Table of Contents
As of February 2026
- Name and Address of the Controller
- Contact Details of the Data Protection Officer
- General Information on Data Processing
- Rights of the Data Subject
- Provision of the Website and Creation of Log Files
- Use of Cookies
- Webshop
- Ordering in the Webshop
- Payment Options
- Shipping Service Providers
- Email Contact
- Contact Form
- Partner Programs
- Review Portal
- Email Dispatch
- Content Delivery Networks
- Use of Matomo Analytics Software
- Use of Google Analytics
- Use of LiveChat
- Use of Meta Tracking Pixel
- Used Plugins
1. Name and Address of the Controller
The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is:
myfolie GmbH
Von-Stauffenberg-Str, 27
82008 Unterhaching
Germany
2. Contact Details of the Data Protection Officer
The data protection officer of the controller is
DataCo GmbH
Dachauer Straße 65
80335 Munich
Germany
+49 89 / 7400 45840
www.dataguard.de
3. General Information on Data Processing
I.) Scope of Processing of Personal Data
We generally process personal data of our users only to the extent necessary to provide a functional webshop as well as our content and services. The processing of personal data of our users is regularly carried out only with the user's consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by legal regulations.
II.) Legal Basis for Processing Personal Data
Insofar as we obtain the consent of the data subject for processing operations of personal data, Art. 6 para. 1 sentence 1 lit. a GDPR serves as the legal basis.
When processing personal data necessary for the performance of a contract to which the data subject is party, Art. 6 para. 1 sentence 1 lit. b GDPR serves as the legal basis. This also applies to processing operations necessary to carry out pre-contractual measures.
Insofar as processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6 para. 1 sentence 1 lit. c GDPR serves as the legal basis.
In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 sentence 1 lit. d GDPR serves as the legal basis.
If processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, and the interests, fundamental rights, and freedoms of the data subject do not override the first-mentioned interest, Art. 6 para. 1 sentence 1 lit. f GDPR serves as the legal basis for the processing.
III.) Data Deletion and Storage Duration
The personal data of the data subject will be deleted or blocked as soon as the purpose of storage ceases to apply. Storage may also take place if this has been provided for by the European or national legislator in EU regulations, laws, or other provisions to which the controller is subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless further storage of the data is necessary for the conclusion or fulfillment of a contract.
4. Rights of the Data Subject
If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:
I.) Right of Access (Art. 15 GDPR)
You have the right to request confirmation from us as to whether personal data concerning you is being processed.
- If this is the case, you have the right to access this data and the following information:
- Processing purposes
- Categories of personal data
- Recipients or categories of recipients
- Planned storage duration or the criteria for determining this duration
- The existence of rights to rectification, erasure, restriction, or objection
- Right to lodge a complaint with the competent supervisory authority
- Where applicable, the source of the data (if collected from a third party)
- Where applicable, the existence of automated decision-making including profiling with meaningful information about the logic involved, the scope, and the intended effects
- Where applicable, transfer of personal data to a third country or international organization
II.) Right to Rectification (Art. 16 GDPR)
If your personal data is incorrect or incomplete, you have the right to request immediate correction or completion of the personal data.
III.) Right to Restriction of Processing (Art. 18 GDPR)
If one of the following conditions is met, you have the right to request the restriction of processing of your personal data:
- You contest the accuracy of your personal data, for a period enabling us to verify the accuracy of the personal data.
- In the event of unlawful processing, you oppose the erasure of the personal data and request the restriction of their use instead.
- We no longer need your personal data for the purposes of processing, but you require them for the establishment, exercise, or defense of legal claims, or
- after you have objected to processing, for the duration of the assessment as to whether our legitimate grounds override your grounds.
IV.) Right to Erasure (“Right to be Forgotten”) (Art. 17 GDPR)
If one of the following reasons applies, you have the right to request the immediate erasure of your personal data:
- Your data is no longer necessary for the purposes for which it was originally collected.
- You withdraw your consent and there is no other legal basis for processing.
- You object to the processing and there are no overriding legitimate grounds for the processing, or you object pursuant to Art. 21 para. 2 GDPR.
- Your personal data has been unlawfully processed.
- Erasure is required for compliance with a legal obligation under Union or Member State law to which we are subject.
- The personal data was collected in relation to services offered by the information society in accordance with Art. 8 para. 1 GDPR.
Please note that the above reasons do not apply to the extent that processing is necessary:
- For exercising the right of freedom of expression and information;
- For compliance with a legal obligation or for the performance of a task carried out in the public interest to which we are subject.
- For reasons of public interest in the area of public health.
- For archiving purposes in the public interest, scientific or historical research purposes, or for statistical purposes.
- For the establishment, exercise, or defense of legal claims.
V.) Right to Notification
If you have exercised your right to rectification, erasure, or restriction of processing against the controller, the controller is obliged to communicate any rectification or erasure of data or restriction of processing to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients by the controller.
VI.) Right to Data Portability (Art. 20 GDPR)
You have the right to receive your personal data in a structured, commonly used, and machine-readable format or to request the transmission to another controller.
VII.) Right to Object to Certain Data Processing (Art. 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 para. 1 sentence 1 lit. e or f GDPR. This also applies to profiling based on these provisions. If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
VIII.) Right to Withdraw Consent under Data Protection Law
You have the right to withdraw your consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
IX.) Automated Individual Decision-Making Including Profiling
You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision is necessary for entering into, or performance of, a contract between you and the controller, is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or is based on your explicit consent.
However, such decisions must not be based on special categories of personal data under Art. 9 para. 1 GDPR unless Art. 9 para. 2 lit. a or b GDPR applies and appropriate measures to protect the rights and freedoms and your legitimate interests have been taken. In the cases referred to in a. and c., the controller shall take appropriate measures to safeguard your rights and freedoms and legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your point of view, and to contest the decision.
X.) Right to Lodge a Complaint with a Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data relating to you infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR. A list of the competent supervisory authorities in Germany can be found on the website of the Federal Commissioner for Data Protection at the following link:
https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html
5. Provision of the Website and Creation of Log Files
I.) Description and Scope of Data Processing
Every time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.
The following data is collected:
- Information about the browser type and version used
- The user's operating system
- The user's Internet service provider
- The user's IP address
- Date and time of access
- Websites from which the user's system accesses our website
- Websites accessed by the user's system via our website
This data is stored in the log files of our system. This data is not stored together with other personal data of the user.
II.) Purpose of Data Processing
The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.
Storage in log files is carried out to ensure the functionality of the website. In addition, the data helps us optimize the website and ensure the security of our information technology systems. The data is not evaluated for marketing purposes in this context.
These purposes also constitute our legitimate interest in data processing pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR.
III.) Legal Basis for Data Processing
The legal basis for the temporary storage of data and log files is Art. 6 para. 1 sentence 1 lit. f GDPR.
IV.) Duration of Storage
The data is deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. In the case of data collection for the provision of the website, this is the case when the respective session is ended.
In the case of storage of data in log files, this is the case after seven days at the latest. Further storage is possible. In this case, the IP addresses of the users are deleted or anonymized so that assignment of the calling client is no longer possible.
V.) Possibility of Objection
The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. The user may object. Whether the objection is successful must be determined within the framework of a balancing of interests.
6. Use of Cookies
I.) Description and Scope of Data Processing
When you visit our website, we use technical tools for various functions, in particular cookies, which may be stored on your device. When accessing our website and at any time thereafter, you have the choice whether to allow cookies in general or to select individual additional functions. You can make changes in your browser settings or via our consent manager. Cookies are text files or information in a database that are stored on your hard drive and assigned to the browser you are using, so that certain information flows to the entity that sets the cookie. Below we describe what types of cookies we use: We use technically necessary cookies that are required for the technical structure of the website. Without these cookies, our website cannot be displayed (completely correctly) or support functions are not possible.
The following data is stored and transmitted by technically necessary cookies:
- Session ID
- Cookie settings
We also use cookies on our website that enable an analysis of users' browsing behavior.
The following data may be transmitted in this way:
The data collected in this way is pseudonymized by technical means. Therefore, it is no longer possible to assign the data to the accessing user without additional information. The data is not stored together with other personal data of the users.
II.) Purpose of Data Processing
The purpose of using technically necessary cookies is to ensure the functionality of our website. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized even after a page change.
We need technically necessary cookies for the following applications:
- Shopping cart
- Functionality of the website
- Cookie settings
III.) Legal Basis for Data Processing
For the storage of information in the end user's device and/or access to information already stored in the end user's device, the provisions of the Telecommunications Telemedia Data Protection Act (TTDSG) apply. If the setting and reading of cookies is technically necessary, this is done to ensure the functionality of our website. In this case, the storage and access to cookies on your device is based on § 25 para. 2 no. 2 TTDSG. This storage and access to information on your device is intended to facilitate your use of our website and to provide you with our services as requested. Some functions of our website also do not work without the use of these cookies and could therefore not be offered. The cookies are generally deleted after the session ends (e.g. logging out or closing the browser) or after a specified period. Information on deviating storage periods for cookies can be found in the following sections of this privacy policy.
IV.) Duration of Storage, Objection and Removal Options
The user can withdraw their consent to the processing of personal data at any time. Cookies are stored on the user's computer and transmitted from there to our site. Therefore, you as the user also have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies for our website are deactivated, it may no longer be possible to use all functions of the website in full.
The transmission of Flash cookies cannot be prevented via the browser settings, but by changing the settings of the Flash Player.
If you use a Safari browser from version 12.1, cookies are automatically deleted after seven days. This also applies to opt-out cookies set to prevent tracking measures.
7. Webshop
We offer a webshop on our website. For this, we use proprietary webshop software.
The website and webshop are hosted on our own servers. Third parties have no access to server log files.
The servers automatically collect and store information in so-called server log files, which your browser automatically transmits when you visit the website. The stored information is:
- Browser type and version
- Operating system used
- Referrer URL
- Hostname of the accessing computer
- Date and time of the server request
- IP address
This data is not merged with other data sources. The collection of this data is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of its website – for this, the server log files must be recorded. The server location of the website is geographically in Germany.
7.1. Customer Account and Storage of Designs
I.) Description and Scope of Data Processing
You have the option to create a customer account on our website.
During registration and use of the customer account, the following personal data is processed in particular:
- First and last name
- Email address
- Password (stored encrypted)
- Billing and shipping address
- Phone number (optional)
- Order history
- Payment status
- Uploaded designs, graphics, and print data
- Saved drafts and configurations
For business customers (B2B), the following may also be processed:
- Company name
- Contact person
- VAT identification number
- if applicable, internal reference numbers
The storage of uploaded designs is carried out for contract fulfillment as well as for reuse by the customer.
II.) Purpose of Data Processing
The processing is carried out for:
Setting up and managing the customer account
Processing and handling orders
Storing designs for reuse
Processing complaints
Compliance with statutory retention obligations
III.) Legal Basis
The processing is based on:
- Art. 6 para. 1 sentence 1 lit. b GDPR (contract fulfillment)
- Art. 6 para. 1 sentence 1 lit. c GDPR (legal obligations)
- Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interest in user-friendly provision of the customer account)
If designs are stored beyond the mere contract processing, processing may also be based on consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.
IV.) Storage of Designs and Uploaded Content
Designs, graphics, and print data uploaded by customers are stored:
- for the production of the ordered products
- to enable repeat orders
- for the processing of warranty and complaint cases
As long as a customer account exists, saved designs remain stored until the customer account is deleted, unless statutory retention obligations or technical requirements prevent this.
After deletion of the customer account, personal data and saved designs are deleted, unless statutory retention obligations exist.
Deletion from backups is carried out as part of regular technical deletion cycles.
V.) Responsibility for Uploaded Content
The user is solely responsible for ensuring that the uploaded content:
- does not infringe the rights of third parties (e.g. copyrights, trademark rights, personal rights)
- does not contain special categories of personal data in accordance with Art. 9 GDPR, unless a separate legal basis exists
- Content uploaded is only checked by us on a random basis or for production-related reasons.
8. Ordering in the Webshop
I.) Description and Scope of Data Processing
We offer our customers the opportunity to design their own motifs and texts online and order them as adhesive films. After completing the order process, we receive personal data that we need to process the order. Mandatory information required for contract processing is specially marked, further information provided by uploading photos or contact details to be printed on the ordered adhesive film is voluntary. The personal data to be printed on the adhesive film may be forwarded to external service providers such as graphic designers. All other personal data will not be transmitted to external service providers outside the company.
II.) Purpose of Data Processing
The transfer of the personal data you voluntarily provide serves the purpose of processing the contract and creating the product when you purchase an adhesive film.
III.) Legal Basis for Data Processing
The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR, as the processing of the data is necessary for the execution of the concluded purchase contract.
IV.) Duration of Storage
Graphics/photos that you upload to be printed on the adhesive film will be deleted after the statutory retention periods have expired (for refund/warranty reasons).
All payment data and data on any chargebacks will only be stored as long as they are needed for payment processing and possible handling of chargebacks and debt collection as well as for combating misuse.
Furthermore, payment data may be stored beyond this if and as long as this is necessary to comply with statutory retention periods or to pursue a specific case of misuse.
Your personal data will be deleted after the statutory retention periods have expired, i.e. after a maximum of 10 years.
9. Payment Options
I.) Description and Scope of Data Processing
We offer our customers various payment options for processing their orders. For this purpose, we redirect customers to the platform of the respective payment service provider depending on the payment method. After completion of the payment process, we receive the customers' payment data from the payment service providers or our house bank and process this in our systems for invoicing and accounting purposes.
Payment via Amazon Pay
It is possible to process the payment transaction with the payment service provider AmazonPay. AmazonPay enables online payments to third parties by using the payment and shipping information stored in your Amazon account.
The European operating company of AmazonPay is Amazon Payments Europe s.c.a., 38 avenue J.F. Kennedy, L-1855 Luxembourg. If you already have an Amazon.de customer account, you can pay immediately with the payment method stored there – either by direct debit or credit card. This requires logging into your Amazon account.
Further information and your order overview for paying via AmazonPay can be found at https://pays.amazon.de. When paying via Amazon Pay, all personal data provided to or collected by Amazon Pay is primarily processed by Amazon Pays s.c.a. and secondarily by Amazon EU SARL, Amazon Services Europe SARL, and Amazon Media EU SARL, all three located at 5, Rue Plaetis L 2338, Luxembourg. Further information on the processing of your data by Amazon in the context of AmazonPay can be found in the Amazon Pay privacy policy at: https://pay.amazon.com/de/help/201751600
Payment by Credit Card
It is possible to complete the payment process by credit card.
If you have chosen payment by credit card, payment data will be forwarded to payment service providers for payment processing. All payment service providers comply with the requirements of the "Payment Card Industry (PCI) Data Security Standards" and have been certified by an independent PCI Qualified Security Assessor.
In the context of payment by credit card, the following data is regularly transmitted:
- Purchase amount
- Date and time of purchase
- First and last name
- Address
- Email address
- Credit card number
- Credit card validity period
- Security code (CVC)
- IP address
- Phone number / mobile number
Payment data is forwarded to the following payment service providers:
- Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Netherlands
Further information on the privacy policies as well as revocation and removal options with the payment service providers can be found here: https://www.adyen.com/de_DE/legal/terms-and-conditions
Payment via Billie (B2B Invoice Purchase)
We offer the option of invoice purchase via the payment service provider Billie GmbH.
Provider is Billie GmbH, Charlottenstraße 4, 10969 Berlin, Germany
If you select the payment method invoice purchase via Billie, personal data will be transmitted to Billie for the purpose of carrying out a credit check and payment processing.
This includes in particular:
- First and last name
- Billing and shipping address
- Company data (for B2B orders)
- Email address
- IP address
- Purchase amount
- if applicable, date of birth
- if applicable, other data required for payment processing
Billie carries out a risk check including a credit check. Probability values (score values) may be calculated. Processing is carried out for the purpose of deciding on the establishment, execution, or termination of the contractual relationship.
Further information on data processing by Billie can be found at:
https://www.billie.io/datenschutz/
Payment via PayPal
It is possible to process the payment transaction with the payment service provider PayPal.
Provider of this payment service is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.
If you select PayPal as the payment method, the data required for payment processing will be transmitted to PayPal.
This regularly includes:
- First and last name
- Billing and shipping address
- Email address
- IP address
- Purchase amount
- Date and time of purchase
- Payment method
- if applicable, other data required for payment processing
PayPal reserves the right to carry out a credit check. Probability values (score values) may be calculated. Further information on data processing by PayPal can be found at:
https://www.paypal.com/de/webapps/mpp/ua/privacy-full
Payment in Advance
If you have chosen payment in advance, we only process data provided by your bank. This data is only used to verify receipt of payment.
II.) Purpose of Data Processing
The transfer of payment data to payment service providers serves the purpose of processing the payment, e.g. when you purchase a product and/or use a service.
III.) Legal Basis for Data Processing
The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR, as the processing of the data is necessary for the execution of the concluded purchase contract.
IV.) Duration of Storage
All payment data and data on any chargebacks will only be stored as long as they are needed for payment processing and possible handling of chargebacks and debt collection as well as for combating misuse.
Furthermore, payment data may be stored beyond this if and as long as this is necessary to comply with statutory retention periods or to pursue a specific case of misuse.
Your personal data will be deleted after the statutory retention periods have expired, i.e. after a maximum of 10 years.
V.) Loss of Legal Basis
The payment service provider used remains entitled to process your payment data as long as this is necessary for proper payment processing. Legal retention periods may also apply.
10. Shipping Service Providers
I.) Description and Scope of Data Processing
If you order products or services on our website that require a shipping service provider for delivery, you will receive your order and shipping confirmation via your email address, and, depending on the shipping service provider, notification that your shipment has arrived and/or notification of parcel announcement and possible delivery options.
The data is transmitted to the following service providers:
- DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn
- General Logistics Systems Germany GmbH & Co. OHG, GLS Germany-Straße 1 - 7, DE-36286 Neuenstein
- United Parcel Service Deutschland S.à r.l. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany
The data transmitted regularly includes:
II.) Purpose of Data Processing
The purpose of processing personal data and transmitting address data to shipping service providers is to process the concluded purchase contract and deliver the goods.
III.) Legal Basis for Data Processing
The legal basis for transmitting your address data (first name, last name, address) to the respective shipping service provider is Art. 6 para. 1 sentence 1 lit. b GDPR, as the processing of the data is necessary for the execution of the concluded purchase contract.
IV.) Duration of Storage
The transmitted data is deleted by the respective shipping service provider once the parcel has been delivered.
V.) Objection and Removal Options
The notification service by the shipping service provider can be canceled by the affected user at any time. For this purpose, each email contains a corresponding opt-out link.
11. Email Contact
I.) Description and Scope of Data Processing
It is possible to contact us via the email address provided on our website. In this case, the personal data transmitted with the email will be stored.
The data is used exclusively for processing the conversation.
In connection with data processing, the data is passed on to the service provider: Zendesk Inc.
The order processing contract with Zendesk includes so-called EU standard contractual clauses (Art. 46 para. 2 sentence 1 lit. c GDPR). These are classified as an appropriate guarantee for the protection of the transfer and processing of personal data outside the EU.
Further information on the processing of data by Zendesk can be found here: https://www.zendesk.de/company/agreements-and-terms/privacy-notice/
II.) Purpose of Data Processing
In the case of contact by email, the necessary legitimate interest in processing the data also lies herein.
III.) Legal Basis for Data Processing
The legal basis for the processing of data transmitted in the course of sending an email is Art. 6 para. 1 lit. f GDPR. Our legitimate interest is to optimally respond to your inquiry sent by email. If the email contact is aimed at concluding a contract, an additional legal basis for processing is Art. 6 para. 1 lit. b GDPR.
IV.) Duration of Storage
The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected and statutory retention periods no longer require the retention of the data. For personal data sent by email, this is the case when the respective conversation with the user is finished. The conversation is finished when it can be inferred from the circumstances that the matter in question has been conclusively clarified.
V.) Possibility of Objection
If the user contacts us by email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.
Currently none, as contact is voluntary and purpose-bound and is only directed at customers or interested parties; deletion under GDPR can be requested by email
All personal data stored in the course of contacting us will be deleted in this case.
12. Contact Form
I.) Description and Scope of Data Processing
There is a contact form on our website that can be used for electronic contact. If a user takes advantage of this option, the data entered in the input mask will be transmitted to us and stored.
At the time the message is sent, the following data is stored:
- Email address
- IP address of the accessing computer
- Date and time the form is sent
- Order number & postal code if it concerns an existing order for verification;
- Other data provided by the user as a message
Alternatively, it is possible to contact us via the email address provided. In this case, the personal data transmitted with the email will be stored.
The data is used exclusively for processing the conversation.
In connection with data processing, the data is passed on to the service provider: Zendesk Inc.
The order processing contract with Zendesk includes so-called EU standard contractual clauses (Art. 46 para. 2 sentence 1 lit. c GDPR). These are classified as an appropriate guarantee for the protection of the transfer and processing of personal data outside the EU.
Further information on the processing of data by Zendesk can be found here: https://www.zendesk.de/company/agreements-and-terms/privacy-notice/
II.) Purpose of Data Processing
The processing of personal data from the input mask is solely for processing the contact request. In the case of contact by email, the necessary legitimate interest in processing the data also lies herein.
The other personal data processed during the sending process serves to prevent misuse of the contact form and to ensure the security of our information technology systems.
III.) Legal Basis for Data Processing
The legal basis for the processing of data transmitted in the course of sending a contact form is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest is to optimally respond to your inquiry sent via the contact form. If the contact via the contact form is aimed at concluding a contract, an additional legal basis for processing is Art. 6 para. 1 sentence 1 lit. b GDPR.
IV.) Duration of Storage
The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected and statutory retention periods no longer require the retention of the data. For personal data from the input mask of the contact form and those sent by email, this is the case when the respective conversation with the user is finished. The conversation is finished when it can be inferred from the circumstances that the matter in question has been conclusively clarified.
V.) Possibility of Objection
The user can withdraw their consent to the processing of personal data at any time. If the user contacts us by email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.
All personal data stored in the course of contacting us will be deleted in this case.
13. Partner Programs
We also use the services of the following partner programs:
Belboon GmbH: Weinmeisterstraße 12-14, 10178 Berlin
The controller has integrated components of Belboon on this website. Belboon is a German affiliate network offering affiliate marketing. If you click on an ad with a partner link, Belboon will place a cookie for conversion tracking on your computer. The cookies serve the purpose of proper billing within the partner program by recording the success of an advertising medium. The cookies recognize that you have clicked on the ad and the origin of the order with the advertiser can be tracked. Belboon also uses so-called tracking pixels. These allow information such as visitor traffic on the pages to be evaluated.
The information generated by cookies and tracking pixels about the use of this website (including the IP address) and the delivery of advertising formats is transmitted to and stored on a server of Belboon. Among other things, Belboon can recognize that the partner link on this website was clicked. Belboon may pass on this (anonymized) information to contract partners under certain circumstances, but data such as the IP address will not be merged with other stored data.
Where legally required, we have obtained your consent to the processing of your data as described above in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future. If you wish to block the evaluation of user behavior via cookies, you can set your browser to inform you about the setting of cookies and decide individually whether to accept them or to exclude the acceptance of cookies for certain cases or in general.
via an internet browser or other software programs.
For information on the processing of your personal data by Instagram and the corresponding objection options, please see:
Belboon: https://www.belboon.com/de/ueber-uns/datenschutz/
Firstlead GmbH (Adcell): Rosenfelder Str. 15-16, 10315 Berlin.
The controller has integrated components of Adcell on this website. Adcell is a German affiliate network offering affiliate marketing. If you click on an ad with a partner link, Adcell will place a cookie for conversion tracking on your computer. The cookies serve the purpose of proper billing within the partner program by recording the success of an advertising medium. The cookies recognize that you have clicked on the ad and the origin of the order with the advertiser can be tracked. Adcell also uses so-called tracking pixels. These allow information such as visitor traffic on the pages to be evaluated.
The information generated by cookies and tracking pixels about the use of this website (including the IP address) and the delivery of advertising formats is transmitted to and stored on a server of Adcell. Among other things, Adcell can recognize that the partner link on this website was clicked. Adcell may pass on this (anonymized) information to contract partners under certain circumstances, but data such as the IP address will not be merged with other stored data.
Where legally required, we have obtained your consent to the processing of your data as described above in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future. If you wish to block the evaluation of user behavior via cookies, you can set your browser to inform you about the setting of cookies and decide individually whether to accept them or to exclude the acceptance of cookies for certain cases or in general.
For information on the processing of your personal data by Adcell and the corresponding objection options, please see: https://www.adcell.de/agb#sector_6
14. Review Portal
Trust-Pilot Review
We participate in the review procedure of the provider Trustpilot A/S, Pilestræde 58, 5, 1112 Copenhagen, Denmark.
Trustpilot offers users the opportunity to review our services. Users who have used our service will be asked for their consent to receive a review request. If users have given the corresponding consent (by clicking a checkbox after completing the order), they will receive a review request with a link to a review page. To ensure that users have actually used our services, we transmit the necessary data to Trustpilot regarding the user and the service used (this includes name, email address, and an order number as well as the order date). This data is used solely to verify authenticity and address the user.
The legal basis for processing the user's data in the context of the review procedure is consent pursuant to Art. 6 para. 1 lit. a GDPR.
To submit a review, it is possible to open a customer account with Trustpilot. In this case, the terms and privacy notices of Trustpilot apply. To maintain the neutrality and objectivity of the reviews, we have no direct influence on the reviews and cannot delete them ourselves. For this, we ask users to contact Trustpilot.
Further information on the processing of your data by Trustpilot as well as on your rights to object and other data subject rights can be found in Trustpilot's privacy policy: https://de.legal.trustpilot.com/end-user-privacy-terms.
15. Email Dispatch
Mandrill
We use Mandrill by Mailchimp, provided by The Rocket Science Group, LLC, 512 Means Street, Suite 404 Atlanta, GA 30318 United States.
Mandrill is used upon order completion to send you an order confirmation as well as possible payment reminders and other emails. In doing so, we or our hosting provider process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers. The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR, as the processing of the data is necessary for the execution of the concluded purchase contract.
The order processing contract with Mandrill includes so-called EU standard contractual clauses (Art. 46 para. 2 sentence 1 lit. c GDPR). These are classified as an appropriate guarantee for the protection of the transfer and processing of personal data outside the EU.
Further information on Mandrill and data protection at Mandrill can be found here: http://mailchimp.com/legal/privacy/
16. Content Delivery Networks
I.) Description and Scope of Data Processing
We use functions of the Content Delivery Network KeyCDN by proinity LLC, Reichenauweg 1, 8272 Ermatingen, Switzerland, on our website. A Content Delivery Network (CDN) is a network of regionally distributed and internet-connected servers that deliver content – especially large media files such as videos. KeyCDN offers web optimization and security services that we use to improve the loading times of our website and to protect it from misuse. When you access our website, a connection is established to the servers of proinity LLC to retrieve content, for example. Personal data may be stored and evaluated in server log files, especially user activity (in particular, which pages were visited), and device and browser information (in particular, the IP address and operating system).
Further information on the collection and storage of data by proinity LLC can be found here: https://www.keycdn.com/privacy
II.) Purpose of Data Processing
The use of these functions serves the delivery and acceleration of online applications and content.
III.) Legal Basis for Data Processing
The collection of this data is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of its website – for this, the server log files must be recorded.
IV.) Duration of Storage
Your personal information will be stored as long as necessary to fulfill the purposes described in this privacy policy or as required by law.
V.) Objection and Removal Options
Information on objection and removal options with proinity LLC can be found at: https://www.keycdn.com/privacy
17. Use of Matomo
I.) Scope of Processing of Personal Data
We use the open-source tracking tool Matomo (https://matomo.org/) to analyze the browsing behavior of our users. Matomo sets a cookie on your computer. Through the functions of Matomo, personal data can be stored and evaluated, especially user activity (in particular, which pages were visited and which elements were clicked), device and browser information (in particular, the IP address and operating system), data about displayed advertisements (in particular, which ads were shown and whether the user clicked on them), and also data from advertising partners (in particular, pseudonymized user IDs). The software is configured so that IP addresses are not fully stored, but 2 bytes of the IP address are masked for anonymization (e.g., 192.168.xxx.xxx). In this way, it is no longer possible to assign the shortened IP address to the accessing computer. The data is stored in our MySQL database; logs or report data are not sent to Matomo servers. Further information on data processing by Matomo can be found here: https://matomo.org/privacy-policy/
II.) Purpose of Data Processing
The processing of users' personal data enables us to analyze the browsing behavior of our users. By evaluating the data obtained, we are able to compile information about the use of individual components of our online presence. This helps us to continuously improve our online presence and its user-friendliness.
III.) Legal Basis for Processing Personal Data
The legal basis for processing users' personal data is generally the user's consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR.
IV.) Duration of Storage
Your personal information will be stored as long as necessary to fulfill the purposes described in this privacy policy or as required by law, e.g., for tax and accounting purposes.
V.) Revocation and Removal Options
You have the right to withdraw your consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. You can prevent the collection and processing of your personal data by Matomo by blocking the storage of third-party cookies on your computer, using the "Do Not Track" function of a supported browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser. With the following link, you can deactivate the processing of your personal data by Matomo: https://matomo.org/privacy-policy/ Further information on objection and removal options with Matomo can be found at: https://matomo.org/privacy-policy/
18. Use of Google Analytics (GA4)
I.) Scope of Processing of Personal Data
We use Google Analytics 4 (“GA4”) to analyze user behavior on our website. Provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data transfer to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, cannot be excluded.
Google Analytics sets cookies and processes information about the use of our website, in particular:
shortened IP address (IP anonymization / IP is not permanently stored)
Date and time of access
Pages accessed / click paths
Referrer URL
Device and browser information
Approximate location data (region)
Events / conversions (e.g., purchase completion)
II.) Purpose of Data Processing
The processing enables us to analyze the use of our website as well as to optimize the functionality, user guidance, and economic efficiency of our online offering.
III.) Legal Basis for Processing Personal Data
The legal basis is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR in conjunction with § 25 para. 1 TTDSG (setting/reading of non-essential cookies). You grant consent via our consent manager and can revoke it at any time with effect for the future.
IV.) Duration of Storage
The storage period depends on the retention periods configured in Google Analytics. Data is deleted as soon as it is no longer required for the stated purposes. More information on retention periods can be found in the settings of our consent manager or in the respective information in the cookie settings.
V.) Revocation and Removal Options
You can revoke your consent at any time via our consent manager. You can also prevent the storage of cookies by setting your browser software accordingly; however, we point out that in this case not all functions of this website may be fully usable.
Further information on data processing by Google can be found at: https://policies.google.com/privacy
19. Use of LiveChat
We use the live chat system of the provider LiveChat Inc., 1 International Pl, STE 1400 Boston, MA 02110 - 2619, USA, which is represented in the European Union by LiveChat Software SA. ul. Zwyci?ska 47, 53 - 033 Wroclaw, Poland, hereinafter referred to as "LiveChat". In our live chat, you have the opportunity to contact myfolie employees directly and ask your questions in real time and receive answers. Data processing is based on your consent (Art. 6 para. 1 lit. a GDPR). If you do not agree with this processing, you have the option to prevent the installation of cookies by making the appropriate settings in your internet browser. Details can be found above under "Privacy & Cookie Settings".
You can revoke this consent at any time here; however, please note that in this case you may not be able to use all functions of this website to their full extent. The lawfulness of the data processing carried out up to the revocation remains unaffected.
Your personal data will also be transferred to the USA. Since July 10, 2023, there is an adequacy decision "EU-U.S. Data Privacy Framework" under Art. 45 III GDPR for the USA. The European Commission has adopted the EU-U.S. Data Privacy Framework and determined in the decision that the United States ensures an adequate level of protection for personal data. However, the transfer of personal data to the United States only applies if the respective US data recipient is also certified under the EU-US Data Privacy Framework with the US Department of Commerce. A list of certified companies can be found at: https://www.dataprivacyframework.gov/s/participant-search
Live Chat Inc. is certified under the Data Privacy Framework. Further information on the processing of your data by Trustpilot as well as on your rights to object and other data subject rights can be found in LiveChat's privacy policy: https://www.livechatinc.com/legal/privacy-policy/#main
20. Use of Meta Pixel
I.) Scope of Processing of Personal Data
We use the Meta Pixel of Meta Platforms Inc., 1601 Willow Road, Menlo Park, CA 94025, USA and its representative in the Union Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal H , D2 Dublin, Ireland (hereinafter: Meta) on our online presence. With its help, we can track the actions of users after they have seen or clicked on a Meta ad. Personal data can thus be stored and evaluated, especially user activity (in particular, which pages were visited and which elements were clicked), device and browser information (in particular, the IP address and operating system), data about displayed ads (in particular, which ads were shown and whether the user clicked on them), and also data from advertising partners (in particular, pseudonymized user IDs). This allows us to record the effectiveness of Meta ads for statistical and market research purposes. Data may be transferred to Meta servers in the USA. The data collected in this way is anonymous to us, i.e., we do not see the personal data of individual users. However, this data is stored and processed by Meta. Meta may link this data to your Meta account and use it for its own advertising purposes in accordance with Meta's data usage policy. Further information on data processing by Meta can be found here: https://de-de.facebook.com/policy.php
II.) Purpose of Data Processing
The use of the Meta Pixel serves the analysis and optimization of advertising measures.
III.) Legal Basis for Processing Personal Data
The legal basis for processing users' personal data is generally the user's consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR.
IV.) Duration of Storage
Your personal information will be stored as long as necessary to fulfill the purposes described in this privacy policy or as required by law, e.g., for tax and accounting purposes.
Exercising Your Rights
You have the right to withdraw your consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. You can prevent the collection and processing of your personal data by Meta by blocking the storage of third-party cookies on your computer, using the "Do Not Track" function of a supported browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser. Further information on objection and removal options with Meta can be found at: https://de-de.facebook.com/policy.php
21. Used Plugins
We use plugins for various purposes. The plugins used are listed below:
Microsoft Advertising (formerly Bing Ads)
Google Ads
- Provider: Google Ireland Ltd., Ireland (transfer to the USA possible)
- Purpose: Conversion Tracking
- Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR (consent)
- Third country transfer: USA possible
- Privacy information:
https://policies.google.com/privacy?gl=DE&hl=de
Google Ads Remarketing
Google Tag Manager
Google Analytics (GA4)
- Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (transfer to Google LLC, USA possible)
- Purpose: Web analysis / statistical evaluation of user behavior / website optimization
- Processed data (in particular): shortened IP address, device and browser information, referrer URL, page views, click behavior, approximate location data, conversions
- Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR (consent) in conjunction with § 25 para. 1 TTDSG
- Third country transfer: USA possible
- Privacy information:
https://policies.google.com/privacy
https://business.safety.google/gdpr/
I.) Duration of Storage
Your personal information will be stored as long as necessary to fulfill the purposes described in this privacy policy or as required by law.
II.) Transfer to Third Countries
When using plugins marked with third country transfer or USA, personal data may be transferred to servers in third countries outside the EU, such as the USA. The legal basis for this transfer is consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. The United States of America does not provide an adequate level of data protection based on a decision of the European Union. The main risk of the transfer is the obligation of plugin providers to make user data accessible to US authorities under certain circumstances. We currently have a data processing agreement with all providers with standard contractual clauses to make the third country transfer as data protection-friendly and secure as possible. Adjustments to the ECJ ruling of 16.07.2020 (Schrems II, Ref. C-311/18) including additional security measures are currently being pursued by us. A copy of the standard contractual clauses can be requested from us by informal email.
III.) Possibility of Revocation
You have the right to withdraw your consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
You can prevent the collection and processing of your personal data by the respective providers by blocking the storage of third-party cookies on your computer, using the "Do Not Track" function of a supported browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser.
IV.) Risk Notice
Your personal data will also be transferred to the USA. There is no adequacy decision for the USA under Art. 45 para. 3 GDPR. Please note that data transfer without an adequacy decision carries certain risks, which we would like to inform you about below: US intelligence services use certain online identifiers (such as IP address or unique identification numbers) as a starting point for monitoring individuals. In particular, it cannot be ruled out that these intelligence services have already collected information about you, which could be used to trace the data transferred here back to you. Providers of electronic communication services headquartered in the USA are subject to surveillance by US intelligence services under 50 U.S. Code § 1881a (“FISA 702”). Accordingly, providers of electronic communication services headquartered in the USA are obliged to provide US authorities with personal data under 50 U.S. Code § 1881a, without you possibly having legal remedies. Even encryption of data in the data centers of the provider of electronic communication services may not provide adequate protection, as a provider of electronic communication services has a direct obligation to grant access to or release imported data in its possession, custody, or control. This obligation may expressly extend to cryptographic keys without which the data is unreadable. The fact that this is not merely a "theoretical risk" is shown by the ECJ judgment of July 16, 2020 (Case C 311/18, "Schrems II"). We have concluded guarantees with Google in the form of standard contractual clauses pursuant to Art. 46 para. 2 lit. c GDPR. A copy of the standard contractual clauses can be requested from us.
