Carole Serafin

Privacy Policy

Last updated: [DATE]

1. Controller

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Carole Serafin
Sole Proprietorship
Kernbeißerweg 17
86156 Augsburg
Germany

Email: [EMAIL ADDRESS]
Phone: [PHONE NUMBER, IF APPLICABLE]

For questions regarding the processing of your personal data, you can contact us using the contact details above.

2. General Information on Data Processing

We process personal data only where this is permitted by applicable data protection law, in particular the GDPR and applicable German data protection legislation.

Personal data means any information relating to an identified or identifiable natural person.

We process personal data in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.

3. Personal Data We Process

Depending on how you use our website and services, we may process the following categories of personal data:

  • Name and contact details
  • Email address
  • Postal and billing/delivery address
  • Telephone number, where provided
  • Order and transaction information
  • Payment-related information
  • Information you provide when contacting us
  • IP address and technical information relating to your device
  • Information concerning your use of our website
  • Other information you voluntarily provide to us

We only process the data that is necessary for the relevant purpose.

4. Visiting Our Website

When you visit our website, certain technical information may be automatically transmitted to our server. This may include:

  • IP address
  • Date and time of access
  • Browser type and version
  • Operating system
  • Referring website
  • Pages accessed
  • Other technically necessary information

This information may be processed to ensure the security, stability and proper functioning of our website and to detect and prevent misuse or attacks.

The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in providing a secure and functional website.

Where technically necessary data is processed to provide a service you have requested, the processing may also be based on Article 6(1)(b) GDPR.

5. Contacting Us

If you contact us by email, contact form or other means, we process the information you provide in order to handle and respond to your request.

Depending on the nature of your request, the legal basis may be:

  • Article 6(1)(b) GDPR, where the processing is necessary to take steps at your request or perform a contract;
  • Article 6(1)(c) GDPR, where processing is necessary to comply with a legal obligation; or
  • Article 6(1)(f) GDPR, where we have a legitimate interest in responding to and managing enquiries.

We retain correspondence only for as long as necessary for the relevant purpose and, where applicable, for the duration of statutory retention obligations.

6. Orders and Contracts

If you purchase products or services from us, we process the personal data necessary to establish, perform and manage the contractual relationship.

This may include your name, contact details, billing and delivery information, order details and payment-related information.

The legal basis is Article 6(1)(b) GDPR.

We may also process certain information to comply with statutory accounting, tax and record-keeping obligations. The legal basis in such cases is Article 6(1)(c) GDPR.

7. Payment Processing

Where payment services are used, payment may be processed by external payment service providers.

[INSERT PAYMENT PROVIDERS, e.g. PayPal / Stripe / Klarna / bank transfer]

Depending on the payment method selected, the necessary payment and transaction information may be transmitted to the relevant payment provider.

The processing is necessary for the performance of the contract pursuant to Article 6(1)(b) GDPR and, where applicable, for compliance with legal obligations pursuant to Article 6(1)(c) GDPR.

For further information about how the relevant payment provider processes personal data, please refer to its own privacy policy.

8. Shipping and Delivery

Where products are shipped to you, we may provide the necessary delivery information to the relevant shipping provider.

This may include your name, delivery address and other information necessary to complete the delivery.

The legal basis is Article 6(1)(b) GDPR.

9. Cookies and Similar Technologies

Our website may use cookies and similar technologies.

Cookies that are strictly necessary for the operation, security and basic functionality of the website may be used where permitted by applicable law.

Where cookies or similar technologies are used for analytics, advertising, personalised content or other purposes that require consent, we will obtain your consent before placing or using them, where required by law.

The legal basis for processing based on consent is Article 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future.

11. Marketing and Advertising

[KEEP THIS SECTION ONLY IF APPLICABLE]

If you have given your consent to receive marketing communications, we may use your contact information to send you information about our products, services, offers or other relevant communications.

The legal basis is Article 6(1)(a) GDPR.

You may withdraw your consent at any time, for example by using the unsubscribe link contained in our marketing emails.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

12. Newsletter

[KEEP THIS SECTION ONLY IF YOU OFFER A NEWSLETTER]

If you subscribe to our newsletter, we process your email address and any other information necessary to send you the newsletter.

We use the [NEWSLETTER PROVIDER] service to manage and distribute our newsletter.

We send newsletters based on your consent pursuant to Article 6(1)(a) GDPR.

You can unsubscribe at any time by using the unsubscribe link in the newsletter or by contacting us.

13. Service Providers and Recipients

We may use external service providers to operate our website and provide our services. These may include:

  • Website hosting providers
  • IT and technical service providers
  • Payment service providers
  • Shipping and logistics providers
  • Email and communication providers
  • Accounting and tax service providers
  • Analytics providers
  • Customer-support providers

Such providers may process personal data only to the extent necessary for the relevant service and, where required, on the basis of appropriate contractual arrangements pursuant to Article 28 GDPR.

14. International Data Transfers

Some of our service providers may process personal data outside the European Economic Area (EEA).

Where personal data is transferred to a country outside the EEA, we ensure that an appropriate legal mechanism under Chapter V GDPR applies.

This may include an adequacy decision of the European Commission or appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

15. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected.

Where statutory retention obligations apply, we retain the relevant data for the legally prescribed period.

After the applicable retention period has expired, the data will be deleted unless further processing is necessary for another legally permitted purpose.

16. Your Rights

Under the GDPR, you have the following rights, subject to the applicable legal requirements:

  • Right of access to your personal data pursuant to Article 15 GDPR.
  • Right to rectification of inaccurate or incomplete personal data pursuant to Article 16 GDPR.
  • Right to erasure pursuant to Article 17 GDPR.
  • Right to restriction of processing pursuant to Article 18 GDPR.
  • Right to data portability pursuant to Article 20 GDPR, where applicable.
  • Right to object to certain processing pursuant to Article 21 GDPR.
  • Right to withdraw consent at any time where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

17. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.

You may contact the supervisory authority in the country where you live, work or where you believe an infringement occurred.

For customers in France, this is the Commission Nationale de l’Informatique et des Libertés (CNIL).

For our business establishment in Germany, the competent German supervisory authority is:

Bayerisches Landesamt für Datenschutzaufsicht
https://www.lda.bayern.de/de/beschwerde.html

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our website, services, legal requirements or data-processing practices.

The current version will always be published on this page.