This Privacy Policy informs you about the processing of personal data when using this website and our online shop.
- Controller
Gruftiladen – Business Owner Alexandra Schnack
Straße der Jugend 18, 14974 Ludwigsfelde, Germany
E-mail: info@gruftiladen.de
Telephone: +49 1577 190 09 89
The controller determines the purposes and means of processing personal data (Art. 4 No. 7 GDPR).
2. Hosting by IONOS
We host our website with IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.
IONOS provides us with infrastructure and platform services, computing capacity, storage space, and security services. In this context, we and/or IONOS process your data on the basis of a Data Processing Agreement (Art. 28 GDPR). The processing is carried out to provide a secure and efficient website (legal basis: Art. 6(1)(f) GDPR).
3. SSL/TLS Encryption
For security reasons, this website uses SSL/TLS encryption. You can recognize an encrypted connection by the “https://” address and the padlock symbol in your browser.
4. Access Data / Server Log Files
When you use this website for informational purposes only, we or our hosting provider automatically collect so-called server log files:
- Accessed page/file
- Date and time
- Amount of data transferred
- Referrer URL
- Browser type/version
- Operating system
- IP address (where applicable, anonymized)
Processing is carried out for the technical provision, stability, and security of the website (e.g. detection of misuse or attacks).
Legal basis: Art. 6(1)(f) GDPR.
Log data is regularly deleted, at the latest after 7–14 days, unless longer retention is required for security-related reasons.
5. Cookies & Consent (TTDSG)
We use cookies and similar technologies. Cookies that are not technically necessary (e.g. for statistics or marketing) are only set after you have given your consent (Section 25(1) TTDSG, Art. 6(1)(a) GDPR).
Technically necessary cookies are required to provide the website (Section 25(2) No. 2 TTDSG, Art. 6(1)(f) GDPR).
We use a consent management tool. You can change your settings at any time and withdraw any consent you have given with effect for the future.
You can also delete or block cookies in your browser; however, certain functions of the website may be limited without certain cookies.
6. Contact
If you contact us via the contact form or by e-mail, we process the data you provide (e.g. name, e-mail address, message) in order to handle your request.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in communication); where related to a contract, Art. 6(1)(b) GDPR.
We delete the data once your inquiry has been fully processed, provided there are no statutory retention obligations.
7. Customer Account & Contract Processing
Customer accounts and guest accounts are available. When creating a customer account and for the performance of a contract, we process the data you provide (e.g. name, billing/shipping address, e-mail address, order details).
Legal basis: Art. 6(1)(b) GDPR.
Customer accounts can be deleted at any time (by contacting us using the contact details above).
After completion of the contract, we retain data for the duration of statutory retention periods (in particular Section 147 German Fiscal Code (AO), Section 257 German Commercial Code (HGB)) and delete it thereafter unless further legal grounds for processing exist.
8. Order and Payment Processing; Shipping
For delivery purposes, we pass on the necessary data (name, address, where applicable e-mail address/telephone number for delivery notifications) to the commissioned shipping company.
Legal basis: Art. 6(1)(b) GDPR.
9. Payment Service: PayPal
If you select PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg), we transmit payment-related and transaction-related data to PayPal.
Legal basis: Art. 6(1)(b) GDPR.
PayPal may transmit data to credit agencies for the purpose of assessing creditworthiness (Art. 6(1)(f) GDPR – legitimate interest in determining payment ability). Information about the credit agencies used and further details can be found in PayPal’s Privacy Policy.
PayPal may transfer data to third countries (including the USA). Such transfers are based on appropriate safeguards (e.g. the EU-US Data Privacy Framework or the EU Standard Contractual Clauses).
You may object to the credit assessment directly with PayPal; this does not affect the processing required for contract performance.
Further information can be found in PayPal’s Privacy Policy:
https://www.paypal.com/de/webapps/mpp/ua/privacy-full
10. Recipients & Data Processing on Our Behalf
In addition to the categories mentioned above, we use data processors (hosting providers, IT service providers, support providers). Data processing agreements pursuant to Art. 28 GDPR are in place with these providers. Personal data is only disclosed to third parties where there is a legal basis (e.g. contract performance, consent, legitimate interest, or legal obligation).
Transfers to Third Countries
Where service providers process data in third countries (outside the EU/EEA, e.g. the USA), this only takes place if:
- an adequacy decision of the European Commission exists (e.g. EU-US Data Privacy Framework), or
- appropriate safeguards pursuant to Art. 46 GDPR (in particular the EU Standard Contractual Clauses) have been agreed.
Further details can be found in the respective service descriptions in this Privacy Policy or from the respective provider.
11. Storage Period
Unless otherwise stated in this Privacy Policy, we process personal data only for as long as necessary for the respective purposes. Afterwards, we delete or anonymize the data unless statutory retention obligations (particularly under commercial or tax law) require otherwise.
We use exclusively locally stored fonts on this website. As a result, no connection is established to external servers (such as Google Fonts).
We also refrain from integrating social media plugins (e.g. Facebook, Instagram, or Twitter “Like” buttons) that could transmit data to third parties simply by accessing the website.
12. Your Rights
You have the rights under Arts. 15–21 GDPR, in particular:
- Right of access (Art. 15)
- Right to rectification (Art. 16)
- Right to erasure (Art. 17)
- Right to restriction of processing (Art. 18)
- Right to data portability (Art. 20)
- Right to object to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21)
- Right to withdraw consent with effect for the future (Art. 7(3))
To exercise your rights, simply contact us using the contact details provided above.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example:
The State Commissioner for Data Protection and the Right of Access to Files Brandenburg (LDA Brandenburg), Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.
13. Obligation to Provide Data
Certain data is required when placing an order (identified during the ordering process). Without this data, a contract cannot be concluded. There is no obligation to provide data for purely informational use of the website.
14. Automated Decision-Making / Profiling
No automated decision-making, including profiling, takes place.
15. External Links
Links to third-party websites result in data processing by the respective provider when clicked. The respective third-party provider is solely responsible for the content and data processing on those websites.
16. Electronic Right of Withdrawal Function
In accordance with statutory requirements, we provide consumers with an electronic withdrawal function through which contracts concluded online can be withdrawn.
If you use this function, we process the personal data you submit in order to receive your withdrawal, identify you and the affected contract, confirm receipt of your withdrawal, and comply with statutory documentation and record-keeping obligations.
The following data may, in particular, be processed:
- First and last name
- E-mail address
- Order, purchase, or contract number
- Information about the affected contract or order
- Date and time the withdrawal was submitted
- Technical log data, where required for the provision and documentation of the function
The processing is carried out on the basis of Art. 6(1)(c) GDPR in order to fulfill legal obligations and Art. 6(1)(b) GDPR for the performance and execution of the contractual relationship.
The data collected in connection with the withdrawal will only be stored for as long as necessary to process the withdrawal and to comply with statutory retention and documentation obligations.
Where we use external service providers for the technical provision of our online shop or the processing of customer inquiries, they are engaged as data processors in accordance with Art. 28 GDPR.
17. Changes to this Privacy Policy
We will update this Privacy Policy whenever legal, technical, or business changes make this necessary. The current version is always available on this website.