Privacy policy
Privacy Policy
Privacy Policy
Unless otherwise specified below, the provision of your personal data is neither required by law nor by contract, nor is it necessary for the conclusion of a contract. You are not obligated to provide this data. Failure to provide such data has no consequences. This applies only to the extent that no other information is provided regarding the processing operations described below.
“Personal data” refers to any information relating to an identified or identifiable natural person.
Each time you access our website, your internet browser transmits usage data to us or our web host/IT service provider, and this data is stored in log files (so-called server log files). This stored data includes, for example, the name of the page accessed, the date and time of access, the IP address, the amount of data transferred, and the requesting provider.
Processing is based on Article 6(1)(f) of the GDPR, grounded in our overriding legitimate interest in ensuring the smooth operation of our website and in improving our services.
Your data may be transferred to and processed in third countries outside the EU, in particular to Canada and the United States. An adequacy decision by the European Commission exists for Canada. For the United States, an adequacy decision by the European Commission exists in the form of the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to those of the European Commission’s Standard Contractual Clauses.
Contact
Data Controller
Please contact us if you wish. The data controller is: HOYER GmbH, Steinbruchstr. 18, 82398 Polling, Germany, +49(0)881 3015, info@hoyer-honig.de
Unsolicited Contact by the Customer via Email
If you initiate business contact with us via email, we will collect your personal data (name, email address, message text) only to the extent you provide it. The data is processed for the purpose of handling and responding to your inquiry.
If the contact serves to carry out pre-contractual measures (e.g., consultation regarding a purchase interest, preparation of a quote) or relates to a contract already concluded between you and us, this data processing is based on Article 6(1)(b) of the GDPR.
If you contact us for other reasons, this data processing is based on Article 6(1)(f) of the GDPR, based on our overriding legitimate interest in processing and responding to your inquiry. In this case, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(f) of the GDPR.
We use your email address solely to process your inquiry. Your data will subsequently be deleted in accordance with statutory retention periods, unless you have consented to further processing and use.
Collection and Processing When Using the Contact Form at
When youuse the contact form, we collect your personal data (name, email address, message text) only to the extent you provide it. The purpose of this data processing is to establish contact.
If the contact serves to carry out pre-contractual measures (e.g., consultation regarding a purchase interest, preparation of a quote) or relates to a contract already concluded between you and us, this data processing is based on Article 6(1)(b) of the GDPR.
If contact is made for other reasons, this data processing is based on Article 6(1)(f) of the GDPR, based on our overriding legitimate interest in processing and responding to your inquiry. In this case, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(f) of the GDPR.
We use your email address solely to process your inquiry. Your data will subsequently be deleted in accordance with statutory retention periods, provided you have not consented to further processing and use.
Collection and Processing When Using the Withdrawal Button
If you have entered into a contract through our website, we provide you with a withdrawal function (withdrawal button) that allows you to submit your notice of withdrawal immediately. When you use the cancellation function, we collect your personal data (name, email address, information identifying the contract or part of the contract you wish to cancel, and the time (date and time) the notice of cancellation was sent) only to the extent you provide it. The purpose of this data processing is to provide you with the legally required option to withdraw from your contract and to properly process your withdrawal. If the contact relates to a contract already concluded between you and us, this data processing is based on Article 6(1)(b) of the GDPR. Otherwise, data processing is based on Article 6(1)(c) of the GDPR, as we are legally required to provide you with a cancellation function on our website. We use your email address solely to process your notice of cancellation. Your data will then be deleted in accordance with statutory retention periods, unless you have consented to further processing and use.
The processing of your personal data serves the purpose of legally complying with the statutory requirements for the design of the cancellation feature and is based on Article 6(1)(c) of the GDPR. This data processing is also carried out on the basis of Article 6(1)(f) of the GDPR, based on our overriding legitimate interest in providing you with a user-friendly option to exercise your right of withdrawal. In this case, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(f) of the GDPR
.
Customer Account Orders
Customer Account
When you open a customer account, we collect your personal data to the extent specified there. The purpose of this data processing is to improve your shopping experience and simplify order processing. Processing is based on Article 6(1)(a) of the GDPR with your consent. You may revoke your consent at any time by notifying us, without affecting the lawfulness of the processing carried out on the basis of your consent prior to revocation. Your customer account will then be deleted.
Your data may be disclosed, for example, to the shipping companies and dropshipping or fulfillment providers you have selected, payment service providers, service providers for order processing, and IT service providers. In all cases, we strictly comply with legal requirements. The scope of data transfer is limited to the minimum necessary.
Your data may be transferred to and processed in third countries outside the EU, in particular to Canada and the United States. An adequacy decision by the European Commission exists for Canada. For the U.S., an adequacy decision by the European Commission is in place: the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to those of the European Commission’s Standard Contractual Clauses.
Reviews, Advertising
Using Judge.me
We use the "Judge.me" review system from Judge.me Ltd (c/o Buckworths 2nd Floor, 1-3 Worship Street, London, England, EC2A 2AB; "Judge.me") on our website. Judge.me allows us to collect customer reviews and display them on our website to give you insight into the quality of our services.
After placing an order, you may receive an invitation from us or Judge.me to submit a review, and you can then submit a review. In doing so, the following data, among others, may be processed by us or Judge.me: email address, name, phone number, address, information about your device (IP address, information about your web browser and the operating system used), information about the product you purchased or the service you used (order number, product details), the content of your review and the star rating you provided, and your product photos or videos (if you included them with your product review). This data may also be used, if necessary, to verify your review. Judge.me uses technologies such as cookies.
Your data may be transferred outside the EU to the United Kingdom. An adequacy decision by the European Commission is in place for the United Kingdom. Your data may be transferred to the United States. An adequacy decision by the European Commission is in place for the United States: the Trans-Atlantic Data Privacy Framework (TADPF). Judge.me is not certified under the TADPF. This data transfer is based on special contracts that have been approved for use in the United Kingdom and that provide the same level of protection as that afforded to personal data in the United Kingdom.
The use of cookies or similar technologies is based on your consent pursuant to Section 25(1), Sentence 1 of the TDDDG in conjunction with Article 6(1)(a) of the GDPR. The processing of your personal data is based on your consent pursuant to Article 6(1)(a) of the GDPR, provided that you have expressly consented to the transfer of your data and to receiving the request for a review. You may withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of your consent prior to withdrawal.
For more information on data protection when using Judge.me, please visit: https://judge.me/privacy.
Use of Your Email Address to Send Newsletters
We use your email address—regardless of the fulfillment of the contract—exclusively for our own promotional purposes to send newsletters, provided you have expressly consented to this. Processing is based on Article 6(1)(a) of the GDPR with your consent. You may withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of your consent prior to withdrawal. To do so, you can unsubscribe from the newsletter at any time by using the corresponding link in the newsletter or by notifying us. Your email address will then be removed from the mailing list.
Use of the Email Address for Sending Direct Marketing
We use your email address, which we received in connection with the sale of a product or service, to send you electronic marketing for our own products or services that are similar to you have already purchased from us, provided you have not objected to this use. Providing your email address is necessary for the conclusion of the contract. Failure to provide it means that no contract can be concluded. Processing is based on Article 6(1)(f) of the GDPR, based on our overriding legitimate interest in direct marketing. You may object to this use of your email address at any time by notifying us. You can find the contact information for exercising your right to object in the legal notice. You can also use the link provided for this purpose in the promotional email. No costs other than the transmission costs according to the standard rates will be incurred for this
.
Use of Klaviyo
We use the services of Klaviyo Inc. (125 Summer St, Floor 7, Boston, MA 02111, USA; “Klaviyo”) for newsletter distribution under a data processing agreement.
We share the information you provide when subscribing to the newsletter (email address, first and last name if applicable) with Klaviyo. Data processing serves the purpose of sending the newsletter and analyzing its performance.
To evaluate newsletter campaigns, the newsletters we send contain a 1x1-pixel image (tracking pixel) or a tracking link. This allows us to determine whether you have opened the newsletter and, if applicable, whether you have clicked on any embedded links. In this context, we collect your personal data, such as your IP address, browser type, device, and the time of access. This data may be used to create usage profiles under a pseudonym. The collected data is not used to identify you personally. The collected data is used solely for statistical analysis to improve newsletter campaigns.
Your data is generally transmitted to and stored on Klaviyo’s servers in the United States. An adequacy decision by the European Commission is in place for the United States: the Trans-Atlantic Data Privacy Framework (TADPF). Klaviyo has obtained TADPF certification and is therefore committed to complying with European data protection principles.
The processing of your personal data is based on Article 6(1)(f) of the GDPR, based on our overriding legitimate interest in a targeted, effective, and user-friendly newsletter system. You have the right to object at any time to the processing of your personal data for reasons arising from your particular situation.
For more information on data protection at Klaviyo, please visithttps://www.klaviyo.com/legal/privacy-noticeandhttps://www.klaviyo.com/legal/data-processing-agreement.
Use of the Email Address for Availability Notifications
We offer a product availability notification service on our website. If an item is temporarily out of stock, you have the option to enter your email address on the product page and receive an email notification from us when it becomes available, provided you have consented to this. Once the item becomes available, you will receive a one-time email notification regarding the availability of that item. This processing is based on Article 6(1)(a) of the GDPR with your consent. You may withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of your consent prior to withdrawal. You may unsubscribe from the availability notification at any time by notifying us. Your email address will then be removed from the mailing list.
Shipping Service Providers Inventory Management
Sharing Your Email Address with Shipping Carriers to Provide Shipping Status Updates
We share your email address with the shipping carrier as part of contract fulfillment, provided you have expressly consented to this during the ordering process. The purpose of this disclosure is to inform you via email about the shipping status. Processing is based on Article 6(1)(a) of the GDPR with your consent. You may revoke your consent at any time by notifying us or the shipping company, without affecting the lawfulness of the processing carried out on the basis of your consent prior to revocation.
Use of an External Inventory Management System
We use an inventory management system for contract fulfillment as part of data processing on our behalf. For this purpose, your personal data collected as part of the order istransferredto
Pforzheimer Datenverarbeitungsgesellschaft mbH, Stuttgarter Str. 41, 75179 Pforzheim,
.
The processing of your personal data serves the purpose of fulfilling the contract concluded with you and is carried out on the basis of Article 6(1)(b) of the GDPR.
Payment Service Provider
Use of PayPal Express
We use the PayPal Express payment service provided by PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; “PayPal”) on our website. The purpose of this data processing is to enable us to offer you the option of paying via the PayPal Express payment service. To integrate this payment service, it is necessary for PayPal to collect, store, and analyze data (e.g., IP address, device type, operating system, browser type, and your device’s location) when you visit the website. Cookies may also be used for this purpose. The cookies enable your browser to be recognized.
The processing of your personal data is based on Article 6(1)(f) of the GDPR, based on our overriding legitimate interest in offering a customer-oriented selection of various payment methods. You have the right to object at any time to the processing of your personal data for reasons arising from your particular situation.
When you select and use PayPal Express, the data required for payment processing is transmitted to PayPal so that we can fulfill the contract with you using the selected payment method. This processing is based on Article 6(1)(b) of the GDPR. For more information on data processing when using the PayPal Express payment service, please refer to the corresponding privacy policy atwww.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE#Updated_PS.
Use of PayPal Checkout
We use the PayPal Checkout payment service provided by PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; “PayPal”) on our website. Data processing is carried out for the purpose of enabling us to offer you payment via this payment service. When you select and use payment via PayPal, credit card via PayPal, direct debit via PayPal, or “Pay Later” via PayPal, the data required for payment processing is transmitted to PayPal so that we can fulfill the contract with you using the selected payment method. This processing is based on Article 6(1)(b) of the GDPR.
In this process, cookies may be stored that enable your browser to be recognized. The resulting data processing is based on Article 6(1)(f) of the GDPR, based on our overriding legitimate interest in offering a customer-oriented selection of various payment methods. You have the right to object at any time to the processing of your personal data for reasons arising from your particular situation.
Credit card via PayPal, direct debit via PayPal, and “Pay Later” via PayPal
For certain payment methods, such as credit card via PayPal, direct debit via PayPal, or “Pay Later” via PayPal, PayPal reserves the right to obtain a credit check, if necessary, based on mathematical and statistical methods using credit reporting agencies. To this end, PayPal transmits the personal data required for a credit check to a credit bureau and uses the information received regarding the statistical probability of default to make a balanced decision regarding the establishment, execution, or termination of the contractual relationship. The credit report may include probability values (score values) calculated using scientifically recognized mathematical and statistical methods, which incorporate, among other things, address data. Your legitimate interests will be taken into account in accordance with legal provisions. The data processing serves the purpose of conducting a credit check for the initiation of a contract. The processing is carried out on the basis of Article 6(1)(f) of the GDPR, based on our overriding legitimate interest in protecting against payment default when PayPal makes an advance payment.
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(f) of the GDPR by notifying PayPal. Providing this data is necessary to conclude the contract using your preferred payment method. Failure to provide this data will result in the contract not being able to be concluded using the payment method you have selected.
Third-party providers
When paying via a third-party payment method, the data required for payment processing is transmitted to PayPal. This processing is based on Article 6(1)(b) of the GDPR. To process this payment method, PayPal may then forward the data to the respective provider. This processing is based on Article 6(1)(b) of the GDPR. Examples of local third-party providers include:
- Apple Pay (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
- Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)
- giropay (Paydirekt GmbH, Stephanstr. 14-16, 60313 Frankfurt am Main)
Purchase on Account via PayPal
When you choose the "Purchase on Account" payment method, the data required to process the payment is first transmitted to PayPal. To process this payment method, PayPal then transmits the data to Ratepay GmbH (Franklinstraße 28-29, 10587 Berlin; “Ratepay”) in order to fulfill the contract with you using the selected payment method. This processing is based on Article 6(1)(b) of the GDPR. Ratepay may conduct a credit check based on mathematical-statistical methods (probability or score values) using credit reporting agencies in accordance with the procedure described above. The data processing serves the purpose of conducting a credit check for the initiation of a contract. The processing is based on Article 6(1)(f) of the GDPR, reflecting our overriding legitimate interest in protecting against payment default when Ratepay makes an advance payment. For more information on data protection and which credit bureaus Ratpay uses, please visithttps://www.ratepay.com/legal-payment-dataprivacy/andhttps://www.ratepay.com/legal-payment-creditagencies/.
For more information on data processing when using PayPal, please refer to the corresponding privacy policy athttps://www.paypal.com/de/webapps/mpp/ua/privacy-full.
Cookies
Our website uses cookies. Cookies are small text files that are stored in or by the web browser on a user’s computer system. When a user visits a website, a cookie may be stored on the user’s operating system. This cookie contains a unique string of characters that allows the browser to be uniquely identified when the website is visited again.
Microsoft Edge:https://support.microsoft.com/de-de/microsoft-edge/cookies-in-microsoft-edge-lB6schen-63947406-40ac-c3b8-57b9-2a946a29ae09
Use of the GDPR Legal Cookie
We use the GDPR Legal Cookie consent management tool from iubenda s.r.l. (Via San Raffaele 1, 20121 Milan, Italy; “iubenda”) on our website. This tool allows you to grant consent to data processing via the website—in particular, the use of cookies—and to exercise your right to withdraw consent that has already been granted. The purpose of data processing is to obtain and document the necessary consents for data processing and thereby comply with legal obligations. Cookies may be used for this purpose. In this context, the following information, among other things, may be collected and transmitted to iubenda: anonymized IP address, date and time of consent, URL from which the consent was sent, anonymous, random, encrypted key, consent status. This data is not disclosed to any other third parties. Data processing is carried out to fulfill a legal obligation pursuant to Article 6(1)(c) of the GDPR. For more information on iubenda’s terms of use and privacy policy, please visit:
, https://www.iubenda.com/nutzungsbedingungen/31059378, and https://gdpr-legal-cookie.com/pages/datenschutzerklarung.
Plug-ins and Other Information
Use of Google Tag Manager
We use GoogleTag Manager from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”) on our website. This application manages JavaScript tags and HTML tags used to implement tracking and analytics tools in particular. Data processing serves the purpose of tailoring our website to user needs and optimizing it. Google Tag Manager itself does not store cookies, nor does it process personal data. However, it enables the triggering of additional tags that may collect and process personal data. For more information on terms of use and privacy, please visit
. Use of Google reCAPTCHA
We use the reCAPTCHA service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”) on our website as part of a data processing agreement. The purpose of this check is to distinguish between input by a human and automated, machine-based processing. To this end, your input is transmitted to Google and processed there. In addition, your IP address and, if applicable, other data required by Google for the reCAPTCHA service are transmitted to Google. This data is processed by Google within the European Union and, where applicable, may also be transferred to servers operated by Google LLC in the United States. An adequacy decision by the European Commission is in place for the United States: the Trans-Atlantic Data Privacy Framework (TADPF). Google has obtained certification under the TADPF and is therefore committed to complying with European data protection principles. The use of cookies or similar technologies is based on your consent pursuant to Section 25(1), Sentence 1 of the TDDDG in conjunction with Article 6(1)(a) of the GDPR. The processing of your personal data is based on your consent pursuant to Article 6(1)(a) of the GDPR. You may withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal.
Use of YouTube
We use the feature on our website that allows us to embed YouTube videos provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “YouTube”). YouTube is an affiliate of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”).
This feature displays videos hosted on YouTube within an iFrame on the website. The “Enhanced Privacy Mode” option is enabled. As a result, YouTube does not store any information about website visitors. Information about the video is only transmitted to YouTube and stored there once you watch a video. Your data may be transferred to the United States. An adequacy decision by the European Commission is in place for the United States: the Trans-Atlantic Data Privacy Framework (TADPF). YouTube has obtained certification under the TADPF and is therefore committed to complying with European data protection principles.
The use of cookies or similar technologies is based on your consent pursuant to Section 25(1), Sentence 1 of the TDDDG in conjunction with Article 6(1)(a) of the GDPR. The processing of your personal data is based on your consent pursuant to Article 6(1)(a) of the GDPR. You may withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of your consent prior to withdrawal.
For more information on the collection and use of data by YouTube and Google, your rights in this regard, and options for protecting your privacy, please see YouTube’s Privacy Policy athttps://www.youtube.com/t/privacy.
Data Subject Rights and Retention Period
Retention Period
After the contract has been fully executed, the data will initially bestored for the duration of the warranty period, and thereafter in accordance with statutory retention periods—particularly those under tax and commercial law—and then deleted upon expiration of these periods, unless you have consented to further processing and use.
Rights of the Data Subject
Provided the legal requirements are met, you are entitled to the following rights under Articles 15 through 20 of the GDPR: the right of access, the right to rectification, the right to erasure, the right to restriction of processing, and the right to data portability.
In addition, pursuant to Article 21(1) of the GDPR, you have the right to object to processing based on Article 6(1)(f) of the GDPR, as well as to processing for the purposes of direct marketing.
Right to lodge a complaintwith the supervisory authority
Pursuant to Article 77 of the GDPR, you have the right to lodge a complaintwith the supervisory authority if you believe that the processing of your personal data is not lawful.
You may file a complaint, among other places, with the supervisory authority responsible for us, which you can contact using the following information:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Tel.: +49 981 1800930
Fax: +49 981 180093800
Email: poststelle@lda.bayern.de
Right to Object
If the processing of personal data described here is based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR, you have the right to object to such processing at any time for reasons arising from your particular situation, with effect for the future.
Once an objection has been filed, the processing of the relevant data will be terminated, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing is necessary for the establishment, exercise, or defense of legal claims.
If personal data is processed for direct marketing purposes, you may object to this processing at any time by notifying us. Once you have objected, we will cease processing the relevant data for direct marketing purposes.
Last updated: October 22, 2024

