Privacy Policy

Controller

Name and address of the Controller

Nepata GmbH
Hochstatt 6-8
85283 Wolnzach
Deutschland
Tel.: +49 8442 95840 0
E-Mail: oliver.tiedemann@nepata.de

The provision of personal data is neither legally nor contractually required. You are not obliged to provide it, and a failure to provide it has no consequences, unless stated otherwise.

"Personal data" means any information relating to an identified or identifiable natural person.

Server log files

Visits to the website take place without any required personal details. On each access, usage data is transmitted by the browser and stored in server log files (name of the page accessed, date, time, IP address, volume of data transferred, provider). The processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of a legitimate interest in trouble-free operation and in improving our services.

Contact

Controller

The contact details of the controller responsible for data processing can be found in the legal notice.

Customer-initiated contact by email

If you contact the company on your own initiative by email, the company collects your name, email address and the text of the message to the extent provided. The data processing serves to handle and respond to the contact enquiry.

In the case of pre-contractual measures or existing contracts, the processing is carried out pursuant to Art. 6(1)(b) GDPR. For other reasons, it is carried out pursuant to Art. 6(1)(f) GDPR on the basis of a legitimate interest. You have the right to object at any time to this processing based on Art. 6(1)(f) GDPR.

The email address is used only to process the enquiry. Data is deleted in compliance with statutory retention periods, unless more extensive consent has been given.

Collection and processing when using the contact form

When using the contact form, your name, email address and the text of the message are collected to the extent provided. By sending the form, you confirm that the processing is carried out pursuant to Art. 6(1)(a) GDPR with your consent.

Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out up to that point. The email address is used only to process the enquiry; data is subsequently deleted, unless more extensive consent has been given.

Customer account and orders

Customer account

When you open an account, data is collected to the extent specified. The processing improves the shopping experience and simplifies order handling. It is carried out pursuant to Art. 6(1)(a) GDPR with your consent, which may be withdrawn at any time. The account is subsequently deleted.

Collection, processing and disclosure of personal data for orders

When you place an order, data is collected only to the extent necessary to fulfil and process the order and to handle the enquiry. Provision is required for the conclusion of the contract; failure to provide it prevents the conclusion of the contract. The processing is carried out pursuant to Art. 6(1)(b) GDPR.

Data is disclosed to shipping companies, dropshipping providers, payment service providers, service providers and IT service providers. Statutory requirements are observed; the transfer of data is limited to a minimum.

Reviews and advertising

Data collection when writing a comment

When commenting on an article or post, your name, email address and the text of the comment are collected to the extent provided. By sending the comment, you confirm that the processing is carried out pursuant to Art. 6(1)(a) GDPR with your consent.

Consent may be withdrawn at any time. On publication, only the name provided is published; personal data is subsequently deleted.

Shopauskunft customer review

The review tool "shopauskunft.de" provided by Händlerbund Management AG (Torgauer Straße 233 B, 04347 Leipzig) is used. After an order, a request to submit a review is sent by email using the "Rechtssichere Bewertungsanfrage (RBA)" system.

Order data (order number/invoice number, purchase value, shipping costs) and your email address are processed. The processing is carried out pursuant to Art. 6(1)(a) GDPR with your consent to the disclosure of data and the request to submit a review.

Consent may be withdrawn at any time by means of the relevant link or by notification. Further information: https://www.shopauskunft.de/datenschutz

Use of the email address for sending newsletters

Independently of the performance of a contract, the email address is used exclusively for advertising purposes to send newsletters, provided that express consent has been given. The processing is carried out pursuant to Art. 6(1)(a) GDPR with your consent, which may be withdrawn at any time.

The newsletter may be unsubscribed from by means of the relevant link or by notification; the email address is then removed. Data is disclosed to a service provider for email marketing as part of processing on our behalf; no disclosure to other third parties takes place.

Use of the email address for direct advertising

The email address obtained from the sale of goods or the provision of a service is used for electronic advertising for our own similar goods/services, provided that no objection has been raised. Provision is required for the conclusion of the contract; failure to provide it prevents the conclusion.

The processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of a legitimate interest in direct advertising. You may object to this use at any time. Contact details for objecting can be found in the legal notice; the link in the advertising email may also be used. Only standard transmission costs are incurred.

Shipping service providers

Disclosure of the email address to shipping companies

As part of the performance of the contract, the email address is disclosed to the transport company, provided that express consent has been given during the ordering process. This serves to provide information on the shipping status. The processing is carried out pursuant to Art. 6(1)(a) GDPR with your consent, which may be withdrawn at any time.

Payment service providers and credit checks

Use of PayPal

All PayPal transactions are subject to the PayPal privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Use of PayPal Express

PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxemburg) is used as a payment service. The data processing enables payment via PayPal Express.

On accessing the website, PayPal collects data (IP address, device type, operating system, browser type, location) and stores it. Cookies enable the browser to be recognised. The use of cookies is carried out pursuant to Section 15(3) sentence 1 TMG; the processing of personal data is carried out pursuant to Art. 6(1)(f) GDPR on the basis of a legitimate interest in a customer-oriented variety of payment methods. You have a right to object to this processing.

When PayPal Express is selected, the required payment data is transmitted to PayPal pursuant to Art. 6(1)(b) GDPR.

Use of Amazon Payments

Amazon Payments Europe s.c.a. (38 avenue John F. Kennedy, L-1855 Luxemburg) is used as a payment service. The data processing enables payment via Amazon Payments.

On accessing the website, Amazon Payments collects data (IP address, device type, operating system, browser type, location) and stores it. Cookies enable the browser to be recognised. The use of cookies is carried out pursuant to Section 15(3) sentence 1 TMG; the processing of personal data is carried out pursuant to Art. 6(1)(f) GDPR on the basis of a legitimate interest in a customer-oriented variety of payment methods. You have a right to object to this processing.

When Amazon Payments is selected, the required payment data is transmitted to Amazon Payments pursuant to Art. 6(1)(b) GDPR. Further information: https://pay.amazon.com/de/help/201212490

Data collection and processing for credit checks

In the case of advance performance (purchase on account or by direct debit), a credit check may be obtained from SCHUFA Holding AG (Komoranweg 5, 65201 Wiesbaden). The required data is transmitted; the information received is used to make balanced decisions on the establishment, performance or termination of the contract.

The credit check may include probability values (score values) that are based on mathematical and statistical methods and take address data into account. Interests worthy of protection are taken into account in accordance with the statutory provisions. The data processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of a legitimate interest in protection against payment default. You have a right to object to this processing. Provision is required for the conclusion of the contract with the chosen payment method; failure to provide it prevents the conclusion with this payment method.

Cookies

General information about cookies

The website uses cookies — small text files that are stored in the browser or on the computer system. When the website is accessed, a cookie may be stored on the operating system and contains a characteristic string of characters that allows the browser to be recognised.

Cookies are stored on your computer; you have full control over them. By means of the appropriate browser settings, you can be notified before cookies are set, decide individually whether to accept them, or prevent their storage. Cookies already stored can be deleted at any time. However, if cookies are deactivated, you may not be able to make full use of all functions of the website.

Technically necessary cookies

Unless stated otherwise, only technically necessary cookies are used in order to make our services more user-friendly, effective and secure. Cookies allow your browser to be recognised even after you change pages, and enable the provision of services. Some functions cannot be offered without the use of cookies, as the browser must be recognised after a change of page.

The use of cookies is carried out pursuant to Section 15(3) sentence 1 TMG. The processing of personal data is carried out pursuant to Art. 6(1)(f) GDPR on the basis of a legitimate interest in optimal website functionality and in a user-friendly, effective design. You have a right to object to this processing.

Analytics and advertising tracking

Use of Google Analytics

Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) is used for website analysis. If you are resident in the EU/EEA or Switzerland, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Irland) is the responsible data controller.

The data processing analyses the website and visitors as well as serving marketing and advertising purposes. The information collected includes: IP address, date/time of page access, click path, browser and device information, pages visited, referrer URL, location data, purchasing activities. The website has IP anonymisation activated.

The processing of personal data is carried out pursuant to Art. 6(1)(f) GDPR on the basis of a legitimate interest in a needs-based and targeted design of the website. You have a right to object to this processing. You can prevent the collection of data by means of a browser plug-in: https://tools.google.com/dlpage/gaoptout?hl=de

Use of the Facebook Pixel

Facebook Inc. (1601 S. California Ave, Palo Alto, CA 94304, USA) is used for the "Custom Audiences" remarketing function. When you visit the website, a direct connection to the Facebook servers is established; information about the pages you visit is assigned to your Facebook user account. Data may be transferred to the USA.

The processing of personal data is carried out pursuant to Art. 6(1)(f) GDPR on the basis of a legitimate interest in addressing visitors with interest-based advertising. You have a right to object to this processing. Further information: https://www.facebook.com/about/privacy/

Use of Google Ads conversion tracking

Google LLC or Google Ireland Limited is used for "Google Ads" and conversion tracking. When you click on a Google ad, a conversion tracking cookie is set; these cookies contain no personal data and do not serve to identify you personally. Data may be transferred to the USA.

The processing of personal data is carried out pursuant to Art. 6(1)(f) GDPR on the basis of a legitimate interest in addressing visitors with interest-based advertising. You have a right to object to this processing. To deactivate personalised advertising: https://support.google.com/ads/answer/2662922?hl=de

Use of the remarketing or "similar audiences" function of Google Inc.

Google LLC or Google Ireland Limited is used for the remarketing or "similar audiences" functions. Cookies are used to record website visits and anonymised usage data; no personal data of visitors is stored. Data may be transferred to the USA.

The processing of personal data is carried out pursuant to Art. 6(1)(f) GDPR on the basis of a legitimate interest in addressing visitors with interest-based advertising. You have a right to object to this processing. To deactivate: https://support.google.com/ads/answer/7395996?hl=de

Plug-ins and other

Use of Google Tag Manager

Google LLC or Google Ireland Limited is used for Google Tag Manager. This manages JavaScript and HTML tags used to implement tracking and analytics tools. Google Tag Manager itself neither stores cookies nor processes personal data, but it does enable the triggering of further tags. Further information: https://www.google.com/intl/de/tagmanager/use-policy.html

Use of Facebook Connect

Facebook Ireland Ltd. (Grand Canal Harbour, Dublin, D02, Irland) is used for the Facebook Connect single sign-on function, which enables you to log in using an existing Facebook account. In doing so, a connection to the Facebook servers is established and cookies are used; data may be transferred to the USA.

The processing of personal data is carried out pursuant to Art. 6(1)(f) GDPR on the basis of a legitimate interest in a needs-based and targeted design of the website. You have a right to object to this processing.

Use of Google reCAPTCHA

Google LLC or Google Ireland Limited is used for the reCAPTCHA service, which distinguishes human input from automated input. In doing so, the input, your IP address and possibly further data are transmitted to Google and may be transferred to the USA.

The processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of a legitimate interest in protecting the website against automated spying, misuse and SPAM. You have a right to object to this processing.

Use of GoogleMaps

Google LLC or Google Ireland Limited is used for GoogleMaps embeds, which display geographical information and interactive maps. In doing so, Google collects and processes visitor data; data may be transferred to the USA.

The processing of personal data is carried out pursuant to Art. 6(1)(f) GDPR on the basis of a legitimate interest in a needs-based and targeted design of the website. You have a right to object to this processing.

Use of YouTube

Google Ireland Limited is used for embedding YouTube videos. The "extended data protection mode" option is activated, so YouTube does not store any visitor information until a video is watched. Data may be transferred to the USA.

The processing of personal data is carried out pursuant to Art. 6(1)(f) GDPR on the basis of a legitimate interest in a needs-based and targeted design of the website. You have a right to object to this processing. Further information: https://www.youtube.com/t/privacy

Data subject rights and retention period

Duration of storage

Following the complete performance of the contract, data is initially stored for the duration of the warranty period and subsequently, taking into account the statutory retention periods — in particular under tax and commercial law — and is then deleted once those periods have expired, unless consent to more extensive processing/use has been given.

Rights of the data subject

Where the statutory requirements are met, you are entitled to the following rights pursuant to Art. 15–20 GDPR: right of access, right to rectification, right to erasure, right to restriction of processing, right to data portability. In addition, pursuant to Art. 21(1) GDPR, you have a right to object to processing based on Art. 6(1)(f) GDPR and to processing for direct advertising.

Right to lodge a complaint with the supervisory authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with the supervisory authority if you are of the opinion that the processing of your personal data is not lawful.

Right to object

Where there is a legitimate interest based on Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to these processing operations with effect for the future. Following an objection, the processing of the data concerned will be ended, unless there are compelling legitimate grounds that override your interests/rights/freedoms, or the processing serves to assert, exercise or defend legal claims.

Where processing is carried out for the purposes of direct advertising, you may object at any time by notification; processing for the purposes of direct advertising will then be ended.

Last updated: 20.07.2020