Privacy Policy

1) Information on the collection of personal data and contact details of the controller

1.1 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Kurz & Lankow GbR Hochkönigstr. 2 83395 Freilassing Germany Phone: +49 8654 4069830 Email: [email protected] Partners: Mario Kurz, Philipp Lankow

The controller responsible for processing personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

1.3 For security reasons, and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the controller), this website uses SSL/TLS encryption. You can recognize an encrypted connection by the "https://" prefix and the lock icon in your browser's address bar.

2) Data collection when visiting our website

When you use our website for purely informational purposes, i.e. if you do not register or otherwise provide us with information, we only collect the data that your browser transmits to our server (so-called "server log files"). When you visit our website, we collect the following data, which is technically necessary for us to display the website to you:

• The website you visited
• Date and time of access
• Amount of data sent in bytes
• Source/referrer from which you accessed the page
• Browser used
• Operating system used
• IP address used (where applicable, in anonymized form)

This processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. Your data is not passed on or otherwise used. However, we reserve the right to retroactively check the server log files if there are concrete indications of unlawful use.

3) Cookies

To make your visit to our website more attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your device. Some of these cookies are automatically deleted after you close your browser (so-called "session cookies"), while others remain on your device for longer and enable page settings to be saved (so-called "persistent cookies"). In the latter case, you can find the storage period in the overview of your web browser's cookie settings.

If individual cookies we use also process personal data, this processing is carried out either pursuant to Art. 6(1)(b) GDPR for the performance of the contract, pursuant to Art. 6(1)(a) GDPR if consent has been given, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interest in the best possible functionality of the website and a customer-friendly and effective design of the visit to the site.

You can configure your browser to notify you when cookies are set and decide individually whether to accept them, or to exclude the acceptance of cookies for certain cases or generally.

Please note that if you do not accept cookies, the functionality of our website may be limited.

4) Contacting us

When you contact us (e.g. via contact form or email), personal data is processed solely for the purpose of handling and responding to your inquiry, and only to the extent necessary for that purpose. The legal basis for processing this data is our legitimate interest in responding to your inquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at entering into a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted once it can be determined from the circumstances that the matter in question has been conclusively resolved, provided no statutory retention obligations apply.

5) Data processing when opening a customer account

Pursuant to Art. 6(1)(b) GDPR, personal data continues to be collected and processed to the extent necessary when you provide it to us when opening a customer account. The data required to open an account can be found in the input fields of the relevant form on our website. You may delete your customer account at any time by sending a message to the controller's address listed above. After your customer account is deleted, your data will be erased, provided all contracts concluded through it have been fully settled, no statutory retention periods apply, and we no longer have a legitimate interest in continued storage.

6) Data processing for order fulfillment

6.1 To the extent necessary for contract fulfillment for delivery and payment purposes, the personal data we collect is passed on, pursuant to Art. 6(1)(b) GDPR, to the engaged shipping company and the engaged financial institution.

If we owe you updates for goods with digital elements or for digital products under a corresponding contract, we process the contact details you provided when ordering (name, address, email address) in order to personally inform you, within the scope of our statutory information obligations pursuant to Art. 6(1)(c) GDPR, of upcoming updates via a suitable means of communication (e.g. by post or email) within the legally prescribed period. Your contact details are used strictly for the purpose of notifying you about updates we owe you and are processed by us only to the extent necessary for that information.

To process your order, we also work with the following service providers, who fully or partially support us in performing concluded contracts. Certain personal data is transmitted to these service providers in accordance with the information below.

6.2 Use of payment service providers

• Mollie: If you choose a payment method offered by the payment service provider Mollie, payment processing is carried out via the payment service provider Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands, to which we disclose, pursuant to Art. 6(1)(b) GDPR, the information you provided during the ordering process together with information about your order (name, address, IBAN, BIC, invoice amount, currency, and transaction number). Your data is disclosed exclusively for the purpose of processing the payment with Mollie and only to the extent necessary for that purpose.
• Stripe: If you choose a payment method offered by the payment service provider Stripe, payment processing is carried out via the payment service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. For this purpose, we transmit the information you provided during the ordering process together with information about your order (name, address, email address, invoice amount, currency, and, where applicable, account details or credit card details and transaction number), pursuant to Art. 6(1)(b) GDPR, to Stripe. Your data is disclosed exclusively for the purpose of processing the payment with Stripe and only to the extent necessary for that purpose.

7) Tools and other services

sevDesk: For our bookkeeping, we use sevDesk, the cloud-based accounting software provided by sevDesk GmbH, Hauptstraße 115, 77652 Offenburg, Germany.

sevDesk processes incoming and outgoing invoices as well as, where applicable, our company's bank transactions in order to automatically capture invoices, match them to transactions, and generate financial accounting records through a partially automated process.

Insofar as personal data is also processed in this context, processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the efficient organization and documentation of our business operations.

Further information on sevDesk GmbH, the automated processing of data, and its privacy policy can be found at https://sevdesk.de/sicherheit-datenschutz/

8) Your rights as a data subject

8.1 Applicable data protection law grants you the following rights with respect to the controller regarding the processing of your personal data (rights to information and intervention), with the applicable legal basis governing the respective requirements for exercising each right:

• Right of access pursuant to Art. 15 GDPR
• Right to rectification pursuant to Art. 16 GDPR
• Right to erasure pursuant to Art. 17 GDPR
• Right to restriction of processing pursuant to Art. 18 GDPR
• Right to notification pursuant to Art. 19 GDPR
• Right to data portability pursuant to Art. 20 GDPR
• Right to withdraw consent given pursuant to Art. 7(3) GDPR
• Right to lodge a complaint pursuant to Art. 77 GDPR

8.2 Right to object

Where we process your personal data on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR, you have the right to object at any time, for reasons arising from your particular situation, to this processing with effect for the future.

After you exercise your right to object, we will stop processing the affected data unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

If your personal data is processed for direct marketing purposes, you have the right to object to the processing of your personal data for such purposes at any time. The right to object may be exercised as described above.

Upon receipt of your objection, we will immediately stop processing your personal data for direct marketing purposes.

9) Duration of storage of personal data

The duration for which personal data is stored is determined by the applicable legal basis, the purpose of processing, and, where relevant, the applicable statutory retention period (e.g. retention periods under commercial and tax law).

Where personal data is processed on the basis of explicit consent pursuant to Art. 6(1)(a) GDPR, this data is stored until the data subject withdraws their consent.

Where statutory retention periods exist for data processed in connection with contractual or quasi-contractual obligations on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted once the retention periods expire, provided it is no longer required for the performance or initiation of a contract and/or we no longer have a legitimate interest in its continued storage.

Where personal data is processed on the basis of Art. 6(1)(f) GDPR, this data is stored until the data subject exercises their right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that outweigh the interests, rights, and freedoms of the data subject, or the processing serves to assert, exercise, or defend legal claims.

Where personal data is processed for direct marketing purposes on the basis of Art. 6(1)(f) GDPR, this data is stored until the data subject exercises their right to object pursuant to Art. 21(2) GDPR.

Unless otherwise indicated elsewhere in this privacy policy with regard to specific processing situations, stored personal data will otherwise be deleted once it is no longer required for the purposes for which it was collected or otherwise processed.