Table of Contents
As of September 2026
- Name and Address of the Controller
- Contact Details of the Data Protection Officer
- General Information on Data Processing
- Rights of the Data Subject
- Provision of the Website and Creation of Log Files
- Use of Cookies
- Webshop
- Ordering in the Webshop
- Payment Options
- Shipping Service Providers
- Email Contact
- Contact Form
- Affiliate Programs
- Review Portal
- Email Dispatch
- Content Delivery Networks
- Use of Matomo Analytics Software
- Use of Google Analytics
- Use of LiveChat
- Use of Meta Tracking Pixel
- Used Plugins
1. Name and Address of the Controller
The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is:
myfolie GmbH
Von-Stauffenberg-Str, 27
82008 Unterhaching
Germany
2. Contact Details of the Data Protection Officer
The data protection officer of the controller is
DataCo GmbH
Dachauer Straße 65
80335 Munich
Germany
+49 89 / 7400 45840
www.dataguard.de
3. General Information on Data Processing
I.) Scope of Processing of Personal Data
We generally process personal data of our users only to the extent necessary to provide a functional webshop and our content and services. The processing of personal data of our users regularly takes place only with the user's consent. An exception applies in cases where obtaining prior consent is not possible for factual reasons and the processing of the data is required by legal regulations.
II.) Legal Basis for the Processing of Personal Data
If we obtain the consent of the data subject for processing operations of personal data, Art. 6 para. 1 sentence 1 lit. a GDPR serves as the legal basis.
When processing personal data necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 sentence 1 lit. b GDPR serves as the legal basis. This also applies to processing operations necessary for carrying out pre-contractual measures.
If the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6 para. 1 sentence 1 lit. c GDPR serves as the legal basis.
If vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 sentence 1 lit. d GDPR serves as the legal basis.
If processing is necessary for the purposes of the legitimate interests pursued by our company or a third party and the interests, fundamental rights and freedoms of the data subject do not override the first-mentioned interest, Art. 6 para. 1 sentence 1 lit. f GDPR serves as the legal basis for the processing.
III.) Data Deletion and Storage Duration
The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also take place if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. Blocking or deletion of the data also takes place when a storage period prescribed by the aforementioned standards expires, unless there is a necessity for further storage of the data for the conclusion or fulfillment of a contract.
4. Rights of the Data Subject
If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:
I.) Right of Access (Art. 15 GDPR)
You have the right to request confirmation from us as to whether personal data concerning you is being processed.
- If this is the case, you have a right of access to this data and the following information:
- Processing purposes
- Categories of personal data
- Recipients or categories of recipients
- Planned storage duration or the criteria for determining this duration
- The existence of rights to rectification, erasure, restriction, or objection
- Right to lodge a complaint with the competent supervisory authority
- Where applicable, the origin of the data (if collected from a third party)
- Where applicable, the existence of automated decision-making including profiling with meaningful information about the logic involved, the scope, and the expected impact
- Where applicable, transfer of personal data to a third country or international organization
II.) Right to Rectification (Art. 16 GDPR)
If your personal data is incorrect or incomplete, you have the right to request immediate correction or completion of the personal data.
III.) Right to Restriction of Processing (Art. 18 GDPR)
If one of the following conditions is met, you have the right to request restriction of the processing of your personal data:
- You contest the accuracy of your personal data, for a period enabling us to verify the accuracy of the personal data.
- In the case of unlawful processing, you oppose the erasure of the personal data and request the restriction of their use instead.
- We no longer need your personal data for the purposes of processing, but you require them for the establishment, exercise, or defense of legal claims, or
- after you have objected to processing, for the duration of the assessment as to whether our legitimate grounds override yours.
IV.) Right to Erasure ("Right to be Forgotten") (Art. 17 GDPR)
If one of the following reasons applies, you have the right to request immediate deletion of your personal data:
- Your data is no longer necessary for the purposes for which it was originally collected.
- You withdraw your consent and there is no other legal basis for the processing.
- You object to the processing and there are no overriding legitimate grounds for the processing, or you object according to Art. 21 para. 2 GDPR.
- Your personal data has been unlawfully processed.
- Erasure is required to comply with a legal obligation under Union or Member State law to which we are subject.
- The personal data was collected in relation to information society services offered in accordance with Art. 8 para. 1 GDPR.
Please note that the above reasons do not apply to the extent that processing is necessary:
- For exercising the right of freedom of expression and information;
- For compliance with a legal obligation or for the performance of a task carried out in the public interest to which we are subject.
- For reasons of public interest in the area of public health.
- For archiving purposes in the public interest, scientific or historical research purposes, or for statistical purposes.
- For the establishment, exercise, or defense of legal claims.
V.) Right to Notification
If you have asserted the right to rectification, erasure, or restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data concerning you has been disclosed of this rectification or erasure of data or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients by the controller.
VI.) Right to Data Portability (Art. 20 GDPR)
You have the right to receive your personal data in a structured, commonly used, and machine-readable format or to request transmission to another controller.
VII.) Right to Object to Certain Data Processing (Art. 21 GDPR)
You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you that is based on Art. 6 para. 1 sentence 1 lit. e or f GDPR. This also applies to profiling based on these provisions. If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing.
VIII.) Right to Withdraw Data Protection Consent
You have the right to withdraw your data protection consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
IX.) Automated Individual Decision-Making Including Profiling
You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision is necessary for entering into, or performance of, a contract between you and the controller, is permitted by Union or Member State law to which the controller is subject and these laws contain appropriate measures to safeguard your rights and freedoms and your legitimate interests, or is based on your explicit consent.
However, such decisions must not be based on special categories of personal data under Art. 9 para. 1 GDPR, unless Art. 9 para. 2 lit. a or b GDPR applies and appropriate measures to protect the rights and freedoms and your legitimate interests have been taken. Regarding the cases mentioned in a. and c., the controller will take appropriate measures to safeguard the rights and freedoms and your legitimate interests, which include at least the right to obtain human intervention on the part of the controller, to express your own point of view, and to contest the decision.
X.) Right to Lodge a Complaint with a Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of personal data relating to you infringes the GDPR. The supervisory authority with which the complaint has been lodged will inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy under Art. 78 GDPR. A list of the locally competent supervisory authorities in Germany can be found on the website of the Federal Commissioner for Data Protection at the following link:
https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html
5. Provision of the Website and Creation of Log Files
I.) Description and Scope of Data Processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.
The following data is collected:
- Information about the browser type and version used
- The user's operating system
- The user's internet service provider
- The user's IP address
- Date and time of access
- Websites from which the user's system accesses our website
- Websites accessed by the user's system via our website
This data is stored in the log files of our system. This data is not stored together with other personal data of the user.
II.) Purpose of Data Processing
The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.
Storage in log files is carried out to ensure the functionality of the website. In addition, the data serves us to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.
These purposes also constitute our legitimate interest in data processing pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR.
III.) Legal Basis for Data Processing
The legal basis for the temporary storage of the data and the log files is Art. 6 para. 1 sentence 1 lit. f GDPR.
IV.) Duration of Storage
The data is deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. In the case of data collection for the provision of the website, this is the case when the respective session is ended.
In the case of storage of data in log files, this is the case after no more than seven days. Further storage is possible. In this case, the IP addresses of the users are deleted or anonymized so that assignment of the calling client is no longer possible.
V.) Possibility of Objection
The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. The user may object. Whether the objection is successful must be determined within the scope of a balancing of interests.
6. Use of Cookies
I.) Description and Scope of Data Processing
When you visit our website, we use technical tools for various functions, in particular cookies, which may be stored on your device. When you access our website and at any time thereafter, you have the choice of whether to allow cookies in general or which individual additional functions you wish to select. You can make changes in your browser settings or via our consent manager. Cookies are text files or information in a database that are stored on your hard drive and assigned to the browser you are using, so that certain information can be transmitted to the party that sets the cookie. Below we describe the types of cookies we use: We use technically necessary cookies that are required for the technical structure of the website. Without these cookies, our website cannot be displayed (completely correctly) or support functions are not possible.
The following data is stored and transmitted by technically necessary cookies:
- Session ID
- Cookie settings
We also use cookies on our website that enable an analysis of users' surfing behavior.
The following data may be transmitted in this way:
The data collected in this way is pseudonymized by technical precautions. Therefore, it is no longer possible to assign the data to the accessing user without the addition of further information. The data is not stored together with other personal data of the users.
II.) Purpose of Data Processing
The purpose of using technically necessary cookies is to ensure the functionality of our website. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized even after a page change.
We require technically necessary cookies for the following applications:
- Shopping cart
- Functionality of the website
- Cookie settings
III.) Legal Basis for Data Processing
For the storage of information in the end user's device and/or access to information already stored in the end user's device, the provisions of the Telecommunications Telemedia Data Protection Act (TTDSG) apply. If the setting and reading of cookies is technically necessary, this is done to ensure the functionality of our website. In this case, the storage of and access to cookies on your device is based on § 25 para. 2 no. 2 TTDSG. This storage and access to the information on your device is intended to facilitate your use of our website and to provide you with our services as requested. Some functions of our website do not work without the use of these cookies and could therefore not be offered. The cookies are generally deleted after the end of the session (e.g., logging out or closing the browser) or after a specified period. Information about different storage periods for cookies can be found in the following sections of this privacy policy.
IV.) Duration of Storage, Objection and Removal Option
The user can revoke their consent to the processing of personal data at any time. Cookies are stored on the user's computer and transmitted from there to our site. Therefore, as a user, you also have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies for our website are deactivated, it may no longer be possible to use all functions of the website in full.
The transmission of Flash cookies cannot be prevented via the browser settings, but by changing the settings of the Flash Player.
If you are using a Safari browser from version 12.1, cookies are automatically deleted after seven days. This also applies to opt-out cookies set to prevent tracking measures.
7. Webshop
We offer a webshop on our website. For this, we use proprietary webshop software.
The website and webshop are hosted on our own servers. Third parties do not have access to server log files.
The servers automatically collect and store information in so-called server log files, which your browser automatically transmits when you visit the website. The stored information is:
- Browser type and version
- Operating system used
- Referrer URL
- Hostname of the accessing computer
- Date and time of the server request
- IP address
This data is not merged with other data sources. The collection of this data is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of their website – for this, the server log files must be recorded. The server location of the website is geographically in Germany.
7.1. Customer Account and Storage of Designs
I.) Description and Scope of Data Processing
You have the option to create a customer account on our website.
During registration and use of the customer account, the following personal data in particular is processed:
- First and last name
- Email address
- Password (stored encrypted)
- Billing and shipping address
- Phone number (optional)
- Order history
- Payment status
- Uploaded designs, graphics, and print data
- Saved drafts and configurations
For business customers (B2B), the following may also be processed:
- Company name
- Contact person
- VAT identification number
- if applicable, internal reference numbers
The storage of uploaded designs takes place as part of contract fulfillment and for reuse by the customer.
II.) Purpose of Data Processing
The processing is carried out for:
Setting up and managing the customer account
Processing and handling orders
Storing designs for reuse
Handling complaints
Fulfilling legal retention obligations
III.) Legal Basis
The processing is based on:
- Art. 6 para. 1 sentence 1 lit. b GDPR (contract fulfillment)
- Art. 6 para. 1 sentence 1 lit. c GDPR (legal obligations)
- Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interest in user-friendly provision of the customer account)
If designs are stored beyond the mere contract processing, processing may also be based on consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.
IV.) Storage of Designs and Uploaded Content
Designs, graphics, and print data uploaded by customers are stored:
- for the production of the ordered products
- to enable repeat orders
- for handling warranty and complaint cases
If a customer account exists, stored designs remain saved until the customer account is deleted, unless legal retention obligations or technical requirements prevent this.
After deletion of the customer account, personal data and stored designs are deleted, unless legal retention obligations exist.
Deletion from backup copies occurs as part of the usual technical deletion cycles.
V.) Responsibility for Uploaded Content
The user is solely responsible for ensuring that the uploaded content:
- does not infringe the rights of third parties (e.g., copyrights, trademark rights, personal rights)
- does not contain special categories of personal data as defined in Art. 9 GDPR, unless a separate legal basis exists for this
- A substantive review of uploaded designs by us is only carried out on a random basis or for production-related reasons.
8. Ordering in the Webshop
I.) Description and Scope of Data Processing
We offer our customers the opportunity to design their own motifs and texts online and order them as adhesive film. For this purpose, after completion of the order process, we receive personal data that we need to process the order. Mandatory information necessary for contract processing is specially marked, further information provided by uploading photos or contact details to be printed on the ordered adhesive film is voluntary. The personal data to be printed on the adhesive film may be forwarded to external service providers such as graphic designers. All other personal data is not transmitted to external service providers outside the company.
II.) Purpose of Data Processing
The transmission of the personal data you voluntarily provide serves the purpose of processing the contract and creating the product when you purchase an adhesive film.
III.) Legal Basis for Data Processing
The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR, as the processing of the data is necessary for the execution of the concluded purchase contract.
IV.) Duration of Storage
Graphics/photos that you upload for printing on the adhesive film will be deleted after the statutory retention periods have expired (for refund/warranty reasons).
All payment data as well as data on any chargebacks are only stored as long as they are required for payment processing and possible handling of chargebacks and debt collection as well as for combating misuse.
Furthermore, payment data may be stored beyond this, provided and as long as this is necessary to comply with legal retention periods or to pursue a specific case of misuse.
Your personal data will be deleted after the statutory retention periods have expired, i.e., after a maximum of 10 years.
9. Payment Options
I.) Description and Scope of Data Processing
We offer our customers various payment options for processing their orders. Depending on the payment option, we redirect customers to the platform of the respective payment service provider. After completion of the payment process, we receive the customers' payment data from the payment service providers or our house bank and process this in our systems for invoicing and accounting purposes.
Payment via Amazon Pay
It is possible to process the payment transaction with the payment service provider AmazonPay. AmazonPay enables online payments to third parties by accessing the payment and shipping information stored in your Amazon account.
The European operating company of AmazonPay is Amazon Payments Europe s.c.a., 38 avenue J.F. Kennedy, L-1855 Luxembourg. If you already have an Amazon.de customer account, you can pay immediately using the payment method stored there – either by direct debit or credit card. Registration with your Amazon account is required for this.
Further information and your order overview for payments via AmazonPay can be found at https://pays.amazon.de. When paying via Amazon Pay, all personal data provided to or collected by Amazon Pay is primarily processed by Amazon Pays s.c.a. and secondarily by Amazon EU SARL, Amazon Services Europe SARL, and Amazon Media EU SARL, all three located at 5, Rue Plaetis L 2338, Luxembourg. Further information on the processing of your data by Amazon in the context of AmazonPay can be found in the Amazon Pay privacy policy at: https://pay.amazon.com/de/help/201751600
Payment by Credit Card
It is possible to complete the payment process by credit card.
If you have chosen payment by credit card, payment data will be forwarded to payment service providers for payment processing. All payment service providers comply with the requirements of the "Payment Card Industry (PCI) Data Security Standards" and have been certified by an independent PCI Qualified Security Assessor.
In the context of payment by credit card, the following data is regularly transmitted:
- Purchase amount
- Date and time of purchase
- First and last name
- Address
- Email address
- Credit card number
- Credit card validity period
- Security code (CVC)
- IP address
- Phone number / mobile number
Payment data is forwarded to the following payment service providers:
- Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Netherlands
Further information on the privacy policies and options for revocation and removal vis-à-vis the payment service providers can be found here: https://www.adyen.com/de_DE/legal/terms-and-conditions
Payment via Billie (B2B Invoice Purchase)
We offer the option of invoice purchase via the payment service provider Billie GmbH.
Provider is Billie GmbH, Charlottenstraße 4, 10969 Berlin, Germany
If you select the invoice purchase payment method via Billie, personal data will be transmitted to Billie for the purpose of carrying out a credit check and payment processing.
This includes in particular:
- First and last name
- Billing and shipping address
- Company data (for B2B orders)
- Email address
- IP address
- Purchase amount
- if applicable, date of birth
- if applicable, other data required for payment processing
Billie conducts a risk assessment including a credit check. Probability values (score values) may be calculated. Processing is carried out for the purpose of deciding on the establishment, execution, or termination of the contractual relationship.
Further information on data processing by Billie can be found at:
https://www.billie.io/datenschutz/
Payment via Klarna (Invoice Purchase)
We offer the option of invoice purchase via the payment service provider Klarna.
Provider is Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden.
If you select the invoice purchase payment method via Klarna, personal data will be transmitted to Klarna for the purpose of carrying out a credit check and payment processing.
This includes in particular:
- First and last name
- Billing and shipping address
- Email address
- Phone number (if applicable)
- IP address
- Purchase amount
- Date of birth (if required)
- Order information and, if applicable, other data required for payment processing
Klarna conducts a risk and credit check to decide on the provision of invoice purchase. Probability values (score values) may be calculated. Processing is carried out for the purpose of deciding on the establishment, execution, and processing of the contractual relationship.
Further information on data processing by Klarna can be found in Klarna's privacy policy: https://www.klarna.com/de/datenschutz/
Payment via PayPal
It is possible to process the payment transaction with the payment service provider PayPal.
The provider of this payment service is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.
If you select PayPal as the payment method, the data required for payment processing will be transmitted to PayPal.
This regularly includes:
- First and last name
- Billing and shipping address
- Email address
- IP address
- Purchase amount
- Date and time of purchase
- Payment method
- if applicable, other data required for payment processing
PayPal reserves the right to carry out a credit check. Probability values (score values) may be calculated. Further information on data processing by PayPal can be found at:
https://www.paypal.com/de/webapps/mpp/ua/privacy-full
Payment in Advance
If you have chosen payment in advance, we do not process any data other than the data provided by your bank. This is only used to verify receipt of payment.
II.) Purpose of Data Processing
The transmission of payment data to payment service providers serves the purpose of processing the payment, e.g., when you purchase a product and/or use a service.
III.) Legal Basis for Data Processing
The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR, as the processing of the data is necessary for the execution of the concluded purchase contract.
IV.) Duration of Storage
All payment data as well as data on any chargebacks are only stored as long as they are required for payment processing and possible handling of chargebacks and debt collection as well as for combating misuse.
Furthermore, payment data may be stored beyond this, provided and as long as this is necessary to comply with legal retention periods or to pursue a specific case of misuse.
Your personal data will be deleted after the statutory retention periods have expired, i.e., after a maximum of 10 years.
V.) Loss of Legal Basis
The payment service provider used remains entitled to process your payment data as long as this is necessary for contractual payment processing. There may also be legal retention periods.
10. Shipping Service Providers
I.) Description and Scope of Data Processing
If you order products or services on our website that require a shipping service provider for delivery, you will receive your order and shipping confirmation via your email address and, depending on the shipping service provider, notification that your shipment has arrived and/or notification of package announcement and possible delivery options.
The data is transmitted to the following service providers:
- DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn
- General Logistics Systems Germany GmbH & Co. OHG, GLS Germany-Straße 1 - 7, DE-36286 Neuenstein
- United Parcel Service Deutschland S.à r.l. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany
The data transmitted regularly includes:
II.) Purpose of Data Processing
The purpose of processing personal data and transmitting address data to shipping service providers is to process the concluded purchase contract and deliver the goods.
III.) Legal Basis for Data Processing
The legal basis for transmitting your address data (first name, last name, address) to the respective shipping service provider is Art. 6 para. 1 sentence 1 lit. b GDPR, as the processing of the data is necessary for the execution of the concluded purchase contract.
IV.) Duration of Storage
The transmitted data is deleted by the respective shipping service provider once the package has been delivered.
V.) Objection and Removal Option
The notification service by the shipping service provider can be canceled by the affected user at any time. For this purpose, each email contains a corresponding opt-out link.
11. Email Contact
I.) Description and Scope of Data Processing
It is possible to contact us via the email address provided on our website. In this case, the personal data transmitted with the email will be stored.
The data is used exclusively for processing the conversation.
In connection with data processing, the data is passed on to the service provider: Zendesk Inc.
The contract for commissioned data processing with Zendesk includes so-called EU Standard Contractual Clauses (Art. 46 para. 2 sentence 1 lit. c GDPR). These are classified as appropriate safeguards for the protection of the transfer and processing of personal data outside the EU.
Further information on the processing of data by Zendesk can be found here: https://www.zendesk.de/company/agreements-and-terms/privacy-notice/
II.) Purpose of Data Processing
In the case of contact by email, this also constitutes the necessary legitimate interest in processing the data.
III.) Legal Basis for Data Processing
The legal basis for processing the data transmitted in the course of sending an email is Art. 6 para. 1 lit. f GDPR. Our legitimate interest is to optimally respond to your inquiry sent by email. If the email contact aims at concluding a contract, the additional legal basis for processing is Art. 6 para. 1 lit. b GDPR.
IV.) Duration of Storage
The data is deleted as soon as it is no longer necessary to achieve the purpose for which it was collected and statutory retention periods no longer require the retention of the data. For personal data sent by email, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.
V.) Possibility of Objection
If the user contacts us by email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.
Currently none, as contacting us is voluntary and purpose-bound and is only directed at customers or interested parties; Deletion according to GDPR can be requested by email
All personal data stored in the course of contacting us will be deleted in this case.
12. Contact Form
I.) Description and Scope of Data Processing
There is a contact form on our website that can be used for electronic contact. If a user takes advantage of this option, the data entered in the input mask will be transmitted to us and stored.
At the time the message is sent, the following data is stored:
- Email address
- IP address of the accessing computer
- Date and time of sending the form
- Order number & postal code if it concerns an existing order for verification;
- Other data transmitted by the user as a message
Alternatively, it is possible to contact us via the email address provided. In this case, the personal data transmitted with the email will be stored.
The data is used exclusively for processing the conversation.
In connection with data processing, the data is passed on to the service provider: Zendesk Inc.
The contract for commissioned data processing with Zendesk includes so-called EU Standard Contractual Clauses (Art. 46 para. 2 sentence 1 lit. c GDPR). These are classified as appropriate safeguards for the protection of the transfer and processing of personal data outside the EU.
Further information on the processing of data by Zendesk can be found here: https://www.zendesk.de/company/agreements-and-terms/privacy-notice/
II.) Purpose of Data Processing
The processing of personal data from the input mask serves solely to process the contact request. In the case of contact by email, this also constitutes the necessary legitimate interest in processing the data.
The other personal data processed during the sending process is used to prevent misuse of the contact form and to ensure the security of our information technology systems.
III.) Legal Basis for Data Processing
The legal basis for processing the data transmitted in the course of sending a contact form is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest is to optimally respond to your inquiry sent via the contact form. If the contact via the contact form aims at concluding a contract, the additional legal basis for processing is Art. 6 para. 1 sentence 1 lit. b GDPR.
IV.) Duration of Storage
The data is deleted as soon as it is no longer necessary to achieve the purpose for which it was collected and statutory retention periods no longer require the retention of the data. For personal data from the input mask of the contact form and those sent by email, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.
V.) Possibility of Objection
The user can revoke their consent to the processing of personal data at any time. If the user contacts us by email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.
All personal data stored in the course of contacting us will be deleted in this case.
13. Affiliate Programs
We also use the services of the following affiliate programs:
Belboon GmbH: Weinmeisterstraße 12-14, 10178 Berlin
The controller has integrated components of Belboon on this website. Belboon is a German affiliate network that offers affiliate marketing. If you click on an ad with a partner link, Belboon sets a cookie for conversion tracking on your computer. The cookies serve the purpose of correct billing within the framework of the affiliate program by recording the success of an advertising medium. Through the cookies, it is recognized that you have clicked on the ad and the origin of the order can be traced to the advertiser. Belboon also uses so-called tracking pixels. These can be used to analyze information such as visitor traffic on the pages.
The information generated by cookies and tracking pixels about the use of this website (including the IP address) and the delivery of advertising formats is transmitted to a server of Belboon and stored there. Among other things, Belboon can recognize that the partner link on this website was clicked. Belboon may pass on this (anonymized) information to contractual partners under certain circumstances, but data such as the IP address is not merged with other stored data.
Where legally required, we have obtained your consent for the above-described processing of your data in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future. If you want to block the analysis of user behavior via cookies, you can set your browser so that you are informed about the setting of cookies and individually decide on their acceptance or exclude the acceptance of cookies for certain cases or in general.
via an internet browser or other software programs can be deleted.
For information on the processing of your personal data by Instagram and the corresponding objection options, please see:
Belboon: https://www.belboon.com/de/ueber-uns/datenschutz/
Firstlead GmbH (Adcell): Rosenfelder Str. 15-16, 10315 Berlin.
The controller has integrated components of Adcell on this website. Adcell is a German affiliate network that offers affiliate marketing. If you click on an ad with a partner link, Adcell sets a cookie for conversion tracking on your computer. The cookies serve the purpose of correct billing within the framework of the affiliate program by recording the success of an advertising medium. Through the cookies, it is recognized that you have clicked on the ad and the origin of the order can be traced to the advertiser. Adcell also uses so-called tracking pixels. These can be used to analyze information such as visitor traffic on the pages.
The information generated by cookies and tracking pixels about the use of this website (including the IP address) and the delivery of advertising formats is transmitted to a server of Adcell and stored there. Among other things, Adcell can recognize that the partner link on this website was clicked. Adcell may pass on this (anonymized) information to contractual partners under certain circumstances, but data such as the IP address is not merged with other stored data.
Where legally required, we have obtained your consent for the above-described processing of your data in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future. If you want to block the analysis of user behavior via cookies, you can set your browser so that you are informed about the setting of cookies and individually decide on their acceptance or exclude the acceptance of cookies for certain cases or in general.
For information on the processing of your personal data by Adcell and the corresponding objection options, please see: https://www.adcell.de/agb#sector_6
14. Review Portal
Trustpilot Review
We participate in the review process of the provider Trustpilot A/S, Pilestræde 58, 5, 1112 Copenhagen, Denmark.
Trustpilot offers users the opportunity to review our services. Users who have used our service are asked for consent to receive a review request. If users have given the corresponding consent (by clicking a checkbox after completing the order), they will receive a review request with a link to a review page. To ensure that users have actually used our services, we transmit to Trustpilot the data required for this purpose regarding the user and the service used (this includes the name, email address, and an order number as well as the order date). This data is used solely for verifying authenticity and addressing the user.
The legal basis for processing user data in the context of the review process is consent pursuant to Art. 6 para. 1 lit. a GDPR.
To submit a review, it is possible to open a customer account with Trustpilot. In this case, the terms and conditions and privacy notices of Trustpilot apply. To maintain the neutrality and objectivity of the reviews, we have no direct influence on the reviews and cannot delete them ourselves. For this, we ask users to contact Trustpilot.
Further information on the processing of your data by Trustpilot as well as your rights to object and other rights of data subjects can be found in Trustpilot's privacy policy: https://de.legal.trustpilot.com/end-user-privacy-terms.
15. Email Dispatch
Mandrill
We use Mandrill from Mailchimp, provided by The Rocket Science Group, LLC, 512 Means Street, Suite 404 Atlanta, GA 30318 United States.
Mandrill is used upon completion of the order to send you an order confirmation as well as possible payment reminders and other emails. In this process, we or our hosting provider process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers. The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR, as the processing of the data is necessary for the execution of the concluded purchase contract.
The contract for commissioned data processing with Mandrill includes so-called EU Standard Contractual Clauses (Art. 46 para. 2 sentence 1 lit. c GDPR). These are classified as appropriate safeguards for the protection of the transfer and processing of personal data outside the EU.
Further information about Mandrill and data protection at Mandrill can be found here: http://mailchimp.com/legal/privacy/
16. Content Delivery Networks
I.) Description and Scope of Data Processing
We use functions of the Content Delivery Network KeyCDN from proinity LLC, Reichenauweg 1, 8272 Ermatingen, Switzerland, on our website. A Content Delivery Network (CDN) is a network of regionally distributed and internet-connected servers that deliver content – especially large media files such as videos. KeyCDN provides web optimization and security services that we use to improve the loading times of our website and to protect it from misuse. When you access our website, a connection is established to the servers of proinity LLC to retrieve content, for example. Personal data may be stored and analyzed in server log files, especially user activity (in particular, which pages were visited), and device and browser information (in particular, the IP address and operating system).
Further information on the collection and storage of data by proinity LLC can be found here: https://www.keycdn.com/privacy
II.) Purpose of Data Processing
The use of these functions serves the delivery and acceleration of online applications and content.
III.) Legal Basis for Data Processing
The collection of this data is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of their website – for this, the server log files must be recorded.
IV.) Duration of Storage
Your personal information will be stored as long as necessary to fulfill the purposes described in this privacy policy or as required by law.
V.) Objection and Removal Option
Information on objection and removal options vis-à-vis proinity LLC can be found at: https://www.keycdn.com/privacy
17. Use of Matomo
I.) Scope of Processing of Personal Data
We use the open-source tracking tool Matomo (https://matomo.org/) to analyze the surfing behavior of our users. Matomo sets a cookie on your computer. Through the functions of Matomo, personal data can be stored and analyzed, especially user activity (in particular, which pages were visited and which elements were clicked), device and browser information (in particular, the IP address and operating system), data about displayed advertisements (in particular, which ads were shown and whether the user clicked on them), and also data from advertising partners (in particular, pseudonymized user IDs). The software is configured so that IP addresses are not fully stored, but 2 bytes of the IP address are masked for anonymization (e.g., 192.168.xxx.xxx). In this way, it is no longer possible to assign the shortened IP address to the accessing computer. The data is stored in our MySQL database; logs or report data are not sent to Matomo servers. Further information on the processing of data by Matomo can be found here: https://matomo.org/privacy-policy/
II.) Purpose of Data Processing
The processing of users' personal data enables us to analyze the surfing behavior of our users. By evaluating the data obtained, we are able to compile information about the use of the individual components of our online presence. This helps us to continuously improve our online presence and its user-friendliness.
III.) Legal Basis for the Processing of Personal Data
The legal basis for processing users' personal data is generally the user's consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.
IV.) Duration of Storage
Your personal information will be stored as long as necessary to fulfill the purposes described in this privacy policy or as required by law, e.g., for tax and accounting purposes.
V.) Revocation and Removal Option
You have the right to withdraw your data protection consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. You can prevent the collection and processing of your personal data by Matomo by blocking the storage of third-party cookies on your computer, using the "Do Not Track" function of a supported browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser. With the following link, you can disable the processing of your personal data by Matomo: https://matomo.org/privacy-policy/ Further information on objection and removal options vis-à-vis Matomo can be found at: https://matomo.org/privacy-policy/
18. Use of Google Analytics (GA4)
I.) Scope of Processing of Personal Data
We use Google Analytics 4 (“GA4”) to analyze user behavior on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data transfer to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, cannot be ruled out.
Google Analytics sets cookies and processes information about the use of our website, in particular:
shortened IP address (IP anonymization / IP is not permanently stored)
Date and time of access
Pages accessed / click paths
Referrer URL
Device and browser information
Approximate location data (region)
Events / conversions (e.g., purchase completion)
II.) Purpose of Data Processing
The processing enables us to analyze the use of our website and optimize the functionality, user guidance, and economic efficiency of our online offering.
III.) Legal Basis for the Processing of Personal Data
The legal basis is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR in conjunction with § 25 para. 1 TTDSG (setting/reading of non-essential cookies). You grant consent via our consent manager and can revoke it at any time with effect for the future.
IV.) Duration of Storage
The storage period depends on the retention periods configured in Google Analytics. Data is deleted as soon as it is no longer required for the stated purposes. For more information on storage periods, please refer to the settings of our consent manager or the respective information in the cookie settings.
V.) Revocation and Removal Option
You can revoke your consent at any time via our consent manager. You can also prevent the storage of cookies by adjusting your browser software settings; however, please note that in this case not all functions of this website may be fully usable.
Further information on data processing by Google can be found at: https://policies.google.com/privacy
19. Use of LiveChat
We use the live chat system of the provider LiveChat Inc., 1 International Pl, STE 1400 Boston, MA 02110 - 2619, USA, which is represented in the European Union by LiveChat Software SA. ul. Zwyci?ska 47, 53 - 033 Wroclaw, Poland, hereinafter referred to as "LiveChat". In our live chat, you have the opportunity to contact myfolie employees directly and have your questions answered in a real-time chat. Data processing is based on your consent (Art. 6 para. 1 lit. a GDPR). If you do not agree to this processing, you have the option to prevent the installation of cookies by adjusting the corresponding settings in your internet browser. Details can be found above under the section "Privacy & Cookie Settings".
You can revoke this consent at any time here; however, please note that in this case you may not be able to use all functions of this website to their full extent. The lawfulness of the data processing carried out up to the revocation remains unaffected by the revocation.
Your personal data is also transferred to the USA. Since July 10, 2023, there has been an adequacy decision "EU-U.S. Data Privacy Framework" pursuant to Art. 45 III GDPR for the USA. The European Commission has adopted the EU-U.S. Data Privacy Framework and determined in the decision that the United States ensures an adequate level of protection for personal data. However, the transfer of personal data to the United States only applies if the respective US data recipient is also certified under the EU-US Data Privacy Framework with the US Department of Commerce. A list of certified companies can be viewed at the following link: https://www.dataprivacyframework.gov/s/participant-search
Live Chat Inc. is certified under the Data Privacy Framework. Further information on the processing of your data by Trustpilot as well as your rights to object and other rights of data subjects can be found in LiveChat's privacy policy: https://www.livechatinc.com/legal/privacy-policy/#main
20. Use of Meta Pixel
I.) Scope of Processing of Personal Data
We use the Meta Pixel of Meta Platforms Inc., 1601 Willow Road, Menlo Park, CA 94025, USA and its representative in the Union Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal H, D2 Dublin, Ireland (hereinafter: Meta) on our online presence. With its help, we can track the actions of users after they have seen or clicked on a Meta ad. Personal data can be stored and analyzed, especially user activity (in particular, which pages were visited and which elements were clicked), device and browser information (in particular, the IP address and operating system), data about displayed advertisements (in particular, which ads were shown and whether the user clicked on them), and also data from advertising partners (in particular, pseudonymized user IDs). This allows us to record the effectiveness of Meta ads for statistical and market research purposes. Data may be transferred to Meta servers in the USA. The data collected in this way is anonymous for us, i.e., we do not see the personal data of individual users. However, this data is stored and processed by Meta. Meta may link this data to your Meta account and also use it for its own advertising purposes, in accordance with Meta's data usage policy. Further information on the processing of data by Meta can be found here: https://de-de.facebook.com/policy.php
II.) Purpose of Data Processing
The use of the Meta Pixel serves the analysis and optimization of advertising measures.
III.) Legal Basis for the Processing of Personal Data
The legal basis for processing users' personal data is generally the user's consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.
IV.) Duration of Storage
Your personal information will be stored as long as necessary to fulfill the purposes described in this privacy policy or as required by law, e.g., for tax and accounting purposes.
Exercising Your Rights
You have the right to withdraw your data protection consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. You can prevent the collection and processing of your personal data by Meta by blocking the storage of third-party cookies on your computer, using the "Do Not Track" function of a supported browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser. Further information on objection and removal options vis-à-vis Meta can be found at: https://de-de.facebook.com/policy.php
21. Used Plugins
We use plugins for various purposes. The plugins used are listed below:
Microsoft Advertising (formerly Bing Ads)
Google Ads
- Provider: Google Ireland Ltd., Ireland (transfer to the USA possible)
- Purpose: Conversion Tracking
- Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR (consent)
- Third country transfer: USA possible
- Privacy information:
https://policies.google.com/privacy?gl=DE&hl=de
Google Ads Remarketing
Google Tag Manager
Google Analytics (GA4)
- Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (transfer to Google LLC, USA possible)
- Purpose: Web analytics / statistical evaluation of user behavior / website optimization
- Data processed (in particular): shortened IP address, device and browser information, referrer URL, page views, click behavior, approximate location data, conversions
- Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR (consent) in conjunction with § 25 para. 1 TTDSG
- Third country transfer: USA possible
- Privacy information:
https://policies.google.com/privacy
https://business.safety.google/gdpr/
I.) Duration of Storage
Your personal information will be stored as long as necessary to fulfill the purposes described in this privacy policy or as required by law.
II.) Transfer to Third Countries
When using plugins marked with third country transfer or USA, personal data may be transferred to servers in third countries outside the EU, such as the USA. The legal basis for this transfer is consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. The United States of America does not offer an adequate level of data protection based on a decision of the European Union. The main risk of the transfer is the obligation of plugin providers to make user data accessible to US authorities under certain circumstances. With all providers, there is currently a data processing agreement with standard contractual clauses to make the third country transfer as data protection-friendly and secure as possible. Adjustments to the ECJ ruling of 16.07.2020 (Schrems II, Ref. C-311/18) including additional security measures are currently being pursued by us. A copy of the standard contractual clauses can be requested from us by informal email.
III.) Possibility of Revocation
You have the right to withdraw your data protection consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
You can prevent the collection and processing of your personal data by the respective providers by blocking the storage of third-party cookies on your computer, using the "Do Not Track" function of a supported browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser.
IV.) Risk Notice
Your personal data is also transferred to the USA. There is no adequacy decision pursuant to Art. 45 para. 3 GDPR for the USA. We would like to point out that data transfer without an adequacy decision entails certain risks, which we would like to inform you about below: US intelligence services use certain online identifiers (such as the IP address or unique identifiers) as a starting point for monitoring individuals. In particular, it cannot be ruled out that these intelligence services have already collected information about you that can be used to trace the data transferred here back to you. Providers of electronic communication services headquartered in the USA are subject to surveillance by US intelligence services under 50 U.S. Code § 1881a (“FISA 702”). Accordingly, providers of electronic communication services headquartered in the USA are obliged to make personal data available to US authorities under 50 U.S. Code § 1881a, without you possibly having any legal remedies. Even encryption of the data in the data centers of the provider of electronic communication services cannot provide adequate protection, as a provider of electronic communication services with regard to imported data that is in its possession or custody or under its control has a direct obligation to grant access to or disclose it. This obligation may expressly extend to cryptographic keys without which the data is unreadable. The fact that this is not merely a "theoretical risk" is shown by the ECJ judgment of July 16, 2020 (Case C 311/18, "Schrems II"). We have concluded guarantees with Google in the form of standard contractual clauses pursuant to Art. 46 para. 2 lit. c GDPR. A copy of the standard contractual clauses can be requested from us.
