Data protection

Legal notice: Data protection

A. Information across all sales channels

1. Controller and content of this privacy policy

We, Brütsch/Rüegger Tools Ltd. (Heinrich Stutz-Strasse 20, 8902 Urdorf, Switzerland) are the operator of the ToolStore business premises (“business premises”) and the website www.brw.ch (hereinafter “website”) and, unless otherwise stated, are responsible for the data processing listed in this privacy policy.

Please take note of the following information so that you know what personal data we collect from you and for what purposes we use it. In terms of data protection, we are primarily guided by the legal requirements of Swiss data protection law, in particular the Federal Act on Data Protection (FADP), as well as the EU GDPR, the provisions of which may be applicable in individual cases.

Please note that the following information is reviewed and amended from time to time. We therefore recommend that you consult this privacy policy regularly. Furthermore, other companies are responsible or jointly responsible with us under data protection law for individual data processing operations listed below, so that in these cases the information provided by these providers is also authoritative.

2. Contact person for data protection

If you have any questions about data protection or wish to exercise your rights, please get in touch with our contact person for data protection by sending an e-mail to the following address: peter.maeder@brw.ch

You can reach our EU data protection representative at

Priolan GmbH
Stefan Keller
Lisa-Meitner-Str. 12
74074 Heilbronn
Heilbronn, Germany

Phone: +49 176 4581 54 35
E-mail: datenschutz@brw-tools.de

3. Your rights

If the legal requirements are met, you have the following rights as a data subject:

Right to information: You have the right to request access to your personal data stored by us at any time free of charge if we are processing it. This gives you the opportunity to check what personal data we process about you and that we use it in accordance with the applicable data protection regulations.

Right to rectification: You have the right to have inaccurate or incomplete personal data rectified and to be informed of the rectification. In this case, we will inform the recipients of the data concerned of the adjustments made, unless this is impossible or involves disproportionate effort.

Right to erasure: You have the right to have your personal data erased under certain circumstances. In individual cases, particularly in the case of statutory retention obligations, the right to erasure may be excluded. In this case, the data may be blocked instead of erased if the conditions are met.

Right to restriction of processing: You have the right to request that the processing of your personal data be restricted.

Right to data portability: You have the right to receive from us, free of charge, the personal data that you have provided to us in a readable format.

Right to object: You can object to data processing at any time, in particular for data processing in connection with direct advertising (e.g. advertising e-mails).

Right to withdraw consent: In principle, you have the right to withdraw your consent at any time. However, processing activities based on your consent in the past will not become unlawful as a result of your withdrawal.

To exercise these rights, please send us an email to the following address: peter.maeder@brw.ch

Right to lodge a complaint: You have the right to lodge a complaint with a competent supervisory authority, e.g. against the way in which your personal data is processed.

4. Data security

We use suitable technical and organizational security measures to protect your personal data stored by us against loss and unlawful processing, in particular unauthorized access by third parties. Our employees and the service companies commissioned by us are obliged by us to maintain confidentiality and to observe data protection. Furthermore, these persons are only granted access to personal data to the extent necessary to fulfill their tasks.

Our security measures are continuously adapted in line with technological developments. However, the transmission of information via the Internet and electronic means of communication always involves certain security risks and we cannot provide an absolute guarantee for the security of information transmitted in this way.

5. Contacting us

If you contact us via our contact addresses and channels (e.g. by e-mail, telephone or contact form), your personal data will be processed. The data that you have made available to us will be processed, e.g. the name of your company, your name, your function, your e-mail address or telephone number and your request. In addition, the time of receipt of the request is documented. Mandatory information is marked with an asterisk (*) in contact forms.

We process this data exclusively in order to implement your request (e.g. providing information about a product, support in contract processing such as returning products, incorporating your feedback into the improvement of our service, etc.). The legal basis for this data processing is our legitimate interest within the meaning of Art. 6 para. 1 lit. f EU GDPR in the implementation of your request or, if your request is aimed at the conclusion or execution of a contract, the necessity for the implementation of the necessary measures within the meaning of Art. 6 para. 1 lit. b EU GDPR.

6 Use of your data for marketing purposes

6.1 Central data storage and analysis in the CRM system

If a clear assignment to your person is possible, we will store and link the data described in this privacy policy, i.e. in particular your personal data, your contacts, your contract data and your surfing behavior on our websites in a central database. This serves the efficient management of customer data and allows us to respond to your concerns appropriately, and enables the efficient provision of the services you have requested and the processing of the associated contracts. The legal basis for this data processing is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in the efficient management of user data.

We evaluate this data in order to further develop our offers in line with your needs and to display and suggest the most relevant information and offers to you. We also use methods that predict potential, interests and future orders based on your website usage. The legal basis for this data processing is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in the implementation of marketing measures.

6.2 E-mail marketing and newsletter

If you register for our email newsletter (e.g. when opening or within your customer account), the following data will be collected. Mandatory information is marked with an asterisk (*) in the registration form:

E-mail address
Salutation
First name and surname

To avoid misuse and to ensure that the owner of an e-mail address has actually given their consent, we use the so-called double opt-in for registration. After sending the registration, you will receive an e-mail from us containing a confirmation link. To definitively register for the newsletter, you must click on this link. If you do not click on the confirmation link within the specified period, your data will be deleted and our newsletter will not be sent to this address.

By registering, you consent to the processing of this data in order to receive news from us about our company, our offers in the area of tools and related products and services. This may also include invitations to take part in competitions or to evaluate one of the aforementioned products and services. The collection of the salutation and name allows us to verify the assignment of the registration to a possibly already existing customer account and to personalize the content of the mails. The link to a customer account helps us to make the offers and content contained in the newsletter more relevant to you and better tailored to your potential needs.

We will continue to use your data to send you emails until you withdraw your consent. Revocation is possible at any time, in particular via the unsubscribe link in all our marketing emails.

Our marketing emails may contain a so-called web beacon or 1x1 pixel (tracking pixel) or similar technical aids. A web beacon is an invisible graphic that is linked to the user ID of the respective newsletter subscriber. For each marketing email sent, we receive information about which addresses have not yet received the email, to which addresses it was sent and which addresses failed to receive it. We also see which addresses have opened the email, for how long and which links they have clicked on. Finally, we also receive information about which addresses have unsubscribed. We use this data for statistical purposes and to optimize the advertising emails in terms of frequency, timing, structure and content of the emails. This enables us to better tailor the information and offers in our emails to the individual interests of the recipients.

The web beacon is deleted when you delete the email. To prevent the use of the web beacon in our marketing e-mails, please set the parameters of your e-mail program so that HTML is not displayed in messages, if this is not already the case by default. You can find information on how to configure this setting in the help sections of your email software, e.g. here for Microsoft Outlook.

By subscribing to the newsletter, you also consent to the statistical analysis of user behavior for the purpose of optimizing and adapting the newsletter. This consent constitutes our legal basis for the processing of data within the meaning of Art. 6 para. 1 lit. a EU GDPR.

We use the email marketing software Marketing Cloud from salesforce.com Germany GmbH (Erika-Mann-Str. 31, 80636 Munich, GERMANY) for marketing emails. Therefore, your data is stored in a database of salesforce.com Germany GmbH, whereby salesforce.com Germany GmbH can access your data if this is necessary for the provision of the software and for support in the use of the software. The legal basis for this processing is our legitimate interest within the meaning of Article 6(1)(f) GDPR in the use of third-party services.

7. Disclosure to third parties and access by third parties

Without the support of other companies, we would not be able to provide our services in the desired form. In order for us to be able to use the services of these companies, it is also necessary to pass on your personal data to a certain extent. Such disclosure takes place in particular if this is necessary to fulfill the contract you have requested, i.e. for example to the logistics or transport companies that deliver the requested products, or to a manufacturer who is to fulfill your warranty claim. The legal basis for these transfers is the necessity to fulfill the contract within the meaning of Art. 6 para. 1 lit. b EU GDPR.

Data is also passed on to selected service providers and only to the extent necessary for the provision of the service. Various third-party service providers are also already explicitly mentioned in this privacy policy, e.g. in the sections on marketing. These are, for example, IT service providers (such as providers of software solutions), advertising agencies and consulting firms. Our legitimate interest within the meaning of Art. 6 para. 1 lit. f EU GDPR in obtaining third-party services forms the legal basis for this data transfer.

In addition, your data may be passed on, in particular to authorities, legal advisors or debt collection agencies, if we are legally obliged to do so or if this is necessary to protect our rights, in particular to enforce claims arising from the relationship with you. Data may also be disclosed if another company intends to acquire our company or parts thereof and such disclosure is necessary to carry out a due diligence review or to complete the transaction. The legal basis for this data transfer is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in the protection of our rights and compliance with our obligations or the sale of our company.

8. Transfer of personal data abroad

We are also entitled to transfer your personal data to third parties abroad if this is necessary to carry out the data processing mentioned in this privacy policy (see in particular sections 12-15). It goes without saying that the statutory provisions on the disclosure of personal data to third parties will be complied with. If the country in question does not have an adequate level of data protection, we ensure through contractual arrangements that your data is adequately protected by these companies.

9. Retention periods

We only store personal data for as long as is necessary to carry out the processing described in this privacy policy within the scope of our legitimate interest. In the case of contractual data, storage is prescribed by statutory retention obligations. Requirements that oblige us to store data result from accounting and tax regulations. According to these regulations, business communication, concluded contracts and accounting documents must be stored for up to 10 years. If we no longer need this data to perform the services for you, the data will be blocked. This means that the data may then only be used if this is necessary to fulfill retention obligations or to defend and enforce our legal interests. The data will be deleted as soon as there is no longer an obligation to retain it and there is no longer a legitimate interest in retaining it.

B. Special information for our website

10. Log file data

When you visit our website, the servers of our hosting provider (CONTINUM AG, Bismarckallee 17, 79098 Freiburg, GERMANY) temporarily store every access in a log file. The following data is recorded without any action on your part and stored by us until it is automatically deleted

the IP address of the requesting computer,
the date and time of access
the name and URL of the retrieved file
the website from which the access was made, if applicable with the search term used,
the operating system of your computer and the browser you are using (incl. type, version and language setting),
Device type in the case of access by cell phone,
the city or region from which the access was made
the name of your Internet access provider.

This data is collected and processed for the purpose of enabling the use of our website (establishing a connection), ensuring system security and stability in the long term as well as for error and performance analysis and enabling us to optimize our website (see also section 13 for the last points).

In the event of an attack on the network infrastructure of the website or in the event of suspicion of other unauthorized or abusive website use, the IP address and the other data are evaluated for clarification and defense and, if necessary, used in the context of criminal proceedings for identification and for civil and criminal proceedings against the users concerned.

The purposes described above constitute our legitimate interest in data processing within the meaning of Art. 6 para. 1 lit. f EU GDPR.

Finally, when you visit our website, we use cookies as well as applications and tools that are based on the use of cookies. The data described here may also be processed in this context. You will find more detailed information on this in the following sections of this privacy policy, in particular section 11.

11. Cookies

Cookies are information files that your web browser stores on your computer's hard disk or memory when you visit our website. Cookies are assigned identification numbers through which your browser is identified and the information contained in the cookie can be read.

Among other things, cookies help to make your visit to our website easier, more pleasant and more useful. We use cookies for various purposes that are required for your desired use of the website, i.e. are “technically necessary”. For example, we use cookies to identify you as a registered user after you have logged in without you having to log in again each time you navigate through the various subpages. The provision of the shopping cart and order function is also based on the use of cookies. Cookies also perform other technical functions required for the operation of the website, such as load balancing, i.e. the distribution of the performance load of the site to different web servers in order to reduce the load on the servers. Cookies are also used for security purposes, for example to prevent the unauthorized posting of content. Finally, we also use cookies as part of the design and programming of our website, e.g. to enable the uploading of scripts or codes.

The legal basis for this data processing is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in providing a user-friendly and up-to-date website.

Most Internet browsers accept cookies automatically. However, when you access our website, we ask for your consent to the cookies we use that are not technically necessary, especially when using third-party cookies for marketing purposes. You can make the settings you require using the corresponding buttons in the cookie banner. Details on the services and data processing associated with the individual cookies can be found within the cookie banner and in the following sections of this privacy policy.

You may also be able to configure your browser so that no cookies are stored on your computer or so that a message always appears when you receive a new cookie. On the following pages you will find explanations of how you can configure the processing of cookies in selected browsers.

Deactivating cookies may mean that you cannot use all the functions of our website.

12. Google SiteSearch / Google Custom Search Engine

This website uses the Google SiteSearch/Google Custom Search Engine of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). This enables us to provide you with an efficient search function on our website.

When using our search fields, your browser may transmit the log file data listed in section 10 (incl. IP address) and the search term you have entered to Google if you have installed JavaScript in your browser. If you wish to prevent the transmission of data, you can deactivate JavaScript in your browser settings (usually in the “Data protection” menu). Please note that the search function and other functions of the website may be impaired in this case.

The legal basis for this data processing is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in the provision of an efficient website search function.

For further data processing by Google, please refer to Google's privacy policy: https://policies.google.com/privacy?hl=en-GB

13. Tracking and web analysis tools

13.1 General information on tracking

We use the web analysis services listed below for the purpose of designing and continuously optimizing our website to meet your needs. In this context, pseudonymized user profiles are created and cookies are used (please also refer to section 11). The information generated by the cookie about your use of this website is usually transferred to a server of the service provider together with the log file data listed in section 10, where it is stored and processed. This may also involve a transfer to servers abroad, e.g. in the USA (see section 8, in particular on the guarantees provided).

By processing the data, we receive the following information, among other things

Navigation path taken by a visitor on the site (incl. content viewed and products selected or purchased),
the time spent on the website or subpage
the subpage on which the website is exited,
the country, region or city from which access is made
end device (type, version, color depth, resolution, width and height of the browser window) and
Returning or new visitor.

13.2 Google Analytics

On our behalf, the provider will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for us and providing other services relating to website activity and internet usage for the purposes of market research and tailoring the design of this website to meet your needs. For these processing operations, we and the providers can be regarded as joint controllers under data protection law up to a certain extent.

The legal basis for this data processing with the following tools is your consent within the meaning of Art. 6 para. 1 lit. a EU GDPR. You can withdraw your consent or refuse processing at any time by rejecting or deactivating the relevant cookies in the settings of your web browser (see section 11) or by making use of the service-specific options described below.

For further processing of the data by the respective provider as the (sole) controller under data protection law, in particular any disclosure of this information to third parties such as authorities due to national legal regulations, please refer to the respective data protection information of the provider.

We use the web analysis service Google Analytics from Google Ireland Limited (Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland) or Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) (“Google”).

The data described about the use of the website may be transmitted to the servers of Google LLC. in the USA for the processing purposes explained (see section 13.1). The IP address is shortened by activating IP anonymization (“anonymizeIP”) on this website before transmission within the member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there.

Users can prevent Google from collecting the data generated by the cookie and relating to the use of the website by the user concerned (including the IP address) and from processing this data by Google by downloading and installing the browser plug-in at the following link: https://tools.google.com/dlpage/gaoptout?hl=en-GB

Further information on data protection at Google can be found here.

13.3 PIWIK Pro

Our website uses PIWIK Pro, a web analysis service provided by PIWIK PRO GmbH, Kurfürstendamm 21, 10719 Berlin, Germany (“PIWIK Pro”). PIWIK Pro uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site.

Data collected

The following data is collected and processed when you use PIWIK Pro

Your IP address (anonymized)
Date and time of your visit
Time spent on the individual pages
Pages and subpages accessed
Click behavior on the website
Country and city of origin of the access
Information about the device you are using (e.g. operating system, browser type and version)
Referrer URL (the previously visited page)

Purpose of the processing

We use the information collected by PIWIK Pro to analyze and regularly improve the use of our website. The statistics obtained enable us to improve our offer and make it more interesting for you as a user.

Legal basis for processing

The data is processed on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR and Art. 13 para. 1 FADP. You can withdraw your consent at any time by adjusting the cookie settings in your browser or by using the corresponding option on our website.

Data transmission and retention period

The data collected is stored on servers within the European Union and is not passed on to third parties. We only store your data for as long as is necessary to fulfill the above-mentioned purposes or as required by law.

Your rights

You have the right to receive information about your personal data stored by us at any time and to request that it be corrected, deleted or that its processing be restricted. In addition, you have the right to withdraw your consent to the processing of your personal data at any time.

If you have any questions about data protection in relation to the use of PIWIK Pro on our website, you can contact our data protection officer at any time: peter.maeder@brw.ch

14. Social media

14.1 Social media profiles

On our website, we have included links to our profiles in the social networks of the following providers

Meta Platforms Inc, 1601 S California Ave, Palo Alto, CA 94304, USA;
Instagram Inc. 1601 Willow Road, Menlo Park, CA 94025, USA;
Twitter Inc. with registered office at 1355 Market Street, Suite 900, San Francisco, CA 94103, USA;
Linkedin Unlimited Company, Wilton Place, Dublin 2, Ireland;
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland;
New Work SE, Am Strandkai 1, 20457 Hamburg, Germany.

If you click on the social network icons, you will be automatically redirected to our profile in the respective network. This establishes a direct connection between your browser and the server of the respective social network. As a result, the network receives the information that you have visited our website with your IP address and clicked on the link.

If you click on a link to a network while you are logged into your user account with the network in question, the content of our website can be linked to your profile so that the network can assign your visit to our website directly to your account. If you want to prevent this, you should log out before clicking on the relevant links. A connection between your access to our website and your user account takes place in any case if you log in to the respective network after clicking on the link. The respective provider is responsible under data protection law for the associated data processing. Please therefore refer to the information on the network's website.

The legal basis for any data processing attributed to us is our legitimate interest within the meaning of Art. 6 para. 1 lit. f EU GDPR in the use and advertising of our social media profiles.

15. Online advertising and targeting

15.1 In general

We use the services of various companies to provide you with interesting offers online. This involves analyzing your user behavior on our website and websites of other providers in order to subsequently display online advertising tailored to you.

Most of the technologies used to track your user behavior (“tracking”) and to display targeted advertising (“targeting”) work with cookies (see also section 11), with which your browser can be recognized via various websites. Depending on the service provider, it may also be possible for you to be recognized online even when using different end devices (e.g. laptop and smartphone). This may be the case, for example, if you have registered with a service that you use on several devices.

In addition to the data already mentioned, which is generated when websites are accessed (“log file data”, see section 10) and when cookies are used (section 11) and which may be passed on to the companies involved in the advertising networks, the following data in particular is used to select the advertising that is potentially most relevant to you:

Information about you that you have provided when registering or using a service of advertising partners (e.g. your gender, your age group);
User behavior (e.g. search queries, interactions with advertising, types of websites visited, products viewed and purchased, newsletters subscribed to).

15.2 Google Ads

We and our service providers use this data to recognize whether you belong to the target group we are addressing and take this into account when selecting advertisements. For example, after you have visited our site, you may be shown ads for the products you have consulted when you visit other sites (“re-targeting”). Depending on the scope of the data, a user profile may also be created, which is automatically evaluated, and the ads are selected according to the information stored in the profile, such as membership of certain demographic segments or potential interests or behaviors. Such ads may be presented to you on various channels, including our website or app (as part of on-site and in-app marketing) as well as ads placed via the online advertising networks we use, such as Google.

The data may then be analyzed for the purpose of billing the service provider and assessing the effectiveness of advertising measures in order to better understand the needs of our users and customers and improve future campaigns. This may also include information that the performance of an action (e.g. visiting certain sections of our websites or sending information) is attributable to a specific advertisement. We also receive aggregated reports from the service providers on advertising activities and information on how users interact with our website and our advertisements.

The legal basis for this data processing is your consent within the meaning of Art. 6 para. 1 lit. a EU GDPR. You can withdraw your consent at any time by rejecting or deactivating the relevant cookies in your web browser settings (see section 11). Further options for blocking advertising can also be found in the information provided by the respective service provider, e.g. Google.

This website uses the services of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”) for online advertising. Google uses cookies for this purpose, such as the DoubleClick cookie, which enable your browser to be recognized when you visit other websites. The information generated by the cookies about your visit to these websites (including your IP address) is transmitted to a Google server in the USA and stored there (please also refer to section 6). Further information on data protection at Google can be found here.

The legal basis for this data processing is your consent within the meaning of Art. 6 para. 1 lit. a EU GDPR. You can withdraw your consent at any time by rejecting or deactivating the relevant cookies in the settings of your web browser (see section 11). Further options for blocking advertising can be found here.

16. Registration for a customer account

If you open a customer account on our website, we collect the following data, whereby mandatory information is marked with an asterisk (*) in the corresponding form:

Personal details:

Salutation
Surname
First name
Billing or delivery address
Telephone or fax
Company, company address, customer number and tax number
Function and department

E-mail address
password

Further details:

Languages
Gender

We use the personal details to establish your identity and to check the requirements for registration. The e-mail address and password together serve as login data and thus ensure that the correct person is using the website under your details. We also require your e-mail address for verification and confirmation of the account opening and for future communication with you required for contract processing. In addition, this data is stored in the customer account for future contracts. For this purpose, we also enable you to store further details in the account (e.g. your preferred means of payment).

We also use the data to provide an overview of the products and services ordered (see sections 18 and 23 in particular) and an easy way to manage your personal data, to administer our website and the contractual relationships, i.e. to establish, structure the content of, process and amend the contracts concluded with you via your customer account.

We process the information on language and gender in order to display offer suggestions on the website that are best tailored to your profile or your personal needs, to statistically record and evaluate the selected offers and thus to optimize our suggestions and offers.

The legal basis for the processing of your data for the aforementioned purpose is your consent in accordance with Art. 6 para. 1 lit. a EU GDPR. You can withdraw your consent at any time by removing the data from your customer account or deleting your customer account or having it deleted by notifying us.

To avoid misuse, you must always treat your login data confidentially and should close the browser window when you have finished communicating with us, especially if you share the computer with others.

17. Ordering products

If you wish to order products or book services on the website, we require various data to process the contract. If you do not log in with your customer account (see section 17), we collect the following data - depending on the product or service - whereby mandatory information is marked with an asterisk (*) in the corresponding form:

Salutation
Surname
First name
Billing and delivery address
e-mail address
Company, company address and tax number
Telephone number

We use the data to establish your identity before concluding a contract. We also need your e-mail address to confirm your order and for future communication with you required for contract processing. We store your data together with the order details (e.g. time, order number, etc.), the data on the services ordered/booked (e.g. name, price and features of the product; “product data”), the data on payment (e.g. payment method selected, confirmation of payment and time; see also section 19) and the information on the payment method selected, confirmation of payment and time of payment. Furthermore, section 19) as well as information on the processing and fulfillment of the contract (e.g. return of products, use of service or warranty services, etc.) in our CRM database (see section 6.1) so that we can ensure correct order processing and contract fulfillment.

Insofar as this is necessary for the fulfillment of the contract, we will also pass on the required information to any third-party service providers (e.g. transport companies).

The legal basis for this data processing is the fulfillment of the contract with you in accordance with Art. 6 para. 1 lit. b EU GDPR.

The provision of data that is not marked as mandatory is voluntary. We process this data in order to tailor our offer to your personal needs in the best possible way, to facilitate the processing of contracts, to contact you via an alternative communication channel if necessary with a view to fulfilling the contract or for statistical recording and evaluation to optimize our offers. The legal basis for this data processing is your consent within the meaning of Art. 6 para. 1 lit. a EU GDPR. You can withdraw your consent at any time by notifying us.

18. Online payment processing

If you purchase paid services or products on our website, depending on the product or service and the desired payment method - in addition to the information mentioned in Section 18 - you may be required to provide further data, such as your credit card information or the login to your payment service provider. This information and the fact that you have purchased a service from us at the relevant amount and time will be forwarded to the respective payment service providers (e.g. providers of payment solutions, credit card issuers and credit card acquirers). Please always refer to the information provided by the respective company, in particular the privacy policy and general terms and conditions. The legal basis for this transfer is the fulfillment of a contract in accordance with Art. 6 para. 1 lit. b EU GDPR.

In order to avoid payment cases, the necessary data, in particular your personal data, may also be transmitted to a credit agency for the automated assessment of your creditworthiness. In this context, the credit agency can assign you a so-called score value. This is an estimate of the future risk of a payment default, e.g. based on a percentage. The value is calculated using mathematical-statistical procedures and by incorporating data from the credit agency from other sources. We reserve the right not to offer you the payment method “invoice” in accordance with the information received. The legal basis for this data processing is our legitimate interest pursuant to Art. 6 para. 1 lit. f. EU GDPR in the avoidance of payment defaults.

C. Special information for our business premises

19. video surveillance

In order to prevent misuse and to take action against unlawful behavior (in particular theft and damage to property), the entrance area and the publicly accessible areas of our business premises are monitored by cameras. The image data is only viewed if there is a suspicion of unlawful behavior. Otherwise, the images are automatically deleted after 72 hours.

For the provision of the video surveillance system, we use a service provider who may have access to the data if this is necessary for the provision of the system. If the suspicion of unlawful conduct is substantiated, the data may then be passed on to the extent necessary for the enforcement of claims or the filing of reports to consulting firms (in particular our law firm) and authorities.

The legal basis is our legitimate interest within the meaning of Art. 6 para. 1 lit. f. EU GDPR in the protection of our property and the protection and enforcement of our rights.

20. Opening a customer account

If you open a customer account in our business premises, we collect the following data, whereby the mandatory information in the corresponding form is marked with an asterisk (*):

Salutation
Surname
First name
Billing and delivery address
e-mail address
Telephone number or fax
Company, company address and tax number
Telephone number

We use the data to establish your identity and to check the requirements for opening the account. We collect your e-mail address and telephone number for future communication with you required for contract processing. In addition, this data and the data for the purchase of products and services (see section 18) is stored under a customer number in the customer account in order to provide you with an overview of your data at your request and to enable future linking with data from other channels. Your account and the stored data will also be linked to your online account (see section 17) if the personal details are identical.

The legal basis for processing your data for the aforementioned purpose is your consent in accordance with Art. 6 para. 1 lit. a EU GDPR. You can withdraw your consent at any time by asking us to delete the data.

21. Purchase or order of products in the store

As a rule, you can also purchase products in our store without providing your name, in which case the section on payment processing must be observed (see section 25). On request, you will receive a receipt in paper form, which you should keep and present after the purchase in order to make use of customer services (see section 26). However, you can also purchase products using your customer account. In this case, please also refer to the section on opening a customer account (see section 23).

When you purchase and/or order certain products, we need your name and various other data to process the contract. Depending on the product or service, we collect the following data, whereby mandatory information in forms is marked with an asterisk (*):

Salutation
Surname
First name
Billing and delivery address
e-mail address
Telephone number or fax
Company, company address and tax number
Telephone number

We use the data to establish your identity before concluding a contract. We also require your e-mail address for future communication with you that is necessary to process the contract. We store your data together with the order details (e.g. time, order number, etc.), the data on the services ordered/booked (e.g. name, price and features of the product; “product data”), the data on payment (e.g. payment method selected, confirmation of payment and time; see also section 19) and the information on the payment method used. Furthermore, section 19) as well as information on the processing and fulfillment of the contract (e.g. return of products, use of service or warranty services, etc.) in our CRM database (see section 6.1) so that we can ensure correct order processing and contract fulfillment.

Insofar as this is necessary for the fulfillment of the contract, we will also pass on the required information to any third-party service providers (e.g. transport companies).

The legal basis for this data processing is the fulfillment of the contract with you in accordance with Art. 6 para. 1 lit. b EU GDPR.

22. payment processing

If you purchase products in our store using electronic means of payment, the processing of personal data is required. By using the payment terminals, you transmit the information stored in your means of payment, such as the name of the cardholder and the card number, to the payment service providers involved (e.g. providers of payment solutions, credit card issuers and credit card acquirers). They also receive the information that the payment method was used in our restaurant, the amount and the time of the transaction. Conversely, we only receive the credit of the amount of the payment made at the relevant time, which we can assign to the relevant receipt number, or information that the transaction was not possible or was canceled. Please always refer to the information provided by the respective company, in particular the privacy policy and the general terms and conditions. The legal basis for this transmission is the fulfillment of the contract with you in accordance with Art. 6 para. 1 lit. b EU-GDPR.

23. Use of customer services in the business premises

In our business premises, you can make use of numerous customer services that may require the processing of personal data. This includes, for example, the collection of an ordered product, the return of products in the exercise of a right of return or a warranty claim, the complaint about a service, etc. In such cases, we collect the following data - depending on the product concerned or the service requested - whereby mandatory information in forms is marked with an asterisk (*):

Salutation
Surname
First name
Billing and delivery address
e-mail address
Telephone number or fax
Company, company address and tax number
Telephone number

We use this data to establish your identity. We also need your e-mail address for the communication with you required to provide the customer service. We store this data together with the details, time and content of the requested service in our CRM database (see section 6.1) so that we can guarantee the correct processing of the requested service. Insofar as this is necessary for the fulfillment of the contract, we will also pass on the required information to any third-party service providers (e.g. transport companies) or other third parties involved (e.g. manufacturers in the event of a claim under the manufacturer's warranty).

The legal basis for this data processing is our legitimate interest within the meaning of Art. 6 para. 1 lit. f EU GDPR in the implementation of your request or, if your request concerns the execution of a contract with you, the necessity of carrying out the necessary contractual measures within the meaning of Art. 6 para. 1 lit. b EU GDPR.

Status: May 17, 2024