Privacy policy

Privacy Policy

We, Primal State Performance GmbH, operate the websites https://www.primal-state.de and https://glow25.de and collect certain data from you where this is necessary. In the following Privacy Policy you will learn what we do with your data (so-called personal data) and why we do this. We also explain how we protect your data, when data is deleted, and what rights you have under data protection law.

Who can I contact?

The data controller for this website is:

Primal State Performance GmbH
Pappelallee 78/79
10437 Berlin, Germany
datenschutz@primal-state.de

Data Protection Officer:

Fresh Compliance GmbH
Gina Bleckmann
Schönhauser Allee 43a
10435 Berlin, Germany

You can reach our Data Protection Officer or any other data protection contact using these details. Please contact us at any time if you have specific questions about your data, its deletion, or your rights.

What are my rights?

You can contact us at any time if you have questions about your data protection rights or wish to exercise the following rights:

  • Right to withdraw consent (e.g. you can contact us if you wish to withdraw a previously given consent to a newsletter) — under UK GDPR Art. 7(3) / EU GDPR Art. 7(3)
  • Right of access (e.g. you can contact us if you want to know what data we hold about you) — under UK GDPR Art. 15 / EU GDPR Art. 15
  • Right to rectification (e.g. you can contact us if your email address has changed and we should replace the old one) — under UK GDPR Art. 16 / EU GDPR Art. 16
  • Right to erasure (e.g. you can contact us if we should delete certain data we hold about you) — under UK GDPR Art. 17 / EU GDPR Art. 17
  • Right to restriction of processing (e.g. you can contact us if you want us to retain but not use your email address except for essential communications) — under UK GDPR Art. 18 / EU GDPR Art. 18
  • Right to data portability (e.g. you can contact us to receive your stored data in a portable format) — under UK GDPR Art. 20 / EU GDPR Art. 20
  • Right to object (e.g. you can contact us if you object to any of the advertising or analytics methods described here) — under UK GDPR Art. 21 / EU GDPR Art. 21
  • Right to lodge a complaint with the competent supervisory authority:
    • For UK customers: The Information Commissioner's Office (ICO), https://ico.org.uk
    • For EU customers: The data protection supervisory authority in your country of residence, e.g. https://www.bfdi.bund.de (Germany)

Deletion of data and retention periods

Unless otherwise stated, we delete your data as soon as it is no longer needed — for example, data from a contact request once your enquiry has been fully dealt with and there are no statutory retention obligations preventing deletion. Your data will also be blocked or deleted when a retention period expires. Certain data may need to be retained for longer for legal reasons. You can of course request information about the stored data at any time. Data protection requests and other legal matters may also be stored for longer periods within the applicable statutory retention and limitation periods.

Visiting the website

If you simply browse our website, we do not collect personal data, with the exception of data your browser transmits in order to enable the visit, in particular:

  • IP address (e.g. 81.91.215.example or 2a02:8109:9440:1198:bdb1:551f:example)
  • Approximate location based on IP range (e.g. Berlin)
  • Internet provider (e.g. Vodafone or Deutsche Telekom)
  • Internet speed (e.g. 120 Mbit)
  • Date and time (e.g. 11:55 on 25/05/2023)
  • Last visited website (e.g. google.co.uk)
  • Browser (e.g. Chrome or Safari)
  • Operating system (e.g. Mac OS)
  • Hardware (e.g. Intel processor)

As a privacy protection measure, we delete or anonymise the IP address after your visit to our website. As a result, the other technical data can no longer be attributed to you and are used solely for anonymous, statistical purposes to optimise our website. The website visit takes place via an encrypted connection, which you can recognise by the address bar switching from "http://" to "https://" and by the padlock symbol in your browser bar. When SSL/TLS encryption is active, data you transmit to us cannot be read by third parties. The purpose of the temporary storage of data is, on the one hand, the technical necessity for establishing the connection and, on the other, the correct, error-free display of our website. The legal basis is the mutual performance of a contract or the implementation of pre-contractual measures in accordance with UK GDPR Art. 6(1)(b) / EU GDPR Art. 6(1)(b), where you visit the website to obtain information about or use our products and services. Beyond this, the legitimate interest basis, assessed under UK GDPR Art. 6(1)(f) / EU GDPR Art. 6(1)(f), applies in conjunction with the aforementioned protective measures.

Contacting us

You have the option of contacting us via our contact form or by other means. You may provide us with the following data:

  • First name / last name
  • Email address
  • Order number (if applicable)
  • Message or enquiry

As a protective measure, contact — just like the rest of the website — takes place via an encrypted connection. You can also choose other means of contact. Data is stored only for as long as is necessary to achieve the purpose. The purpose of the data collected is solely to establish contact and communicate with you, and the data is used only for this purpose. The legal basis is legitimate interest, assessed in pursuit of the stated purpose and within the aforementioned protective measures, in accordance with UK GDPR Art. 6(1)(f) / EU GDPR Art. 6(1)(f).

Online orders

You can place orders on our website without prior registration and without creating a password-based customer account. During checkout, our webshop provider "Shopify International Ltd." (Shopify) creates a customer profile or internal customer record that is required for order processing and administration. This profile is linked to the email address provided at checkout. You do not need to create a password, as a customer account with login functionality is not automatically created. Access to the customer account is only possible if you actively log in or use the account function.

If you use the login function, Shopify checks whether a record already exists for the email address provided. If so, a one-time access code ("passcode") is sent to the stored email address. If no such record exists, a customer account is created as part of this process. Authentication is exclusively passwordless via one-time codes; permanent passwords are not assigned.

For the creation of a customer account, you may voluntarily add further details to your profile, in particular your address, telephone number, and payment methods for subscriptions. The only mandatory fields when providing an address are street and house number and postcode. At the latest when placing an order, however, first name, last name, and the complete billing and/or delivery address must be provided.

There is also the option of using the "Shop" service from Shopify. This is a separate Shopify function through which customers can centrally manage and view orders from various Shopify stores. Use of this service is the sole responsibility of the customer and Shopify.

Electronic withdrawal and cancellation function

If you use the electronic withdrawal or cancellation function provided on our website, we process the data you provide (e.g. name, email address, order number, contract data, and details of the withdrawal or cancellation) in order to receive your declaration, process it, and confirm receipt as required by law.

The processing is carried out to implement pre-contractual measures and to perform a contract pursuant to UK GDPR Art. 6(1)(b) / EU GDPR Art. 6(1)(b), and to fulfil legal obligations pursuant to UK GDPR Art. 6(1)(c) / EU GDPR Art. 6(1)(c).

Data is stored for the duration of the statutory retention and limitation periods and then deleted.

Use of shipping service providers

Where necessary for the delivery of your order, we pass your data to a shipping company. Depending on your choice of payment method, we pass the required payment data to the relevant credit institution or payment service provider. In some cases you can create an account with the payment service provider or log in with an existing account. In the aforementioned cases, the privacy policies of the respective service providers apply.

In particular, we use the following service providers:

  • Deutsche Post AG, Germany – Deutsche Post handles some of our deliveries. Further information is available in Deutsche Post's privacy information.
  • HIVE Technologies GmbH, Germany – We also use HIVE Technologies GmbH for the dispatch of our products. Further information can be found in HIVE's privacy policy.
  • Future Fulfilment B.V., Netherlands – We also use Future Fulfilment B.V. for the dispatch of our products. Further information can be found in Future Fulfilment's privacy policy.
  • MH DIREKT e-commerce + fulfillment GmbH & Co. KG, Austria – We also use MH DIREKT for the dispatch of our products. Further information can be found in MH DIREKT's privacy policy.

As a protective measure, the transmission of data you enter — just like the rest of the website — takes place via an encrypted connection. We also apply the principle of data minimisation and only collect data that is actually necessary. Your data is stored for as long as is necessary for order processing, or until you request deletion. Data relevant to invoicing is, however, subject to statutory retention periods and may be retained for up to ten years. The purpose of the data collected is order processing, in order to provide you with the product you have requested. The legal basis is the mutual performance of a contract in accordance with UK GDPR Art. 6(1)(b) / EU GDPR Art. 6(1)(b).

Use of payment service providers

You have the option of choosing between various payment service providers. The following data is required as a minimum:

  • Name
  • Payment data

For the payment process we use the following payment service providers:

  • Recharge Payments, Inc., headquartered in Santa Monica, California, USA
  • PayPal (Europe) S.à r.l. et Cie, S.C.A., headquartered in Luxembourg, and/or PayPal Inc., headquartered in San Jose, California, USA
  • Apple Pay, provided by Apple Inc., headquartered in Cupertino, California, USA
  • Abrantix, provided by Abrantix AG, Switzerland

As a protective measure, the transmission of data you enter takes place via an encrypted connection. The purpose of the data collected is to process payment in order to provide you with the product you have requested. The legal basis is the mutual performance of a contract in accordance with UK GDPR Art. 6(1)(b) / EU GDPR Art. 6(1)(b).

Newsletter

If you are interested in news about our company or our products, you can sign up for our newsletter. For this purpose, you provide your email address, to which we will send the newsletter in future. We store your email address until you unsubscribe from the newsletter. Every newsletter email contains a corresponding unsubscribe link for this purpose. The newsletter is delivered by a specialist service provider.

As a protective measure, we have concluded a data processing agreement (data processing contract) with the commissioned service provider. You can also unsubscribe from the newsletter at any time. The purpose of the data collection is to deliver the newsletter to your personal email address, to fulfil your desire for news about our company or our products. The legal basis is your consent in accordance with UK GDPR Art. 6(1)(a) / EU GDPR Art. 6(1)(a).

Newsletter tracking

Our newsletters contain so-called tracking pixels. A tracking pixel is a miniature graphic embedded in emails sent in HTML format, in order to enable log file recording and log file analysis. This allows a statistical evaluation of the success or failure of online marketing campaigns. Using the embedded tracking pixel, we can recognise whether and when an email was opened by the recipient, and which links in the email were accessed. Such personal data collected via tracking pixels in newsletters is stored and analysed by us to optimise newsletter delivery and to tailor the content of future newsletters even better to your interests. This personal data will not be passed on to third parties. You are entitled to withdraw your consent at any time. Following withdrawal, this personal data will be deleted by us. An unsubscribe from the newsletter is automatically interpreted by us as a withdrawal.

Email advertising without newsletter registration and your right to object

If we receive your email address in connection with the sale of a product or service and you have not objected, we reserve the right to send you regular offers by email for similar products from our range as part of our existing customer communications. You can object to this use of your email address at any time by sending a message using the contact details set out below or via a link provided for this purpose in the advertising email, without any costs other than transmission costs at the basic rate being incurred.

The newsletter is sent as part of processing on our behalf by Infusion Software, Inc. (www.infusionsoft.com), to which we pass your email address for this purpose. Infusion Software, Inc. is based in the USA. To ensure compliance with European data protection standards even for any transfer of data from the EU or EEA to the USA and possible further processing there, Infusion Software, Inc. relies on the European Commission's Standard Contractual Clauses, which we have contractually agreed with Infusion Software, Inc. Further information can be found in the service provider's privacy policy.

Postal advertising and your right to object

We also reserve the right to use your first and last name and postal address for our own advertising purposes, e.g. to send you interesting offers and information about our products by post. This serves to protect our legitimate interests, which outweigh those of our customers after a balancing of interests, in advertising to our customers pursuant to UK GDPR Art. 6(1)(f) / EU GDPR Art. 6(1)(f). You have the right to object to this data processing.

Integration of the Trusted Shops Trustbadge

To display our Trusted Shops quality seal and the reviews collected, and to offer Trusted Shops products to buyers after an order, the Trusted Shops Trustbadge is integrated on this website.

This serves to protect our legitimate interests, which outweigh those after a balancing of interests, in the optimal marketing of our offering pursuant to UK GDPR Art. 6(1)(f) / EU GDPR Art. 6(1)(f). The Trustbadge and the services advertised through it are an offering of Trusted Shops GmbH, Subbelrather Str. 15C, 50823 Cologne, Germany. When the Trustbadge is called up, the web server automatically stores a so-called server log file, which contains, for example, your IP address, the date and time of the request, the volume of data transferred, and the requesting provider (access data), and documents the request. This access data is not evaluated and is automatically overwritten no later than seven days after the end of your page visit.

In the processing of your personal data described above, Trusted Shops GmbH and we act as "joint controllers" pursuant to UK GDPR Art. 26 / EU GDPR Art. 26. We hereby inform you of the handling of personal data within the framework of joint controllership pursuant to UK GDPR Art. 13 / EU GDPR Art. 13. Further information can be found in Trusted Shops' privacy policy.

You can assert your rights under UK GDPR Art. 15 et seq. / EU GDPR Art. 15 et seq. in particular against Trusted Shops GmbH, for example at the following email address: privacy@trustedshops.com. Your requests can also be directed to us at datenschutz@primal-state.de.

Further personal data is only transferred to Trusted Shops if you have consented pursuant to UK GDPR Art. 6(1)(a) / EU GDPR Art. 6(1)(a), if you decide after completing an order to use Trusted Shops products, or if you have already registered to use them. In this case, the contractual agreement made between you and Trusted Shops applies.

Sending of review reminder emails

If you have given us your express consent during or after your order pursuant to UK GDPR Art. 6(1)(a) / EU GDPR Art. 6(1)(a), we will transmit your email address to Trusted Shops GmbH, Subbelrather Str. 15c, 50823 Cologne, Germany, so that they can send you a review reminder by email. This consent can be withdrawn at any time by a message using the contact details described above or directly to Trusted Shops.

Customer satisfaction surveys

If you wish to participate in a customer satisfaction survey after a purchase or a service rendered, we will send you an email with a link to the survey. In the survey, we collect — depending on its design — in particular your rating (e.g. stars/scales), free-text feedback, and any details about your user experience. If we assign the survey to a person (e.g. via an individual survey link or internal reference numbers), we also process the attribution data required for this (e.g. email address, customer/transaction number). We store the survey data only for as long as is necessary for evaluation and internal improvement of our services; thereafter the data is deleted or anonymised. The conduct and technical provision of the survey may be carried out by a specialist service provider.

When we integrate the link to the survey in emails, for transparency reasons we already briefly point out the data processing in connection with the survey in the email itself. We also provide a brief privacy notice at the beginning of the survey. Where an external service provider is used (generally TYPEFORM, S.L., based in Spain), a data processing contract has been concluded with them (UK GDPR Art. 28 / EU GDPR Art. 28). The purpose of the processing is to measure and improve customer satisfaction and to optimise our products and services.

The legal basis is your consent in accordance with UK GDPR Art. 6(1)(a) / EU GDPR Art. 6(1)(a), or processing in the context of existing customer communications . You can object to contact for customer satisfaction surveys at any time with effect for the future, or withdraw a given consent at any time. The relevant email contains a corresponding notice or a simple opt-out option.

Social media presence

We use various social media services to present ourselves and our products. We process your personal data when you communicate with us via these channels. In particular, we process contact data (e.g. profiles, email addresses or telephone numbers, where you provide them) and content data (e.g. comments, tags and links).

  • Facebook, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin, Ireland ("Meta"). Facebook is a social media platform that enables users to connect with other people or companies, share content, join groups, and communicate by text, video or voice call. Data is processed within the European Union. For further information, see Facebook's Privacy Policy.
  • Instagram, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Instagram is a social media platform that allows users to share and explore photos, videos and stories, and interact with others through likes, comments and direct messages. Data is processed within the European Union. For further information, see Instagram's Privacy Policy.

When you visit our Facebook or Instagram page, your IP address is transmitted to Meta. According to Meta, where this is a UK or German IP address, it is anonymised and deleted after 90 days. Meta also processes further information about your device, such as the browser used, and may in some circumstances link this to your user account.

If you are logged into your Facebook or Instagram account during the visit, Meta can use cookies to track that you have visited our page and how you have used it, in order to show you personalised content or advertising.

If you do not want this, you should log out of your respective account, deactivate the "stay logged in" function, delete cookies, and restart your browser. Please note that if you log in again to use interactive features, attribution to your profile will again be possible.

As joint controllers pursuant to UK GDPR Art. 26 / EU GDPR Art. 26 of these pages, we have concluded agreements with most platform operators, which stipulate that they assume the main data protection obligations for information, fulfilment of data subjects' rights, data security, and notification and information in the event of data breaches. As providers of the social media platforms, they have immediate access to the necessary information and can also immediately take necessary measures and provide information. We receive only anonymised user statistics.

You can assert your rights as a data subject against either of the joint controllers. If you contact us, we will instruct the platform providers accordingly. For further information, see the privacy policies and information provided by the operators of the respective networks.

Data collected about you in this context is processed by Meta and may in some cases be transferred to countries outside the European Union.

Meta also provides Primal State as page operator with a number of statistical data via the "Insights" function. These statistics are generated and provided by Meta. As the operator of the page, we have no influence on their generation and cannot prevent this function. Through the "Insights" function, we are shown information for the categories "fans", "subscribers", "people reached" and "people interacting" for a selectable period, including: page activities such as page views, page previews, actions on the page; reach activities such as likes, people reached and recommendations; post activities such as post interactions, video views, comments, shared content.

In addition, statistical information about the Facebook groups linked to our page is provided to us. In accordance with Facebook's terms of use, to which every user agrees when creating a Facebook profile, we can also identify the page's subscribers and fans and view their profiles and other information they have shared.

As a protective measure, data you enter is transmitted via the respective platform's encrypted connection. We do not use the login to access or store personal data such as friend lists or contacts for our own purposes. We are not aware of which data the social networks collect as part of the login or how data is linked. For further details, see the privacy policies of Facebook and Meta. The purpose of the data collected is registration via an existing user account to use enhanced functions on the website. Registration via social networks is voluntary and can be revoked at any time or the user account can be logged out. The legal basis is your consent in accordance with UK GDPR Art. 6(1)(a) / EU GDPR Art. 6(1)(a).

Job applications

If you apply to us online or otherwise respond to one of our job advertisements, we collect and process the personal application data for the purpose of handling the application process. Processing is carried out primarily by electronic means. This is particularly the case when the relevant application documents are transmitted to us electronically, for example by email or via a web form on the website. We process the personal data necessary for establishing an employment relationship. This includes in particular contact data, data about your qualifications, working hours, and all information required for the hiring decision.

If we conclude an employment contract, the transmitted data will be stored for the purpose of processing the employment relationship in compliance with statutory provisions. If no employment contract is concluded on our part, the application documents will be deleted six months after notification of the rejection decision — this retention period is based on the need for evidence in any proceedings under applicable anti-discrimination legislation . If consent has been given, applications may be retained for longer than six months.

We use recruiting software provided by the service provider Ashby, Inc. to process applications. This software helps us to post job advertisements and manage applications centrally. The service provider is a US company. To ensure a level of data protection comparable to European standards, we have concluded a data processing agreement with the service provider and commit to complying with the conditions of the Standard Contractual Clauses as an additional safeguard. The EU–US Data Privacy Framework adequacy decision is currently in force, confirming for certified organisations (including Ashby) that the USA ensures an adequate level of data protection. Further information can be found in Ashby's privacy policy.

We also ensure that only those persons involved in the application process have access to your application documents. Deletion of data is also always ensured by us as described above. The purpose of the data collected is to carry out the application process and the related hiring decision.

The legal basis for processing is the decision on the establishment and performance of an employment relationship pursuant to UK GDPR Art. 6(1)(b) and Art. 88 / EU GDPR Art. 6(1)(b) and Art. 88 .

Employee management

As part of using the "WorkMotion" platform, we work with WorkMotion Software GmbH, Richard-Ermisch-Straße 7, 10247 Berlin, Germany, as joint controllers within the meaning of UK GDPR Art. 26 / EU GDPR Art. 26. In this context, personal data is jointly processed in particular in connection with international employment relationships, contract processing, and communication via the platform.

The purposes and means of this data processing have been jointly determined with WorkMotion. A joint controllership agreement has been concluded, which in particular regulates which party assumes which data protection obligations (e.g. information obligations, exercising of data subject rights, technical and organisational measures).

You can assert your rights under UK GDPR Art. 15 et seq. / EU GDPR Art. 15 et seq. (e.g. access, rectification, erasure) against both us and directly against WorkMotion Software GmbH. Further information can be found in WorkMotion's privacy policy.

Where personal data is transferred to so-called third countries in the course of our cooperation, this is done exclusively in compliance with UK GDPR Art. 44 et seq. / EU GDPR Art. 44 et seq. WorkMotion ensures an adequate level of data protection through the use of appropriate safeguards, in particular the conclusion of EU Standard Contractual Clauses and supplementary technical and organisational measures.

Cookies

Our website partly uses so-called cookies. Cookies are small text files that are usually stored in a folder in your browser. Cookies contain information about the current or most recent visit to the website:

  • Name of the website
  • Expiry date of the cookie
  • Any value

If cookies do not contain a specific expiry date, they are only temporarily stored and automatically deleted as soon as you close your browser or restart your device. Cookies with an expiry date remain stored even when you close your browser or restart your device. Such cookies are only removed at the stated date or when you manually delete them.

On our website we use the following three types of cookies:

  • Essential cookies (these are required by us, e.g. to display the website correctly for you and to temporarily store certain settings)
  • Functional and performance cookies (these help us, e.g. to evaluate technical data about your visit and thus avoid error messages)
  • Advertising and analytics cookies (these ensure, e.g. that advertising for shoes is displayed if you previously searched for shoes)

You can configure, block and delete cookies in your browser settings. If you delete all cookies on our website, some functions of the website may not display correctly. For helpful information and instructions for common browsers, please refer to the guidance available from your national cybersecurity authority.

Recipients of data

In accordance with the descriptions and purposes given above, we share your data with the following recipients, who are essential for the provision of our offering and communication with you:

  • YouTube, operated by YouTube LLC (Google Ireland Limited), headquartered at Gordon House, Barrow Street, Dublin 4, Ireland. YouTube enables users to upload, view, share and comment on a wide range of user-generated and professionally produced videos on various topics and categories. Data is processed within the European Union. For further information, see YouTube's Privacy Policy.
  • Google Analytics, operated by Google Ireland Ltd., headquartered at Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is used to analyse user behaviour and to display personalised advertising. Data is processed within the European Union. For further information, see Google's Privacy Policy.
  • Google Ads, operated by Google Ireland Ltd., headquartered at Gordon House, Barrow Street, Dublin 4, Ireland. Google Ads is used to serve targeted advertising and analyse its performance. Usage data may be captured and linked with other Google services. Data is processed within the European Union. For further information, see Google's Privacy Policy.
  • Amazon Ads, provided by Amazon Europe Core S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg, or another affiliated Amazon company. Amazon Ads is used to serve targeted advertising, measure its performance, and optimise advertising campaigns. In particular, usage data, device and browser information, IP addresses, cookie IDs, pseudonymous identifiers and information about interactions with adverts or our website may be processed. This data may be linked with information from other Amazon services to provide interest-based advertising and to analyse the success of advertising measures. Processing may also take place outside the European Economic Area / UK; Amazon states that it uses appropriate safeguards for this, in particular Standard Contractual Clauses. For further information, see Amazon's Privacy Notice and information about Amazon Ads.
  • Pinterest, operated by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. Pinterest uses a conversion tracking pixel to reach website visitors who have already shown interest in our content or offerings and are Pinterest members, with relevant advertising on Pinterest. Pinterest captures which areas of the website were visited in order to serve targeted adverts, for example about subscriptions. Data is processed within the European Union. For further information, see Pinterest's Privacy Policy.
  • Hotjar, operated by Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian's STJ 3141, Malta, Europe. Hotjar is a web analytics tool that helps companies understand user behaviour on their website through heatmaps, visitor recordings, conversion funnel analyses and feedback collection. Data is processed within the European Union. For further information, see Hotjar's Privacy Policy.
  • Cloudflare, operated by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare is a web infrastructure and security company that provides content delivery network (CDN), DDoS protection, and various optimisation services to improve the performance and security of websites. Depending on your location, data is processed either within the European Union or in the USA. For further information, see Cloudflare's Privacy Policy.
  • Outbrain, operated by Outbrain Inc., 111 West 19th Street, New York, NY 10011, USA. Outbrain is a content discovery platform that provides personalised content recommendations for online users and helps publishers increase user engagement and generate revenue through promoted content. Depending on your location, data is processed either within the European Union or in the USA. For further information, see Outbrain's Privacy Policy.
  • Taboola, operated by Taboola, Inc., 16 Madison Square West, 7th Floor, New York, New York 10010, USA. Taboola is a content discovery platform that uses algorithms to recommend personalised content for users, helping publishers and advertisers to drive engagement and monetise their websites. Depending on your location, data is processed either within the European Union or in the USA. For further information, see Taboola's Privacy Policy.
  • Bogos.io, operated by BOGOS (formerly "Free Gifts by Secomapp"), headquartered in Hanoi, Vietnam. BOGOS.io is used to provide and evaluate sales promotions such as free gifts, bundle offers, discounts and upsells in our online shop. In particular, usage data, shopping cart and order information, IP address, browser data, and cookie information may be processed. Further service providers may also be integrated for the provision and analysis of the service. Processing of personal data outside the European Economic Area, in particular in the USA or Vietnam, cannot be excluded. For further information, see BOGOS's Privacy Policy.
  • Klaviyo, operated by Klaviyo, Inc., Boston, Massachusetts, USA. Klaviyo is used to provide email marketing, newsletters, and personalised customer communications and to evaluate their success. In particular, contact data, usage data, order information, interactions with emails, and technical information such as IP address, browser data and cookie information may be processed. The processing of personal data may also take place outside the European Economic Area, in particular in the USA. For further information, see Klaviyo's Privacy Policy.
  • Linkster, operated by Linkster GmbH, Germany. Linkster is used to technically provide affiliate and influencer marketing measures, to track partner referrals, and to enable the settlement of commissions. In particular, usage data, referrer URLs, transaction and order information, IP address, and cookie information may be processed. Processing is carried out to analyse and attribute marketing and referral performance and to measure the success of campaigns. For further information, see Linkster's Privacy Policy.
  • Vimeo, operated by Vimeo.com, Inc., New York, USA. Vimeo is used to provide and play videos on our website. In particular, usage data, IP address, browser and device information, and information about interaction with embedded videos may be processed. If you access a Vimeo video, Vimeo may use cookies or similar technologies. The processing of personal data may also take place outside the European Economic Area, in particular in the USA. For further information, see Vimeo's Privacy Policy.
  • AWIN, operated by AWIN AG, Eichhornstraße 3, 10785 Berlin, Germany, is an affiliate marketing network for attributing transactions and settling partner programmes. In the context of cashback and loyalty programmes (e.g. PAYBACK), technical tracking information is processed to correctly attribute transactions and to provide the benefits you have expressly requested, such as PAYBACK points or cashback credits. In particular, click and transaction data may be processed. For further information, see AWIN's Privacy Policy.

We only share data that is necessary for the performance of the mutual contract, or where you have given us consent, for example in the context of our newsletter or the cookie banner. Where no contract yet exists, we share data in certain cases on the basis of legitimate interests. This is the case, for example, when you merely visit our website or wish to make contact. When you visit our website, it is in the mutual interest to provide access to the offering and to communicate with each other.

We have also concluded data processing agreements with all external recipients to meet the requirements of UK and European law. Depending on your location, some of the service providers mentioned above — where indicated — will also transfer your data to the United States. The EU–US Data Privacy Framework adequacy decision is currently in force. Additional data processing agreements, known as Standard Contractual Clauses, are also concluded. We also assess each service provider together with our Data Protection Officer and ensure that additional security measures are available, such as strong encryption of data.

Privacy Policy last updated: June 2026