Privacy Policy

We welcome you to our websites and are pleased about your interest. Protecting your personal data is important to us. We therefore conduct our activities in accordance with the applicable laws on the protection of personal data and data security. Below, we would like to inform you about which data from your visit is used for which purposes.

Controller responsible for processing under the GDPR

The controller within the meaning of the General Data Protection Regulation and other data protection laws applicable in the member states of the European Union, as well as other provisions of a data protection nature, is:

Femtis Power GmbH

Glücksteinallee 43

68163 Mannheim

https://femtis.de/

support@femtis.de

Data Protection Officer

Nils Möllers

Keyed GmbH

Siemensstraße 12

48341 Altenberge, Westphalia

info@keyed.de

+49 (0) 2505 - 639797

https://keyed.de

What is personal data?

The term personal data is defined in the Federal Data Protection Act and the EU GDPR. Accordingly, it refers to individual details concerning the personal or factual circumstances of an identified or identifiable natural person. This includes, for example, your legal name, address, telephone number, or date of birth. Learn more here about what data protection means exactly.

Scope of anonymous data collection and data processing

Unless otherwise stated in the following sections, no personal data is generally collected, processed, or used when you use our websites. However, through the use of analysis and tracking tools, we learn certain technical information from the data transmitted by your browser (for example, browser type/version, operating system used, websites visited on our site, including time spent there, and the website visited previously). We evaluate this information solely for statistical purposes.

Relevant legal bases for the processing of personal data

Where we obtain the consent of the data subject for the processing of personal data, Art. 6 para. 1 lit. a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for processing personal data.
When processing personal data that is necessary to fulfill a contract to which the data subject is a contracting party, Art. 6 para. 1 lit. b) GDPR serves as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.
Where the processing of personal data is necessary to comply with a legal obligation to which our company is subject, Art. 6 para. 1 lit. c) GDPR serves as the legal basis.
If the vital interests of the data subject or another natural person make the processing of personal data necessary, Art. 6 para. 1 lit. d) GDPR serves as the legal basis.
If processing is necessary to safeguard a legitimate interest of our company or a third party, and if the interests, fundamental rights, and freedoms of the data subject do not override that interest, Art. 6 para. 1 lit. f) GDPR serves as the legal basis for processing.

Use of cookies

The websites of Femtis Power GmbH use cookies. Cookies are data stored by the internet browser on the user's computer system. When a page is accessed, the cookies can be transmitted to that page and thus enable the user to be identified. Cookies help make the use of websites easier for users.

You can object to the placement of cookies at any time by changing the corresponding setting in your internet browser. Cookies that have been placed can be deleted. Please note that if cookies are disabled, it may not be possible to use all the functions of our website to their full extent. The user data collected in this way is pseudonymized by technical means. Therefore, it is no longer possible to associate the data with the user accessing the website. The data is not stored together with other personal data of the users. When our website is accessed, users are informed about the use of cookies for analysis purposes by an information banner and referred to this privacy policy. This also includes information on how the storage of cookies can be prevented in the browser settings. The legal basis for processing personal data using technically necessary cookies is Art. 6 para. 1 lit. f) GDPR. The legal basis for processing personal data using cookies for analysis purposes, where the user has provided the relevant consent, is Art. 6 para. 1 lit. a) GDPR. Please refer to our cookie banner and the information in this privacy policy to find out whether and to what extent cookies are used on our website.

Google Tag Manager

Description and purpose

We use Google Tag Manager (Google LLC. 1600 Amphitheatre Parkway Mountain View, CA 94043, USA) on our website. Google Tag Manager allows us to manage website tags through an interface and is a cookie-free domain that does not collect personal information, but can trigger other tags that collect data. Google pseudonymizes the data, and the IP address transmitted by your browser as part of Google Analytics is not combined with other data from Google.

Legal basis

The legal basis for processing your personal data is Art. 6 para. 1 lit. a) GDPR.

Recipient

The recipient of your personal data is Google LLC. (1600 Amphitheatre Parkway Mountain View, CA 94043, USA).

Transfer to third countries

The personal data is transferred to the United States. The transfer is subject to appropriate safeguards pursuant to Art. 46 GDPR. For this purpose, where necessary, we have concluded appropriate safeguards within the meaning of Art. 46 (2) GDPR with the data importer. In addition, we are aware of our responsibility and, where necessary, take further measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Data storage period

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. In addition, the data will be deleted if you exercise your right to erasure pursuant to Art. 17 para. 1 GDPR.

Withdrawal

You have the right to withdraw your consent at any time, cf. Art. 7 para. 3 sentence 1 GDPR. This can be done informally and without stating reasons and takes effect for the future. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found above in our privacy policy under “Rights of data subjects”.

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here: https://policies.google.com/privacy?hl=de&gl=de

Meta Pixel

Description and purpose

To detect your user behavior, we use the so-called Meta Pixel from Meta Platforms Inc., 1 Hacker Way, Menlo Park, California 94025, USA. This is an analytics tool that can be used to measure the effectiveness of advertising. It is a code snippet for the website that can be used to measure, optimize, and build audiences for advertising campaigns. Conversion measurement allows us to track across devices (including mobile phones, tablets, and desktop computers) what actions people take after seeing our Facebook ads. By creating a Meta Pixel and adding it to our pages where conversions take place (e.g., the purchase confirmation page), we can determine which people complete conversions as a result of our Facebook ads. The Pixel continues to monitor the actions people take after clicking our ads. This allows us to determine on which device our customers saw the ad and on which devices they ultimately completed the conversion. According to Facebook, the data collected includes:

HTTP headers
HTTP headers contain a range of information sent via a standard web protocol between any browser request and any server on the Internet. HTTP headers contain information such as IP addresses (which can only be evaluated at the general country level in Germany), web browser information, page location, document, URI referrer, and the web browser's user agent.
Pixel-specific data
This includes the Pixel ID and Facebook cookie data used to link events to a specific Facebook advertising account and associate them with a person known to Facebook.
Optional values
Developers and marketers can optionally send additional information about the visit via standard and custom data events. Typical custom data events include, for example, information about whether a purchase was made on a page, the conversion value, and much more. You can find more information about custom data events here. With your consent, we use the “Visitor Action Pixel” of Meta Platforms Inc., 1 Hacker Way, Menlo Park, California 94025, USA, or, if you are located in the EU, Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, on our website. With this conversion tool, we can track your actions after you have seen or clicked on a Facebook advertisement. This serves to monitor and analyze the effectiveness of our Facebook advertisements for statistical purposes and market research. Although we can only identify this data in anonymized form, Facebook also stores and processes this data. We do not know exactly what Facebook does with this data, but it can be assumed that Facebook can and will link this data to your Facebook account. Facebook can thus use this information for advertising, market research, and the needs-based design of Facebook pages. For this purpose, Facebook and its partners create usage, interest, and relationship profiles, e.g. to evaluate your use of our website with regard to the advertisements displayed to you on Facebook, inform other Facebook users about your activities on our website, and provide other services associated with the use of Facebook. This may also include cookies on the ... [truncated]

Advanced matching

Advertisers can optionally activate the Meta Pixel's advanced matching feature by sending encrypted information such as an email address or telephone number to Facebook. For matching, advertisers can send one or more of the following identifiers: email address, telephone number, first name, last name, city, state, ZIP code, date of birth, or gender.

Legal basis

The legal basis for processing your personal data is Art. 6 para. 1 lit. a) GDPR.

Recipient

The recipients of your personal data are Meta Platforms Inc. (1 Hacker Way, Menlo Park, California 94025, USA) and Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland).

Transfer to third countries

The personal data is transferred to the USA. The transfer is subject to appropriate safeguards pursuant to Art. 46 GDPR. For this purpose, we have concluded standard contractual clauses pursuant to Art. 46(2)(c) GDPR with the data importer. In addition, we are aware of our responsibility and, where necessary, take further measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Data storage period

Withdrawal

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here: https://www.facebook.com/about/privacy

Further information about the Meta Pixel can be found here: https://de-de.facebook.com/business/help/742478679120153?id=1205376682832142

Shopify International Ltd.

Description and purpose

We use the Shopify service on our website, provided by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify is a tool for creating and hosting websites. When you visit our website, Shopify collects your IP address as well as information about the device and browser you use. Shopify also analyzes visitor numbers, visitor sources, and customer behavior, and creates user statistics. If you make a purchase on our website, Shopify also collects your name, email address, delivery and billing addresses, payment details, and other data related to the purchase (e.g., telephone number, amount of sales made, etc.). For the analyses, Shopify stores cookies in your browser.

Legal basis

The legal basis for processing your personal data is consent pursuant to Art. 6 (1) (a) GDPR. In addition, processing is also based on our legitimate interest pursuant to Art. 6 (1) (f) GDPR. Our overriding legitimate interest lies in the appealing and simple presentation of content on our website.

Recipient

The recipient of your personal data is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

Transfer to third countries

Your personal data is not transferred to a third country. However, we are aware of our responsibility and regularly review the framework conditions and legal changes. In the event that a transfer to a third country takes place, we will update this information as soon as possible.

Data storage period

Withdrawal

Options for objecting

Under Art. 21 (1) GDPR, you have the right to object to the processing of your personal data at any time. If you exercise this right, processing for this purpose will no longer take place. Further information can be found above in our privacy policy under “Rights of data subjects”.

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here: https://www.shopify.com/de/legal/datenschutz

Description and purpose

Reddit is a social news aggregator, a website where registered users can post or submit content. Content can consist either of a link or a text post. Other users can rate the posts positively or negatively. The ratings indicate the position the post occupies on the respective Reddit page and on the homepage. This service is provided by reddit, Inc., c/o Wired, 520 Third St., San Francisco, CA 94107.

Legal basis

The legal basis for processing personal data is consent pursuant to Art. 6 (1) (a) GDPR.

Recipient

The recipient is reddit, Inc., c/o Wired, 520 Third St., San Francisco, CA 94107.

Transfer to third countries

Data is transferred to the USA.

Data storage period

Right to object

You have the option to withdraw your consent to data processing at any time. Withdrawal does not affect the validity of data processing operations carried out in the past.

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further privacy information via link

https://www.redditinc.com/policies/privacy-policy

Hotjar

Description and purpose

We use Hotjar (Hotjar Ltd, Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 3155, Malta) to better understand the needs of our users and optimize the experiences and services offered on this website. Hotjar’s technology helps us better understand our users’ experiences (e.g. time spent on pages, links clicked, etc.), helping us tailor our offerings to our users’ feedback. Hotjar uses cookies and other technologies to collect information about our users’ behavior and their devices, including the device’s IP address (which is only collected and stored anonymously while the website is being used), screen size, device type (unique device identifiers), information about the browser used, location (country only), and preferred language for displaying our website. Hotjar stores this information on our behalf in a pseudonymous user profile.

Legal basis

The legal basis for processing your personal data is Art. 6 para. 1 lit. a) GDPR.

Recipient

The recipient of your personal data is Hotjar Ltd (Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 3155, Malta).

Transfer to third countries

The use of the service may result in personal data being transferred to a third country. In the event that personal data is transferred, the provider ensures the level of protection required under the GDPR by complying with Articles 44 et seq. of the GDPR. If there is no adequacy decision for the third country in which the data importer is established, the transfer takes place subject to appropriate safeguards. If you have any questions, please feel free to contact our data protection officer.

Data storage period

Withdrawal

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here:

https://www.hotjar.com/legal/policies/privacy/

Pinterest Conversion

Description and purpose

Within our online offering, the so-called “Pinterest Tag” of Pinterest Inc. is used to analyze, optimize, and operate our online offering economically. With the help of the Pinterest Tag, Pinterest can identify visitors to our online offering as a target audience for displaying advertisements (so-called “Pinterest Ads”). Accordingly, we use the Pinterest Tag to display the Pinterest Ads placed by us only to Pinterest users who have also shown an interest in our online offering or who exhibit certain characteristics (e.g. interests in particular topics or products, determined based on the websites visited) that we transmit to Pinterest (so-called “ActALike Audiences”). We also use the Pinterest Tag to ensure that our Pinterest Ads correspond to users’ potential interests and are not intrusive. The Pinterest Tag also enables us to measure the effectiveness of Pinterest advertisements for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Pinterest advertisement (so-called “Conversion”). The Pinterest Tag is integrated directly by Pinterest when our websites are accessed and may store a so-called cookie, i.e. a small file, on your device. If you subsequently log in to Pinterest or visit Pinterest while logged in, the visit to our online offering is recorded in your profile. The data collected about you is anonymous to us, so it does not allow us to draw any conclusions about users’ identities. Pinterest processes the data in accordance with Pinterest’s Data Usage Policy.

Legal basis

The legal basis for processing your personal data is Art. 6 para. 1 lit. a) GDPR.

Recipient

The recipient is Pinterest Inc., 651 Brannan Street, San Francisco, CA, 94107, USA.

Transfer to third countries

Personal data is transferred to the USA. The transfer is subject to appropriate safeguards pursuant to Art. 46 GDPR. For this purpose, pursuant to Art. 46(2)(c) GDPR, we have entered into officially approved standard contractual clauses, such as those approved by the European Commission, with the data importer. In addition, we are aware of our responsibility and, where necessary, take further measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Data storage period

Withdrawal

You have the right to withdraw your consent at any time, see Art. 7 para. 3 sentence 1 GDPR. This can be done informally and without providing reasons and will take effect for the future. Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found above in our privacy policy under “Rights of data subjects”.

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here: https://policy.pinterest.com/en/privacy-policy

Matomo web analytics service

Description and purpose

Our website uses Matomo (formerly Piwik), an open-source software for the statistical analysis of visitor traffic. Matomo is provided by InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand. Matomo uses cookies that are stored on your computer and enable anonymized analysis of your use of the website. It is generally not possible to draw conclusions about a specific person, as your IP address is anonymized immediately after processing and before storage. Matomo is used to improve the quality of our website and its content. This allows us to learn how the website is used and continuously optimize our services. When individual pages of our website are accessed, the following data is stored: 1. Two bytes of the IP address of the user's accessing system 2. The website accessed 3. The website from which the user reached the accessed website (referrer) 4. The subpages accessed from the accessed website 5. The time spent on the website 6. The frequency with which the website is accessed. The software runs exclusively on our website's servers. The users' personal data is stored only there. The data is not disclosed to third parties. The software is configured so that the IP addresses are not stored in full; instead, 2 bytes of the IP address are masked. This makes it impossible to associate the shortened IP address with the accessing computer. Processing the users' personal data enables us to analyze our users' browsing behavior.

Legal basis

The legal basis for processing your personal data is Art. 6 para. 1 lit. a) GDPR.

Recipient

The recipient of your personal data is Matomo, InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand.

Transfer to third countries

Data storage period

Right of revocation

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here:

https://matomo.org/privacy-policy/

Taboola

Description and purpose

We use Taboola's service on our website, which enables user-specific recommendations for content and advertisements to be displayed based on browsing behavior and customer interests, thereby improving the user-friendliness of our offering. The provider of this service is Taboola Germany GmbH, Alt-Moabit 2, 10557 Berlin. Usage profiles are created using pseudonyms; they are not combined with data about the holder of the pseudonym and do not allow any conclusions to be drawn about personal data. Taboola collects the following user information by means of cookies: the user's operating system, websites/content accessed on our websites, the referrer/link through which the user came to our website, the time and number of website visits, visits to error pages, location information (city and state), truncated IP addresses.

Legal basis

The legal basis for processing your personal data is Art. 6 para. 1 lit. a) GDPR.

Recipient

The recipient of your personal data is Taboola Germany GmbH, Alt-Moabit 2, 10557 Berlin.

Transfer to third countries

The personal data is transferred to Israel. Pursuant to Art. 45(1) GDPR, an adequacy decision exists for the third country, certifying a comparable and therefore adequate level of protection. Furthermore, in the event of a change in the legal situation, we will take additional measures as soon as possible to ensure the protection of personal data.

The personal data is also transferred to the United States. The transfer is subject to appropriate safeguards pursuant to Art. 46 GDPR. For this purpose, we have concluded standard data protection clauses pursuant to Art. 46(2)(c) GDPR with the data importer. Furthermore, we are aware of our responsibility and, where necessary, take additional measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Data storage period

According to Taboola's privacy policy, the data will be deleted 13 months after the user's last interaction: https://www.taboola.com/de/policies/datenschutzerklaerung#nutzer.

Withdrawal

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here:

https://www.taboola.com/de/privacy-policy

Outbrain Target Advertisement

Description and purpose

Visitor pixels and cookies from Outbrain Inc., 39 West 13th Street, 3rd floor, New York, NY 10011, USA are used on this website to measure conversions. This makes it possible to track users' behavior after they have been redirected to the provider's website by clicking on an Outbrain advertisement. This procedure is used to evaluate the effectiveness of Outbrain advertisements for statistical and market research purposes and can help optimize future advertising activities. The data collected is anonymous to us, meaning that it does not allow us to draw any conclusions about the users' identities.

Legal basis

The legal basis for processing personal data is consent pursuant to Art. 6 (1) (a) GDPR.

Recipient

The recipient is Outbrain Inc., 39 West 13th Street, 3rd floor, New York, NY 10011, USA.

Transfer to third countries

Data is transferred to the USA.

Data storage period

Right to object

You have the option to withdraw your consent to data processing at any time. Withdrawal does not affect the validity of data processing operations carried out in the past.

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further privacy information via link

Please refer to Outbrain's privacy policy for information on the purpose and scope of data collection and the further processing and use of data by Outbrain, as well as your related rights and options for protecting your privacy:https://www.outbrain.com/legal/privacy#privacy-policy

Criteo SA

Description and purpose

We use the services of Criteo SA on our website. Criteo SA is an international provider of performance marketing and personalized online advertising.
The service is used to display personalized advertisements to visitors based on their previous browsing behavior and interests. This service collects information about usage behavior on the website via cookies, pixels, or similar tracking technologies. This data is processed in pseudonymized form and used to obtain an accurate analysis of user behavior.

Legal basis

The legal basis for processing your personal data is Art. 6 para. 1 lit. a) GDPR.

Recipient

The recipient of your personal data is Criteo SA, 32 Rue Blanche, 75009 Paris, France.

Transfer to third countries

Data storage period

Withdrawal

You have the right to withdraw your consent at any time, cf. Art. 7 para. 3 sentence 1 GDPR. This can be done informally and without stating reasons and takes effect for the future. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found in our privacy policy under “Rights of data subjects”.

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further data protection information

You can find more information about data protection at Criteo SA here: https://www.criteo.com/de/privacy/

Adtriba (now Funnel BA)

Description and purpose

We use the services of Adtriba on our website; however, Adtriba is now part of Funnel AB. Funnel acquired Adtriba in June 2024, thereby combining Adtriba's advanced marketing measurement technology with Funnel's marketing intelligence platform. This combination enables Funnel to offer its customers a more comprehensive solution for improving the effectiveness of their marketing activities across all channels.

Legal basis

The legal basis for processing your personal data is Art. 6 para. 1 lit. a) GDPR.

Recipient

The recipient of your personal data is Funnel AB, Klarabergsgatan 29, 111 21, Stockholm.

Transfer to third countries

Personal data may be transferred to the United States. The transfer takes place subject to appropriate safeguards pursuant to Article 46 of the GDPR. For this purpose, pursuant to Article 46(2)(c) of the GDPR, we have concluded with the data importer state-approved contractual clauses, such as the standard contractual clauses approved by the European Commission. In addition, we are aware of our responsibility and, where necessary, take further measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Data storage period

Withdrawal

You have the right to withdraw your consent at any time, cf. Art. 7 para. 3 sentence 1 GDPR. This can be done informally and without stating reasons and takes effect for the future. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found in our privacy policy under “Rights of data subjects”.

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further data protection information

Further information on data protection at Adtriba (Funnel) can be found here:

https://funnel.io/legal/adtriba/terms-and-conditions-german

https://funnel.io/privacy

Insider

Description and purpose

We use the Insider service on our website. Insider is an omnichannel and customer engagement platform that supports companies in creating and automating personalized marketing campaigns across various communication channels. This service collects, analyzes, and uses data from website and app users to enable personalized customer experiences and targeted marketing activities. User data from various sources may be combined to create a unified, cross-channel customer profile.

Legal basis

The legal basis for processing your personal data is Art. 6 para. 1 lit. a) GDPR.

Recipient

The recipient of your personal data is Insider, 1 Scotts Road #24-10 Shaw Centre, Singapore (2282208).

Transfer to third countries

Data storage period

Withdrawal

You have the right to withdraw your consent at any time, cf. Art. 7 para. 3 sentence 1 GDPR. This can be done informally and without stating reasons and takes effect for the future. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found in our privacy policy under “Rights of data subjects”.

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further data protection information

Further information on data protection at Insider can be found here:

https://useinsider.com/privacy-policy-for-roundtables/?utm_source=chatgpt.com#privacy-policy

TVSquared/ Innovid

Description and purpose

We use the TVSquared service on our website, which belongs to Innovid. Innovid supports us with advertising, personalization, and measurement in the area of Connected TV (CTV). Through a global infrastructure that enables data-driven personalization, real-time decision-making, scaled ad delivery, and accredited measurement, Innovid offers its customers and partners optimized solutions that maximize the value of advertising investments across screens and devices.

Legal basis

The legal basis for processing your personal data is Art. 6 para. 1 lit. a) GDPR.

Recipient

The recipients of your personal data are TV Squared Limited, Fifth Floor 1 Exchange Crescent, Conference Square, Edinburgh EH3 8UL and Innovid LLC 30 Irving Place, 12th Floor, New York, NY 10003.

Transfer to third countries

The personal data will be transferred to the United States. The transfer is subject to appropriate safeguards pursuant to Art. 46 GDPR. For this purpose, pursuant to Art. 46 para. 2 lit. c) GDPR, we have concluded government-approved contractual clauses with the data importer, such as the Standard Contractual Clauses approved by the European Commission. In addition, we are aware of our responsibility and, where necessary, take further measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Data storage period

Withdrawal

You have the right to withdraw your consent at any time, see Art. 7 para. 3 sentence 1 GDPR. This can be done informally and without stating reasons and takes effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found in our privacy policy under “Rights of data subjects”.

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further data protection information

Further information on data protection at TVSquared and Innovid can be found here:

https://1-demo-clients.tvsquared.com/u/tcs/read#%2F

https://www.innovid.com/privacy-policy

Google Analytics 4

Description and purpose

This website uses the “Google Analytics 4” service, provided by Google LLC, to analyze users’ use of the website. The service uses “cookies” - text files stored on your device. First-party cookies are used for this purpose. With a first-party cookie, the user can only be recognized by the website from which the cookie originates, not across multiple domains. The information collected by the cookies is generally sent to and stored on a Google server in the USA. Where applicable, Google Analytics is used on this website with the code “gat._anonymizeIp();” added to ensure anonymized collection of IP addresses (so-called IP masking). Please also note the following information regarding the use of Google Analytics: Users’ IP addresses are truncated within the member states of the EU and the European Economic Area. This truncation removes the personal reference from your IP address. For EU citizens, the IP address is also used only to derive location data and is then deleted. You also have the option to enable or disable the collection of detailed location and device data for individual regions (tracking settings). As part of the data processing agreement concluded between the website operators and Google LLC, Google uses the collected information to prepare an analysis of website use and website activity and provides services related to internet use.

Legal basis

The legal basis for processing your personal data is Art. 6 para. 1 lit. a) GDPR.

Recipient

The recipient of your personal data is Google LLC. (1600 Amphitheatre Parkway Mountain View, CA 94043, USA).

Transfer to third countries

The personal data is transferred to the United States. The transfer takes place subject to appropriate safeguards pursuant to Art. 46 GDPR. For this purpose, we have concluded standard contractual clauses with the data importer. In addition, we are aware of our responsibility and, where necessary, take further measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Data storage period

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In addition, the data is deleted if you exercise your right to erasure within the meaning of Art. 17 para. 1 GDPR. The maximum storage period is 14 months.

Withdrawal

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here: https://support.google.com/analytics/answer/6004245?hl=de https://policies.google.com/privacy?hl=de&gl=de.

Google Ads and Conversion Tracking

Description and purpose

To draw attention to our current projects and developments, planned activities and services, we place Google AdWords ads and use Google conversion tracking for this purpose. Google AdWords (Google Ads) is a service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). These ads are displayed on websites within the Google advertising network in response to search queries. We have the option of combining our ads with specific search terms. We also use AdWords remarketing lists for search ads. This enables us to customize search ad campaigns for users who have previously visited our website. These services allow us to combine our ads with specific search terms or to display ads to previous visitors promoting, for example, services that visitors viewed on our website. An analysis of online user behavior is necessary for interest-based offers. Google uses cookies to conduct this analysis. When a user clicks on an ad or visits our website, Google places a cookie on the user's computer. This information is used to target the visitor during a subsequent search query. Further information about the cookie technology used can also be found in Google's information on website statistics and its privacy policy. With the help of this technology, Google and we, as the customer, receive information that a user clicked on an ad and was redirected to our websites in order to contact us via the contact form. Likewise, Google and we, as the customer, receive information through Google forwarding numbers that a user on the Internet ... [truncated]

Legal basis

The legal basis for processing your personal data is consent pursuant to Art. 6 para. 1 lit. a) GDPR.

Recipient

The recipient of your personal data is Google LLC. (1600 Amphitheatre Parkway Mountain View, CA 94043, USA). The data controller responsible for processing your information depends on your usual place of residence, unless otherwise specified in the privacy notices of a particular service:

Google Ireland Limited for users of Google services who usually reside in the European Economic Area or Switzerland
Google LLC for users of Google services who usually reside in the United Kingdom.

Transfer to third countries

The personal data are transferred to the USA (server location). The transfer is subject to appropriate safeguards pursuant to Art. 46 GDPR. For this purpose, we have concluded standard contractual clauses pursuant to Art. 46 para. 2 lit. c) GDPR with the data importer. Furthermore, we are aware of our responsibility and, where necessary, take additional measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Data storage period

Withdrawal

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further data protection information

Further information about the processing of your personal data can be found here: www.google.com/policies/privacy/

Google Ads Remarketing service

Description and purpose

Our website uses the Google Ads Remarketing service provided by Google LLC. With this service, we can display interest-based advertising to visitors to our website. For this purpose, Google sets cookies and processes information about your usage behavior (e.g., pages visited, click behavior, and technical data such as your IP address). The purpose is to analyze user behavior in order to display personalized advertising to you on other websites.

Through the use of cookies or pixels, the system recognizes returning users and segments them based on their behavior, such as which pages they visited or how long they stayed there.

As part of these remarketing measures, Google processes various types of personal data. These include, in particular, the IP address, information about the device and browser used, and specific usage behavior on the website. This data is collected via cookies and tracking IDs and transmitted to Google.

The data collected are used primarily to personalize advertising, measure campaign performance, and optimize ads and target audiences.

Legal basis

The legal basis for processing your personal data is Art. 6 para. 1 lit. a)

Recipient

The recipient of your personal data is Google LLC. (1600 Amphitheatre Parkway Mountain View, CA 94043, USA).

Transfer to third countries

The personal data is transferred to the United States. The transfer is subject to appropriate safeguards pursuant to Art. 46 GDPR. For this purpose, where necessary, we have concluded appropriate safeguards within the meaning of Art. 46 (2) GDPR with the data importer. Google LLC is also certified under the Data Privacy Framework. In addition, we are aware of our responsibility and, where necessary, take further measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Data storage period

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In addition, the data is deleted if you exercise your right to erasure within the meaning of Art. 17 (1) GDPR. Remarketing cookies are stored for up to 540 days.

Withdrawal

You have the right to withdraw your consent pursuant to Art. 6 (1) (a) GDPR at any time; see Art. 7 (3) sentence 1 GDPR. This can be done informally and without stating reasons and will take effect for the future. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found above in our privacy policy under “Rights of data subjects”.

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here: https://policies.google.com/privacy?hl=de&_gl=1*1ltq0is*_ga*MzE0Mzg4NzI2LjE3NTYxOTYzMTQ.*_ga_V9K47ZG8NP*czE3NTYxOTYzMTMkbzEkZzAkdDE3NTYxOTYzMTYkajU3JGwwJGgw

Google Maps

Description and purpose

This website uses the Google Maps API provided by Google LLC. (1600 Amphitheatre Parkway Mountain View, CA 94043, USA) to display geographical information visually. When using Google Maps, Google also collects, processes, and uses data about visitors' use of the Maps functions on the websites.

Legal basis

The legal basis for processing your personal data is Art. 6 para. 1 lit. a) GDPR.

Recipient

The recipient of your personal data is Google LLC (1600 Amphitheatre Parkway Mountain View, CA 94043, USA).

Transfer to third countries

Data storage period

Withdrawal

Contractual or legal obligation

There is no contractual or legal obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here:

https://policies.google.com/privacy?hl=de&gl=del

Microsoft Clarity

Description and purpose

We use the Microsoft Clarity service provided by Microsoft Corporation on our website. Microsoft Clarity is used to provide us with better insights into the use of our website in order to further improve user-friendliness. The service can be used to create heatmaps and overviews of cursor and scrolling movements, and to process data such as access times and IP addresses.

Legal basis

The legal basis for processing your personal data is Art. 6 para. 1 lit. a) GDPR.

Recipient

Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

Transfer to third countries

Data storage period

Withdrawal

You have the right to withdraw your consent at any time, cf. Art. 7 para. 3 sentence 1 GDPR. This can be done informally and without stating reasons and takes effect for the future. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found in our privacy policy under “Rights of data subjects”.

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further data protection information

Further information on data protection at Microsoft can be found here: https://privacy.microsoft.com/de-de/privacystatement

Microsoft Ads

Description and purpose

We use technologies from Microsoft Ads (bingads.microsoft.com) on the website, which are provided and operated by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (“Microsoft”). Microsoft places a cookie on your device if you reached our website via a Microsoft Bing advertisement. Microsoft Bing and the website operator can thereby determine that someone clicked on an advertisement, was redirected to our website, and reached a previously specified target page (conversion page). We only learn the total number of users who clicked on a Bing advertisement and were then redirected to the conversion page. Microsoft collects, processes, and uses information from the cookie to create usage profiles using pseudonyms (Microsoft Conversion Tracking). These usage profiles are used to analyze visitor behavior and to serve advertisements. No personal information relating to the user's identity is processed.

Legal basis

The legal basis for processing your personal data is Art. 6(1)(a) GDPR.

Recipient

The recipient of your personal data is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (“Microsoft”), to which it is transferred and where it is stored.

Transfer to third countries

The personal data is transferred to the United States. The transfer is subject to appropriate safeguards pursuant to Art. 46 GDPR. Where required, we have concluded appropriate safeguards within the meaning of Art. 46(2) GDPR with the data importer. We have concluded this with the data importer. In addition, we are aware of our responsibility and, where required, take further measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Data storage period

Withdrawal

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here:

https://privacy.microsoft.com/en-US/privacystatement

Kameleoon

Description and purpose

The website uses the Kameleoon service provided by Kameleoon GmbH to analyze website usage and optimize the user experience for all visitors. The Kameleoon service does not collect any personal data, but only processes the data collected by Google Analytics.

Legal basis

The legal basis for processing your personal data is Art. 6 para. 1 lit. a) GDPR.

Recipient

The recipient of your personal data is Kameleoon GmbH, Beim Alten Ausbesserungswerk 4, 77654 Offenburg, Germany.

Transfer to third countries

Data storage period

Withdrawal

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here: https://www.kameleoon.com/de/datenschutz

Klaviyo Inc.

Description and purpose

For sending the newsletter, we use the cloud-based service provider Klaviyo Inc. on our website. Klaviyo is used to create and send newsletters and marketing emails and to manage their delivery. When you subscribe to our newsletter, we process your personal data in the form of your IP address, email address, date and time, action type, metadata, object and profile reference. Through an integrated data platform and AI, Klaviyo combines marketing automation, analytics, and customer service in a unified solution, making it easier for us to understand our customers better and grow faster.

Legal basis

The legal basis for processing your personal data is Art. 6 para. 1 lit. a) GDPR and Art. 6 para. 1 lit. f). Our overriding legitimate interest arises from direct marketing for customer acquisition.

Recipient

The recipient of your personal data is Klaviyo, Inc.,125 Summer Street, Floor 6, Boston, MA, 02110, USA.

Transfer to third countries

Data storage period

Withdrawal

You have the right to withdraw your consent at any time, cf. Art. 7 para. 3 sentence 1 GDPR. This can be done informally and without stating reasons and takes effect for the future. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found in our privacy policy under “Rights of data subjects”.

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further data protection information

Further information on data protection at Klaviyo can be found here: https://privacy.klaviyo.com/policies/de-DE/

REVIEWS.io

Description and purpose

We use the review service REVIEWS.io on our website, provided by Reviews.co.uk Ltd. The service is used to collect, display, and manage customer reviews of our products and services. REVIEWS.io supports us in collecting authentic reviews from customers, displaying reviews on our website, and analyzing customer satisfaction.

For this purpose, personal data such as IP address, device and browser information, timestamps, referrer URL, and interactions with review widgets are processed. If you submit a review or receive review invitations, additional data such as your name, email address, order number, review content, and other information provided voluntarily may also be processed.
Processing serves to promote transparency in the online shop, improve our customer service, and present authentic user opinions.

Legal basis

Your personal data is processed on the basis of your consent pursuant to Article 6(1)(a) GDPR.

Recipient

The recipient of the data is Reviews.co.uk Ltd., 29 St Nicholas Place, Leicester, LE1 5LB, United Kingdom.

Transfer to third countries

As Reviews.co.uk Ltd. is located in the United Kingdom, personal data is processed in a so-called third country. The United Kingdom has an adequacy decision from the European Commission pursuant to Article 45 GDPR, confirming a level of data protection equivalent to that in the EU.

If Reviews.io transfers individual data to third countries (e.g., the USA), this is done exclusively on the basis of appropriate safeguards pursuant to Article 46 GDPR, in particular the standard contractual clauses approved by the European Commission. In addition, where required, we implement supplementary technical and organizational measures.

Data storage period

Your data will be deleted as soon as it is no longer necessary for the purposes for which it was collected. This applies in particular to the display or analysis of reviews. Regardless of this, deletion will take place if you exercise your right to erasure under Article 17 GDPR and no statutory retention obligations prevent it.

Withdrawal

You may withdraw your consent to the processing of your data at any time, without stating a reason, with effect for the future (Article 7(3) GDPR). The lawfulness of processing carried out before withdrawal remains unaffected. Further information on withdrawal can be found in the “Rights of data subjects” section of our Privacy Policy.

Contractual or legal obligation

There is no legal or contractual obligation to provide personal data. However, without consent, personalized reviews cannot be submitted or review emails sent.

Further data protection information

For more information about data protection at REVIEWS.io, please see:
https://www.reviews.io/legal/user-privacy-policy.

Rebuy Engine (Rebuy Engine Inc.)

Description and purpose

On our website, we use the Rebuy Engine service, provided by Rebuy Engine Inc. Rebuy Engine is a cloud-based personalization and conversion optimization service that provides functions such as product recommendations, dynamic product suggestions, cross-selling elements, search optimization, and automated shopping cart optimization.

To provide these functions, Rebuy Engine processes various types of personal data, including IP address, device and browser information, referrer URL, interactions with products, click behavior, shopping cart data, and pseudonymized user IDs. The processing is carried out to display personalized content, improve the user experience, and optimize the performance of our online shop.

Legal basis

Your personal data is processed on the basis of your consent pursuant to Art. 6 para. 1 lit. a) GDPR.

Recipient

The recipient of the data is Rebuy Engine Inc., 6004 Saint Johns Avenue, Minneapolis, United States.

Transfer to third countries

The use of Rebuy Engine involves the transfer of personal data to the United States. The transfer is based on appropriate safeguards pursuant to Art. 46 GDPR, in particular the standard contractual clauses approved by the European Commission.
In addition, where necessary, we implement supplementary technical and organizational measures to ensure a level of data protection equivalent to that in the EU.

Data storage period

The data will be deleted as soon as it is no longer required to achieve the respective purpose. This applies in particular to displaying personalized content or analyzing interactions. We also delete the data if you exercise your right to erasure pursuant to Art. 17 para. 1 GDPR, unless statutory retention obligations prevent this.

Withdrawal

You can withdraw your consent at any time without stating reasons, with effect for the future (Art. 7 para. 3 GDPR). The lawfulness of processing carried out before the withdrawal remains unaffected. Further information can be found in our privacy policy in the section “Rights of data subjects”.

Contractual or legal obligation

There is no legal or contractual obligation to provide personal data. However, without your consent, personalized product recommendations or dynamic content cannot be provided.

Further data protection information

Further information on data protection at Rebuy Engine can be found at:
https://rebuyengine.com/privacy

Brevo (Sendinblue GmbH)

Description and purpose

We use the Brevo service to send emails and for marketing and communication processes. Brevo offers functions for sending transactional emails, newsletters, and automated email campaigns, managing contacts, and analyzing performance.

In this context, Brevo processes personal data such as:

Email address
Name (if provided)
IP address
timestamps
Shipping and delivery status
Device data
Interaction data (e.g., open and click rates, where technically necessary)

Processing serves in particular to reliably provide technical messages (e.g., order confirmations, password resets), newsletters, and marketing communications, as well as to analyze their delivery.

Legal basis

Processing takes place depending on the type of email:

Art. 6 para. 1 lit. b) GDPR (performance of a contract), for transactional emails such as order or account communications.
Art. 6 para. 1 lit. a) GDPR (consent), for newsletter subscriptions or promotional emails.

Recipient

Brevo (Sendinblue GmbH)
Köpenicker Straße 126, 10179 Berlin, Germany.

Transfer to third countries

The primary processing of data by Brevo takes place within the European Union.
If, in the context of individual sub-processors, personal data is transferred to a third country (e.g., the USA), this is carried out exclusively on the basis of appropriate safeguards pursuant to Art. 46 GDPR, in particular the standard contractual clauses approved by the European Commission. In addition, where necessary, technical and organizational measures are taken to ensure an adequate level of data protection.

Data storage period

Brevo stores personal data only for as long as necessary to provide the respective service.
Contact data is deleted as soon as it is no longer needed for communication or if you exercise your right to erasure pursuant to Art. 17 GDPR and no statutory retention obligations prevent this.
Log data relating to delivery is automatically deleted by Brevo in accordance with internal policies.

Withdrawal

If the data processing is based on your consent, you may withdraw it at any time without stating reasons, with effect for the future (Art. 7 para. 3 GDPR).

Contractual or legal obligation

There is no legal or contractual obligation to provide your data.

Further data protection information

For more information about data protection at Brevo, please visit:
https://www.brevo.com/de/legal/privacypolicy/

ThoughtMetric

Description and purpose

We use the ThoughtMetric service, provided by ThoughtMetric, Inc. ThoughtMetric is an analytics and attribution tool that enables us to measure the performance of our marketing activities across various channels. The service aggregates data from e-commerce systems and marketing platforms to create reports on conversions, campaign performance, customer journeys, and revenue analyses.

In doing so, ThoughtMetric processes personal data such as:

IP address
Device and browser information
cookie or pixel IDs
interaction data (product views, click behavior, ordering processes)
pseudonymized user IDs
technical event data and timestamps

ThoughtMetric helps us understand the effectiveness of our marketing channels (e.g., Meta, Google Ads, Klaviyo, TikTok), use marketing budgets more efficiently, and continuously optimize our website.

Legal basis

Your personal data is processed on the basis of your consent pursuant to Art. 6 para. 1 lit. a) GDPR.

Recipient

The recipient of your data is ThoughtMetric, Inc., 55 Court Street, Floor 2, Boston, MA 02203, USA.

Transfer to third countries

ThoughtMetric processes personal data in the United States.
The transfer is carried out pursuant to Art. 46 GDPR on the basis of the standard contractual clauses (SCCs) approved by the European Commission. In addition, supplementary technical and organizational measures are taken where necessary to ensure an adequate level of data protection.

Data storage period

ThoughtMetric stores personal data only for as long as necessary to analyze and provide marketing attribution and performance reports.
Data is deleted as soon as the purpose of the processing no longer applies or as soon as you exercise your right to erasure pursuant to Art. 17 GDPR and no statutory retention obligations exist.

Withdrawal

You may withdraw your consent at any time without giving reasons, with effect for the future (Art. 7(3) GDPR).

Contractual or legal obligation

There is no legal or contractual obligation to provide your data.

Further data protection information

Further information on data protection at ThoughtMetric can be found at:
https://thoughtmetric.io/privacypolicy.html

ConfigSecurity

Description and purpose

We use the security and monitoring service ConfigSecurity on our website to ensure the stability, security, and integrity of our systems.
ConfigSecurity monitors configuration changes, detects security-relevant events, analyzes access patterns, and helps detect unauthorized access, attempted misuse, or technical malfunctions at an early stage.

As part of these functions, ConfigSecurity processes in particular:

IP address
Device and browser information
technical log and event data
timestamps
URLs and path requests
system and server status information
pseudonymized identifiers

The processing serves exclusively to maintain technical security, analyze errors, and protect our IT infrastructure.

Legal basis

Your personal data is processed on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR.
Our legitimate interest is to protect our website, systems, and data against attacks, misuse, technical disruptions, and unauthorized access, and to ensure the secure and stable operation of our online services.

Recipient

The recipient of the data is the respective provider of ConfigSecurity.

Transfer to third countries

If ConfigSecurity uses services or servers in third countries, personal data is transferred exclusively on the basis of appropriate safeguards pursuant to Art. 46 GDPR, in particular the standard contractual clauses approved by the European Commission.
In addition, we implement supplementary technical and organizational measures where necessary to ensure an adequate level of data protection.

Data storage period

Personal data is stored only for as long as necessary to achieve the security and monitoring purposes stated above. Log data is regularly deleted automatically.
Regardless of this, we delete data as soon as you exercise your right to erasure pursuant to Art. 17 GDPR, unless statutory retention obligations prevent this.

Objection

As the processing is based on our legitimate interest, you may object to the processing at any time (Art. 21 GDPR).
The lawfulness of the processing carried out up to that point remains unaffected.
Further information about your rights can be found in the “Rights of data subjects” section of our privacy policy.

Contractual or legal obligation

There is no legal or contractual obligation to provide personal data.

Further data protection information

Further information about data protection at the ConfigSecurity provider can be found in its privacy notices.
(Link can be added once known.)

Roeye CDN

Description and purpose

We use the Roeye CDN service on our website to deliver static content, accelerate loading times, and increase the security and stability of our website.

A Content Delivery Network (CDN) such as Roeye distributes content through a global server network to deliver page views faster and minimize server loads. It also supports security functions such as DDoS protection, bot filtering, access control, and performance optimization.

As part of using the service, personal data may be processed, in particular:

IP address
Device and browser information
Requested URLs
Timestamps and technical log data
Source and destination information of network traffic
pseudonymized usage data

This data processing is technically necessary to deliver the content of our website reliably, efficiently, and securely.

Legal basis

Your personal data is processed on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR.
Our legitimate interest is the efficient, secure, and stable provision of our online offering, as well as protection against attacks and misuse.

Recipient

The recipient of the data is the operator of Roeye CDN.

Transfer to third countries

Since CDN infrastructures are regularly distributed globally, personal data may be transferred to countries outside the European Union.
Any transfer is carried out exclusively on the basis of appropriate safeguards pursuant to Art. 46 GDPR, in particular the Standard Contractual Clauses (SCCs) approved by the European Commission.
In addition, where necessary, supplementary technical and organizational measures (e.g., encryption, access restrictions) are implemented to ensure an adequate level of data protection.

Data storage period

Log data is stored only for as long as necessary to ensure operation, analyze errors, prevent threats, or provide the content.
In addition, we will delete the data if you exercise your right to erasure pursuant to Art. 17 GDPR and there are no statutory retention obligations to the contrary.

Objection

Since the processing is based on our legitimate interest, you have the right to object to this processing at any time (Art. 21 GDPR).
The processing carried out up to that point remains unaffected.
Further information about your rights can be found in the “Rights of data subjects” section of our privacy policy.

Contractual or legal obligation

There is no legal or contractual obligation to provide personal data.

Further data protection information

Further information on the data protection measures of the operator of Roeye CDN can be found in the privacy notices of the respective provider.
(Can be added once I know the exact provider.)

Amazon Web Services (AWS) – CloudFront & Amazon S3

Description and purpose

We use various services from Amazon Web Services (AWS) for our website, in particular Amazon CloudFront and Amazon S3.

Amazon CloudFront is a Content Delivery Network (CDN) that delivers static content such as images, scripts, stylesheets, or media through globally distributed servers.
Amazon S3 (Simple Storage Service) is used to store and provide static files and securely deliver website resources.

As part of providing these services, personal data - in particular your IP address, device and browser information, and technical metadata (e.g., access time, requested file, user agent) - is processed. This is done exclusively to provide our website and its content quickly, reliably, and securely.

Legal basis

The processing of personal data in connection with the use of AWS services is based on our legitimate interests pursuant to Art. 6 para. 1 lit. f) GDPR.
Our legitimate interest lies in providing our online services efficiently, economically, and securely, load balancing, improving website performance, and protecting against attacks and misuse.

Recipient

The recipient of the personal data is
Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, and, where applicable, other group companies of Amazon Web Services, Inc., 410 Terry Ave North, Seattle, WA 98109-5210, USA.

Transfer to third countries

The use of CloudFront may result in the transfer of personal data to third countries outside the EU, including the United States.

The transfer is based on the Standard Contractual Clauses (Art. 46 GDPR) adopted by the European Commission, which AWS has implemented contractually. In addition, where necessary, supplementary technical and organizational measures are taken to ensure a level of data protection equivalent to that in the EU (e.g., encryption, access restrictions, logging, network segmentation).

Data storage period

AWS generally stores personal data only for as long as necessary to provide the requested content or ensure system integrity.
Log data is stored for a limited period, depending on the AWS service concerned, and then automatically deleted. In addition, we delete your data as soon as you exercise your right to erasure under Art. 17 GDPR and no statutory retention obligations oppose this.

Objection

If the processing is based on our legitimate interest, you may object to the processing at any time (Art. 21 GDPR). The lawfulness of the processing carried out up to that point remains unaffected. Further information on the right to object can be found in our privacy policy in the section “Rights of data subjects.”

Contractual or legal obligation

There is no legal or contractual obligation to provide the personal data.

Further data protection information

Further information on data protection at Amazon Web Services can be found at:
https://aws.amazon.com/privacy/

Trusted Shops Trustbadge®

Description and purpose

The Trustbadge® plug-in or widget from Trusted Shops is used on our website. Trusted Shops is operated by Trusted Shops GmbH, Colonius Carré, Subbelrather Straße 15c, 50823 Cologne. Through the Trusted Shops Trustbadge® plug-in or widget, we present you with a summary of our current profile at Trusted Shops directly on our website. This makes it apparent on our website how other users have rated us and what position we hold at Trusted Shops. Its integration enables our profile to be found immediately, so that you can obtain further information about us and also rate us. The purpose of processing the data is to integrate a summary of our Trusted Shops profile on our website, in particular to present our Trusted Shops quality seal and any reviews collected. The Trusted Shops plug-in or widget is integrated into our website via an interface (“API”) to Trusted Shops using JavaScript. The Trustbadge also sets cookies in particular. When the Trustbadge is accessed, the web server automatically stores a so-called server log file containing, for example, your IP address, the amount of data transferred, the date and time of access, and the requesting provider (access data), and documents the access. This access data is not analyzed. Further personal data is transmitted to Trusted Shops only if you have consented to this, decided to use Trusted Shops products after completing an order, or have already registered to use them. In this case, the contractual agreement concluded between you and Trusted Shops applies. We ourselves do not collect any data when you view the Trustbadge.

Legal basis

The legal basis for processing your personal data is Art. 6 para. 1 lit. a) GDPR.

Recipient

The recipient of your personal data is Trusted Shops GmbH, Colonius Carré, Subbelrather Straße 15c, 50823 Cologne.

Transfer to third countries

The personal data is transferred to the United States. The transfer is subject to appropriate safeguards pursuant to Art. 46 GDPR. For this purpose, we have concluded standard data protection clauses pursuant to Art. 46 para. 2 lit. c) GDPR with the data importer. In addition, we are aware of our responsibility and, where necessary, take further measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Data storage period

According to Trusted Shops, the data is automatically overwritten no later than seven days after the end of your visit to the website (see https://business.trustedshops.de/impressum#a0_content).

Withdrawal

Contractual and legal obligation

There is no contractual or legal obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here: Legal notice and data protection | Trusted Shops

eTrusted (Trusted Shops GmbH)

Description and purpose

We use the eTrusted service on our website, a review and customer feedback system operated by Trusted Shops GmbH. eTrusted enables us to send automatic review requests after a purchase, collect customer feedback, manage reviews, and display them on our website.
This enables us to analyze customer satisfaction, improve the quality of our services, and provide transparent, authentic customer reviews.

As part of these functions, eTrusted processes personal data such as:

Name (if provided)
Email address
Order number or internal order ID
IP address
Technical metadata (timestamps, shipping status)
Feedback, review texts, and voluntarily provided information

Technical data (e.g. browser information, device data, widget interactions) may also be processed automatically to display review content or trust widgets.

Legal basis

The legal basis for processing your personal data is Art. 6 para. 1 lit. a) GDPR.

Recipient

The recipient of the personal data is:

Trusted Shops GmbH
Subbelrather Straße 15c
50823 Cologne
Germany.

Transfer to third countries

Trusted Shops GmbH processes data primarily within the European Union.
If a transfer to third countries takes place as part of individual sub-processors (e.g. the USA), this is carried out exclusively on the basis of appropriate safeguards pursuant to Art. 46 GDPR, in particular standard contractual clauses, as well as supplementary technical and organizational measures.

Data storage period

Data is stored for as long as necessary to display, maintain the review history, or analyze customer feedback.
In addition, we delete personal data as soon as you exercise your right to erasure under Art. 17 GDPR and no statutory retention obligations prevent this.

Withdrawal

If the processing is based on your consent, you may withdraw it at any time without stating reasons, with effect for the future (Art. 7 para. 3 GDPR).

Contractual or legal obligation

There is no legal or contractual obligation to provide personal data.

Further data protection information

Further information on data protection at eTrusted / Trusted Shops can be found at:
Imprint and data protection | Trusted Shops

Creation of log files

Each time the website is accessed, Femtis Power GmbH collects data and information through an automated system. This data is stored in the server's log files. The data is also stored in our system's log files. This data is not stored together with other personal data of the user.
The following data may be collected:

(1) Information about the browser type and version used
(2) The user's operating system
(3) The user's internet service provider
(4) The user's IP address
(5) Date and time of access
(6) Websites from which the user's system reached our website (referrer)
(7) Websites accessed by the user's system via our website

Duration of storage of personal data

Personal data is stored for the duration of the applicable statutory retention period. Once this period has expired, the data is routinely deleted unless it is required for initiating or fulfilling a contract.

Contact options

The Femtis Power GmbH website contains a contact form that can be used for electronic contact. Alternatively, contact can be made via the provided email address. If the data subject contacts the controller responsible for processing via one of these channels, the personal data transmitted by the data subject will be automatically stored. The data is stored solely for the purpose of processing the inquiry or contacting the data subject. The data is not disclosed to third parties. If the user has given consent, the legal basis for processing the data is Art. 6(1)(a) GDPR. The legal basis for processing data transmitted when sending an email is Art. 6(1)(f) GDPR. If the email contact aims to conclude a contract, an additional legal basis for processing is Art. 6(1)(b) GDPR. The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For personal data from the contact form and data sent by email, this is the case when the respective conversation with the user has ended. The conversation is considered ended when the circumstances indicate that the matter in question has been conclusively clarified.

Online Shop

We use your personal data to process your online purchases (your orders and returns are handled through our online services) and to send notifications about delivery status or alerts in the event of problems with the delivery of your items. We use your personal data to process your payments. We also use your data to handle complaints and product warranty claims. Your personal data is used to establish your identity, ensure that you have reached the legal minimum age for online purchases, and verify your address with external partners. We want to offer you several payment methods and conduct analyses to determine which payment options are available to you, including your payment history and credit checks.

Disclosure of data when using online payment service providers

If, as part of your ordering process, you decide to pay using one of the online payment service providers we offer, your contact details will be transmitted to that provider as part of the order initiated in this way. The lawfulness of this data transfer is based on Art. 6 para. 1 lit. b) GDPR, for carrying out the payment method you have selected, as well as our legitimate interests pursuant to Art. 6 para. 1 lit. f) GDPR in enabling a user-friendly and uncomplicated payment process. The personal data transmitted to the online payment service provider usually includes your first name, last name, address, IP address, email address, or other data required to process the order, as well as data related to the service, such as the type of service, the recipient's identity, the invoice amount and taxes in percent, invoice information, etc. This transfer is necessary to provide the service using the payment method you have selected, particularly to confirm your identity, administer your payment, and manage the customer relationship. Please note, however: The online payment service provider may also disclose personal data to service providers, subcontractors, or other affiliated companies insofar as this is necessary to fulfill the contractual obligations arising from your order or the personal data is to be processed on behalf of the provider. Depending on the payment method selected, e.g. invoice or direct debit, the personal data transmitted to the provider may be forwarded by the provider to credit reference agencies. This transfer serves to verify identity and creditworthiness in relation to the transaction you have made... [truncated]

American Express American Express Services Europe Limited, Frankfurt am Main branch, Theodor-Heuss-Allee 112, 60486 Frankfurt am Main at https://www.americanexpress.com/de/legal/online-datenschutzerklarung.html
Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium at https://www.mastercard.de/de-de/datenschutz.html
Visa Europe Services Inc., London branch, 1 Sheldon Square , London W2 6TT , United Kingdom at https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html
PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg at https://www.paypal.com/de/webapps/mpp/ua/privacy-full
Stripe, Inc.,185 Berry Street, Suite 550, San Francisco, CA 94107, USA at https://stripe.com/de/privacy#translation g. micropayment GmbH, Scharnweberstrasse 69, D-12587 Berlin at https://www.micropayment.de/about/privacy/
Klarna AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden
(Apple Pay) Apple Distribution International, Hollyhill Industrial Estate, Hollyhill Cork, Ireland;
Shopify Payments, 126 York Street, Suite 200, Ottawa, ON, Canada, K1N 5T5;
Google Pay (Europe), Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
UnionPay International Youxian Gongsi German Branch - An der Welle 4, 60322 Frankfurt am Main at
https://www.unionpayintl.com/en/privacyNotice/?utm_source=chatgpt.com
Bancontact Payconiq Company, Rue d’Arlon 82, 1040 Brussels, Belgium at
https://help.xe.com/hc/de/sections/19601578205457-Hinweis-zum-Datenschutz
(BLIK) Polski Standard Płatności sp. z o.o., ul. Czerniakowska 87A, 00-718 Warsaw, Poland at
https://www.blik.com/media/PRIVACY_POLICY_AND_COOKIES_POLICY.pdf
(Przelewy24) PayPro SA, Kanclerska 15A, 60-326 Poznań, Poland at
https://www.przelewy24.pl/en/information-obligation-gdpr-payer
TWINT AG, Stauffacherstrasse 41, CH-8004 Zurich, Switzerland at
https://www.twint.ch/datenschutz/
iDeal Currence Holding B.V., Beethovenstraat 300, 1077 Amsterdam, Netherlands at
https://ideal.nl/en/ideal-privacy-cookiestatement

Transfer to third countries

We would like to inform you that your personal data may also be transferred to a server in a third country and thus processed outside the EU.

Duration

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. In addition, the data will be deleted if you withdraw your consent or request the deletion of your personal data. Contractual or legal obligation to provide personal data. The provision of personal data is neither required by law nor contractually required, nor is it necessary to conclude a contract. You are also not obliged to provide the personal data. However, failure to provide it may mean that you cannot use this service, or cannot use it to its full extent.

Registration on our website

If the data subject uses the option to register on the website of the controller responsible for processing by providing personal data, the data are transmitted to the controller responsible for processing via the respective input form. The data are stored exclusively for the purpose of internal use by the controller responsible for processing. The data are deleted as soon as they are no longer necessary to achieve the purpose for which they were collected. During registration, the user's IP address and the date and time of registration are stored. This serves to prevent misuse of the services. The data are not disclosed to third parties. An exception applies if there is a legal obligation to disclose them. Registration of the data is required to provide content or services. Registered persons may have the stored data deleted or amended at any time. The data subject may obtain information about their stored personal data at any time.

Routine deletion and blocking of personal data

The controller responsible for processing processes and stores the personal data of the data subject only for as long as necessary to achieve the purpose of storage. Storage beyond this period may take place if provided for by the European or national legislator in regulations, laws, or other provisions under Union law to which the controller responsible for processing is subject. As soon as the purpose of storage ceases to apply or a storage period prescribed by the aforementioned provisions expires, the personal data are routinely blocked or deleted.

Rights of the data subject

If your personal data are processed, you are a data subject within the meaning of the GDPR and have the following rights vis-à-vis the controller:

Right of access pursuant to Art. 15 GDPR

You may request confirmation from the controller as to whether personal data concerning you are being processed by us. If such processing exists, you may request information from the controller about the following:

the purposes for which the personal data are processed;
the categories of personal data that are processed;
the recipients or categories of recipients to whom your personal data have been disclosed or will be disclosed;
the envisaged period for which your personal data will be stored or, if this is not possible, the criteria used to determine the storage period;
the existence of a right to request rectification or erasure of your personal data, restriction of processing by the controller, or to object to such processing;
the existence of a right to lodge a complaint with a supervisory authority;
all available information about the source of the data, where the personal data are not collected from the data subject;
the existence of automated decision-making, including profiling, pursuant to Art. 22 paras. 1 and 4 GDPR and - at least in these cases - meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You have the right to request information as to whether your personal data are transferred to a third country or an international organisation. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

Right to rectification pursuant to Art. 16 GDPR

You have the right to request rectification and/or completion from the controller if the personal data concerning you that are processed are inaccurate or incomplete. The controller must carry out the rectification without undue delay.

Right to erasure pursuant to Art. 17 GDPR

(1) You may request that the controller erase your personal data without undue delay, and the controller is obliged to erase these data without undue delay if one of the following grounds applies:

The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.
You withdraw your consent, on which the processing was based pursuant to Art. 6 para. 1 lit. a) or Art. 9 para. 2 lit. a) GDPR, and there is no other legal basis for the processing.
You object to the processing pursuant to Art. 21 para. 1 GDPR, and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 para. 2 GDPR.
The personal data concerning you were processed unlawfully.
The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
The personal data concerning you were collected in relation to information society services offered pursuant to Art. 8(1) GDPR.

(2) If the controller has made your personal data public and is obliged to erase it pursuant to Art. 17(1) GDPR, the controller shall, taking account of available technology and the cost of implementation, take reasonable measures, including technical measures, to inform controllers processing the personal data that you, as the data subject, have requested the erasure by them of any links to, or copies or replications of, this personal data.

(3) The right to erasure does not apply insofar as processing is necessary

for the exercise of the right to freedom of expression and information;
for compliance with a legal obligation requiring processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) and Art. 9(3) GDPR;
for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Art. 89(1) GDPR, insofar as the right referred to in paragraph 1 is likely to render the achievement of the objectives of this processing impossible or seriously impair it, or
for the establishment, exercise or defense of legal claims.

Right to restriction of processing pursuant to Art. 18 GDPR

You may request the restriction of processing of your personal data under the following conditions:

if you dispute the accuracy of your personal data for a period enabling the controller to verify the accuracy of the personal data;
the processing is unlawful and you object to the deletion of the personal data and instead request the restriction of the use of the personal data;
the controller no longer needs the personal data for the purposes of processing, but you need it for the establishment, exercise or defense of legal claims, or
if you have objected to the processing pursuant to Art. 21 para. 1 GDPR and it has not yet been determined whether the legitimate grounds of the controller override your grounds.

If the processing of your personal data has been restricted, these data may, apart from being stored, only be processed with your consent or for the establishment, exercise or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State. If the restriction of processing has been restricted under the above-mentioned conditions, you will be informed by the controller before the restriction is lifted.

Right to be informed pursuant to Art. 19 GDPR

If you have asserted your right to rectification, erasure or restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right to be informed by the controller about these recipients.

Right to data portability pursuant to Art. 20 GDPR

You have the right to receive your personal data that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that

the processing is based on consent pursuant to Art. 6 para. 1 lit. a) GDPR or Art. 9 para. 2 lit. a) GDPR, or on a contract pursuant to Art. 6 para. 1 lit. b) GDPR, and
the processing is carried out by automated means. In exercising this right, you also have the right to have your personal data transmitted directly from one controller to another, where technically feasible. The freedoms and rights of other persons must not be adversely affected as a result. The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Right to object pursuant to Art. 21 GDPR

You have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on those provisions. The controller shall no longer process your personal data unless they can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object to processing for direct marketing purposes, your personal data shall no longer be processed for such purposes. You may exercise your right to object in connection with the use of information society services - notwithstanding Directive 2002/58/EC - by automated means using technical specifications.

Right to withdraw consent under data protection law pursuant to Art. 7(3) GDPR

You have the right to withdraw your consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR.

Automated decision-making in individual cases, including profiling

You have the right not to be subject to a decision based solely on automated processing - including profiling - which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

is necessary for entering into or performing a contract between you and the controller,
is permitted by Union or Member State law to which the controller is subject, and that law contains appropriate measures to safeguard your rights and freedoms as well as your legitimate interests, or
is carried out with your explicit consent.

However, these decisions must not be based on special categories of personal data within the meaning of Art. 9(1) GDPR, unless Art. 9(2)(a) or (g) applies and appropriate measures have been taken to safeguard the rights and freedoms as well as your legitimate interests.

With regard to the cases mentioned in a. and c., the controller shall take appropriate measures to safeguard the rights and freedoms as well as your legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your own point of view, and to contest the decision.

Integration of other third-party services and content

Description and purpose

It may happen that this online offering incorporates third-party content, such as videos, fonts, or graphics from other websites. This always requires the providers of this content (hereinafter referred to as “third-party providers”) to be able to see users’ IP addresses. Without the IP address, they could not send the content to the respective user’s browser. The IP address is therefore required to display this content. We endeavor to use only content whose respective providers use the IP address solely to deliver the content. However, we have no influence if third-party providers store the IP address, for example, for statistical purposes. To the extent known to us, we inform users accordingly. Through these integrations, we aim to provide and improve our online offering.

Legal bases

The legal basis for integrating other third-party services and content is Art. 6(1)(f) GDPR. Our overriding legitimate interest lies in presenting our online presence accordingly and in providing user-friendly and economically efficient services. For further information, please refer to the respective privacy notices of the providers.

Contractual or legal obligation to provide personal data

The provision of personal data is neither required by law nor by contract, nor is it necessary to conclude a contract. You are also not obliged to provide the personal data. However, failure to provide it may mean that you cannot use this function, or cannot use it fully.

Data transfers to third countries

The controller may transfer personal data to a third country. In principle, the controller can ensure an adequate level of protection for the processing through various appropriate safeguards. Data transfers may be carried out on the basis of an adequacy decision, binding corporate rules, approved codes of conduct, standard data protection clauses or an approved certification mechanism pursuant to Art. 46(2)(a)–(f) GDPR.

If the controller transfers data to a third country on the legal basis of Art. 49(1)(a) GDPR, you will be informed here about the possible risks of transferring data to a third country.

There is a risk that the third country receiving your personal data may not provide a level of protection equivalent to that afforded to personal data in the European Union. This may be the case, for example, if the European Commission has not adopted an adequacy decision for the third country concerned or if certain agreements between the European Union and the third country concerned are declared invalid. In particular, in some third countries there are risks to the effective protection of EU fundamental rights due to the use of surveillance laws (for example, the USA). In such a case, it is the responsibility of the controller and the recipient to assess whether the rights of data subjects in the third country enjoy a level of protection equivalent to that in the Union and can also be effectively enforced.

However, the level of protection for natural persons guaranteed throughout the Union by the General Data Protection Regulation must not be undermined when personal data are transferred from the Union to controllers, processors or other recipients in third countries or to international organisations, including where personal data are onward transferred from a third country or an international organisation to controllers or processors in the same or another third country or to the same or another international organisation.

Additional website functions

Data recipients

Where legally permitted or required, or where you have given your consent, we also share your personal data with other recipients who provide services for us. We limit the disclosure of your personal data to what is necessary. In some cases, our service providers receive your personal data as data processors and are then strictly bound by our instructions when handling your personal data (data processing agreement pursuant to Art. 28 GDPR). In some cases, the recipients act independently with the data we transmit to them. The following categories of service providers/recipients may receive your data:

Providers of email marketing via newsletters
Providers of hosting services for the operation of our servers
Service providers in the area of applications to support the selection of applicants
Service providers for development work, including programming, development, maintenance, and support of software applications
Postal service providers
External legal advisors
Marketing agencies / website support
Other IT service providers (e.g., IT systems companies)
Other Services and Tools

The service providers commissioned by us must meet strict confidentiality requirements. They are granted only the access to your data required to perform their assigned tasks.

In the event of suspected criminal activity, data may be disclosed to law enforcement authorities.

Security

We have implemented extensive technical and operational safeguards to protect your data from accidental or deliberate manipulation, loss, destruction, or access by unauthorized persons. Our security procedures are reviewed regularly and adapted to technological developments. In addition, data protection is continuously ensured through ongoing auditing and optimization of our data protection organization.

Conclusion

Femtis Power GmbH reserves all rights to make changes and updates to this privacy policy. This privacy policy was created by the data protection management system as part of hellotrust, a brand of Keyed GmbH.