Privacy Policy

Table of Contents

1. Data Controller

2. Hosting & Content Delivery

3. Server Log Files

4. Cookies & Consent Management

5. Data Processing for Orders

6. Payment Service Providers

7. Shipping Service Providers

8. Newsletter & Marketing Communication

9. Web Analytics (Mixpanel)

10. Social Media Presence

11. Legal Basis Matrix

12. Storage Duration & Deletion

13. Your Rights as a Data Subject

14. Data Security

15. Obligation to Provide Data

16. Changes to this Policy

1. Data Controller

The Data Controller within the meaning of data protection laws is:

TRANDADEV UG (haftungsbeschränkt)
Rathausgasse 5
12529 Schönefeld

HRB 19606 (Local Court of Cottbus)
Managing Director: Przemyslaw Tranda

Responsible for all questions regarding data protection.

(A Data Protection Officer is currently not required pursuant to Art. 37 GDPR, as fewer than 20 persons are employed in the automated processing of personal data, and no processing operations are carried out that require a data protection impact assessment pursuant to Art. 35 GDPR or that process special categories of data pursuant to Art. 9 or 10 GDPR on a large scale).

2. Hosting & Content Delivery

Our website is operated by an EU ISO 27001-certified hosting service provider; a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR has been concluded with them. This service provider processes all data flowing through our website on our behalf.

3. Server Log Files

When you access our website, the following data is processed in so-called server log files for technical reasons: IP address, date & time of access, requested file (URL), referrer URL (the previously visited page), information about the browser used, and the operating system (user agent).

This data serves exclusively to technically secure and optimize the operation of the website, system security, and statistical evaluation. This data is automatically deleted after seven days.

The legal basis for this processing is Art. 6(1)(f) GDPR (legitimate interest in the technical functionality and security of the website).

4. Cookies & Consent Management

Cookies are small text files that are stored on your end device. Some cookies are technically necessary for the operation of the website (e.g., for the shopping cart). For all other cookies that are not technically necessary (e.g., for analysis or marketing purposes), we obtain your active consent via our consent management banner.

The processing of personal data by technically necessary cookies is based on Art. 6(1)(f) GDPR (our legitimate interest in the error-free provision of our website).

For all non-technically necessary cookies and the associated processing of personal data, we obtain your active consent in accordance with § 25(1) sentence 1 TTDSG (storage and access to information in the end device) in conjunction with Art. 6(1)(a) GDPR (subsequent data processing). You have the equivalent opportunity to grant or refuse your consent at any time.

5. Data Processing for Orders

When you place an order with us, we process the data required for contract execution: your master data (name, address), communication data (email, telephone number if applicable), payment data, and delivery data.

The processing of this data takes place exclusively for the purpose of initiating, implementing, and processing the purchase contract (Art. 6(1)(b) GDPR). The mandatory fields required for the purchase are marked accordingly in the order form; without providing this data, a contract conclusion and shipment of the goods are not possible.

6. Payment Service Providers

We use external payment service providers to process payments. In doing so, we forward the necessary payment data to these service providers.

• PayPal (Europe S.à r.l. et Cie, S.C.A., Luxembourg): For payment processing via PayPal. The transfer of your data to PayPal takes place exclusively for the purpose of transaction execution on the basis of Art. 6(1)(b) GDPR. In the event of data transfers to third countries, PayPal relies on appropriate guarantees such as the EU-US Data Privacy Framework (provided the recipient is certified) or Standard Contractual Clauses of the EU Commission (SCC).

• Stripe Payments Europe Ltd. (Ireland): For credit card payments and other payment methods. The transfer of your data to Stripe takes place exclusively for the purpose of transaction execution on the basis of Art. 6(1)(b) GDPR. Here, too, appropriate guarantees such as the EU-US Data Privacy Framework (provided the recipient is certified) or Standard Contractual Clauses of the EU Commission apply to third-country transfers.

Please refer to the privacy policies of the respective payment service providers for further information on the processing of your data by these providers.

7. Shipping Service Providers

For the delivery of the goods ordered by you, we work together with shipping service providers. For the purpose of delivery, we transmit the necessary data (name, address, email, and if applicable, telephone number for shipment notification) to:

• DHL Paket GmbH (Bonn, Germany)

• DPD Germany

The transfer of this data is based on Art. 6(1)(b) GDPR (performance of a contract). The shipping service provider processes the data according to its own data protection guidelines.

8. Newsletter & Marketing Communication

If you sign up for our newsletter, we process your email address for the purpose of sending the newsletter. Registration takes place using the double-opt-in procedure, in which you receive a confirmation email after entering your email address to verify your registration. Your email address is only activated for newsletter delivery after confirmation.

We use the service of Mailerlite to send our newsletter.

The legal basis for this processing is your consent pursuant to Art. 6(1)(a) GDPR.

You can revoke your consent to receive the newsletter at any time and unsubscribe from the newsletter. A link to unsubscribe can be found at the end of each newsletter. After unsubscribing, your email address will be deleted from the active newsletter distribution list.

9. Web Analytics (Mixpanel)

We use Mixpanel, a web analytics service, to analyze the use of our website and to optimize it. Mixpanel uses cookies that enable an analysis of your use of the website.

We use Mixpanel with activated IP anonymization. In this case, your IP address is shortened by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area and thus anonymized.

The data is only loaded and processed after you have given your consent via our consent management banner in accordance with Art. 6(1)(a) GDPR.

We have concluded a Data Processing Agreement with Mixpanel in accordance with Art. 28 GDPR.

10. Social Media Presence

We maintain profiles or fan pages on social networks in order to communicate with interested parties and users and to provide information about our products and services.

• Facebook / Meta (Meta Platforms Ireland Ltd., Grand Canal Harbour, Dublin 2, Ireland)

• Instagram (Meta Platforms Ireland Ltd., Grand Canal Harbour, Dublin 2, Ireland)

• LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland)

When visiting our social media profiles, the terms and conditions and privacy policies of the respective provider apply. Data processing within the scope of operating a fan page or a profile on these platforms is based on joint controllership (Art. 26 GDPR) between us and the respective platform operator. Information on joint controllership and the essential contents of the agreement under Art. 26 GDPR can be found on the websites of the respective providers.

We have no influence on the data collection and further processing by the social media operators.

11. Legal Basis Matrix

The following matrix provides an overview of the most important processing activities on our website, the associated data types, the legal bases, the storage duration, and the recipients:

12. Storage Duration & Deletion

We store personal data only as long as necessary to achieve the respective processing purpose. As soon as the purpose ceases to apply, we delete or anonymize the data, unless statutory retention obligations (e.g., commercial or tax law retention periods of 6 or 10 years) prevent this.

13. Your Rights as a Data Subject

You have the right at any time to:

• Obtain information about your personal data stored by us (Art. 15 GDPR).

• Request the correction of incorrect data (Art. 16 GDPR).

• Request the deletion of your data, provided the requirements of Art. 17 GDPR are met.

• Request the restriction of processing of your data, provided the requirements of Art. 18 GDPR are met.

• Request data portability, provided the requirements of Art. 20 GDPR are met.

• Object to the processing of your data (Art. 21 GDPR), provided the processing is based on legitimate interests pursuant to Art. 6(1)(f) GDPR.

• Revoke consent granted at any time with effect for the future (Art. 7(3) GDPR).

• Lodge a complaint with the competent data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen).

Please contact us using the contact details mentioned in point 1 to assert your rights.

14. Data Security

We apply appropriate technical and organizational security measures (TOMs) according to Art. 32 GDPR to protect your data against accidental or unlawful destruction, loss, alteration, or against unauthorized disclosure or unauthorized access. This includes, in particular, the TLS encryption of our website, internal access controls, and regular backups.

15. Obligation to Provide Data

The provision of certain personal data (master, payment, delivery data) is necessary for the conclusion and performance of the purchase contract (Art. 6(1)(b) GDPR). Without providing this data, a purchase via our website is not possible. The provision of all other data is voluntary.

16. Changes to this Policy

This privacy policy will be updated as necessary, e.g., due to changes in the legal situation, technical conditions, or our processing activities. We recommend that you inform yourself regularly about the content of our privacy policy.

Current Version: April 25, 2026