Privacy Policy

Privacy Information – Online Shop: shop.thelaend.de

General Information

We are pleased that you are visiting our online shop and thank you for your interest. Below, we inform you about the handling of your personal data when using our online shop. The concept of processing covers the entire process from the collection, storage, modification, and/or transfer to the deletion of your data (hereinafter: "processing"). Personal data refers to all information that relates directly or indirectly to you or other individuals (such as name, address, email address, etc.).

1. Who is responsible for the processing of your personal data?

State Ministry of Baden-Württemberg (hereinafter also: "we" or "us")
Richard-Wagner-Straße 15
70184 Stuttgart
Phone: 0711 2153-0
Email: poststelle@stm.bwl.de

2. Contact person for data protection

You can reach the official Data Protection Officer of the State Ministry at:

State Ministry of Baden-Württemberg
Official Data Protection Officer
Richard-Wagner-Straße 15
70184 Stuttgart
Email: Datenschutz@stm.bwl.de

3. For what purposes and on what legal basis do we process personal data and how long is it stored?

We process personal data for the purposes described below based on the legal grounds described below, in particular for the provision of the online shop and the processing of orders.

(1) Registration | User Account

You can either place orders via our website as a guest without registering, or register in our shop as a customer for future orders. Registration has the advantage that, in the event of a future order, you can log directly into our shop with your email address and password without having to enter your order details again.

If you voluntarily create a user account, your personal data will be entered into an input mask, transmitted to us, and stored. We then process the data you provided during registration on the basis of your consent in accordance with Art. 6 (1) sentence 1 lit. a GDPR.

When registering and logging into your user account, the date and time of registration are also stored. The legal basis for this is Art. 6 (1) sentence 1 lit. f GDPR. Legitimate purposes include evaluating access to the protected areas of our website, ensuring the integrity of our online shop, and preventing misuse by individual users.

Insofar as we process your personal data to create a customer account based on your consent, you have the right to revoke your consent at any time by sending a message to the contact details provided in Section 1 or 2, or to delete your customer account yourself at any time in the customer area. Your data stored for the customer account will then be deleted, subject to statutory retention periods.

(2) Order

When you place an order via our website, we initially collect the following data, both in the case of a guest order and in the case of registration in the shop:

  • Salutation, first name, last name,

  • a valid email address,

  • Billing and, if applicable, delivery address,

  • Content of the order,

  • Billing and payment data,

  • Company name and VAT ID No., if applicable.

The collection of this data takes place:

  • to process, fulfill, and handle your order;

  • for correspondence with you;

  • for invoicing and

  • to manage our customer data for registered customers.

The data processing takes place upon your order and is necessary in accordance with Art. 6 (1) sentence 1 lit. b GDPR for the stated purposes for the appropriate processing of your order and for the fulfillment of our obligations arising from the purchase contract. In addition, we process your email address in accordance with Art. 6 (1) sentence 1 lit. c GDPR, as we are legally obligated to send you an electronic order confirmation.

We store the personal data collected by us for the processing of your order until the expiry of the statutory or potential contractual warranty and guarantee rights (regularly two years by law). After this period has expired, your data will be deleted by us unless we are obligated to store it for a longer period in accordance with Article 6 (1) sentence 1 lit. c GDPR due to tax and commercial law retention and documentation requirements (from UStG, HGB, StGB or AO) or you have consented to storage beyond this in accordance with Art. 6 (1) sentence 1 lit. a GDPR.

(3) Law Enforcement

Insofar as this is necessary for the establishment, exercise, or defense of legal claims (e.g., in the event of payment defaults), we may also process your personal data on the basis of our legitimate interests in law enforcement in accordance with Art. 6 (1) sentence 1 lit. f GDPR.

(4) Cookies | Analysis

We use cookies on our website. These are small text files that are placed on your end device and stored by your browser. Cookies do no harm and do not contain viruses.

Most of the cookies we use are so-called "session cookies". They serve us in particular to recognize whether you have already visited individual pages of our website and are automatically deleted after the end of your visit. Other cookies remain on your end device for a certain period of time ("persistent cookies") and enable us to recognize your browser on your next visit and to save the content of your shopping cart.

Cookies can be controlled using all internet browsers. If you want to use the full functionality of the website, you should set your browser to accept session cookies. If you do not want cookies to be stored on your computer, you should deactivate the corresponding option in the browser's system settings.

Technically necessary cookies:

We use technically necessary cookies. These are required for the smooth functioning of the website. We use these in accordance with Art. 6 (1) sentence 1 lit. f GDPR on the basis of our legitimate interests. The following data is processed:

  • Language setting

Analysis cookies:

For the needs-based design and continuous optimization of our web pages, we also use software for the statistical evaluation of visitor access provided by Piwik PRO GmbH, Kurfürstendamm 21, 10719 Berlin. Piwik PRO also uses cookies that are stored on your end device and that enable an analysis of the use of the website. The following data is processed:

  • IP address (this is anonymized immediately after processing and prior to storage)

The cookies are automatically deleted after one year.

We only use Piwik PRO on the basis of your voluntary consent in accordance with Art. 6 (1) sentence 1 lit. a GDPR. You will see the consent options when you visit our website for the first time.

(5) Contact Form | Contact via Email

If you send us inquiries via the contact form on our website or by email, your details from the inquiry form, including the contact details you provided there, will be stored by us for the purpose of processing the inquiry and in the event of follow-up questions.

The processing of the data entered in the contact form takes place on the basis of Art. 6 (1) sentence 1 lit. b GDPR, provided it is necessary for the performance of a contract or the implementation of pre-contractual measures, and otherwise on the basis of our legitimate interests according to Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interests lie in responding to user inquiries.

The data will be deleted after the final processing of your request, but no later than the end of the calendar year following the last contact with you, unless we are legally obligated to retain the data beyond this period. Please note that data transmission over the Internet is generally not always secure. Particularly in email traffic, protection during data exchange cannot be guaranteed.

(6) Telephone Contact

If you contact us by phone, your contact details, including your telephone number, will be stored by us for the purpose of processing the inquiry and in the event of follow-up questions.

The data is processed on the basis of Art. 6 (1) sentence 1 lit. b GDPR, provided it is necessary for the performance of a contract or the implementation of pre-contractual measures, and otherwise on the basis of our legitimate interests according to Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interests lie in responding to customer concerns.

4. Disclosure of Data to Third Parties and Other Recipients

We only transfer personal data to third parties if this is necessary in the context of contract processing, for example to the companies entrusted with the delivery of the goods or the credit institution commissioned with the payment processing. A further transfer of the data to third parties does not take place unless you have expressly consented to this; in particular, we do not pass on your data to recipients located outside the European Union or the European Economic Area.

To process your order, we pass on the data to the third parties named below. In addition, we use the service providers listed under "other recipients" who process the data on our behalf.

a) Shipping Service Providers

For contract processing, we use the external logistics service providers DHL / Deutsche Post (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn) and MB mail & service GmbH + Co. KG (Daimlerstraße 10, 74372 Sersheim). We pass on your name and delivery address to them, provided this is necessary for the delivery of the ordered goods. The legal basis for this is Art. 6 (1) sentence 1 lit. b GDPR.

b) Payment Service Providers

General

In addition, your payment data, insofar as required for payment processing, is passed on to the payment service provider commissioned by us or selected by you in the ordering process, as well as the credit institution commissioned with the payment. The legal basis for this is Art. 6 (1) sentence 1 lit. b GDPR.

PayPal

On our website, we offer, among other things, payment via PayPal. The provider of this payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal").

PayPal reserves the right to carry out a credit check for the payment methods credit card via PayPal, direct debit via PayPal, or "purchase on account" via PayPal. PayPal uses the result of the credit check with regard to the statistical probability of non-payment for the purpose of deciding on the provision of the respective payment method. Further data protection information can be found in the PayPal Privacy Policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

c) Other Recipients

Fulfillment Partner Atlas Service GmbH

Atlas Service GmbH, Breitwiesenstr. 9, 70565 Stuttgart, has been commissioned by us to support the online shop in the areas of communication, logistics, and the dispatch of goods, and processes your personal data for these purposes on our behalf and upon our instruction (Art. 28 GDPR).

Operation of the Online Shop

For the operation of our online shop, we use the service provider Code Rockets, Waldackerweg 72, 73732 Esslingen am Neckar, which carries out the associated data processing on our behalf and upon our instruction (Art. 28 GDPR).

Hosting

We host the online shop with the provider Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen. A data processing agreement has been concluded between the service provider Code Rockets and Hetzner Online GmbH.

Myra Security

We use the service "Myra Security". The provider is Myra Security GmbH, Landsberger Straße 187, 80687 München (hereinafter "Myra").

Myra offers a globally distributed Content Delivery Network with DNS, as well as DDoS protection and a firewall. Technically, the information transfer between your browser and our website is routed via the Myra network. This enables Myra to analyze the data traffic between your browser and our website and to serve as a filter between our servers and potentially malicious data traffic from the Internet. Myra may also use cookies or other technologies to recognize internet users, which, however, are used solely for the purpose described here (defense against attacks and not for marketing purposes). Since the service is necessary for the technical security of the website, the legal basis is our legitimate interest in accordance with Art. 6 (1) sentence 1 lit. f GDPR. We have concluded a data processing agreement with Myra in accordance with Art. 28 GDPR. The use of Myra is based on our legitimate interest in an as error-free and secure provision of our web presence as possible (Art. 6 (1) lit. f GDPR).

d) Authorities and Courts

Your data will only be passed on, e.g., to supervisory authorities and law enforcement authorities, within the framework of legal provisions if it is necessary for the prevention and detection of fraud cases and other criminal offenses, to ensure appropriate player protection, or to ensure the security of our data processing systems. Depending on the individual case, the legal bases for this are Art. 6 (1) sentence 1 lit. c (fulfillment of legal obligations) or lit. f GDPR (protection of legitimate interests).

5. What rights do you have?

a) Right of Withdrawal

Insofar as we process your data on the basis of your consent according to Art. 6 (1) sentence 1 lit. a GDPR, you can revoke your consent at any time with effect for the future. The legality of the data processing carried out until the revocation remains unaffected by the revocation. For the revocation of consent to data processing, an informal message to us using the contact details mentioned in Section 1 or Section 2 is sufficient.

b) Right to Object

You have the right to object at any time to the processing of your personal data for reasons arising from your particular situation, provided this is based on Art. 6 (1) sentence 1 lit. f GDPR ("legitimate interests") (Art. 21 GDPR). In this case, we will no longer process your personal data unless there are compelling legitimate grounds for the processing that outweigh your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims. A short message to the contact details mentioned in Section 1 or Section 2 is sufficient to exercise the right to object.

c) Data Subject Rights

In addition, you may – provided the respective legal requirements are met and subject to any restrictions according to §§ 9, 10 LDSG BW (State Data Protection Act of Baden-Württemberg) – claim the following rights, which you can exercise at any time by contacting us using the data provided in Sections 1 and 2:

  • Right of access according to Art. 15 GDPR: You have the right to obtain information about your personal data processed by us (the purposes of the processing, the categories of personal data processed, the recipients or categories of recipients to whom your data has been or will be disclosed, the planned storage duration or the criteria for determining the storage duration, the existence of a right to rectification, erasure, restriction of processing, objection to processing, the right to lodge a complaint with a supervisory authority, the origin of your data if it was not collected from you by us, the existence of automated decision-making including profiling and, where applicable, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you, and your right to be informed about the appropriate safeguards according to Art. 46 GDPR in connection with the transfer of your data to third countries) and a copy of the data;

  • Right to rectification according to Art. 16 GDPR: You have the right to demand the immediate rectification of incorrect data concerning you and/or the completion of your incomplete data stored by us;

  • Right to erasure according to Art. 17 GDPR: You have the right to request the erasure of your personal data if the requirements of Art. 17 (1) GDPR are met. However, this right does not exist, in particular, if the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims;

  • Right to restriction of processing according to Art. 18 GDPR: You have the right to request the restriction of the processing of your personal data as long as the accuracy of your data, which you contest, is being verified; if you reject the erasure of your data due to unlawful data processing and instead request the restriction of the processing of your data; if you need your data for the establishment, exercise, or defense of legal claims after we no longer need this data once its purpose has been achieved; or if you have lodged an objection for reasons related to your particular situation, as long as it has not yet been determined whether our legitimate reasons prevail;

  • Right to information according to Art. 19 GDPR: If you have asserted the right to rectification, erasure, or restriction of processing against the controller, the controller is obligated to communicate this rectification or erasure of the data or restriction of processing to each recipient to whom the personal data concerning you has been disclosed, unless this proves impossible or involves a disproportionate effort. You have the right to be informed about these recipients.

  • Right to data portability according to Art. 20 GDPR: You have the right to receive your personal data, which you have provided to us, in a structured, commonly used, and machine-readable format or to request its transmission to another controller, provided this is technically feasible;

d) Right to Lodge a Complaint

If you believe that the processing of personal data concerning you violates the GDPR, you have the right – without prejudice to any other administrative or judicial remedy – to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, in accordance with Art. 77 GDPR. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Heilbronner Straße 35, 70191 Stuttgart.

6. Data Security

This site uses SSL encryption for security reasons and to protect the transmission of confidential content, such as the inquiries you send to us as the site operator. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

Back to top