data protection

We operate our websites according to the following principles:

We are committed to complying with the legal provisions on data protection and always endeavour to take into account the principles of data avoidance and data minimisation.

1. Name and address of the controller and the data protection officer

a) The controller

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states of the European Union as well as other data protection regulations is:

Pad home design concept gmbh
Königsberger Str. 46
86690 Mertingen

email: datenschutz@padconcept.com
phone: 09078 912 526 0
https://padconcept.com

b) The Data Protection Officer

You can contact the data protection officer of the controller as follows:

SiDIT GmbH, Langgasse 20, 97261 Güntersleben, info@sidit.de

2. Definitions

We have designed our privacy policy according to the principles of clarity and transparency. Should there be any uncertainty regarding the use of various terms, the corresponding definitions can be viewed here.

3. Legal basis for the processing of data

a) Processing of personal data in accordance with the GDPR

We only process your personal data such as your first and last name, your email address and IP address, etc. if there is a legal basis for doing so. According to the General Data Protection Regulation, the following regulations in particular apply:

Art. 6 (1) sentence 1 lit. a GDPR: The data subject has given his or her consent to the processing of personal data concerning him or her for one or more specific purposes.
Art. 6 (1) sentence 1 lit. b GDPR: The processing is necessary for the performance of a contract to which the data subject is party or for the implementation of pre-contractual measures taken at the request of the data subject.
Art. 6 para. 1 sentence 1 lit. c GDPR: The processing is necessary to fulfill a legal obligation to which the controller is subject
Art. 6 para. 1 sentence 1 lit. d GDPR: The processing is necessary to protect the vital interests of the data subject or of another natural person
Art. 6 para. 1 sentence 1 lit. e GDPR: the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
Art. 6 para. 1 sentence 1 lit. f GDPR: the processing is necessary to safeguard the legitimate interests of the controller or of a third party, unless the interests or fundamental rights and freedoms of the data subject which require protection of personal data prevail, in particular if the data subject is a child

However, we will always point out to you at the respective points in this data protection declaration the legal basis on which the processing of your personal data takes place.

b) Consent of the legal guardians according to Art. 8 Para.1 S.2 Alt.2 GDPR

A legal guardian must consent to all data processing within the scope of this website for which the consent of a minor who has not yet reached the age of 16 is required. Information on the individual data processing operations, their purposes and the data categories affected for which the consent of the data subject is required can be found in the data protection declaration.

You can revoke your consent at any time by sending the revocation declaration in text form to the contact details of the person responsible. The processing until the revocation remains lawful.

c) Processing of information according to Section 25 Paragraph 1 TDDDG

We also process information in accordance with Section 25 Paragraph 1 TDDDG by storing information on your terminal equipment or accessing information that is already stored in your terminal equipment. This can include both personal information and non-personal data, e.g. cookies, browser fingerprints, advertising IDs, MAC addresses and IMEI numbers. Terminal equipment is any device that is directly or indirectly connected to the interface of a public telecommunications network for sending, processing or receiving messages, Section 2 Paragraph 2 No. 6 TDDDG.

We generally process this information based on your consent, Section 25 Para. 1 TDDDG.

If an exception applies according to Section 25 Paragraph 2 No. 1 and No. 2 TDDDG, we do not require your consent. Such an exception applies if we only access or store the information in order to transmit a message via a public telecommunications network or if this is absolutely necessary so that we can provide a telemedia service that you have expressly requested. You can revoke your consent at any time.

We would like to inform you that the revocation of your consent will not affect the legality of the processing carried out on the basis of your consent until the revocation..

4. Disclosure of personal data

The passing on of personal data also constitutes processing within the meaning of the previous section 3. However, we would like to inform you separately at this point about the issue of passing on data to third parties. The protection of your personal data is very important to us. For this reason, we are particularly careful when it comes to passing on your data to third parties.

Data will therefore only be passed on to third parties if there is a legal basis for the processing. For example, we pass on personal data to people or companies who work for us as processors in accordance with Art. 28 GDPR. A processor is anyone who processes personal data on our behalf - in particular in a relationship of instruction and control with us.

In accordance with the requirements of the GDPR, we conclude a contract with each of our processors to oblige them to comply with data protection regulations and thus provide your data with comprehensive protection.

5. Storage period and deletion

We will delete your personal data if it is no longer necessary for the purposes for which it was collected or otherwise processed, if the processing is not necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims.

6. SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as the requests you send to us as the website operator, this website uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

If SSL or TLS encryption is activated, the data you send to us cannot be read by third parties.

7. Cookies

We use cookies on our website. Cookies are small data packets that your browser automatically creates and that are stored on your device when you visit our website. These cookies are used to store information related to the device used.

When using cookies, a distinction is made between technically necessary cookies and "other" cookies. Technically necessary cookies are those that are absolutely necessary in order to provide an information society service that you have expressly requested.

a) Technically necessary cookies

In order to make the use of our services more pleasant for you, we use technically necessary cookies. These can be so-called session cookies (e.g. language and font selection, shopping cart, etc.), consent cookies, cookies to ensure server stability and security, etc. The legal basis for the cookies arises from Art. 6 Paragraph 1 Clause 1 Letter f) GDPR, our legitimate interest in the error-free operation of the website and the interest in providing you with an optimized version of our services.

b) Other cookies

Other cookies include cookies for statistical purposes, analysis, marketing and retargeting purposes.

We use these cookies for you based on your consent in accordance with Art. 6 Paragraph 1 Clause 1 Letter a) of GDPR.
You can revoke your consent to the use of cookies at any time. We would like to inform you that the revocation of your consent does not affect the legality of the processing carried out on the basis of your consent up to the time of revocation.

To do this, you can either edit your cookie settings on our website, deactivate the use of cookies in your browser settings (although this may also limit the functionality of the online service) or, in individual cases, set an opt-out for the corresponding service.

For the respective services, we will inform you in the privacy policy on which legal basis this data is processed.

Change Cookie Settings

8. Cookie-Banner

To obtain consent for the cookies we use, we use the cookie banner of the service provider shopware (shopware AG, Ebbinghoff 10, 48624 Schoeppingen). This service provider itself sets a so-called consent cookie in order to query and process the respective consent status. This consent cookie is technically necessary and is therefore used due to our legitimate interest in accordance with Art. 6 Para. 1 Clause 1 Letter f of GDPR, Section 25 Para. 1 TDDDG.

9. Collection and storage of personal data and their type and purpose of use

a) External hosting

Our website is hosted by PZ Systeme Gmbh & Co. KG, Liebigstraße 3a, 84030 Landshut. For this reason, all personal data collected on our website is stored on the servers of our host, unless an external third-party service is integrated. This may include the IP address, your email address, communication data or similar. You can find out which specific personal data this involves below in the individual functions and services explained by us. If we use an external third-party service, this will be made clear in the description of the respective service or tool.

The hoster only processes your data on our instructions and to the extent that this is necessary to provide the services on the website. The hoster does not process the data for its own purposes. We have concluded a contract for order processing with them.

b) When visiting the website

When you visit our website, the browser used on your device automatically sends information to our website's server. This information is temporarily stored in a so-called log file. The following information is recorded without your intervention and stored until it is automatically deleted:

IP address of the requesting computer
date and time of access
Name and URL of the retrieved file

We process the above data for the following purposes:

Ensuring a smooth connection to the website
Ensuring a comfortable use of our website
error analysis

Data that allows conclusions to be drawn about you, such as the IP address, is deleted after 7 days at the latest. If we store the data beyond this period, it is pseudonymized so that it can no longer be assigned to you. The legal basis for data processing is Art. 6 Paragraph 1 Clause 1 Letter f of GDPR. Our legitimate interest follows from the purposes for data collection listed above. Under no circumstances do we use the data collected for the purpose of drawing conclusions about you personally.

c) Shop system

To offer our goods, we use the shop system from shopware (shopware AG, Ebbinghoff 10, 48624 Schoeppingen).

The data you provide will therefore also be processed by our shop provider as part of the operation of the shop system. In addition, the shop system may set additional cookies. For this reason, we have concluded a contract for order data processing with them.

Further information on data protection can be found at: https://www.shopware.com/de/datenschutz/

d) contractual relationship

(1) Conclusion of contract

When establishing the contractual relationship, only the personal data that is absolutely necessary for the execution of the contract will be processed in accordance with Art. 6 Paragraph 1 Clause 1 Letter b of GDPR. If you provide any additional voluntary information, this will only be processed on the basis of your consent in accordance with Art. 6 Paragraph 1 Clause 1 Letter a of GDPR. We use this voluntary information to offer a customer-friendly service and to continually improve it.

(2) Customer account

You have the option of creating a customer account with us. In addition to your personal data for contract processing, your other voluntary information and the purchases you have made with us in the past will be stored and processed. You can access these at any time and thus receive an overview of the purchases you have made with us. This data is used so that you can easily log in with your login data the next time you make a purchase. It is also intended to help you manage your purchasing activities.
Die The legal basis is the consent you have given in accordance with Art. 6 Paragraph 1 Clause 1 Letter a of GDPR.

You have the option to change or delete your data in your customer account at any time, and also to delete the account in its entirety. If you use this function, your customer account and all the data it contains will be deleted immediately.

(3) Transfer of data for shipping
We pass on the data necessary for the shipping of our goods (first name and surname, address, email address, telephone number if required due to freight forwarding) to the relevant shipping service provider for notification/coordination of the delivery of the goods and for the delivery of the goods.
The legal basis for the transfer arises from Art. 6 Paragraph 1 Clause 1 Letter b of GDPR. Wir geben Ihre Daten in diesem Zusammenhang an einen der nachfolgenden Versanddienstleister weiter. In this context, we pass on your data to one of the following shipping service providers. You will then receive further information from them on the processing of your data:

DPD

DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg, germany, info@dpd.com, Tel. 06021 843-0; https://www.dpd.com/de/de/datenschutz/

GLS

General Logistics Systems Germany GmbH & Co. OHG, GLS Germany-Straße 1 – 7, DE-36286 Neuenstein, 06677-646907000, service@gls-germany.com: https://gls-group.eu/DE/de/datenschutz-standard

(4) Transfer of data when using online payment service providers

If you decide to pay with one of the online payment service providers we offer during the ordering process, your contact details will be sent to them as part of the order triggered in this way. The legality of the transfer of data arises from Art. 6 Para. 1 Clause 1 Letter b GDPR, to carry out the payment method you have chosen, as well as our legitimate interests in accordance with Art. 6 Para. 1 Clause 1 Letter f GDPR to enable user-friendly and uncomplicated payment processing.

The personal data transmitted to the online payment service provider usually includes first name, last name, address, telephone number, IP address, email address, or other data required to process the order, as well as data related to the order, such as number of items, item number, invoice amount and taxes in percent, invoice information, etc.

This transmission is necessary to process your order using the payment method you have selected, in particular to confirm your identity, to administer your payment and the customer relationship.

Please note, however: Personal data may also be passed on by the online payment service provider to service providers, subcontractors or other affiliated companies if this is necessary to fulfil the contractual obligations arising from your order or if the personal data is to be processed on behalf of them.

Depending on the payment method selected, e.g. invoice or direct debit, the personal data transmitted to the provider will be transmitted by the provider to credit agencies. This transmission serves to check your identity and creditworthiness in relation to the order you have placed. You can find out which credit agencies these are and which data is generally collected, processed, stored and passed on by the respective provider in the respective data protection declarations of the providers:

PayPal

PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg under https://www.paypal.com/de/webapps/mpp/ua/privacy-full

e) Newsletter

Content of the newsletter and registration data

Our newsletter will only be sent to you and statistical surveys and analyses will be carried out, as well as the registration process will be logged, if you order it from us and have given your consent in accordance with Art. 6 (1) sentence 1 lit. a GDPR, Section 25 (1) TDDDG.

The contents of the newsletter are described in detail when you register for the newsletter. To register for the newsletter, it is sufficient to provide your email address. If you provide further voluntary information such as your name and/or gender, this will be used exclusively to personalize the newsletter addressed to you.

double opt-in and logging

For security reasons, we use the so-called double opt-in procedure to register for our newsletter so that no one can register with someone else's email address. After registering for our newsletter, you will therefore first receive an email asking you to confirm your registration. The registration only becomes effective once you have confirmed it.

Furthermore, your registration for the newsletter will be logged. The logging includes saving the time of registration and confirmation, the data you provided and your IP address. If you make changes to your data, these changes will also be logged.

revocation

If you no longer wish to receive our newsletter, you can revoke your consent at any time for the future. To do so, you can click on the unsubscribe link at the end of each newsletter or send us an email to the following email address: datenschutz@padconcept.com

The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until the revocation.

use of CleverReach

We use the email tool CleverReach (CleverReach GmbH & Co. KG, Mühlenstr. 43, 26180 Rastede, Germany) to send our newsletter.

For this purpose, the data you provide will be passed on to CleverReach and processed by them. This tool enables us to evaluate how the newsletters are opened and used.

We have concluded a data processing agreement with CleverReach. CleverReach does not have the right to pass on your data.

Further information on CleverReach’s data protection can be found here.

f) Contact form

We provide you with a form on our website so that you have the opportunity to contact us at any time. To use the contact form, you must provide a name for personal address and a valid email address for contact so that we know who the request came from and can process it.

If you send us inquiries via the contact form, your details from the inquiry form, including the contact details you provided there and your IP address, will be processed in accordance with Art. 6 Paragraph 1 Clause 1 Letters b and f of GDPR to carry out pre-contractual measures that are carried out at your request or to protect our legitimate interest, namely to exercise our business activities.

The enquiries and the associated data will be deleted no later than 3 months after receipt, unless they are required for a further contractual relationship.

g) VUse of Google Tag Manager

This website uses Google Tag Manager. The Tag Manager does not collect any personal data. The tool triggers other tags, which in turn may collect data. Google Tag Manager does not access this data. If deactivation has been carried out at domain or cookie level, this remains in place for all tracking tags that are implemented with Google Tag Manager. Google's privacy policy for this tool can be found here: https://www.google.de/tagmanager/use-policy.html

10. Rights of the data subject

You have the following rights:

a) Information

According to Art. 15 GDPR, you have the right to request information about your personal data processed by us. This right to information includes information about

the processing purposes
the categories of personal data
the recipients or categories of recipients to whom your data have been or will be disclosed
the planned storage period or at least the criteria for determining the storage period
the existence of a right to rectification, erasure, restriction of processing or objection
the existence of a right of complaint to a supervisory authority
the origin of your personal data, unless it was collected by us
the existence of automated decision-making, including profiling, and, where appropriate, meaningful information on its details

b) Correction

According to Art. 16 GDPR, you have the right to have any incorrect or incomplete personal data stored by us corrected without delay.

c) Deletion

According to Art. 17 GDPR, you have the right to request that we delete your personal data immediately, unless further processing is necessary for one of the following reasons:

the personal data are still necessary for the purposes for which they were collected or otherwise processed
to exercise the right to freedom of expression and information
to fulfill a legal obligation which requires processing by European Union or Member State law to which the controller is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller
for reasons of public interest in the area of public health pursuant to Art. 9 (2)(h) and (i) and Art. 9 (3) GDPR
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89 (1) GDPR, insofar as the right referred to in section a) is likely to make the achievement of the objectives of this processing impossible or seriously compromises it
to assert, exercise or defend legal claims

d) Restriction of processing

In accordance with Art. 18 GDPR, you can request the restriction of the processing of your personal data for one of the following reasons:

You dispute the accuracy of your personal data.
The processing is unlawful and you refuse to delete the personal data.
We no longer need the personal data for the purposes of processing, but you require it to assert, exercise or defend legal claims.
You object to the processing pursuant to Art. 21 Para. 1 GDPR.

e) Informing

If you have requested the rectification or erasure of your personal data or a restriction of processing in accordance with Art. 16, Art. 17 or Art. 18 GDPR, we will inform all recipients to whom your personal data was disclosed, unless doing so should prove impossible or involve disproportionate expenditure. You can request that we inform you of these recipients.

f) Transmission

You have the right to receive your personal data that you have provided to us in a structured, common and machine-readable format.

You also have the right to request that this data be transmitted to a third party, provided that the processing was carried out using automated procedures and is based on consent in accordance with Art. 6 Para. 1 S. 1 lit. a or Art. 9 Para. 2 lit. a or on a contract in accordance with Art. 6 Para. 1 S. 1 lit. b GDPR.

g) Revocation

According to Art. 7 Para. 3 GDPR, you have the right to revoke your consent at any time. The revocation of your consent does not affect the legality of the processing carried out on the basis of your consent until the revocation. In the future, we may no longer continue the data processing that was based on your revoked consent.

h) Complaint

According to Art. 77 GDPR, you have the right to complain to a supervisory authority if you believe that the processing of your personal data violates the GDPR.

i) objection

your personal data is processed on the basis of legitimate interests in accordance with Art. 6 Paragraph 1 Clause 1 Letter f of GDPR, you have the right to object to the processing of your personal data in accordance with Art. 21 GDPR, provided there are reasons for doing so that arise from your particular situation or the objection is directed against direct advertising. In the latter case, you have a general right of objection, which we will implement without specifying the particular situation. If you would like to exercise your right of withdrawal or objection, simply send an email to datenschutz@padconcept.com

j) Automated decision-making in individual cases, including profiling

You have the right not to be subjected to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

is necessary for the conclusion or performance of a contract between you and us
is permitted by European Union or Member State law to which we are subject and this law contains appropriate measures to safeguard your rights and freedoms as well as your legitimate interests
with your express consent

11. Shopware Analytics

Purpose of processing: Together with our store software service provider, we evaluate certain information from our customer base under joint responsibility (e.g. customer group, pages visited, click paths, date and time of the visit, information about the end device used (resolution, resolution density, operating system), referrer URL, information about the browser used, locale, search queries and time zone). This information is processed by an external service provider and forwarded to us in approximate real time so that we can monitor the use of our website and improve our offerings.
Legal basis: Art. 6 para. 1 letter f GDPR
Data categories: Derived from core and contact data (the customer group, no individual customer data), usage data, connection data
Recipients of the data: shopware AG, Ebbinghoff 10, 48624 Schöppingen, Germany (as joint controller), IT service provider
The essence of joint responsibility: The joint responsibility exists between us and shopware AG; the data is collected in our store and then transferred to servers of shopware or its service providers; with the exception of obtaining your consent for the use of cookies or comparable technologies and the fulfillment of these information obligations, all obligations, in particular the implementation of the rights of data subjects, are the responsibility of shopware AG, which you can reach at legal@shopware.com. You can also assert your data subject rights with us; we will then forward your request to shopware AG accordingly. shopware AG can derive behavior patterns on our store from the data collected, but cannot assign this data to you as a person.
Intended third country transfer: None
Do we store or read personal data on your end device based on your consent? Yes, see Consent Management for details.

However, these decisions must not be based on special categories of personal data pursuant to Art. 9 (1) GDPR, unless Art. 9 (2)(a) or (g) GDPR applies and appropriate measures to protect your rights and freedoms as well as your legitimate interests have been taken. With regard to the cases referred to in i) and iii), we will take appropriate measures to safeguard your rights and freedoms as well as your legitimate interests, including at least the right to obtain human intervention on our part, to express your point of view and to contest the decision.