Privacy Policy

1) Information about the collection of personal data and the controller's contact details

1.1 The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Kurz & Lankow GbR Hochkönigstr. 2 83395 Freilassing Germany Phone: 08654 4069830 Email: [email protected] Partners: Mario Kurz, Philipp Lankow

The controller responsible for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

1.3 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the string „https://“ and the lock symbol in your browser bar.

2) Data collection when visiting our website

When you use our website for information purposes only, i.e. when you do not register or otherwise transmit information to us, we collect only the data that your browser transmits to our server (so-called „server log files“). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

• The website you visited
• The date and time of access
• The amount of data sent, in bytes
• The source/referrer from which you reached the page
• The browser used
• The operating system used
• The IP address used (in anonymized form where applicable)

Processing takes place pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used in any other way. However, we reserve the right to subsequently review the server log files if there are concrete indications of unlawful use.

3) Cookies

To make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your device. Some of these cookies are automatically deleted again once you close your browser (so-called „session cookies“), while others remain on your device for longer and enable settings to be saved (so-called „persistent cookies“). In the latter case, you can find the storage duration in the cookie-settings overview of your web browser.

Insofar as personal data is also processed by individual cookies we use, the processing takes place pursuant to Art. 6(1)(b) GDPR either for the performance of the contract, pursuant to Art. 6(1)(a) GDPR where consent has been given, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a user-friendly and effective design of the site visit.

You can set your browser so that you are informed about the setting of cookies and can decide individually whether to accept them, or exclude the acceptance of cookies for certain cases or in general.

Please note that if you do not accept cookies, the functionality of our website may be limited.

4) Contacting us

When you contact us (e.g. via the contact form or email), personal data is processed solely for the purpose of handling and responding to your request and only to the extent necessary for this. The legal basis for processing this data is our legitimate interest in responding to your request pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted once it can be inferred from the circumstances that the matter in question has been conclusively clarified, provided there are no statutory retention obligations to the contrary.

5) Data processing when opening a customer account

Pursuant to Art. 6(1)(b) GDPR, personal data will continue to be collected and processed to the extent required if you provide it to us when opening a customer account. You can find out which data is required to open an account from the input form on our website. You can delete your customer account at any time by sending a message to the controller's address stated above. After deletion of your customer account, your data will be deleted, provided all contracts concluded through it have been fully performed, no statutory retention periods stand in the way, and we have no legitimate interest in continued storage.

6) Data processing for order fulfillment

6.1 Insofar as necessary for the performance of the contract for delivery and payment purposes, the personal data we collect is passed on pursuant to Art. 6(1)(b) GDPR to the commissioned transport company and the commissioned credit institution.

Insofar as we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we process the contact data you provided when ordering (name, address, email address) in order to inform you personally, within the framework of our statutory information obligations pursuant to Art. 6(1)(c) GDPR, about upcoming updates within the legally prescribed period via a suitable communication channel (e.g. by mail or email). Your contact data is used strictly for the purpose of notifications about updates we owe and is processed by us for this purpose only to the extent necessary for the respective information.

To process your order, we also work with the following service providers, who support us in whole or in part with the performance of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

6.2 Use of payment service providers (payment services)

• Mollie: If you choose a payment method from the payment service provider Mollie, payment is processed via the payment service provider Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands, to whom we pass on the information you provided during the ordering process together with information about your order (name, address, IBAN, BIC, invoice amount, currency and transaction number) pursuant to Art. 6(1)(b) GDPR. Your data is passed on solely for the purpose of payment processing with the payment service provider Mollie and only to the extent necessary for this.
• Stripe: If you choose a payment method from the payment service provider Stripe, payment is processed via the payment service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. For this purpose we transmit the information provided during the ordering process together with information about your order (name, address, email address, invoice amount, currency and, where applicable, account or credit card details and transaction number) pursuant to Art. 6(1)(b) GDPR to Stripe. Your data is passed on solely for the purpose of payment processing with Stripe and only to the extent necessary for this.

7) Tools and other matters

sevDesk: To handle our accounting, we use the sevDesk service, the cloud-based accounting software of sevDesk GmbH, Hauptstraße 115, 77652 Offenburg.

sevDesk processes incoming and outgoing invoices and, where applicable, our company's bank transactions, in order to automatically capture invoices, match them to transactions and use this to create the financial accounting in a partially automated process.

Insofar as personal data is also processed in this context, the processing takes place pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the efficient organization and documentation of our business processes.

You can find more information about sevDesk GmbH, the automated processing of data and the data protection provisions at https://sevdesk.de/sicherheit-datenschutz/

8) Rights of the data subject

8.1 The applicable data protection law grants you the following data-subject rights (rights to information and intervention) vis-à-vis the controller with regard to the processing of your personal data, whereby reference is made to the legal basis cited for the respective conditions of exercise:

• Right of access pursuant to Art. 15 GDPR
• Right to rectification pursuant to Art. 16 GDPR
• Right to erasure pursuant to Art. 17 GDPR
• Right to restriction of processing pursuant to Art. 18 GDPR
• Right to notification pursuant to Art. 19 GDPR
• Right to data portability pursuant to Art. 20 GDPR
• Right to withdraw consent given pursuant to Art. 7(3) GDPR
• Right to lodge a complaint pursuant to Art. 77 GDPR

8.2 Right to object

Insofar as we process your personal data on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to this processing with effect for the future.

After you exercise your right to object, we will stop processing the data concerned, unless we can demonstrate compelling legitimate grounds for further processing that override your interests, rights and freedoms, or unless the processing serves the assertion, exercise or defense of legal claims.

If your personal data is processed for the purpose of direct marketing, you can object at any time to the processing of your personal data for these purposes. The right to object can be exercised in the manner described above.

After receiving your objection, we will immediately stop processing your personal data for the purposes of direct marketing.

9) Duration of storage of personal data

The duration of storage of personal data is determined by the respective legal basis, the purpose of processing and, where applicable, additionally by the respective statutory retention period (e.g. retention periods under commercial and tax law).

Where personal data is processed on the basis of explicit consent pursuant to Art. 6(1)(a) GDPR, this data is stored until the data subject withdraws their consent.

Where statutory retention periods exist for data processed in the context of legal or quasi-legal obligations on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted after the retention periods expire, provided it is no longer required for the performance or initiation of the contract and/or we have no legitimate interest in continued storage.

Where personal data is processed on the basis of Art. 6(1)(f) GDPR, this data is stored until the data subject exercises their right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for processing that override the interests, rights and freedoms of the data subject, or unless the processing serves the assertion, exercise or defense of legal claims.

Where personal data is processed for the purpose of direct marketing on the basis of Art. 6(1)(f) GDPR, this data is stored until the data subject exercises their right to object pursuant to Art. 21(2) GDPR.

Unless otherwise stated in the other information in this declaration about specific processing situations, stored personal data is otherwise deleted once it is no longer necessary for the purposes for which it was collected or otherwise processed.