Privacy Policy

Registered Office:

Kärcher Ireland Ltd, Redcow Retail Centre, Robinhood Road, Dublin 22, D22 PY03, Ireland

Tel. 353 1 409 7777

E-mail: info@ie.karcher.com

Board of Management:

• Hartmut Jenner (CEO)
• Christian May (Deputy CEO)
• Stefan Patzke
• Marco Cardinale
• Markus Limberger
• Mark Venner
• Simon Keeping

Chairwoman of the Supervisory Board:

• Franziska Kärcher

(Hereinafter referred to as ‘Kärcher’) carries out all data processing operations (e.g. collection, processing and transfer) in accordance with the statutory regulations.

The following Privacy Policy provides an overview of which types of data are collected on and via our website and how they are used and transmitted, which security measures Kärcher takes to protect your data and how you can exercise your rights.

If you have any questions regarding data protection or your rights, please contact our data protection officer:

Kärcher UK Limited

Chief Operating Officer, Mark Venner

Kärcher House, Brookhill Way, BANBURY, OX16 3ED

Phone: 01295 752000

Email: data.officer@karcher.co.uk

1. Scope of the processing of personal data

Unless otherwise stated, we process your personal data as a visitor to our website (hereinafter referred to as the ‘Data Subject’) in order to be able to make available and provide you with a functional and visitor-friendly website as well as our content and services.

2. Legal basis for the processing of personal data

Legal basis for the processing of personal dataTo the extent that we obtain the consent of the Data Subject for personal data processing operations, Article 6 (1) lit. a. General Data Protection Regulation (GDPR) serves as the legal basis.

Article 6 (1) lit. b. GDPR serves as the legal basis for processing the personal data required for the performance of a contract to which the Data Subject is party. This is also the case for the processing operations required for carrying out pre-contractual measures.

To the extent that the processing of personal data is required for compliance with a legal obligation to which our company is subject, Article 6 (1) lit. c. GDPR serves as the legal basis.

If the processing is necessary to protect a legitimate interest of our company or a third party, and if the interests, fundamental rights and freedoms of the Data Subject do not outweigh the former interest, Article 6 (1) lit. f. GDPR serves as the legal basis for the processing.

3. Data erasure and storage period

The personal data of the Data Subject shall be erased or blocked as soon as the purpose of storage no longer applies.

Data may be stored beyond this period if this has been provided for by the European or national legislator in EU regulations, laws or other regulations to which the Controller is subject. The data shall also be blocked or erased once a storage period prescribed by the standards mentioned expires, unless there is a need for further storage of the data to enter into or perform a contract.

1. Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the accessing computer system.

The following data are collected in this regard:

• date and time of the request;
• name of the requested file;
• page from which the file was requested;
• access status (transfer file, file not found, etc.);
• web browser and operating system used;
• complete IP address of the requesting computer;
• volume of data transmitted.

The data are also stored in our system’s log files. These data are not stored together with the visitor’s other personal data.

2. Legal basis for data processing

The legal basis for the temporary storage of data and log files is Article 6 (1) lit. f. GDPR.

3. Purpose of the data processing

The temporary storage of the IP address by the system is necessary in order to deliver the website to the visitor's computer. For this purpose, the visitor’s IP address must remain stored for the duration of the session.

Storage in log files takes place to ensure the functionality of the website. In addition, we use the data to optimise the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.

These purposes also form the basis for our legitimate interest in data processing in accordance with Article 6 (1) lit. f GDPR.

4. Duration of storage

The data will be erased as soon as they are no longer required to achieve the purpose for which they were collected. In the case of data collection for the provision of the website, this is the case when the respective session has ended. If the data are stored in log files, this is the case after thirty days at the latest.

Within our checkout process we use the shop system of the service provider Shopify International Limited, Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (hereinafter referred to as ‘Shopify’), for the purpose of hosting and displaying the online shop on the basis of processing on our behalf. All data collected on our website which is necessary for the order processing is processed on Shopify's servers. As part of the aforementioned services provided by Shopify, data may also be transferred to Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada, Shopify Data Processing (USA) Inc., Shopify Payments (USA) Inc. or Shopify (USA) Inc. for further processing. In the event of data being transmitted to Shopify Inc. in Canada, the European Commission's adequacy decision ensures an adequate level of data protection. Further information on Shopify's data protection can be found at the following website: https://www.shopify.com/legal/privacy

Any further processing on servers other than those mentioned above will only take place within the scope specified below.

1. Description and scope of data processing

Contact forms are provided on our website that can be used to contact us electronically. If a visitor makes use of this option, the data entered in the input mask shall be transmitted to us and stored.

Alternatively, you can contact us using the email addresses provided. In this case, the visitor’s personal data transmitted with the email shall be stored.

2. Legal basis for data processing

If your contact via the contact form aims to enter into or perform a contract, the legal basis for the processing is Art. 6 (1) lit. b GDPR.

The legal basis for the processing of the data is Art. 6 (1) lit. a. GDPR if the visitor has given their consent, otherwise it is our legitimate interest (Art. 6 (1) lit. f. GDPR).

3. Purpose of the data processing

The processing of personal data from the input mask serves solely to enable us to process the communication. In the case of contact by email, this also constitutes the necessary legitimate interest in processing the data.

The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

4. Disclosure to third parties

If we are not the right contact partner for the respective enquiry (e.g. for the specific product requested), we shall forward the enquiry with the data provided to the respective Kärcher Group company for response.

The respective company shall then answer your enquiry, if necessary.

5. Duration of storage

The data shall be erased 180 days after transmission.

The personal data additionally collected during the sending process shall be erased after a period of seven days at the latest.

Description, scope and purpose of data processing

If the user opens a customer account and provides personal data, we will use this data for opening the customer account and for the execution of the contract. The data collected can be seen from the respective input forms. The customer can delete the account at any time by sending a message to the above address of the person responsible. We store and use the data you provide for the purpose of processing the contract. After complete processing of the contract or deletion of your customer account, your data will be blocked with due regard to tax and commercial law retention periods and deleted after expiry of these periods, unless you have expressly consented to further use of your data or a legally permitted further use of data has been reserved by our site.

Legal basis for data processing

The legal basis for the temporary storage of data and log files is Article 6 (1) lit. b GDPR.

Duration of storage

The data will be erased as soon as they are no longer required to achieve the purpose for which they were collected.

Description and scope of data processing

a) Subscribing to our newsletter

On our website you have the option to subscribe to a free newsletter. When you register for the newsletter, the data you enter on the input screen (title, first and last name, email address, newsletter preferences) are transmitted to us and stored.

In addition, the following data are collected when registering:

• Date and time of the registration

As part of the registration process, your consent is obtained for the processing of the data and reference is made to this Privacy Policy.

Once you have subscribed to our newsletter, we will regularly send you information on our promotions, offers and services by email (including reminders for any checkout abandonment in our online shop). We use the double opt-in procedure to send the newsletter. This means that we will only send you an email newsletter once you have expressly given your consent to receive it. We will then send you a confirmation email in which you will be requested to confirm that you wish to receive the newsletter in future by clicking on a corresponding link. Unconfirmed profiles are deleted in the system after 3 months.

If you subscribe to the newsletter on certain forms (e.g. the product registration form "Register & Win", warranty extensions, checkout from the online shop) or if you have subscribed the newsletter in the past, the information from this form as well as your online shop purchase history will be added to your existing newsletter profile or used as a basis for creating a new newsletter profile. This information is used to personalise newsletters in order to provide you with the most suitable information on our promotions, offers and services.

b) Newsletter for existing commercial customers

If you have bought products or services from us and you were informed of your right of objection when your email address was collected and upon each use, we may process your email address available to us in order to send you regular information about our promotions, offers and services by email (Regulation 13(11) of the ePrivacy Regulations 2011 (S.I. No. 336 of 2011)). You can object to this advertising use of your e-mail address at any time (e.g. by clicking on the objection option or by e-mail) without incurring any costs other than the transmission costs according to the basic rates.

c) Measuring opening and click rates

To improve our newsletters, we measure opening and click rates. To do this, the newsletters contain a pixel-sized file (a so-called tracking pixel), which is retrieved from our server or that of our mailing service provider when the newsletter is opened. As part of the retrieval process, technical information, such as information about the browser you are using and your system as well as the time of retrieval, will first be collected.

This information is used to improve our newsletter from a technical perspective based on the technical data or the target groups and their reading behaviour. This analysis also includes determining whether the newsletters are opened, when they are opened, and which links are clicked on. This information is assigned to the respective recipient and stored in their profile. We use these analyses to identify the reading habits of our visitors and adapt our content to suit them or to send different content that aligns with our visitors’ interests.

Unless otherwise stated, no data will be passed on to third parties outside the Kärcher Group in connection with the data processing for sending the newsletters. The data are used solely to send the newsletter.

Legal basis for data processing

The legal basis for the processing of data after subscribing to the newsletter is the user granting their consent under Art. 6 (1) lit. a GDPR.

The legal basis for processing the data of existing customers or for adding form or product data as from chapter 1.a) is our legitimate advertising interests (Art. 6 (1) lit. f GDPR in conjunction with Regulation 13(11) of the ePrivacy Regulations 2011 (S.I. No. 336 of 2011)) in sending interest-based advertising.

Purpose of the data processing

The visitor's email address is collected in order to deliver the newsletter. The other personal data collected as part of the registration process is used to prevent misuse of the services or of the email address used.

Duration of storage

The data will be erased as soon as they are no longer required to achieve the purpose for which they were collected. Therefore, the visitor's email address will be stored for as long as the subscription to the newsletter remains active. Your email address will be blocked and erased from our newsletter mailing list after four weeks once you have unsubscribed, unless you have expressly consented to the further use of your data or if we reserve the right to use your data beyond this scope in a manner which is permitted by law and about which we have informed you in this Policy.

Possibility of revocation (if consent has previously been granted) and objection (in the case of Regulation 13(11) of the ePrivacy Regulations 2011 (S.I. No. 336 of 2011))

The data subject can revoke consent to the sending of the newsletter at any time. To this end, a corresponding unsubscribe link can be found in each newsletter.

Otherwise, the data subject may object to processing based on legitimate interests (Art. 6 para.1 lit.f GDPR) at any time by sending an email to paul.carroll@karcher.com.

Wisepops

We use the Wisepops service on our website, provided by Wisepops SAS, 17 rue de la Pompe, 75116 Paris, France.

1. Description, purpose and scope of data processing

Wisepops is a marketing tool we use to display targeted information, offers, or registration forms (e.g., for newsletters) to you in the form of pop-ups, banners, or on-site notifications. When you visit our website and have given your consent, the tool collects interaction data (e.g., which pop-ups you have seen or clicked), your IP address (usually shortened/anonymized), browser type, operating system, and approximate location. If you actively enter data into a Wisepops form (e.g., your email address), this data will also be processed. The purpose of this processing is to optimize our marketing efforts, increase the conversion rate, and ensure user-friendly information delivery.

2. Legal basis for data processing

The legal basis for processing personal data using Wisepops is your explicit consent in accordance with [relevant legal provisions].Article 6 paragraph 1 letter a GDPR. This consent is given voluntarily via the cookie banner (consent management tool) displayed when accessing the website.

3. Recipients of personal data

The recipient of the data is Wisepops SAS, acting as a data processor. We have concluded a data processing agreement (DPA) with Wisepops, in which the provider commits to processing our users' data only according to our instructions and in compliance with GDPR standards.

4. Duration of storage, right to object and erasure

The cookies set by Wisepops have different storage durations, depending on their specific function (e.g., session management or recognition of returning visitors). You can find the exact storage duration for each individual cookie directly in the cookie list in our consent management tool.

The processed data will be deleted as soon as it is no longer needed for the purpose for which it was collected or you withdraw your consent. You can withdraw your consent at any time with effect for the future via the cookie settings on our website or by manually deleting the cookies in your browser.

Description, scope and purpose of data processing

In order to process the order of the customer, we work together with the several service provider(s), who support us in whole or in part in the execution of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

The personal data collected by us will be passed on to the transport company commissioned with the delivery as part of the contract processing, insofar as this is necessary for the delivery of the goods. We will forward your payment data to the commissioned credit institution as part of the payment processing, provided this is necessary for the payment processing. If payment service providers are used, we will explicitly inform you of this below. The legal basis for the forwarding of the data is Art. 6 (1) lit. b GDPR.

Legal basis for data processing

The legal basis for the temporary storage of data and log files is Article 6 (1) lit. b GDPR.

Duration of storage

The data will be erased as soon as they are no longer required to achieve the purpose for which they were collected.

Google Analytics

On our website, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google").

1. Purpose of Data Processing

Google Analytics 4 allows us to analyze the interactions of website visitors. As the website operator, we receive various usage data, such as page views, duration of visit, operating systems used, and the user's origin. This data is aggregated by Google and assigned to a respective user or their device. The main purpose is to evaluate the use of our website, compile reports on website activities, and optimize our services.

2. Data Protection through IP Anonymization

In Google Analytics 4, IP anonymization is enabled by default. Google Analytics 4 does not log or store individual IP addresses. The service uses IP addresses only briefly to derive general geographic location data (such as city and country) and then discards them immediately. At no time is your full IP address stored on a disk. According to Google, the IP address transmitted by your browser is not merged with other Google data.

3. Data Transfer to the USA

A transfer of data to Google LLC in the USA cannot be ruled out. From the perspective of European data protection law, the USA is a third country without an adequate level of data protection. For data transfers to the USA, Google relies on the Standard Contractual Clauses of the European Commission, which are intended to ensure an adequate level of data protection.

4. Legal Basis

The use of Google Analytics 4 is based on your consent pursuant to Art. 6(1)(a) GDPR. You grant this consent via our cookie consent banner.

5. Revocation of Your Consent

You can revoke your consent at any time with future effect by adjusting your preferences in our cookie settings. Furthermore, you can generally prevent the collection and processing of data by Google by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

Integration of media data through Cliplister

1. Description, purpose and scope of data processing

Our website uses interfaces to the services of Cliplister GmbH, Schauenburgerstrasse 116, 24114 Kiel, Germany (‘Cliplister’).

Cliplister is a professional enterprise cloud infrastructure from Germany for the organisation, processing and distribution of media data such as images, videos, audio, PDFs or 3D content. The content is stored on Cliplister and integrated into our website and can be played or accessed directly from our website.

If you access a corresponding website of our offering, we establish a connection to Cliplister via web interfaces in order to provide you with such content in the best possible way. Here, your IP address and device-specific information are transmitted to Cliplister for the purpose of optimal and legally secure presentation of the content, and recorded by Cliplister in an encrypted and anonymised form.

2. Legal basis for data processing

The use is based on our legitimate interests, i.e. interest in the secure and efficient provision of media data in accordance with Art. 6 (1) lit. f. GDPR.

3. Third-party information

For more information about advertising technology, see Cliplister's data protection provisions: https://cliplister.com/datenschutz/

Google Maps

1. Description, purpose and scope of data processing

Our website uses Google Maps to provide map services (including route planning, etc.). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Maps is a service that enables map services such as route planning, viewing satellite images and other actions such as searching for bars, public buildings, sights, etc. For more information about Google Maps features, please visit: https://support.google.com/maps/
The data you transmit for the purpose of using these map services shall be stored on Google LLC servers in the US. Google Ireland Limited has entered into a contract with Google LLC in accordance with standard contractual clauses (https://privacy.google.com/businesses/gdprcontrollerterms/).

2. Legal basis for data processing

The use is based on our legitimate interests, i.e. interest in the user-friendly provision of a map service in accordance with Art. 6 (1) lit. f. GDPR.

3. Duration of storage, possibility of objection and removal

In principle, data are erased as soon as the purpose for which they were collected has been fulfilled. We do not store any user data in connection with Google Maps. Third-party providers may collect data in connection with the use of the plug-ins. You can obtain more detailed information regarding the duration of storage on the respective provider's website in their data protection section.

4. Third-party information

For more information about Google Maps, please see the Google Maps Privacy Policy at https://policies.google.com/privacy?hl=de

reCAPTCHA Google

1. Description, purpose and scope of data processing

Our website uses ‘Google reCAPTCHA’ (hereinafter referred to as ‘reCAPTCHA’) from Google. reCAPTCHA is used to check whether the data entered on our website (e.g. in a contact form) are entered by a human or by an automated program. To do this, reCAPTCHA analyses the behaviour of the website visitor based on various characteristics. This analysis begins automatically as soon as the website visitor enters the website. For analysis, reCAPTCHA evaluates various information (e.g. IP address, time spent on the website by the visitor or mouse movements made by the user). The data collected during the analysis are forwarded to Google.

2. Legal basis for data processing

Data processing is carried out on the basis of point Art. 6 (1) lit. f. GDPR. The website operator has a legitimate interest in protecting its websites from abusive automated spying and from spam.

3. Duration of storage, possibility of objection and removal

If you do not want any data to be transmitted to Google, you must completely log out of Google and erase all Google cookies before visiting our website or using the reCAPTCHA software. The data are, in principle, automatically transmitted to Google as soon as you visit our site. In order to erase these data again, you must contact Google Support at https://support.google.com/?hl=de&tid=231579508952.

4. Third-party information

For more information about Google reCAPTCHA and Google’s Privacy Policy, please visit the following links: https://www.google.com/intl/de/policies/privacy/ and https://www.google.com/recaptcha/intro/android.html.

Use of Algolia AI Search on our Website

We use the search technology Algolia AI Search on our website to provide you with a fast and precise search function and to improve your user experience. The provider of this service is Algolia, Inc., 301 Howard Street, Suite 300, San Francisco, CA 94105, USA (hereinafter "Algolia").

The use of Algolia is based on our legitimate interest in an appealing presentation and easy findability of the content we provide on the website in accordance with Art. 6 (1) (f) GDPR.

When you use the search function on our website, your search queries and information about the search results you click on are processed by Algolia. To protect your privacy, Algolia has implemented IP anonymization. Your IP address is shortened before it is stored and processed further. This procedure makes it impossible to directly identify you, while a rough geographical assignment (at the country level) is retained for statistical purposes.

In addition to the search queries and the anonymized IP address, Algolia may use an anonymous "user token" to associate search queries and click events with a session. This token allows us to analyze and optimize the search function, but it does not allow for any conclusions to be drawn about your identity.

Data processing may take place in the USA. The data transfer to the USA is based on the adequacy decision of the EU Commission on the EU-U.S. Data Privacy Framework (DPF), to which Algolia has acceded.

1. Use of cookies

Cookies are used for behavioural targeting on our website. These are text files by means of which data containing usage information (websites visited, number of visits, visiting times, length of stay on pages, etc) are stored on your hard disk.

The profiles are anonymised and evaluated for statistical purposes, in order to allow the interests of the respective user when Internet advertising (e.g. banners) is uploaded to other websites. Cookies do not hold any personal data such as name, address or email.

By continuing to use our websites and apps, you accept that cookies will be set on your device. You may refuse the use of cookies by selecting the appropriate settings on your browser. However, we would like to point out that in this case you may not be able to use all functions of this website to their full extent.

2. Behavioural Advertising

Your IP (Internet Protocol) address is collected via the use of our websites, directly from the behavioural targeting service provider. This is GroupM Competence Center GmbH. Your IP address is anonymised and cannot be traced back to you again. The purpose of collecting this data is for user oriented advertising.

You can learn more about Interest-Based Advertising and your right to opt-out, at this link:

https://www.groupm.com/mplatform-privacy-notice/

3. Google Analytics

The website also uses Google Analytics, a web analytics service provided by Google LLC (“Google”). Google Analytics uses “cookies” to help the website analyse how users are navigating on the site. The IP address is not logged or stored. The information will allow reports to be compiled on website activity and to provide other services relating to the website use and internet use to the website operator.

You can prevent Google from collecting the data generated by the cookie and relating to your use of the website and from processing this data by downloading and installing the browser plug-in available at the following link: https://support.google.com/analytics/answer/181881?hl=en

4. Use of Google's Consent Mode

At Kärcher we are committed to protecting the privacy of our users and complying with applicable privacy regulations. To align with these obligations and ensure a transparent and secure environment for all of our website visitors, we implement Google's "Consent Mode" functionality on our website. “Consent Mode” is an advanced technological solution designed to optimise cookie consent management and ensure respectful data collection and in accordance with the preferences of our users.

4.1. What is Google's "Consent Mode"?

Google "Consent Mode" is a technology that adjusts the operation of cookies and data processing on our website according to the user's consent. The technology dynamically modifies how Google services, such as Google Analytics and Google Ads, interact with user data, based on specific consent preferences. On a technical level, Consent Mode uses API consent signals to communicate with our web services and Google solutions, adapting data collection and use in real time. This approach reduces the collection of personal data to the minimum necessary, in line with user preferences, while maintaining the comprehensive functionality of our digital services.

Kärcher has implemented the advanced v2 version of “Consent Mode” which increases flexibility and control over data handling and audience measurement in compliance with relevant privacy laws in the United Kingdom.

4.2. Purpose and Function

The purpose of "Consent Mode" is to ensure that we respect our visitors' consent choices regarding the collection and use of their data. When a user visits our site, they are presented with a detailed consent interface, allowing an informed choice about the categories of cookies they wish to enable. This modular approach ensures precise compliance with user privacy preferences, allowing from full acceptance to specific rejection of cookie categories.

4.3 Measurement without third-party cookies:

Even without tracking cookies, we use "Consent Mode" to obtain crucial information about site usage in an anonymous and aggregated form. This ability to collect data, complemented by conversion modelling techniques based on machine learning when specific consent for cookies is not granted, allows advertisers to evaluate the performance of our campaigns in an aggregated and anonymous way, optimising the user experience while protecting your privacy.

4.4 Third party information

You can find more information about “Consent Mode” in the Google Help Center https://support.google.com/google-ads/answer/10000067?hl=en

1. General technical and organisational measures:

Kärcher has taken a variety of security measures to protect personal information appropriately and adequately. All data stored by Kärcher are protected by physical and technical measures as well as procedural measures that restrict access to the information to specially authorised persons in accordance with this Privacy Policy.

Our websites sit behind a software firewall to prevent access from other networks that are connected to the Internet. In addition, the only employees that have access to personal information are those who require it to perform a specific task. These employees are trained in security and data protection practices and treat your information confidentially.

2. Secure data transmission

The transfer of your personal data in the course of an order being processed in the online shop is done so under encryption using the industry-standard Secure Socket Layer ('SSL') technology, SSL encryption version 3.

2C2P

The Company agrees and undertakes that any collection, use or disclosure of personal data (as defined in the Personal Data Protection Act B.E. 2562 (“PDPA”)) shall be strictly for the performance of the Company’s obligations under this Agreement and in compliance with PDPA and any other relevant legislations. The Company shall employ administrative, physical, and technical safeguards to ensure that personal data is afforded protection and shall as soon as practicable notify the Applicant of any confirmed breaches of security that may result in the unauthorized collection, access, use or disclosure of personal data.

Apple Pay

If you choose the ‘Apple Pay’ payment method from Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland (hereinafter referred to as ‘Apple‘) payment will be processed via the ‘Apple Pay’ function of your iOS, watchOS or macOS-powered device by charging a payment card on file with ‘Apple Pay’. Apple Pay uses security features built into the hardware and software of your device to protect your transactions. To authorise a payment, you must enter a code that you have previously defined and verify it using the ‘Face ID’ or ‘Touch ID’ function of your device.

For the purpose of payment processing, the information you provide during the ordering process, along with information about your order, is passed on to Apple in encrypted form. Apple then re-encrypts this data with a developer-specific key before the data is transmitted to the payment service provider of the payment card stored in Apple Pay to process the payment. The encryption ensures that only the website through which the purchase was made can access the payment data. After the payment has been made, Apple sends your device account number and a transaction-specific dynamic security code to the originating website to confirm that the payment has been successful.

If personal data is processed during the transfers described, the processing is carried out exclusively for the purpose of payment processing in accordance with Art. 6 (1) lit. b GDPR.

Apple stores anonymised transaction data, including the approximate purchase amount, the approximate date and time, and whether the transaction was successfully completed. Anonymisation completely rules out any personal reference. Apple uses the anonymised data to improve Apple Pay and other Apple products and services.

If you use Apple Pay on your iPhone or Apple Watch to complete a purchase you have made via Safari on your Mac, the Mac and the authorisation device communicate via an encrypted channel on the Apple servers. Apple does not process or store any of this information in a format that can be used to identify you. You can disable the ability to use Apple Pay on your Mac in your iPhone settings. Go to ‘Wallet & Apple Pay’ and disable ‘Allow payments on Mac’.

For more information about Apple Pay's privacy practices, please see the web address below: https://support.apple.com/us-en/HT203027

Google Pay

If you choose the ‘Google Pay’ payment method from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (hereinafter referred to as ‘Google’), payment will be processed via the ‘Google Pay’ application on your mobile device that is operated with at least Android 4.4 (‘KitKat’) and has an NFC function by debiting a payment card stored with Google Pay or a payment system verified there (e.g. PayPal). To authorise a payment via Google Pay in excess of €25, your mobile device must first be unlocked using the verification measure set up for this purpose (e.g. facial recognition, password, fingerprint or pattern).

For the purpose of payment processing, the information you provide during the ordering process, along with information about your order, will be passed on to Google. Google then transmits the payment information stored in Google Pay in the form of a uniquely assigned transaction number to the originating website, which is used to verify that payment has been made. This transaction number does not contain any information about the real payment data of your means of payment stored with Google Pay, but is created and transmitted as a one-time valid numeric token. For all transactions via Google Pay, Google only acts as an agent to process the payment process. The transaction is carried out exclusively in the relationship between the user and the initial website by debiting the means of payment stored with Google Pay.

If personal data is processed in the course of the transfers described, the processing is carried out exclusively for the purpose of payment processing in accordance with Art. 6 (1) lit. b GDPR.

Google reserves the right to collect, store and evaluate certain transaction-specific information for each transaction carried out via Google Pay. This includes the date, time and amount of the transaction, merchant location and description, a description of the purchased goods or services provided by the merchant, photos you have attached to the transaction, the name and email address of the seller and buyer or sender and recipient, the payment method used, your description of the reason for the transaction and, if applicable, the offer associated with the transaction.

According to Google, this processing is carried out exclusively in accordance with Art. 6 (1) lit. f GDPR, on the basis of a legitimate interest in proper accounting, verification of transaction data and optimisation and maintenance of the functionality of the Google Pay service.

Google also reserves the right to combine the processed transaction data with other information that is collected and stored by Google when using other Google services.

The Google Pay terms of use can be found here:

https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=en

Further information on data protection at Google Pay can be found at the following Internet address:

https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en

Paypal

When you pay via PayPal, credit card via PayPal, direct debit via PayPal or – if offered – ‘purchase on account’ or ‘payment by instalments’ via PayPal, we will forward your payment data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter referred to as ‘PayPal’) for payment processing. The transfer is carried out in accordance with Art. 6 (1) lit. b GDPR, and only insofar as it is necessary for payment processing.

PayPal reserves the right to carry out a credit check for the payment methods credit card via PayPal, direct debit via PayPal or – if offered – ‘purchase on account’ or ‘payment by instalments’ via PayPal. For this purpose, your payment data may be passed on to credit reference agencies in accordance with Art. 6 (1) lit. f GDPR, on the basis of PayPal's legitimate interest in determining your solvency. PayPal uses the result of the credit check in relation to the statistical probability of non-payment for the purpose of deciding whether to provide the respective payment method. The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit check, they are based on a scientifically recognised mathematical-statistical procedure. Among other things, but not exclusively, address data is included in the calculation of the score values. For further information on data protection, including information on the credit reference agencies used, please refer to PayPal's data protection declaration: https://www.paypal.com/us/legalhub/paypal/privacy-full

You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for the contractual processing of payments.

Adyen

Other Payments are processed by the payment service provider Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Netherlands (hereinafter referred to as ‘Adyen’). We have concluded an agreement with Adyen for order processing in accordance with Article 28 GDPR.

We transmit your IP address to Adyen for the purposes of fraud prevention and detection. All data is transmitted in encrypted form. Adyen collects and stores the data and only passes it on to the companies involved in the payment process. We do not collect or store payment data.

When you select the ‘credit card’ payment method, personal data is automatically transmitted to Adyen. By selecting this payment option, you consent to the transfer of personal data to our payment service provider that is necessary for payment processing and for identity and credit checks.

The personal data transmitted to Adyen is usually the card type (Mastercard or VISA), the name of the cardholder, the card number, the check digit and the expiry date.

The ‘3-D Secure’ procedure is used for credit card payments to confirm the identity of the buyer using two-factor authentication.

You have the option to revoke your consent to the handling of personal data at any time with effect for the future.

Information on data protection at Adyen can be found at https://www.adyen.help/hc/en-us/categories/360002679940-Adyen-on-my-bank-statement

Adyen may use affiliated companies and authorized third-party subprocessors to provide these services. These subprocessors process personal data only on Adyen's behalf and under appropriate contractual and technical safeguards. Information about updates to Adyen's subprocessor list is available on Adyen's website: https://help.adyen.com/en_US/updates/adyen-sub-processor-update

Mollie

When you pay via Mollie we will forward you to mollie B.V., Keizersgracht 121, 1015 CJ Amsterdam, the Netherlands (hereinafter referred to as ‘Mollie’) as our payment service provider for the processing of payments, regardless of which payment method you use. The payment data you enter is recorded and stored by mollie B.V. in accordance with Art. 6 (1) lit.b GDPR and is only passed on to the companies involved in the payment process. As a company based in the EU, mollie is subject to the provisions of the European General Data Protection Regulation (GDPR). For more information about data protection by mollie, please refer to the Mollie privacy policy: https://www.mollie.com/de/privacy.

You can object to the processing of your data at any time by sending a message to mollie. However, mollie may still be entitled to process your personal data if this is necessary for the contractual processing of payments. A revocation has no effect on the effectiveness of data processing operations in the past.

CartDNA

We use CartDNA (Nabeyond Ltd) to provide the technical integration between our Shopify store and our selected payment service provider(s).

CartDNA acts as a Data Processor on our behalf where applicable and processes personal data solely for the purpose of providing payment integration services, routing payment requests, maintaining transaction logs, providing reconciliation and technical support, and ensuring the secure operation of the integration.

CartDNA does not collect, access, process, or store sensitive payment card information, including card numbers, CVV/CVC security codes, expiry dates, or full payment authentication data. All sensitive payment information is processed directly by our selected payment service provider within secure, PCI DSS-certified payment environments.

CartDNA may process limited information necessary to operate the integration, such as transaction identifiers, order reference numbers, customer billing country, payment status information, merchant account details, and limited transaction metadata. This information is processed only for the purposes of providing the payment integration service and in accordance with applicable data protection laws, including the UK GDPR and, where applicable, the EU GDPR.

For additional information, please refer CartDNA public documentation:

Privacy Policy: https://cartdna.com/en/legal/privacy-policy

Security & Compliance: https://cartdna.com/en/product/security-and-compliance

Legal & Compliance Hub: https://cartdna.com/en/legal

In addition to the cases explicitly mentioned in this Privacy Policy, your personal data shall only be passed on without your prior express consent if such is legally permissible or required.

If necessary in order to investigate the illegal or abusive use of the website or for legal prosecution, personal data shall be forwarded to the law enforcement authorities or other public authorities and, if necessary, to the third parties which have suffered damage. However, this will only happen if there are indications of illegal or abusive conduct. We are also legally obligated to provide information to certain public bodies upon request. These may be criminal prosecution authorities, public authorities that prosecute administrative offences subject to fines, and the financial authorities.

Any transfer of personal data is justified by the fact that (1) the processing is necessary for compliance with a legal obligation to transfer data to law enforcement authorities to which we are subject in accordance with Article 6 (1) lit. c. GDPR in conjunction with national legal requirements, or (2) we have a legitimate interest in passing the data on to the named third parties if there are indications of abusive conduct or to enforce legal claims, and your rights and interests in the protection of your personal data within the meaning of Article 6 (1) lit. f. GDPR do not prevail.

Third-party companies and external service providers are used to enable us to offer the services on this website. Under Article 28 (1) GDPR, any third-party companies and external service providers used as processors are carefully selected, regularly reviewed and contractually obligated to process all personal data exclusively in accordance with our instructions.

Unless otherwise stated, data shall only be transferred to offices in countries outside of the European Union (so-called third countries) if:

• an adequate level of data protection is ensured; or
• you have given your consent.

1. Right to information:

Pursuant to Article 15 GDPR, you can request information on your personal data that we process.

2. Right to object:

You have the right to object for good cause (see Section 8).

3. Right to rectification:

If information concerning you is not (or is no longer) correct, you can request rectification pursuant to Article 16 GDPR. If your data are incomplete, you can request to have the data completed.

4.  Right to erasure:

You can request the erasure of your personal data pursuant to Article 17 GDPR.

5. Right to restriction of processing:

According to Article 18 GDPR, you have the right to request a restriction of processing of your personal data.

6. Right to lodge a complaint:

If you believe that the processing of your personaldata violates data protection law, you have the right under Article 77 (1) GDPR to lodge a complaint with a data protection supervisory authority of your choice, or with the data protection supervisory authority that is responsible for the controller.

7. Right to data portability:

In the event that the requirements of Article 20 (1) GDPR are met, you have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to third parties.

8. Right to object pursuant to Article 21 (1) GDPR:

You have the right to object, on grounds relating to your particular situation,at any time to the processing of your personal data pursuant to Article 6 (1) lit. f. GDPR. The controller shall then cease processing the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject, or if the processing takes place for the establishment, exercise or defence of legal claims.