Data Protection Declaration

1) Information on the Collection of Personal Data and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. On the following pages, we inform you about the handling of your personal data when using our website. Personal data is all data with which you can be personally identified.

1.2 The controller in charge of data processing on this website, within the meaning of the General Data Protection Regulation (GDPR), is Jagna Kucharczyk, Foliage factory, Stettener Strasse 27, 78658 Zimmern ob Rottweil, Germany, e-mail: hello@foliage-factory.com. The controller in charge of the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2) Data Collection When You Visit Our Website

2.1 When using our website for information only, i.e. if you do not register or otherwise provide us with information, we only collect data that your browser transmits to our server (so-called "server log files"). When you visit our website, we collect the following data that is technically necessary for us to display the website to you:

Our visited website
Date and time at the moment of access
Amount of data sent in bytes
Source/reference from which you came to the page
Browser used
Operating system used
IP address used (if applicable: in anonymized form)

Data processing is carried out in accordance with Art. 6 (1) point f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to check the server log files subsequently, if there are any concrete indications of illegal use.

2.2 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the controller). You can recognize an encrypted connection by the character string https:// and the lock symbol in your browser line.

3) Hosting & Content Delivery Network

3.1 Shopify

For the hosting of our website and the display of the page content, we use the system of the following provider: Shopify International Limited, Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada

All data collected on our website is processed on the provider's servers. We have concluded an order processing agreement with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorised disclosure to third parties.

In case of data transfer to Canada, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

3.2 Cloudflare

We use a content delivery network offered by the following provider: Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA

This service enables us to deliver large media files such as graphics, page content or scripts faster via a network of regionally distributed servers. The processing is carried out to protect our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6 (1) point f GDPR. We have concluded an order processing agreement with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorised disclosure to third parties.

For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

3.3 Shopify

We use a content delivery network from the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify")

Data may also be transferred to:

Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada
Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA

This service enables us to deliver large media files such as graphics, page content, or scripts more quickly via a network of regionally distributed servers. The processing is carried out to protect our legitimate interest in improving the stability and functionality of our website in accordance with Art. 6 (1) (f) GDPR. We have concluded a data processing agreement with the provider that ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

When data is transferred to Canada, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

For data transfers to the USA, the data recipient has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection based on an adequacy decision of the European Commission.

4) Cookies

In order to make your visit to our website more attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your end device. In some cases, these cookies are automatically deleted again after the browser is closed (so-called "session cookies"), in other cases, these cookies remain on your end device for longer and allow page settings to be saved (so-called "persistent cookies"). In the latter case, you can find the duration of the storage in the overview of the cookie settings of your web browser.

If personal data is also processed by individual cookies set by us, the processing is carried out either in accordance with Art. 6 (1) point b GDPR for the performance of the contract, in accordance with Art. 6 (1) point a GDPR in the case of consent given or in accordance with Art. 6 (1) point f GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the page visit.

You can set your browser in such a way that you are informed about the setting of cookies and you can decide individually about their acceptance or exclude the acceptance of cookies for certain cases or in general.

Please note that the functionality of our website may be limited if cookies are not accepted.

5) Contacting Us

5.1 Trustpilot

For rating reminders, we use the services offered by the following provider: Trustpilot A/S, Pilestræde 58, 1112 Copenhagen, Denmark

We transmit your e-mail address and, if applicable, other customer data to the provider exclusively on the basis of your express consent in accordance with Art. 6 (1) point a GDPR to allow the provider to contact you by e-mail with a rating reminder.

You can revoke your consent at any time with effect for the future vis-à-vis us or the provider.

We have concluded an order processing contract with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorised disclosure to third parties.

5.2 When you contact us (e.g. via contact form or e-mail), personal data is collected. Which data is collected in the case of a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your request or for establishing contact and for the associated technical administration.

The legal basis for processing data is our legitimate interest in responding to your request in accordance with Art. 6 (1) point f GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 (1) point b GDPR. Your data will be deleted after final processing of your enquiry; this is the case if it can be inferred from the circumstances that the facts in question have been finally clarified, provided there are no legal storage obligations to the contrary.

6) Comment Function

When you use the comment function on this website, your comment, the time it was submitted and the name you chose for the comment are stored and published on this website. Your IP address is also logged and stored for security purposes and in case a comment infringes third-party rights or contains unlawful content. We need your email address to contact you if a third party challenges your published content as unlawful.

The legal bases for storing these data are Article 6(1)(b) and (f) GDPR. We reserve the right to delete comments that third parties challenge as unlawful.

7) Data Processing When Opening a Customer Account and for Contract Processing

Pursuant to Art. 6 (1) point b GDPR, personal data will continue to be collected and processed to the extent required in each case if you provide us with this data when opening a customer account. The data required for opening an account can be found in the corresponding form on our website. Deletion of your customer account is possible at any time and can be done by sending a message to the above address of the person responsible. After deletion of your customer account, your data will be deleted, provided that all contracts concluded via it have been fully processed, no statutory retention requirement prevents deletion and no legitimate interest on our part in the continued storage exists.

8) Use of Client Data for Direct Advertising

8.1 Subscribe to our e-mail newsletter

If you register for our e-mail newsletter, we will regularly send you information about our offers. The only mandatory data for sending the newsletter is your e-mail address. The provision of further data is voluntary and will be used to address you personally. We use the so-called double opt-in procedure for sending the newsletter. This means that we will only send you an e-mail newsletter once you have expressly confirmed that you consent to receiving newsletters. We will then send you a confirmation e-mail asking you to confirm that you wish to receive the newsletter in future by clicking on an appropriate link.

By activating the confirmation link, you give us your consent for the use of your personal data pursuant to Art. 6 (1) point a GDPR. When you register for the newsletter, we store your IP address entered by your Internet service provider (ISP) as well as the date and time of registration for the purpose of tracing any possible misuse of your e-mail address at a later date. The data collected by us when you register for the newsletter is used exclusively for the promotional purposes by way of the newsletter. You can unsubscribe from the newsletter at any time via the link provided for this purpose in the newsletter or by sending a corresponding message to the responsible person named at the beginning. After unsubscribing, your e-mail address will be deleted from our newsletter distribution list immediately, unless you have expressly consented to further use of your data, or we reserve the right to further use of your data which is permitted by law and about which we inform you in this declaration.

8.2 Shopify Email

Our e-mail newsletters are sent via this provider: Shopify Email, Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.

On the basis of our legitimate interest in effective and user-friendly newsletter marketing, we pass on the data you provided when registering for the newsletter to this provider in accordance with Art. 6 (1) point f GDPR so that they can send the newsletter on our behalf.

Subject to your express consent pursuant to Art. 6 (1) point a GDPR, the provider also carries out a statistical analysis of the success of newsletter campaigns by means of web beacons or tracking pixels in the emails sent, which can measure opening rates and specific interactions with the newsletter content. In the process, end device information (e.g. time of page view, IP address, browser type and operating system) is also collected and analysed, but not combined with other data records.

You can revoke your consent to newsletter tracking at any time with effect for the future.

We have concluded an order processing agreement with the provider, which safeguards the data of our website visitors and prohibits a transfer to third parties.

In case of data transfer to Canada, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

8.3 Notification by e-mail of stock availability
If our online shop provides the possibility of informing you by e-mail about the time of availability for selected, temporarily unavailable items, you can subscribe to our e-mail notification service for product availability. If you register for our e-mail notification service for product availability, we will send you a one-time message by e-mail about the availability of the article you have selected. The only mandatory information needed to send this notification is your e-mail address. The indication of further data is voluntary and is used if appropriate, in order to be able to address you personally. We use the so-called double opt-in procedure when sending this notification. This means that we will only send you a corresponding notification after you have expressly confirmed that you agree to receive such a message. We will then send you a confirmation e-mail asking you to click on a link to confirm that you wish to receive such notification.

By activating the confirmation link, you consent to the use of your personal data in accordance with Art. 6 (1) point a GDPR. When you register for our e-mail notification service for product availability, we store your IP address as registered by the internet service provider (ISP) as well as the date and time of registration in order to be able to track any possible misuse of your e-mail address at a later time. The data collected by us when you register for our e-mail notification service regarding the availability of goods is used exclusively for the purpose of informing you about the availability of a particular item in our online shop. You can cancel the e-mail notification service for the availability of goods at any time by sending a corresponding message to the controller in charge of data processing named at the beginning. After you have unsubscribed, your e-mail address will be deleted immediately from our distribution list, unless you have expressly consented to the further use of your data or unless we reserve the right to make further use of your data in accordance with the law about which we inform you in this declaration.

8.4 Shopping cart reminders by e-mail

If you cancel your purchase with us before completing the order, you have the option of being reminded of the contents of your virtual shopping cart by e-mail.

The only mandatory information required to send this reminder is your e-mail address. Providing additional data is voluntary and may be used to address you personally. We use the so-called double opt-in procedure to send e-mails, which ensures that you only receive a notification once you have expressly confirmed your consent to this by clicking on a verification link sent to the e-mail address provided.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Art. 6 (1) point a GDPR to send a shopping cart reminder. We store your IP address entered by your Internet service provider (ISP) as well as the date and time of registration in order to be able to trace any possible misuse of your e-mail address at a later date. The data we collect when you register for our e-mail notification service is used strictly for the intended purpose.

You can unsubscribe from the shopping cart reminders at any time by sending a corresponding message to the person responsible named above. After unsubscribing, your e-mail address will be immediately deleted from our mailing list set up for this purpose, unless you have expressly consented to further use of your data or we reserve the right to use the data in any other way that is permitted by law and about which we inform you in this declaration.

9) Processing of Data for the Purpose of Order Handling

9.1 Insofar as necessary for the processing of the contract for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6 Para. 1 lit. b GDPR.

If we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we will process the contact data (name, address, e-mail address) provided by you when placing the order in order to inform you personally by suitable means of communication (e.g. by post or e-mail) about upcoming updates within the legally stipulated period of time within the framework of our statutory duty to inform pursuant to Art. 6 Para. 1 lit. c GDPR. Your contact details will be used strictly for the purpose of informing you about updates owed by us and will only be processed by us for this purpose to the extent that this is necessary for the respective information.

In order to process your order, we also work together with the following service provider(s), who support us in whole or in part in the execution of concluded contracts. Certain personal data is transferred to these service providers in accordance with the following information.

9.2 In order to fulfil our contractual obligations, we may use direct delivery by suppliers (drop shipping). For this purpose, we will pass on your name and delivery address to a supplier selected by us, solely for the purpose of delivering the goods, in accordance with Article 6 (1) point b of the GDPR.
Where the delivery involves goods that cannot be sent by parcel post (freight, bulky goods, etc.), and where prior coordination of a delivery date by telephone is required, we will also pass on your telephone number to the said supplier in accordance with Article 6 (1) point b of the GDPR.

9.3 If we use dropshipping suppliers to fulfil our contractual obligations, we also pass on your email address and/or telephone number to the supplier before delivery to arrange a delivery date or provide a delivery notification, provided you have given your express consent during the order process in accordance with Article 6(1)(a) GDPR.

You may withdraw your consent by contacting us at any time with effect for the future.

9.4 Passing on Personal Data to Shipping Service Providers

- Deutsche Post

We use the following provider as transport service provider: Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany

We pass on your e-mail address and/or telephone number to the provider in accordance with Art. 6 (1) point a GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or for delivery notification, if you have given your express consent in the ordering process. Otherwise, we will only pass on the name of the recipient and the delivery address to the supplier for the purpose of delivery in accordance with Art. 6 (1) point b GDPR. The transmission only takes place to the extent necessary for the delivery of the goods. In this case, prior coordination of the delivery date with the supplier or the delivery announcement is not possible.

The consent can be revoked at any time with effect for the future vis-à-vis the responsible person named above or vis-à-vis the provider.

- DHL

We use the following provider as transport service provider: DHL Paket GmbH, Charles-de-Gaulle-Str. 20, 53113 Bonn, Germany

The consent can be revoked at any time with effect for the future vis-à-vis the responsible person named above or vis-à-vis the provider.

- DHL Express

We use the following provider as transport service provider: DHL Express Germany GmbH, Heinrich-Brüning-Str. 5, 53113 Bonn, Germany

The consent can be revoked at any time with effect for the future vis-à-vis the responsible person named above or vis-à-vis the provider.

- DHL Express Austria

We use the following transport service provider: DHL Express (Austria) GmbH, Am Europlatz 2 (Objekt G), 1120 Vienna, Austria.

With your express consent during the order process under Article 6(1)(a) GDPR, we pass your email address and/or telephone number to the provider before delivery to arrange a delivery date or provide a delivery notification. Otherwise, we pass on only the recipient’s name and delivery address for delivery purposes under Article 6(1)(b) GDPR. Data are disclosed only to the extent necessary for delivery. Without this consent, prior delivery coordination or notification by the provider is not possible.

You may withdraw your consent at any time with effect for the future by contacting the controller named above or the provider.

- DHL Austria

We use the following provider as transport service provider: DHL Paket (Austria) GmbH, Campus 21, Liebermannstrasse F08/401, 2345 Brunn am Gebirge, Austria

The consent can be revoked at any time with effect for the future vis-à-vis the responsible person named above or vis-à-vis the provider.

- DPD

We use the following provider as transport service provider: DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg, Germany

The consent can be revoked at any time with effect for the future vis-à-vis the responsible person named above or vis-à-vis the provider.

- DPD Austria

We use the following provider as transport service provider: DPD Direct Parcel Distribution Austria GmbH, Arbeitergasse 46, Leopoldsdorf 2333, Austria

The consent can be revoked at any time with effect for the future vis-à-vis the responsible person named above or vis-à-vis the provider.

- GLS

We use the following provider as transport service provider: General Logistics Systems Germany GmbH & Co. OHG, GLS Germany-Straße 1 – 7, 36286 Neuenstein, Germany

The consent can be revoked at any time with effect for the future vis-à-vis the responsible person named above or vis-à-vis the provider.

- Hermes

We use the following provider as transport service provider: Hermes Logistik Gruppe Deutschland GmbH, Essener Straße 89, 22419 Hamburg, Germany

The consent can be revoked at any time with effect for the future vis-à-vis the responsible person named above or vis-à-vis the provider.

- Austrian Post

We use the following provider as transport service provider: Austrian Post Aktiengesellschaft, Rochusplatz 1, 1030 Vienna, Austria

The consent can be revoked at any time with effect for the future vis-à-vis the responsible person named above or vis-à-vis the provider.

- Post CH

We use the following provider as transport service provider: Schweizerische Post AG, Schweiz, Wankdorfallee 4, 3030 Bern

We pass on your e-mail address and/or telephone number to the provider prior to delivery of the goods for the purpose of coordinating a delivery date or for delivery notification, if you have given your express consent in the ordering process. Otherwise, we will only pass on the name of the recipient and the delivery address to the supplier for the purpose of delivery. This information will only be passed on if it is necessary for the delivery of the goods. In this case, prior coordination of the delivery date with the supplier or notification of delivery is not possible.

The consent can be revoked at any time with effect for the future vis-à-vis the responsible person named above or vis-à-vis the provider.

In case of data transfer to the provider's location, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

- Poste Italiane

We use the following transport service provider: Poste Italiane S.p.A., Viale Europa 190, 00144 Rome, Italy.

You may withdraw your consent at any time with effect for the future by contacting the controller named above or the provider.

- PostNL

We use the following provider as transport service provider: Koninklijke post NL BV, Waldorpstraat 3, 2521CA The Hague, Netherlands

The consent can be revoked at any time with effect for the future vis-à-vis the responsible person named above or vis-à-vis the provider.

- trans-o-flex

We use the following transport service provider: trans-o-flex Express GmbH & Co. KGaA, Hertzstraße 10, 69469 Weinheim, Germany.

You may withdraw your consent at any time with effect for the future by contacting the controller named above or the provider.

- UPS

We use the following provider as transport service provider: United Parcel Service Deutschland Inc. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany

The consent can be revoked at any time with effect for the future vis-à-vis the responsible person named above or vis-à-vis the provider.

- UPS Austria

We use the following provider as transport service provider: United Parcel Service Speditionsgesellschaft m.b.H, Cargo Nord, Objekt 1,1300 Vienna Airport, Austria

The consent can be revoked at any time with effect for the future vis-à-vis the responsible person named above or vis-à-vis the provider.

9.5 Use of Payment Service Providers

- Apple Pay

If you choose the payment method "Apple Pay" of Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, the payment processing is carried out via the "Apple Pay" function of your terminal device operated with iOS, watchOS or macOS by debiting a payment card deposited with "Apple Pay". Apple Pay uses security features built into the hardware and software of your device to protect your transactions. In order to release a payment, you use the authentication method required by your device, such as Face ID, Touch ID or a device passcode.
For the purpose of payment processing, your information provided during the ordering process, along with information about your order, will be transmitted to Apple in encrypted form. Apple then encrypts this data again with a developer-specific key before the data is transmitted to the payment service provider of the payment card stored in Apple Pay for payment processing. The encryption ensures that only the website from which the purchase was made can access the payment information. After the payment is made, Apple sends your device account number and a transaction-specific dynamic security code to the originating website to confirm the payment.
If personal data is processed in the described transmissions, the processing is carried out exclusively for the purpose of payment processing in accordance with Art. 6 Para. 1 lit. b GDPR.
Apple retains anonymised transaction data, including the approximate amount of the purchase, the approximate date and time and whether the transaction was completed successfully. Anonymisation completely excludes any personal reference. Apple uses the anonymised data to improve Apple Pay and other Apple products and services.
When you use Apple Pay on iPhone or the Apple Watch to complete a purchase made through Safari on Mac, the Mac and the authorization device communicate through an encrypted channel on Apple's servers. Apple does not process or store this information in any format that can identify you personally. You can disable the ability to use Apple Pay on your Mac in your iPhone preferences. Go to "Wallet & Apple Pay" and disable "Allow payments on Mac".
For more information about Apple Pay privacy, please visit the following web address: https://support.apple.com/en-gb/HT203027

- Bancontact

Online payment methods from the following provider are available on this website: Bancontact Payconiq Company, Rue d'Arlon 82, 1040 Brussels, Belgium

If you select a payment method of the provider for which you make an advance payment (e.g. credit card payment), your payment data provided during the ordering process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be passed on to the provider in accordance with Art. 6 (1) point b GDPR. In this case, your data will only be passed on for the purpose of processing payment with the provider and only to the extent necessary for this purpose.

- BLIK

One or more online payment methods from the following provider are available on this website: Polski Standard Płatności Sp. z o.o., Czerniakowska 87a, 00-718 Warsaw, Poland.

To process your payment, the payment data supplied during the order process, including your name, address, bank and payment-card information, currency and transaction number, and information about your order are passed to the provider in accordance with Article 6(1)(b) GDPR. This disclosure is solely for payment processing with the provider and only to the extent necessary for that purpose.

- EPS-Überweisung

Online payment methods from the following provider are available on this website: PSA Payment Services Austria GmbH, Handelskai 92, Gate 2,1200 Vienna, Austria

- Google Pay

If you select Google Pay at checkout, you choose an available payment method through Google’s payment interface. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). Google Pay can be used in supported web browsers on computers and mobile devices. Any authentication required depends on the payment method, issuing bank and device.

Google Pay securely returns payment data, including a payment token, for the selected payment method. These data and the purchase details are passed to the payment service provider to execute the transaction. Depending on the information requested during checkout, billing or delivery details and contact information may also be supplied. We process the data necessary to complete the payment and fulfil the order under Article 6(1)(b) GDPR.

Google also processes information about your use of Google Pay, such as transaction details, account information and device information, for its own purposes as described in its privacy notice. This can include processing payments, preventing fraud, complying with legal requirements and maintaining or improving the service. The applicable legal bases and any combination with information from other Google services are explained in that notice.

Further information: Google Pay terms and Google Payments privacy notice.

- Klarna

Online payment methods from the following provider are available on this website: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden

When selecting a payment method of the provider with which the provider makes advance payments (such as invoice purchase or instalment purchase or direct debit), you will also be asked to provide certain personal data (first name and surname, street, house number, postcode, city, date of birth, e-mail address, telephone number, if applicable data on alternative means of payment) during the ordering process.

In order to safeguard our legitimate interest in determining the solvency of our customers, this data is passed on to the provider by us for the purpose of a credit check in accordance with Art. 6 (1) point f GDPR. On the basis of the personal data provided by you as well as further data (such as shopping cart, invoice total, order history, payment history), the provider checks whether the payment option selected by you can be granted with regard to payment and/or bad debt risks.

In addition to internal provider criteria, identity and creditworthiness information from the following credit agencies may also be included in the decision-making process as part of the application review in accordance with Art. 6 (1) point f GDPR:

https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they have their basis in a scientifically recognised mathematical-statistical procedure. The calculation of the score values includes, but is not limited to, address data.

You can object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may still be entitled to process your personal data if this is necessary for the contractual processing of payments.

- PayPal

Online payment methods from the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method of the provider for which you make an advance payment, your payment data provided during the ordering process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be passed on to the provider in accordance with Art. 6 (1) point b GDPR. In this case, your data will only be passed on for the purpose of processing payment with the provider and only to the extent necessary for this purpose.

When selecting a payment method of the provider with which the provider makes advance payments, you will also be asked to provide certain personal data (first name and surname, street, house number, postcode, city, date of birth, e-mail address, telephone number, if applicable data on alternative means of payment) during the ordering process.

- PayPal Checkout

This website uses PayPal Checkout, an online payment system from PayPal, which consists of PayPal's own payment methods and local payment methods from third-party providers.

When paying via PayPal, credit card via PayPal, direct debit via PayPal or - if offered - "Pay Later" via PayPal, we pass on your payment data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal") as part of the payment processing. The transfer takes place in accordance with Art. 6 Para. 1 lit. b GDPR and only insofar as this is necessary for the payment processing.

For the payment methods credit card via PayPal, direct debit via PayPal or - if offered - "Pay later" via PayPal - PayPal reserves the right to conduct a credit check. For this purpose, your payment data may be passed on to credit agencies in accordance with Art. 6 Para. 1 lit. f GDPR on the basis of PayPal's legitimate interest in determining your solvency. PayPal uses the result of the credit check in terms of the statistical probability of non-payment for the purpose of deciding on the provision of the respective payment method. The creditworthiness information may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they have their basis in a scientifically recognised mathematical-statistical procedure. The calculation of the score values includes, but is not limited to, address data. You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for the contractual processing of payments.

If you select the PayPal payment method "purchase on account", your payment data will first be transferred to PayPal in preparation for payment, whereupon PayPal will forward them to Ratepay GmbH, Ritterstr. 12-14, 10969 Berlin ("Ratepay") in order to carry out the payment. The legal basis in each case is Art. 6 para. 1 lit. b GDPR. In this case, Ratepay carries out an identity and creditworthiness check on its own behalf to determine solvency in accordance with the principle already mentioned above and passes on your payment data to credit agencies on the basis of the legitimate interest in determining solvency in accordance with Art. 6 Para. 1 lit. f GDPR. A list of the credit agencies that Ratepay may use can be found here: https://www.ratepay.com/legal-payment-creditagencies/

When using the payment method of a local third party provider, your payment data will first be forwarded to PayPal for the preparation of the payment in accordance with Art. 6 (1) lit. b GDPR. Depending on your selection of an available local payment method, PayPal will then transfer your payment data to the corresponding provider in order to carry out the payment in accordance with Art. 6 Para. 1 lit. b GDPR:

- Apple Pay (Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
- Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)
- Klarna (Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden)
- iDeal (Currence Holding BV, Beethovenstraat 300 Amsterdam, Netherlands)
- bancontact (Bancontact Payconiq Company, Rue d'Arlon 82, 1040 Brussels, Belgium)
- blik (Polski Standard Płatności sp. z o.o., ul. Czerniakowska 87A, 00-718 Warsaw, Poland)
- eps (PSA Payment Services Austria GmbH, Handelskai 92, Gate 2
1200 Vienna, Austria)
- MyBank (PRETA S.A.S, 40 Rue de Courcelles, F-75008 Paris, France)
- Przelewy24 (PayPro SA, Kanclerska 15A, 60-326 Poznań, Poland).

For further information on data protection, please refer to PayPal's privacy policy: https://www.paypal.com/de/legalhub/paypal/privacy-full?locale.x=en_DE

- Ratepay

Online payment methods from the following provider are available on this website: Ratepay GmbH, Ritterstr. 12-14, 10969 Berlin, Germany

https://www.ratepay.com/legal-payment-creditagencies/

- Shopify Payments

Online payment methods from the following provider are available on this website: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

9.6 Electronic Withdrawal Function for Distance Contracts

Consumers who conclude contracts on this website for which a statutory right of withdrawal exists have the option to declare their withdrawal via an electronic withdrawal function, in accordance with the applicable withdrawal provisions.

When using the withdrawal function, in addition to details identifying the specific contract being withdrawn from, other personal information—such as the consumer's first name, last name, and email address—must be provided or confirmed.

The collection of this information and its transmission to us is carried out in accordance with Art. 6 (1) point b of the GDPR, and only to the extent necessary for the proper processing of the withdrawal request. Furthermore, and also based on Art. 6 (1) point b of the GDPR, the provided personal data is used to confirm receipt of the withdrawal declaration via email. An additional legal basis for this processing is Art. 6 (1) point c of the GDPR. We are legally obligated to provide an electronic cancellation function for remunerated distance contracts concluded with consumers.

10) Online Marketing

10.1 Google AdSense

This website uses Google AdSense, a web ad service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). Google AdSense uses so-called cookies. These are text files that are stored on your computer and enable an analysis of your use of the website. In addition, Google AdSense also uses "web beacons" (small invisible graphics) to collect information, which can be used to record, collect and evaluate simple actions such as visitor traffic on the website. The information generated by those cookies and/or web beacons (including your IP address) about your use of this website will normally be transmitted to a server of Google and will be stored there. When using Google AdSense, personal data may also be transmitted to the servers of Google LLC. in the USA.

Google will use the information obtained in this way to analyze your usage of this website with regard to AdSense ads. The IP address transmitted by your browser as part of Google AdSense is not merged with other Google data. The information collected by Google may be transferred to third parties, if this is prescribed by law and/or if third parties process this data by request of Google.

All processing described above, in particular the reading of information on the end device used, is only carried out if you have given us your express consent to do so in accordance with Art. 6 (1) point a GDPR. Without this consent, Google AdSense will not be used during your visit to the site.

You can revoke your consent at any time with effect for the future. To exercise your revocation, please deactivate this service in the "Cookie Consent Tool" provided on the website.

For more information about Google's privacy policy, please visit: https://privacy.google.com/intl/en-GB/take-control.html?categories_activeEl=sign-in and https://business.safety.google/privacy/

10.2 Smile.io Loyalty Programme

To reward customers for certain actions on our website, we use the loyalty programme of the following provider: Smile, Inc, PO Box 33042, Ira Needles, Waterloo, ON, N2T 2M9, Canada.

Rewards are recorded through a points system, and points can be redeemed for rewards. To record eligible orders and other interactions correctly and assign them to the loyalty programme, we transmit order data to the provider: name, email address, order number, cart items, cart value, item ID, item price and shipping country. The provider stores and evaluates these data.

This processing takes place only if you have a registered user account on our website and have signed up for the loyalty programme. It is based on our legitimate interest in calculating rewards correctly for participating customers and on customers’ legitimate interest in having all eligible orders credited, in accordance with Article 6(1)(f) GDPR.

We have concluded a data processing agreement with the provider that protects our website visitors’ data and prohibits unauthorised disclosure to third parties.

An adequacy decision of the European Commission ensures an appropriate level of protection when data are transferred to the provider’s location.

11) Web Analysis Services

11.1 Google Analytics 4

This website uses Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which can be used to analyze the use of websites.

Google Analytics 4 uses cookies, which are text files stored on your device, to analyse your use of this website. The information collected is normally transmitted to and processed on Google servers, including, where applicable, servers of Google LLC in the USA.

According to Google, IP addresses of users in the EU, Switzerland and the UK are used to derive approximate location information and are then discarded before measurement data are logged. These IP addresses are not logged or stored in Google Analytics.

On our behalf, Google evaluates use of the website and prepares reports about website activity and related use of its services. The two-month retention period stated here applies to user-level and event-level data covered by Google Analytics’ retention controls, including data associated with cookies, user identifiers or advertising identifiers. Google deletes expired data in its monthly deletion cycle. This control does not determine the retention of standard aggregated reports.

If the option to reset retention on new activity is enabled, each new event from a user restarts the retention period for that user identifier. If it is disabled, new activity does not restart that period. Age, gender and interest data are subject to Google’s separate two-month retention rule. Further information is available in Google’s data-retention explanation.

Demographic characteristics
Google Analytics can provide statistics about the age, gender and interests of website users, drawing on advertising information and other information available to Google. These statistics help us identify groups for marketing analysis. The demographic reports supplied to us do not identify individual visitors by name. The retention rules described above apply.

All processing described above, in particular the setting of Google Analytics cookies for the storage and reading of information on the terminal device used by you for the use of the website, will only take place if you have given us your express consent for this in accordance with Art. 6 para. 1 letter a GDPR. Without your consent, Google Analytics 4 will not be used during your use of the website.

You can revoke your consent once given at any time with effect for the future. To exercise your revocation, please deactivate this service via the "Cookie Consent Tool" provided on the website.

Google Signals
On this website, the "Google Signals" service can also be used as an extension of Google Analytics 4. With Google Signals, cross-device reports can be created by Google (so-called "cross-device tracking"). If you have activated "personalised ads" in your Google account settings and you have linked your internet-enabled devices to your Google account, Google can analyse user behaviour across devices and create database models based on this, provided you have given your consent to the use of Google Analytics in accordance with Art. 6 para. 1 letter a GDPR (see above). The logins and device types of all page visitors who were logged into a Google account and performed a conversion are taken into account. The data shows, among other things, on which device you first clicked on an ad and on which device the associated conversion took place. Insofar as Google Signals is used, we do not receive any personal data from Google, but only statistics compiled on the basis of Google Signals. You have the option of deactivating the "personalised ads" function in the settings of your Google account and thus turning off the cross-device analysis. To do this, follow the instructions on this page: https://support.google.com/ads/answer/2662922?hl=de
Further information can be found here: https://support.google.com/analytics/answer/7532985?hl=de

User IDs
As an extension of Google Analytics 4, the "UserIDs" function can also be used on this website. By assigning individual UserIDs, we can have Google create cross-device reports (so-called "cross-device tracking"). This means that your usage behaviour can also be analysed across devices if you have given your corresponding consent to the use of Google Analytics in accordance with Art. 6 para. 1 letter a GDPR, if you have set up a personal account by registering on this website and are logged into your personal account on different end devices with your relevant login data. The data collected in this way shows, among other things, on which end device you clicked on an ad for the first time and on which end device the relevant conversion took place.

We have concluded a so-called data processing agreement with Google for our use of Google Analytics 4, by which Google is obliged to protect the data of our website users and not to pass it on to third parties.

Further legal information on Google Analytics 4 can be found here: https://policies.google.com/privacy?hl=en and https://business.safety.google/privacy/

Details on the processing triggered by Google Analytics 4 and Google's handling of data from websites can be found here: https://policies.google.com/technologies/partner-sites

Collection of user-provided data
To improve analysis for users whose contact details we have received through business or similar relationships, we use the user-provided data collection feature. With your express consent under Article 6(1)(a) GDPR, we electronically transmit customer data, particularly email addresses and telephone numbers, for matching with Google accounts. These contact details are converted into hash values using the SHA-256 procedure. Matching allows more precise measurement, improved cross-device attribution and use of analysis results for Google Ads personalisation and conversion tracking. You may withdraw your consent by contacting us at any time with effect for the future. Further information is available in Google’s information on user-provided data.

Further information on IP-address handling: Google Analytics.

11.2 Shopify Analytics

This website uses the web analytics service provided by the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada

Using cookies and/or comparable technologies (tracking pixels, web beacons, algorithms for reading end device and browser information), the service collects and stores pseudonymised visitor data, including information on the end device used such as the IP address and browser information, in order to evaluate it for statistical analyses of user behaviour on our website and to create pseudonymised user profiles. Pseudonymisation generally excludes the possibility of direct personal reference. Your personal data will not be combined with data collected in any other way.

All processing described above, in particular the reading or saving of information on the end device used, is only carried out if you have given us your express consent in accordance with Art. 6 (1) point a GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the "cookie consent tool" provided on the website.

We have concluded an order processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

When data is transferred to Canada, an appropriate level of data protection is guaranteed by an adequacy decision of the European Commission.

11.3 Shopify Network Intelligence

We use Shopify Network Intelligence, provided by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”).

For the Enhanced Services covered by Appendix E of Shopify’s Data Processing Addendum, Shopify acts as an independent controller. It uses customer interactions and transactions across our store, other merchants and Shopify to provide, develop and improve analytics, product personalisation and advertising services. Relevant data may include contact details, order and search histories, products viewed, transaction details, device identifiers, IP addresses and privacy preferences. The processor relationship for other Shopify services remains separate.

Where our processing for statistical service improvement does not require consent, its legal basis is our legitimate interest in understanding and improving our store under Article 6(1)(f) GDPR. Personalised advertising and any non-essential storage or access on your device requiring consent take place only on the basis of your consent under Article 6(1)(a) GDPR. You can withdraw that consent through our website’s cookie settings. You can also contact us to exercise your rights, including the right to object where applicable.

Shopify explains its own purposes, legal bases, recipients and retention criteria in its Consumer Privacy Policy. You can exercise rights concerning Shopify’s controller processing, including advertising choices, through Shopify’s privacy portal.

Data may be processed by Shopify Inc. in Canada and by other Shopify entities or service providers, including in the USA. Shopify describes the safeguards for international transfers, including binding corporate rules for relevant intra-group transfers and standard contractual clauses where appropriate, in its privacy policy.

12) Retargeting, Remarketing and Conversion Tracking

12.1 Meta Pixel with Advanced Matching

We use Meta Pixel with advanced matching, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”).

With your consent, the pixel records information about actions on our website, such as page visits, registrations and purchases, together with device and browser information and relevant identifiers. This can include an IP address and identifiers associated with a click on a Facebook or Instagram advertisement. Advanced matching also uses customer details supplied to us, such as an email address. Matching details are converted into SHA-256 hash values before transmission by the pixel. Hashing does not make them anonymous: Meta can match the values with its account records.

We use this information to measure the effectiveness of our advertisements, attribute conversions and form audiences for relevant advertising on Facebook and Instagram. Meta may associate the information with its users and process it for its own advertising purposes in accordance with its privacy policy.

For the collection of event data and their transmission to Meta that constitute joint processing, we and Meta are joint controllers under Article 26 GDPR. The subsequent processing by Meta is outside that joint processing. Our respective responsibilities are set out in the Controller Addendum to the Meta Business Tools Terms. We are responsible for the information we provide and for obtaining the required consent on our website. You may exercise your data-protection rights concerning the joint processing against either controller. Meta’s privacy policy provides its contact details and further information about its processing and your rights.

The processing described here, including non-essential cookies and device access, takes place only with your consent under Article 6(1)(a) GDPR. You can withdraw it at any time for the future in our website’s cookie settings. Withdrawal does not affect the lawfulness of processing before withdrawal.

Data may be transferred to Meta Platforms, Inc. in the USA. Meta identifies participation in the EU–US Data Privacy Framework as a safeguard for covered transfers to its certified US entity. Further information on transfers and safeguards is provided in Meta’s privacy policy.

12.2 Google Ads Remarketing

This website uses Google Ads remarketing provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).

With your consent, information about your previous visits to our website is used to create advertising audience segments. Google and other participating advertising providers use cookies and/or device identifiers to show our advertisements on websites across the Internet based on those previous visits.

This processing, including storing or reading information on your device, takes place only with your express consent under Article 6(1)(a) GDPR. You may withdraw that consent at any time with effect for the future by disabling the service in our cookie consent tool.

You can also manage personalised advertising through Google My Ad Center and your device settings.

Personal data may also be transferred to Google LLC in the USA. The provider participates in the EU–US Data Privacy Framework, which ensures an appropriate level of data protection on the basis of an adequacy decision of the European Commission.

Further information is available in Google’s privacy policy.

12.3 Google Ads Conversion-Tracking

This website uses the online advertising program "Google Ads" and, within the scope of Google Ads, the conversion tracking of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). We use Google Ads to draw attention to our attractive offers on external websites with the help of advertising media (so-called Google Adwords). We can determine how successful the individual advertising measures are in relation to the data of the advertising campaigns. Our aim is to show you advertising that is of interest to you, to make our website more interesting for you and to achieve a fair calculation of the advertising costs incurred.

The conversion tracking cookie is set when a user clicks on an ad placed by Google. Cookies are small text files that are stored on your end device. These cookies usually lose their validity after 30 days and are not used for personal identification. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognize that the user clicked on the ad and was redirected to this page. Each Google Ads customer receives a different cookie. Cookies cannot therefore be tracked across Google Ads clients' websites. The information obtained using the conversion cookie is used to create conversion statistics for Google Ads customers who have opted in to conversion tracking. Clients learn the total number of users who clicked on their ad and were redirected to a page tagged with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users.
The use of Google Ads may also result in the transmission of personal data to the servers of Google LLC. in the USA.

Details on the processing triggered by Google Ads Conversion Tracking and on Google's handling of data from websites can be found here: https://policies.google.com/technologies/partner-sites.

All of the processing described above, in particular the setting of cookies for reading out information on the end device used, will only be carried out if you have given us your express consent to do so in accordance with Art. 6 (1) a GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website.

You can also manage personalised advertising through Google My Ad Center. To withdraw your consent to tracking on this website, use our cookie consent tool as described above.

In order to address users whose data we have received in the context of business or business-like relationships in a more interest-oriented advertising manner, we use a customer matching function in the context of Google Ads. For this purpose, we transmit one or more files containing customer contact data (primarily email addresses and telephone numbers) electronically to Google. The email addresses and telephone numbers are converted into SHA-256 hash values for matching with existing Google accounts. Hashing does not make the data anonymous: Google can match the hash values to its account records. This enables personalized advertising to be played via all Google services linked to the respective Google account.

Customer data will only be transferred to Google if you have given us your express consent to do so in accordance with Art. 6 (1) a GDPR. You can revoke this consent at any time with effect for the future. Further information on Google's data protection measures in relation to the customer matching function can be found here: https://support.google.com/google-ads/answer/6334160?hl=en&ref_topic=10550182

Further information on Google's privacy standards can be found here: https://policies.google.com/privacy and https://business.safety.google/privacy/

12.4 Google Marketing Platform

This website uses the online marketing tool Google Marketing Platform of the operator Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("GMP").

GMP uses cookies to serve ads relevant to users, to improve campaign performance reports or to prevent a user from seeing the same ads more than once. Google uses a cookie ID to identify which ads are shown in which browser and to prevent them from being shown more than once.

In addition, GMP can use cookie IDs to record so-called conversions that relate to ad requests. This is the case, for example, when a user sees a GMP advertisement and later, using the same browser, calls up the advertiser's website and makes a purchase via this website. According to Google, GMP cookies contain no personal information.

Due to the marketing tools used, your browser automatically establishes a direct connection with the Google server. We have no influence on the scope and further use of the data collected by Google through the use of these tools and therefore inform you as follows according to our state of knowledge: By integrating GMP, Google receives the information that you have called up the corresponding part of our website or clicked on an advertisement from us. If you are registered with a Google service, Google can allocate the visit to your account. Even if you are not registered with Google or have not logged in, it is possible that the provider will find out and save your IP address. In the context of the use of GMP, personal data may also be transmitted to the servers of Google LLC. in the USA.

You can revoke your consent at any time with effect for the future. To exercise your revocation, please deactivate this service in the "Cookie Consent Tool" provided on the website.

You can obtain further information about the data protection regulations of GMP by Google at the following Internet addresses: https://policies.google.com/privacy?gl=de&hl=en and https://business.safety.google/privacy/

12.5 OpenAI Ads Conversion Tracking

This website uses the conversion tracking technology of the following provider: OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland

Data may also be transferred to: OpenAI OpCo, LLC, USA

For this purpose, certain end device and browser information, including your IP address if applicable, is read via the tracking technology in order to record and evaluate user actions predefined by us (e.g., completed transactions, leads, search queries on the website, calls to product pages). This enables us to compile statistics on user behavior on our website after forwarding from an advertisement, which we use to optimize our offer.
All processing described above, in particular the setting of cookies for the reading of information on the end device used, will only be carried out if you have given us your express consent to do so in accordance with Art. 6 (1) point a GDPR. You can revoke your consent at any time with future effect by deactivating this service in the "cookie consent tool" provided on the website.

We and OpenAI generally act as independent data controllers. OpenAI acts as a processor only for the restricted activities defined in its Ad Tools Data Processing Addendum.

Under its Conversion Terms, OpenAI may use the information to provide reports, create advertising audiences and develop, provide, measure and improve its products and services.

OpenAI Ireland Limited processes data from the EEA and Switzerland. Onward transfers to countries without adequate protection require a valid transfer mechanism. For transfers between affiliates in its restricted processing arrangements, OpenAI identifies European Commission standard contractual clauses in its Ad Tools Sub-Processor List.

12.6 Pinterest-Tag Conversion-Tracking

This website uses the conversion tracking technology of the following provider: Pinterest Europe Ltd, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland

If you have accessed our website from an advertisement on the provider's domain, the success of the advertisement can be tracked with the help of cookies and/or comparable technologies (tracking pixels, web beacons, pings, or HTTP requests).
For this purpose, certain end device and browser information, including your IP address if applicable, is read via the tracking technology in order to record and evaluate user actions predefined by us (e.g., completed transactions, leads, search queries on the website, calls to product pages). This enables us to compile statistics on user behavior on our website after forwarding from an advertisement, which we use to optimize our offer.

All processing described above, in particular the setting of cookies for the reading of information on the end device used, will only be carried out if you have given us your express consent to do so in accordance with Art. 6 (1) point a GDPR. You can revoke your consent at any time with future effect by deactivating this service in the "cookie consent tool" provided on the website.

We have concluded an order processing agreement with the provider, which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

13) Site Functionalities

13.1 Pinterest plugins

Plugins of the social network of the following provider are used on our website: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland

These plugins allow direct interaction with content on the social network.

In order to increase the protection of your data when visiting our website, the plugins are initially deactivated and integrated into the page by means of a so-called "2-click" or "Shariff" solution. This integration ensures that when you access a page of our website that contains such plugins, no connection is yet established with the servers of the provider.

Your browser only establishes a direct connection to the servers of the provider when you activate the plugins and thereby give your consent to the data transfer in accordance with Art. 6 (1) point a GDPR. In this process, regardless of whether you log into an existing user profile, a certain amount of information about your end device used (including your IP address), your browser and your page history is transferred to the provider and may be further processed there.

If you are logged into an existing user profile on the provider's social network, information about interactions carried out via the plugins will also be published there and displayed to your contacts.

You can revoke your consent at any time by deactivating the activated plugin by clicking on it again. However, the revocation has no influence on the data that has already been transferred to the provider.

Data can also be transferred to: Pinterest Inc., USA

We have concluded an order processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

For the transfer of data to the USA, the provider relies on standard contractual clauses of the European Commission, which are meant to ensure compliance with the European level of data protection.

13.2 Trust-Widget by IT-Recht Kanzlei

Our website incorporates graphic elements from the following provider to display an externally awarded trust seal: IT-Recht Kanzlei GmbH & Co. KG, Alter Messeplatz 2, 80339 Munich, Germany

When you visit a page on our website that contains such graphic elements, your browser establishes a direct connection to the provider's servers in order to load the elements properly. In doing so, certain browser information, including your IP address, is transmitted to the provider.

Insofar as personal data is processed in this context, this is done in accordance with Art. 6 (1) lit. f GDPR on the basis of our legitimate interest in the optimal marketing of our offer and the appealing design of our website.

13.3 Trustpilot Display Widget

Our website displays graphic elements from Trustpilot A/S, Pilestræde 58, 1112 Copenhagen, Denmark, to show external customer reviews and/or an externally awarded quality seal.

When you visit a page containing these elements, your browser connects directly to the provider’s servers to load them. Certain browser information, including your IP address, is transmitted to the provider.

Where personal data are processed, the legal basis is Article 6(1)(f) GDPR and our legitimate interest in marketing our offering and presenting our website attractively.

13.4 Google Maps

We use embedded Google Maps to display geographical information and our location. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).

The embedded map is loaded only after you consent to this service. When activated, it connects your browser to Google and transmits information such as your IP address, browser details and the page containing the map. Google may process these data on servers in the USA and may associate them with your Google account if you are signed in. Google’s own use of the data, including personalisation, is explained in its privacy policy.

Our integration and the associated device access and disclosure are based on your consent under Article 6(1)(a) GDPR. You can withdraw it at any time for the future through the cookie settings on our website and then reload the page. The map will not be loaded without the required consent. You can also contact us about your consent and exercise rights concerning Google’s own processing directly with Google. Withdrawal does not affect processing already lawfully carried out.

Further information: Google’s terms, additional Google Maps terms and Google’s privacy policy. For covered transfers to Google LLC in the USA, Google relies on its participation in the EU–US Data Privacy Framework. Its privacy policy explains further safeguards and rights.

13.5 Google Maps API

To check certain entries in the address form of the order process used in our web shop to detect input errors in real time, we use the services of the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transmitted to: Google LLC., USA

The provider validates the address entered, verifies the spelling, and completes any missing data. If the address is not unique, correct alternative suggestions are displayed. For this purpose, the address data you entered is transmitted to the provider, stored there, and evaluated.

This processing is carried out in accordance with Art. 6 (1) point f GDPR based on our legitimate interest in the proper collection of the correct customer address data to diligently fulfil our contractual delivery obligations and to prevent contract implementation problems.

The provider processes the data concerned separately and does not merge them with other data files. He deletes them as soon as their status or correctness has been confirmed, but no later than after 30 days.

Further information on Google's privacy standards can be found here: https://business.safety.google/privacy/

13.6 Google Web Fonts

This site uses so-called web fonts from the following provider to display fonts in a uniform manner: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data is also transferred to: Google LLC, USA

When you call up a page, your browser loads the required web fonts into your browser cache to display texts and fonts correctly and establishes a direct connection to the provider's servers. In this process, certain browser information, including your IP address, is transmitted to the provider.

The processing of personal data while establishing the connection with the provider of the fonts is only carried out if you have given us your express consent to do so in accordance with Art. 6 (1) point a GDPR. You can revoke your consent at any time with effect for the future by deactivating this service via the "cookie consent tool" provided on the website. If your browser does not support web fonts, a standard font will be used by your computer.

Further information on Google's privacy standards can be found here: https://business.safety.google/privacy/

13.7 Google reCAPTCHA

On this website, we use the CAPTCHA service of the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transmitted to: Google LLC, USA. For the visual design of the CAPTCHA window, the provider uses "Google Fonts", i.e., fonts loaded from the Internet by Google. No further information is processed except that mentioned above, which is already transmitted to Google via the functionality of reCAPTCHA.

The service checks whether an input is made by a natural person or abusively by machine and automated processing with the aim of blocking spam, DDoS attacks and similar automated malicious attacks. To ensure whether an action is performed by a human being and not by an automated bot, the provider collects the IP address of the end device used, the recognition data of the browser, the operating system type and the date and duration of the visit and transmits these data to the provider's servers to be evaluated. This may involve the use of cookies, i.e. small text files that are stored in the browser of the end device.

If the processing described above is carried out on the basis of cookies, these will only be set if you have given us your express consent to do so in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the ‘cookie consent tool’ provided on the website.

If the processing described above is carried out without the use of cookies, the legal basis is our legitimate interest in determining individual responsibility on the Internet and avoiding misuse and spam in accordance with Art. 6 para. 1 lit. f GDPR.

We have concluded an order processing contract with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorized disclosure to third parties.

13.8 Google Customer Reviews (formerly Google Certified Dealer Program)

We cooperate with Google LLC in the framework of the "Google Customer Reviews" program. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). The program offers us the opportunity to obtain customer reviews from users of our website. After making a purchase on our website, you will be asked whether you would like to participate in a Google e-mail survey. If you give your consent pursuant to Art. 6 (1) point a GDPR, we transmit your e-mail address to Google. You will receive an email from Google Customer Reviews asking you to rate the shopping experience on our site. The feedback you provide will then be combined with our other reviews and displayed in our Google Customer Reviews logo and Merchant Center dashboard and will also be used for Google seller reviews. When using Google Customer Reviews, personal data may also be transmitted to the servers of Google LLC. in the USA.

You can revoke your consent at any time by sending a message to the controller responsible for data processing or to Google.

For more information about Google's privacy practices with Google Customer Reviews, please visit https://support.google.com/merchants/?hl=en-GB#topic=7259123
For more information about Google Seller Ratings' privacy practices, visit this link: https://support.google.com/adwords/answer/2375474

Further information on Google's privacy standards can be found here: https://business.safety.google/privacy/

14) Tools and Miscellaneous

This website uses a so-called "cookie consent tool" to obtain effective user consent for cookies and cookie-based applications that require consent. The "cookie consent tool" is displayed to users in the form of an interactive user interface when they access the page, on which consent for certain cookies and/or cookie-based applications can be given by ticking the appropriate box.

Using the tool, all cookies/services requiring consent are only loaded if the respective user provides the corresponding consent by ticking the corresponding box. This ensures that such cookies are only set on the respective end device of the user if consent has been granted.

The tool sets technically necessary cookies to save your cookie preferences. Personal user data is generally not processed.
If, in individual cases, personal data (such as the IP address) is processed for the purpose of storing, assigning or logging cookie settings, this is done in accordance with Art. 6 (1) point f GDPR based on our legitimate interest in legally compliant, user-specific and user-friendly consent management for cookies and thus in a legally compliant design of our website.
Further legal basis for the processing is Art. 6 (1) point c GDPR. As the responsible party, we are subject to the legal obligation to make the use of technically unnecessary cookies dependent on the respective user consent.
Further information on the operator and the setting options of the cookie consent tool can be found directly in the corresponding user interface on our website.

15) Rights of the Data Subject

15.1 The applicable data protection law grants you the following comprehensive rights of data subjects (rights of information and intervention) vis-à-vis the data controller with regard to the processing of your personal data:

Right of access by the data subject pursuant to Art. 15 GDPR;
Right to rectification pursuant to Art. 16 GDPR;
Right to erasure (“right to be forgotten”) pursuant to Art. 17 GDPR;
Right to restriction of processing pursuant to Art. 18 GDPR;
Right to be informed pursuant to Art. 19 GDPR;
Right to data portability pursuant to Art. 20 GDPR;
Right to withdraw a given consent pursuant to Art. 7 (3) GDPR;
Right to lodge a complaint pursuant to Art. 77 GDPR.

15.2 RIGHT TO OBJECT

IF, WITHIN THE FRAMEWORK OF A CONSIDERATION OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR PREDOMINANT LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON THE GROUNDS THAT ARISE FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO FURTHER PROCESSING IF WE CAN PROVE COMPELLING REASONS WORTHY OF PROTECTION FOR PROCESSING WHICH OUTWEIGH YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES TO ASSERT, EXERCISE OR DEFEND LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA WHICH ARE USED FOR DIRECT MARKETING PURPOSES. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT ADVERTISING PURPOSES.

16) Duration of Storage of Personal Data

The duration of the storage of personal data is based on the respective legal basis, the purpose of processing and - if relevant – on the respective legal retention period (e.g. commercial and tax retention periods).

If personal data is processed on the basis of express consent pursuant to Art. 6 (1) point a GDPR, this data is stored until the data subject revokes his consent.

If there are legal storage periods for data that is processed within the framework of legal or similar obligations on the basis of Art. 6 (1) point b GDPR, this data will be routinely deleted after expiry of the storage periods if it is no longer necessary for the fulfillment of the contract or the initiation of the contract and/or if we no longer have a justified interest in further storage.

When processing personal data on the basis of Art. 6 (1) point f GDPR, this data is stored until the data subject exercises his right of objection in accordance with Art. 21 (1) GDPR, unless we can provide compelling grounds for processing worthy of protection which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.

If personal data is processed for the purpose of direct marketing based on Art. 6 (1) point f GDPR, this data is stored until the data subject exercises his right of objection pursuant to Art. 21 (2) GDPR.

Unless otherwise stated in the information contained in this declaration on specific processing situations, stored personal data will be deleted if it is no longer necessary for the purposes for which it was collected or otherwise processed.

Source version: 26.09.2026, 12:50:08

Based on IT-Recht Kanzlei source texts dated 26 September 2026. Editorial revision R2 and supplementary translations: Foliage Factory. This edited version has not been reissued or approved by IT-Recht Kanzlei.

White cat sitting next to green plants on a white surface with a white background.

Useful Links:

Shipping & Delivery

Order Tracking

Guarantee & Returns

Payment Methods & Security

Experience you can count on

More than 20,000 customers, rated 4.6 out of 5 stars.

Quality first

Plants are hand-selected and checked before shipping.

Reliable shipping

Safe packaging and tracked shipping from DE and NL.

Small business

Support a small, independent, women-led family business.

Row of various potted baby plants (starter plants) on a white background

Shop Baby Plants ➜

Our Customers

rate us with 4.6 out of 5 Stars

★★★★★

Die Pflanzen waren prima verpackt und ein heatpack war im Paket enthalten. Die Lieferzeit hat 2 bis 3 Tagen gedauert, was aus meiner Sicht wirklich gut ist. Alle drei Pflanzen haben die Lieferung gut überstanden. Ich habe mich auf Hoyas spezialisiert und habe schon die nächsten Pflanzen meiner Wunschliste auf der Website gefunden. Daher wird die nächste Bestellung nicht lange auf sich warten lassen.

Marion

★★★★★

The plants are carefully packaged and arrive in great conditions (I’m based in Spain) and they’re always there to help in any way they can with your purchase.I have and will always recommend Foliage Factory to every friend I can. I’m not only satisfied with their plants and prices, but their customer service is exceptional.

José

★★★★☆

Very healthy and well packed plant. Unfortunately there was one plant that ordered couldn’t be delivered as it was out of stock hence 1 star less.

Sam

★★★★☆

Die Sendung kam leider in keinem guten Zustand bei mir an, kann passieren. Habe mich darauf hin sofort an Foliage Factory gewandt und habe selten einen so guten, schnellen, freundlichen und kulanten Kundendienst erlebt.

Frauke

★★★★★

Everything arrived in good condition and very well packed - it wasn't easy with a fragile plant and a heavy bag of substrate. I recommend it!

Lia

★★★★★

Bester online-Pflanzenhandel den ich kenne (habe davor 4 andere ausprobiert). Eine teure Pflanze wurde beim Transport beschädigt und mir ersetzt. Der Kontakt dabei war auch sehr nett (danke Jan) und hat mir gut geholfen. Die anderen Pflanzen sind in einem sehr guten Zustand, keine Schädlinge, super Bewurzelung. Nur zu empfehlen! :)

C L

★★★★★

Super Service, Gute Auswahl, Preise sind fair. Eine Pflanze kam kaputt an, hab sofort Ersatz bekommen. Danke an den unkomplizierten (und blitzschnellen) Kundenservice!!

Sarah

★★★★★

Envoie très rapide (2 jours), plantes parfaitement emballées et super offres ! Je suis une habituelle j'ai passé 6 ou 7 commandes et je n'en peut être plus satisfaite du service client et de la qualité et variété des plantes offertes

Iris

★★★★★

The plants have arrived in perfect condition, the roots and the foliage so so healthy! I had problem with 1 plant out of 16 and they have responded to my email almost instantly and the issue was resolved straight away. I'm really impressed and satisfied, definitely getting more plants from them again!

Patricija

★★★★★

I received perfectly heathy and absolutely beautiful plants, even bigger than expected. The delivery within Europe was really fast. I think Foliage Factory has one of the best plant web shops in the internet. It‘s just great to get so much informations about the plants. I will definitely order again :)

Walkerova

Exclusive Offers

Limited discounts, extras, and bundle deals for subscribers.

Foliage Points

Get points with every order to redeem them for discounts.

Refer a Friend

Give your friends 10 € off and get 200 Foliage Points.

Newsletter Perk

Use your 10% code on plants when you're ready to order.