Privacy Policy

With these privacy notes, we inform you about our handling of your personal data and about your rights under the European General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). Responsible for data processing is isento GmbH (hereinafter referred to as "we" or "us").

I. General Information

1. Contact

If you have questions or suggestions regarding this information or wish to contact us to assert your rights, please direct your inquiry to:

isento GmbH
Ostendstraße 242
90482 Nuremberg
Phone: +49 911 21 77 38 70
Email: info@isento.de

2. Legal Bases

The data protection term "personal data" refers to all information relating to an identified or identifiable natural person. We process personal data in compliance with relevant data protection regulations, in particular the GDPR and the BDSG. Data processing by us takes place only on the basis of statutory permission. We process personal data only with your consent (§ 25 (1) TDDDG or Art. 6 (1) lit. a GDPR), for the performance of a contract to which you are a party or at your request for the performance of pre-contractual measures (Art. 6 (1) lit. b GDPR), for compliance with a legal obligation (Art. 6 (1) lit. c GDPR), or if processing is necessary to protect our legitimate interests or the legitimate interests of a third party, unless your interests or fundamental rights and freedoms that require the protection of personal data prevail (Art. 6 (1) lit. f GDPR).

3. Duration of Storage

Unless otherwise stated in the following notices, we store the data only as long as is necessary to achieve the processing purpose or for the fulfillment of our contractual or statutory obligations. Such statutory retention obligations may arise in particular from commercial or tax law provisions.

From the end of the calendar year in which the data was collected, we will retain such personal data contained in our accounting records for ten years and retain personal data present in commercial correspondence and contracts for six years. Furthermore, we will retain data in connection with consents subject to proof as well as complaints and claims for the duration of statutory limitation periods. We will delete data stored for advertising purposes if you object to processing for this purpose.

4. Categories of Recipients of Data

We use processors in the context of processing your data. Processing operations carried out by such processors include, for example, hosting, email dispatch, maintenance and support of IT systems, customer and order management, order processing, accounting and billing, marketing measures, or file and data carrier destruction. A processor is a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller responsible for data processing. Processors do not use data for their own purposes, but perform data processing exclusively for the controller and are contractually obligated to guarantee appropriate technical and organizational measures for data protection. Furthermore, we may transmit your personal data to entities such as postal and delivery services, principal bank, tax consultancy/auditing firm, or tax authorities. Further recipients may arise from the following notices.

5. Data Transfer to Third Countries

Our data processing operations may involve the transfer of certain personal data to third countries, i.e., countries in which the GDPR is not applicable law. Such a transfer takes place in a permissible manner if the European Commission has established that an adequate level of data protection is provided in such a third country. If no such adequacy decision of the European Commission exists, a transfer of personal data to a third country only takes place if appropriate safeguards pursuant to Art. 46 GDPR exist or if one of the conditions of Art. 49 GDPR is met.

Unless otherwise stated below, we use the EU Standard Contractual Clauses as appropriate safeguards for the transfer of personal data to third countries. You have the option of obtaining a copy of these EU Standard Contractual Clauses or viewing them. Please contact the address given under Contact for this purpose.

If you consent to the transfer of personal data to third countries, the transfer takes place on the legal basis of Art. 49 (1) lit. a GDPR.

6. Processing in the Exercise of Your Rights

When you exercise your rights pursuant to Art. 15 to 22 GDPR, we process the transmitted personal data for the purpose of implementing these rights by us and in order to provide proof thereof. We will process data stored for the purpose of providing information and preparing it only for this purpose and for purposes of data protection monitoring, and otherwise restrict processing in accordance with Art. 18 GDPR.

These processing operations are based on the legal basis of Art. 6 (1) lit. c GDPR in conjunction with Art. 15 to 22 GDPR and § 34 (2) BDSG.

7. Your Rights

As a data subject, you have the right to assert your data subject rights against us. In particular, you have the following rights:

• You have the right, pursuant to Art. 15 GDPR and § 34 BDSG, to request information as to whether and, if applicable, to what extent we process personal data concerning you or not.
• You have the right, pursuant to Art. 16 GDPR, to demand that we rectify your data.
• You have the right, pursuant to Art. 17 GDPR and § 35 BDSG, to demand that we erase your personal data.
• You have the right, pursuant to Art. 18 GDPR, to obtain the restriction of processing of your personal data.
• You have the right, pursuant to Art. 20 GDPR, to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format and to transmit those data to another controller.
• Insofar as you have granted us separate consent to data processing, you may revoke this consent at any time pursuant to Art. 7 (3) GDPR. Such revocation shall not affect the lawfulness of processing carried out on the basis of the consent until revocation.
• If you believe that processing of personal data concerning you violates the provisions of the GDPR, you have the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR.

8. Right to Object

You have the right, pursuant to Art. 21 (1) GDPR, to object at any time, on grounds relating to your particular situation, to processing based on the legal basis of Art. 6 (1) lit. e or f GDPR. If personal data concerning you is processed by us for the purpose of direct marketing, you may object to this processing pursuant to Art. 21 (2) and (3) GDPR.

9. Data Protection Officer

You can reach our Data Protection Officer at the following contact details:

Email: datenschutzbeauftragter@isento.de
Jörg ter Beek
Cortina Consult GmbH
Hafenweg 24, 48155 Münster
https://www.cortina-consult.com

II. Data Processing on Our Website

When using the website, we collect information that you provide yourself. In addition, during your visit to the website, certain information about your use of the website is automatically collected by us. In data protection law, the IP address is also generally considered personal data. An IP address is assigned to every device connected to the internet by the internet provider so that it can send and receive data.

1. Processing of Server Log Files

During purely informational use of our website, general information transmitted by your browser to our server is initially stored automatically (i.e. not via registration). This typically includes: browser type/version, operating system used, page visited, previously visited page (referrer URL), IP address, date and time of the server request, and HTTP status code (so-called log files).

Processing is carried out to protect our legitimate interests and is based on the legal basis of Art. 6 (1) lit. f GDPR. This processing serves the technical administration and security of the website. The stored data is deleted after seven days, unless there is a justified suspicion of unlawful use based on specific indications and further examination and processing of the information is necessary for this reason. We are unable to identify you as a data subject based on the stored information. Art. 15 to 22 GDPR therefore do not apply pursuant to Art. 11 (2) GDPR, unless you provide additional information enabling your identification to exercise your rights set out in these articles.

2. Contact Options and Inquiries

Our website contains contact forms through which you can send us messages. The transfer of your data is encrypted (indicated by the "https" in the browser's address bar). All data fields marked as mandatory are required to process your request. Failure to provide them means that we cannot process your request. The provision of further data is voluntary. Alternatively, you can also send us a message via the contact email. We process the data for the purpose of answering your inquiry.

Insofar as your inquiry is aimed at concluding or executing a contract with us, Art. 6 (1) lit. b GDPR is the legal basis for data processing. Otherwise, we process the data based on our legitimate interest in getting in touch with inquiring persons. The legal basis for data processing is then Art. 6 (1) lit. f GDPR.

3. Registration

In order to place orders and use further functions of the website, registration via the website or checkout via PayPal direct purchase is required. The details required for registration can be seen from the input mask. The provision of information marked as mandatory is strictly necessary so that registration can be completed. The provided data is processed for the purpose of service provision.

Processing is based on the legal basis of Art. 6 (1) lit. b GDPR.

4. Orders

Insofar as you order a product via our website, we process personal data exclusively for contract execution or to be able to provide you with the ordered product. Within the scope of the booking or ordering process, we only process the data that you have entered in the input mask yourself, as well as payment information where applicable.

To be able to deliver the ordered products to you, we transmit your data required for delivery to one of our shipping service providers as specified in the order, in particular your name and delivery address to the shipping service provider DHL used by us. The legal basis for processing in each case is Art. 6 (1) lit. b GDPR. Insofar as we transmit your email address or phone number to DHL to send you a package announcement or further information regarding shipping status, this is done only on the relevant legal basis for this (consent pursuant to Art. 6 (1) lit. a GDPR). All data fields marked as mandatory are required to process your booking or order. Failure to provide them means that we cannot process your booking or order.

The provision of further data is voluntary. We process such voluntarily provided data on the basis of Art. 6 (1) lit. f GDPR.

For an order in our online shop, it is not necessary to register for a customer account. You nevertheless have the option of creating a customer account via registration. When you have registered for a customer account, your stored data will automatically be entered into the order mask when ordering a product in our shop. In addition, you can use the customer account to inform yourself about the status of your orders and save products to a wishlist.

The details required for registration can be seen from the input mask. The provision of information marked with * as mandatory is strictly necessary so that registration can be completed. A valid email address is required for registration. To confirm the registration, you will initially receive a registration email that you must confirm via a link (double opt-in). After registration, you can log in to the customer account by entering your email address and the password used. The processing of the data provided in the context of registration and use of the customer account is based on the legal basis of Art. 6 (1) lit. b GDPR.

5. Withdrawal

You can also exercise your right of withdrawal via our electronic withdrawal button. If you use this function, we process the personal data provided by you, in particular:

• First and last name
• Order number
• Email address used for the order
• Date and time of receipt of the withdrawal declaration

Processing takes place exclusively to receive and process your withdrawal and to fulfill our statutory obligations to provide proof. The legal basis for this is Art. 6 (1) lit. b GDPR (contract performance) and Art. 6 (1) lit. c GDPR (fulfillment of legal obligations).

Upon receipt of your withdrawal, you will immediately receive a confirmation of receipt on a durable medium (e.g. by email).

Insofar as a reimbursement is made due to an effective withdrawal, we will use the same means of payment that you used for the original transaction, unless expressly agreed otherwise.

6. Payment Service Providers

To pay for ordered products in our online shop, we offer the payment service provider PayPal from PayPal Europe S.a.r.l. et Cie s.c.a. (Luxembourg, EU).

The payment data provided by you in the context of the ordering process will be transmitted by us to the payment service provider insofar as this transmission is necessary to carry out the payment process. In doing so, PayPal may transmit to us your address data stored with PayPal, which we process exclusively for contract execution. The legal basis for this transmission is Art. 6 (1) lit. b GDPR.

Further information on data protection at PayPal can be found at:
https://www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE#r5

Please note that otherwise the respective payment information is processed by payment service providers under their own responsibility.

7. Cookies

We use cookies and comparable technologies ("cookies") on our website. Cookies are small data sets that are stored by your browser when you visit a website. As a result, the browser used is identified and can be recognized by web servers. Through your browser, you have full control over the use of cookies. You can delete cookies at any time in the security settings of your browser. You can object to the use of cookies through your browser settings in principle or for specific cases.

The use of cookies is partly technically necessary for the operation of our website and thus permissible without the consent of the user. In addition, we may use cookies to offer special features and content, as well as for analysis and marketing purposes. These may also include cookies from third-party providers (so-called third-party cookies). We use such technically non-necessary cookies only with your consent pursuant to § 25 (1) TDDDG and, where applicable, Art. 6 (1) lit. a GDPR. Information on the purposes, providers, technologies used, stored data, and the storage duration of individual cookies can be found in the cookie settings of our Consent Management Tool.

8. Consent Management Tool

On our website, we use the Cookie Consent Manager integrated into Shopware. This allows you to grant, decline, and change your consent for the use of cookies and comparable technologies at a later date.

In doing so, information about the cookie settings made by you is processed. The processing is necessary to implement your selection and to be able to prove consents granted.

The legal basis for this processing is Art. 6 (1) lit. c GDPR in conjunction with Art. 7 (1) GDPR.

You can change your settings at any time via the cookie settings of our website or revoke a previously granted consent with effect for the future.

9. Google Tag Manager

On our website, we use the Google Tag Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Google Tag Manager is used to manage and deploy website tags. Analysis and marketing services can be technically integrated and controlled via it. Google Tag Manager allows us to provide certain interactions with our website via a so-called data layer for the respective services used. The tool itself does not set cookies and does not process user profiles itself; it merely triggers other tags, which in turn may collect data under certain circumstances.

Insofar as information is stored on or read from your end device by Google Tag Manager or the services integrated via it, or personal data (such as your IP address) is processed, this is done only after your prior express consent. The legal bases are § 25 (1) TDDDG and Art. 6 (1) lit. a GDPR. You can revoke your consent at any time via the cookie settings of our website with effect for the future.

We have entered into a data processing agreement (Data Processing Terms) with Google. It cannot be excluded that data is transmitted by Google to servers of Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF). In addition, Google uses Standard Contractual Clauses (SCCs) approved by the EU Commission as a guarantee for maintaining an adequate level of data protection in third-country transfers.

Further information on how Google operates and on data processing by Google can be found in Google's privacy policy at:
https://policies.google.com/privacy

III. Data Processing on Our Social Media Pages

We are represented on several social media platforms with a corporate page. In this way, we want to offer further opportunities for information about our company and for exchange. Our company has corporate pages on the following social media platforms:

• Instagram
• LinkedIn

When you visit or interact with a profile on a social media platform, personal data about you may be processed. Information associated with a used social media profile also regularly constitutes personal data. This also includes messages and statements made using the profile. In addition, during your visit to a social media profile, certain information about it is often automatically collected, which can also constitute personal data.

1. Visiting a Social Media Page

a) Instagram

When visiting our Instagram page, through which we present our company or individual products from our offer, certain information about you is processed. The sole controller responsible for this processing of personal data is Meta Platforms Ireland Limited (Ireland, EU). Further information on the processing of personal data by Meta can be obtained at https://www.facebook.com/privacy/explanation. Meta offers the possibility to object to certain data processing; corresponding notes and opt-out options can be found at https://www.facebook.com/settings?tab=ads.

Meta provides us with statistics and insights in anonymized form for our Instagram page, with the help of which we obtain knowledge about the types of actions people take on our page (so-called "Page Insights"). These Page Insights are created based on certain information about people who have visited our page. This processing of personal data is carried out by Meta and us as joint controllers. The processing serves our legitimate interest in evaluating the types of actions taken on our page and improving our page based on these insights. The legal basis for this processing is Art. 6 (1) lit. f GDPR.

We cannot assign the information received via Page Insights to individual user profiles that interact with our Instagram page. We have concluded an agreement with Meta on processing as joint controllers, in which the distribution of data protection obligations between us and Meta is specified. Details on the processing of personal data to create Page Insights and the agreement concluded between us and Meta can be found at https://www.facebook.com/legal/terms/information_about_page_insights_data.

In relation to these data processing operations, you have the option of asserting your data subject rights (see "Your Rights") against Meta as well. Further information on this can be found in Meta's privacy policy at https://www.facebook.com/privacy/explanation.

Please note that according to Meta privacy terms, user data is also processed in the USA or other third countries. Meta transfers user data only to countries for which an adequacy decision of the European Commission pursuant to Art. 45 GDPR exists or on the basis of appropriate safeguards pursuant to Art. 46 GDPR.

b) LinkedIn

For the processing of personal data when visiting our LinkedIn page, LinkedIn Ireland Unlimited Company (Ireland, EU) is generally the sole controller. Further information on the processing of personal data by LinkedIn can be found at https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy.

When you visit our LinkedIn corporate page, follow this page, or engage with the page, LinkedIn processes personal data in order to grant us statistics and insights in anonymized form. This gives us knowledge about the types of actions people take on our page (so-called Page Insights). For this purpose, LinkedIn particularly processes data that you have already provided to LinkedIn via the details in your profile, such as function, country, industry, seniority, company size, and employment status. In addition, LinkedIn will process information about how you interact with our LinkedIn corporate page, e.g. whether you are a follower of our LinkedIn corporate page. With Page Insights, LinkedIn does not provide us with any personal data of yours. We only have access to aggregated Page Insights. Nor is it possible for us to draw conclusions about individual members from the information in the Page Insights. This processing of personal data within the scope of Page Insights is carried out by LinkedIn and us as joint controllers. The processing serves our legitimate interest in evaluating the types of actions taken on our LinkedIn corporate page and improving our corporate page based on these insights. The legal basis for this processing is Art. 6 (1) lit. f GDPR.

We have concluded an agreement with LinkedIn on processing as joint controllers, in which the distribution of data protection obligations between us and LinkedIn is specified. The agreement is available at: https://legal.linkedin.com/pages-joint-controller-addendum. Under this agreement, the following applies:

• LinkedIn and we have agreed that LinkedIn is responsible for enabling you to exercise your rights under the GDPR. You can contact LinkedIn online via the following link (https://www.linkedin.com/help/linkedin/ask/PPQ?lang=de) or reach LinkedIn via the contact details in the privacy policy. You can contact the Data Protection Officer at LinkedIn Ireland via the following link: https://www.linkedin.com/help/linkedin/ask/TSO-DPO. You can also contact us at our specified contact details regarding the exercise of your rights in connection with the processing of personal data within the framework of Page Insights. In such a case, we will forward your request to LinkedIn.
• LinkedIn and we have agreed that the Irish Data Protection Commission is the lead supervisory authority monitoring processing for Page Insights. You always have the right to lodge a complaint with the Irish Data Protection Commission (see www.dataprotection.ie) or with any other supervisory authority.

Please note that according to LinkedIn privacy policies, personal data is also processed by LinkedIn in the USA or other third countries. LinkedIn transfers personal data only to countries for which an adequacy decision of the European Commission pursuant to Art. 45 GDPR exists or on the basis of appropriate safeguards pursuant to Art. 46 GDPR.

c) YouTube

When visiting our YouTube page, through which we present our company in or with videos, certain information about you is processed. The sole controller for this processing of personal data is the operating company of YouTube, namely Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Through each call-up of one of the individual pages of this website, which is operated for us by the service provider and on which a YouTube component (YouTube video) has been integrated, the internet browser on the information technology system of the data subject is automatically prompted by the respective YouTube component to download a display of the corresponding YouTube component from YouTube. Further information on YouTube can be accessed at https://www.youtube.com/yt/about/de/. Within the framework of this technical procedure, YouTube and Google gain knowledge of which specific subpage of our website is visited by the data subject.

If the data subject is logged into YouTube at the same time, YouTube recognizes, with each call-up of a subpage containing a YouTube video, which specific subpage of our website the data subject visits. This information is collected by YouTube and Google and assigned to the respective YouTube account of the data subject. YouTube and Google always receive information via the YouTube component that the data subject has visited our website if the data subject is logged into YouTube at the same time when calling up our website; this takes place regardless of whether the data subject clicks on a YouTube video or not. If such transmission of this information to YouTube and Google is not desired by the data subject, they can prevent the transmission by logging out of their YouTube account before calling up our website.

The privacy policy published by YouTube, available at https://www.google.de/intl/de/policies/privacy/, provides information about the collection, processing, and use of personal data by YouTube and Google.

On smartphones and tablets, the aforementioned services are often not implemented by plugins, but by a device-internal "share" function. According to its settings, information may also be shared with other social media service providers. Please consult your device information for details.

2. Comments and Direct Messages

We also process information that you have made available to us via our corporate page on the respective social media platform. Such information may include the username used, contact details, or a message to us. These processing operations are carried out by us as the sole controller. We process this data based on our legitimate interest in getting in touch with inquiring persons. The legal basis for data processing is Art. 6 (1) lit. f GDPR. Further data processing operations may take place if you have consented (Art. 6 (1) lit. a GDPR) or if this is necessary to fulfill a legal obligation (Art. 6 (1) lit. c GDPR).

IV. Further Data Processing Operations

1. Contact by E-Mail

If you send us a message via the provided contact email, we will process the transmitted data for the purpose of answering your inquiry. We process this data based on our legitimate interest in getting in touch with inquiring persons.

The legal basis for data processing is Art. 6 (1) lit. f GDPR.

2. Customer and Prospect Data

When you contact our company as a customer or prospective customer, we process your data to establish or execute the contractual relationship to the extent necessary. This regularly includes the processing of the personal master, contract, and payment data provided to us, as well as contact and communication data of our contact persons at commercial customers and business partners. The legal basis for these processing operations is Art. 6 (1) lit. b GDPR.

In addition, we process customer and prospect data for analysis and marketing purposes. These processing operations are carried out on the legal basis of Art. 6 (1) lit. f GDPR and serve our interest in further developing our offer and informing you specifically about our offers.

Further data processing operations may take place if you have consented (Art. 6 (1) lit. a GDPR) or if this is necessary to fulfill a legal obligation (Art. 6 (1) lit. c GDPR).

3. Use of E-Mail Address for Marketing Purposes

We may use the email address provided by you during registration or ordering to inform you about our own similar products and services.

The legal basis is Art. 6 (1) lit. f GDPR in conjunction with § 7 (3) UWG. You can object to this at any time without incurring any costs other than the transmission costs according to the basic rates. For this purpose, you can unsubscribe by clicking the unsubscribe link contained in every mailing or by email to info@isento.de.

As of: 09/2026