Privacy Policy

Privacy Policy

Unless otherwise stated below, the provision of your personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are not obliged to provide the data. Failure to provide the data has no consequences. This only applies if no other information is provided in the subsequent processing operations. "Personal data" is all information that relates to an identified or identifiable natural person.

Server log files

You can visit our websites without providing any personal information. Every time you access our website, usage data is transmitted to us or our web host / IT service provider through your Internet browser and stored in protocol data (so-called server log files). This stored data includes, for example, the name of the page accessed, the date and time of access, the IP address, the amount of data transferred and the requesting provider. Processing is carried out on the basis of Art. 6 Paragraph 1 Letter f of GDPR due to our overriding legitimate interest in ensuring trouble-free operation of our website and improving our offering. Your data may be transmitted to third countries outside the EU, in particular to Canada and the USA, and processed there. There is an adequacy decision by the EU Commission for Canada. There is an adequacy decision by the EU Commission for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified according to the TADPF. This data transfer is based on contractual obligations comparable to those of the EU Commission’s standard contractual clauses.

contact

Responsible

Please contact us if you wish. The person responsible for data processing is: Mensur Bunjaku, Nelkenstraße 22, 30827 Garbsen Germany, 051314631177, info@menbun.com

Customer’s initiative contact via email

If you initiate business contact with us by e-mail, we will only collect your personal data (name, e-mail address, message text) to the extent you provide it. The data processing serves to process and answer your contact request. If the contact is for the purpose of carrying out pre-contractual measures (e.g. advice if you are interested in purchasing, creating an offer) or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 Paragraph 1 Letter b GDPR. If contact is made for other reasons, this data processing is carried out on the basis of Art. 6 Paragraph 1 Letter f GDPR out of our overriding legitimate interest in processing and answering your request. In this case, you have the right to object to this processing of personal data concerning you based on Art. 6 Paragraph 1 Letter f GDPR at any time for reasons arising from your particular situation. We will only use your e-mail address to process your request. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Collection and processing when using the contact form

When you use the contact form, we only collect your personal data (name, e-mail address, message text) to the extent you provide it. The data processing serves the purpose of establishing contact. If the contact is for the implementation of pre-contractual measures (e.g. advice in the event of a purchase interest, preparation of an offer) or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 Paragraph 1 Letter b GDPR. If the contact is made for other reasons, this data processing is carried out on the basis of Art. 6 Paragraph 1 Letter f GDPR out of our overriding legitimate interest in processing and answering your request. In this case, you have the right to object to this processing of personal data concerning you based on Art. 6 Paragraph 1 Letter f GDPR at any time for reasons arising from your particular situation. We only use your e-mail address to process your request. Your data will then be deleted in compliance with statutory retention periods unless you have consented to further processing and use.

Collection and processing when sending images by email

You have the option of sending us pictures by email in connection with ordering a personalized product. When you send us your pictures, we may collect your personal data (image of an identifiable person) only to the extent you have made it available. The data processing serves the purpose of creating personalized products. The image sent serves as a template for the product and is used for this purpose (e.g. T-shirt printing). Processing is carried out on the basis of Art. 6 Paragraph 1 Letter b of GDPR and is necessary for the performance of a contract with you. Your data will not be passed on. We only use the image you send us to provide the service. Your data will then be deleted in compliance with statutory retention periods unless you have consented to further processing and use.

Using WeTransfer

We use the WeTransfer service from WeTransfer BV (Willem Fenengastraat 19, 1096 BL Amsterdam, Netherlands; “WeTransfer”) to send files up to 2 GB in size at your request. The purpose of using it is to transmit large files in high quality. To do this, we pass on your email address and the file to be transmitted to WeTransfer. WeTranser generates a download link that is sent to you and us by email. The data is encrypted by WeTransfer during transmission and storage and can only be accessed via the download link. Your personal data may be transmitted to WeTransfer servers in the USA and temporarily stored there (sometimes unencrypted). For the USA, there is an adequacy decision by the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). WeTransfer is not certified according to the TADPF. The data transfer is based, among other things, on standard contractual clauses as suitable guarantees for the protection of personal data, which can be viewed at: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_de. The processing is carried out on the basis of Art. 6 Para. 1 lit. a GDPR with your consent, provided that you have expressly agreed to the use of WeTransfer.

You can revoke your consent at any time by notifying us, without affecting the legality of the processing carried out on the basis of the consent until the revocation.

For more information about data protection when using WeTransfer, please visit: https://wetransfer.com/legal/privacy.

Customer Account Orders

Customer account

When you open a customer account, we collect your personal data to the extent specified there. The data processing serves the purpose of improving your shopping experience and simplifying order processing. The processing is carried out on the basis of Art. 6 Paragraph 1 Letter a of GDPR with your consent. You can revoke your consent at any time by notifying us, without affecting the legality of the processing carried out on the basis of the consent until the revocation. Your customer account will then be deleted.

Collection, processing and transfer of personal data when placing orders

When you place an order, we only collect and process your personal data to the extent that this is necessary to fulfil and process your order and to process your enquiries. The provision of the data is necessary for the conclusion of the contract. Failure to provide the data means that no contract can be concluded. The processing is carried out on the basis of Art. 6 Paragraph 1 Letter b of GDPR and is necessary for the fulfilment of a contract with you. Your data is passed on, for example, to the shipping companies and dropshipping providers, payment service providers, service providers for order processing and IT service providers you have chosen. In all cases, we strictly adhere to the legal requirements. The scope of data transfer is limited to a minimum. Your data may be transferred to third countries outside the EU, in particular to Canada and the USA, and processed there. There is an adequacy decision of the EU Commission for Canada. There is an adequacy decision of the EU Commission for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified according to the TADPF. This data transfer is based on contractual obligations comparable to those of the EU Commission’s standard contractual clauses.

Advertising

Use of the email address for sending newsletters

We use your email address, regardless of the contract processing, exclusively for our own advertising purposes to send newsletters, provided that you have expressly consented to this. The processing is carried out on the basis of Art. 6 Paragraph 1 Letter a of GDPR with your consent. You can revoke your consent at any time without affecting the legality of the processing carried out on the basis of the consent until the revocation. You can unsubscribe from the newsletter at any time by using the corresponding link in the newsletter or by notifying us. Your email address will then be removed from the mailing list.

Payment service provider credit report

Using PayPal Check-Out

We use the PayPal Check-Out payment service from PayPal (Europe) S.à.rl et Cie, SCA (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal") on our website. The data processing serves the purpose of being able to offer you payment via the payment service. By selecting and using payment via PayPal, credit card via PayPal, direct debit via PayPal or "Pay later" via PayPal, the data required for payment processing will be transmitted to PayPal in order to be able to fulfill the contract with you with the selected payment method. This processing is carried out on the basis of Art. 6 Para. 1 lit. b GDPR.

Cookies may be stored here that enable your browser to be recognized. The data processing that takes place as a result is based on Art. 6 Paragraph 1 Letter f of GDPR due to our overriding legitimate interest in offering a customer-oriented range of different payment methods. You have the right to object to this processing of personal data concerning you at any time for reasons arising from your particular situation.

Credit card via PayPal, direct debit via PayPal & “Pay later” via PayPal

For individual payment methods such as credit card via PayPal, direct debit via PayPal or “Pay later” via PayPal, PayPal reserves the right to obtain a credit report based on mathematical-statistical procedures using credit agencies. To do this, PayPal transmits the personal data required for a credit check to a credit agency and uses the information received on the statistical probability of a payment default to make a balanced decision about the establishment, implementation or termination of the contractual relationship. The credit report may contain probability values ​​(score values) that are calculated on the basis of scientifically recognized mathematical-statistical procedures and whose calculation includes, among other things, address data. Your legitimate interests will be taken into account in accordance with the statutory provisions. The data processing serves the purpose of the credit check for the initiation of a contract. The processing is carried out on the basis of Art. 6 Para. 1 lit. f GDPR due to our overriding legitimate interest in protection against payment default if PayPal makes advance payments. You have the right to object to this processing of personal data concerning you based on Art. 6 (1) (f) GDPR at any time by notifying PayPal for reasons arising from your particular situation. The provision of the data is necessary for the conclusion of the contract with the payment method you have requested. Failure to provide the data means that the contract cannot be concluded with the payment method you have selected.

Third party providers

When paying using a third-party payment method, the data required for payment processing is transmitted to PayPal. This processing is carried out on the basis of Art. 6 Para. 1 lit. b GDPR. To carry out this payment method, the data may then be passed on by PayPal to the respective provider. This processing is carried out on the basis of Art. 6 Para. 1 lit. b GDPR. Local third-party providers can be, for example:

• Immediately (SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany)
• giropay (Paydirekt GmbH, Stephanstr. 14-16, 60313 Frankfurt am Main)

Purchase on account via PayPal

When paying using the purchase on account payment method, the data required for payment processing is first sent to PayPal. To carry out this payment method, the data is then sent by PayPal to Ratepay GmbH (Franklinstraße 28-29, 10587 Berlin; "Ratepay") in order to be able to fulfill the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6 Para. 1 lit. b GDPR. Ratepay may carry out a credit check on the basis of mathematical-statistical procedures (probability or score values) using credit agencies in accordance with the process already described above. The data processing serves the purpose of credit checks for the initiation of a contract. The processing is carried out on the basis of Art. 6 Para. 1 lit. f GDPR due to our overriding legitimate interest in protection against payment default if Ratepay makes advance payments.

Further information on data protection and which credit agencies use Ratpay can be found at https://www.ratepay.com/legalpayment-dataprivacy/ and https://www.ratepay.com/legal-payment-creditagencies/.

Further information on data processing when using PayPal can be found in the associated privacy policy at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Data collection and processing during credit checks

If we make advance payments, e.g. when paying by invoice or direct debit, we reserve the right to obtain a credit report based on mathematical-statistical procedures using SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden. To do so, we transmit the personal data required for a credit check to them and use the information received on the statistical probability of a payment default to make a balanced decision about the establishment, implementation or termination of the contractual relationship. The credit report may contain probability values ​​(score values) that are calculated on the basis of scientifically recognized mathematical-statistical procedures and whose calculation includes, among other things, address data. Your legitimate interests will be taken into account in accordance with the statutory provisions. The data processing serves the purpose of the credit check for the initiation of a contract. The processing is carried out on the basis of Art. 6 Para. 1 lit. f GDPR due to our overriding legitimate interest in protection against payment default when we make advance payments. You have the right to object to this processing of personal data concerning you based on Art. 6 (1) (f) GDPR at any time by notifying us for reasons arising from your particular situation. The provision of the data is necessary for the conclusion of the contract with the payment method you have requested. Failure to provide the data means that the contract cannot be concluded with the payment method you have selected.

Rights of data subjects and storage period

Duration of storage

After the contract has been fully processed, the data will initially be stored for the duration of the warranty period, then taking into account statutory retention periods, in particular those under tax and commercial law, and then deleted after the deadline has expired, unless you have consented to further processing and use.

Rights of the data subject

If the legal requirements are met, you have the following rights under Art. 15 to 20 GDPR: Right to information, to rectification, to erasure, to restriction of processing, to data portability. In addition, under Art. 21 Para. 1 GDPR, you have the right to object to processing based on Art. 6 Para. 1 f GDPR and to processing for direct marketing purposes.

Right to complain to the supervisory authority

According to Art. 77 GDPR, you have the right to complain to the supervisory authority if you believe that the processing of your personal data is not lawful.

You can lodge a complaint with the supervisory authority responsible for us, which you can reach using the following contact details:

State Commissioner for Data Protection Lower Saxony Prinzenstraße 5 30159 Hannover Tel.: +49 511 1204500 Fax: +49 511 1204599 E-Mail: poststelle@lfd.niedersachsen.de

Right of objection

If the personal data processing listed here is based on our legitimate interest in accordance with Art. 6 (1) (f) GDPR, you have the right to object to this processing at any time with effect for the future for reasons arising from your particular situation. After objection has been made, the processing of the data concerned will be terminated unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms, or if the processing serves to assert, exercise or defend legal claims.

last update: 29.11.2023