in Section 20, such as your credit card details or login details for your payment service provider. This information, together with the fact that you purchased a service from us for the relevant amount and at the relevant time, is transmitted to the respective payment service providers (e.g. payment-solution providers, credit card issuers and credit card acquirers). Please always take note of the information provided by the respective company, in particular its privacy policy and general terms and conditions. The legal basis for this transmission is the performance of a contract pursuant to Art. 6(1)(b) EU GDPR.

To prevent payment defaults, we may transmit the necessary data, in particular your personal details, to Intrum AG, Eschenstrasse 12, 8603 Schwerzenbach, Switzerland, for an automated assessment of your creditworthiness. In this context, Intrum may assign you a so-called score value. This is an estimate of the future risk of payment default and may be calculated using mathematical and statistical methods and data from other permissible sources. Depending on the credit information received, we reserve the right not to offer you the “invoice” payment method. Where the EU GDPR applies, the legal basis for this processing is our legitimate interest pursuant to Art. 6(1)(f) EU GDPR in preventing payment defaults.

22. Submission of reviews

To help other users make purchasing decisions and to support our quality management (in particular the handling of negative feedback), you may review products ordered through our Website. The data that you provide to us is processed and published on the Website, i.e. in addition to your review and the time it was submitted, potentially also a comment that you added to the review or the name you provided. The legal basis for the processing is your consent within the meaning of Art. 6(1)(a) EU GDPR.

We reserve the right to delete unlawful reviews and, where there is suspicion of unlawful content, to contact you and ask you to comment. The legal basis for these processing activities is our legitimate interest within the meaning of Art. 6(1)(f) EU GDPR in providing the comment and review function and preventing misuse of it.

22.1 Google Customer Reviews

We participate in the Google Customer Reviews programme provided by Google Ireland Limited and/or Google LLC. On the order confirmation page, you may be shown the option to consent to receiving a review survey from Google. If you participate, we transmit to Google in particular the order ID, your e-mail address, the delivery country and the estimated delivery date. Google may send you an e-mail containing a review survey after delivery. Participation is voluntary and takes place only if you make the corresponding selection. For further processing by Google and any international transfers, Google’s privacy provisions and Section 8 of this Privacy Policy apply.

C. Special information for our retail store

23. Use of our Wi-Fi network

In our retail store, you can use free of charge the Wi-Fi network operated by Genossenschaft GGA Maur (Binzstrasse 1, 8122 Binz, Switzerland). Prior registration is required to prevent misuse and to take action against unlawful conduct. In doing so, you transmit the following data to Genossenschaft GGA Maur:

• Mobile telephone number
• MAC address of the device (automatically)

In addition to the above data, each use of the Wi-Fi network records data about the retail store visited, including the time, date and device. The legal basis for these processing activities is your consent within the meaning of Art. 6(1)(a) EU GDPR. The customer may withdraw their registration at any time by notifying us.

Genossenschaft GGA Maur must comply with the statutory obligations under the Swiss Federal Act on the Surveillance of Post and Telecommunications (SPTA) and the associated ordinance. Where the legal requirements are met, the operator of the Wi-Fi network must, on behalf of the competent authority, monitor Internet use or data traffic. The Wi-Fi operator may also be required to disclose the customer’s contact, usage and metadata to authorised authorities. Contact, usage and metadata are retained in personally identifiable form for 6 months and then deleted.

The legal basis for these processing activities is our legitimate interest within the meaning of Art. 6(1)(f) EU GDPR in providing a Wi-Fi network in compliance with the applicable legal requirements.

24. Opening a customer account

If you open a customer account in our retail store, we collect the following data, with mandatory fields marked with an asterisk (*) in the relevant form:

• Title / salutation
• Last name
• First name
• Billing and delivery address
• E-mail address
• Date of birth
• Company, company address and UID number for business customers
• Telephone number

We use the data to establish your identity and verify the requirements for opening the account. We collect your e-mail address and telephone number for future communications with you that are required for contract performance. In addition, this data and the data relating to purchases of products and use of services (see Section 25) are stored under a customer number in the customer account so that, at your request, we can provide you with an overview of your data and enable future linking with data from other channels. Your account and the stored data are also linked to your online account (see Section 19) where the personal details are identical.

The legal basis for processing your data for the above purpose is your consent pursuant to Art. 6(1)(a) EU GDPR. You may withdraw your consent at any time by asking us to delete the data.

25. Purchase or ordering of products in the retail store

As a rule, you can also purchase products in our retail store without providing your name; in this case, however, please note the section on payment processing (see Section 26). At your request, you will receive a paper receipt, which you should retain and present if you wish to use customer services after the purchase (see Section 27). You may also purchase products using your customer account. In this case, please also note the section on opening a customer account (see Section 24).

When purchasing and/or ordering certain products, we require your name and various other data in order to process the contract. Depending on the product or service, we collect the following data, with mandatory fields in forms marked with an asterisk (*):

• Title / salutation
• Last name
• First name
• Billing and delivery address
• E-mail address
• Date of birth
• Company, company address and UID number for business customers
• Telephone number

We use the data to establish your identity before concluding a contract. We also need your e-mail address for future communications with you that are required for contract performance. We store your data together with the order metadata (e.g. time, order number, etc.), the data relating to the products/services ordered or booked (e.g. designation, price and product characteristics; "product data"), payment data (e.g. selected payment method, confirmation of payment and time; see also Section 26) and information relating to the processing and performance of the contract (e.g. product returns, use of service or warranty benefits, etc.) in our CRM database (see Section 6.1) so that we can ensure correct order processing and contract performance.

Where this is necessary for contract performance, we will also disclose the required information to any third-party service providers involved (e.g. transport companies).

The legal basis for these processing activities is the performance of the contract with you pursuant to Art. 6(1)(b) EU GDPR.

Providing data that is not marked as mandatory is voluntary. We process this data in order to tailor our offer as closely as possible to your personal needs, facilitate contract processing, contact you via an alternative communication channel where necessary in connection with contract performance, or record and evaluate data statistically in order to optimise our offers. The legal basis for this processing is your consent within the meaning of Art. 6(1)(a) EU GDPR. You may withdraw your consent at any time by notifying us.

26. Payment processing

If you purchase products in our retail store using electronic means of payment, personal data must be processed. By using the payment terminals, you transmit the information stored in your payment instrument, such as the cardholder’s name and the card number, to the payment service providers involved (e.g. providers of payment solutions, credit card issuers and credit card acquirers). They also receive information that the payment instrument was used in our store, the amount and the time of the transaction. Conversely, we receive only the credit for the amount of the completed payment at the corresponding time, which we can assign to the relevant receipt number, or information that the transaction was not possible or was cancelled. Please always take note of the information provided by the respective company, in particular its privacy policy and general terms and conditions. The legal basis for this transfer is the performance of the contract with you pursuant to Art. 6(1)(b) EU GDPR.

27. Use of customer services in the retail store

In our retail store, you can use a range of customer services that may require the processing of personal data. These include, for example, collecting an ordered product, returning products in exercise of a right of return or a warranty claim, making a complaint about a service, etc. In such cases, depending on the product concerned or the service requested, we collect the following data, with mandatory fields in forms marked with an asterisk (*):

• Title / salutation
• Last name
• First name
• Billing and delivery address
• E-mail address
• Date of birth
• Company, company address and UID number for business customers
• Telephone number

We use the data to establish your identity. We also need your e-mail address for the communications with you required to provide the customer service. We store this data together with the details, time and content of the requested service in our CRM database (see Section 6.1) so that we can ensure correct handling of the requested service. Where this is necessary for contract performance, we will also disclose the required information to any third-party service providers involved (e.g. transport companies) or other third parties involved (e.g. manufacturers in the event of a claim under a manufacturer’s warranty).

The legal basis for this processing is our legitimate interest within the meaning of Art. 6(1)(f) EU GDPR in dealing with your request or, where your request concerns the performance of a contract with you, the necessity of taking the required contractual steps within the meaning of Art. 6(1)(b) EU GDPR.

Version: 9 September 2026