Privacy Policy

Unless otherwise stated below, the provision of your personal data is neither legally or
contractually required, nor necessary for the conclusion of a contract. You are not obliged to provide the data.
Failure to provide the data has no consequences. This only applies unless otherwise stated in the following processing operations.

“Personal data” means all information relating to an identified or identifiable natural person.

Server Log Files
You can visit our websites without providing any personal information.
Each time you access our website, usage data is transmitted to us or our web host / IT service provider by your internet browser
and stored in log files (so-called server log files). This stored data includes, for example, the name of the
accessed page, date and time of access, IP address, amount of data transferred, and the requesting provider.
The processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in ensuring the
trouble-free operation of our website and to improve our services.
Your data may be transferred to third countries outside the European Union for which an
adequacy decision of the EU Commission exists. Insofar as no adequacy decision of the EU Commission exists, such as for
transfers to the USA, data transfers are based, among other things, on standard contractual clauses as suitable guarantees for the protection of
personal data, viewable at: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_de

Contact

Controller
Contact us if you wish. The controller for data processing is: Janek Göhler, Höckendorfer
Str.18, 01705 Freital Germany, +493514760217, janek.goehler@zinn-giesserei-goehler.com

Customer Initiated Contact via Email
If you proactively contact us by email for business purposes, we collect your personal data (name, email address,
message text) only to the extent provided by you. The data processing serves the purpose of processing and responding to
your contact request. If the contact serves the implementation of pre-contractual measures (e.g., consultation for purchase interest, offer creation)
or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 para. 1
lit. b GDPR.
If contact is made for other reasons, this data processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR due to
our overriding legitimate interest in processing and responding to your request. In this case, you have the right,
for reasons arising from your particular situation, to object at any time to this processing based on Art. 6 para. 1 lit. f GDPR
to object to the processing of your personal data.
We only use your email address to process your request. Your data will then be deleted in compliance with statutory
retention periods, unless you have consented to further processing and use.

Collection and Processing when Using the Contact Form
When using the contact form, we collect your personal data (name, email address, message text) only to the extent
provided by you. The data processing serves the purpose of contacting you. If the contact serves the implementation of pre-contractual measures (e.g., consultation for purchase interest, offer creation)
or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 para. 1
lit. b GDPR.
If contact is made for other reasons, this data processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR due to
our overriding legitimate interest in processing and responding to your request. In this case, you have the right,
for reasons arising from your particular situation, to object at any time to this processing based on Art. 6 para. 1 lit. f GDPR
to object to the processing of your personal data.
We only use your email address to process your request. Your data will then be deleted in compliance with statutory
retention periods, unless you have consented to further processing and use.

Customer Account Orders

Customer Account
When opening a customer account, we collect your personal data to the extent specified there. The
data processing serves the purpose of improving your shopping experience and simplifying order processing. The processing
is carried out on the basis of Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by notifying us,
without affecting the lawfulness of the processing carried out based on the consent until revocation. Your
customer account will then be deleted.
Collection, Processing, and Disclosure of Personal Data for Orders
When placing an order, we collect and process your personal data only to the extent necessary for the fulfillment and processing of your
order and for handling your inquiries. The provision of data is necessary for the conclusion of the contract.
You are not obliged to provide the data. Failure to provide the data means that no contract can be concluded. The processing is carried out on the basis of Art. 6 para. 1 lit.
b GDPR and is necessary for the fulfillment of a contract with you.
Your data may be passed on, for example, to the shipping companies and dropshipping providers selected by you,
payment service providers, service providers for order processing, and IT service providers. In all cases, we strictly adhere to legal
requirements. The scope of data transmission is limited to a minimum.
Your data may be transferred to third countries outside the European Union for which an
adequacy decision of the EU Commission exists. Insofar as no adequacy decision of the EU Commission exists, such as for
transfers to the USA, data transfers are based, among other things, on standard contractual clauses as suitable guarantees for the protection of
personal data, viewable at: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_de

Disclosure of Email Address to Shipping Companies for Information on Shipping Status
We pass on your email address to the transport company as part of contract processing, provided you have expressly agreed to this in the
order process. The disclosure serves the purpose of informing you about the shipping status via email. The
processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by
notifying us or the transport company, without affecting the lawfulness of the processing carried out based on the consent until
revocation.

Payment Service Providers

Use of PayPal Checkout
On our website, we use the payment service PayPal Checkout from PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard
Royal L-2449, Luxembourg; “PayPal”). The data processing serves the purpose of being able to offer you payment via the payment service. By selecting and using payment via PayPal, credit card via PayPal, direct debit via PayPal, or “Pay Later” via PayPal,
the data required for payment processing is transmitted to PayPal to fulfill the contract with you using the chosen payment method. This processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR.
Credit Card via PayPal, Direct Debit via PayPal & “Pay Later” via PayPal
For individual payment methods such as credit card via PayPal, direct debit via PayPal, or “Pay Later” via PayPal, PayPal reserves the
right to obtain a credit report, if necessary, based on mathematical-statistical procedures using credit agencies.
For this purpose, PayPal transmits the personal data required for a credit check to a credit agency and uses the
information received about the statistical probability of a payment default for a balanced decision on the
establishment, execution, or termination of the contractual relationship. The credit report may contain probability values (score values) that are calculated based on scientifically recognized mathematical-statistical procedures and whose
calculation includes, among other things, address data. Your legitimate interests are taken into account in accordance with legal provisions.
The data processing serves the purpose of credit assessment for contract initiation. The processing is carried out on the
basis of Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in protecting against payment default when PayPal
makes advance payments.
You have the right, for reasons arising from your particular situation, to object at any time to this processing based on Art. 6 para. 1 lit. f
GDPR-based processing of your personal data by notifying PayPal. The
provision of data is required for the conclusion of the contract with your desired payment method. Failure to provide the data means that the contract cannot be concluded with the payment method you have chosen.

Third-Party Providers
When paying via a third-party payment method, the data required for payment processing is transmitted to PayPal.
This processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR. To carry out this payment method, the data may
then be forwarded by PayPal to the respective provider. This processing is carried out on the basis of Art. 6 Abs. 1 lit. b DSGVO.
Local third-party providers may include:

Sofort (SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany)
giropay (Paydirekt GmbH, Stephanstr. 14-16, 60313 Frankfurt am Main)

Invoice Purchase via PayPal
When paying via the invoice purchase payment method, the data required for payment processing is first transmitted to PayPal.
To carry out this payment method, the data is then transmitted by PayPal to Ratepay GmbH (Franklinstraße 28-29,
10587 Berlin; “Ratepay”) to fulfill the contract with you using the chosen payment method. This processing is carried out on the
basis of Art. 6 para. 1 lit. b GDPR. Ratepay may carry out a credit report based on mathematical-statistical procedures
(probability or score values) using credit agencies, following the process described above. The
data processing serves the purpose of credit assessment for contract initiation. The processing is carried out on the basis of Art. 6
para. 1 lit. f GDPR due to our overriding legitimate interest in protecting against payment default when Ratepay makes advance payments. Further information on data protection and which credit agencies Ratepay uses can be found at https://www.ratepay.com/legal-payment-dataprivacy/ and https://www.ratepay.com/legal-payment-creditagencies/.

Further information on data processing when using PayPal can be found in the associated privacy policy at
https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Plugins and Miscellaneous

Use of Google Tag Manager
On our website, we use the Google Tag Manager from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland;
“Google”).
This application manages JavaScript tags and HTML tags, which are used for the implementation of tracking and
analysis tools in particular. The data processing serves the purpose of designing and optimizing our
website according to needs.
The Google Tag Manager itself does not store cookies, nor does it process personal data. However, it enables
the triggering of further tags that can collect and process personal data.
Further information on terms of use and data protection can be found here.

Data Subject Rights and Storage Period

Storage Duration
After complete contract processing, the data is initially stored for the duration of the warranty period, then taking into account
statutory, in particular tax and commercial law, retention periods, and then deleted after the expiry of the period, unless
you have consented to further processing and use.

Rights of the Data Subject
Subject to the legal requirements, you have the following rights under Art. 15 to 20 GDPR: Right to information, to
rectification, to erasure, to restriction of processing, to data portability.
Furthermore, under Art. 21 para. 1 GDPR, you have a right to object to processing based on Art. 6 para. 1 f GDPR,
as well as to processing for the purpose of direct marketing.

Right to Lodge a Complaint with the Supervisory Authority
According to Art. 77 GDPR, you have the right to lodge a complaint with the supervisory authority if you believe that the
processing of your personal data is not lawful.

You can lodge a complaint, among others, with the supervisory authority responsible for us, which you can reach using the following contact details:

Saxon Data Protection Commissioner
Devrientstraße 5
01067 Dresden
Tel.: +49 351 85471101
Fax: +49 351 85471109
Email: saechsdsb@slt.sachsen.de

Right to Object
If the personal data processing listed here is based on our legitimate interest according to Art. 6 para.
1 lit. f GDPR, you have the right, for reasons arising from your particular situation, to object to this processing at any time with
effect for the future.
After an objection has been made, the processing of the data concerned will be terminated, unless we can demonstrate compelling legitimate
grounds for the processing that override your interests, rights, and freedoms, or if the processing serves the
assertion, exercise, or defense of legal claims.

Last updated: July 13, 2023