Our website can generally be used without providing personal data. Where such data is collected (e.g. name, address or email address), this is always done, where possible, on a voluntary basis. Such data will not be passed on to third parties without your consent. However, we expressly point out that complete protection of data against access by unauthorized third parties is not possible.

The protection of your personal data is of particular concern to us. We therefore process your data exclusively on the basis of the statutory provisions (GDPR, TKG 2003). In this privacy information, we inform you about the most important aspects of data processing in the context of our website. When you visit our website, your IP address, the beginning and end of the session are recorded for the duration of that session. This is technically necessary and therefore constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. We do not further process this data.

Orders via the webshop

For the purpose of contract processing, we process the information provided within the webshop (salutation, name, address, telephone number, email address) and the selected goods. The data you provide is required for the performance of the contract or for the implementation of pre-contractual measures. Without this data, we cannot conclude the contract with you. No data will be transferred to third parties, with the exception of transferring the address to the shipping company commissioned by us for delivery of the goods and to our tax advisor for the fulfillment of our tax obligations. In the event of default in payment or an impending loss, we transmit your contact data (salutation, name, address, email address) as well as information about your order to debt collection agencies commissioned by us for the purpose of reminding you and/or collecting outstanding claims.

We offer the option of processing the payment transaction via the payment service provider Stripe, c/o Legal Process, 510 Townsend St., San Francisco, CA 94103 (Stripe). This corresponds to our legitimate interest in offering an efficient and secure payment method (Art. 6 para. 1 lit. f GDPR). In this context, we pass the following data on to Stripe, insofar as this is necessary for the performance of the contract (Art. 6 para. 1 lit. b GDPR).

– Name of cardholder
– Email address
– Customer number
– Order number
– Bank details
– Credit card details
– Credit card expiry date
– Credit card verification number (CVC)
– Date and time of the transaction
– Transaction amount
– Name of the provider
– Location

The processing of the data stated in this section is neither legally nor contractually required. Without the transfer of your personal data, we cannot process a payment via Stripe. [You may choose another payment method.]

Stripe acts in a dual role as controller and processor in data processing activities. As controller, Stripe uses your transmitted data to fulfill regulatory obligations. This corresponds to Stripe’s legitimate interest (pursuant to Art. 6 para. 1 lit. f GDPR) and serves the performance of the contract (pursuant to Art. 6 para. 1 lit. b GDPR). We have no influence on this process.

As processor, Stripe acts in order to be able to complete transactions within the payment networks. Within the framework of the processing relationship, Stripe acts exclusively on our instructions and has been contractually obliged, within the meaning of Art. 28 GDPR, to comply with data protection regulations.

Stripe has implemented compliance measures for international data transfers. These apply to all global activities in which Stripe processes personal data of natural persons in the EU. These measures are based on the EU Standard Contractual Clauses (SCCs).

Further information on options for objection and removal vis-à-vis Stripe can be found here.

Registration

We offer you the possibility to register on our site. The data entered during this registration, which can be seen from the input form of the registration form, are collected and stored exclusively for the use of our offer. When you register on our site, we also store your IP address and the date and time of your registration.

This serves as protection on our part in the event that a third party misuses your data and registers on our site with these data without your knowledge. No data will be passed on to third parties. No comparison of the data collected in this way with data that may be collected by other components of our site is carried out either. When the registered account is deleted, your data will also be deleted.

Promotional contact

With your voluntary consent to promotional contact by us, we will process your email address, salutation and name for the sending of direct marketing materials by email in accordance with § 174 TKG to the extent consented to:

If you additionally have given consent to the setting of marketing and analytics cookies, your consent to receive newsletters also includes the information collected in this way about your customer behavior, which we use to personalize such promotional communications.

You may revoke your consent to promotional contact at any time, without giving reasons, for all or individual purposes and with effect for the future (e.g. via a link at the end of each newsletter). If you forward our newsletters to third parties, you are obliged to comply with the legal provisions and to obtain the recipient’s prior consent. If a third party asserts claims against us due to newsletter forwardings by you, you shall hold us harmless and indemnify us in respect of all related claims, including penalties and costs of legal defense.

Brevo

For sending our newsletter, we use the service Brevo (formerly Sendinblue), provided by Brevo SAS, 106 Boulevard Haussmann, 75008 Paris, France.

Brevo is used by us as a processor within the meaning of Art. 28 GDPR. A corresponding data processing agreement has been concluded with the provider.

Processed data
In the context of newsletter registration and use, the following personal data are processed in particular:
– Email address
– First and last name
– IP address as well as date and time of registration (double opt-in)
– Usage data in connection with the newsletter (e.g. open and click rates)

Purpose of processing
The data processing is carried out for the purpose of sending information and marketing content as well as for statistical evaluation in order to optimize our newsletter in terms of content and technically.

Newsletter tracking
Our newsletters contain so-called tracking pixels and tracking links. This enables us to evaluate whether and when a newsletter was opened and which links were clicked. These evaluations help us to better adapt the content to the interests of the recipients.

Legal basis
The sending of the newsletter and the associated tracking are based on:
– your consent pursuant to Art. 6 para. 1 lit. a GDPR, and
– § 174 para. 4 TKG 2021 (sending to existing customers for our own similar products or services), provided the legal requirements are met.

Data transfer
As a rule, data processing takes place within the European Union. Should data be transferred to third countries in individual cases, Brevo ensures an appropriate level of data protection through suitable safeguards (e.g. Standard Contractual Clauses pursuant to Art. 46 GDPR).

Revocation / unsubscribe
You can unsubscribe from the newsletter at any time, e.g. via the unsubscribe link in each newsletter or by sending us a corresponding notice. Revoking consent does not affect the lawfulness of processing carried out up to that point.

Further information on data processing by Brevo can be found in the provider’s privacy policy.

Mailchimp

For sending our newsletter, we also use the service Mailchimp, provided by Intuit Inc., 2700 Coast Ave, Mountain View, CA 94043, USA.

Mailchimp is used by us as a processor within the meaning of Art. 28 GDPR. A corresponding data processing agreement has been concluded with the provider.

Processed data: In the context of newsletter registration and use, the following personal data are processed in particular:
– Email address
– First and last name
– IP address as well as date and time of registration (double opt-in)
– Usage data in connection with the newsletter (e.g. open and click rates)

Purpose of processing: The processing of personal data takes place for the purpose of sending information and marketing content as well as for analysis and statistical evaluation in order to optimize our newsletter and adapt it to the interests of the recipients.

Newsletter tracking: The newsletters sent with Mailchimp contain tracking technologies (e.g. tracking pixels and personalized links). These make it possible to evaluate whether a newsletter was opened and which content was clicked. We use this information to improve our newsletter content.

Legal basis: The sending of the newsletter and the associated tracking are based on:
– your consent pursuant to Art. 6 para. 1 lit. a GDPR, and
– § 174 para. 4 TKG 2021 (sending to existing customers for our own similar products or services), provided the legal requirements are met.

Data transfer to third countries: Mailchimp also processes data in the USA. The transfer of personal data takes place on the basis of suitable safeguards pursuant to Art. 46 GDPR, in particular through the conclusion of Standard Contractual Clauses. This ensures an appropriate level of data protection.

Revocation / unsubscribe: You can unsubscribe from the newsletter at any time, for example via the unsubscribe link in each newsletter or by sending us a corresponding notice. Revocation of consent does not affect the lawfulness of processing carried out up to that point.

Further information on data processing by Mailchimp can be found in the provider’s privacy policy.

Instagram-Feed

An Instagram feed is embedded on our website. The provider of the service is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

By embedding the Instagram feed, personal data may be transmitted to Meta when you visit our website. This includes in particular the IP address as well as information about the browser used, the device and user behavior. If you are logged in to Instagram, Meta may be able to assign the visit to our website to your user account.

Data transfer and transfer to third countries: Meta also processes personal data in the USA. The transfer takes place on the basis of suitable safeguards pursuant to Art. 46 GDPR, in particular through the conclusion of Standard Contractual Clauses.

Legal basis: The Instagram feed is only embedded after your express consent via our cookie consent tool. The legal basis for processing is Art. 6 para. 1 lit. a GDPR.

Revocation of consent: You may revoke your consent at any time with effect for the future by changing the relevant settings in our cookie consent tool.

Google Fonts 

Fonts (“Google Fonts”) provided by Google are used on our website. The fonts are embedded locally on our server, so no connection to Google servers is made when our website is accessed.

No personal data are transmitted to Google.

Contests

In connection with contests offered by us, your data will be used solely for the administration of the contest, unless you expressly consent to another use on a case-by-case basis.

Disclosure to third parties

We also transmit your personal data to external agents or service providers to the extent necessary: to other service providers, tool providers and software solution providers who also support us in the provision of our services and act on our behalf; to any third parties who cooperate in the fulfillment of our obligations towards you (for example parcel service providers for delivery of your webshop order, payment service providers for payment processing in the webshop, banks for payment processing); to other external third parties to the extent necessary (e.g. auditors, insurance companies in the event of a claim, legal representatives in a specific case, debt collection agencies in the event of payment default or loss, etc.); to authorities and other public bodies to the extent required by law (e.g. tax authorities, etc.).

Retention period

As a matter of principle, we store your personal data only as long as is necessary to fulfill our obligations to you. For reasons of tax and company-law retention obligations, however, we generally store the personal data you provide in connection with orders for seven years after performance of the contract.

If you have only subscribed to newsletters and the receipt of promotional information and are not one of our customers, we store your personal data until you revoke your consent and for a maximum of three years from your last contact.

Data security

We take appropriate technical and organizational security measures to protect your personal data against accidental or unauthorized deletion, alteration or against loss, theft and unauthorized inspection, disclosure, reproduction, use, modification or access. In addition, we and our employees are obliged to maintain data secrecy and confidentiality. Likewise, our agents and contractors who must have access to your personal data in order to fulfill their professional tasks will be granted access and will be subject to the same obligations of data secrecy and confidentiality.

Server data

For technical reasons, the following data transmitted by your internet browser to us or to our web space provider are recorded (so-called server log files):
– browser type and version
– operating system used
– website from which you visit us (referrer URL)
– website you visit
– date and time of your access
– your Internet Protocol (IP) address.

These anonymous data are stored separately from any personal data you may have provided and do not allow any conclusions to be drawn about a specific person. They are evaluated for statistical purposes in order to ensure the operation, security, stability and functionality of the website and to enable us to optimize our offerings. 

Use of cookies and Borlabs Cookie

Our website uses cookies, small text files that are stored on your device.

Cookies are used to make our website easier to use, personalize content, create statistics or control advertising.

To obtain your consent, we use the Borlabs Cookie banner. Through the banner you can choose which cookies you allow.

We distinguish between:
– Necessary cookies: technically required, active without consent
– External media / marketing / statistics: active only after your consent

You may revoke or adjust your consent at any time, e.g. via the cookie banner on our website.

Web analytics – Google Analytics

Our website uses the web analytics service “Google Analytics” provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”). Google also processes personal data on servers in third countries (in particular the USA); for this purpose, among other things, EU Standard Contractual Clauses pursuant to Art. 46 GDPR are used.

Google Analytics uses cookies or similar technologies that enable an analysis of the use of our website. The information generated by the cookie about your use of our website (e.g. pages accessed, length of stay, source of origin, browser used and device type) is generally transmitted to a Google server and stored there.

We use Google Analytics only if you have consented to the category “Statistics / Web Analytics” via our cookie banner. The legal basis for processing is therefore your consent pursuant to Art. 6 para. 1 lit. a GDPR in conjunction with § 165 TKG 2021. You may revoke your consent at any time with effect for the future via the settings in the cookie banner.

IP anonymization is activated on this website. As a result, your IP address is shortened within the member states of the European Union or in other contracting states to the Agreement on the European Economic Area; only in exceptional cases will the full IP address be transmitted to a Google server and shortened there. According to Google, the IP address transmitted within the framework of Google Analytics is not merged with other Google data.

On our behalf, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide us with other services relating to website and internet use.

You can also prevent the storage of cookies by setting your browser software accordingly and prevent the collection by Google of the data generated by the cookie and relating to your use of the website (including your IP address) as well as the processing of this data by Google by installing a browser add-on available for deactivating Google Analytics (opt-out). Further information on data processing by Google, on the Standard Contractual Clauses used, and on settings and objection options can be found in Google’s privacy policy at https://policies.google.com/privacy.

Your rights

In principle, you have the rights to access, rectification, erasure, restriction, data portability, revocation and objection with regard to your data stored by us. If you believe that the processing of your data violates data protection law or that your data protection claims have otherwise been violated in some way, you can lodge a complaint with the data protection authority.

You can exercise your rights vis-à-vis Veronika Mitteregger and Brüder Gross GmbH as follows:

by letter:
Veronika Mitteregger, Am Kittenberg 15, 8451 Heimschuh
Brüder Gross GmbH, Ratsch 26, 8461 Ehrenhausen an der Weinstraße
by email: mail@flein.net, office@flein.net