Information on data protection

Responsible body
Raumschmiede GmbH
Lange Gwand 1
86682 Genderkingen
Germany
Tel.: +49 (0) 9090 57490-0
Mail: info@garten-und-freizeit.shop

Personal data
Personal data is information about you. This includes your name, address, and email address. You do not have to disclose any personal information to visit our website. In some cases, we require your name and address, as well as other information, in order to provide you with the requested service.

The same applies if we provide you with informational material upon request or if we answer your inquiries. In these cases, we will always inform you. Furthermore, we only store the data you have provided to us automatically or voluntarily.

When you use one of our services, we generally only collect the data necessary to provide our service to you. We may ask you for additional information, but this is voluntary. Whenever we process personal data, we do so to provide our service to you or to pursue our commercial goals.

Safety precautions
We have taken technical and administrative security measures to protect your personal data against loss, destruction, manipulation, and unauthorized access. All our employees and service providers working for us are obligated to comply with applicable data protection laws.

Whenever we collect and process personal data, it is encrypted before transmission. This means your data cannot be misused by third parties. Our security measures are subject to continuous improvement, and our privacy policies are constantly being revised. Please ensure you have the most up-to-date version.

Automatically saved data
Server log files:

The website provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us.

This includes:

Date and time of the request
Name of the requested file
Page from which the file was requested
Access status (file transferred, file not found, etc.)
web browser and operating system used
full IP address of the requesting computer
amount of data transferred
This data will not be merged with other data sources. Processing is carried out in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website.

For reasons of technical security, in particular to ward off attempted attacks on our web server, we store this data briefly. It is not possible for us to identify individual people based on this data. After seven days at the latest, the data is anonymized by shortening the IP address at the domain level, so that it is no longer possible to establish a connection to the individual user. In anonymized form, the data is also processed for statistical purposes; there is no comparison with other databases or disclosure to third parties, even in excerpts.

Customer account
For each customer who registers, we provide password-protected direct access to their stored customer data (customer account). Here, you can view information about your completed, open, and recently shipped orders, as well as manage your address, bank details, and newsletter. You agree to treat your personal access data confidentially and not to disclose it to unauthorized third parties. We cannot accept liability for misused passwords unless we are responsible for the misuse.

With the “Stay logged in” function, we want to make your visit to our website as pleasant as possible. This function allows you to use our services without having to log in each time. However, for security reasons, you will be asked to enter your password again if, for example, you want to change your personal data or place an order. We recommend that you do not use this function if the computer is used by multiple users. Please note that the “Stay logged in” function is not available if you use a setting that automatically deletes stored cookies after each session.

Collection, processing and use of your personal data
Data protection is very important to us. Therefore, when collecting, processing, and using your personal data, we strictly adhere to the legal provisions of the Federal Data Protection Act and the Telemedia Act. We collect, store, and process your data for the entire processing of your purchase, including any subsequent warranties, for our services, technical administration, and our own marketing purposes. Your personal data will only be passed on or otherwise transmitted to third parties if this is necessary for the purpose of contract execution or billing, or if you have previously consented. As part of the order processing, for example, the service providers we use here (such as carriers, logistics providers, banks) receive the necessary data for order and order processing. The data passed on in this way may only be used by our service providers to fulfill their tasks. Any other use of the information is not permitted and will not be carried out by any of the service providers commissioned by us.

For your order, we need your correct name, address, and payment details. We need your email address so we can confirm receipt of your order and communicate with you. We also use this for your identification (customer login). You will also receive your order and shipping confirmations via your email address.

Your personal data will be deleted unless statutory retention periods prevent this and if you have asserted a right to deletion, if the data is no longer required to fulfil the purpose for which it was stored or if its storage is not permitted for other legal reasons.

Definition of cookies
When you visit our website, we may store information on your computer in the form of cookies. Cookies are small files that are transferred from an internet server to your browser and stored on its hard drive. Only the internet protocol address is saved – no personal data. This information stored in the cookies allows us to automatically recognize you the next time you visit our website, making it easier for you to use. The legal basis for the use of cookies is our legitimate interest pursuant to Art. 6 (1) (f) GDPR.

Of course, you can also visit our website without accepting cookies. If you do not want your computer to be recognized the next time you visit, you can also refuse the use of cookies by changing your browser settings to “Reject cookies.” You can find out how to do this in your browser’s user manual. However, if you refuse cookies, this may limit your ability to use some areas of our website.

Information about services, cookies and technologies used
This privacy policy provides an overview of the services, cookies, and technologies we use. Please note that this list is not exhaustive. The lists in this privacy policy and in the integrated consent manager on this site complement each other to provide you with the most comprehensive information possible.

You can easily access the Consent Manager at any time by clicking on the “Cookie Settings” link at the bottom of every page. There you can not only view details about the cookies currently in use but also adjust your personal settings.

In this way, we ensure that you are always transparently and comprehensively informed about the use of cookies and other technologies on our web shop.

Our online presence on Facebook, Instagram, Pinterest, Threads
Our presence on social networks and platforms serves to improve and actively communicate with our customers and interested parties. We provide information there about our products and current special offers.
When you visit our online presence on social media, your data may be automatically collected and stored for market research and advertising purposes. So-called user profiles are created from this data using pseudonyms. These can be used, for example, to place advertisements within and outside the platforms that presumably correspond to your interests. Cookies are generally used on your device for this purpose. Visitor behavior and user interests are stored in these cookies. According to Art. 6 (1) (f) GDPR, this serves to safeguard our legitimate interests, which prevail within the framework of a balancing of interests, in an optimized presentation of our offering and effective communication with customers and interested parties. If you are asked by the respective social media platform operators for consent (consent) to data processing, e.g. using a checkbox, the legal basis for data processing is Art. 6 (1) (a) GDPR.
For detailed information on how the providers process and use data on their websites, as well as how to contact them and your rights and settings options to protect your privacy, in particular opt-out options, please see the providers’ privacy policy linked below.
Threads is provided by Meta Platforms Ireland Limited and is part of Instagram. Threads allows Instagram users to create a Threads profile as part of their Instagram account and then share, view, and interact with content in the Threads app and on the Threads website (“Threads”). Alternatively, users can use Threads without creating a profile and still have access to the basic functionality of Threads. The use of Threads, whether with or without a profile, is subject to the Threads Terms of Use .

Email advertising with newsletter registration
If you subscribe to our newsletter, we will use the data required for this purpose or separately provided by you to regularly send you our e-mail newsletter based on your consent in accordance with Art. 6 (1) (a) GDPR.

You can unsubscribe from the newsletter at any time. You can do so either by sending a message to the contact option described below or via a link provided for this purpose in the newsletter. After unsubscribing, we will delete your email address unless you have expressly consented to further use of your data or we reserve the right to use the data in any other way that is permitted by law and about which we will inform you in this policy.

See also the entry ” Emarsys ” above on this page.

E-mail advertising without registration for the newsletter and your right of objection
If we receive your email address in connection with the sale of a product or service and you have not objected, we reserve the right, pursuant to Section 7 (3) of the German Unfair Competition Act (UWG), to regularly send you offers for products from our range similar to those you have already purchased. This serves to protect our legitimate interest in addressing our customers with advertising, which prevails within the framework of a balancing of interests.
You can object to this use of your email address at any time by sending a message to the contact option described below or via a link provided for this purpose in the advertising email, without incurring any costs other than the transmission costs according to the basic rates.

The newsletter will be sent on our behalf by a service provider to whom we will pass on your email address for this purpose.

This service provider is located within a country of the European Union or the European Economic Area.

See also the entry ” Emarsys ” above on this page.

Competition with newsletter registration
If you register for a competition with us, we will use your personal data to process and administer the competition. The legal basis for this is Art. 6 (1) (b) GDPR (contractual relationship). Further information about the competitions can be found in the terms and conditions, which you must accept if you wish to participate.

By providing your email address, you accept the terms and conditions of participation in accordance with Art. 6 (1) (b) GDPR and agree to subscribe to the Garden and Leisure newsletter for marketing purposes via email. I can unsubscribe from the newsletter at any time by sending an email to datenschutz@raumschmiede.de . The privacy policy can be found here .

Postal advertising and your right to object
We reserve the right to use your first and last name, as well as your postal address, for our own advertising purposes, e.g., to send you interesting offers and information about our products by post. This serves to protect our legitimate interests, which prevail within the context of a balancing of interests, in addressing our customers with advertising in accordance with Art. 6 (1) (f) GDPR.

The advertising mailings are processed on our behalf by a service provider to whom we share your data for this purpose.
You can object to the storage and use of your data for these purposes at any time by sending a message to the contact option described below.

Payment service providers
Amazon Pay
If you choose to pay with “Amazon Pay” as part of your order process, your personal data will be transmitted to Amazon Payments Europe sca as well as Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, all four companies located at 5 Rue Plaetis L 2338 Luxembourg (Amazon Payments). Amazon Payments acts as an online payment service provider and trustee.
The transmission of your data is necessary for payment processing via Amazon Payments and is used to confirm your identity and administer your payment instruction. Processing the purchase contract also requires the transmission of personal data related to the respective order (such as the number of items, item number, invoice amount, taxes, and other invoice information).
Amazon Payments reserves the right to conduct a credit check. The purpose of this credit check is to prevent payment defaults or fraud. Amazon Payments uses the result of the credit check in relation to the statistical probability of default to decide whether to provide the respective payment method. The credit report may contain probability values (so-called score values). To the extent that score values are included in the result of the credit report, these are based on a scientifically recognized mathematical-statistical procedure. Address data, among other things, is used in the calculation of the score values.
In addition, Amazon Payments is entitled to transmit your data to third parties (such as banks, service partners, analysis services, credit agencies, marketing partners, cloud service providers, retargeting providers, affiliated companies).
You have the option of revoking your consent to the processing of your personal data by Amazon Payments at any time. However, the revocation of consent does not affect the legality of the processing carried out on the basis of the consent up to the time of revocation, provided that the personal data must be processed, used, or transmitted for contractual payment processing.

Further data protection information about Amazon Payments can be found here: https://pay.amazon.de/help/201751600

Amazon Payments also processes your personal data in the USA . This is based on EU Standard Contract Clauses ( SCCs), which guarantee an appropriate level of data protection for data processing taking place in the USA .

Klarna
In order to offer you Klarna’s payment options, we will transmit personal data, such as contact details and order data, to Klarna. This allows Klarna to assess whether you are eligible for the payment options offered through Klarna and to tailor the payment options to your needs. General information about Klarna can be found at https://www.klarna.com/de/ . Your personal data will be treated by Klarna in accordance with applicable data protection regulations and in accordance with the information in Klarna’s privacy policy .

Adyen
Payments by credit or debit card are processed through our payment gateway provider, Adyen BV, Simon Carmiggeltstraat 6—50, 5th floor, 1011 DJ Amsterdam, the Netherlands (“Adyen”). If you choose to pay by credit or debit card, you will be required to provide personal information, such as your credit card number, to our payment service provider, Adyen. You transmit your credit or debit card information directly to Adyen. Information you provide to Adyen is not under our control and is subject to Adyen’s privacy policy, available here: https://www.adyen.com/privacy-policy .

We do not store credit card numbers at any time.

Apple Pay
If you choose to pay with Apple Pay during the ordering process, payment processing will be handled by the payment service provider Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA. To process the payment, Apple Pay uses the payment data stored in your Apple Wallet app (e.g., credit card or bank information) as well as device-specific information to authorize and complete the transaction.

Apple only processes the information necessary for payment processing and uses technical and organizational measures to protect your data, such as on-device tokenization and two-factor authentication. As part of the payment processing, Apple may be required to transfer personal data to your bank or other financial service providers involved in the payment.

Apple Inc. is based in the USA, so your personal data may be processed outside the European Union or the European Economic Area (EEA). For the USA, the European Commission has issued an adequacy decision within the framework of the EU-US Data Privacy Framework (DPF), to which Apple Inc. has acceded. This ensures an appropriate level of data protection within the meaning of Articles 44 et seq. of the GDPR.

Your personal data will be processed in accordance with Art. 6 (1) (b) GDPR to fulfill the contractual relationship and to process payments.

Further information on data protection with Apple Pay can be found at:
https://www.apple.com/de/legal/privacy/data/de/apple-pay/
and in Apple’s general privacy policy:
https://www.apple.com/de/legal/privacy/

Payment processing with credit check
We use the following service providers to process payments with credit checks:

Klarna GmbH
Theresienhöhe 12
80339 Munich
Germany

Payment methods offered on this website: Purchase on account, direct debit, installment purchase
Provider’s website: https://www.klarna.com/de/
Provider’s privacy policy: https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/privacy
Contact options: https://www.klarna.com/de/kundenservice/

In order to offer you the best possible payment options, we need to protect you and ourselves from misuse. The payment provider may therefore conduct a credit check based on the personal data you provide.

These will perform a corresponding assessment (scoring) of the statistical probability of a payment default based on mathematical and statistical methods. The following data will be used for this purpose:

• First and last name
• Complete billing address from the order
• Contact details such as email address
• Order/receipt number
• Customer number
• Receipt date
• Selected payment method
• Ordered individual items
• Individual prices, total prices per item, total price and tax share

In the event of a positive credit check, your chosen payment provider assumes the risk of non-payment. For this purpose, the transmitted data is used and stored by the service provider. After the payment has been processed, the transmitted data is deleted in accordance with the statutory retention periods.

If the payment provider’s credit check is negative, the payment method(s) offered by that provider will no longer be displayed. However, you can always pay with “Prepayment by Bank Transfer.”

In this case, your data submitted for credit check will be deleted immediately.

A credit check will only be performed if you select one of the payment methods offered by the payment providers listed above. If you do not wish to do this, you will be offered the option of “advance payment via bank transfer.”

You can object to the storage and use of your personal data by the listed payment providers and their service providers with effect for the future. To do so, contact the payment service providers listed above directly.

There is no need to transfer your data to the payment service provider. However, please note that in this case, the only payment method available to you is “advance payment via bank transfer.” This is handled directly by the shop operator, Raumschmiede GmbH. Your data will not be shared in this case.

Rights of those affected
Please contact us at any time if you would like to learn what personal data we store about you, or if you would like to have it corrected or deleted. Furthermore, you have the right to restriction of processing (Art. 18 GDPR), the right to object to processing (Art. 21 GDPR), and the right to data portability (Art. 20 GDPR).

In these cases, please contact us directly.

Changes to this privacy policy
We reserve the right to change our privacy policy if this should become necessary due to new technologies. Please ensure you have the most recent version. If we make any material changes to this privacy policy, we will post them on our website.

Our data protection officer
All interested parties and visitors to our website can contact our data protection officer at any time for further data protection questions:

Mr. Christian Volkmer
Projekt 29 GmbH & Co. KG
Ostengasse 14
93047 Regensburg
Germany
Tel.: +49 941 2986930
E-Mail: anfragen@projekt29.de
Internet: https://projekt29.de

If our data protection officer is unable to answer your request to your satisfaction, you retain the right to lodge a complaint with the data protection supervisory authority responsible for your federal state.

Information obligations according to Art. 13 GDPR
We would like to inform you comprehensively about the processing of your data in our company and the data protection claims and rights to which you are entitled within the meaning of Art. 13 of the European General Data Protection Regulation (EU GDPR).

1. Who is responsible for data processing and who can you contact?
   Responsible is
   Raumschmiede GmbH
   Lange Gwand 1
   86682 Genderkingen
   Germany
   Tel.: +49 (0) 9090 57490-0
   E-Mail: info@garten-und-freizeit.shop

The company data protection officer is
Christian Volkmer
Projekt 29 GmbH & Co. KG
Ostengasse 14
93047 Regensburg
Germany
E-Mail: anfragen@projekt29.de
Tel.: +49 941-2986930

2. What data is processed and from which sources does this data come?
   We process the data that we have received from you in the context of initiating or processing a contract, based on consent or in the context of your application to us or in the context of your employment with us.

Personal data includes:
your master/contact data, for example, for customers this includes first and last name, address, contact details (email address, telephone number, fax), bank details.

For applicants and employees, this includes, for example, first and last name, address, contact details (email address, telephone number, fax), date of birth, data from CV and employment references, bank details, religious affiliation, photographs.

For business partners, this includes, for example, the name of their legal representatives, company name, commercial register number, VAT number, company number, address, contact details (email address, telephone number, fax), bank details.

For visitors to our company, this includes name and signature.

For journalists, this includes first and last name, email address, and fax number.

For competition participants, this includes first and last name and email address.

In addition, we also process the following other personal data:

Information about the type and content of contract data, order data, sales and document data, customer and supplier history as well as consulting documents,
Advertising and sales data,
Information from your electronic communication with us (e.g. IP address, log-in data),
other data that we have received from you in the context of our business relationship (e.g. in customer discussions),
Data that we generate ourselves from master / contact data and other data, such as customer needs and customer potential analyses,
the documentation of your declaration of consent for receiving e.g. newsletters.
Photographs taken during events.

3. For what purposes and on what legal basis is the data processed?
   We process your data in accordance with the provisions of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act 2018 in its currently valid version:

To fulfill (pre-)contractual obligations (Article 6 (1) (b) GDPR):
Your data is processed for contract processing online or in one of our branches, and for contract processing with your employees within our company. The data is processed in particular when initiating business and executing contracts with you.
to fulfill legal obligations (Article 6 (1) (c) GDPR):
Processing of your data is necessary for the purpose of fulfilling various legal obligations, e.g. from the Commercial Code or the Tax Code.
To protect legitimate interests (Article 6 (1) (f) GDPR):
Based on a balancing of interests, data processing may be carried out beyond the actual fulfillment of the contract to protect the legitimate interests of us or third parties. Data processing to protect legitimate interests occurs, for example, in the following cases:

• Advertising or marketing (see No. 4),
• Measures for business management and the further development of services and products;
• Maintaining a group-wide customer database to improve customer service
• In the context of legal proceedings
• Sending non-promotional information and press releases.

within the scope of your consent (Art. 6 (1) (a) GDPR):
If you have given us your consent to process your data, e.g. to send you our newsletter, publish photos, hold competitions, etc.

4. Processing of personal data for advertising purposes
   You can object to the use of your personal data for advertising purposes at any time, in whole or in part, without incurring any costs other than the transmission costs according to the basic rates.
   Under the legal requirements of Section 7 Paragraph 3 of the Unfair Competition Act (UWG), we are entitled to use the email address you provided when concluding the contract for direct advertising of our own similar goods or services. You will receive these product recommendations from us regardless of whether you have subscribed to a newsletter.
   If you do not wish to receive such recommendations from us by email, you can object to the use of your address for this purpose at any time without incurring any costs other than the transmission costs according to the basic rates. A notification in text form is sufficient for this purpose. Of course, every email always contains an unsubscribe link.
5. Who receives my data?
   If we use a service provider for contract processing, we remain responsible for the protection of your data. All contract processors are contractually obligated to treat your data confidentially and to process it only within the scope of the service provision. The contract processors commissioned by us will receive your data if they need the data to fulfill their respective services. These include, for example, IT service providers that we need for the operation and security of our IT system, as well as advertising and address publishers for our own advertising campaigns.
   Your data is processed in our customer database. The customer database supports the improvement of the data quality of existing customer data (duplicate removal, moved/deceased indicators, address corrections) and enables enrichment with data from public sources.
   If there is a legal obligation or in the context of legal prosecution, authorities and courts as well as external auditors may be recipients of your data.
   In addition, insurance companies, banks, credit agencies and service providers may be recipients of your data for the purpose of initiating and fulfilling contracts.
6. How long will my data be stored?
   We process your data until the end of the business relationship or until the expiration of the applicable statutory retention periods (e.g., those stipulated in the German Commercial Code, the Tax Code, or the Working Hours Act); and furthermore, until the end of any legal disputes in which the data is required as evidence.
7. Is personal data transferred to a third country?
   As a general rule, we do not transfer any data to third countries. In individual cases, transfers will only occur on the basis of an adequacy decision of the European Commission, standard contractual clauses, appropriate safeguards, or your express consent.
8. What data protection rights do I have?
   You have the right to information, correction, deletion or restriction of the processing of your stored data at any time, the right to object to the processing as well as the right to data portability and to lodge a complaint in accordance with the requirements of data protection law.

Right to information:
You can request information from us as to whether and to what extent we process your data.

Right to rectification:
If we process your data that is incomplete or incorrect, you can request that we correct or complete it at any time.

Right to erasure:
You can request that we delete your data if we process it unlawfully or if the processing disproportionately interferes with your legitimate interests. Please note that there may be reasons that prevent immediate deletion, e.g., in the case of statutory retention periods.
Regardless of your exercise of your right to erasure, we will delete your data immediately and completely, unless there is a contractual or statutory retention period to the contrary.

Right to restriction of processing:
You can request that we restrict the processing of your data if

You dispute the accuracy of the data for a period that enables us to verify the accuracy of the data.
the processing of the data is unlawful, but you refuse to delete it and instead request a restriction of data use,
we no longer need the data for the intended purpose, but you still need this data to assert or defend legal claims, or
You have objected to the processing of your data.
Right to data portability:
You can request that we provide you with the data you have provided to us in a structured, common and machine-readable format and that you can transmit this data to another controller without hindrance from us, provided that

we process this data based on your consent which can be revoked or to fulfil a contract between us, and
this processing is carried out using automated procedures.
If technically feasible, you can request that we transmit your data directly to another controller.

Right of objection:
If we process your data based on legitimate interests, you can object to this data processing at any time; this would also apply to profiling based on these provisions. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims. You can object to the processing of your data for direct marketing purposes at any time without giving reasons.

Right to complain:
If you believe that we are violating German or European data protection law in the processing of your data, please contact us so that we can clarify any questions. You also have the right to contact the supervisory authority responsible for you, the relevant state data protection supervisory authority.
If you wish to assert one of the aforementioned rights against us, please contact our data protection officer. In case of doubt, we may request additional information to confirm your identity.

9. Am I obliged to provide data?
   The processing of your data is necessary for the conclusion or fulfillment of the contract you have entered into with us. If you do not provide us with this data, we will generally have to refuse to conclude the contract or will no longer be able to perform an existing contract and will therefore have to terminate it. However, you are not obligated to consent to the processing of data that is not relevant for the fulfillment of the contract or is not required by law.