Privacy Policy

Unless otherwise stated below, the provision of your personal data is neither required by law nor by contract, nor is it necessary for concluding a contract. You are not obliged to provide the data. Failure to provide the data will have no consequences. This only applies insofar as no different information is provided for the processing operations described below.

“Personal data” means any information relating to an identified or identifiable natural person.

Server Log Files

You can visit our website without providing any personal information.

Each time you access our website, usage data is transmitted to us or to our web host / IT service provider by your internet browser and stored in log data (so-called server log files). This stored data includes, for example, the name of the page accessed, the date and time of access, the IP address, the amount of data transferred, and the requesting provider.

Processing is carried out on the basis of Art. 6(1)(f) GDPR, due to our overriding legitimate interest in ensuring the smooth operation of our website and improving our services.

Contact

Controller / Data Protection Officer

Please contact us upon request. The controller responsible for data processing is:
Rumpf Handels GmbH
Textilstr. 19
48465 Schüttorf
Germany
Phone: +49 5923 902340
Email: datenschutz@rumpf.net

You can reach our Data Protection Officer directly at: datenschutz@gsgmbh.de

Data Processing in the Whistleblower Protection System

If you submit information to the internal reporting office as part of the established whistleblower protection system, we collect your personal data (name, electronic contact data, address, message text, information on violations within the meaning of § 3(3) HinSchG, information on the identity of persons protected under the HinSchG) only to the extent you provide it.

Data processing serves the purpose of fulfilling the tasks, duties and rights of the internal reporting office assigned to it under the HinSchG.

Processing is carried out to comply with a legal obligation on the basis of Art. 6(1)(c) GDPR in conjunction with § 10 HinSchG.

Your data will subsequently be deleted in compliance with statutory retention periods (3 years after completion of the procedure within the meaning of § 18 HinSchG).

Customer-Initiated Contact by Email

If you contact us by email on your own initiative, we collect your personal data (name, email address, message text) only to the extent you provide it. Processing serves the purpose of handling and responding to your inquiry.

If the contact relates to pre-contractual measures (e.g. advice in case of purchase interest, preparation of an offer) or to an existing contract between you and us, processing is carried out on the basis of Art. 6(1)(b) GDPR.

If contact is made for other reasons, processing is carried out on the basis of Art. 6(1)(f) GDPR due to our overriding legitimate interest in handling and responding to your inquiry. In this case, you have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you based on Art. 6(1)(f) GDPR.

We use your email address only to process your inquiry. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Collection and Processing When Using the Contact Form

When using the contact form, we collect your personal data (name, email address, message text) only to the extent you provide it. Processing serves the purpose of contacting you.

If the contact relates to pre-contractual measures or to an existing contract, processing is carried out on the basis of Art. 6(1)(b) GDPR.

We use your email address only to process your inquiry. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Use of Address Validation by Endereco

We use address validation on our website provided by Endereco UG (haftungsbeschränkt) (Balthasar-Neumann-Str. 4b, 97236 Randersacker, Germany; “Endereco”).

Processing serves the purpose of checking your entries in our address forms in real time for input and spelling errors and, if necessary, supplementing missing data. If data is entered incorrectly, alternative suggestions for correcting the data will be displayed.

The following information may be transmitted to and processed by Endereco, among others:

postal addresses (country, city, postal code, street, house number)
email address
phone number

Processing of your personal data is carried out on the basis of Art. 6(1)(f) GDPR due to our overriding legitimate interest in having correct data in order to fulfill our contractual obligations. You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you.

The data is processed separately by the provider and is not merged with other data. It is deleted by the provider as soon as the status of the entered data has been determined, but no later than after 30 days.

Further information on data protection at Endereco can be found at: https://www.endereco.de/datenschutzerklaerung/

Applications by Email

Visitors may apply by email for open positions advertised on our website. We collect your personal data only to the extent you provide it. This includes your contact details (e.g. name, email address, phone number), information about your professional qualifications and education, information about professional training as well as performance-related evidence.

Processing serves the purpose of contacting you and deciding on the establishment of an employment relationship. Provision of the data is required in order to carry out the application process. Processing is carried out on the basis of Art. 6(1)(b) GDPR in conjunction with § 26(1) BDSG for the performance of pre-contractual measures (application process as initiation of an employment contract).

If you have given us consent to process personal data for inclusion in our applicant pool (e.g. by ticking a checkbox), processing is carried out on the basis of Art. 6(1)(a) GDPR. You may revoke your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

If special categories of personal data within the meaning of Art. 9(1) GDPR are requested during the application process (e.g. degree of severe disability), this is done on the basis of Art. 9(2)(b) GDPR so that we can exercise rights and fulfill obligations arising from employment law and social security and social protection law.

We store your personal data for as long as necessary to decide on your application. Your data will then be deleted no later than six months thereafter, unless you have consented to further processing and use.

If an employment relationship is established following the application process, the data provided will be further processed on the basis of Art. 6(1)(b) GDPR in conjunction with § 26(1) BDSG for the purposes of carrying out the employment relationship and then transferred to the personnel file.

WhatsApp Business

If you contact us via WhatsApp, we use WhatsApp Business provided by WhatsApp Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; “WhatsApp”). If you are located outside the European Economic Area, this service is provided by WhatsApp Inc. (1601 Willow Road, Menlo Park, CA 94025, USA).

Processing serves the purpose of handling and responding to your inquiry. For this purpose, we collect and process your mobile phone number stored with WhatsApp, your name (if provided), and further data to the extent you provide it.

We use a mobile device for this service whose address book contains only data of users who have contacted us via WhatsApp. Personal data is not transferred to WhatsApp unless you have already consented to this vis-à-vis WhatsApp.

Your data is transferred by WhatsApp to servers of Meta Platforms Inc. in the USA. For the USA, an adequacy decision of the EU Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). Meta Platforms Inc. has certified under the TADPF and is therefore committed to complying with European data protection principles.

If the contact relates to pre-contractual measures or an existing contract, processing is carried out on the basis of Art. 6(1)(b) GDPR. If contact is made for other reasons, processing is carried out on the basis of Art. 6(1)(f) GDPR due to our overriding legitimate interest in providing quick and easy contact and responding to your inquiry. In this case, you have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you based on Art. 6(1)(f) GDPR.

We use your personal data only to process your inquiry. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Further information on WhatsApp’s terms and privacy can be found at https://www.whatsapp.com/legal/#terms-of-service and https://www.whatsapp.com/legal/#privacy-policy.

Customer Account & Orders

Customer Account

When you create a customer account, we collect your personal data to the extent specified there. Processing serves the purpose of improving your shopping experience and simplifying order processing. Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent.

You may revoke your consent at any time by notifying us, without affecting the lawfulness of processing based on consent before its withdrawal. Your customer account will then be deleted.

Collection, Processing and Disclosure of Personal Data in the Context of Orders

When you place an order, we collect and process your personal data only to the extent necessary to fulfill and process your order and to handle your inquiries. Provision of the data is required for concluding the contract. Failure to provide the data means that no contract can be concluded. Processing is carried out on the basis of Art. 6(1)(b) GDPR and is required for the performance of a contract with you.

Your data may be disclosed, for example, to shipping companies, dropshipping / fulfillment providers, payment service providers, providers of order processing services, and IT service providers. In all cases, we strictly comply with legal requirements. The scope of data transfer is limited to a minimum.

Reviews & Marketing

Data Collection When Submitting a Comment or Review

When commenting/reviewing an item or a post, we collect your personal data (name, email address, comment text) only to the extent you provide it. Processing serves the purpose of enabling comments/reviews and displaying them.

For the purpose of verifying your review/comment, we also collect the following data: email address.

By submitting the comment/review, you consent to the processing of the transmitted data. Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You may revoke your consent at any time by notifying us, without affecting the lawfulness of processing based on consent before its withdrawal. Your personal data will then be deleted.

When your comment/review is published, the name you provided will be published.

Review Reminder

After your order, we would like to ask you to review your purchase with us. For this purpose, we use your personal data (name, email address, order information) independently of contract processing in order to send you a review reminder by email after an order has been placed, provided you have expressly consented to this.

Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You may revoke your consent at any time using the corresponding link in the email or by notifying us, without affecting the lawfulness of processing based on consent before its withdrawal.

Use of Email Address for Sending Newsletters

We use your email address to send information and offers via newsletter, provided you have expressly consented to this. Processing serves exclusively the purpose of advertising communication. For this purpose, we process your email address and, if applicable, any additional data you voluntarily provided when subscribing to our newsletter.

Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You may revoke your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

You can unsubscribe from the newsletter at any time using the corresponding link in the newsletter or by notifying us. Your email address will then be removed from the distribution list. Despite removal, we may continue to store your email address in a so-called blacklist to prevent you from receiving newsletter emails from us in the future. This storage is carried out on the basis of Art. 6(1)(f) GDPR due to our legitimate interest and yours in preventing the renewed use of your email address for sending our newsletter. You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you.

Use of Klaviyo

We use the service of Klaviyo Inc. (125 Summer St Floor 7, Boston, MA 02111, USA; “Klaviyo”) for newsletter delivery as part of a data processing agreement. We pass on the information you provide during newsletter subscription (email address, possibly first and last name) to Klaviyo. Processing serves the purpose of newsletter delivery and statistical analysis.

To evaluate newsletter campaigns, the newsletters sent contain a 1x1 pixel graphic (tracking pixel) or a tracking link. This enables us to determine whether you opened the newsletter and whether you clicked on integrated links. In this context, we collect personal data such as IP address, browser type and device, and the time. Under a pseudonym, usage profiles may be created from this data. The collected data is not used to personally identify you and is used solely for statistical evaluation to improve newsletter campaigns.

Your data is generally transferred to servers of Klaviyo in the USA and stored there. For the USA, an adequacy decision of the EU Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). Klaviyo has certified under the TADPF and is therefore committed to complying with European data protection principles.

Processing of your personal data is carried out on the basis of Art. 6(1)(f) GDPR due to our overriding legitimate interest in a targeted, effective and user-friendly newsletter system. You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you.

Further information on data protection at Klaviyo can be found at https://www.klaviyo.com/legal/privacy-notice and https://www.klaviyo.com/legal/data-processing-agreement.

Use of Email Address for Back-in-Stock Notifications

We offer a back-in-stock notification service on our website. If an item is temporarily unavailable, you can enter your email address on the relevant item page and we will inform you by email once it becomes available, provided you have consented to this. You will receive a one-time notification email.

Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You may revoke your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. You can unsubscribe from back-in-stock notifications at any time by notifying us. Your email address will then be removed from the distribution list.

Shipping Service Providers & Inventory Management

Disclosure of Email Address to Shipping Companies for Shipping Status Updates

As part of contract processing, we pass on your email address to the transport company if you have expressly consented to this during the ordering process. The disclosure serves the purpose of informing you about the shipping status by email.

Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You may revoke your consent at any time by notifying us or the transport company, without affecting the lawfulness of processing based on consent before its withdrawal.

Use of an External Inventory Management System

We use an inventory management system for contract processing as part of a data processing agreement. For this purpose, the personal data collected during the ordering process is transmitted to:

plentysystems AG, Johanna-Waescher-Straße 7, 34131 Kassel, Germany
Pickware GmbH, Goebelstr. 21, 64293 Darmstadt, Germany

Processing of your personal data serves the purpose of fulfilling the contract concluded with you and is carried out on the basis of Art. 6(1)(b) GDPR.

Payment Service Providers

Use of the Payment Service Provider Mollie

We use Mollie B.V. (Keizersgracht 313, 1016 EE Amsterdam, Netherlands; “Mollie”) for payment processing on our website. Processing serves the purpose of offering you different payment methods via Mollie.

If you choose one of Mollie’s payment options, the data required for payment processing will be transmitted to Mollie. This includes your payment data (e.g. bank account number or credit card number), your IP address, your internet browser and device type, and in some cases your first and last name, address data, and information about the product or service you purchased from us.

This processing is carried out on the basis of Art. 6(1)(b) GDPR.

Further information on data processing by Mollie can be found in Mollie’s privacy policy: https://www.mollie.com/de/privacy

Cookies

Our website uses cookies. Cookies are small text files that are stored on a user’s computer system via the internet browser. When a user accesses a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string that allows the browser to be uniquely identified when the website is accessed again.

Cookies are stored on your device. Therefore, you have full control over the use of cookies. By selecting the appropriate technical settings in your internet browser, you can be notified before cookies are set and decide individually whether to accept them, and you can prevent the storage of cookies and the transmission of the data they contain. Cookies that have already been stored can be deleted at any time. However, please note that you may then not be able to use all functions of this website in full.

You can find information on how to manage cookies (including disabling them) for the major browsers here:

Technically Necessary Cookies

Unless otherwise stated in this privacy policy, we use only technically necessary cookies to make our services more user-friendly, effective and secure. Cookies also enable our systems to recognize your browser after a page change and to offer you services. Some functions of our website cannot be provided without cookies; for these, it is necessary that the browser is recognized again after a page change.

The use of cookies or comparable technologies is based on § 25(2) TDDDG. Processing of your personal data is carried out on the basis of Art. 6(1)(f) GDPR due to our overriding legitimate interest in ensuring optimal website functionality and a user-friendly and effective design of our services. You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you.

Use of CookieFirst

We use the consent management tool CookieFirst provided by Digital Data Solutions B.V. (Plantage Middenlaan 42a, 1018 DH, Amsterdam, Netherlands; “CookieFirst”). The tool enables you to give consent to data processing via the website—especially the setting of cookies—and to make use of your right to withdraw consent already given. Processing serves the purpose of obtaining and documenting required consents and thus complying with legal obligations.

The following information may be collected and transmitted to CookieFirst:

uniquely assignable ID
date and time of consent
opt-in and opt-out data

This data is not disclosed to other third parties. Processing is carried out to comply with a legal obligation on the basis of Art. 6(1)(c) GDPR.

Further information can be found at: https://cookiefirst.com/legal/privacy-policy/

Analytics & Ad Tracking

Google Analytics 4

We use Google Analytics provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”) to analyze website usage and for marketing and advertising purposes. Information collected may include IP address, date and time of page access, click path, browser and device information, visited pages, referrer URL, location data, and purchase activities.

Your IP address is shortened by us on our own servers beforehand. Google therefore receives only pseudonymized data.

The use of cookies or comparable technologies takes place with your consent pursuant to § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. Processing of your personal data takes place with your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time.

Advanced Consent Mode

We use the advanced implementation of consent mode (Advanced Consent Mode). Even if consent is not granted, user data may be transmitted to Google in the form of “pings”. These pings may include information such as: IP address to derive IP country (the IP address is not logged), date and time of page access, URL of visited pages, user agent, referrer URL, or information about the triggering of website events (e.g. a conversion). Google may model usage data on the basis of this information.

The information generated is generally transferred to a Google server in the USA and stored there. For the USA, an adequacy decision exists (Trans-Atlantic Data Privacy Framework, TADPF).

Further information can be found at https://policies.google.com/technologies/partner-sites and https://policies.google.com/privacy?hl=de&gl=de.

shopware Analytics

We use “shopware Analytics” provided by shopware AG (Ebbinghoff 10, 48624 Schöppingen, Germany; “shopware”). Shopware and we are joint controllers for the collection of your data and its transmission to shopware when using the service. Processing serves the purpose of analyzing this website and its visitors.

Cookies or comparable technologies are used for this purpose. Use takes place with your consent pursuant to § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

Further information can be found at: https://docs.shopware.com/de/shopware-6-de/erweiterungen/shopware-analytics

Microsoft Clarity

We use “Microsoft Clarity” provided by Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; “Microsoft”) to design, optimize and analyze our website.

Cookies or comparable technologies are used. Information collected may include IP address, time of access, click path, device and browser information, location data, preferred language, visited subpages, time spent, and viewed content. The data is processed under a pseudonym and is not used to personally identify visitors.

Further information can be found at: Cookie list, Data retention, Terms, Microsoft Privacy Statement.

Meta Pixel

We use the Meta Pixel provided by Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; “Meta”). Meta and we are joint controllers for the collection of your data and its transmission to Meta when the service is integrated.

The application serves the purpose of displaying interest-based advertising on Facebook and Instagram and creating conversion statistics. Further information can be found in Meta’s privacy information at: https://www.facebook.com/about/privacy/

Google Ads Conversion Tracking

We use the online advertising program “Google Ads” and, in this context, conversion tracking. Further information and Google’s privacy policy can be found at: https://www.google.de/policies/privacy/

Microsoft Advertising

We use Microsoft Advertising provided by Microsoft Corporation (One Microsoft Way, Redmond, WA 98052-6399, USA) for marketing and advertising purposes and to measure the success of advertising measures (conversion tracking). Further information can be found at: https://privacy.microsoft.com/de-de/privacystatement

Plugins and Other Services

Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”). Google Tag Manager itself does not store cookies and does not process personal data. However, it enables the triggering of other tags that may collect and process personal data.

Further information can be found at: https://www.google.com/intl/de/tagmanager/use-policy.html

Google reCAPTCHA

We use reCAPTCHA provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”). This query serves the purpose of distinguishing whether input is made by a human or by automated processing.

Further information can be found at: https://www.google.com/recaptcha/intro/android.html and https://www.google.com/privacy.

YouTube

We use the function for embedding YouTube videos provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “YouTube”). Videos are displayed in an iFrame and “enhanced privacy mode” is enabled. This means YouTube does not store information about website visitors unless they watch a video.

Further information can be found in YouTube’s privacy information at: https://www.youtube.com/t/privacy

Google Fonts

We use Google Fonts provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”) for the uniform display of fonts. When a page is accessed, a connection to Google servers is established. Your IP address and browser information may be processed and transmitted to Google.

Further information can be found at: https://www.google.de/intl/de/policies/ and https://developers.google.com/fonts/faq.

Data Subject Rights and Retention

Retention Period

After full performance of the contract, data is initially stored for the duration of the warranty period and then in compliance with statutory retention periods, in particular under tax and commercial law, and deleted after expiry of these periods unless you have consented to further processing and use.

Rights of the Data Subject

If the legal requirements are met, you have the following rights under Art. 15 to 20 GDPR: right of access, rectification, erasure, restriction of processing, and data portability.

In addition, pursuant to Art. 21(1) GDPR you have the right to object to processing based on Art. 6(1)(f) GDPR, as well as to processing for direct marketing purposes.

Right to Lodge a Complaint with a Supervisory Authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data is unlawful.

You may lodge a complaint, among others, with the supervisory authority responsible for us:

State Commissioner for Data Protection of Lower Saxony
Prinzenstraße 5
30159 Hannover
Germany
Phone: +49 511 1204500
Fax: +49 511 1204599
Email: poststelle@lfd.niedersachsen.de

Right to Object

If the personal data processing listed here is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to such processing with effect for the future.

After an objection, processing of the data concerned will cease unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or if processing serves the establishment, exercise or defense of legal claims.

Last updated: 22/10/2024