Privacy Policy

 

PRIVACY POLICY

 

• Controller responsible for data processing

The controller within the meaning of Art. 4 No. 7 GDPR is:

Hahn a syn s.r.o.
Lelkova 186/4, 747 21 Kravaře, Czech Republic
Company Registration Number (IČO): 07882076
VAT ID No.: CZ07882076
Registered in the Commercial Register maintained by the Regional Court in Ostrava, Section C, File 77562
Managing Director: B.A. Lukas Hahn

E-mail: info@hahn-profis.de
Telephone: +49 9944 890 9896, +49 163 02 44 737

For all questions regarding the processing of your personal data and the exercise of your rights under the GDPR, you can contact us at any time using the contact details listed above.

 

• 1 General Information

Your personal data (e.g. title, name, address, e-mail address, telephone number, bank details, credit card number) are processed by us only in accordance with the provisions of German data protection law and the data protection law of the European Union (EU). In addition to the purposes of processing, recipients, legal bases, and storage periods, the following provisions also inform you about your rights and the controller responsible for processing your data. This Privacy Policy applies only to our websites. If you are redirected to other websites via links on our pages, please refer to those websites for information about how they handle your data.

 

• 2 Data Processing for Contract Performance

(1) Purpose of processing

The personal data that you provide to us during the ordering process are required in order to conclude a contract with us. You are not obliged to provide your personal data. However, without your address, we cannot send the goods to you. For some payment methods, we require the necessary payment details in order to pass them on to a payment service provider commissioned by us. The data entered by you during the ordering process are therefore processed for the purpose of performing the contract.

If you submit an enquiry to us before conclusion of the contract by e-mail, contact form, etc., we process the data received in this way in order to carry out pre-contractual measures and, for example, answer your questions about our products.

 

(2) Legal basis

The legal basis for this processing is Art. 6(1)(b) GDPR.

 

(3) Categories of recipients

Payment service providers, shipping service providers, hosting providers, where applicable inventory management systems, and where applicable suppliers (dropshipping).

 

(4) Storage period

We store the data required for processing the contract until the expiry of the statutory warranty periods and, where applicable, contractual guarantee periods.

We retain data required under commercial and tax law for the periods prescribed by law, generally ten years (see Section 257 HGB, Section 147 AO).

Data processed for the implementation of pre-contractual measures are deleted as soon as those measures have been completed and it is evident that no contract will be concluded.

 

• 3 Information about Cookies

(1) Purpose of processing

Technically necessary cookies are used on this website. These are small text files that are not permanently stored in or by your Internet browser on your computer system. These cookies make it possible, for example, to place several products in a shopping cart.

Other cookies remain stored permanently and recognise your browser when you visit again. These cookies make it possible, for example, to store your passwords for a customer account permanently.

 

(2) Legal bases 

The legal basis for the processing is Art. 6(1)(a) GDPR.

Where applicable, you have expressly given the following consent to the use of cookies on our website:

This site requires cookies. Do you agree to the use of cookies? “Yes”

 

(3) Storage period

Technically necessary cookies are generally deleted when the browser is closed. Permanently stored cookies have varying lifetimes ranging from a few minutes to several years.

 

(4) Right of withdrawal

If you do not wish these cookies to be stored, please disable acceptance of these cookies in your Internet browser. However, this may result in restrictions to the functionality of our website.

You can withdraw your consent to permanent storage by deleting the stored cookies through your browser.

• 4 Integration of Third-Party Services and Content

(1) Privacy policy for the use of Facebook Tracking

This website uses the remarketing function “Custom Audiences” of Facebook Inc. (“Facebook”). This function is used to display interest-based advertisements (“Facebook Ads”) to visitors of this website when they visit the Facebook social network. For this purpose, the Facebook remarketing tag has been implemented on this website. When you visit the website, this tag establishes a direct connection to Facebook's servers. The Facebook server is informed that you have visited this website, and Facebook assigns this information to your personal Facebook user account. Further information about the collection and use of data by Facebook as well as your rights and options for protecting your privacy can be found in Facebook's privacy information at https://www.facebook.com/about/privacy/. Alternatively, you can deactivate the “Custom Audiences” remarketing function at https://www.facebook.com/settings/?tab=ads#_=_. To do so, you must be logged in to Facebook.

Data may be disclosed to third parties.

• 5 Rights of the Data Subject

If your personal data are processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

 

1. Right of access

You may request confirmation from the controller as to whether personal data concerning you are being processed by us.

If such processing takes place, you may request information from the controller regarding the following:

(1) the purposes for which the personal data are processed;

(2) the categories of personal data being processed;

(3) the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;

(4) the envisaged period for which the personal data concerning you will be stored or, if specific information cannot be provided, the criteria used to determine the storage period;

(5) the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the controller, or a right to object to such processing;

(6) the existence of a right to lodge a complaint with a supervisory authority;

(7) all available information about the source of the data where the personal data are not collected from the data subject;

(8) the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved as well as the significance and envisaged consequences of such processing for the data subject.

You have the right to request information as to whether the personal data concerning you are transferred to a third country or to an international organisation. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.

 

2. Right to rectification

You have the right to rectification and/or completion by the controller if the personal data concerning you that are being processed are inaccurate or incomplete. The controller must carry out the rectification without undue delay.

 

3. Right to restriction of processing

You may request restriction of the processing of personal data concerning you under the following conditions:

(1) if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;

(2) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;

(3) the controller no longer needs the personal data for the purposes of processing, but you require them for the establishment, exercise, or defence of legal claims, or

(4) if you have objected to processing pursuant to Art. 21(1) GDPR and it has not yet been determined whether the legitimate grounds of the controller override your grounds.

Where the processing of personal data concerning you has been restricted, such data may, apart from storage, only be processed with your consent or for the establishment, exercise, or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If the restriction of processing has been imposed under the above conditions, you will be informed by the controller before the restriction is lifted.

 

4. Right to erasure
5. a) Obligation to erase

You may request that the controller erase personal data concerning you without undue delay, and the controller is obliged to erase such data without undue delay where one of the following grounds applies:

(1) The personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed.

(2) You withdraw your consent on which the processing is based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal ground for the processing.

(3) You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR.

(4) The personal data concerning you have been unlawfully processed.

(5) The personal data concerning you must be erased in order to comply with a legal obligation under Union law or the law of Member States to which the controller is subject.

(6) The personal data concerning you have been collected in relation to the offer of information society services pursuant to Art. 8(1) GDPR.

 

1. b) Information to third parties

Where the controller has made the personal data concerning you public and is obliged pursuant to Art. 17(1) GDPR to erase them, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers processing the personal data that you, as the data subject, have requested the erasure of any links to, or copies or replication of, those personal data.

 

1. c) Exceptions

The right to erasure does not apply to the extent that processing is necessary

(1) for exercising the right of freedom of expression and information;

(2) for compliance with a legal obligation that requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(3) for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) and Art. 9(3) GDPR;

(4) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Art. 89(1) GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or

(5) for the establishment, exercise, or defence of legal claims.

 

5. Right to notification

If you have exercised your right to rectification, erasure, or restriction of processing against the controller, the controller is obliged to communicate this rectification or erasure of data or restriction of processing to all recipients to whom the personal data concerning you have been disclosed, unless this proves impossible or involves disproportionate effort.

You have the right to be informed by the controller about these recipients.

 

6. Right to data portability

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used, and machine-readable format. You also have the right to transmit those data to another controller without hindrance from the controller to whom the personal data were provided, where

(1) the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and

(2) the processing is carried out by automated means.

In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. The freedoms and rights of other persons must not be adversely affected by this.

The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

 

7. Right to object

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on those provisions.

The controller will no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defence of legal claims.

Where personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for the purposes of such marketing; this also applies to profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for such purposes.

In connection with the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

 

8. Right to withdraw consent under data protection law

You have the right to withdraw your data protection consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

 

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing - including profiling - which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

(1) is necessary for entering into or performance of a contract between you and the controller,

(2) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or

(3) is based on your explicit consent.

However, these decisions may not be based on special categories of personal data referred to in Art. 9(1) GDPR unless Art. 9(2)(a) or (g) applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

With regard to the cases referred to in (1) and (3), the controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your point of view, and to contest the decision.

  

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.