1. Data protection at a glance

Data collection on this website

Who is responsible for the data collection on this website?

Data processing on this website is carried out by the website operator. You can find their contact details in the section "Note on the responsible body" in this privacy policy.

How do we collect your information?

On the one hand, your data is collected when you provide it to us. This can be, for example, data that you enter into a contact form.

Other data is collected automatically or with your consent when you visit the website by our IT systems. This is mainly technical data (e.g. Internet browser, operating system or time of page access). The collection of this data takes place automatically as soon as you enter this website.

What do we use your data for?

Part of the data is collected to ensure that the website is provided without errors. Other data may be used to analyze your user behavior.

What rights do you have regarding your data?

You have the right at any time to obtain information free of charge about the origin, recipient and purpose of your

stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time for the future. You also have the right to request the restriction of the processing of your personal data in certain circumstances. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time for this and other questions on the subject of data protection.

Analytics and third-party tools

When you visit this website, your surfing behaviour can be statistically evaluated. This is mainly done with so-called analysis programs.

Detailed information about these analysis programs can be found in the following privacy policy.

2. Hosting + Content Delivery

External Hosting

This website is hosted externally. The personal data collected on this website is stored on the servers of the hoster/hosters. This can include, but is not limited to, IP addresses, contact requests, meta and communication data, contract data, contact data, names, website accesses and other data generated via a website.

The external hosting is carried out for the purpose of fulfilling the contract with our potential and

existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of a secure, fast and efficient provision of our online offer by a professional provider (Art. 6 para. 1 lit. f GDPR).

If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDDG, insofar as the consent includes the storage of cookies or access to information in the user's end device (e.g. device fingerprinting) within the meaning of the TTDDG. The consent can be revoked at any time.

Our hoster(s) will only process your data to the extent necessary to fulfil its performance obligations and follow our instructions with regard to this data.

We use the following host(s):

Amazon Web Services (AWS)

The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg (hereinafter referred to as AWS).

When you visit our website, your personal data is processed on AWS's servers. Personal data may also be transferred to AWS's parent company in the USA. Data transfer to the USA is based on the EU Standard Contractual Clauses.

Details can be found here.

For more information, please refer  to  the AWS Privacy Statement.

The use of AWS is based on Art. 6 para. 1 lit. f GDPR. We have a legitimate

Interest in presenting our website as reliably as possible. Provided that a corresponding

consent has been requested, the processing is carried out exclusively on the basis of Art. 6 (1) (a) GDPR and § 25 (1) TDDDG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. The consent can be revoked at any time.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

Order processing

We have concluded a contract processing agreement (DPA) for the use of the above-mentioned service. This is a contract required by data protection law that ensures that it processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Cloudflare

We use the "Cloudflare" service. The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (hereinafter referred to as "Cloudflare").

Cloudflare offers a globally distributed content delivery network with DNS. Technically, the transfer of information between your browser and our website is routed via Cloudflare's network. This enables Cloudflare to analyze the traffic between your browser and our website and serve as a filter between our servers and potentially malicious traffic from the Internet. Cloudflare may also use cookies or other technologies to recognize Internet users, but these are used solely for the purpose described here.

The use of Cloudflare is based on our legitimate interest in providing our website as error-free and secure as possible (Art. 6 para. 1 lit. f GDPR).

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.cloudflare.com/privacypolicy/.

You can find more information about security and privacy at Cloudflare here: https://www.cloudflare.com/privacypolicy/.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link:

https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt0000000GnZKAA0&status=Active.

Order processing

We have concluded a contract processing agreement (DPA) for the use of the above-mentioned service. This is a contract required by data protection law that ensures that it processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

JSDelivr

To provide our website, we use the open source services of jsdelivr.com of the Polish software company ProspectOne, Królewska 65A/1, 30-081, Kraków, Poland. It is a content delivery network (CDN).

In order to provide this service,  your browser may send personal data to jsdelivr.com. jsDelivr can therefore collect and store user data such as IP address, browser type, browser version, which website is loaded, or the time and date of the page visit. However, as the site operator, we have no influence on possible further data processing by jsDelivr!

jsDelivr has servers distributed in different countries and your data may also be stored outside the European Economic Area. See our note on "Information on data transfer to the USA and other third countries".

If you have consented to the use of jsdelivr.com-CDN, the legal basis for the corresponding data processing is this consent. According to Art. 6 (1) (a) GDPR (consent), this consent constitutes the legal basis for the processing of personal data as it may occur during collection by jsdelivr.com-CDN.

We also have a legitimate interest in using jsdelivr.com-CDN to optimize our online service and make it more secure. The corresponding legal basis for this is Art. 6 (1) (f) GDPR (legitimate interests). Nevertheless, we only use the tool if you have given your consent.

For information on data processing by jsDelivr, see https://www.jsdelivr.com/privacy-policy-jsdelivr-net.

Unpkg

On our website, a web service of the company Npm, Inc., 1999 Harrison Street #1150, CA 94612 Oakland, United States of America (hereinafter: Unpkg) is loaded. If you have activated Java Script in your browser and have not installed a Java Script blocker, your browser may transmit personal data to Unpkg. Further information on the handling of the transmitted data can be found in Unpkg's privacy policy: https://www.npmjs.com/policies/privacy

You can prevent the collection and processing of your data by Unpkg by disabling the execution of script code in your browser or by installing a script blocker in your browser.

PINGDOM

On our website, we use "Pingdom", a service of SolarWinds Worldwide, LLC, 7171 Southwest Parkway, Bldg 400, Austin, Texas 78735, USA (hereinafter referred to as "SolarWinds"). Pingdom stores and processes information about your user behavior on our website. Pingdom uses cookies for this purpose, i.e. small text files that are stored locally in the cache of your web browser on your device and that enable an analysis of your use of our website.

We use Pingdom for marketing and optimization purposes, in particular to analyze the use of our website and to be able to continuously improve individual functions and offers as well as the user experience. By statistically evaluating user behaviour, we can improve our offer and make it more interesting for you as a user. This is also our legitimate interest in the processing of the above data by the third-party provider. The legal basis is Art. 6 para. 1 sentence 1 lit. f) GDPR.

You can prevent the installation of cookies by deleting existing cookies and deactivating the storage of cookies in the settings of your web browser. We would like to point out that in this case you may not be able to use all the functions of our website to their full extent. You can also prevent Pingdom from collecting the aforementioned information by setting an opt-out cookie on the website linked below:

Please note that this setting will be deleted if you delete your cookies. You can object to the collection and transfer of personal data or prevent the processing of this data by deactivating the execution of Java script in your browser. In addition, you can prevent the execution of Java script code altogether by installing a Java script blocker (e.g. www.noscript.net or www.ghostery.com). We would like to point out that in this case you may not be able to use all the functions of our website to their full extent.

Third-party information: SolarWinds Worldwide, LLC, 7171 Southwest Parkway, Bldg 400, Austin, Texas 78735, USA

Further information from the third-party provider on data protection can be found on the following website: www.solarwinds.com/legal/privacy

RAWGIT

On our site, we use the RawGit service of the company Ryan Grove, Portland, Oregon, United States, website: www.wonko.com. The processing also takes place in a third country for which there is no adequacy decision from the Commission. Therefore, the usual level of protection for the GDPR cannot be guaranteed during the transfer, as it cannot be ruled out that authorities in the third country, for example, can access the collected data.

The legal basis for the transfer of personal data is our legitimate interest in processing in accordance with Art. 6 (1) (f) GDPR. Our legitimate interest lies in achieving the purpose described below.

The service is a content delivery network that mirrors our content via various servers to ensure optimal accessibility worldwide.

With regard to processing, you have the right to object as set out in Art. 21. You can find more information at the end of this privacy policy.

3. General information and mandatory information

Privacy

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this data protection declaration.

When you use this website, various personal data is collected.

Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

We would like to point out that data transmission on the Internet (e.g. when communicating by e-mail) may have security gaps. It is not possible to completely protect the data from access by third parties.

Note on the responsible body

The person responsible for data processing on this website is:

WINORA-STAIGER GmbH

Max-Planck-Straße 6

97526 Sennfeld

Phone: +49 9721-65 01-0

E-mail: info@winora-group.de

The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of the processing of personal data (e.g. names, e-mail addresses, etc.).

Storage period

Unless a specific storage period has been specified in this privacy policy, your personal data will remain with us until the purpose for which the data is processed no longer applies. If you assert a justified request for erasure or revoke consent to data processing, your data will be deleted, unless we have other legally permissible grounds for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, the deletion takes place after these reasons have ceased to exist.

General information on the legal basis of data processing on this website

If you have consented to data processing, we process your personal data on the basis of Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR, insofar as special categories of data are processed in accordance with Art. 9 (1) GDPR. In the case of explicit consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Art. 49 (1) (a) GDPR. If you have consented to the storage of cookies or access to information in your device (e.g. via device fingerprinting), data processing will also be carried out on the basis of Section 25 (1) TTDDG. The consent can be revoked at any time. If your data is required for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6 (1) (b) GDPR. Furthermore, we process your data if it is necessary to comply with a legal obligation on the basis of Art. 6 (1) (c) GDPR.

Data processing may also be carried out on the basis of our legitimate interest in accordance with Art. 6 (1) (f) GDPR. Information on the relevant legal bases in each individual case is provided in the following paragraphs of this data protection declaration.

Data protection supervisor

We have appointed a data protection officer.

Dipl.-Ing. Lars Ebertz on behalf of EBERTZ DATENSCHUTZ GmbH

Ober den Wiesen 17

35756 Mittenaar

E-mail: lars@ebertz-datenschutz.de

Recipients of personal data

As part of our business activities, we work together with various external bodies. In some cases, it is also necessary to transmit personal data to these external bodies. We only pass on personal data to external bodies if this is necessary in the context of the performance of a contract, if we are legally obliged to do so (e.g. disclosure of data to tax authorities), if we have a legitimate interest in the disclosure in accordance with Art. 6 (1) (f) GDPR or if another legal basis allows the data transfer. When using

We only pass on personal data of our customers to processors on the basis of a valid contract for order processing. In the case of joint processing, a joint processing contract is concluded.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your explicit consent. You can revoke any consent you have already given at any time. The lawfulness of the data processing carried out up to the time of revocation remains unaffected by the revocation.

Right to object to data collection in special cases as well as to direct marketing (Art. 21 GDPR)

IF THE DATA PROCESSING IS CARRIED OUT ON THE BASIS OF ART. 6 PARA. 1 LIT. E OR F GDPR

YOU HAVE THE RIGHT AT ANY TIME TO WITHDRAW FROM THE

SITUATION AGAINST THE PROCESSING OF YOUR PERSONAL DATA

TO LODGE AN OBJECTION; THIS SHALL ALSO APPLY TO AN APPLICATION BASED ON THESE PROVISIONS

PROFILING. THE RESPECTIVE LEGAL BASIS ON WHICH THE PROCESSING IS BASED,

PLEASE REFER TO THIS PRIVACY POLICY. IF YOU FILE AN OBJECTION,

IF WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED, IT WILL BE

UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING OF

EVIDENCE THAT OUTWEIGHS YOUR INTERESTS, RIGHTS AND FREEDOMS OR THE PROCESSING SERVES TO ASSERT, EXERCISE OR DEFEND LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21 PARA. 1 GDPR).

YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING,

YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOU AT ANY TIME

CONCERNING PERSONAL DATA FOR THE PURPOSE OF SUCH ADVERTISING

; THIS ALSO APPLIES TO PROFILING, INSOFAR AS IT IS RELATED TO SUCH DIRECT ADVERTISING IN

CONNECTION. IF YOU OBJECT, YOUR PERSONAL DATA WILL THEN NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION PURSUANT TO ART. 21 PARA. 2 GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a

supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged infringement. The right of appeal exists without prejudice to other administrative or judicial remedies.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done to the extent that it is technically feasible.

Information, correction and deletion

Within the framework of the applicable legal provisions, you have the right to free use of the

Information about your stored personal data, its origin and recipients and the purpose of the data processing and, if applicable, a right to rectification or deletion of this data. You can contact us at any time for this and other questions on the subject of personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time for this. The right to restriction of processing exists in the following cases:

 If you contest the accuracy of your personal data stored by us, we will need

usually time to check this. For the duration of the audit, you have the right to request the restriction of the processing of your personal data.

 If the processing of your personal data was/is unlawful, you may

demand the restriction of data processing instead of deletion.

 If we no longer need your personal data, but you have used it to exercise it,

If you need to defend or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of erasure.

 If you have filed an objection in accordance with Art. 21 (1) GDPR, a balancing of your interests and ours must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data may only be processed with your consent or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as

Orders or inquiries that you send to us as the site operator require an SSL or TLS

Encryption. You can recognize an encrypted connection by the fact that the address bar of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Objection to advertising e-mails

The use of contact details published in the context of the imprint obligation for the sending of unsolicited advertising and information material is hereby contradicted. The operators of the pages expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, for example by spam e-mails.

4. Data collection on this website

Cookies

Our websites use so-called "cookies". Cookies are small data packets and target

Your device will not be harmed. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your device until you delete them yourself or until your web browser automatically deletes them.

Cookies can come from us (first-party cookies) or from third-party companies (so-called third-party cookies).

cookies). Third-party cookies enable the integration of certain services of

Third-party companies within websites (e.g. cookies used to process payment services).

Cookies have different functions. Many cookies are technically necessary because certain website functions would not work without them (e.g. the shopping cart function or the display of videos). Other cookies may be used to evaluate user behavior or for advertising purposes.

Cookies that are necessary to carry out the electronic communication process, to provide certain functions that you have requested (e.g. for the shopping cart function) or to optimise the website (e.g. cookies to measure the web audience) (necessary cookies) are stored on

on the basis of Art. 6 (1) (f) GDPR, unless another legal basis is indicated. The website operator has a legitimate interest in the storage of necessary cookies for the technically error-free and optimized provision of its services. If consent to the

storage of cookies and comparable recognition technologies, the processing is carried out exclusively on the basis of this consent (Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDDG); consent can be revoked at any time.

You can set your browser to inform you about the setting of cookies and

Allow cookies only in individual cases, exclude the acceptance of cookies for certain cases or in general

as well as enable the automatic deletion of cookies when the browser is closed. If you disable cookies, the functionality of this website may be limited.

You can find out which cookies and services are used on this website in this privacy policy.

OneTrust Consent Management

We offer you the opportunity to decide for yourself in detail in which cases you want to consent to tracking via cookies and other technologies - in order to display content relevant to you and offers tailored to you.

The processing of your data for the purposes stated here is partly based on legitimate interest, but in part we also require your consent. For this purpose, we use the Consent Management Platform (CMP) of OneTrust, LLC, 1350 Spring St NW, Atlanta, GA 30309, as a processor.

Onetrust's CMP enables you to give us data protection-compliant and self-determined consent to the processing of your data and to revoke it at any time. You can also object to data processing based on our legitimate interest. For more information on Onetrust's privacy and CMP, click here. 

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

Browser type and browser version operating system used

Referrer URL

Hostname of the accessing computer

Time of the server request IP address

This data is not merged with other data sources.

This data is collected on the basis of Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website – for this purpose, the server log files must be recorded.

Contact

If you send us inquiries via the contact form, your information from the

Enquiry form including the contact details you provide there for the purpose of processing the enquiry

and stored with us in the event of follow-up questions. We do not pass on this data without your consent.

The processing of this data is carried out on the basis of Art. 6 (1) (b) GDPR if your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the

Effective processing of the requests addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR), if this has been requested; consent can be revoked at any time.

The data you enter in the contact form will remain with us until you ask us to delete it, revoke your consent to its storage or the purpose for which the data is stored no longer applies

(e.g. after your request has been processed). Mandatory statutory provisions – in particular retention periods – remain unaffected.

Enquiry by e-mail, telephone or fax

If you contact us by e-mail, telephone or fax, your enquiry, including all personal data resulting from it (name, enquiry), will be stored and processed by us for the purpose of processing your request. We do not pass on this data without your consent.

The processing of this data is carried out on the basis of Art. 6 (1) (b) GDPR if your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the

Effective processing of the requests addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR), if this has been requested; consent can be revoked at any time.

The data you send to us via contact requests will remain with us until you ask us to delete it, revoke your consent to its storage or the purpose for which the data is stored no longer applies

(e.g. after your request has been processed). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

Salesforce Sales Cloud

We use Salesforce Sales Cloud to manage customer data. The provider is salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich (hereinafter referred to as "Salesforce").

Salesforce Sales Cloud is a CRM system and allows us, among other things, to manage existing and potential customers as well as customer contacts and to organize sales and communication processes. The use of the CRM system also enables us to analyse our customer-related processes. Customer data is stored on Salesforce's servers. In this context, personal data may also be transmitted to the parent company of salesforce.com Germany GmbH, salesforce.com inc., Salesforce Tower, 415 Mission Street, San Francisco, CA 94105, USA.

Details on Salesforce Sales Cloud features can be found here.

The use of Salesforce Sales Cloud is based on Art. 6 (1) (f) GDPR. The

Website operator has a legitimate interest in the most efficient customer administration and customer communication possible. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 (1) (a) GDPR and § 25 (1) TTDDG, insofar as the consent includes the storage of cookies or access to information in the user's end device (e.g. device fingerprinting) within the meaning of the TTDDG. The consent can be revoked at any time.

Salesforce has Binding Corporate Rules (BCR) approved by the French Data Protection Authority. These are binding internal company regulations that legitimize intra-company data transfers to third countries outside the EU and the EEA. Details can be found here.

For details, see  Salesforce's privacy policy.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

Order processing

We have concluded a contract processing agreement (DPA) for the use of the above-mentioned service. This is a contract required by data protection law that ensures that it processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

REGISTRATION ON THIS WEBSITE – BIKE GARAGE

You can register on this website to use additional features on the site. We will only use the data entered for this purpose for the purpose of using the respective offer or service of the Bike Garage for which you have registered. The mandatory information requested during registration must be provided in full. Otherwise, we will refuse registration.

For important changes, for example in the scope of the offer or in the event of technically necessary changes and information, we will use the e-mail address provided during registration to inform you in this way.

The processing of the data entered during registration is carried out for the purpose of executing the user relationship established by the registration and, if necessary, for the initiation of further contracts (Art. 6 para. 1 lit. b GDPR) and, if consent has been obtained, on the basis of Art. 6 para. 1 lit. a GDPR.

The data collected during registration will be stored by us - in Salesforce Sales Cloud - as long as you are registered in the Bike Garage and will then be deleted.

Statutory retention periods remain unaffected.

5. Analytics Tools and Advertising

Bing Ads

This website uses Bing Ads. Bing Ads is an online advertising program of Microsoft Corporation, One Microsoft Way, Redmond WA 94043, USA ("Microsoft"). As part of Microsoft Bing Ads, we use so-called conversion tracking. When you click on an ad served by Bing, a cookie is set for conversion tracking. Cookies are small text files that the Internet browser stores on the user's computer. These cookies expire after 30 days and are not used to personally identify users. If the user visits certain pages of this website and the cookie has not expired, Microsoft and we can tell that the user clicked on the ad and was redirected to that page. Each Microsoft Bing Ads customer receives a different cookie. The cookies cannot be tracked through the websites of Bing Ads customers. The information collected using the conversion cookie is used to compile conversion statistics for Bing Ads customers who have opted for conversion tracking. Customers will see the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users. If you do not wish to participate in tracking, you can object to this use by slightly deactivating the Bing Ads conversion tracking cookie via your Internet browser under User Settings. They will then not be included in the conversion tracking statistics. The storage of "conversion cookies" is based on Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in the analysis of user behaviour in order to optimise both its website and its advertising.

More information about Microsoft Bing Ads can be found in the privacy policy of

Microsoft: https://privacy.microsoft.com/de-de/privacystatement.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies in certain cases or in general, and activate the automatic deletion of cookies when you close the browser. If you disable cookies, the functionality of this website may be limited.

Clarity

This website uses Clarity. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, https://docs.microsoft.com/en-us/clarity/ (hereinafter referred to as "Clarity").

Clarity is a tool for analysing user behaviour on this website. In particular, Clarity records mouse movements and creates a graphical representation of which part of the website users scroll to particularly frequently (heat maps). Clarity may also record sessions so that we can view site usage in the form of videos. We also receive information about general user behavior within our website.

Clarity uses technologies that enable the recognition of the user for the purpose of analysing user behaviour (e.g. cookies or the use of device fingerprinting). Your personal data is stored on Microsoft's servers (Microsoft Azure Cloud Service) in the USA.

If consent has been obtained, the use of the above-mentioned service is carried out exclusively on the basis of Art. 6 (1) (a) GDPR and § 25 TDDDG. The consent can be revoked at any time. If no consent has been obtained, the use of this service is based on Art. 6 (1) (f) GDPR; the website operator has a legitimate interest in effective user analysis.

Further details on Clarity's data protection can be found here.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

Order processing

We have concluded a contract processing agreement (DPA) for the use of the above-mentioned service. This is a contract required by data protection law that ensures that it processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Google DoubleClick

This website uses functions of Google DoubleClick. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland, (hereinafter referred to as "DoubleClick").

DoubleClick is used to show you interest-based ads across the Google Network. With the help of DoubleClick, the advertisements can be tailored to the interests of the respective viewer. For example, our advertising may appear in Google search results or in banner ads associated with DoubleClick.

In order to be able to display interest-based advertising to users, DoubleClick must use the respective

viewer and tell them about their visited websites, clicks and other information about the

user behavior. To do this, DoubleClick uses cookies or comparable

recognition technologies (e.g. device fingerprinting). The information collected is used to

pseudonymous user profile in order to display interest-based advertising to the user in question.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDDG. The consent can be revoked at any time.

Further information on objection options against the advertisements displayed by Google can be found at the following links: and here.

Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that allows us to create tracking or statistics tools and other

technologies on our website. The Google Tag Manager itself does not create

user profiles, does not store cookies and does not carry out independent analyses. It only serves to

Administration and playout of the tools integrated via him. However, Google Tag Manager does collect your IP address, which may also be transmitted to Google's parent company in the United States.

The use of Google Tag Manager is based on Art. 6 para. 1 lit. f GDPR. The

Website operators have a legitimate interest in the quick and uncomplicated integration and management of various tools on their website. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1

TTDDG, insofar as the consent includes the storage of cookies or access to information in the user's end device (e.g. device fingerprinting) within the meaning of the TTDDG. The consent can be revoked at any time.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

Google Analytics

This website uses functions of the web analysis service Google Analytics. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse the behaviour of website visitors. In doing so, the website operator receives various usage data, such as page views, dwell time, operating systems used and origin of the user. This data is transferred to the respective terminal of the

Users. There is no assignment to a user ID.

Furthermore, we can use Google Analytics to, among other things: Record your mouse and scroll movements and clicks. In addition, Google Analytics uses various modeling approaches to complement the collected data sets and uses machine learning technologies in data analysis.

Google Analytics uses technologies that enable the recognition of the user for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is usually transmitted to a Google server in the USA and stored there.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDDG. The consent can be revoked at any time.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission.

Details can be found here.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

IP anonymization

Google Analytics IP anonymization is activated. As a result, your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before it is transmitted to the USA. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide further information with the website.

website use and internet use to provide services to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data held by Google.

Browser Plugin

You can prevent the collection and processing of your data by Google by  downloading and installing the browser plugin available at the following link.

You can find more information about the handling of user data by Google Analytics in  Google's privacy policy.

Order processing

We have concluded a contract processing agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

Google Ads

The website operator uses Google Ads. Google Ads is an online advertising program of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads enables us to display advertisements in the Google search engine or on third-party websites when the user enters certain search terms on Google (keyword targeting). In addition, targeted advertisements can be processed based on user data held by Google (e.g.

location data and interests) (target group targeting). As a website operator, we can evaluate this data quantitatively, for example by analysing which search terms led to the display of our advertisements and how many ads led to corresponding clicks.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDDG. The consent can be revoked at any time.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here and here .

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

Google Ads Remarketing

This website uses the functions of Google Ads Remarketing. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

With Google Ads Remarketing, we can assign people who interact with our online offer to specific target groups in order to then display interest-based advertising in the Google advertising network (remarketing or retargeting).

Furthermore, the advertising audiences created with Google Ads Remarketing can be linked to Google's cross-device functions. In this way, interest-based, personalised advertising messages that have been adapted to you depending on your previous usage and surfing behaviour on one device (e.g. mobile phone) can also be displayed on another of your devices (e.g. tablet or PC).

If you have a Google account, you can object to personalized advertising at the following link .

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDDG. The consent can be revoked at any time.

Further information and the privacy policy can be found in Google's privacy policy here.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The

DPF is an agreement between the European Union and the USA that aims to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

Target group creation with customer matching

For target group formation, we use, among other things, the customer match of Google Ads Remarketing.

In doing so, we transfer certain customer data (e.g. email addresses) from our customer lists to Google. If the customers in question are Google users and are logged in to their Google Account, they will be

Displays relevant advertising messages within the Google network (e.g. on YouTube, Gmail or in the search engine).

Google Conversion Tracking

This website uses Google Conversion Tracking. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

With the help of Google conversion tracking, Google and we can see whether the user has taken certain actions. For example, we can evaluate which buttons on our website have been clicked on how often and which products have been viewed or purchased particularly often. These

Information is used to compile conversion statistics. We learn the total number of users who clicked on our ads and what actions they took. We do not receive any information that allows us to personally identify the user. Google itself uses cookies or comparable recognition technologies for identification.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDDG. The consent can be revoked at any time.

You can find more information about Google conversion tracking in  Google's privacy policy:

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

PRIVACY POLICY FOR OUR GOOGLE ADS LEAD FORM EXTENSION

General information on data protection

The protection of your private rights and freedoms is important to us; we will only use your data for the intended purposes. Since it is important to us that you know at all times to what extent we collect, use and, if necessary, use your data. to third parties, we will inform you in detail below about the processing of your personal data (collected via our lead form).

When processing personal data, we strictly adhere to the requirements of the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) and, if applicable, the provisions of the German Data Protection Act. other data protection-relevant provisions.

Scope

This privacy policy applies exclusively to our Google Lead Form extension. It does not apply to Google's own content; You can find Google's privacy policy here   

Name and address of the data controller:

WINORA-STAIGER GmbH Max-Planck-Straße 6 97526 Sennfeld

Phone: 09721-65 01-0
Fax: 09721-65 01-45
E-mail: info@winora-group.de 

Name and address of the data protection officer

Dipl.-Ing. Lars Ebertz on behalf of EBERTZ DATENSCHUTZ GmbH Oberden Wiesen 17 35756 Mittenaar

eMail: lars(at)ebertz-datenschutz.de 

If you have any questions about the processing of your personal data, or if you wish to assert your rights as a data subject (such as the right to information, correction, blocking or deletion of data) or if you wish to revoke your consent, please contact our data protection officer directly.

Learn about Google Ads (lead form extension provider)

Google Ireland Limited Gordon House, Barrow Street Dublin 4 Ireland
Tel: +353 1 543 1000 Fax: +353 1 686 5660 E-mail: support-deutschland(at)google.com 

You can find Google's privacy policy here.

Google's Data Protection Officer

To reach Google's data protection officer, you can  fill out a corresponding contact form  under the following link:

Running our Google Ads lead form extension

Within the lead form extension, Google collects personal data for us. In particular, this is all data entered there – by you.

Interacting with our lead form

As soon as you enter data in our lead form, it will be stored in our Google Ads profile. Through our profile, we can download the data in bulk (manually or automatically) and use it for the purpose specified in the form.  The data will not be passed on to third parties.

We transfer the data to our CRM system (see SALESFORECE SALES CLOUD) and also compare it with any existing data sets in order to be able to assign them correctly.

As part of the Google Enhanced Conversion Tracking function, Google receives a so-called hash of the email identifier - there is no plain text transmission - for later recognition and correct assignment. See also the chapter 'GOOGLE (ENHANCED) CONVERSION-TRACKING' in the general privacy policy.

SALESFORCE SALES CLOUD

We use Salesforce Sales Cloud to manage customer data. The provider is salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich (hereinafter referred to as "Salesforce").

Salesforce Sales Cloud is a CRM system and allows us, among other things, to manage existing and potential customers as well as customer contacts – such as the Google LeadAd contacts – and to organize sales and communication processes. The use of the CRM system also enables us to analyse our customer-related processes. Customer data is stored on Salesforce's servers. Personal data may also be transmitted to the parent company of salesforce.com Germany GmbH, salesforce.com inc., Salesforce Tower, 415 Mission Street, San Francisco, CA 94105, USA.

Salesforce has Binding Corporate Rules (BCR) approved by the French Data Protection Authority. These are binding internal company regulations that legitimize intra-company data transfers to third countries outside the EU and the EEA.

Details can be found here.

Details can be found in  Salesforce's privacy policy:

Salesforce Order Processing

We have concluded an order processing agreement (DPA) with SALESFOREC. This is a contract required by data protection law that ensures that it processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Basic information on the deletion or blocking of personal data

We will only store your personal data for the period necessary to fulfil the specified purpose. After the purpose has ceased to exist and after expiry, if applicable. existing retention periods, your data will be deleted immediately. If deletion is not possible, the data will be blocked instead.

Rights of data subjects

Chapter III of the EU General Data Protection Regulation (GDPR) provides for extensive rights for data subjects, which we explain to you below with regard to the processing of your personal data:

1) Right to information This requirement applies in particular to information on the following details of data processing:

·        Purposes of processing

·        Categories of data

·        If applicable, recipients or categories of recipients

·        If applicable, the planned storage period or the criteria for determining this duration

·        Note on the respective right to rectification, deletion, restriction or objection

·        Existence of the right to lodge a complaint with a supervisory authority

·        If applicable, origin of the data (if not collected from you)

·        If necessary, the existence of automated decision-making including profiling including meaningful information about the logic involved, the scope and the expected effects

·        If applicable, (planned) transfer to a third country or international organisation

2) Right to correction We will immediately correct any incorrect data, provided that you inform us accordingly.

3) Right to erasure (right to be forgotten): provided that the processing is no longer necessary and one of the following conditions is met:

·        Elimination of the purpose of processing

·        Withdrawal of your consent and lack of any other legal basis for processing

·        Object to processing without an important reason to the contrary

·        Unlawful processing

·        Necessary to comply with a legal obligation

·        Data collection was carried out in accordance with Art. 8 (1) GDPR

We will respond to your request as part of the deletion request, if necessary. to those third parties to whom your data had previously been transferred.

4) Right to restriction of processing Provided that one of the following conditions is met:

·        You dispute the accuracy of your data (restriction can be made on our site for the duration of the review)

·        In the event of unlawful processing and if the data is not to be deleted, the deletion shall be replaced by a restriction of processing

·        If the processing purposes cease to apply, at the same time you need your data to assert, exercise or defend legal claims

·        After you have objected in accordance with Art. 21 (1) GDPR and for the duration of the examination, whether our legitimate reasons outweigh yours.

5) Right to data portability If it is technically possible and does not affect the rights and freedoms of other persons, we will – at your request – transfer your data to another recipient (controller).

6) Right to object If we collect or have collected and process personal data from you (on the basis of Art. 6 para. 1 e or f or Art. 9 para. 2 a GDPR), you have the right to object to the data processing (including profiling) at any time (with effect for the future). In exceptional cases, the objection may be invalid, e.g. if we can prove compelling legitimate interests for the processing that outweigh your interests or if the processing serves to assert, exercise or defend legal claims. Where we process your personal data for direct marketing purposes, you have the right to object to this processing at any time. This also applies to profiling, insofar as it is related to such direct advertising. You also have the right to object to the processing of your data concerning you that we carry out for scientific or historical research purposes or for statistical purposes in accordance with Art. 89 (1) GDPR, unless such processing is necessary for the performance of a task in the public interest.

7) Automated decision-making on a case-by-case basis, including profiling To the extent that we collect, or have collected and process personal data from you, you have the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal effects concerning you or similarly significantly affects you. Exceptions to this requirement apply if the decision is necessary for the conclusion or performance of a contract between you and us or if you have expressly consented to the processing. In any case, we will take reasonable steps to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain the intervention of a person on our part, to express your point of view and to challenge the decision.

8) Right to withdraw consent under data protection law You have the right to revoke your consent to the processing of personal data at any time.

9) Right to lodge a complaint with a supervisory authority You can access a list of the competent supervisory authorities in Germany on the website of the Federal Commissioner for Data Protection or under the following link:
https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/AufsBehoerdFuerDenNichtOeffBereich/AufsichtsbehoerdenNichtOeffBereich_liste.html

Legal basis for processing

We process personal data in accordance with the requirements of the GDPR, depending on the type and purpose of the processing, as follows:

Informed consent

Article 6(1a)

Safeguarding our legitimate interest

Art. 6 para. 1 f

Our legitimate interest

Our legitimate interest, as defined in accordance with Article 6 (1) (f) GDPR, is based on the performance of our business activities, the maintenance of our operational capacity and the securing of the employment of our employees.

Existence of automated decision-making

We do not use automatic decision-making and do not use any techniques to carry out profiling measures.

Service provider for Google marketing

If we use service providers for the data processing of our Google Lead forms, we conclude corresponding contracts for order processing (DPA) with them. In the course of this, we regulate the scope and under which security conditions the processing of the data takes place and determine the necessary authority to issue instructions in accordance with Art. 28 GDPR

GOOGLE (ENHANCED) CONVERSION TRACKING

This website uses Google Conversion Tracking. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

With the help of Google conversion tracking, Google and we can see whether the user has taken certain actions. For example, we can evaluate which buttons on our website have been clicked on how often and which products have been viewed or purchased particularly often.

Information is used to compile conversion statistics. We learn the total number of users who clicked on our ads and what actions they took. We do not receive any information that allows us to personally identify the user. Google itself uses cookies or comparable recognition technologies for identification.

If you give your consent, we will transmit the e-mail address provided during the purchase of one of our products to Google by means of a secure (hashed) procedure in order to be able to carry out a possible conversion (so-called ENHANCED CONVERSION). This conversion can then generate statistics that provide us with information about the course and development of a purchase in order to optimize our processes.

You can find more information about Google conversion tracking in Google's privacy policy: . The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG. The consent can be revoked at any time with effect for the future. 

Meta pixel (formerly Facebook Pixel)

This website uses the Facebook/Meta visitor action pixel to measure conversion. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. However, according to Facebook, the data collected will also be transferred to the USA and other third countries.

In this way, the behavior of the site visitors can be tracked after they have clicked on a

Facebook ad was redirected to the provider's website. This allows the effectiveness of Facebook ads to be evaluated for statistical and market research purposes and future advertising measures to be optimized.

The data collected is anonymous for us as the operator of this website, we cannot draw any conclusions about the identity of the users. However, the data is stored and processed by Facebook so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes, in accordance with the Facebook Data Use Policy). This allows Facebook to enable the placement of advertisements on and off Facebook pages. This use of the data cannot be influenced by us as the site operator.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG. The consent can be revoked at any time.

We use the function of advanced matching within the meta pixels.

Advanced matching allows us to submit to Meta (Facebook) different types of data (e.g., city, state, zip code, hashed email addresses, names, gender, date of birth, or phone number) of our customers and prospects that we collect through our website. This activation allows us to tailor our advertising campaigns on Facebook even more precisely to people who are interested in our offers. In addition, advanced matching improves website conversion attribution and expands Custom Audiences.

Insofar as personal data is collected on our website with the help of the tool described here, and sent to

Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square,

Grand Canal Harbour, Dublin 2, Ireland is jointly responsible for this data processing (Art. 26

GDPR). The joint responsibility is limited exclusively to the recording of the

Data and its disclosure to Facebook. The processing by Facebook after the transfer is not part of the joint responsibility. The obligations incumbent on us together

have been set out in a joint processing agreement. The text of the agreement can be found here. According to this agreement, we are responsible for the provision of data protection information when using the Facebook tool and for the implementation of the tool on our website in a manner that is secure under data protection law. Facebook is responsible for the data security of Facebook's products. You can assert the rights of data subjects (e.g. requests for information) regarding the data processed by Facebook directly with Facebook. If you assert your rights as a data subject with us, we are obliged to forward them to Facebook.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission.

Details can be found here:

and here.

In Facebook's privacy policy you will find further information on how to protect your privacy.

You can also turn off the Custom Audiences remarketing feature in the Ads Settings section of . To do this, you must be logged in to Facebook.

If you do not have a Facebook account, you can opt out of Facebook's usage-based advertising on the European Interactive Digital Advertising Alliance website: /.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

SMARTFIT – Onlinesizing.bike

You can use Smartfit Online Sizing on our website. Smartfit is a solution from Radlabor GmbHHeinrich-von-Stephan-Str. 5c, 79100 Freiburg (https://www.onlinesizing.bike/).

You can download the application on our website.

To get a size recommendation for a specific bike, you can submit the following information through the application:

1.                       Gender (mandatory)

2.                       Height (required)

3.                       Leg length (optional)

4.                       Arm length (optional)

Smartfit calculates a specific size recommendation for a bike using algorithms that find the right bike size based on your anthropometric data and gender. In some cases, you can transfer your preferred bike size from the application to your personal shopping cart via a button on the results screen.

USE OF PERSONAL INFORMATION FROM OUR APPLICATION

We will only use your personal data from the Application for the following purposes:

·        Recommendation of bike sizes in real time.

·        Providing fit prediction services in our partners' online stores.

·        Optimizing the overall quality of our referral mechanisms.

·        Statistical analysis of the number of bike sizes over time.

All personal data is processed anonymously and Smartfit never collects or processes personal data (e.g. real name, address data, payment information). All data is stored on servers and databases located either in Frankfurt, Germany, or in Nuremberg, Germany. No data will be transferred outside the European Union. All data is automatically deleted after a certain retention period.

We do not use data for marketing or advertising purposes.

COOKIES

We use a local storage cookie to store the following information:

1.                       Gender (mandatory)

2.                       Height (required)

3.                       Leg length (if specified by the user)

4.                       Arm length (if specified by the user)

We store this data along with a session identifier in your local storage. The cookie is considered necessary for technical reasons. Without the cookie, the Online Sizing Widget cannot be used sensibly. The cookie allows us to identify returning users so that you do not have to re-enter your basic information when you use the application again. The token (JWT) is renewed after a user has been inactive for 4 hours.

In some cases, the cookie allows the immediate display of size recommendations on the product detail pages of our partners' webshops without using the application again. In some cases, our application transmits the recommended size to a partner store (i.e. so that the recommended size is automatically selected in a drop-down on the product page). When the Smartfit recommendation engine is enabled, you don't have to re-enter your basic information, with the recommended bikes displayed in new browser tabs.

SAFETY AND SECURITY

We use appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss and/or destruction as well as against access by unauthorised persons. Our security measures are subject to continuous improvement in line with current technological developments.

Further data processing by Radlabor GmbH – in the sense of independent or instruction-bound data processing – does not take place!

Survicate

We use the "Survicate" service of Survicate sp. z o.o., Przyrynek 14, Warsaw, Poland, for the creation and evaluation of customer surveys. This allows us to constantly improve our services and adapt them to user requirements. The service does not collect data automatically, but we send invitations to participate in the surveys on a case-by-case basis, which are completely voluntary. If you participate in the surveys , the data entered there will be processed, in individual cases these may be personal, but the surveys are generally anonymous.

For more information, please visit  .

YOTPO REVIEWS

On the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offer within the meaning of Article 6 (1) (f) GDPR), we use the Yotpo app from the provider Yotpo, 33 West 19th Street, 5th Floor, New York, NY 10011 (https://www.yotpo.com) within our online offer in order to use its content and services to evaluate purchases. For this purpose, we forward personal data of our customers who have made a purchase to said company.

For this offer, emails will be sent after a set period of time asking you to rate your purchase.

This serves to improve the user experience of our web shop through individual and independent evaluations of our products and services.

Yotpo's Privacy Policy : https://www.yotpo.com/privacy-policy/

6. Newsletter

Newsletter data

If you would like to subscribe to the newsletter offered on the website, we require an email address from you as well as information that allows us to verify that you are the owner of the e-mail address provided and that you agree to receive the newsletter. Other data is not collected or is only collected on a voluntary basis. We use this data exclusively for sending the requested information and do not pass it on to third parties.

The data entered in the newsletter registration form will be processed exclusively on

Basis of your consent (Art. 6 para. 1 lit. a GDPR). You can revoke your consent to the storage of the data, the e-mail address and its use for sending the newsletter at any time, for example via the "unsubscribe" link in the newsletter. The lawfulness of the data processing operations that have already taken place remains unaffected by the revocation.

The data you provide to us for the purpose of subscribing to the newsletter will be processed by us until your

unsubscribe from the newsletter is stored by us or the newsletter service provider and deleted from the newsletter distribution list after unsubscribing from the newsletter or after the purpose has ceased to exist. We reserve the right to delete or block e-mail addresses from our newsletter distribution list at our own discretion within the scope of our legitimate interest in accordance with Art. 6 (1) (f) GDPR.

Data that has been stored by us for other purposes remains unaffected by this.

After you have unsubscribed from the newsletter distribution list, your e-mail address will be sent to us or the

Newsletter service providers may be stored in a blacklist, if this is necessary to prevent future mailings. The data from the blacklist will only be used for this purpose and will not be merged with other data. This serves both your interest and our interest in complying with the legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR). The storage in the blacklist is not limited in time. You can object to the storage if your interests outweigh our legitimate interest.

We use the Salesforce Sales Cloud to send our newsletter emails. For more information, see the Salesforce Sales Cloud chapter  .

7. Plugins and Tools

AWIN AFFILIATE PROGRAM

On the basis of your express consent in accordance with Art. 6 (1) (a) GDPR, we use components of the company AWIN on our website. AWIN is a German affiliate network and serves as an interface between merchants and distributors.

Affiliate marketing is an Internet-based form of distribution that enables commercial operators of websites, the so-called merchants or advertisers, to display advertising, which is usually remunerated by click or sale commissions, on the websites of third parties, i.e. sales partners, who are also called affiliates or publishers. The merchant provides an advertising medium via the affiliate network, i.e. an advertising banner or other suitable means of internet advertising, which are subsequently integrated by an affiliate on its own websites or advertised via other channels, such as keyword advertising or e-mail marketing.

AWIN's operating company is AWIN AG, Eichhornstraße 3, 10785 Berlin, Germany.

AWIN places a cookie on the data subject's information technology system. What cookies are has already been explained above. AWIN's tracking cookie does not store any personal data. Only the identification number of the affiliate, i.e. that of the potential customer referring partner, as well as the serial number of the visitor to a website and the clicked advertising material are stored. The purpose of storing this data is to process commission payments between a merchant and the affiliate, which are processed via the affiliate network, i.e. AWIN.

The data subject can prevent the setting of cookies by our website, as already described above, at any time by means of a corresponding setting of the Internet browser used and thus permanently object to the setting of cookies. Such a setting of the Internet browser used would also prevent AWIN from placing a cookie on the data subject's information technology system. In addition, cookies already set by AWIN can be deleted at any time via an Internet browser or other software programs.

AWIN's applicable privacy policy can be accessed at: www.awin.com/de/rechtliches/privacy-policy.

YouTube

This website embeds videos from the YouTube website. The website is operated by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit one of our websites on which YouTube is integrated, a connection to YouTube's servers is established. The YouTube server is informed which of our pages you have visited.

Furthermore, YouTube may store various cookies on your device or use comparable technologies for recognition (e.g. device fingerprinting). This allows YouTube to obtain information about visitors to this website. This information is provided, inter alia:

used to collect video statistics, improve the user experience and prevent fraud attempts.

If you are logged in to your YouTube account, you enable YouTube to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account.

YouTube is used in the interest of an appealing presentation of our online offerings.

This constitutes a legitimate interest within the meaning of Art. 6 (1) (f) GDPR. Provided that a corresponding

consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a

GDPR and § 25 (1) TTDDG, insofar as the consent includes the storage of cookies or access to information in the user's end device (e.g. device fingerprinting) within the meaning of the TTDDG. The consent can be revoked at any time.

For more information on how user data is handled, please see YouTube's privacy policy here.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The

DPF is an agreement between the European Union and the USA that aims to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

Google Fonts

This site uses so-called Google Fonts, which are provided by Google, for the uniform display of fonts. When you call up a page, your browser loads the required fonts into your browser cache in order to display texts and fonts correctly.

For this purpose, the browser you use must connect to Google's servers. This makes Google aware that this website has been accessed via your IP address. The use of Google Fonts is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the uniform presentation of the typeface on its website. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDDG, insofar as the consent includes the storage of cookies or access to information in the user's end device (e.g. device fingerprinting) within the meaning of the TTDDG. The consent can be revoked at any time.

If your browser does not support Google Fonts, a default font will be used by your computer.

You can find more information about Google Fonts at and in Google's privacy policy.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

Google Maps

This site uses the Google Maps map service. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

In order to use the functions of Google Maps, it is necessary to store your IP address. These

Information is usually transmitted to a Google server in the USA and stored there. The provider of this site has no influence on this data transfer. If Google Maps is enabled, Google may use Google Fonts for the purpose of displaying fonts consistently. When you call up Google Maps, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly.

The use of Google Maps is in the interest of an appealing presentation of our online offers and to make it easy to find the places we indicate on the website. This constitutes a legitimate interest within the meaning of Art. 6 (1) (f) GDPR. Provided that a corresponding

consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a

GDPR and § 25 (1) TTDDG, insofar as the consent includes the storage of cookies or access to information in the user's end device (e.g. device fingerprinting) within the meaning of the TTDDG. The consent can be revoked at any time.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission.

Details can be found here and here.

You can find more information on the handling of user data in  Google's privacy policy:

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

Google reCAPTCHA

We use "Google reCAPTCHA" (hereinafter "reCAPTCHA") on this website. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

The purpose of reCAPTCHA is to verify whether data is entered on this website (e.g. in a contact form) by a human or by an automated program. To do this, reCAPTCHA analyzes the behavior of the website visitor based on various characteristics. This analysis begins automatically as soon as the website visitor enters the website. For analysis,

reCAPTCHA collects various information (e.g. IP address, time spent on the website by the website visitor or mouse movements made by the user). The data collected during the analysis is forwarded to Google.

The reCAPTCHA analyses run completely in the background. Website visitors are not informed that an analysis is taking place.

The storage and analysis of the data is carried out on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in protecting its websites from abusive automated spying and spam. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1

TTDDG, insofar as the consent includes the storage of cookies or access to information in the user's end device (e.g. device fingerprinting) within the meaning of the TTDDG. The consent can be revoked at any time.

For more information about Google reCAPTCHA, please refer to the Google Privacy Policy and the Google Terms of Service at the following links.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

Hotjar

This website uses Hotjar. The provider is Hotjar Ltd., Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe (Website: https://www.hotjar.com).

Hotjar is a tool for analysing your user behaviour on this website. With Hotjar, we can, among other things: Record your mouse and scroll movements and clicks. Hotjar can also determine how long you have stayed on a certain spot with the mouse pointer. From this information, Hotjar creates so-called heat maps, which can be used to determine which website areas are preferred by the website visitor.

We can also determine how long you stayed on a page and when you left it. We can also determine at which point you have abandoned your entries in a contact form (so-called conversion funnels).

In addition, Hotjar can be used to collect direct feedback from website visitors. This function serves to improve the website operator's web offerings.

Hotjar uses technologies that enable the recognition of the user for the purpose of analysing user behaviour (e.g. cookies or the use of device fingerprinting).

If consent has been obtained, the assignment will be carried out in this way. g. service exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 TDDDG. The consent can be revoked at any time. If no consent has been obtained, the use of this service is based on Art. 6 (1) (f) GDPR; the website operator has a legitimate interest in the analysis of user behaviour in order to optimise both its website and its advertising.

Disabling Hotjar

If you want to opt out of Hotjar's data collection, click on the following link and follow the instructions there.

Please note that the deactivation of Hotjar must be done separately for each browser or device.

For more information about Hotjar and the data collected, please refer to Hotjar's privacy policy at the following link: https://www.hotjar.com/privacy

Order processing

We have concluded a contract processing agreement (DPA) for the use of the above-mentioned service. This is a contract required by data protection law that ensures that it processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

8. Our social media presences

This privacy policy applies to the following social media presences

https://www.facebook.com/haibike.official/

https://www.instagram.com/haibikeofficial/

https://www.youtube.com/channel/UCh-aXMY-o1SBqzkcAGuhBkw

Data processing through social networks

We maintain publicly accessible profiles on social networks. The social networks we use in detail can be found below.

Social networks such as Facebook, X, etc. can usually analyze your user behavior comprehensively when you visit their website or a website with integrated social media content (e.g. like buttons or advertising banners). Visiting our social media presences triggers numerous data protection-relevant processing operations. In detail:

If you are logged into your social media account and visit our social media presence, the operator of the social media portal can assign this visit to your user account. However, your personal data may also be collected if you are not logged in or do not have an account with the respective social media portal. In this case, this data collection is carried out, for example, via cookies that are stored on your device or by recording your IP address.

With the help of the data collected in this way, the operators of the social media portals can create user profiles in which your preferences and interests are stored. In this way, interest-based advertising can be shown to you on and off the respective social media presence. If you have an account with the respective social network, interest-based advertising can be displayed on all devices on which you are logged in or were logged in.

Please also note that we cannot track all processing processes on the social media portals. Depending on the provider, further processing operations may therefore be carried out by the

operators of the social media portals. Details can be found in the terms of use and privacy policy of the respective social media portals.

Legal basis

Our social media presences are intended to ensure the widest possible presence on the Internet. This is a legitimate interest within the meaning of Art. 6 (1) (f) GDPR. The social

networks may be based on different legal bases, which must be indicated by the operators of the social networks (e.g. consent within the meaning of Art. 6 para. 1 lit. a

GDPR).

Controller and exercise of rights

If you visit one of our social media presences (e.g. Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered during this visit. In principle, you can assert your rights (information, correction, deletion, restriction of processing, data portability and complaint) against us as well as against the operator of the respective social media portal (e.g. against Facebook).

Please note that despite the joint responsibility with the social media portal operators, we do not have full influence on the data processing processes of the social media portals. Our options are largely based on the corporate policy of the respective provider.

Storage period

The data collected directly by us via the social media presence will be deleted from our systems as soon as you ask us to delete it, revoke your consent to its storage or the purpose for which it was stored no longer applies. Stored cookies remain on your device until you delete them. Mandatory legal provisions – esp. retention periods – remain unaffected.

We have no influence on the storage period of your data, which is stored by the operators of the social networks for their own purposes. For details, please contact the operators of the social networks directly (e.g. in their privacy policy, see below).

Your rights

You have the right at any time to obtain information free of charge about the origin, recipient and purpose of your

stored personal data. They also have the right to object, to

data portability and a right to lodge a complaint with the competent supervisory authority. You can also request the rectification, blocking, deletion and, in certain circumstances, the restriction of the processing of your personal data.

Social networks in detail

Facebook

We have a profile on Facebook. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter referred to as Meta). According to Meta, the data collected will also be transferred to the USA and other third countries.

We have concluded a joint processing agreement (Controller Addendum) with Meta. This Agreement sets out which data processing operations we or Meta are responsible for when you visit our Facebook page. You can view this agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum.

You can adjust your advertising settings independently in your user account. To do this, click on the following link and log in:.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission.

Details can be found here and here.

Details can be found in  Facebook's privacy policy:

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link:

Instagram

We have a profile on Instagram. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission.

Details can be found here.

Details on their handling of your personal data can be found in  Instagram's privacy policy.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

YouTube

We have a profile on YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Details on their handling of your personal data can be found in YouTube'  s privacy policy:

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link: