Privacy policy

Data protection regulations website www.veggiecrumbz.de

I. Introduction and terms

1. GENERAL

By operating our website with the URL www.veggiecrumbz.de (hereinafter referred to as “website”) we process personal data. We treat these confidentially and process them in accordance with applicable laws - in particular the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and the Telecommunications Telemedia Data Protection Act (TTDSG). With this privacy policy we want to inform you about what personal data we collect from you, for what purposes and on what legal basis we use it and, if necessary, to whom we disclose it. In addition, we will explain to you what rights you have to protect and enforce your data protection.

2. TERMS

Our data protection regulations contain technical terms that are found in the GDPR and the BDSG. For your better understanding, we would like to explain these terms in simple words:

2.1 Personal Data

“Personal data” is all information that relates to an identified or identifiable person (Art. 4 No. 1 GDPR). Information about an identified person can e.g. B. the name or the email address. However, personal data also includes data where the identity is not immediately obvious, but can be determined by combining your own or third-party information and thus finding out who it is. For example, a person will B. can be identified by providing your address or bank details, your date of birth or user name, your IP addresses and/or location data. All information that allows a conclusion to be drawn about a person in any way is relevant here.

2.2 Processing

Art. 4 No. 2 GDPR refers to “processing” as any process in connection with personal data. This applies in particular to collecting, recording, organizing, arranging, storing, adapting or changing, reading out, querying, using, disclosing, transmitting, distributing or any other form of provision, comparing or linking, the restriction, deletion or destruction of personal data.

II. Responsible person and data protection officer

3. RESPONSIBLE
Responsible for data processing is:
Company: Ebbe & Food GmbH (“we”)
Legal representative: Marlon Harms (Managing Director)
Address: Cremon 11, 20457 Hamburg
Telephone: +49 40 2383040 20
Email: contact@ebbeundfood.eu

4. DATA PROTECTION OFFICER
We have appointed an external data protection officer for our company. You can reach him at:

Company: HABEWI GmbH & Co. KG
Legal representative: General partner HABEWI Beteiligungs GmbH, represented by Arne Platzbecker (Managing Director)
Address: Palmaille 96, 22767 Hamburg
Telephone: 040/ 46008966
Fax: 040/ 46008977
Email: datenschutz@habewi.de

III. Processing frame

5. PROCESSING FRAMEWORK: WEBSITE

As part of the website, we process your personal data listed in detail below in Section IV. We only process data from you that you actively provide on the website (e.g. by filling out forms) or that you automatically provide when using our offer.

Your data will be processed exclusively by us and will not be sold, loaned or passed on to third parties. If we use the help of external service providers to process your personal data, this takes place within the framework of so-called order processing, in which we as the client are authorized to give instructions to our contractors. Our website is operated on the shop system of the external service provider “Shopify” (Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland). Shopify hosts our website at the external provider Google Ireland Limited (Gordon House, Barrow Street, Dublin 4 Ireland) in a data center location in Europe. Our online shop is operated as part of order processing. All data collected on our website is processed on Shopify’s servers. If necessary, your data may also be sent to Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada, Shopify Data Processing (USA) Inc., Shopify Payments (USA) Inc. or Shopify (USA) as part of the processing by Shopify ) Inc. will be transmitted. The European Commission's adequacy decision ensures the appropriate level of data protection in Canada. Shopify also processes your data in the USA. Further information on data protection at Shopify can be found at: https://www.shopify.de/legal/datenschutz.

We generally do not transfer data to third countries and have no plans to do so. We will inform you about exceptions to this principle in the processing operations described below. Any data transfer to third countries will then take place on the basis of the so-called EU standard contractual clauses.

IV. Processing in detail

6. PROVISION OF THE WEBSITE AND SERVER LOGFILES SHOPIFY
Every time you visit the website, our shop provider Shopify automatically collects information that your browser transmits to the Shopify server. These are also stored in Shopify’s so-called log files. The information includes the request, the IP address, browser type and language as well as the date and time of the request. The information is used by Shopify to analyze and maintain the technical operation of the servers and network as well as to combat misuse and is automatically deleted after 7 days. We have no access to these server log files.

7. REGISTRATION AND PROFILE

7.1 Description of processing
By registering, you conclude a free user contract with us. By registering you will receive your own user account on our website. You register by filling out the registration form on our website and submitting it to us electronically. To register, you must provide your first name, last name, address, telephone number and email address. By clicking on the “Register” button, you submit the form to us. Alternatively, you can save your data for later purchases by confirming the storage of your data by clicking the “Save my information and pay faster next time” checkbox when placing your order. You will then receive an automatic welcome email. This contains a link to confirm your email address. Only after you have successfully verified your email address by clicking on the confirmation link will your account be activated on our website.
As a registered user, you can shop more quickly and conveniently on our website by entering your billing and delivery addresses and your preferred payment method in your user profile. This means that you do not have to enter your personal data again for subsequent (further) purchases.

7.2 Purpose
The processing takes place in order to be able to provide you with the functions of our website for registered users.

7.3 Legal basis
The processing is necessary to conclude and fulfill the free user contract (Art. 6 Para. 1 lit. b GDPR). Without providing your personal data during registration, we cannot provide our contractually agreed services.

7.4 Storage period
We will automatically delete the data when your user contract ends. You can terminate the user agreement yourself by selecting the “Delete profile” function in the settings of your user account. Alternatively, you can also inform us by post to Ebbe & Food GmbH, Cremon 11, 20457 Hamburg or by email to contact@ebbeundfood.eu that you no longer wish to be a registered user of our website. We will then delete your user account immediately. In addition, as a logged in user, you can edit and remove your own details and information at any time.

8. PURCHASING

8.1 Description of processing
You can shop on our website. As part of your ordering process, we process your personal data. The fields displayed in our online shop are mandatory and must be filled out by you. Otherwise it will not be possible for us to conclude a purchase contract with you and send you the desired goods. When shopping on our website, you can also use one of the payment methods offered (Shopify Payments, (credit card: VISA, Mastercard, American Express), PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal reserves the right to transmit personal data to credit reporting agencies under certain circumstances for identity and creditworthiness checks. Further information on data protection at PayPal can be found at com/de/webapps/mpp/ua/privacy-full?locale .x=de_DE) and Google Pay. to pay the purchase price. When you complete your order, the data required for payment will be passed on to the respective payment service provider. If you shop on our website as a registered user, you can store your billing and delivery addresses as well as your preferred payment method in your user profile for faster and more convenient ordering with us. In addition, your first name, last name and address will be transmitted to DHL as the shipping service provider to process the delivery.
As a registered user, you can shop more quickly and conveniently on our website by entering your billing and delivery addresses and your preferred payment method in your user profile. This means that you do not have to enter your personal data again for subsequent (further) purchases.

8.2 Purpose
Processing takes place to conclude and process purchase contracts.

8.3 Legal basis
The processing is necessary to conclude and fulfill the purchase contracts (Art. 6 Para. 1 lit. b GDPR). This also applies to the transfer of the data required to process payments to respective payment service providers.

8.4 Storage period
Due to commercial and tax law requirements, we are obliged to store your address, payment and order data for a period of ten years. However, we restrict processing after two years. This means that your data will then only be stored separately to comply with the statutory retention periods and will be deleted immediately after these have expired.

8.5 Recipients
To process your payment, personal data will be passed on to one of the external payment service providers listed below and selected by you as part of your purchase:
Shopify Payments: Shopify Payments 3rd Floor, Europa House, Harcourt Building, Harcourt Street, Dublin 2. If you choose a payment service provider offered by Shopify Payments, payment processing will take place via the respective service provider. Further information about data protection at Shopify Payments can be found at: https://www.shopify.com/legal/privacy.
In order to carry out and process the delivery of goods, we will pass on the necessary data to the shipping service provider DHL (DHL Paket GmbH, Sträßchenweg 10, 53113 Bonn).

9. COOKIES AND OTHER TRACKING TECHNOLOGIES

9.1 Description of processing
Our website uses cookies. Cookies are small text files that are stored on the user's device when they visit a website. Cookies contain information that enables the recognition of a device and, if necessary, certain functions of a website. We differentiate between our own cookies and external, so-called third-party cookies. Our site uses so-called “session cookies” and “persistent cookies”. “Session cookies” are automatically deleted when you end your internet session and close the browser. Persistent cookies remain stored on your device for a longer period of time. In addition to cookies, we also use other tracking technologies, such as pixels or so-called fingerprinting. If cookies are technically necessary for the operation of our site, your consent is not required. All other cookies and tracking technologies that are not technically necessary are only set after you have actively consented to the use of cookies/tracking technologies via our consent tool. To obtain and document consent, we use the “GDPR LEGAL COOKIE” service from beeclever GmbH, Universitätsstraße 3, 56070 Koblenz, Germany. The consent tool itself saves your selection in a cookie on your device. This means that you do not have to make a decision about cookies again when you visit our website again.
You can determine which cookies are used on our website for what purpose, how long they are stored on your device and what consent you may have already given in the settings of the consent tool (call up the consent tool using the button on the left). remove.

9.2 Purpose
We use cookies/tracking technologies to make our website more user-friendly and as described in section 1 to offer the functions described.

9.3 Legal basis
The processing is necessary with regard to technically necessary cookies and the use of the consent tool to protect the overriding legitimate interests of the person responsible (Art. 6 Para. 1 lit. f GDPR in conjunction with Section 25 Para. 2 TTDSG). Our legitimate interest lies in the purpose stated in Section 8.2. When processing with regard to all other cookies/tracking technologies - i.e. cookies/tracking technologies that are not technically necessary - the legal basis is consent (Art. 6 Para. 1 lit. a GDPR in conjunction with Section 25 Para. 1 TTDSG). Such consent is voluntary.

9.4 Storage period, revocation of consent
Cookies are automatically deleted at the end of a session or when the specified storage period has expired. Since cookies are stored on your device, you as a user have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been saved can be deleted. This can also be done automatically. If cookies/tracking technologies are deactivated, deleted or restricted for our website, it may be that individual functions of our website cannot be used or can only be used to a limited extent. You can revoke any consent you have given to the use of cookies at any time in the settings of the consent tool (call up the consent tool using the button on the left) with effect for the future.

9.5 Recipients
When using cookies/tracking technologies, data may be transmitted to the relevant providers of these third-party services. In this case, data may also be transferred to third countries outside the European Union or the European Economic Area. We provide information about the recipients of data and third-country transfers in the settings of the consent tool or in the corresponding passage on the third-party service in these data protection regulations.

10. CONTACT FORM AND CONTACT BY EMAIL

10.1 Description of processing
To get in touch, we have provided a contact form on our website. In this form you will be asked to enter your company name, your email address, your name and a message or topic for us. If you send the form you have filled out to us, the data you provide, as well as your IP address, date and time, will first be processed for us by HubSpot and then made available to us in our HubSpot system. The contact form can only be transmitted if you confirm that you have read these data protection regulations by clicking on the relevant checkbox. We use the contact form to provide you. You can also contact us using the email addresses provided on the website. To contact us, you can write to us using the email address provided on the website. In this case, the personal data transmitted by email will be processed by us.

10.2 Purpose
By providing a contact form on our website, we want to offer you a convenient way to get in touch with us. The data transmitted with and in the contact form or your email will be used exclusively for the purpose of processing and answering your request.

10.3 Legal basis
The processing is necessary to protect the overriding legitimate interests of the person responsible (Article 6 (1) (f) GDPR). Our legitimate interest lies in the purpose stated in Section 9.2. If the email contact is aimed at concluding or fulfilling a contract, the data is processed to fulfill the contract (Art. 6 Para. 1 lit. b GDPR).

10.4 Storage period
We will delete the data as soon as it is no longer required to achieve the purpose for which it was collected. This usually occurs when communication with you has ended. Communication ends when the circumstances indicate that your concern has been finally clarified. If statutory retention periods prevent deletion, deletion will take place immediately after the statutory retention period has expired.

10.5 Recipients and data transfer to third countries
We use the services of HubSpot to manage and provide our contact form. This takes place as part of order processing. HubSpot is an offer from HubSpot, Inc., 25 First Street, Cambridge, MA 02141 USA. Further information about data protection at HubSpot can be found at https://legal.hubspot.com/de/privacy-policy. HubSpot also processes your personal data in the USA.

11. NEWSLETTER

11.1 Description of processing
We send out a newsletter at irregular intervals. With the newsletter we inform you about new offers and interesting promotions. You will only receive our newsletter if you actively subscribe to our mailing list. You can also subscribe to it by filling out and submitting a newsletter registration form on our website. You can also subscribe to it when placing an order in our online shop. To register for the newsletter, you only need to provide your email address. All other information (such as your first name and last name) is voluntary and serves solely to personalize the emails. To carry out and verify newsletter registrations, we use the so-called double opt-in procedure. Registration takes place in several steps. First, sign up for the newsletter on our website. You will then receive an email from us at the email address you provided. With this email we ask you to confirm that you have actually registered for the newsletter and that you would like to receive it. Confirmation occurs by clicking on a confirmation link in the email. Only after successful confirmation will we add you to our newsletter distribution list and send you future emails. As part of the double opt-in process, we store the date, time and your IP addresses both when registering and when confirming. If you purchase goods or services on our website and provide your email address, we may subsequently use this to send you a so-called existing customer newsletter. In such a case, the newsletter will only be used to send direct advertising for similar goods or services.

11.2 Purpose
The processing takes place in order to be able to offer the newsletter function and send newsletter emails to subscribers and existing customers. The collection and storage of date, time and IP addresses when registering for the newsletter serves to document consents given and to protect against the improper entry of email addresses.

11.3 Legal basis
The processing of our subscriber newsletter is based on consent in accordance with Art. 6 Para. 1 lit. a GDPR. You can access the declaration of consent at any time on our website at https://www.veggiecrumbz.de/pages/veggie-crumbz-newsletter. Your consent is voluntary. The collection and storage of date, time and IP addresses when registering for the newsletter is necessary to protect the overriding legitimate interests of the person responsible (Art. 6 Para. 1 lit. f GDPR). Our legitimate interest lies in the purpose stated in Section 10.2.
The processing of our existing customer newsletter is based on Art. 6 Para. 1 lit. f GDPR to protect the overriding interests of the person responsible. Our legitimate interest lies in direct advertising to existing customers. This is permissible within the framework of Section 7 Paragraph 3 UWG, which we observe.

11.4 Storage period and revocation of consent
If you do not confirm your registration for our newsletter within 24 hours of receiving the corresponding registration email, your data will be automatically deleted. We also process your personal data for the duration of your newsletter subscription. You can stop receiving our newsletter at any time by revoking your consent. You can also object to the use of your email address to send our existing customer newsletter at any time. A simple explanation is sufficient (by email to contact@ebbeundfood.eu or by post to Ebbe & Food GmbH, Cremon 11, 20457 Hamburg). You can unsubscribe from the newsletter at any time. To do this, send us an email to contact@ebbeundfood.eu. If you revoke your consent, you will no longer be sent newsletters and your personal data will be removed from our active mailing list. We will add your email address to our so-called black list to enforce your revocation. This allows us to ensure that you will not receive any newsletters from us in the future and that your email address will not be misused by third parties.

11.5 Recipients and transmission to third countries:
To manage our newsletter distribution list and send emails, we use the services of the newsletter provider HubSpot. This takes place as part of order processing. HubSpot is an offer from HubSpot, Inc., 25 First Street, Cambridge, MA 02141 USA. Further information about data protection at HubSpot can be found at https://legal.hubspot.com/de/privacy-policy. HubSpot also processes your personal data in the USA.

12. SOCIAL NETWORKS

12.1 Description of processing
Our website does not use so-called social media plugins. The Facebook and Instagram logos displayed on our website are only linked to the corresponding profiles of our company on the social networks. There is no data transmission to social networks when the logos are integrated. If you click on one of the logos, you will simply be redirected to the external website of the respective social network.
However, our profiles within the social networks represent data processing. If you are logged in to the respective social network when you visit such a profile, this information will be assigned to your user account there. If you interact with our profile, e.g. commenting, “sharing”, “liking” or “retweeting” a post, this information is also stored in your user account. We can usually also see your interactions with our profile.
On the social networks Facebook and Instagram we have the opportunity to receive statistical data about the use of our Facebook page or our Instagram profile via the so-called “Insights” function. These statistics are provided by Facebook or Instagram. The “Insights function” is not essential. We cannot decide to turn this feature on or off. It is available to all Facebook fan page operators and all Instagram business account operators, regardless of whether you use the Insights function or not.
We are provided with the following data via Facebook Insights for a selectable period of time in an anonymous form with regard to fans, subscribers, people reached and people who interacted: total number of page views, “likes” including origin, page activities, post interactions, Reach, post reach (divided into organic, viral and paid interactions), comments, shared content, replies and demographic evaluations, i.e. country of origin, gender and age. With Insights statistics, it is not possible for us to identify subscribers and fans of our site or view their profiles.
Furthermore, Instagram Insights provides us with anonymous data about the development and reach of our Instagram profile, as well as the posts, stories and videos we post there. In the Instagram Insights we also receive statistical information about the place of origin, gender and age of the subscribers to our Instagram profile.
The social networks with which you communicate store your data using pseudonyms as usage profiles and use them for advertising purposes and market research. For example, you may be shown advertisements within the social network and on other third-party websites that match your presumed interests. For this purpose, cookies are usually used, which the social network stores on your device. You have the right to object to the creation of these user profiles, which you must contact the social networks directly to exercise.

12.2 Purpose
We maintain profiles on the aforementioned social networks for the purpose of public relations and corporate communication with customers and interested parties. We use the “Insights” function from Facebook and Instagram to evaluate the reach of our posts on the social network and to make them more appealing to our visitors in the future.

12.3 Legal basis
The legal basis for data processing within the scope of our profiles on social networks is the protection of our overriding legitimate interests (Art. 6 Para. 1 lit. f GDPR). Our legitimate interest lies in the purpose stated in Section 12.2. If you are asked for your consent by the respective operator of a social network, the legal basis is Article 6 Paragraph 1 Letter a GDPR. The data processing takes place with regard to our presence on Facebook and Instagram on the basis of joint responsibility in accordance with Art. 26 GDPR.

12.4 Recipients and transmission to third countries
The respective social networks are operated by the companies listed below. Further information on data protection with regard to our profile on social networks can be found in the linked data protection regulations.
Facebook: Meta Platforms, Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA or Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Data protection regulations:

facebook.com/policy.php;www.facebook.com/help/186325668085084,
www.facebook.com/about/privacy/your-info-on-other#applications as well
www.facebook.com/about/privacy/your-info#everyoneinfo.

Instagram: Meta Platforms, Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA or Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland; Privacy policy: instagram.com/155833707900388/.

The social networks also process your personal data in the USA.

13. GOOGLE ANALYTICS

13.1 Description of processing
Our website uses “Google Analytics”, a web analysis service provided by Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA (hereinafter referred to as “Google”). Google Analytics uses cookies (see section 8) that enable your use of our offering to be analyzed. The information generated by the cookies is usually transferred to a Google server in the USA and stored there. However, we only use Google Analytics with IP anonymization. As a result, your IP address will be shortened beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. The IP address transmitted by your browser as part of Google Analytics is not combined with other Google data. The statistics created by Google Analytics record in particular how many users visit our website, which country or location the access comes from, which sub-pages are accessed and which links or search terms visitors use to reach our website. The Google Analytics user terms and conditions can be found at google.com/analytics/terms/de.html. An overview of data protection at Google Analytics is available at www.google.com/intl/de/analytics/learn/privacy.html. Google's privacy policy can be viewed at www.google.de/intl/de/policies/privacy.

13.2 Purpose
The processing takes place in order to be able to evaluate the use of our website. The information obtained in this way is used to improve and tailor our online presence to our needs.

13.3 Legal basis
Processing is carried out on the basis of consent in accordance with Article 6 Paragraph 1 Letter a GDPR. We obtain this via the consent tool (see section 8.1). Such consent is voluntary.

13.4 Storage period and right to object, revocation of consent
We have explained the storage period and your control and setting options for cookies in Section 8.4. You can revoke the consent you have given with regard to Google Analytics at any time in the settings of the consent tool with effect for the future. Alternatively, you can object to data processing by Google Analytics at any time by downloading and installing the browser add-on offered by Google at google.com/dlpage/gaoptout?hl=de. We automatically delete the analysis data processed and stored with Google Analytics after 14 months.

13.5 Recipients and transmission to third countries
According to the German data protection supervisory authorities (Data Protection Conference), Google Analytics has joint responsibility for data processing for us. Against this background, we have also concluded the “Google Measurement Controller-Controller Data Protection Terms” with Google. Google also processes your personal data in the USA.

14. GOOGLE MAPS

14.1 Description of processing
Our website uses “Google Maps”, a service for displaying maps from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as “Google”). We use Google Maps by including a map with our business address on our website. The map is loaded directly from a Google server. In order for this to happen, your browser sends a request to a Google server. This means that we may also transmit your IP address to Google in conjunction with the address of our website. However, Google Maps does not store cookies on your device. If you are logged in to Google when you visit our site, Google Maps assigns this information to your Google user account. Google saves your data as usage profiles and uses them for advertising purposes, market research and/or to tailor Google websites to your needs. You have the right to object to the creation of these user profiles, which you must contact Google directly to exercise. Further information about data protection at Google can be found at
google.com/privacy?hl=de-DE.

14.2 Purpose
The processing takes place in order to be able to show you an interactive map on our website.

14.3 Legal basis
Processing is carried out on the basis of consent in accordance with Article 6 Paragraph 1 Letter a GDPR. We obtain this via the “Other” consent tool (see Section 8.1) or as part of a content blocker at the point on our website where an interactive map is to be displayed. Such consent is voluntary.

14.4 Revocation of consent
You can revoke your consent to display Google Maps maps on our website at any time in the settings of the consent tool (call up the consent tool using the button on the left) with effect for the future.

14.5 Recipients and transmission to third countries 

Google also processes your personal data in the USA.

15. META PIXELS

15.1 Description of processing
Our website uses the remarketing service “Meta Pixel” (formerly “Facebook Pixel”), which is provided by Meta Platforms, Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA or Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Meta”). The “Meta Pixel” enables us to place advertisements on the social networks Facebook and Instagram that are specifically targeted at those Facebook/Instagram users who have shown interest in our offering - e.g. through a previous visit to our site Website. With the help of the “Meta Pixel” we can also track and evaluate the effectiveness and reach of our advertising on Facebook/Instagram by recording whether Facebook/Instagram users interact with our advertisements on the two social networks by clicking on them Advertisements are redirected to our website. When you visit our website, a connection is established to the meta servers and the “meta pixel” is embedded into our website. In addition, Meta may store a cookie on your device (see section 8 above). If you are logged in to Facebook or Instagram or later log in to Facebook or Instagram, your visit to our website will be assigned to your respective user account. The data collected about you using the “Meta Pixel” is anonymous to us. They do not provide us with any conclusions about you personally. However, Meta allows you to connect to your user profile. Data processing by Meta is carried out in accordance with the company's data policy, which can be found for Facebook at facebook.com/policy.php and for Instagram at privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect.

15.2 Purpose
The processing takes place in order to be able to carry out targeted online advertising for our own offers on Facebook and Instagram and to evaluate their effectiveness and reach.

15.3 Legal basis
Processing is carried out on the basis of consent in accordance with Article 6 Paragraph 1 Letter a GDPR. We obtain this via the “Other” consent tool (see section 8.1). Such consent is voluntary.

15.4 Storage period and right to object, revocation of consent
We have explained the storage period and your control and setting options for cookies/tracking pixels in Section 8. You can revoke the consent you have given with regard to data collection by the “Meta Pixel” and the use of your data to display Facebook advertisements at any time in the settings of the consent tool with effect for the future. facebook.com/settings?tab=ads You can object to the data collection by the “Meta Pixel” and the use of your data to display Facebook/Instagram advertisements at any time, including to Meta. You can decide which types of advertisements are shown to you on Facebook within the settings of your Facebook account at www.facebook.com/settings?tab=ads. This setting is applied across devices.

15.5 Recipients and transmission to third countries
By integrating the Meta Pixel, personal data may be transmitted to Meta. Meta also processes your personal data in the USA.

16. GOOGLE ADS CONVERSION

16.1 Description of processing
Our website uses the advertising service “Google Ads Conversion”, which is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4. Ireland (hereinafter referred to as “Google”). With the help of Google Ads Conversions, we can place advertising on external websites to draw your attention to our offers. In addition, the service enables us to determine the reach and success of individual advertising measures. Our advertisements are delivered by Google via so-called “ad servers”. For this purpose, Google uses so-called “ad server” cookies, through which certain parameters are measured to measure success, such as display of ads or clicks by users. If you reach our website via a Google ad, Google Ads will store a cookie in your device (see section 8). According to Google, these cookies are not intended to identify you personally. The analysis values for this cookie are usually the unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions) and opt-out information (marking that the user does not would like to be addressed more). The cookies enable Google to recognize your internet browser. If you visit a Google Ads customer's website and the cookie stored on your device has not yet expired, Google and the customer can recognize that you clicked on the ad and were redirected to our website. Each Google Ads customer is assigned a different cookie. Cookies cannot therefore be tracked via the websites of Google Ads customers. We ourselves do not process any personal data through our Google Adwords advertising campaigns. Google only provides us with statistical evaluations. Based on these evaluations, we can identify which of the advertising measures used are particularly effective. We do not receive any further data from the use of advertising materials; in particular, we cannot identify users based on this information. When you visit our website, a connection is established to the Google servers. We have no influence on the extent and further use of the data collected by Google through the use of Google Ads Conversion and therefore inform you according to our level of knowledge: By integrating Google Ads Conversion, Google receives the information about which subpage of our website You have accessed or clicked on an advertisement from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, there is a possibility that Google will find out and store your IP address.
Further information about data protection at Google can be found here: google.com/privacy?hl=de and
services.google.com/sitestats/de.html.

16.2 Purpose
The processing takes place in order to be able to carry out targeted online advertising for our own offers and to evaluate their effectiveness and reach.

16.3 Legal basis
Processing is carried out on the basis of consent in accordance with Article 6 Paragraph 1 Letter a GDPR. We obtain this via the “Other” consent tool (see section 8.1). Such consent is voluntary.

16.4 Storage period and right to object, revocation of consent
We have explained the storage period and your control and setting options for cookies in Section 8. You can also object to data processing by Google Ads Conversion at any time via the following website: google.com/ads/preferences. You can revoke the consent you have given with regard to data collection by Google Ads Conversion at any time in the settings of the consent tool with effect for the future.

16.5 Recipients and transmission to third countries
By integrating Google Ads Conversion, personal data may be transmitted to Google. Google also processes your personal data in the USA.

17. GOOGLE RECAPTCHA

17.1 Description of processing
Our website uses “reCAPTCHA”, a service operated by Google LLC, 1600 Amphitheater Parkway, Mountain View, California 94043, USA (hereinafter referred to as “Google”). With reCAPTCHA we can check in forms whether the entry was made by a human or by automated software - especially so-called bots. This allows us to protect our website from spam and misuse. In this context, your IP address, the length of time you spend on the website, your mouse movements and any other data required for the reCAPTCHA service are transmitted to Google. Further information about data protection at Google can be found at google.com/privacy?hl=de-DE.

17.2 Purpose
The processing takes place to protect forms on our website from misuse and spam.

17.3 Legal basis
The processing is necessary to protect the overriding legitimate interests of the person responsible (Article 6 (1) (f) GDPR). Our legitimate interest lies in the purpose stated in Section 17.2.

17.4 Recipients and transmission to third countries
Google also processes your personal data in the USA.

18. CONTENT DELIVERY NETWORK (CDN)

18.1 Description of processing
Our website uses so-called Content Delivery Networks (CDN). CDNs shorten the loading time of common JavaScript libraries because the files are transferred from fast, local or under-used servers of external service providers. Another advantage compared to storing the JavaScript libraries locally on our server is that the files are regularly checked for security by external service providers and kept up to date. We have integrated JavaScript libraries from the external service provider Cloudflare to implement some programming functions on our website. When you visit our website, a connection is established to the servers of the external services mentioned and the JavaScript library is loaded into our website. This tells the external service providers which website you have visited. Our website uses so-called Content Delivery Networks (CDN). CDNs ensure that the loading time of common JavaScript libraries is shortened because the files are transferred from fast, local or under-utilized servers of external service providers. Another advantage compared to storing the JavaScript libraries locally on our server is that the files are regularly checked for security by external service providers and kept up to date. To implement some programming functions on our website, we have integrated JavaScript libraries from the external service provider Fastly, Inc. (Fastly Inc., 475 Brannan St. #300, San Francisco, CA 94107, USA). When you visit our website, a connection is established to the servers of the external services mentioned and the JavaScript library is loaded into our website. This tells the external service providers which website you have visited. If necessary, your IP address will also be transferred. To prevent Java Script from running altogether, you can install a Java Script blocker in your browser.

18.2 Purpose
The processing takes place in order to shorten the loading time of our website and to be able to integrate JavaScript and libraries quickly and securely.

18.3 Legal basis
The processing is necessary to protect the overriding legitimate interests of the person responsible (Article 6 (1) (f) GDPR). Our legitimate interest lies in the purpose stated in Section 18.2.

18.4 Recipients and transmission to third countries
By integrating the JavaScript libraries, your data will be transmitted to one of the following CDNs:
Cloudflare hosted by Cloudflare, Inc. For more information, please see Cloudflare's privacy policy at cloudflare.com/security-policy/.
Fastly Inc., 475 Brannan St. #300, San Francisco, CA 94107, USA. Further information about data protection at Fastly, Inc. can be found at: https://www.fastly.com/de/privacy/.
Google Hosted Libraries. Google LLC, 1600 Amphitheater Parkway, Mountain View, California 94043, USA. Further information can be found in Google's privacy policy at: https://policies.google.com/privacy?hl=de.

19 SHOPIFY ANALYTICS

19.1 Description of processing
Our website uses “Shopify Analytics”, a web analysis service operated by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (hereinafter referred to as “Shopify Analytics”). The Shopify Analytics web analysis service uses cookies. The information and data collected by these cookies about the use of our website is transferred to Shopify and evaluated there. Shopify may also transfer this information to third parties if required by law or if third parties process this data on behalf of Shopify. Further information about Shopify Analytics can be found at: https://help.shopify.com/de/manual/reports-and-analytics/shopify-reports. Further information about Shopify Analytics data protection can be found at: https://www.shopify.de/legal/datenschutz.

19.2 Purpose
The processing takes place in order to be able to evaluate the use of our website. The information obtained in this way is used to improve and tailor our online presence to our needs.

19.3 Legal basis
Processing is carried out on the basis of consent in accordance with Article 6 Paragraph 1 Letter a GDPR. We obtain this via the consent tool (see section 8.1). Such consent is voluntary.

19.4 Storage period and right to object, revocation of consent
We have explained the storage period and your control and setting options for cookies in Section 8.4. You can revoke the consent you have given with regard to Shopify Analytics at any time in the settings of the consent tool with effect for the future. We automatically delete the analysis data processed and stored with Shopify Analytics after 12 months at the latest.

19.5 Recipients and transmission to third countries
Shopify acts for us as a service provider within the scope of order processing. By integrating Shopify Analytics, your data is also transferred to Shopify.

20. REVIEW.IO

20.1 Description of processing
If you purchase goods on our website and provide your email address, we may subsequently use it to send a review request. This gives you the opportunity to write and publish reviews on our website. For this we use the open review platform “Review.io”, a service provided by REVIEWS.io 2020 GMBH, Stralauer Allee 6, 10245 Berlin, Germany. Review.io allows us to collect customer reviews and publish them on our website. Writing a review is voluntary.
When you write a review on our website, REVIEWS.io automatically creates a personal account for you and collects the following personal information about you: your name (this is public unless you have chosen to remain anonymous), your Email address, your social media profile (optional if added by you). Providing your name and email address is mandatory, i.e. H. Without this information it is not possible to write a review on the website. Reviewers can verify reviews by adding social media information. If this method is used, we may store publicly available information in your profile. We will publish your name alongside your review unless you have chosen to remain anonymous. If you choose to post your review anonymously, the contactable information will still be visible to the reviewed business if they subscribe to our services. Further information about data protection at REVIEWS.io can be found at: https://www.reviews.io/front/user-privacy-policy.

20.2 Purpose
The processing takes place in order to be able to offer the rating function and publish reviews.

20.3 Legal basis
When submitting reviews, processing takes place on the basis of consent in accordance with Art. 6 Para. 1 lit. a GDPR. Your consent is voluntary.

20.4 Storage period and revocation of consent
You can stop the processing of your personal data at any time by withdrawing your consent. A simple explanation is sufficient (by email to contact@ebbeundfood.eu or by post to Ebbe & Food GmbH, Cremon 11, 20457 Hamburg). If you revoke your consent, we will delete or anonymize the review.

20.5 Recipients and transmission to third countries:
To collect and manage customer reviews, we use the services of the review platform “Review.io”, a service of REVIEWS.io 2020 GMBH, Stralauer Allee 6, 10245 Berlin, Germany. This takes place as part of order processing.

21. MICROSOFT ADERTISING

21.1 Description of processing
Our website uses the advertising service “Microsoft Adervertising” (formerly Bing Ads), which is operated by Microsoft Corporation One Microsoft Way, Redmond, WA 98052-63399, USA (hereinafter referred to as “Microsoft”). With the help of Microsoft Advertising, we can place advertising on external websites to draw your attention to our offers. In addition, the service enables us to determine the reach and success of individual advertising measures. A conversion tracking tag from Microsoft Advertising is used. This is the so-called Universal Event Tracking (UTE) tag. For example, we find out which advert you used to reach our website. By integrating Microsoft Advertising, we receive information about which subpage of our website you have visited or clicked on our ad. We only receive information to evaluate your web behavior, but no personal information. Cookies are set in your browser to collect and process this data.

Further information on data protection at Microsoft can be found here: https://privacy.microsoft.com/de-de/privacy.

21.2 Purpose
The processing takes place in order to be able to carry out targeted online advertising for our own offers and to evaluate their effectiveness and reach.

21.3 Legal basis
Processing is carried out on the basis of consent in accordance with Article 6 Paragraph 1 Letter a GDPR. We obtain this via the “Other” consent tool (see section 8.1). Such consent is voluntary.

21.4 Storage period and right to object, revocation of consent
We have explained the storage period and your control and setting options for cookies in Section 8. You can revoke the consent you have given with regard to data collection by Microsoft Advertising at any time in the settings of the consent tool with effect for the future.

21.5 Recipients and transmission to third countries
By integrating Microsoft Advertising, personal data may be transmitted to Microsoft. Microsoft also processes your personal data in the USA.

V. Security measures

22. Security measures
In order to protect your personal data from unauthorized access, we have provided our website with an SSL or TLS certificate. SSL stands for “Secure Sockets Layer” and TLS for “Transport Layer Security” and encrypts the communication of data between a website and the user’s device. You can recognize the active SSL or TLS encryption by a small lock logo that is displayed on the far left in the browser's address bar.

VI. Your rights

23. Rights of those affected
With regard to the data processing described above by our company, you are entitled to the following data subject rights:

23.1 Information (Article 15 GDPR)
You have the right to request confirmation from us as to whether we are processing personal data relating to you. If this is the case, you have a right to information about this personal data and to the information listed in detail in Art. 15 GDPR under the conditions set out in Article 15 GDPR.

23.2 Correction (Article 16 GDPR)
You have the right to request that we immediately correct any incorrect personal data concerning you and, if necessary, complete any incomplete personal data.

23.3 Deletion (Article 17 GDPR)
You have the right to request that we delete personal data concerning you immediately if one of the reasons listed in detail in Article 17 GDPR applies, e.g. B. if your data is no longer needed for the purposes we pursue.

23.4 Restriction of data processing (Article 18 GDPR)
You have the right to request that we restrict processing if one of the conditions listed in Article 18 GDPR is met, e.g. B. if you dispute the accuracy of your personal data, data processing will be restricted for the period that allows us to verify the accuracy of your data.

23.5 Data portability (Art. 20 GDPR)
You have the right, under the conditions listed in Art. 20 GDPR, to request the release of the data concerning you in a structured, common and machine-readable format.

23.6 Revocation of consent (Art. 7 Para. 3 GDPR)
You have the right to withdraw your consent at any time to processing based on consent. The revocation applies from the time it is asserted. In other words, it works for the future. The revocation of consent does not make the processing unlawful retroactively.

23.7 Complaint (Article 77 GDPR)
If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. You may exercise this right with a supervisory authority in the EU member state of your residence, your place of work or the place of the alleged infringement.

23.8 Prohibition of automated decisions/profiling (Art. 22 GDPR)
Decisions that have legal consequences for you or that significantly affect you may not be based solely on automated processing of personal data - including profiling. We inform you that we do not use automated decision-making, including profiling, with regard to your personal data.

23.9 Right to object (Art. 21 GDPR)
If we process your personal data on the basis of Article 6 Paragraph 1 Letter f of the GDPR (to protect overriding legitimate interests), you have the right to object to this under the conditions listed in Article 21 of the GDPR. However, this only applies if there are reasons that arise from your particular situation. After an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate reasons for the processing that outweigh your interests, rights and freedoms. We also do not have to stop processing if it serves to assert, exercise or defend legal claims. In any case - regardless of the particular situation - you have the right to object to the processing of your personal data for direct advertising at any time.

Stand: September 2023