1. General

1.1 What is personal data 

Personal data is information that discloses or can disclose the identity of the user. We adhere to the principle of data minimization. Personal data is not collected wherever possible.

1.2 Handling of personal data 

Personal data is used exclusively to establish, define the content of, perform or process the contractual relationship (Art. 6 I sentence 1 b GDPR).

In addition, personal data is processed only where we have obtained your consent (Art. 6 I sentence 1 a GDPR) or where the data is required to protect our legitimate interests and the balancing of interests shows that no overriding interests, fundamental rights or freedoms on your part oppose this (Art. 6 I sentence 1 f GDPR).

We may use data processors to process your personal data, with whom we have concluded a data processing agreement where necessary; however, personal data is generally not disclosed to third parties beyond this.

The data is disclosed to the shipping company commissioned with delivery solely for the purpose of fulfilling the contract, insofar as this is necessary to deliver the ordered goods. To process payments, the payment data required for this purpose is disclosed to the credit institution commissioned with processing the payment and, where applicable, to the commissioned and selected payment service provider.

Your personal data is processed in the EU and in countries classified by the EU as secure or adequate. If personal data is processed in the USA, we ensure that the services we use are certified under the “Data Privacy Framework”.

1.3 Usage data 

When visiting the website, general technical information is collected. This includes the IP address used, the time and duration of the visit, the browser type and, where applicable, the referring page. For technical reasons, this usage data is recorded in a log file and may be used and stored for statistical analysis of this website. This usage data is not linked to your other personal data.

1.4 Registration data 

Registration is required to make full use of the functions of our website. The registration data is collected through your corresponding entries and used for the specific purpose stated in accordance with your consent (Art. 6 I sentence 1 a GDPR).

1.5 Storage period 

We store your personal data after the purpose for which the data was collected has ended only for as long as required by statutory provisions, particularly tax regulations.

2. Your Rights

2.1 Right of Access

You may request information from us as to whether we process personal data concerning you and, where this is the case, you have the right to access this personal data and the other information specified in Article 15 GDPR.

2.2 Right to Rectification

You have the right to have inaccurate personal data concerning you rectified and may, pursuant to Article 16 GDPR, request the completion of incomplete personal data.

2.3 Right to Erasure

You have the right to request that we erase the personal data concerning you without undue delay. We are obliged to erase it without undue delay, in particular if one of the following grounds applies:

Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed. You withdraw your consent, on which the processing of your data was based, and there is no other legal basis for the processing. Your data was processed unlawfully.

The right to erasure does not apply insofar as your personal data is required to establish, exercise, or defend our legal claims.

2.4 Right to Restriction of Processing

You have the right to request that we restrict the processing of your personal data if:

• You dispute the accuracy of the data and we therefore need to verify its accuracy,
• The processing is unlawful and you oppose erasure and instead request restriction of use
• We no longer need the data, but you require it to establish, exercise, or defend legal claims,
• You have objected to the processing of your data, and it has not yet been determined whether our legitimate grounds override your grounds.

2.5 Right to Data Portability

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, and you have the right to transmit this data to another controller without hindrance from us, provided that the processing is based on consent or a contract and the processing is carried out by automated means.

2.6 Right to Withdraw Consent

Where the processing of your personal data is based on consent, you have the right to withdraw that consent at any time.

2.7 General Provisions and Right to Lodge a Complaint

As a rule, exercising the above rights is free of charge for you. You have the right to contact the supervisory authority responsible for us, the State Data Protection Commissioner, directly with complaints.

3. Data security

3.1 Data security 

All data on our website is protected against loss, destruction, access, alteration, and dissemination through technical and organizational measures.

3.2 Sessions and cookies 

We use cookies or server-side sessions to operate our website, in which data may be stored. We ensure that no personal data is transferred from sessions or through cookies without your express consent, and that cookies are only used where technically necessary for the website (e.g. spam protection for contact forms, shopping cart functionality) and therefore the balancing of interests shows that no overriding interests of yours conflict with this (Art. 6 I sentence 1 f GDPR) or where you have given your express consent. With your express consent, we use cookies to personalize content and advertisements, enable social media functions, and analyze access to our website. With your consent, we may share information about your use of our website with our social media, advertising, and analytics partners. Our partners may be able to combine this information with other data they already hold about you. Below you will find the domain, name, and duration of the cookies used only on the basis of your consent:

First-party cookies
Domain: kraftwunder.com / Name: cookielawinfo-checkbox-non-necessary / Duration: 1 year
Domain: kraftwunder.com / Name: cookielawinfo-checkbox-necessary / Duration: 1 year

Third-party cookies
Domain: .doubleclick.net / Name: IDE / Duration: until 2022-10-04
Domain: .youtube.com / Name: VISITOR_INFO1_LIVE / Duration: until 2022-03-08
Domain: .youtube.com / Name: YSC / Duration: Session

4. Presence on social media platforms

We use the following social media platforms to present our company and communicate (explicit reference is made to the privacy policies and opt-out options linked below).

Facebook (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland)
Privacy policy: https://www.facebook.com/about/privacy/
Opt-out: https://www.youronlinechoices.com/

Instagram (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland)
Privacy policy and opt-out: https://help.instagram.com/

YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)
Privacy policy: https://policies.google.com/privacy

These social media platforms may process personal data outside the EU; in this regard, we refer to the aforementioned privacy policies of the social media platforms. The respective social media platforms may create usage profiles based on your usage behavior and the interests and actions resulting from it, and may store cookies on your computer containing your usage behavior. If you have an account on the respective social media platform and are logged in, your usage behavior may even be stored independently of the device. Your usage profile may be used, for example, to place advertisements that are presumed to correspond to your interests.

We process personal data exclusively to communicate with you via the social media platform you have chosen and to optimize our online presence, while ensuring that no interests of yours are affected here that outweigh this legitimate interest of ours (Art. 6 I sentence 1 f GDPR). If you have already given the respective operator of the social media platform effective consent to the corresponding data processing, your personal data will also be processed on the basis of this consent (Art. 6 I sentence 1 a GDPR).

5. Third-Party Services

5.1 Social Media Links 

We maintain our own social media pages with third-party providers accessible via links on this website. By using the links, you will be taken to the respective websites of the third-party providers (e.g., Facebook, Twitter, Instagram). To avoid unnecessary data sharing, we recommend logging out of the respective third-party provider before using the relevant link, so that the third-party provider cannot potentially create usage profiles merely through the use of the link.

5.2 Use of YouTube 

This website and the integrated services contain so-called embedded videos from YouTube. These enable a connection to YouTube and the videos hosted there. YouTube is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). YouTube is used only with your consent (Art. 6 I sentence 1 a GDPR). No user interests that outweigh this legitimate technical necessity of embedding the videos are affected here (Art. 6 I sentence 1 f GDPR). For information on the purpose and scope of data collection and use by Google, as well as your rights and settings options for protection as a YouTube customer, please refer to YouTube’s privacy policy. You can find it at: https://policies.google.com/privacy.

5.3 Google Web Fonts 

We use so-called web fonts from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google") to display a consistent font on our website. These are automatically stored in your browser cache when you access one of our pages to enable the desired display. If your browser does not support the web fonts used, a standard font from your computer may be used instead. No user interests are affected here that outweigh this technical necessity (Art. 6 I sentence 1 f GDPR). You can view Google's privacy policy here: https://www.google.com/policies/privacy/  Further information about Google Web Fonts can be found at https://developers.google.com/fonts/faq.

5.4 Google DoubleClick 

This website uses the online marketing tool DoubleClick (operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). DoubleClick uses cookies to serve relevant ads to users, improve campaign performance reports, or prevent a user from seeing the same ads multiple times. Using a cookie ID, Google records which ads are served in which browser and can thus prevent them from being served multiple times. In addition, DoubleClick can use cookie IDs to record so-called conversions that are related to ad requests. This is the case, for example, when a user sees a DoubleClick ad and later visits the advertiser's website using the same browser and makes a purchase there. According to Google, DoubleClick cookies do not contain any personal information. Due to the marketing tools used, your browser automatically establishes a direct connection with Google's server. We have no influence over the scope or further use of the data collected by Google through the use of this tool and therefore inform you according to our current knowledge: By integrating DoubleClick, Google receives the information that you have accessed the corresponding part of our website or clicked on one of our ads. If you are registered with a Google service, Google can associate the visit with your account. Even if you are not registered with Google or are not logged in, it is possible that the provider may obtain and store your IP address. You can prevent participation in this tracking process by changing the corresponding settings in your browser. Please note that in this case you may not be able to use all the functions of our offering to their full extent. DoubleClick is used only with your consent (Art. 6 I sentence 1 a GDPR). You can view Google's privacy policy here: https://policies.google.com/privacy.

5.5 Google Analytics 

This website uses Google Analytics, a web analytics service provided by Google and operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), and collects and stores data through this web analytics service from which usage profiles are created using pseudonyms. The usage profiles created in this way are used to evaluate visitor behavior in order to tailor and improve the services presented on this website to meet users’ needs. Google Analytics uses so-called “cookies”, small text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie about your use of this website is generally transmitted to and stored on a Google server in the USA. However, if IP anonymization is activated on this website, Google will truncate your IP address beforehand within member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, compile reports on website activity, and provide the website operator with further services related to website use and Internet use. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data held by Google. The usage profiles maintained under a pseudonym will also not be merged with personal data about the user without the user’s express and separately stated consent. Google Analytics is used only with your consent (Art. 6 I S. 1 a GDPR).You can prevent cookies from being stored by selecting the appropriate setting in your browser software; however, please note that in this case you may not be able to use all the functions of this website to their full extent. You can also prevent Google from collecting the data generated by the cookie and related to your use of the website (including your IP address), as well as from processing this data, by clicking the following link (http://tools.google.com/dlpage/gaoptout?hl=de) available browser plugin and install it. You can also prevent Google Analytics from collecting your data by clicking the following link. An opt-out cookie will be set that prevents the collection of your data on future visits to this website: Disable Google Analytics. You can view Google's privacy policy at http://www.google.de/intl/de/policies/privacy/view. Further information on the terms of use can be found at http://www.google.com/analytics/terms/de.html. Please note that Google Analytics on this website has been expanded with the "anonymizeIp" code to ensure anonymized collection of IP addresses (so-called IP masking).

5.6 Use of Meta Pixel (formerly Facebook Pixel)

We use the Meta Pixel operated by Meta Platforms Inc., 1 Hacker Way, Menlo Park, CA 94304, USA ("Meta"). The entity responsible for processing the information collected by Meta is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. This function enables us to target visitors to this website with advertising on Facebook. For this purpose, personalized and interest-based Facebook ads are displayed when Facebook pages are visited. 

Conversion tracking also allows Meta and its partners to display advertisements to you outside Facebook. 

The function is enabled on our website by a pixel from Meta that is implemented on the page. When you visit our website, the pixel establishes a direct connection to the Facebook server if you have consented to the pixel being set (Article 6 I sentence 1 a GDPR). The Facebook server is thus informed which of our websites the user has visited. Facebook assigns this information to your personal Facebook user account. 

Please note that the use of the Meta Pixel may result in the transfer of personal data to Meta Platforms Inc., 1 Hacker Way, Menlo Park, CA 94304, USA.

Further information on the collection and use of data by Meta, your rights in this regard, and options for protecting your privacy can be found in Facebook's privacy policy at https://www.facebook.com/about/privacy/.

Once you have given your consent, you can object at any time using this opt-out link: 

Opt Out: https://www.youronlinechoices.com/

If you do not want Facebook to assign the collected information directly to your Facebook account, you can edit this function in your account settings at:  https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fsettings%2F%3Ftab%3Dads#_=_edit. To do this, you must be logged in to Facebook.

Meta Platforms Inc. is certified under the EU-US Data Privacy Framework, which ensures GDPR-compliant processing of the personal data of EU citizens within the USA.

5.7 Shopify

We created our website with the external service provider Shopify (Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland) and also host it there. The personal data collected on our website is stored on Shopify's servers and also processed, among other places, in the USA. This may primarily include IP addresses, contact requests, metadata and communication data, contract data, contact details, names, website visits, and other data generated via a website. We have concluded a data processing agreement with this provider. Shopify will process your data only to the extent necessary to fulfill its service obligations and will follow our instructions regarding this data. Shopify is used for the purpose of operating the website and in the interest of providing our online offering securely, quickly, and efficiently through a professional provider. No user interests are affected here that outweigh this technical necessity of using the service provider (Art. 6 I sentence 1 f GDPR). You can view Shopify's privacy policy here:  https://www.shopify.com/de/legal/datenschutz    

5.8 Payment options

In addition to payment by credit card, payment via PayPal and Klarna is also available:

PayPal (PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg (City), Luxembourg) 

Privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full/ 

Klarna (Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden)

Privacy policy: https://www.klarna.com/sofort/datenschutz/ 

Google Pay (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)  

Privacy policy: https://policies.google.com/privacy?hl=de&gl=de

The following data of yours is regularly transmitted to and processed by third-party providers for payment processing:

• Your email address

• Your address

•  Details of your order

• Your IP address

• Bank details

The transmission and processing of your personal data by the payment provider is required so that you can make the payment through it. The legal basis for this is Art. 6 I sentence 1 b GDPR (processing for the performance of a contract).

5.9 CDN from UNPKG

Our website uses a so-called Content Delivery Network (CDN). A CDN is a network of high-performance servers that temporarily stores content in various locations around the world. A CDN essentially has two tasks: on the one hand, it is intended to provide content in the shortest possible time, and on the other, to relieve the web host by distributing traffic. The legal basis is Article 6 I sentence 1 f of the GDPR. No data is transferred outside the EU or outside a country for which the European Commission has issued an adequacy decision.  

 5.10 Trusted Shops

Trusted Shops widgets are integrated into this website to display Trusted Shops services (e.g. quality seal, collected reviews) and to offer Trusted Shops products to buyers after an order. The Trustbadge and the services advertised with it are offered by Trusted Shops AG, Subbelrather Str. 15C, 50823 Cologne, with which we are jointly responsible under Article 26 of the GDPR. In the following, we inform you about the key contents of the agreement in accordance with Article 26 II of the GDPR in these data protection notices. 

The Trustbadge is provided as part of joint controllership by a US-based CDN provider (Content Delivery Network). An adequate level of data protection is ensured, among other things, by standard data protection clauses and further contractual measures. Further information on data protection at Trusted Shops AG can be found in its privacy policy: https://www.trustedshops.de/impressum-datenschutz/ 

When the Trustbadge is accessed, the web server automatically stores a so-called server log file, which also contains your IP address, the date and time of access, the amount of data transferred, and the requesting provider (access data), and documents the access. The IP address is anonymized immediately after collection, so that the stored data can no longer be associated with you. The anonymized data is used in particular for statistical purposes and error analysis.

After your order is completed, your email address, hashed using a cryptographic one-way function, will be transmitted to Trusted Shops AG. The transmission of the hashed email address serves to check whether you are already registered for services with Trusted Shops AG. If this is the case, further processing will take place in accordance with the contractual agreement between you and Trusted Shops. If you are not yet registered for the services, you will subsequently have the opportunity to register for the first time. Further processing after registration has taken place is likewise governed by the contractual agreement with Trusted Shops AG. If you do not register, all transmitted data will be automatically deleted by Trusted Shops AG, after which it will no longer be possible to associate the data with an individual.

The legal basis for using the Trusted Shops functions is our legitimate interest (Art. 6 I sentence 1 f GDPR) in enabling an attractive presentation of our services and offers. 

As part of the joint controllership between us and Trusted Shops AG, please preferably contact Trusted Shops AG using the contact details provided above for questions regarding data protection and to exercise your rights. Regardless, you may always contact the controller of your choice. If necessary, your request will then be forwarded to the other controller for a response.

5.11 AWS

Our website is hosted (operated) by the external service provider Amazon Web Services, or AWS for short (Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA). The personal data collected on our website is stored on AWS servers. This may include, in particular, IP addresses, contact details, contract data, website access data, and other data generated through a website. The hosting provider is used for the purpose of fulfilling our contractual obligations to our potential and existing customers (Art. 6 I sentence 1 b GDPR) and in the interest of ensuring the secure, fast, and efficient provision of our online offering by a professional provider (Art. 6 I sentence 1 f GDPR). AWS will process your data only to the extent necessary to fulfill its service obligations and will follow our instructions regarding this data. AWS also uses a CDN (Content Delivery Network). A CDN is a network of high-performance servers that temporarily store content in various locations around the world. A CDN essentially has two functions: first, it is intended to deliver content in the shortest possible time, and second, to relieve the web host by distributing traffic. The legal basis is Art. 6 I sentence 1 f GDPR.  

You can view AWS's privacy policy here: https://aws.amazon.com/de/privacy/ 

You can find the Amazon data processing terms, which correspond to the standard contractual clauses, at https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf

To contact us regarding data protection, you are welcome to contact us using the contact details below. Controller within the meaning of the GDPR:

Nowbody GmbH & Co. KG
Sacrower Allee 46
D-14476 Potsdam

Email: hello@kraftwunder.com
Phone: +49(0)3320 150 36 71