Privacy Notice for the Estabel GmbH Online Shop

This Privacy Notice informs you, on behalf of Estabel GmbH (hereinafter “Estabel”, “we” or “us”), about the processing of personal data in connection with your use of our online shop at www.estabel.com, as well as about the rights to which you are entitled under the General Data Protection Regulation (GDPR).

     I.         Controller

The controller within the meaning of the GDPR is:

Estabel GmbH

Oberanger 30

80331 Munich, Germany

Commercial register: Munich Local Court (Amtsgericht München), HRB 305622

Phone: 0151 23976852

Email: info@estabel.com or customercare@estabel.com

  II.         Collection, Processing and Use of Your Personal Data

1.    What data do we process and from which sources does it originate?

We process personal data that you provide to us in connection with your use of our online shop, in particular:

·       Master data (e.g. name, address, contact details such as telephone number and email address)

·       Order data (e.g. items ordered, order history)

·       Payment data (e.g. selected payment method, bank details in the case of direct debit, credit card data)

·       Communication data (e.g. content of contact made by email or telephone)

·       Usage data (e.g. IP address, date and time of access, pages accessed, browser used).

As a general rule, we collect this data directly from you, for example when you register a customer account, place an order, or contact us.

2.    Is there an obligation to provide data?

As a general rule, you are under neither a statutory nor a contractual obligation to provide your personal data. However, without certain data (in particular delivery and payment data), we cannot process an order or conclude and/or perform a purchase contract with you. Providing this data is therefore necessary in order to use our online shop and the related services.

3.    For what purposes and on what legal bases do we process your personal data?

To the extent that, in providing our online shop, we wish to use cookie functions that are not strictly necessary for the operation of the online shop, such as functionality, performance, or marketing cookies, we do so only where you have given your consent.

4.    To whom do we disclose your personal data?

Your personal data is disclosed to third parties only to the extent necessary. We disclose your personal data in particular to the following categories of recipients:

·       IT service providers that operate the online shop on our behalf (e.g. hosting and shop system providers)

·       Payment service providers for processing direct debit and credit card payments

·       Shipping service providers for delivering your order

·       Tax and legal advisers, as well as public authorities, to the extent we are legally obliged to provide information or disclose data

Our service providers, who are engaged for the purpose of preparing, carrying out, and following up on orders in our online shop, including the provision of the online shop and its functions, receive from us only such personal data as is necessary for the performance of the service engaged, and process the data solely on our behalf and in accordance with our instructions. All of our employees, and all employees of external service providers who have access to personal data and/or process such data, are obliged to treat this data as confidential.

5.    Is your personal data transferred to a third country?

As a general rule, your personal data is processed in countries that are members of the European Union (“EU”) and the European Economic Area (“EEA”).

Insofar as your data is nevertheless transferred to a country outside the EU or the EEA for which the European Commission has not issued an adequacy decision (a “third country”), Estabel takes the necessary measures to ensure an adequate level of protection for the personal data, such as entering into the EU Standard Contractual Clauses.

6.    How long is your personal data stored?

As a general rule, we anonymise or erase personal data once it is no longer required for the purposes set out above and provided that no statutory documentation or retention requirements (e.g. under the German Commercial Code, the German Fiscal Code, or other statutory provisions) preclude erasure.

Where required by law, or where we have a legitimate interest in retaining personal data – for example in the event of judicial or extrajudicial disputes relating to an order – longer retention of the data is possible. The personal data will be erased thereafter.

7.    Your Rights as a Data Subject

Where the statutory requirements are met, you may have the following rights:

·       the right to obtain information about the processing of your data and a copy of the data processed (right of access, Art. 15 GDPR),

·       the right to request the rectification of inaccurate data or the completion of incomplete data (right to rectification, Art. 16 GDPR),

·       the right to request the prompt erasure of personal data (right to erasure, Art. 17 GDPR),

·       the right to request restriction of the processing of your data (right to restriction of processing, Art. 18 GDPR),

·       the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance from us (right to data portability, Art. 20 GDPR),

If you have any further questions regarding data protection, or wish to exercise your rights as a data subject, you may contact us at any time. You can reach us by email at info@estabel.com or customercare@estabel.com, or by post at the address given in Section I above.

If you consider that our processing of personal data concerning you infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority. In addition to the other supervisory authorities referred to in Art. 77 GDPR, the supervisory authority of the place of the alleged infringement also has competence. As Estabel is established in Bavaria, the competent supervisory authority for Estabel is:

Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA)

Promenade 27

91522 Ansbach, Germany

www.lda.bayern.de

III.         Additional Country-Specific Data Protection Provisions

Estabel applies the substantive requirements of the GDPR as a minimum standard for the protection of personal data, irrespective of whether, in a particular case, another national data protection law additionally applies. The following country-specific additions apply exclusively to customers resident in Switzerland or the United Kingdom to whom Estabel delivers goods through the online shop, and contain only such additional information as goes beyond the level of protection set out above.

1.    Switzerland

To the extent that the processing of your personal data, as a data subject resident in Switzerland, falls within the scope of the Swiss Federal Act on Data Protection (Bundesgesetz über den Datenschutz, “FADP”), the information set out above applies correspondingly, subject to the requirements of the FADP. In addition to the rights set out in Section II.‎7 above, you have the right to lodge a complaint concerning the processing of your personal data with the Swiss Federal Data Protection and Information Commissioner (Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter, “FDPIC”), Feldeggweg 1, 3003 Bern, Switzerland, https://www.edoeb.admin.ch.

2.    United Kingdom

To the extent that Estabel offers goods to data subjects in the United Kingdom, thereby engaging the scope of the UK General Data Protection Regulation as supplemented by the Data Protection Act 2018 (“UK GDPR”), the information set out above applies correspondingly, subject to the requirements of the UK GDPR. In addition to the rights set out in Section II.‎7 above, you have the right to lodge a complaint with the competent UK supervisory authority, the Information Commissioner's Office (“ICO”), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom, https://ico.org.uk.