Privacy Policy

1. Controller

The controller responsible for the processing of personal data in connection with this website and the online shop is:

ETERNESIS GmbH & Co. KG, Ericusspitze 4, 20457 Hamburg, Email: datenschutz@eternesis.com.

The competent data protection supervisory authority is the Hamburg Commissioner for Data Protection and Freedom of Information.

2. Purposes and Legal Bases of Processing

We process personal data only insofar as this is necessary for the following purposes: operation and provision of the online shop, contract processing and customer management, marketing and sales (e.g. newsletter), IT security and abuse prevention.

Legal bases:

  • Performance of a contract / pre-contractual measures: Art. 6(1)(b) GDPR
  • Compliance with legal obligations: Art. 6(1)(c) GDPR
  • Consent: Art. 6(1)(a) GDPR
  • Legitimate interest: Art. 6(1)(f) GDPR, in particular for the secure operation of the online shop, efficient communication, marketing and sales purposes, further development of our offering, as well as the operation and maintenance of a commission-based sales system.

3. Provision of the Website and Hosting

Our website and online shop are operated via an external platform and hosting service provider. For operating the online shop, we use in particular the e-commerce solution Shopify as well as infrastructure and security services (e.g. Cloudflare). With every access, technically necessary data is processed, in particular:

  • IP address
  • Date and time of access
  • Pages/files accessed
  • Referrer URL
  • Browser type and version, operating system, device type

Purpose: Provision, stability, and security of the online offering. Legal basis: Art. 6(1)(f) GDPR.

4. Contact

When you contact us by email, telephone, or contact form, we process the data you provide (e.g. name, contact details, content of the inquiry) in order to process your request. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures/contract) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries). The data is deleted as soon as it is no longer required for processing, unless legal obligations require longer storage.

5. Customer Account and Orders

To set up a customer account and process orders, we process in particular:

  • Master data (name, address, email address)
  • Login credentials (email address, password)
  • Order data (products, prices, timing, status)
  • Payment information (payment method chosen, payment status)
  • Communication data related to the order

This data is required to perform the contract; without it, concluding a contract via the online shop is not possible. Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(c) GDPR (statutory retention obligations).

6. Payment Processing

We use payment service providers to process payments. Depending on the payment method chosen, the data required to carry out the payment (e.g. order amount, currency, billing data, payment method) is transmitted to the respective payment service provider. Legal basis: Art. 6(1)(b) GDPR (contract performance), where applicable Art. 6(1)(f) GDPR (legitimate interest in secure payment processing). Payment service providers are generally independent controllers.

7. Shipping and Logistics

For the shipment of goods, we pass on the necessary data (name, delivery address, and where applicable, email address/phone number for shipment tracking). Legal basis: Art. 6(1)(b) GDPR.

8. Newsletter / Email Marketing

If you subscribe to our newsletter, we process your email address and, where applicable, your name in order to regularly send you information about products and promotions. External newsletter/marketing service providers (e.g. maileon) may be used for sending and managing the newsletter.

Legal basis: Your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with future effect (e.g. via the unsubscribe link in every email).

9. Communication Tools (Chat, Telephony, Messenger)

For customer communication, external telephony and communication services such as Placetel, Superchat, or messenger services such as WhatsApp Business may be used. In this context, contact data and communication content are processed. The use of messenger services requires that you use them yourself. Use is voluntary and may result in data being transferred to third countries (e.g. the USA). Data processing is carried out by the respective messenger service provider as an independent data controller. Legal basis: Art. 6(1)(b) GDPR (contract/inquiry) or Art. 6(1)(f) GDPR (legitimate interest in efficient communication). When using messenger services, please note that the respective operator is an independent controller.

10. Cookies; Consent; Tracking and Marketing Technologies

We use cookies and similar technologies:

  • Technically necessary cookies (e.g. for shopping cart, login, language) required for using the shop;
  • Optional cookies/technologies (e.g. for statistics, marketing, convenience functions) that are only used with your consent.

On your first visit, you will be shown a consent banner. There you can select which categories you agree to. You can change or withdraw your settings at any time with future effect.

Legal bases:

  • Technically necessary cookies: Art. 6(1)(b) or (f) GDPR in conjunction with Section 25(2) TDDDG [German Telecommunications and Telemedia Data Protection Act]
  • Optional cookies: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG

With your consent, we also use analytics and marketing technologies (e.g. web analytics, conversion measurement). Services such as Google Analytics, Google Tag Manager, Google Ads, Meta Conversion API, as well as LinkedIn Insight Tag, TikTok Pixel, Hotjar, or Varify.io may be used for this purpose. Cookies and comparable technologies are only set once you have given consent via the consent banner. Legal basis: Your consent (Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG). You can withdraw this consent at any time via the consent tool. A consent management tool may be used to manage consents. This may result in data transfers to third countries (outside the EU) in accordance with Section 14.

11. Product Recommendations

As part of our referral program, we process information about which referral partner (sales representative) a user came to our online shop through. For this purpose, technical identifiers (e.g. brand partner ID, affiliate ID, timestamp, and where applicable cookie/session ID) may be processed in order to attribute sales and settle commissions. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR in a functioning commission-based sales system; insofar as cookies are used for this purpose, this is done on the basis of your consent under Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG. For independent sales representatives, separate data protection notices attached as an appendix to the respective sales representative agreement apply in addition.

12. Integration of External Content (e.g. Videos)

Our website may embed external content (e.g. videos, maps). This concerns, in particular, embedded content such as videos from YouTube or Vimeo. When such content is accessed, technical data (IP address, device information, referrer URL) may be transmitted to the respective provider and cookies may be set. This content is only loaded if you have given your consent via the consent tool. Legal basis: Your consent (Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG).

13. Categories of Recipients

Recipients include in particular: IT and hosting service providers (including providers of shop solutions, infrastructure providers), payment service providers and banks, shipping and logistics service providers, CRM and email marketing service providers, communication platforms, marketing and tracking providers, as well as authorities. Insofar as service providers act on our behalf, a data processing agreement pursuant to Art. 28 GDPR is in place.

14. Data Transfer to Third Countries

Personal data is transferred to countries outside the European Union or the European Economic Area only if:

  • an adequacy decision by the EU Commission pursuant to Art. 45 GDPR exists, or
  • appropriate safeguards pursuant to Art. 46 GDPR are in place (in particular EU Standard Contractual Clauses), or
  • an exception under Art. 49 GDPR applies, or you have expressly consented.

This may affect services in the categories "hosting/IT," "analytics/tracking," "marketing," "communication services," and "embedded content," in particular from Google, Meta, HubSpot, or comparable providers. Further details can be found in the sections above.

15. Storage Period

We store personal data only for as long as is necessary for the respective purposes or as we are legally obligated to do so. This includes in particular:

  • Contract and order data: up to 10 years (commercial and tax law retention obligations)
  • Communication data (contact inquiries): until final processing, plus any applicable statutory limitation periods
  • Newsletter/marketing data: until you withdraw your consent
  • Cookie/tracking data: according to the retention periods specified in the consent tool

Data is subsequently deleted or anonymized.

16. Your Rights

Subject to the statutory requirements, you have in particular the right to:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Object to processing based on Art. 6(1)(e) or (f) GDPR, in particular against direct marketing (Art. 21 GDPR)
  • Withdraw consent given (Art. 7(3) GDPR) with future effect

To exercise these rights, you can contact us at any time using the contact details listed in section 1. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work, or the place of the alleged infringement.

17. Changes to This Privacy Policy

We reserve the right to amend this privacy policy if technical or legal circumstances change. The version published on this website at any given time shall apply.