1) Information on the collection of personal data and contact details of the controller
1.1 We are pleased that you are visiting our website and thank you for your interest. Below we inform you about the handling of your personal data when you use our website. Personal data means all data with which you can be personally identified.
1.2 The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Aegean Vibe, owner Sadik Demirkaya, Rathausplatz 5, 91052 Erlangen, Germany, phone: +49 176 37660425, e-mail: info@aegeanvibe.com. The controller for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.
1.3 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string “https://” and the lock symbol in your browser line.
2) Data collection when visiting our website
When our website is used merely for information purposes, i.e. if you do not register or otherwise transmit information to us, we only collect the data that your browser transmits to our server (so-called “server log files”). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:
- Our website that was visited
- Date and time at the time of access
- Amount of data sent in bytes
- Source/referral from which you reached the page
- Browser used
- Operating system used
- IP address used (where applicable: in anonymised form)
The processing takes place pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not disclosed or otherwise used. However, we reserve the right to check the server log files retrospectively should concrete indications point to unlawful use.
3) Hosting & Content Delivery Network
Hosting by Shopify
We use the shop system of the service provider Shopify International Limited, Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”), for the purpose of hosting and presenting the online shop on the basis of processing on our behalf. All data collected on our website is processed on the servers of Shopify. In the context of the aforementioned services of Shopify, data may also be transmitted, as part of further processing on behalf, to Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada, Shopify Data Processing (USA) Inc., Shopify Payments (USA) Inc. or Shopify (USA) Inc. In the event of a transmission of data to Shopify Inc. in Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission. Further information on data protection at Shopify is available on the following website: https://www.shopify.de/legal/datenschutz
Further processing on servers other than the aforementioned servers of Shopify takes place only within the framework communicated below.
4) Cookies
In order to make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your end device. Some of these cookies are automatically deleted again after you close the browser (so-called “session cookies”), while others remain on your end device for longer and enable page settings to be saved (so-called “persistent cookies”). In the latter case, you can find the storage period in the overview of the cookie settings of your web browser.
Insofar as personal data is also processed by individual cookies that we use, the processing takes place pursuant to Art. 6(1)(b) GDPR either for the performance of the contract, pursuant to Art. 6(1)(a) GDPR in the case of consent given, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and in a customer-friendly and effective design of the page visit.
You can set your browser so that you are informed about the setting of cookies and decide individually on their acceptance, or exclude the acceptance of cookies for certain cases or in general.
Please note that if cookies are not accepted, the functionality of our website may be restricted.
5) Contact
In the context of contacting us (e.g. via contact form or e-mail), personal data is processed, exclusively for the purpose of handling and answering your request and only to the extent necessary for this. The legal basis for the processing of this data is our legitimate interest in answering your request pursuant to Art. 6(1)(f) GDPR. If your contact aims at a contract, the additional legal basis for the processing is Art. 6(1)(b) GDPR. Your data will be deleted when it can be inferred from the circumstances that the matter concerned has been conclusively clarified and provided that no statutory retention obligations preclude this.
6) Data processing when opening a customer account
Pursuant to Art. 6(1)(b) GDPR, personal data will continue to be collected and processed to the extent required in each case if you provide it to us when opening a customer account. Which data is required for opening an account can be found in the input mask of the corresponding form on our website. Your customer account can be deleted at any time by sending a message to the above-mentioned address of the controller. After deletion of your customer account, your data will be deleted, provided that all contracts concluded via it have been fully processed, no statutory retention periods preclude this and we have no continuing legitimate interest in further storage.
7) Data processing for order handling
7.1 Insofar as necessary for the performance of the contract for delivery and payment purposes, the personal data collected by us will be disclosed pursuant to Art. 6(1)(b) GDPR to the commissioned transport company and the commissioned credit institution.
To process your order, we also work with the following service provider(s), who support us in whole or in part in the performance of concluded contracts. Certain personal data will be transmitted to these service providers in accordance with the following information.
7.2 Disclosure of personal data to shipping service providers
- DHL
If the goods are delivered by the transport service provider DHL (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn), we disclose your e-mail address to DHL pursuant to Art. 6(1)(a) GDPR before delivery of the goods for the purpose of coordinating a delivery date or announcing the delivery, provided that you have given your express consent to this in the ordering process. Otherwise, for the purpose of delivery pursuant to Art. 6(1)(b) GDPR, we only disclose the name of the recipient and the delivery address to DHL. The disclosure takes place only insofar as this is necessary for the delivery of the goods. In this case, prior coordination of the delivery date with DHL or the delivery announcement is not possible.
The consent can be withdrawn at any time with effect for the future towards the controller named above or towards the transport service provider DHL.
- GLS
If the goods are delivered by the transport service provider GLS (General Logistics Systems Germany GmbH & Co. OHG, GLS Germany-Straße 1-7, 36286 Neuenstein), we disclose your e-mail address to GLS pursuant to Art. 6(1)(a) GDPR before delivery of the goods for the purpose of coordinating a delivery date or announcing the delivery, provided that you have given your express consent to this in the ordering process. Otherwise, for the purpose of delivery pursuant to Art. 6(1)(b) GDPR, we only disclose the name of the recipient and the delivery address to GLS. The disclosure takes place only insofar as this is necessary for the delivery of the goods. In this case, prior coordination of the delivery date with GLS or the delivery announcement is not possible.
The consent can be withdrawn at any time with effect for the future towards the controller named above or towards the transport service provider GLS.
7.3 Use of payment service providers (payment services)
- Paypal
When paying via PayPal, credit card via PayPal, direct debit via PayPal or, if offered, “purchase on account” or “instalment payment” via PayPal, we disclose your payment data in the context of payment processing to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal"). The disclosure takes place pursuant to Art. 6(1)(b) GDPR and only insofar as this is necessary for payment processing.
For the payment methods credit card via PayPal, direct debit via PayPal or, if offered, “purchase on account” or “instalment payment” via PayPal, PayPal reserves the right to obtain a credit report. For this purpose, your payment data may be disclosed to credit reference agencies pursuant to Art. 6(1)(f) GDPR on the basis of the legitimate interest of PayPal in determining your ability to pay. PayPal uses the result of the credit check with regard to the statistical probability of payment default for the purpose of deciding on the provision of the respective payment method. The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. The calculation of the score values includes, among other things but not exclusively, address data. For further data protection information, including on the credit reference agencies used, please refer to the privacy policy of PayPal: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may remain entitled to process your personal data where this is necessary for contractual payment processing.
- Shopify Payments
We use the payment service provider "Shopify Payments", 3rd Floor, Europa House, Harcourt Building, Harcourt Street, Dublin 2. If you opt for a payment method offered via the payment service provider Shopify Payments, payment is processed via the technical service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to whom we disclose the information you provided during the ordering process, together with the information about your order (name, address, account number, bank code, any credit card number, invoice amount, currency and transaction number), pursuant to Art. 6(1)(b) GDPR. Your data is disclosed exclusively for the purpose of payment processing with Stripe Payments Europe Ltd. and only insofar as it is necessary for this. Further information on data protection at Shopify Payments can be found at the following internet address: https://www.shopify.com/legal/privacy.
Data protection information on Stripe Payments Europe Ltd. can be found here: https://stripe.com/de/privacy
8) Website functionalities
Google reCAPTCHA
On this website we also use the reCAPTCHA function of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). This function serves primarily to distinguish whether an entry is made by a natural person or is made abusively by machine and automated processing. The service includes the sending of the IP address and, where applicable, other data required by Google for the reCAPTCHA service to Google and takes place pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in determining individual personal responsibility on the internet and in preventing abuse and spam. When using Google reCAPTCHA, personal data may also be transmitted to the servers of Google LLC. in the USA.
Further information on Google reCAPTCHA and the privacy policy of Google can be found at: https://www.google.com/intl/de/policies/privacy/
Where legally required, we have obtained your consent to the processing of your data described above pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future. To exercise your withdrawal, please follow the option described above for lodging an objection.
9) Rights of the data subject
9.1 The applicable data protection law grants you the following data subject rights (rights of access and intervention) in relation to the controller with regard to the processing of your personal data, whereby reference is made to the legal basis cited for the respective conditions for exercising them:
- Right of access pursuant to Art. 15 GDPR;
- Right to rectification pursuant to Art. 16 GDPR;
- Right to erasure pursuant to Art. 17 GDPR;
- Right to restriction of processing pursuant to Art. 18 GDPR;
- Right to notification pursuant to Art. 19 GDPR;
- Right to data portability pursuant to Art. 20 GDPR;
- Right to withdraw consent given pursuant to Art. 7(3) GDPR;
- Right to lodge a complaint pursuant to Art. 77 GDPR.
9.2 RIGHT TO OBJECT
IF, AS PART OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.
IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.
10) Duration of storage of personal data
The duration of storage of personal data is determined by the respective legal basis, the purpose of processing and, where applicable, additionally by the respective statutory retention period (e.g. retention periods under commercial and tax law).
Where personal data is processed on the basis of express consent pursuant to Art. 6(1)(a) GDPR, this data is stored until the data subject withdraws their consent.
If statutory retention periods exist for data that is processed within the scope of obligations arising from legal transactions or quasi-legal transactions on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted after the expiry of the retention periods, provided it is no longer required for the performance or initiation of the contract and/or we no longer have a legitimate interest in further storage.
Where personal data is processed on the basis of Art. 6(1)(f) GDPR, this data is stored until the data subject exercises their right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.
Where personal data is processed for the purpose of direct marketing on the basis of Art. 6(1)(f) GDPR, this data is stored until the data subject exercises their right to object pursuant to Art. 21(2) GDPR.
Unless the other information in this policy on specific processing situations provides otherwise, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.
