data protection
Data protection
I am delighted that you are interested in our online shop. The protection of your privacy and the handling of your personal data is very important to us. We will therefore inform you in detail below about how we handle your data.
1. Person responsible for data processing
The person responsible for data processing within the online shop within the meaning of the GDPR is:
NuNi UG (limited liability)
Walburgastrasse 9
59555 Lippstadt
Germany
Mail: info@nuni-shop.de
Commercial register number: HRB16436
VAT identification number(s): DE360580875
2. Usage data
2.1 Usage data
Every time the website is accessed, the web server automatically saves a so-called server log file (consisting of usage data). This data set consists of:
-
the name of the requested file,
-
your IP address,
-
Date and time of retrieval,
-
amount of data transferred
-
the requesting provider.
The purpose of storing the above-mentioned usage data is to ensure trouble-free operation of the website and to improve our offering. This serves to protect our legitimate interests in a correct presentation of our offering, which prevail within the framework of a balancing of interests, in accordance with Art. 6 Para. 1 Clause 1 Letter f of GDPR.
The data set mentioned above will be processed for as long as it is necessary for the purposes stated.
2.2 Storage of the IP address
We also store the full IP address transmitted by your web browser for a strictly dedicated purpose in the interest of being able to detect, limit and eliminate attacks on our websites. After this period has elapsed, we delete or anonymize the IP address. The legal basis is our legitimate interest in the secure operation of our website in accordance with Art. 6 Paragraph 1 Clause 1 Letter f of GDPR.
Hosting
We pass on your data to our hosting service provider as part of order processing in accordance with Art. 28 GDPR. Our service provider is strictly bound to our instructions and is contractually obliged accordingly.
Unless otherwise stated in this privacy policy, all usage data and all data collected in forms provided for this purpose on this website are processed on the servers of our hosting service provider.
3. Data processing for contract processing and contact
3.1 Data processing for contract execution
As part of the ordering process, we process the personal data you provide in accordance with Art. 6 (1) (b) GDPR to process your orders. This concerns the following data records:
-
First and Last Name
-
Email address
-
delivery address
We use your email address to send you your order confirmation and invoice and to inform you about the status of your order.
After the contract has been fully processed, your data will be restricted for further processing and deleted after the expiry of the tax and commercial retention periods in accordance with Art. 6 Paragraph 1 Clause 1 Letter c of GDPR, unless you have expressly consented to further use of your data in accordance with Art. 6 Paragraph 1 Clause 1 Letter a of GDPR or there is a legally permitted further use of the data on our part.
3.2 Contact
You have the option of contacting us via our contact form or by email. For this we require the data marked as mandatory fields from you. We use this data on the basis of Art. 6 Para. 1 Clause 1 Letter f of GDPR to answer your query.
You can also decide for yourself whether you want to provide us with further information. This information is provided voluntarily and is not absolutely necessary for contacting you. We process your voluntary information based on your consent.
Your data will only be processed to answer your request. We will delete your data if it is no longer required and there are no legal retention periods to the contrary.
If your data transmitted via the contact form is processed on the basis of Art. 6 Paragraph 1 Clause 1 Letter f of GDPR, you can object to the processing at any time. In addition, you can revoke your consent to the processing of the voluntary information at any time. To do so, please contact the email address provided in the imprint.
3.3 Data processing for the purpose of shipping
For shipping processing as part of the contract fulfillment, we pass on your delivery address to the shipping service provider commissioned with the delivery. This is done so that we can send you the ordered goods in accordance with Art. 6 Paragraph 1 Clause 1 Letter b of GDPR.
4. Data processing for payment processing
We work with these partners to process payments in our online shop:
-
technical service providers,
-
Credit institutions,
-
Payment service providers.
4.1 Data processing for transaction processing
For the purpose of payment processing, we use the services of payment service providers
-
PayPal (Europe) S.à rl et Cie, SCA, 22-24 Boulevard Royal, L-2449 Luxembourg [ Link ]
-
Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden [ Link ]
-
Apple Pay , Apple Inc., One Apple Park Way, Cupertino, CA 95014 [ Link ]
The respective payment service provider acts as its own controller within the meaning of the GDPR within the scope of the payment process. You can find further information on data protection in the data protection information provided behind the service providers.
If you use Paypal, Apple Pay or Klarna, you will be redirected directly to the payment service provider you have selected at the end of the order process. The service provider only processes the data relevant to the invoice. This includes your master data, such as your name and address, your bank details (such as account numbers or credit card numbers) and also information about your order, i.e. the invoice amount. We do not process the data mentioned above. We only receive information about whether the payment was successful or not. Under certain circumstances, the data may also be transmitted by the selected service provider to credit agencies for the purpose of identity and credit checks.
The data processing serves to fulfill the contract in accordance with Art. 6 (1) lit. b GDPR.
Please note that Paypal may transfer data to a country that does not offer an adequate level of data protection. If the data is transferred to the USA, there is a risk that your data may be processed by US authorities for control and monitoring purposes, without you possibly having any legal recourse.
4.2 Data processing for the purpose of fraud prevention and optimising our payment processes
If necessary, we will provide our service providers with additional data, which they will use together with the data necessary for processing the payment as our processors for the purpose of fraud prevention and optimizing our payment processes (e.g. invoicing, processing disputed payments, accounting support). In accordance with Art. 6 (1) sentence 1 lit. f GDPR, this serves to protect our legitimate interests in protecting ourselves against fraud and in efficient payment management, which prevail within the framework of a balancing of interests.
5. Cookies and other technologies
In order to make visiting our website more attractive and to enable the use of certain functions, we use technologies on various pages, including so-called cookies. Cookies are small text files that are automatically saved on your device. Some of the cookies we use are deleted at the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your device and enable us to recognize your browser the next time you visit (persistent cookies).
Any downstream data processing through cookies and other technologies
We use technologies that are absolutely necessary for the use of certain functions of our website (e.g. shopping cart function). These technologies collect and process IP address, time of visit, device and browser information as well as information about your use of our website (e.g. information about the contents of the shopping cart). In the context of a balancing of interests, this serves the overriding legitimate interest in an optimized presentation of our offer in accordance with Art. 6 Para. 1 Clause 1 Letter f of GDPR.
List of cookies used:
Cookie : SSR caching
Purpose : Used to indicate the system that rendered the website.
Duration : 1 minute
Cookie : XSRF-TOKEN
Purpose : Used for security reasons.
Duration : Session
Cookie : hs
Purpose : Used for security reasons.
Duration : Session
Cookie : sVSession
Purpose : Used in connection with newsletter registration.
Duration : 12 months
Cookie : bSession
Purpose : Used to measure system effectiveness.
Duration : 30 minutes
Cookie : Fedops.logger.defaultOverrides
Purpose : Used to measure system effectiveness.
Duration : 12 months
Cookie : Fedops.logger.sessionId
Purpose : Used to measure system effectiveness.
Duration : 12 months
You can set your browser so that it informs you about the placement of cookies. This makes the use of cookies transparent for you. You can also delete cookies at any time using the corresponding browser settings and prevent new cookies from being placed. Please note that our websites may then not be displayed and some functions may no longer be technically available. You can find the cookie settings for your browser under the following links: Microsoft Edge™ / Safari™ / Chrome™ / Firefox™ / Opera™
5.1 Use of Google services for web analysis and advertising purposes
We use the technologies presented below from Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The information automatically collected by Google technologies about your use of our website is usually transferred to a server of Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA and stored there. There is no adequacy decision from the European Commission for the USA. Our cooperation with them is based on standard data protection clauses of the European Commission.
If your IP address is collected via Google technologies, it will be shortened before being stored on Google's servers by activating IP anonymization. Only in exceptional cases will the full IP address be transmitted to a Google server and shortened there. Unless otherwise stated for the individual technologies, data processing is carried out on the basis of an agreement concluded for the respective technology between joint controllers in accordance with Art. 26 GDPR. Further information on data processing by Google can be found in Google's privacy policy.
Google Analytics
For the purpose of website analysis, Google Analytics automatically collects and stores data (IP address, time of visit, device and browser information, and information about your use of our website), from which user profiles are created using pseudonyms. Cookies may be used for this purpose. Your IP address is generally not merged with other data held by Google. The data processing is carried out on the basis of an agreement on order processing by Google.
For the purpose of optimizing the marketing of our website, we have activated the data sharing settings for "Google products and services". This allows Google to access the data collected and processed by Google Analytics and then use it to improve Google services. The data sharing with Google as part of these data sharing settings is based on an additional agreement between the responsible parties. We have no influence on the subsequent data processing by Google.
For the purpose of optimizing the marketing of our website, we use the so-called user ID function. Using this function, we can assign a unique, permanent ID to your interaction data from one or more sessions on our online presence and thus analyze your user behavior across devices and sessions.
For web analysis, the Google Analytics Google Signals extension function enables so-called "cross-device tracking". If your internet-enabled devices are linked to your Google account and you have activated the "personalized advertising" setting in your Google account, Google can create reports on your usage behavior (in particular the number of users across devices), even if you change your device. We do not process any personal data in this respect; we only receive statistics created on the basis of Google Signals.
For web analysis and advertising purposes, the extension function of Google Analytics, the so-called DoubleClick cookie, enables recognition of your browser when you visit other websites. Google will use this information to compile reports on website activity and to provide other services related to website usage.
6. Social Media - Our online presence on Facebook (by Meta), Instagram (by Meta)
In addition to us, the respective operator of the social media platform is also responsible for processing your personal data. To the extent that we can influence this and parameterize the data processing, we will work to ensure that the operator of the social media platform handles data in accordance with data protection regulations within the scope of the options available to us. In this context, please also note the data protection declarations of the respective social media platform, which we have linked below.
6.1 Creation of user profiles and posts
When you visit our online presence on the social media platforms mentioned above, your data is automatically collected and stored for market research and advertising purposes. From this, the provider of the respective social media platform creates user profiles using pseudonyms. These can be used, for example, to place advertisements within and outside the platforms that presumably correspond to your interests. Cookies are usually used for this purpose. You can find detailed information on the processing and use of data by the respective social media operator as well as a contact option and your related rights and setting options to protect your privacy in the providers' data protection notices linked below. We therefore have no influence on the processing of your data by the provider of the social media platform, so the use of the social media platform is at your own risk.
The posts you publish on our social media pages are published by the social media platform and are never processed by us for any other purposes. We only reserve the right to delete content if this should be necessary. If necessary, we will share your posts on our page if this is a function of the social media platform and communicate with you via the social media platform.
The legal basis for the processing of your data is Art. 6 Paragraph 1 Clause 1 Letter f of GDPR. The data processing is carried out in the legitimate interest of conducting public relations work for our company and being able to communicate with you.
6.2 Statistics
Some social media platforms create statistics based on usage data that contain information about your interaction with our social media page. We cannot influence or prevent the implementation and provision of these statistics. However, we do not use optional statistics from the social media platform.
We process this information in accordance with Art. 6 (1) sentence 1 lit. f GDPR in the legitimate interest of validating the use of our social media pages and improving our content in a target group-oriented manner.
6.3 Advertising and remarketing
We occasionally also use the social media platforms described to display targeted advertising.
For this purpose, we use target group definitions that are made available to us by the social media provider. We only use anonymous target group definitions - i.e. we define characteristics based on general demographic information, behavior, interests and connections, for example. The operator of the social media platform uses these to display advertisements to its users accordingly.
The legal basis for this is the consent that the operator of the social media platform has obtained from its users. If you would like to withdraw this consent, please use the withdrawal options provided by the provider of the social media platform, as the social media platform operator is responsible for this processing. Occasionally we or the provider of the social media platform also use publicly available data to define target groups. The legal basis for this processing is then Art. 6 Paragraph 1 Letter f of GDPR. Our legitimate interest here is to define the target group as appropriate as possible. We never use sensitive categories of personal data named in Art. 9 and 10 of the GDPR to define target groups.
If you would like to object to a specific data processing over which we have influence, please contact the contact details provided in the imprint.
6.4 Contractual basis and contact options
Further information on data processing by the provider of the social media platform, configuration options to protect your privacy as well as other objection options and, if available and concluded, the agreement according to Art. 26 GDPR can be found in the provider's privacy policy:
Facebook (by Meta) is an offering from Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland ("Meta Platforms Ireland"). The information automatically collected by Meta Platforms Ireland about your use of our online presence on Facebook (by Meta) is usually transferred to a server of Meta Platforms, Inc., 1 Hacker Way, Menlo Park, California 94025, USA and stored there.
There is no adequacy decision from the European Commission for the USA. Our cooperation with them is based on standard data protection clauses of the European Commission. There is a risk that authorities will access the data for security and surveillance purposes without you being informed or being able to lodge a legal appeal. The transfer to an unsafe third country is based on your consent given to the social media platform in accordance with Art. 49 Para. 1 lit. a GDPR.
Data processing when visiting a Facebook (by Meta) fan page is carried out on the basis of an agreement between joint controllers in accordance with Art. 26 GDPR. Further information (information on Insights data) can be found here .
Instagram (by Meta) is an offering of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland (“Meta Platforms Ireland”). The information automatically collected by Meta Platforms Ireland about your use of our online presence on Instagram is usually transferred to a server of Meta Platforms, Inc., 1 Hacker Way, Menlo Park, California 94025, USA and stored there.
There is no adequacy decision from the European Commission for the USA. Our cooperation with them is based on standard data protection clauses of the European Commission. There is a risk that authorities will access the data for security and surveillance purposes without you being informed or being able to lodge a legal appeal. The transfer to an unsafe third country is based on your consent given to the social media platform in accordance with Art. 49 Para. 1 lit. a GDPR.
Data processing when visiting an Instagram (by Meta) fan page is carried out on the basis of an agreement between joint controllers in accordance with Art. 26 GDPR. Further information (information on insights data) can be found here .
7. Contact options and your rights
7.1 Your rights
When processing your personal data, the GDPR grants you as the data subject certain rights:
Right to information (Art. 15 GDPR)
You have the right to request confirmation as to whether or not personal data concerning you are being processed; if this is the case, you have the right to access this personal data and to the information detailed in Art. 15 GDPR.
Right to rectification (Art. 16 GDPR)
You have the right to request the immediate rectification of inaccurate personal data concerning you and, if necessary, the completion of incomplete data.
Right to erasure (Art. 17 GDPR)
You have the right to request that personal data concerning you be deleted immediately if one of the reasons listed in detail in Art. 17 GDPR applies.
Right to restriction of processing (Art. 18 GDPR)
You have the right to request the restriction of processing if one of the conditions listed in Art. 18 GDPR is met, e.g. if you have objected to processing, for the duration of the review by the controller.
Right to data portability (Art. 20 GDPR)
In certain cases, which are listed in detail in Art. 20 GDPR, you have the right to receive the personal data concerning you in a structured, common and machine-readable format or to request that this data be transmitted to a third party.
Right of withdrawal (Art. 7 GDPR)
If the processing of data is based on your consent, you are entitled to revoke your consent to the use of your personal data at any time in accordance with Art. 7 Para. 3 GDPR. Please note that the revocation only takes effect for the future. Processing that took place before the revocation is not affected.
Right to object
If we process personal data as described above to protect our legitimate interests, which prevail in the context of a balancing of interests, you can object to this processing with effect for the future. If the processing is carried out for direct marketing purposes, you can exercise this right at any time as described above. If the processing is carried out for other purposes, you only have the right to object if there are reasons that arise from your particular situation.
After exercising your right of objection, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which outweigh your interests, rights and freedoms, or if the processing serves to assert, exercise or defend legal claims.
This does not apply if the processing is carried out for direct marketing purposes. In this case, we will no longer process your personal data for this purpose.
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
According to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of data concerning you violates data protection regulations. The right to lodge a complaint can be asserted in particular with a supervisory authority in the member state of your habitual residence, your place of work or the place of the alleged violation.
7.2 Contact options
If you have any questions about the collection, processing or use of your personal data, information, correction, restriction or deletion of data, as well as revocation of consent granted or objection to a specific use of data, please contact us directly using the contact details in our legal notice.
