Privacy Policy

1. Information on the collection of personal data and contact details of the controller

1.1 We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about how we handle your personal data when you use our website. In this context, personal data is all data by which you can be personally identified.

1.2 The controller for the data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is SPINOGY GmbH, Brunnenweg 17, 64331 Weiterstadt, Germany, phone: +49 6150 970 960, email: mail [at] spinogy.de. The controller responsible for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

1.3 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the character string "https://" and the lock symbol in your browser line.

2. Data collection when visiting our website

When using our website for purely informational purposes, i.e. if you do not register or otherwise provide us with information, we only collect such data as your browser transmits to our server (so-called "server log files"). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

  • Our website visited
  • Date and time at the time of access
  • Amount of data sent in bytes
  • Source/reference from which you reached the page
  • Browser used
  • Operating system used
  • IP address used (where applicable: in anonymized form)

The processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used in any other way. However, we reserve the right to subsequently check the server log files if there are concrete indications of unlawful use.

3. Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your end device. Some of these cookies are automatically deleted again after you close your browser (so-called "session cookies"), while others remain on your end device for longer and enable the storage of page settings (so-called "persistent cookies"). In the latter case, you can find the storage period in the overview of the cookie settings of your web browser.

Insofar as personal data is also processed by individual cookies used by us, the processing is carried out in accordance with Art. 6(1)(b) GDPR either for the performance of the contract, in accordance with Art. 6(1)(a) GDPR in the case of consent granted, or in accordance with Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the site visit.

You can set your browser so that you are informed about the setting of cookies and can decide individually about their acceptance or exclude the acceptance of cookies for certain cases or in general.

Please note that if cookies are not accepted, the functionality of our website may be restricted.

Consent management and consent logging

When you first visit our website, you will be asked via a consent banner for your consent to the use of non-essential cookies or services (e.g. statistics). Technically necessary cookies are set without consent; non-essential services are only loaded after you have actively given your consent to this. We store your selection locally in your browser so that the banner does not appear again on every visit. You can change or withdraw your consent at any time with effect for the future via the "Cookie settings" link in the footer; withdrawing consent for the "Statistics" category ends the relevant processing immediately.

To provide evidence of consent granted (Art. 7(1) GDPR), we log each consent on the server side. In doing so, we store the point in time, the version of the consent text, the categories you selected, a hashed (not stored in plain text) IP address as well as technical information about your browser (user agent) and the page accessed. The legal basis is our legal obligation to be able to demonstrate consent as well as our legitimate interest in legal certainty in accordance with Art. 6(1)(c) and (f) GDPR. This log data is not passed on to third parties.

4. Contacting us

When you contact us (e.g. via the contact form or email), personal data is processed – exclusively for the purpose of handling and responding to your request and only to the extent necessary for this. The legal basis for the processing of this data is our legitimate interest in responding to your request in accordance with Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6(1)(b) GDPR. Your data will be deleted if it can be inferred from the circumstances that the matter concerned has been conclusively clarified and provided that no statutory retention obligations prevent this.

5. Data processing when opening a customer account

In accordance with Art. 6(1)(b) GDPR, personal data continues to be collected and processed to the respective extent necessary if you provide it to us when opening a customer account. You can find out which data is required for opening an account from the input mask of the relevant form on our website. You can delete your customer account at any time by sending a message to the above-mentioned address of the controller. After your customer account has been deleted, your data will be deleted, provided that all contracts concluded via it have been fully processed, no statutory retention periods prevent this and we no longer have a legitimate interest in continued storage.

6. Use of customer data for direct advertising

Subscription to our email newsletter

If you subscribe to our email newsletter, we regularly send you information about our offers. The only mandatory information for sending the newsletter is your email address. Providing further data is voluntary and is used to be able to address you personally. For sending the newsletter, we use the so-called double opt-in procedure, which ensures that you only receive newsletters once you have expressly confirmed your consent to receiving the newsletter by clicking a verification link sent to the specified email address.

By activating the confirmation link, you give us your consent for the use of your personal data in accordance with Art. 6(1)(a) GDPR. In this context, we store the IP address entered by your internet service provider (ISP) as well as the date and time of registration in order to be able to trace any possible misuse of your email address at a later point in time. The data collected by us when you subscribe to the newsletter is used strictly for the intended purpose. You can unsubscribe from the newsletter at any time via the link provided for this purpose in the newsletter or by sending a corresponding message to the controller named at the outset. After unsubscribing, your email address will be deleted immediately from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to use the data beyond this, which is legally permitted and about which we inform you in this policy.

7. Data processing for order handling

7.1 Insofar as necessary for the performance of the contract for delivery and payment purposes, the personal data collected by us is passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6(1)(b) GDPR.

To process your order, we also work together with the following service provider(s) who support us in whole or in part with the performance of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

7.2 Transfer of personal data to shipping service providers

Deutsche Post

If the goods are delivered by Deutsche Post (Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn), we pass on your email address to Deutsche Post in accordance with Art. 6(1)(a) GDPR before the delivery of the goods for the purpose of arranging a delivery date or for delivery notification, provided that you have given your express consent to this during the ordering process. Otherwise, for the purpose of delivery, we only pass on the name of the recipient and the delivery address to Deutsche Post in accordance with Art. 6(1)(b) GDPR. The transfer takes place only insofar as this is necessary for the delivery of the goods. In this case, prior arrangement of the delivery date with Deutsche Post or delivery notification is not possible.

Consent can be withdrawn at any time with effect for the future vis-à-vis the controller designated above or vis-à-vis Deutsche Post.

DHL

If the goods are delivered by the transport service provider DHL (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn), we pass on your email address to DHL in accordance with Art. 6(1)(a) GDPR before the delivery of the goods for the purpose of arranging a delivery date or for delivery notification, provided that you have given your express consent to this during the ordering process. Otherwise, for the purpose of delivery, we only pass on the name of the recipient and the delivery address to DHL in accordance with Art. 6(1)(b) GDPR. The transfer takes place only insofar as this is necessary for the delivery of the goods. In this case, prior arrangement of the delivery date with DHL or delivery notification is not possible.

Consent can be withdrawn at any time with effect for the future vis-à-vis the controller designated above or vis-à-vis the transport service provider DHL.

7.3 Use of payment service providers (payment services)

Paypal

When paying via PayPal, credit card via PayPal, direct debit via PayPal or – if offered – "purchase on account" or "installment payment" via PayPal, we pass on your payment data as part of the payment processing to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal"). The transfer is carried out in accordance with Art. 6(1)(b) GDPR and only insofar as this is necessary for the payment processing.

For the payment methods credit card via PayPal, direct debit via PayPal or – if offered – "purchase on account" or "installment payment" via PayPal, PayPal reserves the right to carry out a credit check. For this purpose, your payment data may, in accordance with Art. 6(1)(f) GDPR, be passed on to credit agencies on the basis of PayPal's legitimate interest in determining your solvency. PayPal uses the result of the credit check with regard to the statistical probability of default for the purpose of deciding on the provision of the respective payment method. The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. Among other things, but not exclusively, address data is included in the calculation of the score values. For further data protection information, including on the credit agencies used, please refer to PayPal's privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still remain entitled to process your personal data insofar as this is necessary for the contractual processing of payments.

8. Website functionalities

Google Customer Reviews (formerly Google Certified Shops program)

We work together with Google as part of the "Google Customer Reviews" program. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). This program gives us the opportunity to obtain customer reviews from users of our website. In this context, after a purchase on our website you are asked whether you would like to participate in an email survey by Google. If you give your consent in accordance with Art. 6(1)(a) GDPR, we transmit your email address to Google. You will receive an email from Google Customer Reviews in which you are asked to rate the purchasing experience on our website. The rating you submit is then combined with our other ratings and displayed in our Google Customer Reviews logo as well as in our Merchant Center dashboard. In addition, your rating is used for Google Seller Ratings. As part of the use of Google Customer Reviews, personal data may also be transmitted to the servers of Google LLC in the USA.

You can withdraw your consent at any time by sending a message to the controller responsible for the data processing or to Google.

You can access further information on Google's data protection in connection with the Google Customer Reviews program at the following link: https://support.google.com/merchants/answer/7188525?hl=de

You can read further information on the data protection of Google Seller Ratings at this link: https://support.google.com/google-ads/answer/2375474

Google Analytics 4

This website uses – exclusively after your express consent – the web analytics service Google Analytics 4. The provider is Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies and comparable technologies that enable an analysis of the use of our website. The information generated in this way about your use of this website is generally transmitted to a Google server and stored there; in doing so, a transmission to Google LLC in the USA may take place.

We have activated IP anonymization, so that your IP address is shortened by Google within the EU or the EEA before transmission. Google uses this information on our behalf to evaluate your use of the website, to compile reports on website activity and to provide further services associated with the use of the website. There is a data processing agreement with Google in accordance with Art. 28 GDPR.

The legal basis for the processing is your consent in accordance with Art. 6(1)(a) GDPR in conjunction with § 25(1) TTDSG. Google Analytics is only loaded once you consent to the "Statistics" category in the cookie banner. You can withdraw your consent at any time with effect for the future via the "Cookie settings" (link in the footer).

Insofar as personal data is transmitted to the USA, Google relies on the EU-US Data Privacy Framework as well as additionally on standard contractual clauses of the EU Commission. You can find further information on the handling of user data at Google Analytics in Google's privacy policy: https://policies.google.com/privacy as well as at https://support.google.com/analytics/answer/6004245.

9. Data subject rights

9.1 The applicable data protection law grants you the following data subject rights (rights to information and intervention) vis-à-vis the controller with regard to the processing of your personal data, whereby reference is made to the cited legal basis for the respective conditions of exercise:

  • Right of access in accordance with Art. 15 GDPR;
  • Right to rectification in accordance with Art. 16 GDPR;
  • Right to erasure in accordance with Art. 17 GDPR;
  • Right to restriction of processing in accordance with Art. 18 GDPR;
  • Right to notification in accordance with Art. 19 GDPR;
  • Right to data portability in accordance with Art. 20 GDPR;
  • Right to withdraw consent granted in accordance with Art. 7(3) GDPR;
  • Right to lodge a complaint in accordance with Art. 77 GDPR.

9.2 Right to object

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST AS PART OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL END THE PROCESSING OF THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT ADVERTISING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL END THE PROCESSING OF THE DATA CONCERNED FOR DIRECT ADVERTISING PURPOSES.

10. Duration of storage of personal data

The duration of the storage of personal data is determined on the basis of the respective legal basis, the purpose of processing and – if applicable – additionally on the basis of the respective statutory retention period (e.g. commercial and tax law retention periods).

In the case of processing of personal data on the basis of an express consent in accordance with Art. 6(1)(a) GDPR, this data is stored until the data subject withdraws their consent.

If there are statutory retention periods for data that is processed in the context of legal or quasi-legal obligations on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted after expiry of the retention periods, provided that it is no longer required for the performance of the contract or the initiation of a contract and/or we no longer have a legitimate interest in continued storage.

In the case of processing of personal data on the basis of Art. 6(1)(f) GDPR, this data is stored until the data subject exercises their right to object in accordance with Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defense of legal claims.

In the case of processing of personal data for the purpose of direct advertising on the basis of Art. 6(1)(f) GDPR, this data is stored until the data subject exercises their right to object in accordance with Art. 21(2) GDPR.

Unless otherwise stated in the other information in this policy on specific processing situations, stored personal data is otherwise deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.