Privacy policy

Privacy Policy

1) Introduction and Controller Contact Details

1.1 We are pleased that you are visiting our website and thank you for your interest. Below we inform you about how we handle your personal data when you use our website. Personal data means all data by which you can be personally identified.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Linuma GmbH, Dorfstraße 11, 87616 Marktoberdorf, Germany, Tel.: 015167852776, Email: finance@linuma.de. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2) Data Collection When Visiting Our Website

2.1 When you use our website for information purposes only, i.e. if you do not register or otherwise transmit information to us, we only collect the data that your browser transmits to the server (so-called “server log files”). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

  • The pages of our website visited

  • Date and time of access

  • Amount of data sent in bytes

  • Source/referrer from which you reached the site

  • Browser used

  • Operating system used

  • IP address used (where applicable, in anonymized form)

Processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is neither disclosed to third parties nor used in any other way. However, we reserve the right to check the server log files retrospectively if there are concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the character string “https://” and the lock symbol in your browser’s address bar.

3) Hosting & Content Delivery Network

3.1 Shopify
We use the system of the following provider for hosting our website and displaying the site content: Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”).

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.

All data collected on our website is processed on the provider’s servers. We have concluded a data processing agreement with the provider, which ensures the protection of our site visitors’ data and prohibits unauthorized disclosure to third parties.

For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

3.2 Cloudflare
We use a content delivery network (CDN) provided by: Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA.

This service enables us to deliver large media files such as graphics, page content, or scripts faster via a network of regionally distributed servers. Processing is carried out to safeguard our legitimate interests in improving the stability and functionality of our website pursuant to Art. 6(1)(f) GDPR. We have concluded a data processing agreement with the provider, which ensures the protection of our site visitors’ data and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

4) Cookies

To make your visit to our website attractive and to enable the use of certain functions, we use cookies—small text files stored on your end device. Some cookies are deleted automatically after closing the browser (so-called “session cookies”), while others remain on your device for a longer period and enable the storage of page settings (so-called “persistent cookies”). In the latter case, you can find the storage duration in the overview in your browser’s cookie settings.

Where personal data is processed by individual cookies used by us, processing is carried out pursuant to Art. 6(1)(b) GDPR for the performance of a contract, pursuant to Art. 6(1)(a) GDPR if consent has been given, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly, effective design of the site visit.

You can set your browser to inform you about the use of cookies and decide individually on their acceptance, or to exclude the acceptance of cookies for certain cases or in general.

Please note that if cookies are not accepted, the functionality of our website may be limited.

5) Contacting Us

When you contact us (e.g. via contact form or email), personal data is processed solely for the purpose of handling and responding to your inquiry and only to the extent necessary for this.

The legal basis for processing these data is our legitimate interest in responding to your inquiry pursuant to Art. 6(1)(f) GDPR. If your contact aims at concluding a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted once it can be inferred from the circumstances that the matter in question has been conclusively clarified, provided that no statutory retention obligations apply.

6) Use of Customer Data for Direct Advertising

6.1 Subscribing to our Email Newsletter
If you subscribe to our newsletter, we will regularly send you information about our offers. The only mandatory information for sending the newsletter is your email address. Any additional data is voluntary and serves to address you personally. We use the double opt-in procedure to ensure that you only receive the newsletter once you have explicitly confirmed your consent via a verification link sent to the email address provided.

By activating the confirmation link, you give us your consent to use your personal data pursuant to Art. 6(1)(a) GDPR. We store your IP address as registered by your Internet Service Provider (ISP), as well as the date and time of registration, to trace possible misuse of your email address at a later point. The data collected by us upon newsletter registration is used strictly for the stated purpose.

You can unsubscribe at any time via the link provided in the newsletter or by contacting the controller named above. After unsubscribing, your email address will be promptly deleted from our mailing list unless you have explicitly consented to further use of your data or we reserve the right to use data beyond this which is permitted by law and about which we inform you in this policy.

6.2 Newsletter to Existing Customers
If you have provided us with your email address when purchasing goods or services, we reserve the right to regularly send you offers for similar goods or services from our range by email. For this we do not need to obtain separate consent from you pursuant to Section 7(3) of the German Unfair Competition Act (UWG). Data processing is carried out solely on the basis of our legitimate interest in personalized direct advertising pursuant to Art. 6(1)(f) GDPR. If you initially objected to the use of your email address for this purpose, we will not send emails.

You are entitled to object to the use of your email address for the above advertising purpose at any time with effect for the future by notifying the controller named at the beginning. You will only incur transmission costs at basic rates. Upon receipt of your objection, the use of your email address for advertising purposes will be stopped without delay.

7) Data Processing for Order Handling

7.1 To the extent necessary for contract performance for delivery and payment purposes, personal data collected by us pursuant to Art. 6(1)(b) GDPR will be transmitted to the commissioned transport company and the commissioned credit institution.

If, under a corresponding contract, we owe you updates for goods with digital elements or for digital products, we will process the contact details (name, address, email) you provided during the order to inform you personally, within the statutory periods, about upcoming updates via an appropriate means of communication (e.g. by post or email) in accordance with our legal information obligations pursuant to Art. 6(1)(c) GDPR. Your contact details will be used strictly for notifications about updates owed by us and will only be processed to the extent necessary for the particular notification.

For processing your order, we also work with the following service provider(s) who support us in whole or in part in performing concluded contracts. Certain personal data will be transmitted to these service providers as described below.

7.2 Transmission of Personal Data to Shipping Providers

  • Deutsche Post
    Provider: Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany

We will transmit your email address and/or telephone number to the provider prior to the delivery of the goods for the purpose of coordinating a delivery date or for delivery notification pursuant to Art. 6(1)(a) GDPR, provided that you have expressly consented to this during the ordering process. Otherwise, we will only transmit the name of the recipient and the delivery address to the provider for delivery pursuant to Art. 6(1)(b) GDPR. The data will only be transmitted to the extent necessary for the delivery of the goods. In this case, prior coordination of the delivery date with the provider or delivery notification is not possible.

Consent can be revoked at any time with effect for the future by contacting the controller named above or the provider.

  • DHL
    Provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany

(Transmission conditions identical to Deutsche Post as described above.)

  • DHL Express
    Provider: DHL Express Germany GmbH, Heinrich-Brüning-Str. 5, 53113 Bonn, Germany

(Transmission conditions identical to Deutsche Post as described above.)

7.3 Use of Payment Service Providers (Payment Services)

  • Apple Pay
    If you choose the “Apple Pay” payment method from Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment is processed via the “Apple Pay” function of your device running iOS, watchOS or macOS by charging a payment card stored in “Apple Pay”. Apple Pay uses security features built into your device’s hardware and software to protect your transactions. To authorize a payment, you must enter a code you set beforehand and verify via “Face ID” or “Touch ID”.

For payment processing, the information you provided during the order process along with your order information is transmitted to Apple in encrypted form. Apple then re-encrypts this data with a developer-specific key before transmitting it to the payment service provider of the payment card stored in Apple Pay. This encryption ensures that only the website on which the purchase was made can access the payment data. After the payment has been made, Apple sends your device account number and a transaction-specific dynamic security code to the originating website to confirm the success of the payment.

If personal data is processed in the transmissions described, processing is carried out solely for the purpose of payment processing pursuant to Art. 6(1)(b) GDPR.

Apple stores anonymized transaction data (approximate purchase amount, approximate date and time, and whether the transaction was successfully completed). Due to anonymization, a personal reference is completely excluded. Apple uses anonymized data to improve Apple Pay and other Apple products and services.

If you use Apple Pay on your iPhone or Apple Watch to complete a purchase made via Safari on your Mac, your Mac and the authorizing device communicate over an encrypted channel via Apple’s servers. Apple does not process or store this information in a form that can identify you. You can disable the option to use Apple Pay on your Mac in your iPhone settings under “Wallet & Apple Pay” by deactivating “Allow Payments on Mac”.

Further privacy information for Apple Pay: https://support.apple.com/de-de/HT203027

  • Google Pay
    If you choose the “Google Pay” payment method from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), payment is processed via the Google Pay app on your Android device (min. Android 4.4 “KitKat”) with NFC, by charging a payment card stored in Google Pay or a verified payment system there (e.g. PayPal). To authorize a Google Pay payment over €25, you must first unlock your device via the configured verification method (e.g. face recognition, password, fingerprint, or pattern).

For payment processing, the information you provided during the order process along with your order information is transmitted to Google. Google then transmits your payment information stored in Google Pay to the originating website in the form of a one-time transaction number used to verify the payment. This number contains no actual payment data of the stored means of payment but is created and transmitted as a one-time valid token. In all Google Pay transactions, Google acts only as an intermediary. The transaction is carried out solely between you and the originating website by charging the means of payment stored in Google Pay.

If personal data is processed in the transmissions described, processing is carried out solely for the purpose of payment processing pursuant to Art. 6(1)(b) GDPR.

Google may collect, store, and evaluate certain transaction-specific information for each Google Pay transaction (date, time, amount, merchant location and description, merchant-provided description of goods/services, photos attached by you, names and email addresses of seller and buyer or sender and recipient, payment method used, your description of the reason for the transaction, and any associated offer).

According to Google, this processing is carried out solely pursuant to Art. 6(1)(f) GDPR on the basis of its legitimate interest in proper accounting, verification of transaction data, and optimization and maintenance of the Google Pay service.

Google may also combine processed transaction data with other information collected and stored when you use other Google services.

Google Pay Terms of Service:
https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=de

Google Pay Privacy Notice:
https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de

  • Klarna
    One or more online payment methods from: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden, are available on this website.

If you select a payment method where you pay in advance (e.g. credit card), the payment data you provided during the order process (including name, address, bank and card information, currency, and transaction number) and information about your order will be transmitted to the provider pursuant to Art. 6(1)(b) GDPR—only to the extent necessary for payment processing.

If you select a payment method where the provider pays in advance (e.g. invoice or installment purchase or direct debit), you will be asked during checkout to provide certain personal data (first and last name, street, house number, postcode, city, date of birth, email address, telephone number, and where applicable details of an alternative payment method).

To protect our legitimate interest in assessing the creditworthiness of our customers, we will transmit this data to the provider for the purpose of a credit check pursuant to Art. 6(1)(f) GDPR. The provider checks, based on the personal data you provided and other data (e.g. basket, invoice amount, order history, payment experiences), whether the selected payment option can be granted with regard to payment and/or default risk.

For the decision as part of the application check, identity and credit information from the following agencies may be included pursuant to Art. 6(1)(f) GDPR:
https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The credit report may contain probability values (so-called score values). Where score values are included in the result, they are based on a scientifically recognized mathematical-statistical procedure. The calculation includes, among other things (but not exclusively), address data.

You can object to this processing of your data at any time by notifying us or the provider. However, the provider may still be entitled to process your personal data if this is necessary for contractual payment processing.

  • PayPal
    One or more online payment methods from: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, are available on this website.

If you select a payment method where you pay in advance, the payment data you provided during the order process (including name, address, bank and card information, currency, transaction number) and information about your order will be transmitted to the provider pursuant to Art. 6(1)(b) GDPR, only to the extent necessary for payment processing.

If you select a payment method where we pay in advance, you will be asked during checkout to provide certain personal data (first and last name, street, house number, postcode, city, date of birth, email address, telephone number, and where applicable details of an alternative payment method).

To safeguard our legitimate interest in assessing your creditworthiness, we will transmit this data to the provider pursuant to Art. 6(1)(f) GDPR for a credit check. The provider checks, based on the personal data you provided and other data (e.g. basket, invoice amount, order history, payment experiences), whether the selected payment option can be granted with regard to payment/default risk.

The credit report may contain probability values (score values) based on a recognized mathematical-statistical procedure, which may include address data. You can object at any time by notifying the provider. However, the provider may still process your personal data if required for contractual payment processing.

  • PayPal Checkout
    This website uses PayPal Checkout, an online payment system from PayPal that consists of PayPal’s own payment methods and local third-party methods.

When paying via PayPal, credit card via PayPal, direct debit via PayPal or—if offered—“Pay Later” via PayPal, we transmit your payment data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, for payment processing pursuant to Art. 6(1)(b) GDPR and only to the extent necessary.

For credit card via PayPal, direct debit via PayPal or—if offered—“Pay Later”, PayPal may carry out a credit check. For this purpose, your payment data may be transmitted to credit agencies pursuant to Art. 6(1)(f) GDPR on the basis of PayPal’s legitimate interest in assessing your creditworthiness. The result (statistical probability of default) is used to decide on the provision of the respective payment method. You may object to this processing at any time by notifying PayPal. However, PayPal may still process your personal data if required for contractual payment processing.

If the “invoice purchase” option via PayPal is available and chosen, your payment data will first be transmitted to PayPal and then to Ratepay GmbH, Franklinstraße 28–29, 10587 Berlin (“Ratepay”) for execution. Legal basis in each case: Art. 6(1)(b) GDPR. Ratepay will carry out its own identity and credit check and may transmit your data to credit agencies pursuant to Art. 6(1)(f) GDPR. A list of agencies used by Ratepay: https://www.ratepay.com/legal-payment-creditagencies/

For local third-party methods, your payment data is first transmitted to PayPal pursuant to Art. 6(1)(b) GDPR. Depending on your selection, PayPal then transmits your data to the respective provider pursuant to Art. 6(1)(b) GDPR:
Apple Pay (Apple Distribution International, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)
iDEAL (Currence Holding BV, Beethovenstraat 300, Amsterdam, Netherlands)
Bancontact (Bancontact Payconiq Company, Rue d'Arlon 82, 1040 Brussels, Belgium)
blik (Polski Standard Płatności sp. z o.o., ul. Czerniakowska 87A, 00-718 Warsaw, Poland)
eps (PSA Payment Services Austria GmbH, Handelskai 92, Gate 2, 1200 Vienna, Austria)
MyBank (PRETA S.A.S, 40 Rue de Courcelles, F-75008 Paris, France)
Przelewy24 (PayPro SA, Kanclerska 15A, 60-326 Poznań, Poland)

Further privacy information from PayPal: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

  • Shopify Payments
    One or more online payment methods from: Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland, are available on this website.

If you select a payment method where you pay in advance (e.g. credit card), the payment data you provided during the order process (including name, address, bank and card information, currency, transaction number) and information about your order will be transmitted to the provider pursuant to Art. 6(1)(b) GDPR—only to the extent necessary for payment processing.

8) Web Analytics Services

Shopify Analytics
Provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland
Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada

Using cookies and/or comparable technologies (tracking pixels, web beacons, algorithms for reading device and browser information), the service collects and stores pseudonymized visitor data, including information about the device used such as the IP address and browser information, in order to evaluate it for statistical analyses of usage behavior on our website and to create pseudonymized user profiles. This includes the evaluation of movement patterns (so-called heatmaps), the duration of visits, and interactions with page content (e.g. text entry, scrolling, clicks, mouse-overs). Pseudonymization generally prevents direct personal identification. There is no merging with clear data collected in other ways.

All processing described above—especially reading or storing information on the device used—takes place only if you have given us your explicit consent pursuant to Art. 6(1)(a) GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the “cookie consent tool” provided on the website.

We have concluded a data processing agreement with the provider, which protects the data of our site visitors and prohibits transfer to third parties.

For data transfers to Canada, an adequate level of protection is ensured by an adequacy decision of the European Commission.

9) Retargeting/Remarketing and Conversion Tracking

TikTok Pixel
Provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.

If you arrived on our website from an advertisement on the provider’s domain, cookies and/or comparable technologies (tracking pixels, web beacons, pings or HTTP requests) can be used to measure the success of the advertisement.

Using these technologies, certain device and browser information—including, where applicable, your IP address—is read in order to record and evaluate predefined user actions by us (e.g. completed transactions, leads, searches on the website, product page views). This enables the creation of statistics on user behavior on our website following redirection from an advertisement and serves to optimize our offering.

All processing described above—especially the setting of cookies for reading information on the device used—takes place only if you have given us your explicit consent pursuant to Art. 6(1)(a) GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the “cookie consent tool” provided on the website.

We have concluded a data processing agreement with the provider, which ensures the protection of our site visitors’ data and prohibits unauthorized disclosure to third parties.

10) Tools and Miscellaneous

Cookie Consent Tool
This website uses a “cookie consent tool” to obtain valid user consents for consent-based cookies and cookie-based applications. The tool is displayed to you upon page access as an interactive user interface, where you can give consent for certain cookies and/or cookie-based applications by ticking boxes. All consent-based cookies/services are only loaded if you give the corresponding consent. This ensures that such cookies are set on your device only if consent has been given.

The tool sets technically necessary cookies to store your cookie preferences. Personal user data is not generally processed in this context.

If, in individual cases, personal data (such as the IP address) is processed for the purpose of storing, assigning, or logging cookie settings, processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in legally compliant, user-specific, and user-friendly consent management for cookies and, consequently, in a legally compliant design of our online presence.

An additional legal basis is Art. 6(1)(c) GDPR. As the controller, we are legally obligated to make the use of non-essential cookies dependent on the respective user consent.

Where necessary, we have concluded a data processing agreement with the provider, which ensures the protection of our site visitors’ data and prohibits unauthorized disclosure to third parties.

Further information about the operator and settings options of the cookie consent tool can be found directly in the corresponding user interface on our website.

11) Data Subject Rights

11.1 Under applicable data protection law, you have the following rights vis-à-vis us as the controller regarding the processing of your personal data (rights of access and intervention). The specific prerequisites for exercising these rights are set out in the cited legal provisions:

  • Right of access pursuant to Art. 15 GDPR

  • Right to rectification pursuant to Art. 16 GDPR

  • Right to erasure pursuant to Art. 17 GDPR

  • Right to restriction of processing pursuant to Art. 18 GDPR

  • Right to notification pursuant to Art. 19 GDPR

  • Right to data portability pursuant to Art. 20 GDPR

  • Right to withdraw consent granted pursuant to Art. 7(3) GDPR

  • Right to lodge a complaint pursuant to Art. 77 GDPR

11.2 Right to Object

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTERESTS WITHIN THE FRAMEWORK OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT, AT ANY TIME AND ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING IS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT ADVERTISING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH ADVERTISING. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT ADVERTISING PURPOSES.

12) Duration of Storage of Personal Data

The duration of storage of personal data is determined by the respective legal basis, the purpose of processing, and—where applicable—by statutory retention periods (e.g. commercial and tax retention periods).

When processing personal data on the basis of explicit consent pursuant to Art. 6(1)(a) GDPR, the data concerned will be stored until you withdraw your consent.

If there are statutory retention periods for data processed under contractual or quasi-contractual obligations pursuant to Art. 6(1)(b) GDPR, such data will be routinely deleted after the retention periods have expired, provided they are no longer required for contract performance or initiation and/or there is no legitimate interest on our part in continued storage.

When processing personal data pursuant to Art. 6(1)(f) GDPR, such data will be stored until you exercise your right to object under Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for processing which override your interests, rights, and freedoms, or processing serves the establishment, exercise, or defense of legal claims.

When processing personal data for direct advertising purposes pursuant to Art. 6(1)(f) GDPR, such data will be stored until you exercise your right to object under Art. 21(2) GDPR.

Unless otherwise stated in this policy regarding specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.