Privacy Policy

1) Introduction and Contact Details of the Data Controller
1.1 We are pleased that you are visiting our website and thank you for your interest. Below we inform you about how we handle your personal data when using our website. Personal data in this context means all data that can be used to personally identify you.

1.2 The data controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

GRNK GmbH, Boschstraße 15, 49733 Haren (Ems), Germany
Tel.: +49 5932 / 90 36 263

The data controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2) Data Collection When Visiting Our Website
When you use our website purely for informational purposes, meaning you do not register or otherwise provide us with information, we only collect the data that your browser transmits to our server (so-called "server log files"). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

  • Our visited website

  • Date and time at the moment of access

  • Amount of data sent in bytes

  • Source/referrer from which you accessed the page

  • Browser used

  • Operating system used

  • IP address used (possibly in anonymised form)

Processing is carried out in accordance with Art. 6 (1)(f) GDPR based on our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used in any other way. However, we reserve the right to check the server log files retrospectively should there be concrete indications of unlawful use.

3) Hosting & Content Delivery Network
Shopify

For the hosting of our website and the display of page content, we use the system of the following provider:
Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify").

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.

All data collected on our website is processed on the provider’s servers. We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

When data is transferred to Canada, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

4) Cookies
To make our website more attractive and to enable the use of certain functions, we use cookies, which are small text files stored on your device. Some of these cookies are deleted automatically after you close your browser (so-called “session cookies”), while others remain on your device for a longer period and enable the storage of page settings (so-called “persistent cookies”). In the latter case, you can find the storage period in your web browser’s cookie settings overview.

If personal data is also processed by individual cookies used by us, the processing is carried out in accordance with Art. 6(1)(b) GDPR either for the performance of a contract, in accordance with Art. 6(1)(a) GDPR in the event of your consent, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interest in ensuring the best possible functionality of the website as well as a customer-friendly and effective design of the website visit.

You can set your browser so that you are informed about the setting of cookies and can decide individually whether to accept them, accept cookies for certain cases, or generally exclude them.

Please note that the functionality of our website may be limited if cookies are not accepted.

5) Contact

5.1 Shopify Inbox
This website uses the live chat system of the following provider:
Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

The processing of personal data transmitted via the chat is carried out either in accordance with Art. 6(1)(b) GDPR because it is necessary for the initiation or performance of a contract, or in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in effectively assisting our website visitors.
Your transmitted data will be deleted, subject to statutory retention periods, once the matter in question is fully resolved.

In addition, for the purpose of creating pseudonymised user profiles with the help of cookies, further information may be collected and evaluated, which does not serve to personally identify you and will not be combined with other data sets. If such information is personal, the processing is carried out in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in the statistical analysis of user behaviour for optimisation purposes.

You can prevent the setting of cookies via the corresponding browser settings. This may, however, limit the functionality of our website.
You may object at any time, with future effect, to the collection and storage of data for the purpose of creating a pseudonymised usage profile.

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

When data is transferred to Canada, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

5.2 Reviews.io
For review reminders, we use the services of the following provider:
REVIEWS.io 2020 GmbH, Skalitzer Str. 104, 10997 Berlin, Germany.

Based solely on your express consent pursuant to Art. 6(1)(a) GDPR, we transmit your email address and, if applicable, other customer data to the provider so that they can contact you via email with a review reminder.

You can revoke your consent at any time with effect for the future by notifying us or the provider.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

5.3 Gorgias
To process customer inquiries, we use the email ticketing system of the following provider:
Gorgias Inc., 180 Sansome St, Suite 1800, San Francisco, CA 94014, USA.

If you send contact requests to us via email from our website, these will be stored and organised in the ticketing system to enable chronological processing and to improve the service experience. Using the individually assigned ticket number, you can always view the current status of your request.

For organising and processing inquiries, personal data is collected according to the extent of your submission—at minimum, first name, last name, and email address—and transmitted to, stored by, and retrieved from the provider.

The legal basis for processing this data is our legitimate interest in efficient customer service, the fastest possible handling of your request, and the optimisation of our service offering, pursuant to Art. 6(1)(f) GDPR.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

For the transfer of data to the USA, the provider relies on the European Commission's Standard Contractual Clauses, which are intended to ensure compliance with the European level of data protection.

5.4 When contacting us (e.g., via contact form or email), personal data is processed exclusively for the purpose of handling and responding to your inquiry and only to the extent necessary.

The legal basis for processing this data is our legitimate interest in responding to your inquiry pursuant to Art. 6(1)(f) GDPR. If your contact aims at concluding a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted once it is evident from the circumstances that the matter in question has been conclusively clarified and provided there are no statutory retention obligations.

6) Data Processing When Opening a Customer Account
In accordance with Art. 6(1)(b) GDPR, personal data will continue to be collected and processed to the extent necessary if you provide it to us when opening a customer account. The required data for opening the account can be found in the input form on our website.

You can delete your customer account at any time by sending a message to the above-mentioned contact address of the controller. After deletion of your customer account, your data will be deleted, provided all contracts concluded via it have been fully processed, no statutory retention obligations prevent deletion, and we have no legitimate interest in further storage.

7) Use of Customer Data for Direct Advertising
7.1 Registration for our Email Newsletter
If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information for sending the newsletter is your email address. Providing further data is voluntary and will be used to address you personally. For the newsletter dispatch, we use the so-called double opt-in procedure. This means that we will only send you an email newsletter once you have expressly confirmed to us that you agree to receive newsletters. We will then send you a confirmation email asking you to click on a link to confirm that you wish to receive the newsletter in the future. By activating the confirmation link, you give us your consent for the use of your personal data in accordance with Art. 6(1)(a) GDPR.

When you register for the newsletter, we store your IP address entered by the Internet Service Provider (ISP) as well as the date and time of registration in order to trace any possible misuse of your email address at a later date. The data we collect when you register for the newsletter is used exclusively for the purpose of promotional communication via the newsletter. You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending a corresponding message to the controller named above. After unsubscribing, your email address will be immediately deleted from our newsletter distribution list unless you have expressly consented to further use of your data or we reserve the right to use data beyond this which is permitted by law and about which we inform you in this declaration.

7.2 Sending the Email Newsletter to Existing Customers
If you have provided us with your email address when purchasing goods or services, we reserve the right to regularly send you offers for similar goods or services from our range by email. For this purpose, we do not need to obtain separate consent from you in accordance with Section 7(3) of the German Act Against Unfair Competition (UWG). Data processing is carried out solely on the basis of our legitimate interest in personalised direct advertising pursuant to Art. 6(1)(f) GDPR. If you have initially objected to the use of your email address for this purpose, we will not send you any emails. You are entitled to object to the use of your email address for the aforementioned advertising purposes at any time with effect for the future by notifying the controller named above. For this, you only incur transmission costs according to the basic rates.

7.3 Newsletter via Klaviyo
Our email newsletters are sent via the technical service provider: Klaviyo, 225 Franklin St, Boston, MA 02110, USA (“Klaviyo”), to whom we pass on the data you provided when registering for the newsletter. This transfer takes place in accordance with Art. 6(1)(f) GDPR and serves our legitimate interest in using an advertising-effective, secure, and user-friendly newsletter system.

The data entered by you for the purpose of receiving the newsletter (e.g., email address) will be stored on Klaviyo's servers in the USA.

Klaviyo uses this information to send and statistically evaluate the newsletters on our behalf. For evaluation purposes, the sent emails contain so-called web beacons or tracking pixels, which represent single-pixel image files stored on our website. This allows us to determine whether a newsletter message has been opened and which links have been clicked on. With the help of so-called conversion tracking, it can also be analysed whether a predefined action (such as purchasing a product via our website) has taken place after clicking the link in the newsletter. Technical information is also recorded (e.g., time of retrieval, IP address, browser type, and operating system). The data is collected exclusively in pseudonymised form and is not linked to your other personal data; direct personal identification is therefore excluded.

This data is used solely for statistical analysis of newsletter campaigns. The results of these analyses can be used to better tailor future newsletters to the interests of the recipients. If you wish to object to data analysis for statistical evaluation purposes, you must unsubscribe from the newsletter.

In addition, Klaviyo may use this data itself pursuant to Art. 6(1)(f) GDPR on the basis of its own legitimate interest in designing and optimising the service according to customer needs and for market research purposes, for example, to determine which countries the recipients come from. However, Klaviyo does not use the data of our newsletter recipients to write to them itself or to pass it on to third parties.

To protect your data in the USA, we have concluded a data processing agreement with Klaviyo based on the European Commission's Standard Contractual Clauses to enable the transfer of your personal data to Klaviyo. These data processing terms can be viewed here: https://www.klaviyo.com/legal/dpa

Klaviyo's privacy policy can be viewed here: https://www.klaviyo.com/privacy

8) Processing of Data for Order Handling
8.1 To the extent necessary for the execution of the contract for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned transport company and the commissioned credit institution pursuant to Art. 6(1)(b) GDPR.

If we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we will process the contact data you provide when ordering (name, address, email address) in order to inform you personally, within the scope of our statutory information obligations pursuant to Art. 6(1)(c) GDPR, by suitable means of communication (e.g., by post or email) about upcoming updates within the legally stipulated period. Your contact details will be used strictly for the purpose of notifying you of updates we owe you and will only be processed by us for this purpose to the extent necessary for the respective information.

8.2 Use of Payment Service Providers (PSP)

  • Apple Pay
    If you choose the payment method "Apple Pay" of Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment will be processed via the "Apple Pay" feature of your device operating system, secured by a passcode, Face ID, or Touch ID.

For payment processing, the information you provide during the ordering process will be encrypted and transmitted to Apple in order to process the payment. Apple then encrypts this data with a developer-specific key before the data is sent to the payment service provider of the payment card stored in Apple Pay to process the payment. The encryption ensures that only the website through which the purchase was made can access the payment data.

You can find further information in Apple’s privacy policy: https://www.apple.com/legal/privacy/

  • Klarna
    If a Klarna payment service is selected, payment processing is carried out via Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter "Klarna").

Klarna collects various personal data from the customer in order to process the payment. Klarna then decides whether the customer can use the selected payment method based on the data collected and may transmit the data to credit reference agencies. The processing is carried out on the basis of Art. 6(1)(b) GDPR (contract performance) and on the basis of Art. 6(1)(f) GDPR (legitimate interest in determining solvency).

Klarna's privacy policy is available here: https://www.klarna.com/international/privacy-policy/

9) Online Marketing
Facebook Pixel for Creating Custom Audiences with Advanced Matching
Within our online offering, we use the "Facebook Pixel" service of Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Meta").

If a user clicks on an advertisement placed by us on Facebook or Instagram, an addition is added to the URL of our linked page by Facebook Pixel. This URL parameter is then recorded in the user’s browser via a cookie, which our linked page sets itself. In addition, this cookie records specific customer data such as the email address, which we collect on our website linked to the Facebook ad during transactions (advanced matching).

With the help of this technology, Facebook can determine the visitors of our online offering as a target group for the display of ads (so-called "Facebook Ads"). Accordingly, we use the Facebook Pixel to display the Facebook Ads we place only to Facebook users who have shown an interest in our online offering or who have certain characteristics (e.g., interests in certain topics or products, determined based on visited websites), which we transmit to Facebook (so-called "Custom Audiences").

The use of Facebook Pixel is based on your consent pursuant to Art. 6(1)(a) GDPR.

10) Web Analysis Services
Google Analytics 4
This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland (“Google”).

Google Analytics 4 uses cookies, which are text files placed on your device, to help the website analyse how you use the site. The information generated by these cookies about your use of the website (including the IP address transmitted by your device, shortened by the last octet, see below) is generally transmitted to and stored by Google on servers in the USA.

Google Analytics 4 is used exclusively with the IP anonymisation function enabled. This means that the IP address transmitted by your browser is shortened by Google before being stored, so that it can no longer be directly associated with you. Only in exceptional cases will the full IP address be sent to a Google server in the USA and shortened there. In these exceptional cases, processing is carried out pursuant to Art. 6(1)(a) GDPR based on your consent.

On our behalf, Google will use this information to evaluate your use of the website, compile reports on website activity, and provide other services related to website activity and internet usage.

The data collected via Google Analytics 4 is automatically deleted after 14 months.

More information about Google Analytics 4 can be found here: https://support.google.com/analytics/answer/10089681

11) Retargeting / Remarketing / Referral Advertising
Google Ads Remarketing
Our website uses the functions of Google Ads Remarketing, with which we advertise this website in Google search results and on third-party websites. Provider is Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland (“Google”).

For this purpose, Google sets a cookie in your device's browser, which automatically enables interest-based advertising based on the pages you visit. The processing is based on your consent pursuant to Art. 6(1)(a) GDPR.

Any further processing will only take place if you have agreed to Google linking your internet and app browser history with your Google account and using information from your Google account to personalise ads you see on the web. In this case, if you are logged into Google while visiting our website, Google will use your data together with Google Analytics data to create and define audience lists for cross-device remarketing.

You can permanently deactivate the setting of cookies for ad preferences in your Google account: https://www.google.com/settings/ads/onweb/

12) Tools and Miscellaneous
Google reCAPTCHA
On this website, we use the reCAPTCHA function from Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland (“Google”). This function is primarily used to distinguish whether an entry is made by a natural person or abusively by automated machine processing.

The service includes sending the IP address and any other data required by Google for the reCAPTCHA service to Google, and this is done in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in establishing the individual responsibility of actions on the internet and preventing misuse and spam.

Further information about Google reCAPTCHA and Google's privacy policy can be found here: https://www.google.com/intl/en/policies/privacy/

13) Rights of the Data Subject
13.1 The applicable data protection law grants you the following rights (rights of access and intervention) with respect to the controller regarding the processing of your personal data, whereby reference is made to the legal basis stated:

  • Right of access pursuant to Art. 15 GDPR

  • Right to rectification pursuant to Art. 16 GDPR

  • Right to erasure (“right to be forgotten”) pursuant to Art. 17 GDPR

  • Right to restriction of processing pursuant to Art. 18 GDPR

  • Right to be informed pursuant to Art. 19 GDPR

  • Right to data portability pursuant to Art. 20 GDPR

  • Right to withdraw consent pursuant to Art. 7(3) GDPR

  • Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR

13.2 Right to Object
If we process your personal data within the framework of a balancing of interests based on our overriding legitimate interest, you have the right at any time, for reasons arising from your particular situation, to object to this processing with effect for the future. If you make use of your right to object, we will stop processing the data concerned. However, further processing remains reserved if we can demonstrate compelling legitimate grounds for the processing which override your interests, fundamental rights and freedoms, or if the processing serves the assertion, exercise, or defence of legal claims.

If your personal data is processed by us for direct advertising, you have the right to object at any time to the processing of your personal data for such advertising. You may exercise your objection as described above. If you object to processing for direct advertising purposes, we will immediately cease processing your personal data for such purposes.

14) Duration of Storage of Personal Data
The duration of storage of personal data is measured based on the respective legal retention period (e.g., commercial and tax retention periods). After the expiry of the period, the corresponding data will be routinely deleted, provided it is no longer required for contract performance or initiation and/or there is no legitimate interest on our part to continue storing it.