Information on data protection for purchases on Amazon
1) Information on the collection of personal data and contact details of the person responsible
1.1 We are pleased that you are visiting our Amazon page (hereinafter referred to as "Website") and thank you for your interest. Below we inform you about how your personal data are handled when you use our website. Personal data in this context means all data by which you can be personally identified.
1.2 The data controller responsible for the processing of data within the meaning of the General Data Protection Regulation (GDPR) is Esbit Compagnie GmbH, Zippelhaus 3, 20457 Hamburg, Germany, Tel.: +49 40 85310650, Fax: +49 40 8509184, E-mail: esbit@esbit.de. The controller responsible for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.
1.3 The controller has appointed a data protection officer, who can be contacted as follows: "Dr. Gerald Esins, Zum Vogelsang 9, 23968, Barnekow, Tel: +49 3841281442, E-Mail: ds@esins.de"
2) Contacting us
When you contact us (e.g. via the contact form or by e-mail), personal data are collected. The data collected when using a contact form can be seen from the respective contact form. These data are stored and used exclusively for the purpose of responding to your enquiry or for contacting you and the associated technical administration. The legal basis for processing the data is our legitimate interest in responding to your enquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, Art. 6(1)(b) GDPR also constitutes an additional legal basis for processing. Your data will be deleted after your enquiry has been finally processed; this is the case when it can be inferred from the circumstances that the matter in question has been conclusively clarified, provided that no statutory retention obligations prevent such deletion.
3) Data processing for order fulfilment
3.1 To the extent necessary for the performance of the contract for delivery and payment purposes, the personal data collected by us will be disclosed to the commissioned transport company and the commissioned credit institution in accordance with Art. 6(1)(b) GDPR.
Where, on the basis of a corresponding contract, we owe you updates for goods with digital elements or for digital products, we process the contact data you provided when placing the order in order to inform you personally within the scope of our statutory information obligations pursuant to Art. 6(1)(c) GDPR. Your contact data are used strictly for the specific purpose of communicating updates owed by us and are processed by us for this purpose only to the extent necessary for the respective information.
For the fulfilment of your order, we also cooperate with the service provider(s) listed below who support us, in whole or in part, in the performance of concluded contracts. Certain personal data are transmitted to these service providers in accordance with the following information.
3.2 Service providers
- Amazon Fulfillment (FBA)
Order processing is handled by the service provider "Amazon" (Amazon EU S.à rl, 38 avenue John F. Kennedy, L-1855 Luxembourg) as part of "Fulfillment by Amazon." Your personal data will be shared with Amazon solely for the purpose of processing your online order. This transfer is based on Article 6 Paragraph 1 Letter b of the GDPR and is limited to what is necessary for order processing. Details regarding data protection at Amazon and Amazon's privacy policy can be found at the following link: amazon.de/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&nodeId=3312401 - JTL
We use the following provider for order processing: JTL-Software-GmbH, Rheinstr. 7, 41836 Hückelhoven, Germany
Your name, address, and any other personal data will be forwarded to the provider in accordance with Article 6 Paragraph 1 Letter b of the GDPR solely for the purpose of processing your online order. Your data will only be disclosed to the extent that this is actually necessary for the processing of the order.
4) Tools and other matters
- DATEV
For the purposes of accounting, we use the service of the cloud-based accounting software provided by the following provider: DATEV eG, Paumgartnerstr. 6-14, 90429 Nuremberg, Germany
The provider processes incoming and outgoing invoices as well as, where applicable, our company’s bank transactions in order to automatically record invoices, match them to the transactions, and generate financial accounting from this in a partially automated process.
To the extent that personal data are also processed in this context, such processing is carried out on the basis of our legitimate interest in an efficient organisation and documentation of our business transactions pursuant to Art. 6(1)(f) GDPR.
5) Rights of the data subject
5.1 The applicable data protection law grants you comprehensive data subject rights vis-à-vis the controller with regard to the processing of your personal data (rights of access and intervention), about which we inform you below:
- Right of access pursuant to Art. 15 GDPR;
- Right to rectification pursuant to Art. 16 GDPR;
- Right to erasure pursuant to Art. 17 GDPR;
- Right to restriction of processing pursuant to Art. 18 GDPR;
- Right to information pursuant to Art. 19 GDPR;
- Right to data portability pursuant to Art. 20 GDPR;
- Right to withdraw consent pursuant to Art. 7 para. 3 GDPR;
- Right to lodge a complaint pursuant to Art. 77 GDPR.
5.2 RIGHT TO OBJECT
IF, WITHIN THE SCOPE OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL
DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT
AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO OBJECT TO
THIS PROCESSING WITH EFFECT FOR THE FUTURE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA
CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED WHERE WE CAN
DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH
OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR WHERE THE PROCESSING
SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.
WHERE WE PROCESS YOUR PERSONAL DATA FOR THE PURPOSE OF DIRECT MARKETING,
YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA
CONCERNING YOU FOR SUCH MARKETING PURPOSES. YOU MAY EXERCISE THE OBJECTION
AS DESCRIBED ABOVE. IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE
PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES
6) Duration of the storage of personal data
The duration of the storage of personal data is determined by the respective legal basis, the purpose of the processing and—where applicable—additionally by the respective statutory retention period (e.g. retention periods under commercial and tax law).
Where personal data are processed on the basis of an explicit consent pursuant to Art. 6(1)(a) GDPR, the data concerned will be stored until you withdraw your consent.
Where statutory retention obligations exist for data that are processed in the context of contractual or quasi-contractual obligations on the basis of Art. 6(1)(b) GDPR, such data will be routinely deleted after expiry of the retention periods, unless they are still required for the performance of the contract or for initiating a contract and/or there is no longer any legitimate interest on our part in continued storage.
Where personal data are processed on the basis of Art. 6(1)(f) GDPR, such data will be stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Where personal data are processed for the purposes of direct marketing on the basis of Art. 6(1)(f) GDPR, such data will be stored until you exercise your right to object pursuant to Art. 21(2) GDPR.
Unless otherwise stated in the other information of this privacy policy concerning specific processing situations, stored personal data will otherwise be deleted when they are no longer necessary for the purposes for which they were collected or otherwise processed.
7) Reference to Amazon’s Privacy Policy
For all further data processing operations that go beyond the data processing described above, the Amazon platform is the controller. Further information on Amazon’s data protection practices can be found in Amazon’s privacy notices: amazon.de/gp/help/customer/display.html?ie=UTF8&nodeId=201
909010&ref_=footer_privacy
