Data protection

1) Introduction and contact details of the controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about the handling of your personal data when using our website. Personal data is any data that can be used to personally identify you.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is BRAND THAT REMAINS GmbH, Robert-Koch-Straße 30, 38642 Goslar, Germany, Tel.: 04022859906, E-Mail: info@brandthatremains.com. The controller responsible for the processing of personal data is the natural or legal person who, alone or jointly with others, decides on the purposes and means of the processing of personal data.

2) Data collection when visiting our website

2.1 When using our website for information purposes only, i.e., if you do not register or otherwise transmit information to us, we only collect data that your browser transmits to the site server (so-called "server log files"). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

Our visited website
Date and time at the moment of access
Amount of data sent in bytes
Source/reference from which you reached the page
Browser used
Operating system used
IP address used (if applicable: in anonymized form)

Processing is carried out in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used for any other purpose. We do, however, reserve the right to check the server log files subsequently should there be concrete evidence of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the string "https://" and the lock symbol in your browser line.

3) Cookies

To make visiting our website attractive and to enable the use of certain functions, we use cookies, which are small text files stored on your device. Some of these cookies are automatically deleted after you close your browser (so-called "session cookies"), while others remain on your device for longer and allow for the saving of page settings (so-called "persistent cookies"). In the latter case, you can check the storage duration in the overview of your web browser's cookie settings.

Insofar as personal data is also processed by individual cookies used by us, the processing is carried out in accordance with Art. 6 (1) (b) GDPR either for the performance of the contract, in accordance with Art. 6 (1) (a) GDPR in the case of consent granted, or in accordance with Art. 6 (1) (f) GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the page visit.

You can set your browser so that you are informed about the setting of cookies and decide individually whether to accept them or exclude the acceptance of cookies for certain cases or in general.

Please note that if cookies are not accepted, the functionality of our website may be limited.

4) Contacting us

When contacting us (e.g., via contact form or email), personal data is processed exclusively for the purpose of handling and answering your request and only to the extent necessary for this purpose.

The legal basis for the processing of this data is our legitimate interest in answering your request in accordance with Art. 6 (1) (f) GDPR. If your contact is aimed at a contract, an additional legal basis for processing is Art. 6 (1) (b) GDPR. Your data will be deleted when it can be inferred from the circumstances that the matter in question has been finally clarified and provided that no statutory storage obligations conflict with this.

5) Data processing when opening a customer account

In accordance with Art. 6 (1) (b) GDPR, personal data will continue to be collected and processed to the extent necessary if you provide it to us when opening a customer account. The data required for opening an account can be found in the input mask of the corresponding form on our website.

Deletion of your customer account is possible at any time and can be done by sending a message to the aforementioned address of the controller. After deletion of your customer account, your data will be deleted, provided all contracts concluded through it have been fully settled, no statutory retention periods conflict with this, and there is no remaining legitimate interest on our part for further storage.

6) Use of customer data for direct advertising

MailChimp

Our email newsletters are sent via the following provider: The Rocket Science Group, LLC d/b/a MailChimp, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA

Based on our legitimate interest in effective and user-friendly newsletter marketing, we pass on the data you provided during newsletter registration to this provider in accordance with Art. 6 (1) (f) GDPR so that they can take over the newsletter dispatch on our behalf.

Subject to your explicit consent in accordance with Art. 6 (1) (a) GDPR, the provider also conducts a statistical evaluation of the success of newsletter campaigns using web beacons or tracking pixels in the sent emails, which can measure open rates and specific interactions with the newsletter's content. Device information (e.g., time of access, IP address, browser type, and operating system) is also collected and evaluated, but not merged with other data sets.

You can revoke your consent to newsletter tracking at any time with effect for the future.

We have concluded a data processing agreement with the provider, which protects the data of our site visitors and prohibits disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

7) Data processing for order fulfillment

7.1 As far as necessary for contract fulfillment for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6 (1) (b) GDPR.

Insofar as we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we process the contact data provided by you during the order process in order to inform you personally within the scope of our statutory information obligations in accordance with Art. 6 (1) (c) GDPR. Your contact data will be used strictly for the purpose of communicating updates owed by us and will only be processed by us to the extent necessary for the respective information.

To process your order, we also work together with the service provider(s) listed below, who support us entirely or partially in the execution of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

7.2 To fulfill our contractual obligations to our customers, we work with external shipping partners. We pass on your name as well as your delivery address and, if necessary for delivery, your telephone number to a shipping partner selected by us, exclusively for the purpose of delivering goods in accordance with Art. 6 (1) (b) GDPR.

7.3 DHL Fulfillment

For order fulfillment, we use the following provider: DHL Home Delivery GmbH, Sträßchensweg 10, 53113 Bonn, Germany

Name, address, and, if applicable, other personal data are passed on to the provider exclusively for the purpose of processing the online order in accordance with Art. 6 (1) (b) GDPR. Your data is only passed on to the extent that it is actually necessary for the fulfillment of the order.

7.4 Use of payment service providers

- Apple Pay

If you choose the "Apple Pay" payment method from Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, the payment processing is carried out via the "Apple Pay" function of your device operated with iOS, watchOS, or macOS by charging a payment card stored in "Apple Pay". Apple Pay uses security features integrated into the hardware and software of your device to protect your transactions. Therefore, to authorize a payment, you must enter a code previously set by you and verify it using the "Face ID" or "Touch ID" function of your device.

For the purpose of payment processing, your information provided during the order process, along with information about your order, is transmitted to Apple in encrypted form. Apple then encrypts this data again with a developer-specific key before it is transmitted to the payment service provider of the payment card stored in Apple Pay to carry out the payment. Encryption ensures that only the website through which the purchase was made can access the payment data. After the payment has been made, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website to confirm the success of the payment.

Insofar as personal data is processed during the described transmissions, the processing is carried out exclusively for the purpose of payment processing in accordance with Art. 6 (1) (b) GDPR.

Apple retains anonymized transaction data, including the approximate purchase amount, approximate date and time, and whether the transaction was completed successfully. Anonymization completely excludes any personal reference. Apple uses the anonymized data to improve "Apple Pay" and other Apple products and services.

If you use Apple Pay on an iPhone or Apple Watch to complete a purchase you initiated via Safari on a Mac, the Mac and the authorization device communicate via an encrypted channel on Apple's servers. Apple does not process or store any of this information in a format that can identify you. You can disable the ability to use Apple Pay on your Mac in your iPhone settings. Go to "Wallet & Apple Pay" and deactivate "Allow Payments on Mac".

Further information on data protection with Apple Pay can be found at the following internet address: https://support.apple.com/de-de/HT203027
- Paypal

One or more online payment methods of the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method from the provider where you make an advance payment, your payment data provided during the order process (including name, address, bank and payment card information, currency, and transaction number) as well as information about the content of your order will be passed on to them in accordance with Art. 6 (1) (b) GDPR. In this case, your data is passed on exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

If you select a payment method where we make an advance payment, you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, telephone number, and, if applicable, data for an alternative payment method).

In order to safeguard our legitimate interest in determining your creditworthiness in such cases, this data is forwarded by us to the provider for the purpose of a credit check in accordance with Art. 6 (1) (f) GDPR. Based on the personal data you have provided and other data (such as shopping cart, invoice amount, order history, payment experiences), the provider checks whether the payment method you have selected can be granted with regard to payment and/or default risks.

The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical method. Address data, among other things, is included in the calculation of the score values.

You can object to this processing of your data at any time by sending us a message or by contacting the provider. However, the provider may still be entitled to process your personal data if this is necessary for contractual payment processing.
- Unzer

One or more online payment methods of the following provider are available on this website: Payolution GmbH, Columbusplatz 7-8, Stiege 1 / 5. Stock, 1100 Vienna, Austria

If you select a payment method from the provider where you make an advance payment (such as credit card payment), your payment data provided during the order process (including name, address, bank and payment card information, currency, and transaction number) as well as information about the content of your order will be passed on to them in accordance with Art. 6 (1) (b) GDPR. In this case, your data is passed on exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

If you select a payment method where the provider makes an advance payment (such as purchase on account or installment payment or direct debit), you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, telephone number, and, if applicable, data for an alternative payment method).

In order to safeguard our legitimate interest in determining the creditworthiness of our customers, this data is forwarded by us to the provider for the purpose of a credit check in accordance with Art. 6 (1) (f) GDPR. Based on the personal data you have provided and other data (such as shopping cart, invoice amount, order history, payment experiences), the provider checks whether the payment method you have selected can be granted with regard to payment and/or default risks.

For the decision within the scope of the application review, identity and credit information from the following credit agencies may be included in addition to provider-internal criteria in accordance with Art. 6 (1) (f) GDPR:

SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden, Germany
CRIF GmbH, Diefenbachgasse 35, 11 50 Vienna, Austria
CRIF AG, Hagenholzstrasse 81, 8050 Zurich, Switzerland
CRIF GmbH, Leopoldstraße 244, 80807 Munich, Germany
SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden, Germany
KSV1870 Information GmbH, Wagenseilgasse 7, 1100 Vienna, Austria
Creditreform Boniversum GmbH, Hellersbergstr. 11, 41460 Neuss, Germany
infoscore Consumer Data GmbH, Rheinstrasse 99, 76532 Baden-Baden, Germany
ProfileAddress Direktmarketing GmbH, Altmannsdorfer Strasse 311, 1230 Vienna, Austria
Emailage LTD, 1 Fore Street Ave, London, EC2Y 5EJ, United Kingdom
ThreatMetrix, The Base 3/F, Tower C, Evert van de Beekstraat 1, 1118 CL Schiphol, Netherlands
payolution GmbH, Columbuscenter, Columbusplatz 7-8, 1100 Vienna, Austria
Universum Business GmbH, Hanauer Landstr. 164, 60314 Frankfurt am Main, Germany

8) Retargeting/ Remarketing and Conversion Tracking

Meta Pixel with advanced data matching

Within our online services, we use the "Meta Pixel" service of the following provider in advanced data matching mode: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Meta")

If a user clicks on an advertisement placed by us on Facebook or Instagram, the URL of our linked page is extended by a parameter with the help of "Meta Pixel". This URL parameter is then entered into the user's browser after the redirection by a cookie that our linked page itself sets. Furthermore, this cookie collects specific customer data such as the email address, which we collect on our website linked to the Facebook or Instagram ad during processes such as purchases, account registrations, or sign-ups (advanced data matching). The cookie is then read and enables the transmission of the data, including specific customer data, to Meta.

We use "Meta Pixel" with advanced matching to make our advertisements ("Ads") on Facebook and/or Instagram more effective and to ensure that they correspond to the interests of users or have certain characteristics (e.g., interests in certain topics or products determined based on the websites visited), which we transmit to Meta (so-called "Custom Audiences").

In addition, we analyze the effectiveness of our advertisements by tracking whether users were redirected to our website after clicking on an advertisement (conversion). Compared to the standard version of "Meta Pixel," the advanced matching feature helps us better measure the effectiveness of our advertising campaigns by capturing more attributed conversions.

All transmitted data is stored and processed by Meta so that it can be linked to the respective user profile and Meta can use the data for its own advertising purposes in accordance with Meta's Data Policy (https://www.facebook.com/about/privacy/). The data may enable Meta and its partners to display ads on and off Facebook.

All processing described above, in particular the setting of cookies for reading information on the terminal device used, will only be carried out if you have given us your express consent in accordance with Art. 6(1)(a) GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with the provider, which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

The information generated by Meta is generally transferred to a Meta server and stored there; in this context, data may also be transferred to servers of Meta Platforms Inc. in the USA.

9) Tools and Miscellaneous

9.1 - DATEV

For accounting purposes, we use the service of the cloud-based accounting software from the following provider: DATEV eG, Paumgartnerstr. 6-14, 90429 Nuremberg, Germany.

The provider processes incoming and outgoing invoices as well as, if applicable, the bank transactions of our company in order to automatically record invoices, match them to transactions, and generate financial accounting in a semi-automated process.

Insofar as personal data is processed in this context, the processing is based on our legitimate interest in the efficient organization and documentation of our business transactions in accordance with Art. 6(1)(f) GDPR.

9.2 Cookie Consent Tool

This website uses a so-called "Cookie Consent Tool" to obtain effective user consent for cookies and cookie-based applications that require consent. The "Cookie Consent Tool" is displayed to users when they visit the page in the form of an interactive user interface on which consent for specific cookies and/or cookie-based applications can be given by checking a box. Through the use of this tool, all cookies/services requiring consent are only loaded if the respective user gives their consent by checking the box. This ensures that such cookies are only set on the user's respective terminal device if consent has been given.

The tool sets technically necessary cookies to save your cookie preferences. In principle, personal user data is not processed here.

If, in individual cases, personal data (such as the IP address) is processed for the purpose of saving, assigning, or logging cookie settings, this is done in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in legally compliant, user-specific, and user-friendly consent management for cookies, and thus in a legally compliant design of our website.

A further legal basis for the processing is Art. 6(1)(c) GDPR. As the controller, we are subject to the legal obligation to make the use of technically unnecessary cookies dependent on the respective user consent.

Where necessary, we have concluded a data processing agreement with the provider, which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

Further information on the operator and the setting options of the Cookie Consent Tool can be found directly in the corresponding user interface on our website.

10) Rights of the Data Subject

10.1 The applicable data protection law grants you the following data subject rights (rights of access and intervention) vis-à-vis the controller regarding the processing of your personal data, whereby reference is made to the stated legal basis for the respective exercise requirements:

Right of access pursuant to Art. 15 GDPR;
Right to rectification pursuant to Art. 16 GDPR;
Right to erasure pursuant to Art. 17 GDPR;
Right to restriction of processing pursuant to Art. 18 GDPR;
Right to notification pursuant to Art. 19 GDPR;
Right to data portability pursuant to Art. 20 GDPR;
Right to withdraw consent granted pursuant to Art. 7(3) GDPR;
Right to lodge a complaint pursuant to Art. 77 GDPR.

10.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA AS PART OF A BALANCING OF INTERESTS BASED ON OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OUTWEIGH YOUR INTERESTS, FUNDAMENTAL RIGHTS, AND FREEDOMS, OR IF THE PROCESSING SERVES THE ASSERTION, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

11) Duration of storage of personal data

The duration of the storage of personal data is determined by the respective legal basis, the purpose of the processing and – if applicable – additionally by the respective statutory retention periods (e.g., commercial and tax law retention periods).

When processing personal data on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the data concerned is stored until you revoke your consent.

If there are statutory retention periods for data that is processed within the scope of legal or quasi-legal obligations on the basis of Art. 6(1)(b) GDPR, this data will be routinely deleted after the retention periods have expired, provided it is no longer required for the performance of the contract or the initiation of a contract and/or we no longer have a legitimate interest in further storage.

When processing personal data on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights, and freedoms, or the processing serves the assertion, exercise, or defense of legal claims.

When processing personal data for the purpose of direct marketing on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(2) GDPR.

Unless otherwise stated in the other information of this declaration regarding specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.