This English version is a courtesy translation. Only the German version is legally binding.
of Paul Elsdörfer & Söhne GbR, partners: Paul Elsdörfer, Peter Elsdörfer, Fröttmaningerstraße 2, 80805 München, Germany.
1. Name and contact details of the controller
This privacy notice applies to us,
Paul Elsdörfer & Söhne GbR
Partners: Paul Elsdörfer, Peter Elsdörfer
Fröttmaningerstraße 2
80805 München, Germany
Phone: +49 89 365947
Fax: +49 89 36102315
E-mail: blumen@elsdoerfer.com
as the controller.
2. General information on data processing
I. Scope of the processing of personal data
As a matter of principle, we only process personal data of our users to the extent necessary to provide a functional website and our content and services. The processing of personal data of our users regularly takes place only with the user's consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law.
II. Legal basis for the processing of personal data
Where we obtain the consent of the data subject for processing operations involving personal data, Art. 6 (1) (a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 (1) (b) GDPR serves as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.
Where processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 (1) (c) GDPR serves as the legal basis.
In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 (1) (d) GDPR serves as the legal basis.
If the processing is necessary to safeguard a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest, Art. 6 (1) (f) GDPR serves as the legal basis for the processing.
III. Data erasure and storage period
The personal data of the data subject will be erased or blocked as soon as the purpose of storage no longer applies. Storage may also take place if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. The data will also be blocked or erased when a storage period prescribed by the aforementioned provisions expires, unless further storage of the data is necessary for the conclusion or performance of a contract.
3. Collection and storage of personal data; type, purpose and use
When you place an order with us, the following information is collected:
- Salutation, title, first name, last name
- Address
- E-mail address
- Telephone number (landline and/or mobile)
- Fax number, if applicable (if available & requested)
- Bank details, if applicable
- Date of birth, if applicable
In addition, all information necessary for the performance of the contract with you is collected.
The personal data is collected
- in order to identify you as a customer;
- in order to advise you appropriately;
- in order to fulfil our contractual obligations towards you;
- in order to comply with our legal obligations;
- for correspondence with you;
- for invoicing and, if applicable, dunning;
- for the purposes of permissible direct marketing;
- to assert any claims against you.
The personal data is processed in connection with your enquiry and is necessary for the stated purposes of handling your order and fulfilling obligations arising from the underlying contract.
The personal data collected is stored until the expiry of the statutory retention obligation for merchants (6, 8 or 10 years after the end of the calendar year in which the contractual relationship ended) and then erased. This exceptionally does not apply if we are obliged to store the data for longer due to tax or commercial retention obligations (pursuant to the German Commercial Code (HGB), Criminal Code (StGB) or Fiscal Code (AO)) or if you have consented to storage beyond this.
4. Disclosure of data to third parties
As a matter of principle, your personal data is not transferred to third parties. Exceptions apply only insofar as this is necessary for the processing of contractual relationships with you. This includes in particular disclosure to service providers commissioned by us (so-called processors) or other third parties whose activities are necessary for the performance of the contract (e.g. delivery companies or banks). The disclosed data may be used by the third parties exclusively for the stated purposes.
5. Your rights as a data subject
As a person affected by the data processing, you have various rights:
Right to withdraw consent
You can withdraw any consent you have given us at any time. The data processing based on the withdrawn consent may then no longer be continued in the future. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
Right of access
You can request information about your personal data processed by us. This applies in particular to the purposes of the data processing, the categories of personal data, the categories of recipients where applicable, the storage period, the origin of your data where applicable, and the existence of automated decision-making including profiling and, where applicable, meaningful information about its details.
You can request confirmation from the controller as to whether personal data concerning you is being processed by us. If such processing takes place, you can request information about the following: the purposes of the processing; the categories of data processed; the recipients or categories of recipients; the planned storage period or the criteria for determining it; the existence of a right to rectification, erasure, restriction or objection; the existence of a right to lodge a complaint with a supervisory authority; all available information about the origin of the data if it was not collected from you; and the existence of automated decision-making including profiling pursuant to Art. 22 (1) and (4) GDPR.
You also have the right to request information as to whether your personal data is transferred to a third country or to an international organisation and, in this context, to be informed about the appropriate safeguards pursuant to Art. 46 GDPR.
Right to rectification
You can request the rectification of inaccurate personal data or the completion of your personal data stored by us if it is inaccurate or incomplete. The controller must carry out the rectification without undue delay.
Right to erasure
You can request the erasure of your personal data stored by us unless its processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims. The right to erasure exists in particular if the data is no longer necessary for the purposes for which it was collected, you withdraw your consent and there is no other legal basis, you object and there are no overriding legitimate grounds, the data has been processed unlawfully or there is a legal obligation to erase it.
Right to be informed
If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to communicate this rectification, erasure or restriction to all recipients to whom your personal data has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients.
Right to restriction of processing
You can request the restriction of the processing of your personal data if you contest the accuracy of the data, the processing is unlawful but you oppose its erasure, we no longer need the data but you need it for the establishment, exercise or defence of legal claims, or you have objected to the processing.
Right to data portability
You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller or have it transmitted directly, where technically feasible, provided that the processing is based on consent or a contract and is carried out by automated means.
Right to lodge a complaint
You can lodge a complaint with the supervisory authority responsible for us, e.g. if you believe that we are processing your personal data unlawfully. The authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27
91522 Ansbach, Germany
Phone: +49 (0) 981 53 1300
Fax: +49 (0) 981 53 98 1300
E-mail: poststelle@lda.bayern.de
6. Your right to object
If we process your personal data on the basis of a legitimate interest, you have the right to object to this processing. If you wish to exercise your right to object, a communication in text form is sufficient. You are therefore welcome to write to us, send us a fax or contact us by e-mail. You will find our contact details under section 1 of this privacy notice.
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 (1) (e) or (f) GDPR; this also applies to profiling based on these provisions. If your data is processed for direct marketing purposes, you have the right to object at any time; your data will then no longer be processed for these purposes.
7. Provision of the website and creation of log files
Certain personal data is also processed via our website, including the IP address of website visitors. Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. The following data is collected:
- Information about the browser type and the version used
- The user's operating system
- The user's internet service provider
- The user's IP address
- Date and time of access
- Websites from which the user's system accesses our website
- Websites accessed by the user's system via our website
The data is also stored in the log files of our system. This data is not stored together with other personal data of the user.
Legal basis: The legal basis for the temporary storage of the data and the log files is Art. 6 (1) (f) GDPR.
Purpose: The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. Storage in log files takes place to ensure the functionality of the website and to optimise and ensure the security of our information technology systems. The data is not evaluated for marketing purposes.
Storage period: The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. In the case of data collected to provide the website, this is the case when the respective session has ended. In the case of storage in log files, after seven days at the latest; in case of longer storage, the IP addresses are deleted or anonymised.
8. Use of cookies
Our website uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user's computer system. We use cookies to make our website more user-friendly. The cookies store, among other things, the following data: language settings, items in the shopping cart, log-in information. In addition, cookies may be used that enable an analysis of browsing behaviour (e.g. search terms entered, frequency of page views, use of functions); this data is pseudonymised.
Legal basis: For technically necessary cookies, Art. 6 (1) (f) GDPR; for analysis cookies, if consent has been given, Art. 6 (1) (a) GDPR.
Purpose: Technically necessary cookies make it easier to use the website (e.g. shopping cart, language settings, remembering search terms). Analysis cookies serve to improve the quality of our website and its content.
Control: Cookies are stored on your computer; you have full control. You can deactivate or restrict the transmission of cookies and delete cookies already stored via your browser settings. If cookies are deactivated, it may no longer be possible to use all functions of the website to their full extent.
9. Registration
On our website we offer users the opportunity to register by providing personal data. The data is entered into an input form, transmitted to us and stored. The data is not passed on to third parties. At the time of registration, the user's IP address and the date and time of registration are also stored.
Legal basis: If consent has been given, Art. 6 (1) (a) GDPR; if the registration serves the performance of a contract or pre-contractual measures, additionally Art. 6 (1) (b) GDPR.
Purpose and duration: Registration is required to provide certain content and services or to perform the contract. The data is erased as soon as it is no longer required to achieve the purpose. As a user, you can cancel the registration and have your data changed at any time; please contact us using the contact details given in section 1.
10. Contact form and e-mail contact
A contact form can be used on our website to get in touch electronically. If a user takes advantage of this option, the data entered in the input form (name, possibly telephone number, possibly e-mail address, possibly address) is transmitted to us and stored. At the time the message is sent, the IP address and the date and time are also stored. Alternatively, you can contact us via the e-mail address provided; in this case the personal data transmitted with the e-mail is stored. The data is not passed on to third parties.
Legal basis: If consent has been given, Art. 6 (1) (a) GDPR; for data transmitted by e-mail, Art. 6 (1) (f) GDPR, and if the contact is aimed at concluding a contract, additionally Art. 6 (1) (b) GDPR.
Purpose and duration: The processing serves solely to handle the contact request. The data is erased as soon as the respective conversation has ended; the additional data collected when sending, after seven days at the latest. The user can withdraw their consent or object to the storage at any time.
11. Sending of transactional e-mails
For transactional e-mails (order confirmations, password resets) we use Postmark (ActiveCampaign, LLC, USA). The e-mail address and, where applicable, name and order information are processed for the performance of the contract (Art. 6 (1) (b) GDPR). The transfer to the USA is based on certification under the EU-U.S. Data Privacy Framework. Details on sub-processors and security measures: trust.activecampaign.com.
12. Payment service providers
We use the following payment service providers to process payments. When you select the respective payment method, the data required for it (including name, address, order total and, where applicable, account or card details) is transmitted to the respective provider for the performance of the contract (Art. 6 (1) (b) GDPR).
PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Further information on how PayPal handles your data can be found in PayPal's privacy statement.
Stripe: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Data may be transferred to the US parent company Stripe, Inc. in the context of processing on our behalf; this is based on certification under the EU-U.S. Data Privacy Framework. Further information can be found in Stripe's privacy policy.