Privacy

Data protection

Unless otherwise stated below, the provision of your personal data is neither required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide the data. Failure to provide has no consequences. This only applies if no other information is given in the subsequent processing operations.
"Personal data" is all information that relates to an identified or identifiable natural person.

Customer account - orders      

Customer account
When you open a customer account, we collect your personal data to the extent specified there. The data processing serves the purpose of improving your shopping experience and simplifying order processing. The processing takes place on the basis of Art. 6 Paragraph 1 lit. a GDPR with your consent. You can revoke your consent at any time by notifying us without affecting the legality of the processing carried out on the basis of the consent up to the point of revocation. Your customer account will then be deleted.

Contact - Newsletter      

Collection and processing when using the contact form
When you use the contact form, we collect your personal data (name, email address, message text) only to the extent that you have made available. The data processing serves the purpose of establishing contact. By sending your message, you consent to the processing of the transmitted data. The processing takes place on the basis of Art. 6 Paragraph 1 lit. a GDPR with your consent.
You can revoke your consent at any time by notifying us without affecting the legality of the processing carried out on the basis of the consent up to the point of revocation. We only use your email address to process your request. Your data will then be deleted unless you have consented to further processing and use.

Use of the email address for sending newsletters
We use your e-mail address, regardless of the contract processing, exclusively for our own advertising purposes for sending the newsletter, provided you have expressly consented to this. The processing takes place on the basis of Art. 6 Paragraph 1 lit. a GDPR with your consent. You can revoke your consent at any time without affecting the legality of the processing carried out on the basis of the consent up to the time of revocation.
You can cancel the receipt of our newsletter at any time, i.e. revoke your consent. This means that your consent to its dispatch and the statistical analyzes will expire at the same time. You will find a link to cancel the newsletter at the end of each newsletter.

Your data will be passed on to a service provider for email marketing as part of order processing. Your data will not be passed on to other third parties.

Merchandise management      

Use of an external inventory control system
We use a merchandise management system for contract processing as part of order processing. For this purpose, your personal data collected as part of the order will be sent to
Shopify International Limited; Victoria Buildings, 2nd Floor 1-2 Haddington Road; Dublin 4, D04 XN32, Ireland 
transmitted.

Payment service provider - credit report      

Use of PayPal
All PayPal transactions are subject to the PayPal privacy policy. You can find this under https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Use of personal data when choosing Klarna as the payment method
If you have opted for Klarna's payment services Klarna invoice and / or Klarna installment purchase as a payment option, you have consented to us providing the following personal data such as first and last name, address, date of birth, which is necessary for processing the purchase on account and an identity and credit check , Gender, email address, IP address, telephone number and the data necessary for processing the purchase on account that are related to the order, such as the number of items, item number, invoice amount and taxes in percent, collected and sent to Klarna have submitted. The data processing serves the purpose of offering the payment types purchase on account and hire purchase as well as the necessary credit check. The processing takes place on the basis of Art. 6 Paragraph 1 lit. a GDPR with your consent. You can revoke your consent at any time by notifying us without affecting the legality of the processing carried out on the basis of the consent up to the point of revocation.
This data is transmitted so that Klarna can create an invoice and carry out an identity and credit check to process your purchase with the invoice processing you want. Klarna needs the personal data of the buyer in order to obtain information from credit agencies for the purpose of identity and credit checks. In Germany, these can be the following credit reporting agencies:
- Schufa Holding AG, Kormoranweg 5, 65203 Wiesbaden
- Bürgel Wirtschaftsinformationen GmbH & Co. KG, PO Box 5001 66, 22701 Hamburg
- Creditreform Bremen Seddig KG, Contrescarpe 17, 28203 Bremen
- infoscore Consumer Data GmbH, Rheinstrasse 99, 76532 Baden-Baden.
As part of the decision on the establishment, implementation or termination of the contractual relationship, apart from an address check, Klarna also collects and uses information on the previous payment behavior of the buyer as well as probability values for this behavior in the future. The calculation of these score values by Klarna is carried out on the basis of a scientifically recognized mathematical-statistical procedure. Klarna will also use your address data. If this calculation shows that your creditworthiness is not given, Klarna will inform you of this immediately.

Revocation of the use of personal data by Klarna
1. You can revoke your consent to the use of personal data by Klarna at any time. However, Klarna may still be entitled to process, use and transmit the personal data, insofar as this is necessary for contractual payment processing by Klarna's services, is legally required, or is required by a court or an authority.
2. You can of course receive information about the personal data stored by Klarna at any time. This right is guaranteed by the Federal Data Protection Act. If you, as a buyer, wish to do so, or if you want to notify Klarna of any changes to the stored data, you can contact datenschutz@klarna.de.

Analysis - advertising      

The data processing described below in this section, in particular the setting of cookies, is carried out on the basis of Art. 6 Para. 1 lit. f GDPR out of our overriding legitimate interest: 

- on the needs-based and targeted design of the website, e.g. for analysis and statistics tools 

- Addressing the site visitors in a targeted manner with interest-based advertising, e.g. with conversion tracking

For reasons that arise from your particular situation, you have the right to object at any time to this processing of personal data relating to you based on Article 6 (1) (f) GDPR.

Use of Google Analytics
We use the web analysis service Google Analytics from Google LLC on our website. (1600 Amphitheater Parkway, Mountain View, CA 94043, USA; "Google").
If you have your habitual residence in the European Economic Area or Switzerland, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is the person responsible for your data. Google Ireland Limited is therefore the company affiliated with Google, which is responsible for the processing of your data and compliance with the applicable data protection laws.
The data processing serves the purpose of analyzing this website and its visitors. For this purpose, Google will use the information obtained on behalf of the operator of this website to evaluate your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.
Google Analytics uses cookies, which enable your use of the website to be analyzed. The information generated by the cookies about your use of this website is usually transferred to a Google server in the USA and stored there. IP anonymization is activated on this website. As a result, your IP address will be shortened beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. The full IP address will only be sent to a Google server in the USA and shortened there in exceptional cases.
Google has certified itself under the US-EU data protection agreement “Privacy Shield” and is thus obliged to comply with European data protection guidelines.
You can prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading the browser plug-in available under the following link and install [https://tools.google.com/dlpage/gaoptout?hl=de].
To prevent data collection and storage by Google Analytics across devices, you can set an opt-out cookie. Opt-out cookies prevent the future collection of your data when you visit this website. You must perform the opt-out on all systems and devices used for this to have a comprehensive effect. If you delete the opt-out cookie, inquiries will be sent to Google again. If you click here, the opt-out cookie will be set: Deactivate Google Analytics.
For more information on terms of use and data protection, see https://www.google.com/analytics/terms/de.html or under https://www.google.de/intl/de/policies/.

Use of Google Ads conversion tracking
We use the online advertising program “Google Ads” on our website and, in this context, conversion tracking (evaluation of visits). Google Conversion Tracking is an analysis service provided by Google LLC (1600 Amphitheater Parkway, Mountain View, CA 94043, USA; “Google”).
If you have your habitual residence in the European Economic Area or Switzerland, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is the person responsible for your data. Google Ireland Limited is therefore the company affiliated with Google, which is responsible for the processing of your data and compliance with the applicable data protection laws.
If you click on an ad placed by Google, a conversion tracking cookie will be placed on your computer. These cookies have a limited validity, do not contain any personal data and are therefore not used for personal identification. If you visit certain pages on our website and the cookie has not yet expired, we and Google can tell that you clicked on the ad and were redirected to this page. Each Google Ads customer receives a different cookie. This means that there is no way that cookies can be tracked via the websites of Ads customers.
The information that is obtained with the help of the conversion cookie is used to generate conversion statistics. Here we find out the total number of users who clicked on one of our ads and were redirected to a page with a conversion tracking tag. However, we do not receive any information with which users can be personally identified.
Your data may be transmitted to the USA. Google has certified itself according to the US-EU data protection agreement “Privacy Shield” and is thus obliged to comply with European data protection guidelines.
You can deactivate personalized advertising for you in the advertising settings on Google. Instructions can be found at https://support.google.com/ads/answer/2662922?hl=de.
Alternatively, you can prevent the use of cookies by third parties by visiting the deactivation page of the Network Advertising Initiative https://www.networkadvertising.org/choices/ call up and implement the further information on opt-out mentioned there.
You will then not be included in the conversion tracking statistics.
You can find more information and Google's privacy policy at: https://www.google.de/policies/privacy/

Use of Facebook remarketing
We use the remarketing function “Custom Audiences” from Facebook Inc. (1601 S. California Ave, Palo Alto, CA 94304, USA; “Facebook”) on our website.
The purpose of the application is to target visitors to the website with interest-based advertising on the Facebook social network.
For this purpose, the Facebook remarketing tag was implemented on the website. A direct connection to the Facebook servers is established via this tag when you visit the website. This will tell the Facebook server which of our pages you have visited. Facebook assigns this information to your personal Facebook user account. If you visit the social network Facebook, you will then be shown personalized, interest-based Facebook ads.
Your data may be transmitted to the USA. Facebook has certified itself according to the US-EU data protection agreement "Privacy Shield" and is thus obliged to comply with European data protection guidelines.
You can use the remarketing function "Custom Audiences" here deactivate.
For more information on the collection and use of data by Facebook, your rights in this regard and options for protecting your privacy, see the Facebook data protection information at https://www.facebook.com/about/privacy/.

Plug-ins

Facebook plugins (Like & Share button)
Plugins of the social network Facebook, provider Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA, are integrated on our pages. You can recognize the Facebook plugins by the Facebook logo or the "Like" button on our website. You can find an overview of the Facebook plugins here: https://developers.facebook.com/docs/plugins/.
When you visit our website, the plug-in establishes a direct connection between your browser and the Facebook server. Facebook receives the information that you have visited our site with your IP address. If you click the Facebook "Like" button while you are logged into your Facebook account, you can link the content of our pages to your Facebook profile. This enables Facebook to assign your visit to our website to your user account. We would like to point out that, as the provider of the pages, we have no knowledge of the content of the transmitted data or their use by Facebook. You can find more information on this in Facebook's data protection declaration at: https://de-de.facebook.com/policy.php.
If you do not want Facebook to be able to assign your visit to our website to your Facebook user account, please log out of your Facebook user account.

Instagram plugin
Functions of the Instagram service are integrated into our website. These functions are offered by Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA.
If you are logged into your Instagram account, you can link the contents of our pages to your Instagram profile by clicking the Instagram button. This enables Instagram to assign your visit to our website to your user account. We would like to point out that, as the provider of the pages, we have no knowledge of the content of the data transmitted or its use by Instagram.
You can find more information on this in Instagram's privacy policy: https://instagram.com/about/legal/privacy/.

Pinterest plugin
On our site we use social plugins from the social network Pinterest, which is operated by Pinterest Inc., 808 Brannan Street, San Francisco, CA 94103-490, USA ("Pinterest").
When you call up a page that contains such a plugin, your browser establishes a direct connection to the Pinterest servers. The plugin transmits log data to the Pinterest server in the USA. This log data may contain your IP address, the address of the websites visited, which also contain Pinterest functions, the type and settings of the browser, the date and time of the request, your use of Pinterest and cookies.
Further information on the purpose, scope and further processing and use of the data by Pinterest as well as your related rights and options for protecting your privacy can be found in the privacy policy of Pinterest: https://about.pinterest.com/de/privacy-policy.

Use of Vimeo
We use plug-ins from Vimeo Inc. (555 West 18th Street New York, New York 10011, USA; “Vimeo”) on our website to integrate videos from the “Vimeo” portal.
If you call up pages on our website with such a plug-in, a connection to the Vimeo servers is established and the plug-in is displayed on the page by a message to your browser. As a result, both your IP address and the information about which of our pages you have visited are transmitted to the Vimeo servers.
If you are logged in to Vimeo, Vimeo will assign this information to your personal user account. When using the plug-in functions (e.g. by starting a video by pressing the corresponding button), this information is also assigned to your Vimeo account.
Your data may be transmitted to the USA. Vimeo has certified itself according to the US-EU data protection agreement “Privacy Shield” and thus committed to comply with European data protection guidelines.
The processing takes place on the basis of Art. 6 Paragraph 1 lit. f GDPR from Vimeo's legitimate interest in market analysis and in improving its services in a needs-based and targeted manner.
If you do not want Vimeo to directly associate the information collected with your Vimeo account, you must log out of Vimeo before visiting our website.
You can find more information on the purpose and scope of the collection and on the further use and processing of the data by Vimeo as well as your rights and options for protecting your privacy in Vimeo's data protection information: https://vimeo.com/privacy

Affected rights and storage duration

Duration of storage
After the contract has been fully processed, the data is initially stored for the duration of the warranty period, then taking into account statutory, in particular tax and commercial retention periods, and then deleted after the deadline, unless you have consented to further processing and use.

Rights of the data subject
If the legal requirements are met, you have the following rights according to Art. 15 to 20 GDPR on: Right to information, to correction, to deletion, to restriction of processing, to data portability.
In addition, according to Art. 21 Paragraph 1 GDPR, you have the right to object to processing based on Art. 6 Paragraph 1 f GDPR, as well as against processing for the purpose of direct mail.

Contact us if you wish. The contact details can be found in our imprint.

You can contact our data protection officer directly at: Guido von Thadden
gvonthadden@paperandtea.com

Right of appeal to the supervisory authority
According to Art. 77 GDPR, you have the right to complain to the supervisory authority if you are of the opinion that your personal data is not being processed lawfully.

Right to object
If the personal data processing listed here is based on our legitimate interest in accordance with Article 6 (1) (f) GDPR, you have the right to object to this processing at any time with future effect for reasons that arise from your particular situation.
After the objection has been made, the processing of the data concerned will be terminated unless we can demonstrate compelling legitimate reasons for the processing that outweigh your interests, rights and freedoms, or if the processing serves to assert, exercise or defend legal claims.

If the personal data processing takes place for the purposes of direct advertising, you can object to this processing at any time by notifying us. After the objection has been made, we will stop processing the data concerned for the purpose of direct advertising.