Privacy policy

1) Introduction and contact details of the controller

1.1
We are pleased that you visit our website and thank you for your interest. In the following, we inform you about the handling of your personal data when using our website. Personal data is all data with which you can be personally identified.

1.2
The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is 4TFM E-Commerce Agentur GmbH, Wilhelm-Kuhr-Str. 5, 13187 Berlin, Germany, Tel.: +49 (0) 30 - 40 36 38 90, e-mail: info@4tfm.de. The controller for the processing of personal data is the natural or legal person who alone or jointly with others decides on the purposes and means of the processing of personal data.

2) Data collection when visiting our website

2.1
When using our website for purely informational purposes, i.e., if you do not register or otherwise transmit information to us, we only collect the data that your browser transmits to the server (so-called "server log files"). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

Our visited website
Date and time at the time of access
Amount of data sent in bytes
Source/reference from which you reached the site
Browser used
Operating system used
IP address used (if applicable, in anonymised form)

Processing is carried out in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to check the server log files subsequently if there are concrete indications of unlawful use.

2.2
For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string “https://” and the lock symbol in your browser bar.

3) Hosting & Content Delivery Network

3.1 Shopify
For hosting our website and displaying page content, we use the system of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”).

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.

All data collected on our website is processed on the provider’s servers. We have concluded a data processing agreement with the provider, which ensures the protection of the data of our site visitors and prohibits unauthorized disclosure to third parties.

For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

3.2 Cloudflare
We use a content delivery network from the following provider: Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA.

This service enables us to deliver large media files such as graphics, page content or scripts faster via a network of regionally distributed servers. Processing is carried out to safeguard our legitimate interest in improving the stability and functionality of our website in accordance with Art. 6 (1) (f) GDPR. We have concluded a data processing agreement with the provider, which ensures the protection of the data of our site visitors and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection based on an adequacy decision of the European Commission.

3.3 Shopify
We use a content delivery network of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”).

Data may also be transferred to:

Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada
Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA

For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

For data transfers to the USA, the data recipient has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection based on an adequacy decision of the European Commission.

4) Cookies

To make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e., small text files that are stored on your device. Some of these cookies are automatically deleted after closing the browser (so-called "session cookies"), some remain on your device for a longer period and enable the storage of site settings (so-called "persistent cookies"). In the latter case, you can find the storage duration in the overview of the cookie settings of your web browser.

Insofar as personal data is also processed through individual cookies used by us, processing is carried out in accordance with Art. 6 (1) (b) GDPR either for the performance of a contract, in accordance with Art. 6 (1) (a) GDPR in the case of consent granted, or in accordance with Art. 6 (1) (f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the site visit.

You can configure your browser so that you are informed about the setting of cookies and can decide individually about their acceptance or exclude the acceptance of cookies for certain cases or in general.

Please note that if cookies are not accepted, the functionality of our website may be restricted.

5) Contacting us

5.1 Judge.me
For review reminders, we use the services of the following provider: Judge.me Ltd., c/o Buckworths, 2nd Floor, 1-3 Worship Street, London, England, EC2A 2AB, United Kingdom.

Exclusively on the basis of your express consent in accordance with Art. 6 (1) (a) GDPR, we transmit your email address and, where applicable, further customer data to the provider so that they can contact you with a review reminder by email.

You can withdraw your consent at any time with effect for the future, either to us or to the provider.

We have concluded a data processing agreement with the provider, which ensures the protection of the data of our site visitors and prohibits unauthorized disclosure to third parties.

For data transfers to the provider location, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

5.2 Freshdesk
To process customer inquiries, we use the email ticketing system of the following provider: Freshworks, Inc., 2950 S. Delaware Street, Suite 201, San Mateo, California 94403, USA.

If you send contact requests to us via our website by email, these will be stored and organised in the ticket system in order to enable chronological processing and improve the service experience. You can always view the current status of the processing of your request using the individually assigned ticket number.

For the organization and processing of inquiries, personal data is collected according to the scope of your submission, but at least name, first name and email address, transmitted to the provider, stored there and read out.

The legal basis for processing this data is our legitimate interest in the efficient design of our customer service, in the fastest possible response to your request and in the optimization of our service offering in accordance with Art. 6 (1) (f) GDPR.

We have concluded a data processing agreement with the provider, which ensures the protection of the data of our site visitors and prohibits unauthorized disclosure to third parties.

5.3
When contacting us (e.g., via contact form or email), personal data is processed solely for the purpose of processing and replying to your request and only to the extent necessary for this purpose.

The legal basis for processing this data is our legitimate interest in responding to your request in accordance with Art. 6 (1) (f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 (1) (b) GDPR. Your data will be deleted when it can be inferred from the circumstances that the matter concerned has been conclusively clarified, unless statutory retention obligations prevent deletion.

6) Data processing when opening a customer account

In accordance with Art. 6 (1) (b) GDPR, personal data will continue to be collected and processed to the extent necessary when you provide it to us when opening a customer account. Which data is required for opening the account can be found in the input form on our website.

Deletion of your customer account is possible at any time and can be done by sending a message to the above-mentioned address of the controller. After deleting your customer account, your data will be deleted as long as all contracts concluded via it have been fully processed, there are no statutory retention obligations preventing deletion, and we have no legitimate interest in further storage.

7) Use of customer data for direct advertising

7.1 Registration for our email newsletter
If you register for our email newsletter, we will send you regular information about our offers. The only mandatory information for sending the newsletter is your email address. The provision of further data is voluntary and is used to address you personally. For sending the newsletter, we use the so-called double opt-in procedure to ensure that you only receive newsletters when you have expressly confirmed your consent to receive newsletters by activating a verification link sent to the specified email address.

By activating the confirmation link, you grant us your consent for the use of your personal data in accordance with Art. 6 (1) (a) GDPR. In doing so, we store your IP address entered by the Internet Service Provider (ISP) as well as the date and time of registration in order to be able to trace any possible misuse of your email address at a later date. The data collected by us during registration for the newsletter will be used strictly for the intended purpose.

You can unsubscribe from the newsletter at any time via the corresponding link in the newsletter or by sending a message to the controller mentioned at the beginning. After successful unsubscription, your email address will be deleted immediately from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve a use of data beyond that which is legally permitted and which we inform you about in this declaration.

7.2 Sending the email newsletter to existing customers
If you have provided us with your email address when purchasing goods or services, we reserve the right to regularly send you offers for similar goods or services from our range by email. For this, we do not need to obtain separate consent from you according to § 7 (3) UWG. Data processing is carried out solely on the basis of our legitimate interest in personalised direct advertising in accordance with Art. 6 (1) (f) GDPR. If you initially objected to the use of your email address for this purpose, no email will be sent from our side.

You are entitled to object to the use of your email address for the above-mentioned advertising purpose at any time with effect for the future by notifying the controller mentioned at the beginning. You will only incur transmission costs according to the basic tariffs. After receiving your objection, the use of your email address for advertising purposes will be stopped immediately.

7.3 Brevo
The dispatch of our email newsletters takes place via the following provider: Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany.

Based on our legitimate interest in effective and user-friendly newsletter marketing, we forward the data you provided during newsletter registration to this provider in accordance with Art. 6 (1) (f) GDPR so that they can handle the newsletter dispatch on our behalf.

Subject to your express consent according to Art. 6 (1) (a) GDPR, the provider also carries out statistical success analysis of newsletter campaigns using web beacons or tracking pixels in the sent emails, which can measure opening rates and specific interactions with newsletter content. Device information (e.g., time of access, IP address, browser type and operating system) is also collected and evaluated but not merged with other data sets.
You can revoke your consent to newsletter tracking at any time with effect for the future.

We have concluded a data processing agreement with the provider, which protects the data of our site visitors and prohibits disclosure to third parties.

7.4 Cart reminders by email
If you abandon your purchase with us before completing the order, you have the option of being reminded once by email of the contents of your virtual shopping cart.

The only mandatory information for sending this reminder is your email address. Additional data is voluntary and may be used to address you personally. For sending the email, we use the double opt-in procedure to ensure that you only receive a notification after expressly confirming your consent via a verification link sent to the specified email address.

By activating the confirmation link, you grant us your consent to use your personal data in accordance with Art. 6 (1) (a) GDPR for sending a shopping cart reminder. In doing so, we store your IP address entered by the ISP as well as the date and time of registration to trace possible misuse of your email address at a later date. The data collected during registration for our email notification service is used strictly for the intended purpose.

You can unsubscribe from the cart reminders at any time by sending a message to the controller mentioned at the beginning. After successful unsubscription, your email address will be deleted immediately from our dedicated distribution list unless you have expressly consented to further use of your data or we reserve a use of data beyond that which is legally permitted and which we inform you about in this declaration.

8) Data processing for order fulfilment

8.1
Insofar as necessary for contract processing for delivery and payment purposes, the personal data collected by us is forwarded to the commissioned transport company and the commissioned credit institution in accordance with Art. 6 (1) (b) GDPR.

If, on the basis of a corresponding contract, we owe you updates for goods with digital elements or for digital products, we process the contact data you provided when placing the order in order to inform you personally within the scope of our legal information obligations in accordance with Art. 6 (1) (c) GDPR. Your contact data is used strictly for notifications about updates owed by us and processed only to the extent necessary for the respective information.

To process your order, we also work with the following service provider(s), who support us in whole or in part in the execution of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

8.2 Use of payment service providers (payment services)

Apple Pay
If you choose the payment method “Apple Pay” from Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment is processed via the “Apple Pay” function on your device running iOS, watchOS or macOS by charging a payment card stored in “Apple Pay”. Apple Pay uses security functions embedded in the hardware and software of your device to protect your transactions. To approve a payment, you must enter a pre-set code and verify via “Face ID” or “Touch ID”.

For payment processing, your information provided during the order process along with information about your order is transmitted to Apple in encrypted form. Apple then encrypts this data again with a developer-specific key before transmitting it to the payment service provider of the payment card stored in Apple Pay. The encryption ensures that only the website through which the purchase was made can access the payment data. After the payment is made, Apple sends your device account number and a transaction-specific dynamic security code to the origin website to confirm the success.

Where personal data is processed in the course of these transfers, such processing takes place exclusively for payment processing in accordance with Art. 6 (1) (b) GDPR.

Apple stores anonymised transaction data such as the approximate purchase amount, date and time as well as an indication of whether the transaction was completed successfully. Due to anonymisation, personal reference is excluded. Apple uses anonymised data to improve “Apple Pay” and other Apple products and services.

If you use Apple Pay on your iPhone or Apple Watch to complete a purchase made via Safari on your Mac, the Mac and the authorisation device communicate over an encrypted channel on Apple’s servers. Apple does not process or store any information in a format that can identify you. You can disable the option to use Apple Pay on your Mac in the settings on your iPhone under “Wallet & Apple Pay” and disable “Allow payments on Mac”.

Further information on privacy with Apple Pay can be found here: https://support.apple.com/en-us/HT203027

Klarna
One or more online payment methods from the following provider are available on this website: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden.

If you select a payment method from the provider where you make advance payment (e.g., credit card payment), your payment data provided during the order process (including name, address, bank and card information, currency and transaction number) and information about your order will be forwarded to the provider in accordance with Art. 6 (1) (b) GDPR. Transfer happens exclusively for payment processing and only as far as necessary.

If you select a payment method for which the provider makes advance payment (e.g., invoice purchase, instalment purchase, direct debit), you will be required to provide personal data (first and last name, street, house number, postal code, city, date of birth, email address, telephone number, and possibly data for an alternative payment method).

To safeguard our legitimate interest in assessing the payment ability of our customers, this data is transmitted to the provider for a credit check in accordance with Art. 6 (1) (f) GDPR. The provider checks, based on your provided personal data and other data (such as shopping cart, invoice amount, order history, payment experience), whether the selected payment method can be granted considering risks of payment or debt default.

For decision-making, the provider may include identity and credit information from the following agencie https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The credit report may contain probability values (so-called score values). These are calculated using a scientifically recognised mathematical-statistical procedure. Among other factors, address data is included in the calculation.

You can object to this data processing at any time by notifying us or the provider. However, the provider may still be entitled to process your personal data if this is required for contractual payment processing.

PayPal
One or more online payment methods from the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

If you select a payment method where you make advance payment, your payment data and order information are transferred to the provider in accordance with Art. 6 (1) (b) GDPR.

If you select a payment method where the provider makes advance payment, you will be required to provide additional personal data for a credit check. Processing follows Art. 6 (1) (f) GDPR. Score values may be included.

You can object to processing anytime, but processing may remain necessary for contractual purposes.

Shopify Payments
This website offers payment methods from: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

If you choose a payment method involving advance payment, your payment data and order details are forwarded to the provider in accordance with Art. 6 (1) (b) GDPR.

9) Web analytics services

9.1 Google Analytics 4
This website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), which enables analysis of your use of our website.

Cookies may be set. The collected data includes your IP address, which is shortened by Google to prevent personal identification.

Data may also be transmitted to Google LLC in the USA. Google uses the data to analyse usage, compile reports, and provide related services. The shortened IP address is not merged with other Google data. Data retention: 2 months.

All processing occurs only with your explicit consent under Art. 6 (1) (a) GDPR. Without your consent, Google Analytics 4 is not used. Consent can be withdrawn at any time by deactivating the service via the cookie consent tool.

A data processing agreement has been concluded with Google.
More legal information:

https://business.safety.google/privacy/
https://policies.google.com/privacy
https://policies.google.com/technologies/partner-sites

Demographic features
Google Analytics 4 uses “demographic features” to create statistics about age, gender and interests. These data cannot be assigned to individuals and are deleted after two months.

Google Signals
If enabled, Google Signals analyses cross-device behaviour for users logged into a Google account with personalised ads activated. Processing only with consent (Art. 6 (1) (a) GDPR). You can disable personalised ads in your Google account.
More information: https://support.google.com/analytics/answer/7532985

UserIDs
If enabled and you have a website account, activities across devices can be analysed.
Google participates in the EU-US Data Privacy Framework.

9.2 Shopify Analytics
This website uses the analytics service from Shopify International Limited. Data may also be transferred to Shopify Inc. in Canada.

Using cookies and similar technologies, pseudonymised visitor data is collected and analysed (e.g., IP, browser info, heatmaps, interaction data). No merging with personal data occurs.

Processing only with your explicit consent under Art. 6 (1) (a) GDPR.

A DPA is in place.
Transfers to Canada are based on an adequacy decision.

10) Retargeting / Remarketing and Conversion Tracking

Meta Pixel with Advanced Matching
We use Meta Pixel from Meta Platforms Ireland Limited in extended matching mode.

If a user clicks on an ad placed by us on Facebook or Instagram, a parameter is added to the URL. After redirection, this parameter is stored in a cookie on our page, which can collect customer data such as email addresses during purchase or registration processes. The cookie is read and data is transmitted to Meta.

We use this to optimise ads (custom audiences) and to analyse conversions.

Meta stores and processes the data, linking it with user profiles.
Processing takes place only with consent under Art. 6 (1) (a) GDPR.
Meta participates in the EU-US Data Privacy Framework.

11) Site functionalities

11.1 Judge.me
Graphic elements for external reviews or trust badges from Judge.me Ltd. may be embedded. When loading such elements, certain browser data including IP address is transmitted.

Processing according to Art. 6 (1) (f) GDPR.
A DPA is in place.
Adequacy decision applies.

11.2 hCaptcha
This site uses hCaptcha from Intuition Machines, Inc., USA, to distinguish humans from bots. IP, browser and system data, date and duration of visit may be transmitted.

Legal basis: Art. 6 (1) (f) GDPR.
Transfers use standard contractual clauses.
A DPA is in place.

11.3 n8n
This site uses n8n GmbH, Berlin, to integrate and synchronize data applications. Internal workflows are automated.

Processing under Art. 6 (1) (f) GDPR.
A DPA is in place.

12) Tools and miscellaneous

12.1 sevDesk
We use the cloud accounting service of sevDesk GmbH, Offenburg, Germany. Incoming and outgoing invoices and possibly bank transactions are processed.
Legal basis: Art. 6 (1) (f) GDPR.

12.2 Cookie consent tool
A cookie consent tool is used to obtain valid user consent for cookies. Technically necessary cookies are set to store preferences.

If personal data is processed, it is based on Art. 6 (1) (f) GDPR and additionally Art. 6 (1) (c) GDPR.
A DPA is in place.

12.3 Judge.me (Review verification)
When submitting a review, first and last name, email, order date and number, product name and global identifiers (GTIN/ISDNF) are collected and transmitted to Judge.me for authenticity checks.
Processing under Art. 6 (1) (f) GDPR.
Data is deleted after review verification.

13) Rights of the data subject

13.1
You have the following rights under GDPR:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to notification (Art. 19 GDPR)
Right to data portability (Art. 20 GDPR)
Right to withdraw consent (Art. 7 (3) GDPR)
Right to lodge a complaint (Art. 77 GDPR)

13.2 Right to object

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR IF PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH ADVERTISING PURPOSES. YOU CAN EXERCISE THE RIGHT TO OBJECT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

14) Duration of storage of personal data

The duration of the storage of personal data depends on the respective legal basis, the processing purpose and, where applicable, statutory retention periods.

For data processed based on explicit consent under Art. 6 (1) (a) GDPR, the data is stored until you withdraw consent.

If statutory retention periods apply to data processed under Art. 6 (1) (b) GDPR, the data will be routinely deleted after expiry of the retention periods, provided the data is no longer required for contract fulfilment or initiation and/or no legitimate interest in continued storage exists.

For data processed under Art. 6 (1) (f) GDPR, the data will be stored until you exercise your right to object unless overriding legitimate grounds exist or processing serves legal claims.

For data processed for direct marketing under Art. 6 (1) (f) GDPR, the data is stored until you exercise your right to object.

Unless otherwise stated in this declaration, personal data is deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.