Privacy Policy

Here below we inform you about who is responsible for processing your personal data, the purpose of and scope of the processing of your personal data and about your rights.

C. Josef Lamy GmbH operates all pages that can be reached via the menu items “Design World”, “Made in Germany”, “Finger Tip Feeling” or indicated in the footer as part of the brand world. Lamyshop GmbH operates all pages that can be reached via the menu item "Shop" or are marked as part of the shop in the footer. C. Josef Lamy GmbH and Lamyshop GmbH are joint controllers pursuant to Article 26 (1) sentence 1 of the General Data Protection Regulation (GDPR) because they jointly determine the purposes and means of the processing. In an agreement, they have specified which of them fulfils which obligation under the GDPR. The essential contents of this agreement are available at this link. The pages operated by C. Josef Lamy GmbH and Lamyshop GmbH are hereinafter referred to as "Lamy websites".

Name and contact information of the data controller

C. Josef Lamy GmbH
Grenzhöfer Weg 32
69123 Heidelberg
info@lamy.de

and

Lamyshop GmbH
Kistlerhofstrasse 70, Gebäude 75
81379 München
service@lamyshop.com

 

Name and contact information of the data protection controller

For C. Josef Lamy GmbH:

Michael Gruber
External data protection officer
BSP-SECURITY
datenschutzbeauftragter@lamy.de

 

For the Lamyshop GmbH:

Lamyshop GmbH
Kistlerhofstrasse 70, Gebäude 75
81379 München
service@lamyshop.com

Information on the scope and purpose of the processing of person-related data

 

Server log files

Each time you visit the Lamy websites, usage data is transmitted to us or to our web hoster/IT service provider by your Internet browser and stored as protocol data (in so-called server log files). This stored data includes

  • time of the request,
  • name of the page accessed,
  • IP address (masked),
  • browser used,
  • operating system used and
  • HTTP method.

The legal basis for this data processing relates to our overriding legitimate interest in ensuring the disruption-free operation of our Lamy websites in accordance with Art. 6 para. 1 p. 1 lit. f GDPR.

We delete this personal data after 90 days.

 

Cookies

Types of Cookie

Our Lamy websites use different types of cookies. Please find information about these different types below.

 

Technically essential cookies

Technically necessary cookies safeguard functions without which our Lamy websites cannot be used as intended. These are so-called first party cookies; they are only used by us. The legal basis is our overriding legitimate interest in the fault-free functioning of our Lamy websites in accordance with Art. 6 (1) p. 1 lit. f DSGVO. This personal data is deleted by us at the latest after 30 days. You can find further information in our cookie banner under "Cookie details".

 

Functional cookies

Functional cookies are not absolutely necessary for the operation of our Lamy websites, but they do support user friendliness by, for example, saving language or location settings for a renewed visit to the Lamy websites. The legal basis for the use of these cookies is your consent in accordance with Art. 6 para. 1 p. 1 lit. a GDPR. This personal data is deleted by us at the latest after 90 days. You can find further information in our cookie banner under "Cookie details".

 

Analytics Cookies

Analysis cookies collect information about how you use websites. Thereby, their attractiveness, content and functionality should be improved. The following information, for example, is collected for this purpose

  • the number of visits to a page or sub-pages,
  • the amount of time spent on the website,
  •  the sequence of the pages visited,
  • which search terms brought you to us,
  • the country, region and city from which access is made,
  • the proportion of mobile devices accessing the Lamy websites and
  • which areas of a website are of particular interest to you.

The legal basis for the setting of analysis cookies is your consent pursuant to Art. 6 para. 1 p. 1 lit. a GDPR. We delete this personal data at the latest after 24 months. Further information can be found in section 3 "Analysis and Marketing" and in our cookie banner under "Cookie Details".

 

Marketing Cookies

Marketing cookies help us to analyse our advertising campaigns with our advertising partners and build a profile of your interests in order to show you relevant and targeted advertising on other websites. These are so-called third party cookies and they are placed by our advertising partners when you visit our Lamy websites. The legal basis for the placement of marketing cookies is your consent in accordance with Art. 6 para. 1 p. 1 lit. a GDPR. This personal data is deleted by us at the latest after 90 days. Further information can be found in section 3 "Analysis and Marketing" and in our cookie banner under "Cookie Details".

Use of Google Analytics

We use Google Analytics on our Lamy websites. Google Analytics is a web analysis service provided by Google LLC. The responsible service provider in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google LLC and Google Ireland Limited hereinafter referred to as "Google").

 

Type of data processing

Google Analytics sets cookies to perform an analysis of your use of the Lamy websites. Google Analytics receives the following information about you:

  • Online tags including cookie tags,
  • IP addresses,
  • device IDs and
  • tags assigned by you.

For example, we receive the following information:

  • The number of accesses to certain pages within the website (so-called click path),
  • Information on access times (so-called length of stay timeof users),
  • Information about pages via which the user reaches the website (so-called referrer URL),
  • Information about pages via which the user leaves the website (so-called jump pages),
  • Information on the regional origin of the users (e.g. sorted by city or country of origin) and
  • Information about the conversion rate ofcertain sub-pages.

The Lamy websites use Google Analytics with the extension "_anonymizeIp()" (so-called IP masking). This causes IP addresses within member states of the European Union are shortened before being transmitted to the USA. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and then shortened there.

On behalf of Lamy, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator.

 

Legal basis for the processing of data

The information collected in this way is usually transferred to a Google server in the USA and then stored there. There is no adequacy decision for the USA pursuant to Art. 45 GDPR, as the USA cannot provide protection of personal data comparable to that of the GDPR. Access by US authorities to the data stored by Google cannot be ruled out. We have agreed standard contractual terms with Google, which serve as a guarantee for adequate protection of your data. The standard contractual terms are available at https://workspace.google.com/terms/mcc_terms.html.

The legal basis for this data processing is your consent pursuant to Art. 6 para. 1 p. 1 lit. a GDPR. You can revoke your once given consent at any time and without giving reasons for the future. The legality of the processing carried out on the basis of consent until revocation shall not be affected by the revocation.

By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies which have already been saved may be deleted at any time. This can also be done automatically. If cookies are deactivated for our websites, it may no longer be possible to use all the functions of the websites to their full extent.

In addition, you can prevent Google from collecting the data generated by the cookie pertaining to your use of the Lamy website (including your IP address) and prevent the processing of this data by Google by clicking on the link below and downloading and installing the browser plug-in (https://tools.google.com/dlpage/gaoptout?hl=de).

You can find more information on the terms of use of Google Analytics and on data protection at Google athttps://marketingplatform.google.com/about/analytics/terms/de/ and at https://policies.google.com/?hl=de.

 

Duration of storage

We delete this personal data at the latest after 24 months.

 

 

Use of the Facebook Pixel

We use the Facebook Pixel analysis tool on our Lamy websites. Facebook Pixel is a Facebook Inc. service. The responsible service provider in the EU is Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (Facebook Inc. and Facebook Ireland Limited hereinafter referred to collectively as "Facebook").

 

Type of data processing

We use Facebook Pixel to tailor our advertising to your interests. If you have accessed the Lamy websites via a Facebook ad, the Facebook pixel triggers a section of JavaScript code and stores your user behaviour on our Lamy websites using cookies. These cookies allow Facebook to match your user data with your Facebook account data. If you are logged in as a Facebook user, your visit to our Lamy websites is automatically assigned to your account.

The Facebook Pixel collects the following information and shares it with us:

  • information stored in the HTTP header, i.e. IP address, information on the web browser used, page location, document, referrer and the visitor to the web pages,
  • pixel-specific data, i.e. pixel ID and data from the Facebook cookie,
  • button click data, i.e. all buttons that are clicked by you on the Lamy websites and all pages that are called up as a result of the button clicks,
  • optional values when visiting personalised data events, e.g. conversion value and page type and
  • form field names that are populated when a product is purchased, e.g. email address, address and quantity of the product purchased.

 

Legal basis for the processing of data

The information collected in this way is usually transferred to a Facebook server in the USA and then stored there. There is no adequacy decision for the USA pursuant to Art. 45 GDPR, as the USA cannot provide protection of personal data comparable to that of the GDPR. Access by US authorities to the data stored by Facebook cannot be ruled out. We have agreed standard contractual terms with Facebook which make it possible to guarantee adequate protection of your data. The standard contractual terms are to be found at https://www.facebook.com/legal/EU_data_transfer_addendum.

The legal basis for this data processing is your consent pursuant to Art. 6 para. 1 p. 1 lit. a GDPR. You can revoke your once given consent at any time and without giving reasons for the future. The legality of the processing carried out on the basis of consent until revocation shall not be affected by the revocation.

By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies which have already been saved may be deleted at any time. This can also be done automatically. If cookies are deactivated for our websites, it may no longer be possible to use all the functions of the websites to their full extent.

If you are logged in to Facebook, you can independently change the settings for advertisements underhttps://www.facebook.com/about/basics/advertising/ad-preferences. Instructions for this can be found at https://de-de.facebook.com/help/568137493302217.

You can find more information on the terms of use of Facebook Pixel and Facebook's data protection policy at https://www.facebook.com/policy.php, https://www.facebook.com/legal/terms/dataprocessing/update and https://de-de.facebook.com/legal/terms/businesstools#

 

Duration of storage

We delete this personal data after 90 days.

 

 

This can also be done automatically.

We use Google Ads for online marketing on our Lamy websites. Google Ads is an online advertising system provided by Google LLC. The responsible service provider in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google LLC and Google Ireland Limited hereinafter referred to as "Google").

 

Type of data processing

We use the tracking tool offered by Google Ads. A so-called conversion occurs when you click on one of our Google Ads and subsequently interact in some way with us, for example by making a purchase or signing up for our newsletter. This allows us to see which keywords, ads and campaigns trigger customer actions. Conversion tracking allows us to evaluate and optimise the success of our advertising measures.

The Google Ads tracking tool uses cookies for this purpose. As soon as you click on one of Lamy's Google Ads and thereby reach one of our Lamy web pages, Google Ads stores a cookie. This cookie allows Google Ads to recognise your web browser.  When you visit our Lamy websites and the conversion cookie has not yet expired, Google and ourselves will recognise that you have clicked on a Google Ads ad from Lamy and were thereby redirected to one of the Lamy websites. The cookie with the conversion data is read by Google and statistical evaluations are provided to us by Google. We ourselves do not collect any personal data. We have no influence as to how Google uses the data. Google states that it takes care to maintain the confidentiality and security of conversion data.

We receive the following information through conversion cookies:

  • Unique Cookie ID,
  • number of ad impressions per placement (frequency),
  • last impression (relevant for post-view conversions) and
  • opt-out information (marking that you no longer wish to be contacted).

 

Legal basis for the processing of data

The data collected in this way is usually transferred to a Google server in the USA and stored there. There is no adequacy decision for the USA pursuant to Art. 45 GDPR, as the USA cannot provide protection of personal data comparable to that of the GDPR. Access by US authorities to the data stored by Google cannot be ruled out. We have agreed standard contractual terms with Google, which serve as a guarantee for adequate protection of your data. The standard contractual terms are to be found at https://workspace.google.com/terms/mcc_terms.html.

The legal basis for this data processing is your consent pursuant to Art. 6 para. 1 p. 1 lit. a GDPR. You can revoke your once given consent at any time and without giving reasons for the future. The legality of the processing carried out on the basis of consent until revocation shall not be affected by the revocation.

By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies which have already been saved may be deleted at any time. This can also be done automatically. If cookies are deactivated for our websites, it may no longer be possible to use all the functions of the websites to their full extent.

In addition, you can prevent Google from collecting the data generated by the cookie pertaining to your use of the Lamy website (including your IP address) and prevent the processing of this data by Google by clicking on the link below and downloading and installing the browser plug-in (https://tools.google.com/dlpage/gaoptout?hl=de).

You can find more information about Google Ads terms of use and Google's data protection policy at https://support.google.com/google-ads/answer/9028179?hl=de&ref_topic=3119071 and at https://policies.google.com/?hl=de.

 

Duration of storage

We delete this personal data after 90 days.

 

 

Use of Google’s "remarketing" or "similar target groups" function

We use Google's "remarketing" or "similar target groups" function on our Lamy websites. Google Analytics is a web analysis service provided by Google LLC. The responsible service provider in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google LLC and Google Ireland Limited hereinafter referred to as "Google").

 

Type of data processing

After visiting our Lamy websites, Google's "remarketing" or "similar target groups" function may be used to present you with ads from Google on other websites that contain Lamy-related advertising. To do this, Google analyses your interaction on our Lamy websites and sets cookies that record your visit. A remarketing audience is created based on user behaviour on our Lamy websites and then used to place interest-based Google Ads.

Google may process the following and other data, in connection with the "remarketing" or "similar target groups" function:

  • URLs and referral URLs for web pages that trigger a tag,
  • user-defined parameters of your tracking tag and
  • the resulting inclusion on remarketing lists.

 

Legal basis for the processing of data

The information obtained is transferred to a Google server in the USA and stored there. There is no adequacy decision for the USA pursuant to Art. 45 GDPR, as the USA cannot provide protection of personal data comparable to that of the GDPR. Access by US authorities to the data stored by Google cannot be ruled out. We have agreed standard contractual terms with Google, which serve as a guarantee for adequate protection of your data. The standard contractual terms are to be found at https://workspace.google.com/terms/mcc_terms.html.

The legal basis for this data processing is your consent pursuant to Art. 6 para. 1 p. 1 lit. a GDPR. You can revoke your once given consent at any time and without giving reasons for the future. The legality of the processing carried out on the basis of consent until revocation shall not be affected by the revocation.

By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies which have already been saved may be deleted at any time. This can also be done automatically. If cookies are deactivated for our websites, it may no longer be possible to use all the functions of the websites to their full extent.

In addition, you can prevent Google from collecting the data generated by the cookie pertaining to your use of the Lamy website (including your IP address) and prevent the processing of this data by Google by clicking on the link below and downloading and installing the browser plug-in (https://tools.google.com/dlpage/gaoptout?hl=de).

More information on the terms of use of the "Remarketing" or "Similar target groups" function and on Google's data protection policy can be found at https://support.google.com/adspolicy/answer/143465 and at https://policies.google.com/?hl=de.

 

Duration of storage

We delete this personal data after 90 days.

 

 

Google Tag Manager

We use the Google Tag Manager on our Lamy websites. The Google Tag Manager is a service provided by Google LLC. The responsible service provider in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google LLC and Google Ireland Limited hereinafter referred to as "Google").

 

Type of data processing

The Google Tag Manager allows sections of code from tracking tools used on Lamy websites to be integrated into our Lamy websites in a structured and simplified manner. The code sections are called tags. The Google Tag Manager ensures that the tags embedded on the Lamy websites can be triggered. When triggered, a tag sends tracking information from our Lamy websites to third party providers such as Google. The Google Tag Manager can also transmit and generate its own cookies. For this purpose, the Google Tag Manager records your IP address.

 

Legal basis for the processing of data

The information collected in this way is usually transferred to a Google server in the USA and then stored there. There is no adequacy decision for the USA pursuant to Art. 45 GDPR, as the USA cannot provide protection of personal data comparable to that of the GDPR. Access by US authorities to the data stored by Google cannot be ruled out. We have agreed standard contractual terms with Google, which serve as a guarantee for adequate protection of your data. The standard contractual terms are to be found at https://workspace.google.com/terms/mcc_terms.html.

The legal basis for this data processing is your consent pursuant to Art. 6 para. 1 p. 1 lit. a GDPR. You can revoke your once given consent at any time and without giving reasons for the future. The legality of the processing carried out on the basis of consent until revocation shall not be affected by the revocation.

By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies which have already been saved may be deleted at any time. This can also be done automatically. If cookies are deactivated on our Lamy websites, it may no longer be possible to use all the functions of the websites to their full extent.

In addition, you can prevent Google from collecting the data generated by the cookie pertaining to your use of the Lamy website (including your IP address) and prevent the processing of this data by Google by clicking on the link below and downloading and installing the browser plug-in (https://tools.google.com/dlpage/gaoptout?hl=de).

For more information on the terms of use of the Google Tag Manager and data protection at Google, seehttps://support.google.com/tagmanager/answer/6102821?hl=de and underhttps://policies.google.com/?hl=de.

 

 

Use of Hotjar

We use the analysis tool Hotjar on our Lamy websites. Hotjar is a service provided by Hotjar Ltd, Dragonara Business Centre, Dragonara Road, Paceville St Julian's STJ 3141, Malta.

 

Type of data processing

Hotjar enables us to evaluate the behaviour of visitors to Lamy websites, including for example how much time they spend on the websites and which links they click on. Hotjar uses various tools for this purpose, such as heat maps, session recording, incoming feedback, on-site surveys, external link surveys, funnel analytics and cookies.

As a result, Hotjar collects and shares the following information, etc. with Lamy:

  • IP address,
  • screen size and device type (so-called Unique Device Identifiers),
  • browser used,
  • mouse movement, clicks and scrolling behaviour,
  • location (country only),
  • preferred language setting and
  • date and time of visit.

 

Legal basis for the processing of data

Data collected in this way is transferred to servers in Germany, Ireland and the USA. Hotjar uses contracted Sub-processors for this purpose. Currently, these are Datadog for Germany, Amazon Web Services for Ireland and Sentry for the USA. Hotjar reserves the right to use additional contracted Sub-processors and pledges to take appropriate security measures with new partners.

There is no adequacy decision for the USA pursuant to Art. 45 GDPR, as the USA cannot provide protection of personal data comparable to that of the GDPR. Access by US authorities to the data stored by Sentry cannot be ruled out. Hotjar has agreed standard contractual terms with Sentry which ensure that your data is adequately protected. The standard contractual terms are to be found at sentry.io/legal/dpa/.

The legal basis for this processing of data is your consent pursuant to Art. 6 para. 1 p. 1 lit. a GDPR. Once you have given your consent, you can revoke it with respect to the future at any time and without giving reasons. The legality of the processing carried out on the basis of consent until revocation shall not be affected by the revocation.

By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies which have already been saved may be deleted at any time. This can also be done automatically. If cookies are deactivated for our websites, it may no longer be possible to use all the functions of the websites to their full extent.

You can find more information on data protection at Hotjar at https://www.hotjar.com/legal/policies/privacy/?tid=331633074810 and https://www.hotjar.com/legal/compliance/gdpr-commitment/.

 

Duration of storage

We delete this personal data after 90 days.

 

 

Google Maps

We use Google Maps on our Lamy websites, a map service provided by Google LLC. The responsible service provider in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google LLC and Google Ireland Limited hereinafter referred to as "Google").

 

Type of data processing

Google Maps allows us to show you the locations of our dealers on our Lamy websites. In order to integrate Google Maps on our Lamy websites in a data-saving manner, we use the so-called two-click solution. When you visit our Lamy websites, this two-click solution prevents Google Maps from transferring your data to Google. Only when you click on a Google Maps map on our Lamy website and activate it will data be transferred to Google with your consent. Google Maps then collects information about your browser, the device type, operating system, IP address and the date and time of the request, etc.

The Lamy website also offers you the possibility to search for dealers in your area. For this purpose, you can independently enter an address, a place or a country in the search bar. Clicking the button activates Google Maps and the above data is transferred to Google with your consent. You can also perform a search "as seen from your current location". Clicking the button will then transmit your current location to Google with your consent, in addition to the data mentioned above.

 

Legal basis for the processing of data

The information collected in this way is usually transferred to a Google server in the USA and then stored there. There is no adequacy decision for the USA pursuant to Art. 45 GDPR, as the USA cannot provide protection of personal data comparable to that of the GDPR. Access by US authorities to the data stored by Google cannot be ruled out. We have agreed standard contractual terms with Google, which serve as a guarantee for adequate protection of your data. The standard contractual terms are to be found at https://workspace.google.com/terms/mcc_terms.html.

The legal basis for this processing of data is your consent pursuant to Art. 6 para. 1 p. 1 lit. a GDPR. You can revoke your once given consent at any time and without giving reasons for the future. The lawfulness of the processing carried out on the basis of the consent until revocation shall not be affected by the revocation. You can find more information on data protection at Google at https://policies.google.com/privacy?hl=de.

 

Duration of storage

We delete this personal data after 90 days.

Opening a customer account

When opening a customer account, we collect your personal data to the extent specified there. The purpose of data processing is to improve your shopping experience and to simplify order processing.

The legal basis for this processing of data is your consent pursuant to Art. 6 para. 1 p. 1 lit. a GDPR. You can revoke your consent with respect to the future at any time and without giving reasons (by email to datenschutzbeauftragter@lamy.de). The legality of the processing carried out on the basis of the consent until revocation shall not be affected by the revocation.

We will delete your personal data immediately after your consent has been revoked, unless and insofar as there are legal, in particular commercial and tax law retention periods that prevent this or if some other legal basis exists.

 

Order processing

When you place an order, we collect and use your personal data only insofar as this is necessary to fulfil and process your order and to process your enquiries. The provision of the data is necessary for conclusion of the contract. Failure to make it available means that no contract can be concluded.

Your data will be passed on, for example, to the shipping companies and dropshipping providers, payment service providers, service providers for order processing and IT service providers selected by you. We strictly observe the legal requirements in all cases. The amount of data transmitted is restricted to a minimum.

The legal basis for this data processing is Art. 6 para. 1 p. 1 lit. b GDPR. The processing is necessary for the execution of a contract with you.

After the contract has been fully processed, the data will initially be stored for the duration of the warranty period. Thereafter, the data will be stored if and to the extent that there are statutory retention periods, in particular under commercial and tax law, or if there is some other legal basis for doing so.

 

Payment service provider

To make a payment, you can choose between various payment methods.

 

Using PayPal

Within the framework of the payment process using PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A. 22-24 Boulevard Royal, L-2449, Luxembourg) we receive information about your PayPal account username. This provision is necessary for the conclusion of the purchase contract or in the context of a contract cancellation for the purpose of repayment. PayPal receives your bank information and customer master data. All PayPal transactions are subject to the PayPal data protection declaration. This can be found at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

The legal basis for the transfer and processing of your personal data by your selected payment service provider is Art. 6 para. 1 p. 1 lit. b GDPR. The processing is necessary for the performance of the contract.

 

Using Klarna

Within the framework of the payment process via Klarna (Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden), we will transmit your bank data and customer master data to Klarna. This way Klarna can assess whether you can take advantage of the payment options offered by Klarna and adapt the payment options to your needs. All transactions via Klarna are subject to the Klarna data protection declaration. These can be found at https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/privacy.

We have commissioned the European financial institution Novalnet AG Zahlungsinstitut (ZAG), Feringastraße 4, 85774 Unterföhring (Novalnet) to process payments via Klarna. For the purpose of payment processing, Novalnet receives personal data from you (usually first name, last name, address, date of birth, gender, email address, IP address, telephone number, mobile phone number, payment information) as well as data about your order.

The legal basis for this data processing is Art. 6 para. 1 p. 1 lit. b GDPR. The processing is necessary for the performance of the contract.

 

Using iDeal

In the context of payment processing using iDeal (Currence Services BV, Beethovenstraat 300, 1077 WZ Amsterdam, The Netherlands), we transmit your bank details and customer master data to Currence Services BV. All transactions conducted with iDeal are subject to the iDeal data privacy statement. These can be found at https://www.ideal.nl/en/disclaimer-privacy-statement/.

We have commissioned the European financial institution Novalnet AG Zahlungsinstitut (ZAG), Feringastraße 4, 85774 Unterföhring (Novalnet) to process payments via iDeal. For the purpose of payment processing, Novalnet receives personal data from you (usually first name, last name, address, date of birth, gender, email address, IP address, telephone number, mobile phone number, payment information) as well as data about your order.

The legal basis for this data processing is Art. 6 para. 1 p. 1 lit. b GDPR. The processing is necessary for the performance of the contract.

 

Using eps

The eps payment system was jointly developed by Austrian banks and the Studiengesellschaft für Zusammenarbeit im Zahlungsverkehr GmbH (STUZZA), Frankgasse 10/8, 1090 Vienna. Within the framework of the payment process using eps, we will transmit your bank data and customer master data to STUZZA. All eps transactions are subject to the STUZZA data privacy declaration. These can be found at https://eservice.psa.at/de/datenschutzerklaerung.html.

The European financial institution Novalnet AG Zahlungsinstitut (ZAG), Feringastraße 4, 85774 Unterföhring (Novalnet) has been commissioned to process payments via eps. For the purpose of payment processing, Novalnet receives personal data from you (usually first name, last name, address, date of birth, gender, email address, IP address, telephone number, mobile phone number, payment information) as well as data about your order.

The legal basis for this data processing is Art. 6 para. 1 p. 1 lit. b GDPR. The processing is necessary for the performance of the contract.

 

Payment against invoice or by credit card

If you pay by invoice or credit card, your creditworthiness will be checked. To this end, we work together with Creditreform Boniversum GmbH, Hellersbergstraße 11, 41460 Neuss, from whom we receive the necessary negative data. Therefore, we will transmit your name and your contact information to Creditreform Boniversum GmbH. Information on data processing at Creditreform Boniversum GmbH pursuant to Article 14 of the GDPR can be found here: https://www.boniversum.de/EU-DSGVO.

The legal basis for the transmission and processing of your personal data by Creditreform Boniversum is Art. 6 para. 1 S. 1 lit. b GDPR.

The European financial institution Novalnet AG Zahlungsinstitut (ZAG), Feringastraße 4, 85774 Unterföhring (Novalnet) has been commissioned with the payment processing for payment against invoice or by credit card. For the purpose of payment processing, Novalnet receives personal data from you (usually first name, last name, address, date of birth, gender, email address, IP address, telephone number, mobile phone number, payment information) as well as data about your order.

The legal basis for the transmission and processing of your personal data by Novalnet is Art. 6 para. 1 S. 1 lit. b GDPR. The processing is necessary for the performance of the contract.

 

Inventory management

We use an inventory management system for contract processing. For this purpose, your personal data collected within the framework of the order processing will be passed on to

Mauve Mailorder Software GmbH & Co. KG
Laurentiusweg 83
45276 Essen.

The legal basis for the processing of data relates to our legitimate interest pursuant to Art. 6 para. 1 p. 1 lit. f GDPR. We have a legitimate interest in mapping, analysing and controlling the flow of goods and documenting the goods inventory.

If you contact us via the contact form, the data that you supply is processed in order to respond to your request. The legal basis for data processing is, depending on the content of your request, the necessity to fulfil contractual or pre-contractual obligations pursuant to Art. 6 (1) sentence 1 lit. b GDPR or our legitimate interest pursuant to Art. 6 (1) sentence 1 lit. f GDPR to process your request and reply to your message.

This personal data will be deleted six months after we have responded to your enquiry, unless there are statutory retention periods, in particular under commercial and tax law, or another legal basis.

 

Requesting teaching material

If you are an eligible person requesting educational material, you consent to us using the contact details you provide for the purpose of providing such material.

The legal basis for this processing of data is your consent pursuant to Art. 6 para. 1 p. 1 lit. a GDPR. You can revoke your consent with respect to the future at any time and without giving reasons (by email to datenschutzbeauftragter@lamy.de). The legality of the processing carried out on the basis of consent until revocation shall not be affected by the revocation.

After sending the requested teaching material, we will delete the data you provided in the request, unless and insofar as there are legal, in particular commercial and tax law retention periods to the contrary or another legal basis exists.

 

Newsletter registration

By entering your email address in the newsletter subscription field on the landing page and ticking the box to receive the newsletter, or by ticking the box to receive the newsletter when requesting educational material, you consent to us using your email address for this purpose. When you register to receive the newsletter, your IP address as well as the date and time of your request will be stored in addition to your email address, so that we can provide evidence in the event of any misuse of the email address.

The legal basis for this processing of data is your consent pursuant to Art. 6 para. 1 p. 1 lit. a GDPR. You can revoke your consent with respect to the future at any time and without giving reasons (by email to datenschutzbeauftragter@lamy.de or via the unsubscribe link provided in each email). The legality of the processing carried out on the basis of consent until revocation shall not be affected by the revocation.

After you have revoked your consent, we will delete the data provided by you in connection with the enquiry, unless and insofar as there are legal obligations, in particular relating to commercial and tax law retention periods or another legal basis.

 

Application

Should you submit your applicant data to us via the online forms provided or send us your applicant data by post or email, we will only process this data for the intended purpose and within the scope of the application procedure in accordance with statutory provisions. Generally, we collect the following information:

  • First name and surname
  • Contact details and
  • the documents pertaining to the application, such as cover letter, curriculum vitae and references.

Applicants may also send us additional information at their own discretion. If you use the online forms, the data is transmitted to us in an encrypted form in accordance with the technical state-of-the-art.

The personal data you provide will be processed for the purpose of deciding on the establishment of an employment relationship in accordance with Art. 88 para. 1 GDPR in conjunction with. § Section 26 (1) sentence 1 BDSG. The provision of your personal data is necessary for the execution of the application process and for the decision on the establishment of an employment relationship.

We will store this data for the period of the application process. Should your application not be successful or should you withdraw your application, your data will be deleted after six months, unless there is another legal basis for its retention.

Should your application be successful, we will save the data for your personnel file. This is required for the implementation of the employment relationship pursuant to Art. 88 para. 1 GDPR in conjunction with § 26 para. 1 sentence 1 BDSG.

You have the right

  • to request information about the personal data processed by us under Art. 15 of the GDPR. You may in particular request information on the purposes of the processing, the categories of personal data processed and the categories of recipients to whom your data has been or will be disclosed. The full extent of your right to information can be found in Art. 15. GDPR.
  • to demand the correction of inaccurate or incomplete personal data stored by us without delay in accordance with Art. 16 of the GDPR.
  • to request the deletion of your personal data stored by us in accordance with Art. 17 GDPR, unless the processing is necessary to exercise the right to freedom of expression and information, or to fulfil a legal obligation, or for reasons of public interest or to assert, exercise or defend legal claims.
  • in accordance with Art. 18 of the GDPR, to demand the restriction of processing of your personal data in cases where the accuracy of the data is disputed by you, or where the processing of data is unlawful but you object to its deletion, or where we no longer need the data but you require it to assert, exercise or defend legal claims, or where you have objected to processing in accordance with Art. 21 of the GDPR.
  • to receive your personal data that you have provided to us in a structured, current and machine-readable format or to request its transfer to another responsible person in accordance with Art. 20 GDPR.
  • to revoke your consent provided to us at any time pursuant to Art. 7 Para. 3 GDPR.  The legality of the processing carried out on the basis of consent until revocation shall not be affected by the revocation.
  • in accordance with Art. 21 GDPR, you may object to the processing of your personal data provided that your personal data is processed on the basis of legitimate interests in accordance with Art. 6 (1) p. 1 lit. f GDPR and insofar as there are grounds for the objection which arise from your particular situation or the objection is directed against direct advertising. In the latter case, you have a general right of objection, which we will implement without the need for you to specify a particular situation.
  • under Art. 77 of the GDPR, to complain to a supervisory authority. The responsible supervisory authority is:

 

The Federal State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragte für den Datenschutz und die Informationsfreiheit)

Königstraße 10a
70173 Stuttgart
Germany
Tel.: 0711 / 615541 – 0
Fax: 0711 / 615541 – 15
poststelle@lfdi.bwl.de
https://www.baden-wuerttemberg.datenschutz.de/.

Version: November 2021