Privacy Policy

As of September 2026

Name and address of the controller
Contact details of the data protection officer
General information on data processing
Rights of the data subject
Provision of the website and creation of log files
Use of cookies
Online shop
Ordering in the online shop
Payment methods
Shipping service providers
Email contact
Contact form
Partner programs
Review portal
Email delivery
Content Delivery Networks
Use of Matomo Analytics Software
Use of Google Analytics
Use of LiveChat
Use of Meta Tracking Pixel
Plugins used

1. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the Member States, as well as other data protection regulations, is:

myfolie GmbH
Von-Stauffenberg-Str, 27
82008 Unterhaching
Germany

+49 89 / 92 131 57 - 0
[email protected]

2. Contact details of the data protection officer

The data protection officer of the controller is

DataCo GmbH
Dachauer Straße 65
80335 Munich
Germany
+49 89 / 7400 45840
www.dataguard.de

3. General information on data processing

I.) Scope of the processing of personal data

As a general rule, we process the personal data of our users only to the extent necessary to provide a functional online shop, as well as our content and services. The personal data of our users is generally processed only with the user's consent. An exception applies in cases where it is not possible to obtain consent in advance for factual reasons and the processing of the data is required by law.

II.) Legal basis for processing personal data

Where we obtain the consent of the data subject for processing operations involving personal data, Art. 6 para. 1 sentence 1 lit. a GDPR serves as the legal basis.

When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 sentence 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.

Where processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6 para. 1 sentence 1 lit. c GDPR serves as the legal basis.

In the event that vital interests of the data subject or another natural person make processing of personal data necessary, Art. 6 para. 1 sentence 1 lit. d GDPR serves as the legal basis.

If processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests, fundamental rights and freedoms of the data subject do not override this interest, Art. 6 para. 1 sentence 1 lit. f GDPR serves as the legal basis for processing.

III.) Data erasure and storage period

The personal data of the data subject will be erased or blocked as soon as the purpose of storage no longer applies. Data may also be stored if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. The data will also be blocked or erased if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or performance of a contract.

4. Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

I.) Right of access (Art. 15 GDPR)

You have the right to request confirmation from us as to whether personal data concerning you is being processed.

If this is the case, you have the right to access this data and the following information:
Purposes of processing
Categories of personal data
Recipients or categories of recipients
Planned storage period or the criteria for determining this period
Existence of rights to rectification, erasure or restriction, or to object
Right to lodge a complaint with the competent supervisory authority
Where applicable, the origin of the data (if collected from a third party)
Where applicable, the existence of automated decision-making, including profiling, with meaningful information about the logic involved, the scope and the expected effects
Where applicable, the transfer of personal data to a third country or international organisation

II.) Right to rectification (Art. 16 GDPR)

If your personal data is inaccurate or incomplete, you have the right to request the immediate correction or completion of your personal data.

III.) Right to restriction of processing (Art. 18 GDPR)

If one of the following requirements is met, you have the right to request restriction of the processing of your personal data:

You dispute the accuracy of your personal data, for a period enabling us to verify the accuracy of the personal data.
In the event of unlawful processing, you refuse to have the personal data erased and instead request restriction of the use of the personal data.
We no longer need your personal data for the purposes of processing, but you require your personal data for the establishment, exercise or defence of legal claims, or
after you have objected to processing, for the duration of the verification of whether our legitimate grounds override your grounds.

IV.) Right to erasure ("right to be forgotten") (Art. 17 GDPR)

If one of the following reasons applies, you have the right to request the immediate erasure of your personal data:

Your data is no longer necessary for the purposes for which it was originally collected.
You withdraw your consent and there is no other legal basis for the processing.
You object to the processing and there are no overriding legitimate grounds for the processing, or you object pursuant to Art. 21 para. 2 GDPR.
Your personal data is being processed unlawfully.
Erasure is necessary for compliance with a legal obligation under Union law or the law of the Member State to which we are subject.
The personal data was collected in relation to information society services offered pursuant to Art. 8 para. 1 GDPR.

Please note that the above-mentioned reasons do not apply insofar as processing is necessary:

For exercising the right of freedom of expression and information;
For compliance with a legal obligation or for the performance of a task carried out in the public interest to which we are subject.
For reasons of public interest in the area of public health.
For archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes.
For the establishment, exercise or defence of legal claims.

V.) Right to notification

If you have exercised your right to rectification, erasure or restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data concerning you has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right to be informed by the controller about these recipients.

VI.) Right to data portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller.

VII.) Right to object to certain data processing (Art. 21 GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6 para. 1 sentence 1 lit. e or f GDPR. This also applies to profiling based on these provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing purposes; this also applies to profiling insofar as it is related to such direct marketing.

VIII.) Right to withdraw the data protection consent declaration

IX.) Automated decision-making in individual cases, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision is necessary for entering into or performing a contract between you and the controller, is permitted by Union or Member State law to which the controller is subject, and that law contains suitable measures to safeguard your rights and freedoms and your legitimate interests, or if it is based on your explicit consent.

However, these decisions must not be based on special categories of personal data under Art. 9 para. 1 GDPR, unless Art. 9 para. 2 lit. a or b GDPR applies and suitable measures have been taken to protect rights and freedoms and your legitimate interests. With regard to the cases mentioned in a. and c., the controller shall take suitable measures to safeguard rights and freedoms and your legitimate interests, which must include at least the right to obtain human intervention on the part of the controller, to express your own point of view and to contest the decision.

X.) Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of personal data concerning you violates the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Art. 78 GDPR. A list of the supervisory authorities with local jurisdiction in Germany can be found on the website of the Federal Commissioner for Data Protection at the following link: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html

5. Provision of the website and creation of log files

I.) Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.
The following data is collected:

Information about the browser type and version used
The user's operating system
The user's Internet service provider
The user's IP address
Date and time of access
Websites from which the user's system reaches our website
Websites accessed by the user's system via our website

This data is stored in the log files of our system. This data is not stored together with other personal data of the user.

II.) Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.

Storage in log files takes place to ensure the functionality of the website. In addition, the data serves to optimise the website and ensure the security of our information technology systems. The data is not evaluated for marketing purposes in this context.

These purposes also constitute our legitimate interest in data processing pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR.

III.) Legal basis for data processing

The legal basis for the temporary storage of data and log files is Art. 6 para. 1 sentence 1 lit. f GDPR.

IV.) Storage period

The data is erased as soon as it is no longer necessary to achieve the purpose for which it was collected. In the case of data collected to provide the website, this is the case when the respective session has ended.

In the case of data stored in log files, this is the case after seven days at the latest. Further storage is possible. In this case, the users' IP addresses are erased or altered so that it is no longer possible to identify the accessing client.

V.) Possibility of objection

The collection of data for the provision of the website and the storage of data in log files is essential for operating the website. The user may object to this. Whether the objection is successful must be determined as part of a balancing of interests.

6. Use of cookies

I.) Description and scope of data processing

When you visit our website, we use technical tools for various functions, in particular cookies, which may be stored on your device. When you access our website and at any later time, you can choose whether to generally allow cookies to be set or which individual additional functions you wish to select. You can make changes in your browser settings or via our Consent Manager. Cookies are text files or information in a database that are stored on your hard drive and assigned to the browser you use, so that certain information can be transmitted to the party that sets the cookie. Below we describe the type of cookies we use: We use technically necessary cookies that are required for the technical structure of the website. Without these cookies, our website may not be displayed (fully correctly), or the support functions may not be available.
The following data is stored and transmitted by technically necessary cookies:

Session ID
Cookie settings

We also use cookies on our website that enable an analysis of users' browsing behaviour.
The following data may be transmitted in this way:

Use of website functions

The user data collected in this way is pseudonymised by technical measures. It is therefore no longer possible to assign the data to the accessing user without additional information. The data is not stored together with other personal data of the users.

II.) Purpose of data processing

The purpose of using technically necessary cookies is to ensure the functionality of our website. Some functions of our website cannot be offered without the use of cookies. For these functions, it is necessary for the browser to be recognised again after a page change.
The technically necessary cookies are required for the following applications:

Shopping cart
Website functionality
Cookie settings

III.) Legal basis for data processing

The provisions of the Telecommunications-Telemedia Data Protection Act (TTDSG) apply to the storage of information in the end user's device and/or access to information already stored in the end user's device. If the setting and reading of cookies is technically necessary, this is done to ensure the functionality of our website. In this case, the storage of and access to cookies on your device is based on § 25 para. 2 no. 2 TTDSG. This storage of and access to the information on your device serves to make it easier for you to use our website and to offer you our services as requested. Some functions of our website also do not work without the use of these cookies and therefore could not be offered. Cookies are generally erased after the session ends (e.g. logging out or closing the browser) or after a specified period has expired. Information about deviating storage periods for cookies can be found in the following sections of this Privacy Policy.

IV.) Storage period, objection and removal options

The user has the option to withdraw consent to the processing of personal data at any time. Cookies are stored on the user's computer and transmitted by it to our website. As a user, you therefore have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your Internet browser. Cookies that have already been stored can be erased at any time. This can also be done automatically. If cookies are disabled for our website, it may no longer be possible to use all website functions to their full extent.

The transmission of Flash cookies cannot be prevented via the browser settings, but can be prevented by changing the Flash Player settings.

If you use a Safari browser version 12.1 or later, cookies are automatically erased after seven days. This also applies to opt-out cookies set to prevent tracking measures.

7. Online shop

We offer an online shop on our website. For this purpose, we use specially developed online shop software.

The website and the online shop are hosted on our own servers. Third parties do not have access to server log files.

The servers automatically collect and store information in so-called server log files, which your browser automatically transmits when you visit the website. The stored information is:

Browser type and browser version
Operating system used
Referrer URL
Hostname of the accessing computer
Date and time of the server request
IP address

No combination of this data with other data sources takes place. This data is collected on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website; server log files must be collected for this purpose. The website server is geographically located in Germany.

7.1. Customer account and storage of designs

I.) Description and scope of data processing

You have the option of creating a customer account on our website.

As part of the registration and use of the customer account, the following personal data is processed in particular:

First and last name
Email address
Password (stored in encrypted form)
Billing and delivery address
Telephone number (optional)
Order history
Payment status
Uploaded designs, graphics and print data
Saved drafts and configurations

For business customers (B2B), the following may also be processed:

Company name
Contact person
VAT identification number
Where applicable, internal reference numbers

Uploaded designs are stored as part of contract performance and for reuse by the customer.

II.) Purpose of data processing

Processing takes place for:

Setting up and managing the customer account
Processing and handling orders
Storing designs for reuse
Processing complaints
Compliance with statutory retention obligations

III.) Legal basis

Processing is based on:

Art. 6 para. 1 sentence 1 lit. b GDPR (contract performance)
Art. 6 para. 1 sentence 1 lit. c GDPR (legal obligations)
Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interest in providing a user-friendly customer account)

Insofar as designs are stored beyond the mere processing of the contract, processing may also be based on consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR.

IV.) Storage of designs and uploaded content

Designs, graphics and print data uploaded by customers are stored:

For producing the ordered products
To enable repeat orders
For processing warranty and complaint cases

If a customer account exists, saved designs remain stored until the customer account is deleted, unless statutory retention obligations or technical requirements prevent this.

After the customer account is deleted, personal data and saved designs are erased unless statutory retention obligations apply.

Erasure from backup copies takes place as part of the usual technical deletion cycles.

V.) Responsibility for uploaded content

The user is responsible for ensuring that the uploaded content:

Does not infringe the rights of third parties (e.g. copyrights, trademark rights, personal rights)
Does not contain special categories of personal data pursuant to Art. 9 GDPR unless a separate legal basis exists for this
We only review the content of uploaded designs randomly or for production-related reasons.

8. Ordering in the online shop

I.) Description and scope of data processing

We offer our customers the opportunity to design their own motifs and texts online and order them as adhesive film. After the ordering process has been completed, we receive personal data that we require to process the order. Mandatory information required to process the contracts is marked separately; any other information provided to us by uploading photos or contact details to be printed on the ordered adhesive film is voluntary. The personal data printed on the adhesive film may be forwarded to external service providers such as graphic designers. All other personal data is not transferred to service providers outside the company.

II.) Purpose of data processing

The transmission of the personal data voluntarily provided by you serves to process the contract and create the product when you purchase adhesive film.

III.) Legal basis for data processing

The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR, as the processing of the data is necessary to process the concluded purchase contract.

IV.) Storage period

We erase graphics/photos that you upload so that they can be printed on the adhesive film after the statutory retention obligations have expired (for refund/warranty reasons).

All payment data and data relating to any chargebacks that may occur are stored only for as long as they are required for payment processing, possible processing of returned direct debits and debt collection, and the prevention of misuse.

Payment data may also be stored beyond this period if and for as long as this is necessary to comply with statutory retention periods or to investigate a specific case of misuse.

Your personal data will be erased when the statutory retention obligations expire, i.e. after 10 years at the latest.

9. Payment methods

I.) Description and scope of data processing

We offer our customers various payment methods for processing their orders. Depending on the payment method, we redirect customers to the platform of the relevant payment service provider. After the payment process has been completed, we receive the customers' payment data from the payment service providers or our bank and process it in our systems for invoicing and accounting purposes.

Payment via Amazon Pay

It is possible to process the payment via the payment service provider AmazonPay. AmazonPay enables online payments to third parties by accessing the payment and shipping information stored in your Amazon account.

The European operating company of AmazonPay is Amazon Payments Europe s.c.a., 38 avenue J.F. Kennedy, L-1855 Luxembourg. If you already have an Amazon.de customer account, you can pay immediately using the payment method stored there, either by direct debit or credit card. This requires logging into your Amazon account.

Further information and your order overview for paying via AmazonPay can be found at https://pays.amazon.de. When paying via Amazon Pay, all personal data communicated to or collected by Amazon Pay is primarily processed by Amazon Pays s.c.a. and secondarily by Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, all three located at 5, Rue Plaetis L 2338, Luxembourg. Further information on the processing of your data by Amazon as part of AmazonPay can be found in the Amazon Pay Privacy Notice at:https://pay.amazon.com/de/help/201751600

Payment by credit card

It is possible to complete the payment process by credit card.

If you have selected payment by credit card, payment data is forwarded to payment service providers for payment processing. All payment service providers comply with the requirements of the “Payment Card Industry (PCI) Data Security Standards” and have been certified by an independent PCI Qualified Security Assessor.

The following data is generally transmitted as part of payment by credit card:

Purchase amount
Date and time of purchase
First name and surname
Address
Email address
Credit card number
Credit card expiry date
Security code (CVC)
IP address
Telephone number/mobile phone number

Payment data is forwarded to the following payment service provider:

Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Netherlands

Further information on the privacy policies, as well as objection and removal options vis-à-vis the payment service providers, can be found here: https://www.adyen.com/de_DE/legal/terms-and-conditions

Payment via Billie (B2B purchase on account)

We offer the option of purchasing on account via the payment service provider Billie GmbH.

The provider is Billie GmbH, Charlottenstraße 4, 10969 Berlin, Germany

If you select purchase on account via Billie, personal data is transmitted to Billie for carrying out a credit check and processing the payment.

This includes in particular:

First name and surname
Billing and delivery address
Company data (for B2B orders)
Email address
IP address
Purchase amount
Where applicable, date of birth
Where applicable, further data required for payment processing

Billie carries out a risk assessment, including a credit check. Probability values (score values) may be calculated in this process. Processing takes place for the purpose of deciding on the establishment, performance or termination of the contractual relationship.

Further information on data processing by Billie can be found at:
https://www.billie.io/datenschutz/

Payment via Klarna (purchase on account)

We offer the option of purchasing on account via the payment service provider Klarna.

The provider is Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden.

If you select purchase on account via Klarna, personal data is transmitted to Klarna for carrying out a credit check and processing the payment.

This includes in particular:

First name and surname
Billing and delivery address
Email address
Telephone number (where applicable)
IP address
Purchase amount
Date of birth (where required)
Order information and, where applicable, further data required for payment processing

Klarna carries out a risk and credit assessment in order to decide whether to provide purchase on account. Probability values (score values) may be calculated in this process. Processing takes place for the purpose of deciding on the establishment, performance and handling of the contractual relationship.

Further information on data processing by Klarna can be found in Klarna's Privacy Notice: https://www.klarna.com/de/datenschutz/

Payment via PayPal

It is possible to process the payment via the payment service provider PayPal.

The provider of this payment service is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.

If you select PayPal as your payment method, the data required for payment processing is transmitted to PayPal.

This generally includes:

First name and surname
Billing and delivery address
Email address
IP address
Purchase amount
Date and time of purchase
Payment method
Where applicable, further data required for payment processing

PayPal reserves the right to carry out a credit check. Probability values (score values) may be calculated in this process. Further information on data processing by PayPal can be found at:
https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Payment in advance

If you have selected payment in advance, we do not process any data other than the data transmitted by your bank. This data is used solely to verify receipt of payment.

II.) Purpose of data processing

The transmission of payment data to payment service providers serves to process the payment, e.g. when you purchase a product and/or use a service.

III.) Legal basis for data processing

The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR, as processing the data is necessary to process the concluded purchase contract.

IV.) Storage period

Payment data may also be stored beyond this period if and for as long as this is necessary to comply with statutory retention periods or to investigate a specific case of misuse.

Your personal data will be erased when the statutory retention obligations expire, i.e. after 10 years at the latest.

V.) Lapse of the legal basis

The payment service provider used remains entitled to process your payment data if and for as long as this is necessary for payment processing in accordance with the contract. There may also be statutory retention periods.

10. Shipping service providers

I.) Description and scope of data processing

If you order products or services on our website for which a shipping service provider is used for delivery, you will receive your order and shipping confirmation via your email address and, depending on the respective shipping service provider, a notification that your shipment has arrived and/or a parcel notification and possible delivery options.

The data is transmitted to the following service providers:

DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn
General Logistics Systems Germany GmbH & Co. OHG, GLS Germany-Straße 1 - 7, DE-36286 Neuenstein
United Parcel Service Deutschland S.à r.l. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany

The data transmitted generally includes:

Name
Address

II.) Purpose of data processing

The purpose of processing personal data and transmitting address data to shipping service providers is to process the concluded purchase contract and deliver the goods.

III.) Legal basis for data processing

The legal basis for transmitting your address data (first name, surname, address) to the respective shipping service provider is Art. 6 para. 1 sentence 1 lit. b GDPR, as processing the data is necessary to process the concluded purchase contract.

IV.) Storage period

The transmitted data is erased by the respective shipping service provider once the parcel has been successfully delivered.

V.) Objection and removal options

The notification service provided by the shipping service provider can be cancelled by the data subject at any time. For this purpose, each email contains a corresponding opt-out link.

11. Email contact

I.) Description and scope of data processing

Our website provides the option of contacting us via the email address provided. In this case, the user's personal data transmitted with the email is stored.

The data is used exclusively to process the conversation.

As part of the data processing, the data is transferred to the service provider: Zendesk Inc.

The data processing agreement with Zendesk includes so-called EU standard data protection clauses (Art. 46 para. 2 sentence 1 lit. c GDPR). These are classified as a suitable guarantee for protecting the transfer and processing of personal data outside the EU.

Further information on data processing by Zendesk can be found here: https://www.zendesk.de/company/agreements-and-terms/privacy-notice/

II.) Purpose of data processing

In the event of contact by email, this also constitutes the necessary legitimate interest in processing the data.

III.) Legal basis for data processing

The legal basis for processing the data transmitted when sending an email is Art. 6 para. 1 lit. f GDPR. Our legitimate interest is to respond to your email enquiry in the best possible manner. If the email contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 para. 1 lit. b GDPR.

IV.) Storage period

The data is erased as soon as it is no longer required to achieve the purpose for which it was collected and statutory retention periods no longer require the data to be retained. For personal data sent by email, this is the case when the respective conversation with the user has ended. The conversation is deemed to have ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

V.) Possibility of objection

If the user contacts us by email, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.

Currently none, as contacting us is voluntary and purpose-bound and is directed only at customers or prospective customers; erasure pursuant to the GDPR can be requested by email

All personal data stored as part of the contact will be erased in this case.

12. Contact form

I.) Description and scope of data processing

A contact form is available on our website and can be used for electronic contact. If a user makes use of this option, the data entered in the input form is transmitted to us and stored.

At the time the message is sent, the following data is stored:

Email address
IP address of the accessing computer
Date and time the form was sent
Order number & postcode if it concerns an existing order, for verification;
Other data transmitted by the user as a message

Alternatively, you can contact us via the email address provided. In this case, the user's personal data transmitted with the email is stored.

The data is used exclusively to process the conversation.

As part of the data processing, the data is transferred to the service provider: Zendesk Inc.

Further information on data processing by Zendesk can be found here: https://www.zendesk.de/company/agreements-and-terms/privacy-notice/

II.) Purpose of data processing

We process the personal data from the input form solely to handle the contact request. In the event of contact by email, this also constitutes the necessary legitimate interest in processing the data.

The other personal data processed during the submission process serves to prevent misuse of the contact form and to ensure the security of our information technology systems.

III.) Legal basis for data processing

The legal basis for processing the data transmitted when submitting a contact form is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest is to respond to your enquiry submitted via the contact form in the best possible manner. If contact via the contact form is aimed at concluding a contract, the additional legal basis for processing is Art. 6 para. 1 sentence 1 lit. b GDPR.

IV.) Storage period

The data is erased as soon as it is no longer required to achieve the purpose for which it was collected and statutory retention periods no longer require the data to be retained. For the personal data from the contact form input field and data sent by email, this is the case when the respective conversation with the user has ended. The conversation is deemed to have ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

V.) Possibility of objection

The user may withdraw consent to the processing of personal data at any time. If the user contacts us by email, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.

All personal data stored as part of the contact will be erased in this case.

13. Partner programs

We also use the services of the following partner programs:

Belboon GmbH: Weinmeisterstraße 12-14, 10178 Berlin

The controller has integrated components from Belboon on this website. Belboon is a German affiliate network that offers affiliate marketing. If you click on an advertisement containing a partner link, Belboon places a cookie on your computer for conversion tracking. The cookies serve to ensure correct accounting within the partner program by recording the success of an advertising medium. The cookies make it possible to recognise that you clicked on the advertisement and to trace the origin of the order to the advertiser. Belboon also uses tracking pixels. These make it possible to analyse information such as visitor traffic on the pages.

The information generated by cookies and tracking pixels about the use of this website (including the IP address) and the delivery of advertising formats is transmitted to and stored on a Belboon server. Among other things, Belboon can recognise that the partner link on this website was clicked. Under certain circumstances, Belboon may pass this (anonymised) information on to contractual partners; however, data such as the IP address is not combined with other stored data.

Where legally required, we have obtained your consent pursuant to Art. 6 para. 1 lit. a GDPR for the processing of your data described above. You may withdraw your consent at any time with effect for the future. If you wish to block the analysis of user behaviour via cookies, you can configure your browser to notify you when cookies are set and allow you to decide individually whether to accept them, or exclude the acceptance of cookies in certain cases or generally.

via an Internet browser or other software programs.

Further information on the processing of your personal data by Instagram and the corresponding objection options can be found here:

Belboon: https://www.belboon.com/de/ueber-uns/datenschutz/

Firstlead GmbH (Adcell): Rosenfelder Str. 15-16, 10315 Berlin.

The controller has integrated components from Adcell on this website. Adcell is a German affiliate network that offers affiliate marketing. If you click on an advertisement containing a partner link, Adcell places a cookie on your computer for conversion tracking. The cookies serve to ensure correct accounting within the partner program by recording the success of an advertising medium. The cookies make it possible to recognise that you clicked on the advertisement and to trace the origin of the order to the advertiser. Adcell also uses tracking pixels. These make it possible to analyse information such as visitor traffic on the pages.

The information generated by cookies and tracking pixels about the use of this website (including the IP address) and the delivery of advertising formats is transmitted to and stored on an Adcell server. Among other things, Adcell can recognise that the partner link on this website was clicked. Under certain circumstances, Adcell may pass this (anonymised) information on to contractual partners; however, data such as the IP address is not combined with other stored data.

Further information on the processing of your personal data by Adcell and the corresponding objection options can be found here: https://www.adcell.de/agb#sector_6

14. Review portal

Trustpilot review

We participate in the review process of the provider Trustpilot A/S, Pilestræde 58, 5, 1112 Copenhagen, Denmark.

Trustpilot offers users the opportunity to review our services. Users who have used our service are asked to consent to receiving a review request. If users have given the corresponding consent (by clicking a checkbox after completing the order), they receive a review request with a link to a review page. To ensure that users have actually used our services, we transmit the data required for this purpose to Trustpilot concerning the user and the service used (this includes the name, email address, order number and order date). This data is used solely to verify authenticity and contact the user.

The legal basis for processing the user's data as part of the review process is consent pursuant to Art. 6 para. 1 lit. a GDPR.

To submit a review, it is possible to open a customer account with Trustpilot. In this case, Trustpilot's terms and privacy notices apply. To preserve the neutrality and objectivity of the reviews, we have no direct influence on the reviews and cannot delete them ourselves. We therefore ask users to contact Trustpilot.

Users can obtain further information on the processing of their data by Trustpilot, as well as their rights to object and other data subject rights, in Trustpilot's Privacy Notice: https://de.legal.trustpilot.com/end-user-privacy-terms.

15. Email delivery

Mandrill

We use Mandrill from Mailchimp, provided by The Rocket Science Group, LLC, 512 Means Street, Suite 404 Atlanta, GA 30318 United States.

Mandrill is used when an order is completed to send you an order confirmation and, where applicable, payment reminders and other emails. In this process, we or our hosting provider process inventory data, contact data, content data, contract data, usage data, meta and communication data from customers. The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR, as processing the data is necessary to process the concluded purchase contract.

The data processing agreement with Mandrill includes so-called EU standard data protection clauses (Art. 46 para. 2 sentence 1 lit. c GDPR). These are classified as a suitable guarantee for protecting the transfer and processing of personal data outside the EU.

Further information on Mandrill and data protection at Mandrill can be found here:http://mailchimp.com/legal/privacy/

16. Content Delivery Networks

I.) Description and scope of data processing

On our website, we use functions of the Content Delivery Network KeyCDN from proinity LLC, Reichenauweg 1, 8272 Ermatingen Switzerland. A Content Delivery Network (CDN) is a network of regionally distributed servers connected via the Internet, used to deliver content, particularly large media files such as videos. KeyCDN offers web optimisation and security services, which we use to improve the loading times of our website and protect it against misuse. When you access our website, a connection is established to the servers of proinity LLC in order to retrieve content, for example. As a result, personal data may be stored and evaluated in server log files, particularly user activity (in particular, which pages were visited) and device and browser information (in particular, the IP address and operating system).

Further information on the collection and storage of data by proinity LLC can be found here: https://www.keycdn.com/privacy

II.) Purpose of data processing

The functions are used to deliver and accelerate online applications and content.

III.) Legal basis for data processing

This data is collected on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website; server log files must be collected for this purpose.

IV.) Storage period

Your personal information is stored for as long as necessary to fulfil the purposes described in this Privacy Policy or as required by law.

V.) Objection and removal options

Information on objection and removal options vis-à-vis proinity LLC can be found at: https://www.keycdn.com/privacy

17. Use of Matomo

I.) Scope of the processing of personal data

We use the open-source tracking tool Matomo (https://matomo.org/) to analyse our users' browsing behaviour. Matomo places a cookie on your computer. Matomo's functions can be used to store and evaluate personal data, particularly user activity (in particular, which pages were visited and which elements were clicked), device and browser information (in particular, the IP address and operating system), data about the advertisements displayed (in particular, which advertisements were displayed and whether the user clicked on them), as well as data from advertising partners (in particular, pseudonymised user IDs). The software is configured so that IP addresses are not stored in full; instead, 2 bytes of the IP address are masked for anonymisation (e.g.: 192.168.xxx.xxx). This means it is no longer possible to assign the truncated IP address to the accessing computer. The data is stored in our MySQL database; logs or report data are not sent to Matomo servers. Further information on data processing by Matomo can be found here:https://matomo.org/privacy-policy/

II.) Purpose of data processing

Processing users' personal data enables us to analyse our users' browsing behaviour. By evaluating the data collected, we are able to compile information about the use of the individual components of our online presence. This helps us to continuously improve our online presence and its user-friendliness.

III.) Legal basis for processing personal data

The legal basis for processing users' personal data is generally the user's consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR.

IV.) Storage period

Your personal information is stored for as long as necessary to fulfil the purposes described in this Privacy Policy or as required by law, e.g. for tax and accounting purposes.

V.) Withdrawal and removal options

You have the right to withdraw your data protection consent declaration at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent up to the withdrawal. You can prevent the collection and processing of your personal data by Matomo by preventing the storage of third-party cookies on your computer, using the "Do Not Track" function of a supported browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser. You can deactivate the processing of your personal data by Matomo using the following link: https://matomo.org/privacy-policy/ Further information on objection and removal options vis-à-vis Matomo can be found at: https://matomo.org/privacy-policy/

18. Use of Google Analytics (GA4)

I.) Scope of the processing of personal data

We use Google Analytics 4 (“GA4”) to analyse user behaviour on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The transfer of data to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, cannot be ruled out.

Google Analytics uses cookies and processes information about the use of our website, in particular:

truncated IP address (IP anonymisation / IP is not stored permanently)
Date and time of access
Pages accessed / click paths
Referrer URL
Device and browser information
Approximate location data (region)
Events / conversions (e.g. completed purchase)

II.) Purpose of data processing

Processing enables us to analyse the use of our website and optimise the functionality, user guidance and economic efficiency of our online offering.

III.) Legal basis for processing personal data

The legal basis is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR in conjunction with § 25 para. 1 TTDSG (setting/reading non-essential cookies). You give your consent via our Consent Manager and may withdraw it at any time with effect for the future.

IV.) Storage period

The storage period is determined by the retention periods configured in Google Analytics. Data is erased as soon as it is no longer required for the stated purposes. Further information on storage periods can be found in the settings of our Consent Manager or in the relevant information in the cookie settings.

V.) Withdrawal and removal options

You can withdraw your consent at any time via our Consent Manager. You can also prevent cookies from being stored by configuring your browser software accordingly; however, please note that in this case it may not be possible to use all functions of this website to their full extent.

Further information on data processing by Google can be found at: https://policies.google.com/privacy

19. Use of LiveChat

On our website, we use the live chat system of the provider LiveChat Inc., 1 International Pl, STE 1400 Boston, MA 02110 - 2619, USA, represented in the European Union by LiveChat Software SA. ul. Zwyci?ska 47, 53 - 033 Wroclaw, Poland, hereinafter referred to as "LiveChat". In our live chat, you have the opportunity to contact myfolie employees directly and ask your questions in a real-time chat and receive answers. Data processing is based on your consent (Art. 6 para. 1 lit. a GDPR). If you do not agree to this processing, you can prevent the installation of cookies by configuring the relevant settings in your Internet browser. Details can be found above under the section "Privacy & Cookie Settings".

You can withdraw this consent at any time here; however, we point out that in this case you may not be able to use all functions of this website to their full extent. The lawfulness of data processing operations already carried out remains unaffected by the withdrawal.

Your personal data is also transferred to the USA. Since 10 July 2023, an adequacy decision, "EU-U.S. Data Privacy Framework", pursuant to Art. 45 III GDPR, has been in place for the USA. The European Commission has adopted the EU-US data protection framework and established in its decision that the United States ensures an adequate level of protection for personal data. However, the transfer of personal data to the United States is valid only if the respective US data recipient is also certified under the EU-US Data Privacy Framework by the US Department of Commerce. A list of certified companies can be viewed at the following link: https://www.dataprivacyframework.gov/s/participant-search

Live Chat Inc. is certified under the Data Privacy Framework. Further information on the processing of your data by Trustpilot, as well as users' rights to object and other data subject rights, can be found in LiveChat's Privacy Notice https://www.livechatinc.com/legal/privacy-policy/#main

20. Use of Meta Pixel

I.) Scope of the processing of personal data

On our online presence, we use the Meta Pixel of Meta Platforms Inc., 1601 Willow Road, Menlo Park, CA 94025, USA, and its representative in the Union, Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal H, D2 Dublin, Ireland (hereinafter: Meta). This enables us to track users' actions after they have viewed or clicked on a Meta advertisement. As a result, personal data may be stored and evaluated, particularly user activity (in particular, which pages were visited and which elements were clicked), device and browser information (in particular, the IP address and operating system), data about the advertisements displayed (in particular, which advertisements were displayed and whether the user clicked on them), as well as data from advertising partners (in particular, pseudonymised user IDs). This enables us to measure the effectiveness of Meta advertisements for statistical and market research purposes. Data may be transmitted to Meta servers in the USA. The data collected in this way is anonymous to us, meaning that we do not see the personal data of individual users. However, this data is stored and processed by Meta. Meta may link this data to your Meta account and also use it for its own advertising purposes in accordance with Meta's Data Use Policy. Further information on data processing by Meta can be found here:https://de-de.facebook.com/policy.php

II.) Purpose of data processing

The use of the Meta Pixel serves to analyse and optimise advertising measures.

III.) Legal basis for processing personal data

The legal basis for processing users' personal data is generally the user's consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR.

IV.) Storage period

Your personal information is stored for as long as necessary to fulfil the purposes described in this Privacy Policy or as required by law, e.g. for tax and accounting purposes.

Exercising your rights

21. Plugins used

We use plugins for various purposes. The plugins used are listed below:

Microsoft Advertising (formerly Bing Ads)

Provider: Microsoft Corporation, USA
Purpose: Conversion tracking
Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR (consent)
Third-country transfer: USA
Privacy information:
https://privacy.microsoft.com/de-de/privacystatement
https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA

Google Ads

Provider: Google Ireland Ltd., Ireland (transfer to the USA possible)
Purpose: Conversion tracking
Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR (consent)
Third-country transfer: USA possible
Privacy information:
https://policies.google.com/privacy?gl=DE&hl=de

Google Ads Remarketing

Provider: Google Ireland Ltd., Ireland (transfer to the USA possible)
Purpose: Marketing / remarketing
Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR (consent)
Third-country transfer: USA possible
Privacy information:
https://policies.google.com/privacy?gl=DE&hl=de
https://business.safety.google/gdpr/

Google Tag Manager

Provider: Google Ireland Ltd., Ireland (transfer to the USA possible)
Purpose: Management and delivery of tracking and marketing tags
Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR (where services requiring consent are loaded via Tag Manager)
Third-country transfer: USA possible
Privacy information:
https://policies.google.com/privacy?gl=DE&hl=de
https://business.safety.google/gdpr/

Google Analytics (GA4)

Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (transfer to Google LLC, USA possible)
Purpose: Web analysis / statistical evaluation of user behaviour / website optimisation
Data processed (in particular): truncated IP address, device and browser information, referrer URL, page views, click behaviour, approximate location data, conversions
Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR (consent) in conjunction with § 25 para. 1 TTDSG
Third-country transfer: USA possible
Privacy information:
https://policies.google.com/privacy
https://business.safety.google/gdpr/

I.) Storage period

Your personal information is stored for as long as necessary to fulfil the purposes described in this Privacy Policy or as required by law.

II.) Transfer to third countries

When using plugins marked as involving third-country transfers or transfers to the USA, personal data may be transferred to servers in third countries outside the EU, such as the USA. The legal basis for this transfer is consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. The United States of America does not provide an adequate level of data protection on the basis of a decision by the European Union. The main risk of the transfer lies in the obligation of plugin providers, under certain circumstances, to make user data accessible to US authorities. We currently have data processing agreements with all providers containing standard contractual clauses in order to make third-country transfers as data-protection-friendly and secure as possible. We are currently seeking adjustments to the ruling of the CJEU of 16 July 2020 (Schrems II, Case C-311/18), including additional security measures. A copy of the standard data protection clauses can be requested from us by sending an informal email.

III.) Possibility of withdrawal

You can prevent the respective providers from collecting and processing your personal data by preventing the storage of third-party cookies on your computer, using the "Do Not Track" function of a supported browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser.

IV.) Risk notice

Your personal data is also transferred to the USA. There is no adequacy decision pursuant to Art. 45 para. 3 GDPR for the USA. We would like to point out that a data transfer without an adequacy decision entails certain risks, about which we may inform you as follows: US intelligence services use certain online identifiers (such as the IP address or unique identification numbers) as a starting point for monitoring individuals. In particular, it cannot be ruled out that these intelligence services have already collected information about you that could be used to trace the data transferred here back to you. Providers of electronic communications services headquartered in the USA are subject to monitoring by US intelligence services pursuant to 50 U.S. Code § 1881a (“FISA 702”). Accordingly, providers of electronic communications services headquartered in the USA are obliged to provide personal data to US authorities pursuant to 50 U.S. Code § 1881a, without you necessarily having access to legal remedies. Even encryption of the data in the data centres of the electronic communications service provider cannot offer adequate protection, since an electronic communications service provider has a direct obligation with regard to imported data in its possession, custody or control to grant access to or disclose it. This obligation may expressly also extend to the cryptographic keys without which the data cannot be read. The fact that this is not merely a “theoretical risk” is demonstrated by the CJEU's ruling of 16 July 2020 (Case C 311/18, “Schrems II”). We have concluded guarantees with Google in the form of standard data protection clauses pursuant to Art. 46 para. 2 lit. c GDPR. A copy of the standard data protection clauses can be requested from us.

Top suggestions

Table of Contents