Politik om beskyttelse af persondata

The protection of your personal data is important to us. Below, we explain which data we process when you visit and use our website, the purposes for which this processing takes place, and the rights available to you. In doing so, we comply with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the German Telecommunications Digital Services Data Protection Act (TDDDG).
  1. Controller and Contact Details
    The controller responsible for data processing on this website is:
    Invy GmbH, Freytagstraße 20, 30169 Hanover, Germany
    Represented by the Managing Director: Valentin Genzel
    Email: support@invy-elektro.de
    If you have any questions regarding data protection or wish to exercise your rights, you may contact us at the email address stated above at any time.
  2. General Information on Data Processing
    2.1 Personal Data
    Personal data means any information relating to an identified or identifiable natural person, such as a name, postal address, email address, or IP address. As a general rule, you may visit our website without providing any personal information. However, certain functions, such as placing an order, require personal data, and we only collect the information necessary for the respective purpose.
    2.2 Legal Bases
    We process personal data in accordance with applicable legal requirements. The relevant legal bases include, in particular, your consent pursuant to Art. 6(1)(a) GDPR, the performance of a contract or steps taken prior to entering into a contract pursuant to Art. 6(1)(b) GDPR, compliance with a legal obligation pursuant to Art. 6(1)(c) GDPR, and our legitimate interests pursuant to Art. 6(1)(f) GDPR. Section 25 TDDDG also applies to the storage of information on your terminal device or access to information stored on it, such as through cookies.
    2.3 Recipients and Processors
    To provide our services, we use carefully selected service providers, for example for hosting, payment processing, and shipping. Where these service providers process personal data on our behalf, this is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR. Personal data is disclosed to other third parties only where this is legally permitted or necessary for the performance of a contract.
    2.4 Data Transfers to Third Countries
    Some of the services we use are based in third countries, particularly the United States, or process data in such countries. Where personal data is transferred to the United States, we rely on the European Commission’s adequacy decision concerning the EU-US Data Privacy Framework (DPF), provided that the recipient is appropriately certified, and additionally on the European Commission’s Standard Contractual Clauses.
    2.5 Retention Period
    We retain personal data only for as long as necessary for the respective purposes or for as long as required by statutory retention obligations, particularly commercial and tax-law retention periods of up to ten years. The data is deleted once these periods have expired.
  3. Accessing the Website and Server Log Files
    When you access our website, information transmitted automatically by your browser is collected and stored in server log files. This information includes, in particular:
    • IP address of the accessing device
    • Date and time of access
    • Name of the requested file or page accessed
    • Website from which the request originated (referrer)
    • Browser and operating system used
    • Access status and amount of data transferred
    This processing is carried out to deliver the website, ensure its stability and security, and protect against attacks. The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR. The data is stored only for a short period and is subsequently deleted or anonymized.
  4. Cookies and Consent Management
    Our website uses cookies and comparable technologies. Cookies are small text files stored on your terminal device that enable your browser to be recognized. We use technically necessary cookies that are required for the operation of the website without your consent, on the basis of Section 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR.
    We use all non-essential technologies, particularly those used for analytics, marketing, and embedded third-party content, only after you have provided your consent through our cookie banner. The legal basis in such cases is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. Your consent is voluntary and may be withdrawn at any time with effect for the future. You can adjust or withdraw your selection at any time using the “Cookie Settings” link in the footer of our website.
  5. Hosting and Shop System
    Our website and online shop are operated using the Shopify platform. The service provider is Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, Ireland (parent company: Shopify Inc., Canada). When you visit the website or place an order, Shopify processes information including your IP address, device and browser information, and data generated in connection with your order, such as your name, address, contact details, and payment information. The legal basis is Art. 6(1)(b) and Art. 6(1)(f) GDPR and, in relation to non-essential cookies, your consent pursuant to Art. 6(1)(a) GDPR. We have entered into a data processing agreement with Shopify. The European Commission has issued an adequacy decision for Canada.
  6. Orders and Customer Accounts
    To process your order, we process the information you provide, particularly your name, address, contact and payment details, and order information. The legal basis is the performance of a contract pursuant to Art. 6(1)(b) GDPR. Where tax-law or commercial-law retention obligations apply, the processing is additionally based on Art. 6(1)(c) GDPR.
    You may voluntarily create a customer account. In this case, we store your registration and order information, as well as your IP address and the date and time of registration and login, in order to prevent misuse pursuant to Art. 6(1)(f) GDPR. You may close your customer account at any time. The associated data will subsequently be deleted unless statutory retention obligations require us to retain it.
  7. Payment Processing
    We use external payment service providers to process payments, particularly Shopify Payments / Shop Pay, Stripe, PayPal, and Klarna. Payments made through Apple Pay and Google Pay are processed through these service providers. You enter the information required for payment, such as payment and account information, directly with the respective payment service provider. We do not receive complete payment information such as full credit card numbers. The legal basis is the performance of a contract pursuant to Art. 6(1)(b) GDPR and our legitimate interest in secure and efficient payment processing pursuant to Art. 6(1)(f) GDPR. The privacy policies of the respective payment service providers also apply.
  8. Shipping
    To deliver your order, we provide the necessary information, particularly your name and delivery address and, where provided, your email address and telephone number for shipment tracking and delivery notifications, to the appointed shipping company. We use DHL and GLS for shipping. The legal basis is the performance of a contract pursuant to Art. 6(1)(b) GDPR. Where applicable, shipment notifications are based on your consent pursuant to Art. 6(1)(a) GDPR or our legitimate interest pursuant to Art. 6(1)(f) GDPR.
  9. Contact Form
    If you contact us through the contact form or by email, we process the information you provide in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract. In all other cases, processing is based on our legitimate interest in responding to enquiries pursuant to Art. 6(1)(f) GDPR. The data is deleted once your enquiry has been fully resolved, unless statutory retention obligations require us to retain it.
  10. Newsletter
    You may subscribe to our newsletter through our website. We use Shopify Email, provided by Shopify International Limited, Ireland, to distribute the newsletter. A valid email address is required to subscribe. Registration takes place using a double opt-in procedure, meaning that after registering, you will receive a confirmation message and must confirm your subscription before it becomes active. We store the time of registration in order to document and verify the subscription. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You may unsubscribe from the newsletter at any time, for example by using the unsubscribe link included in each newsletter email. By unsubscribing, you also withdraw your consent.
  11. Product Reviews
    We use the Judge.me review tool to collect and display product reviews. After a purchase, we automatically send a review request to the email address you provided and process your name, email address, and information relating to your order for this purpose. Where you have provided your consent, the legal basis is Art. 6(1)(a) GDPR. Otherwise, the legal basis is Section 7(3) of the German Unfair Competition Act (UWG) in conjunction with our legitimate interest in obtaining customer reviews pursuant to Art. 6(1)(f) GDPR. You may object to receiving review requests at any time without incurring any costs other than the transmission costs charged at the basic rates.
  12. Web Analytics and Online Marketing
    We use the services described below only after you have provided your consent through our cookie banner. The legal basis in each case is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You may withdraw your consent at any time. Where data is transferred to the United States, the information provided in Section 2.4 applies.
    12.1 Google Analytics
    We use Google Analytics (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, United States). Google Analytics uses cookies and similar technologies to evaluate the way visitors use our website, such as page views, time spent on the website, and the origin of visitors. This information helps us improve our services. Google LLC is certified under the EU-US Data Privacy Framework.
    12.2 Google Ads
    We use Google Ads, provided by Google Ireland Limited, to advertise our products and services. Conversion tracking and remarketing technologies are used to measure the effectiveness of our advertising activities and display advertisements tailored to your interests. Cookies may be placed and data may be transmitted to Google in connection with these activities.
    12.3 Meta Pixel
    We use the Meta Pixel for Facebook and Instagram, provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (parent company: Meta Platforms, Inc., United States). The Meta Pixel allows us to measure the effectiveness of our advertisements and create target audiences for advertising purposes. With regard to the collection of data on our website and the transmission of that data to Meta, we and Meta act as joint controllers within the meaning of Art. 26 GDPR. Any subsequent processing by Meta is carried out under Meta’s sole responsibility. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.
  13. Embedded Third-Party Content
    We embed content from external service providers on our website. This content is loaded only after you have provided your consent through our cookie banner. When the content is loaded, a connection is established with the servers of the respective provider, during which information including your IP address may be transmitted. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.
    13.1 YouTube Videos
    We embed videos from YouTube, provided by Google Ireland Limited, Ireland, and Google LLC, United States. When you play a video, information about your use may be transmitted to Google.
    13.2 Instagram and TikTok Content
    We embed posts from Instagram, provided by Meta Platforms Ireland Limited, Ireland, and TikTok, provided by TikTok Technology Limited, Ireland, and its affiliated companies. When you access this content, data may be transmitted to the respective providers.
    13.3 Google Maps
    We use Google Maps, provided by Google Ireland Limited, Ireland, and Google LLC, United States, to display maps. When a map is loaded, information including your IP address and location information may be transmitted to Google.
  14. Protection Against Misuse (hCaptcha)
    We use hCaptcha to protect our website against misuse and automated access by bots. The provider is Intuition Machines, Inc., United States. hCaptcha checks whether an entry is being made by a human and processes information including your IP address, device and browser information, and information relating to your usage behavior for this purpose. The legal basis is our legitimate interest in website security and the prevention of misuse pursuant to Art. 6(1)(f) GDPR. Where consent is obtained for this processing, the legal basis is Art. 6(1)(a) GDPR. The information provided in Section 2.4 applies to transfers of data to the United States.
  15. Social Media Links
    The footer of our website contains buttons linking to our profiles on Instagram, YouTube, TikTok, Pinterest, and WhatsApp. These are links only. A connection to the servers of the respective providers is established only when you actively click one of the buttons. No data is exchanged with these providers merely by visiting our website. The legal basis for providing these links is our legitimate interest in maintaining an attractive public presence pursuant to Art. 6(1)(f) GDPR. The respective providers are responsible for any data processing that takes place after you click a link.
  16. Your Rights
    Subject to the applicable legal requirements, you have the following rights:
    • Right to obtain information about the personal data stored about you pursuant to Art. 15 GDPR
    • Right to have inaccurate or incomplete data corrected pursuant to Art. 16 GDPR
    • Right to erasure pursuant to Art. 17 GDPR
    • Right to restriction of processing pursuant to Art. 18 GDPR
    • Right to data portability pursuant to Art. 20 GDPR
    • Right to withdraw consent with effect for the future pursuant to Art. 7(3) GDPR
    • Right to object to processing based on legitimate interests pursuant to Art. 21 GDPR
    You may object to the processing of your data for direct marketing purposes at any time and without stating a reason. To exercise your rights, simply send a message to support@invy-elektro.de.
  17. Data Security
    We implement technical and organizational security measures to protect your data against loss, manipulation, and unauthorized access. Data transmitted through our website is encrypted using TLS/SSL technology. Please note that data transmission over the internet may be subject to security vulnerabilities and that complete protection against access by third parties cannot be guaranteed.
  18. Current Version and Amendments to This Privacy Policy
    This Privacy Policy is currently valid. We will update it whenever our data processing activities or the applicable legal framework change. The latest version of this Privacy Policy is available on our website at any time.