Privacy policy

Our data protection provisions contain technical terms that are defined in the DSGVO and the BDSG. For your better understanding, we want to explain these terms briefly in simple words in advance:

2.1 Personal Data

"Personal data" refers to all information relating to an identified or identifiable person (Art. 4 No. 1 DSGVO). Information of an identified person can be, for example, the name or email address. However, personal data also include data where the identity is not immediately apparent but can be determined by combining one's own or third-party information to find out who it is. A person can be identified, for example, through the indication of their address or bank details, date of birth, username, IP addresses, and/or location data. Relevant here are all information that allows any inference to a person in any way.

2.2 Processing

Under "Processing," Art. 4 No. 2 DSGVO includes any operation or set of operations performed on personal data. This includes, in particular, collecting, recording, organizing, structuring, storing, adapting, or altering, retrieving, consulting, using, disclosing by transmission, dissemination, or otherwise making available, aligning or combining, restricting, erasing, or destroying personal data.

 II. Controller and Dara Protection Officer

2. CONTROLLER

Responsible for data processing is:

Company: Struck-Leuchten GmbH & Co. KG ("we")

Legal Representative: Markus Struck (Managing Director)

Address: Ottenhausener Str. 41, 32839 Steinheim

Phone: +49(0)5233/9493-0

Email: info@struck-lichtwerbung.de

4. DATA PROTECTION OFFICER

We have appointed an internal data protection officer for our company. You can reach her at:

Company: Struck-Leuchten GmbH & Co. KG

Daniela Nübel

Address: Ottenhausener Str. 41, 32839 Steinheim

Phone: +49(0)5233/9493-24

Email: daniela.nuebel@struck-lichtwerbung.de

III. Processing Framework

5. PROCESSING FRAMEWORK: WEBSITE

As part of the website, we process the personal data listed in detail in section IV. below. We only process data from you that you actively provide on the website (e.g., by filling out forms) or that you automatically provide when using our services.

Your data is processed solely by us and generally not sold, loaned, or disclosed to third parties. If we use external service providers to process your personal data, this is done within the framework of a so-called order processing, where we, as the client, have instructive authority over our contractors. Our website is operated on the shop system of the external service provider "Shopify" (Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland).

Shopify hosts our website with the external provider Google Ireland Limited (Gordon House, Barrow Street, Dublin 4 Ireland) in the data center location. The operation of our online shop takes place within the framework of order processing. All data collected on our website is processed on Shopify's servers. Your data may also be transmitted to Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada, Shopify Data Processing (USA) Inc., Shopify Payments (USA) Inc., or Shopify (USA) Inc. as part of the processing by Shopify. By decision of the European Commission, the adequate level of data protection in Canada is ensured. Shopify also processes your data in the USA. Further information on data protection at Shopify can be found at: www.shopify.de/legal/datenschutz

If additional external service providers are used for individual processing operations listed in section IV., they will be named there.

Data transmission to third countries generally does not take place by us and is also not planned. We will inform you about exceptions to this principle in the processing described below. Any data transmission to third countries then takes place on the basis of the so-called EU standard contractual clauses.

IV. Processing in Detail

6. PROVISION OF THE WEBSITE AND SERVER LOGFILES SHOPIFY

With each visit to the website, our shop provider Shopify automatically collects information that your browser transmits to the Shopify server. These are also stored in Shopify's so-called log files. The information includes the request, the IP address, browser type and language, as well as the date and time of the request. The information is used by Shopify for the analysis and maintenance of the technical operation of the servers and the network, as well as for combating abuse, and is automatically deleted after 7 days. We have no access to these server log files.

7. CONTENT DELIVERY NETWORK (CDN)

7.1 Description of Processing

The online shop uses so-called Content Delivery Networks (CDN). These are provided by our shop system service provider Shopify. CDNs shorten the loading time of the website because files are transferred from fast, nearby, or less busy servers of external service providers. CDNs globally distribute our online shop via an internationally distributed server landscape to reduce access time for visitors. CDNs also perform security functions. Our online shop is distributed via the external service provider Cloudflare. When you visit our website, it is delivered to you by a nearby server.

7.2 Purpose

The processing is carried out to shorten the loading time of our website and to perform security functions.

7.3 Legal Basis

The processing is necessary to safeguard the legitimate interests of the data controller (Art. 6 para. 1 lit. f DSGVO). Our legitimate interest lies in the purpose stated in section 7.2.

7.4 Recipients and Transfer to Third Countries

By using CDNs on our Shopify online shop, your data is transmitted to one of the following CDNs:

Cloudflare is a service provided by Cloudflare, Inc. Further information can be found in Cloudflare's privacy policy at www.cloudflare.com/security-policy/.

8. REGISTRATION AND CUSTOMER ACCOUNT

8.1 Description of Processing

As part of your purchase in our online shop, you can set up a free ongoing customer account with us. In your customer account, you can view and manage your orders, and in the future, shop faster and more conveniently since you don't have to enter your personal data again for later (additional) purchases. Setting up a customer account is not mandatory. You can also shop as a guest. To obtain a customer account, registration is required, e.g., as part of your first purchase. Registration is done by filling out and electronically submitting the registration form on our online shop. To register, you need to provide your first and last name, your email address, and a freely chosen password (entered twice, identical). After clicking the checkbox to agree to our privacy policy and clicking the "Create My Account" button, you submit the form or the provided data to us. You will then receive an automatic welcome email containing a link to confirm your email address. Only after successfully verifying your email address by clicking the confirmation link will your customer account on our online shop be activated. In addition to the information provided during registration, your billing and shipping addresses, as well as your preferred payment method, are stored in your customer account.

8.2 Purpose

The processing is carried out to provide you with a free ongoing customer account in our online shop.

8.3 Legal Basis

The processing is based on the establishment and management of the ongoing customer account (and the storage of the payment method) on the basis of a free user contract for the use of our online shop (Art. 6 para. 1 lit. b DSGVO). If we obtain consent during registration, the processing is based on this consent in accordance with Art. 6 para. 1 lit. a DSGVO. Your consent is voluntary.

8.4 Storage Period and Withdrawal of Consent

We process your personal data related to your customer account until the termination of your user contract as a rule, or until you revoke your consent if we have asked for consent during registration. You can revoke your consent at any time with effect for the future. A simple statement (by post to Struck-Leuchten GmbH & Co. KG, Ottenhausener Str. 41, 32839 Steinheim, by email to info@struck-lichtwerbung.de) is sufficient for this purpose. Revoking your consent does not affect the lawfulness of the processing carried out based on the consent before the revocation. In the event of a revocation, however, we will delete your customer account in our online shop. After the termination of your user contract or the revocation of your consent, we will automatically delete your customer account on our online shop. Additionally, as a logged-in user, you can edit and remove your own information and details at any time.

9. PURCHASE

9.1 Description of Processing

As part of your order process, we process personal data from you. You can shop on our website as a guest or as a registered user. If you shop as a registered user (see section 8) on our website, you can store your billing and shipping addresses, as well as your preferred payment method for a faster and more convenient order with us in your user profile.

If you shop as a guest, you need to fill out the order form during your purchase. The mandatory fields marked with an asterisk in our online shop (email address, first name, last name, address) must be filled out by you. Otherwise, we cannot conclude a purchase contract with you and send you the desired goods. All other information is voluntary. When shopping on our website, you can also choose one of the offered payment methods (PayPal or Shopify Payments) to settle the purchase price. If you choose the PayPal Express payment method, you do not have to fill out the aforementioned mandatory fields in our online shop when making a guest order. After clicking the PayPal Express button, you will be immediately redirected to the PayPal website, where you can log into your respective account. Once you confirm the purchase on PayPal, your personal data will be transferred from PayPal to us and entered into the order form.

When completing your order, the data required for payment will be forwarded to the respective payment service provider, if this has not already happened - as in the case of PayPal Express. In addition, for the processing of the delivery, your first name, last name, and address will be transmitted to our shipping service provider UPS. As part of the order process, you will receive information about the current status of your order shipment from us at the email address you provided. You will receive a link from us through which you can directly retrieve the shipping status of your order from the shipping service provider.

9.2 Purpose

The processing is carried out to conclude and process purchase contracts and to inform you via email about the current status of your order shipment.

9.3 Legal Basis

The processing is necessary for the conclusion and fulfillment of purchase contracts (Art. 6 para. 1 lit. b DSGVO). This also includes the transfer of data required for payment processing to the respective payment service provider and the transmission of data required for the delivery of goods to the shipping service provider UPS.

9.4 Storage Period and Withdrawal of Consent

We are obliged to store your address, payment, and order data for a period of ten years due to commercial and tax regulations. However, we restrict processing after two years. This means that your data will only be kept separately for compliance with legal retention periods and will be deleted immediately after their expiration.

9.5 Recipients

To process your payment, personal data will be transferred to one of the following external payment service providers selected by you during your purchase:

• PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal reserves the right to transmit personal data to credit agencies for identity and credit checks under certain circumstances. Further information on data protection at PayPal can be found at www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE

• Shopify Payments: Shopify Payments 3rd Floor, Europa House, Harcourt Building, Harcourt Street, Dublin 2. If you choose one of the payment service providers offered by Shopify Payments, the payment processing will be carried out by the respective service provider. Further information on data protection at Shopify Payments can be found at: www.shopify.com/legal/privacy.

To carry out and process the delivery of goods, we will transfer the data required for this purpose to the shipping service provider selected by you:

• UPS: United Parcel Service Deutschland S.à r.l & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany

10. COOKIES AND OTHER TRACKING TECHNOLOGIES

10.1 Description of Processing

Our website uses cookies. Cookies are small text files that are stored on the user's device when visiting a website. Cookies contain information that enables the recognition of a device and, if applicable, certain functions of a website. We distinguish between our own cookies and external, so-called third-party cookies. Our site uses so-called "session cookies" and "persistent cookies." "Session cookies" are automatically deleted when you end your internet session and close the browser. Persistent cookies remain stored on your device for a longer period. If cookies are technically necessary for the operation of our site, your consent is not required for this. All other cookies and tracking technologies that are not technically necessary are only set after you have actively consented to the use of cookies/tracking technologies.

10.2 Purpose

We use cookies to make our website more user-friendly and to provide the functions described in section 10.1.

10.3 Legal Basis

The processing of technically necessary cookies is necessary to safeguard the overriding legitimate interests of the data controller (Art. 6 para. 1 lit. f DSGVO). Our legitimate interest lies in the purpose specified in section 10.2. For the processing of all other – i.e., non-technically necessary cookies/tracking technologies – the legal basis is consent (Art. 6 para. 1 lit. a DSGVO). Such consent is voluntary.

10.4 Storage Duration, Withdrawal of Consent

Cookies are automatically deleted at the end of a session or after the specified storage period has expired. Since cookies are stored on your device, you as a user have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Already stored cookies can be deleted. This can also be done automatically. If cookies for our website are deactivated, deleted, or restricted, it may not be possible to use individual functions of our website or only to a limited extent. Any consent given by you for the use of cookies can be revoked at any time in your settings with effect for the future.

10.5 Recipients

When third-party cookies are used, data may be transmitted to the respective providers of these third-party services. Under certain circumstances, this may also involve transmission to third countries outside the European Union or the European Economic Area. We inform about the recipients of data and any transmission to third countries in the corresponding section on the third-party service in these data protection provisions.

11. CONTACT VIA EMAIL

11.1 Description of Processing

You can also contact us via the email addresses provided on the website. To contact us, you can write to us using the email address provided on the website. In this case, the personal data transmitted with the email will be processed by us.

11.2 Purpose

The data transmitted with and in your email will be used exclusively for the purpose of processing and responding to your request.

11.3 Legal Basis

The processing is necessary to safeguard the overriding legitimate interests of the data controller (Art. 6 para. 1 lit. f DSGVO). Our legitimate interest lies in the purpose specified in section 10.2. If the email contact is aimed at concluding or fulfilling a contract, the data processing is carried out to fulfill the contract (Art. 6 para. 1 lit. b DSGVO).

11.4 Storage Duration

We will delete the data as soon as it is no longer necessary to achieve the purpose of its collection. This is usually the case when the respective communication with you has ended. Communication is deemed to have ended when it can be inferred from the circumstances that your request has been conclusively clarified. If statutory retention periods prevent deletion, deletion will take place immediately after the statutory retention period has expired.

12. SOCIAL NETWORKS

12.1 Description of Processing

Our website does not use so-called social media plugins. The logos of the social networks Facebook, Instagram, and YouTube displayed on our website are merely linked to the respective profiles of our company. If you click on one of the logos, you will be redirected to the external website of the respective social network.

However, our profiles within the social networks also involve data processing. If you are logged into the respective social network when visiting such a profile, this information will be associated with your user account there. If you interact with our profile, such as sharing or liking a post, this information will also be stored in your user account. On the social networks Facebook and Instagram, we have the option to obtain statistical data about the use of our Facebook page or Instagram profile via the so-called "Insights" function. These statistics are provided by Facebook or Instagram. The "Insights" function cannot be waived. We cannot decide whether to enable or disable this function. It is available to all Facebook fan page operators and all operators of an Instagram business account, regardless of whether you use the Insights function or not. Via Facebook Insights, we are provided with the following data in anonymized form for a selectable period regarding fans, subscribers, reached persons, and interacting persons: total number of page views, "likes" including origin, page activities, post interactions, reach, post reach (divided into organic, viral, and paid interactions), comments, shared content, responses, as well as demographic evaluations, including country of origin, gender, and age. With the Insights statistics, it is not possible for us to identify subscribers and fans of our page and view their profiles. Furthermore, we are provided with data in anonymized form via Instagram Insights about the development and reach of our Instagram profile, as well as the posts, stories, and videos we post there. In Instagram Insights, we also receive statistical information about the place of origin, gender, and age of the subscribers to our Instagram profile.

The social networks with which you communicate store your data using pseudonyms as usage profiles and use them for advertising purposes and market research. For example, you may be shown advertisements within the social network and on other third-party websites that correspond to your presumed interests. Cookies are usually used for this purpose, which the social network stores on your device. Further information on cookies can be found in section 10. You have the right to object to the creation of these user profiles, which you must exercise directly with the social networks.

12.2 Purpose

We maintain profiles on the aforementioned social networks for the purpose of contemporary and supportive public relations and corporate communication with customers and interested parties. We use the "Facebook Insights" function to make our posts on our Facebook fan page more attractive to our visitors. For example, we can use preferred visiting times of visitors to optimally plan our posts.

12.3 Legal Basis

The legal basis for data processing within our profiles on social networks and the use of the Falcon.io service is the protection of our overriding legitimate interests (Art. 6 para. 1 lit. f DSGVO). Our legitimate interest lies in the purpose specified in section 12.2. If you are asked by the operator of a social network for consent, the legal basis is Art. 6 para. 1 lit. a DSGVO. The data processing concerning our Facebook fan page is also based on an agreement on joint responsibility in accordance with Art. 26 DSGVO.

12.4 Recipients and Transmission to Third Countries

The respective social networks are operated by the companies listed below. Further information on data protection regarding our profile on social networks can be found in the linked data protection provisions.

• Facebook: Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA. Data protection provisions: https://www.facebook.com/policy.php; www.facebook.com/help/186325668085084, www.facebook.com/about/privacy/your-info-on-other#applications and www.facebook.com/about/privacy/your-info#everyoneinfo.

• Instagram: Instagram LLC, 1601 Willow Rd, Menlo Park, California 94025, USA; Data protection provisions: help.instagram.com/155833707900388/.

13. GOOGLE ANALYTICS

13.1 Description of Processing

Our website uses "Google Analytics," a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as "Google"). Google Analytics uses cookies (see section 10.) which enable an analysis of your use of our website. The information generated by the cookies about your use of our website is usually transmitted to a Google server in the USA and stored there. However, we use Google Analytics exclusively with IP anonymization. This means that your IP address will be truncated by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area before being transmitted to the USA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. The statistics created by Google Analytics particularly capture how many users visit our website, from which country or location access is made, which subpages are accessed, and through which links or search terms visitors access our website. The terms of use of Google Analytics can be found at www.google.com/analytics/terms/de.html. An overview of data protection at Google Analytics is available at www.google.com/intl/de/analytics/learn/privacy.html. Google's privacy policy can be viewed at www.google.de/intl/de/policies/privacy.

13.2 Purpose

The processing is carried out to evaluate the use of our website. The information obtained in this way is used to improve and tailor our online presence to meet demand.

13.3 Legal Basis

The processing is based on consent pursuant to Art. 6 para. 1 lit. a DSGVO. Such consent is voluntary.

13.4 Storage Duration and Right to Object, Withdrawal of Consent

We have explained the storage duration as well as your control and adjustment options for cookies in section 10.4. You can object to the processing of your data by Google Analytics at any time by downloading and installing the browser add-on offered by Google at tools.google.com/dlpage/gaoptout?hl=de. The analyzed data processed and stored by Google Analytics will be automatically deleted by us after 14 months.

13.5 Recipients and Transfer to Third Countries

According to the German data protection supervisory authorities (Datenschutzkonferenz), Google Analytics operates jointly with us as the data controller in the processing of data. Against this background, we have also concluded the "Google Measurement Controller-Controller Data Protection Terms" with Google. Google also processes your personal data in the USA.

14. GOOGLE ADS CONVERSION

14.1 Description of Processing

Our website uses the advertising service "Google Ads Conversion," operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as "Google"). With the help of Google Ads Conversions, we can advertise on external websites to draw attention to our offers there. In addition, the service allows us to determine the reach and success of individual advertising measures. Our ads are delivered by Google via so-called "Ad Servers." Google uses so-called "Ad Server" cookies to measure certain parameters for success measurement, such as ad impressions or clicks by users. If you arrive at our website via a Google ad, Google Ads will store a cookie on your device (see section 10). According to Google, these cookies are not intended to personally identify you. Typically, this cookie stores the unique cookie ID, the number of ad impressions per placement (frequency), the last impression (relevant for post-view conversions), and opt-out information (indication that the user no longer wishes to be addressed). The cookies enable Google to recognize your internet browser. If you visit websites of a Google Ads customer and the cookie stored on your device has not expired, Google and the customer can recognize that you clicked on the ad and were redirected to our website. Each Google Ads customer is assigned a different cookie. Therefore, cookies cannot be tracked across Google Ads customers' websites. We do not process any personal data with our Google AdWords advertising measures. Google only provides us with statistical evaluations. Based on these evaluations, we can identify which of the advertising measures used are particularly effective. We do not receive any further data from the use of the advertising materials, in particular, we cannot identify users based on this information. When you visit our website, a connection to Google's servers is established. We have no influence on the scope and further use of the data collected by Google Ads Conversion by Google and therefore inform you to the best of our knowledge: By integrating Google Ads Conversion, Google receives information about which subpage of our website you visited or clicked on an ad from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, it is possible that Google may obtain and store your IP address.

Further information on data protection at Google can be found here: policies.google.com/privacy?hl=en and services.google.com/sitestats/en.html.

14.2 Purpose

The processing is carried out to conduct targeted online advertising for our own offers and to evaluate their effectiveness and reach.

14.3 Legal Basis

The processing is based on consent pursuant to Art. 6 para. 1 lit. a DSGVO.

14.4 Storage Duration and Right to Object, Withdrawal of Consent

We have explained the storage duration, as well as your control and adjustment options for cookies, in section 10.4. You can object to the processing of data by Google Ads Conversion at any time via the following website: www.google.com/ads/preferences. You can revoke the consent you have given for data collection by Google Ads Conversion at any time with effect for the future.

14.5 Recipients and Transfer to Third Countries

Through the integration of Google Ads Conversion, personal data may be transmitted to Google. Google also processes your personal data in the USA. This takes place within the framework of order processing.

15. GOOGLE RECAPTCHA

15.1 Description of Processing

Our website uses "reCAPTCHA," a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA (hereinafter "Google"). With reCAPTCHA, we can check whether entries in forms are made by a human or by automated software, especially so-called bots. This allows us to protect our website from spam and abuse. In this context, your IP address, the duration of your visit to the website, mouse movements made by you, and possibly other data required for the reCAPTCHA service are transmitted to Google. Further information on data protection at Google can be found at policies.google.com/privacy?hl=en-GB.

15.2 Purpose

The processing is carried out to secure forms on our website against abuse and spam.

15.3 Legal Basis

The processing is necessary to safeguard the overriding legitimate interests of the controller (Art. 6 para. 1 lit. f DSGVO). Our legitimate interest lies in the purpose specified in section 15.2.

15.5 Recipients and Transfer to Third Countries

Google also processes your personal data in the USA.

V. Security Meaures 

16. SECURITY MEASURES

To protect your personal data from unauthorized access, we have equipped our website with an SSL or TLS certificate. SSL stands for "Secure Sockets Layer" and TLS for "Transport Layer Security," encrypting the communication of data between a website and the user's device. You can recognize the active SSL or TLS encryption by a small padlock logo displayed to the left in the browser's address bar.

VI. Your Rights

17. DATA SUBJECT RIGHTS

With regard to the data processing described above by our company, you have the following data subject rights:

17.1 Information (Art. 15 DSGVO)

You have the right to request confirmation from us as to whether we are processing personal data concerning you. If this is the case, you have the right, under the conditions set out in Art. 15 DSGVO, to obtain information about this personal data and the information listed in detail in Art. 15 DSGVO.

17.2 Rectification (Art. 16 DSGVO)

You have the right to request us to correct without delay any inaccurate personal data concerning you and, if necessary, to complete incomplete personal data.

17.3 Erasure (Art. 17 DSGVO)

You have the right to request us to erase personal data concerning you without undue delay, provided that one of the reasons listed in Art. 17 DSGVO applies, e.g., if your data are no longer necessary for the purposes for which we collected them.

17.4 Restriction of Processing (Art. 18 DSGVO)

You have the right to request us to restrict processing if one of the conditions listed in Art. 18 DSGVO applies, e.g., if you dispute the accuracy of your personal data, processing will be restricted for the period that allows us to verify the accuracy of your data.

17.5 Data Portability (Art. 20 DSGVO)

You have the right, under the conditions set out in Art. 20 DSGVO, to receive the personal data concerning you in a structured, commonly used, and machine-readable format.

17.6 Withdrawal of Consent (Art. 7 para. 3 DSGVO)

If processing is based on consent, you have the right to withdraw your consent at any time. The withdrawal takes effect from the time it is declared. In other words, the processing does not become retroactively unlawful due to the withdrawal of consent.

17.7 Complaint (Art. 77 DSGVO)

If you believe that the processing of personal data concerning you violates the DSGVO, you have the right to lodge a complaint with a supervisory authority. You can exercise this right with a supervisory authority in the EU member state of your habitual residence, place of work, or the place of the alleged infringement.

17.8 Prohibition of Automated Decision-Making/Profiling (Art. 22 DSGVO)

Decisions that have legal effects on you or significantly affect you may not be based solely on automated processing of personal data - including profiling. We inform you that we do not use automated decision-making, including profiling, regarding your personal data.

17.9 Right to Object (Art. 21 DSGVO)

If we process personal data about you based on Art. 6 para. 1 lit. f DSGVO (to safeguard legitimate interests), you have the right to object under the conditions set out in Art. 21 DSGVO. However, this only applies if there are reasons arising from your particular situation. After an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights, and freedoms, or if processing serves the assertion, exercise, or defense of legal claims. In any case, even without a particular situation, you have the right to object at any time to the processing of your personal data for direct marketing purposes.

As of: April 30, 2024