Privacy Policy

We are pleased about your visit to our website www.amydeluxe.de/ and your interest in our company.

The protection of your personal data, such as date of birth, name, telephone number, address, etc., is very important to us.

The purpose of this privacy policy is to inform you about the processing of your personal data that we collect when you visit our website. Our data protection practices comply with the legal regulations of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The following privacy policy serves to fulfill the information obligations arising from the GDPR. These can be found, for example, in Articles 13 and 14 et seq. of the GDPR.

Responsible

The controller within the meaning of Article 4 No. 7 GDPR is the person who, alone or jointly with others, decides on the purposes and means of processing personal data.

With regard to our website, the responsible party is:

Amy Deluxe Ibrahim Dabes eK,
Pöttmeser Str. 20,
86165 Augsburg,
Germany,
Email: onlineshop@amydeluxe.de
, Tel.: +49 821 90726623

Provision of the website and creation of log files

Each time our website is accessed, our system automatically collects data and information from the accessing device (e.g., computer, mobile phone, tablet, etc.).

What personal data is collected and to what extent is it processed?

(1) Information about the browser type and version used;
(2) The operating system of the accessing device;
(3) Hostname of the accessing computer;
(4) The IP address of the accessing device;
(5) Date and time of access;
(6) Websites and resources (images, files, other page content) accessed on our website;
(7) Websites from which the user's system accessed our website (referrer tracking);
(8) Notification of whether the access was successful;
(9) Amount of data transferred

This data is stored in our system's log files. This data is not stored together with the personal data of any specific user, so individual website visitors cannot be identified.

Legal basis for the processing of personal data

Article 6 paragraph 1 letter f GDPR (legitimate interest). Our legitimate interest lies in ensuring the achievement of the purpose described below.

Purpose of data processing

The temporary (automated) storage of data is necessary for the operation of a website visit to enable the website to be delivered. The storage and processing of personal data also serves to maintain the compatibility of our website for as many visitors as possible and to combat misuse and resolve malfunctions. For this purpose, it is necessary to log the technical data of the requesting computer in order to react as quickly as possible to display errors, attacks on our IT systems, and/or malfunctions of our website. Furthermore, the data helps us to optimize the website and to generally ensure the security of our IT systems.

Storage duration

The aforementioned technical data will be deleted as soon as it is no longer needed to ensure the compatibility of the website for all visitors, but no later than 3 months after accessing our website.

Right to object and to have data deleted

You can object to the processing of your data at any time in accordance with Article 21 of the GDPR and request the erasure of your data in accordance with Article 17 of the GDPR. Information about your rights and how to exercise them can be found at the bottom of this privacy policy.

Special features of the website

Our website offers various features, and when you use them, we collect, process, and store your personal data. Below we explain what happens to this data:

Rating function

• What personal data is collected and to what extent is it processed?

  We will process the data you enter into the fields of our evaluation form to fulfill the purpose stated below.

• Legal basis for the processing of personal data

  Article 6 paragraph 1 letter a GDPR or Article 9 paragraph 2 letter a GDPR (consent by clear affirmative action or behavior or explicit consent)

• Purpose of data processing

  The purpose of data processing is to accept and publish your review on our website and – if you explicitly agree – also on the internet platforms of our review service providers.

• Storage duration

  Your review will be stored and published indefinitely. We reserve the right to delete it without giving reasons and without prior or subsequent notification.

• Right of withdrawal and deletion

  You can withdraw your consent to the publication of the review at any time in accordance with Article 7(3) GDPR. However, processing carried out before the withdrawal remains unaffected. For information on your other rights, please refer to the overview at the end of this privacy policy.

• Necessity of providing personal data

  Providing information in the review function is voluntary and is neither contractually nor legally required. Furthermore, this information is not necessary for entering into a contract. If you do not complete the required fields, or do not complete them fully, your requested review cannot be published on our platform.

Comment function

• What personal data is collected and to what extent is it processed?

  The personal data you leave in your comment, such as the content of your comment, your name or pseudonym, your email address, etc., will be processed by us for the purpose stated below.

• Legal basis for the processing of personal data

  Article 6 paragraph 1 letter a GDPR or Article 9 paragraph 2 letter a GDPR (consent by clear affirmative action or behavior or explicit consent)

• Purpose of data processing

  The purpose of data processing is to accept and publish your comment on our website.

• Storage duration

  Your comment will be stored and published indefinitely. We reserve the right to delete it without giving reasons and without prior or subsequent notification.

• Right of withdrawal and deletion

  Upon your request, we will delete your comments immediately. Please use the "delete" function or contact us. The options for revocation and deletion are governed by the general provisions regarding the right to revoke consent and the right to erasure under data protection law, as described below in this privacy policy.

• Necessity of providing personal data

  The use of the comment function is neither contractually nor legally required, nor is it necessary for concluding a contract. Use of the comment function is entirely voluntary. You are not obligated to write a comment on our site. If you wish to leave a comment, you must fill in the fields marked as required. If you do not fill in the required information, your comment cannot be published.

Contact form(s)

• What personal data is collected and to what extent is it processed?

  The data you enter into our contact forms, which you have entered into the input mask of the contact form, will be processed by us to fulfill the purpose stated below.

• Legal basis for the processing of personal data

  Article 6 paragraph 1 letter a GDPR or Article 9 paragraph 2 letter a GDPR (consent by clear affirmative action or behavior or explicit consent)

• Purpose of data processing

  The data collected via our contact form(s) will only be used to process the specific contact request received through the contact form.

• Storage duration

  After your request has been processed, the collected data will be deleted immediately, unless statutory retention periods apply.

• Right of withdrawal and deletion

  The options for revocation and deletion are governed by the general regulations on the right of revocation and the right to erasure under data protection law as described below in this privacy policy.

• Necessity of providing personal data

  The use of the contact forms is voluntary and neither contractually nor legally required. You are not obligated to contact us via the contact form; you can also use the other contact options listed on our website. If you wish to use our contact form, you must fill in the fields marked as mandatory. If you do not fill in the required information in the contact form, you will either be unable to submit the request, or we will unfortunately be unable to process it.

Login area

• What personal data is collected and to what extent is it processed?

  We will process the registration and login data you have entered with us to fulfill the purpose stated below.

• Legal basis for the processing of personal data

  Article 6 paragraph 1 letter b GDPR (performance of (pre-)contractual measures)

• Purpose of data processing

  You have the option of using a separate login area on our website. To verify your authorization to access the protected area and/or documents, you must enter your login details (email address or username and password) in the corresponding form.

• Storage duration

  The collected data will be stored for as long as you maintain a user account with us.

• Right to object and to have data deleted

  You can find information about your rights and how to exercise them in the section below this privacy policy.

• Necessity of providing personal data

  The use of the login area on our site is contractually required to access the protected area. Access to the content protected by the login area is not possible without entering your personal data. If you wish to use our login area, you must fill in the fields marked as mandatory (username and password). Entering this data requires an existing user account. Login is not possible if the data you enter is incorrect. If your data is incorrect or missing, you cannot access the protected area. However, the rest of the site remains accessible without logging in.

Newsletter registration form

• What personal data is collected and to what extent is it processed?

  By subscribing to the newsletter on our website, we receive the email address you entered in the registration field and, if applicable, further contact details, provided you give them to us via the newsletter registration form.

• Legal basis for the processing of personal data

  Article 6 paragraph 1 letter a GDPR or Article 9 paragraph 2 letter a GDPR (consent by clear affirmative action or behavior or explicit consent)

• Purpose of data processing

  The data collected in our newsletter registration form will be used exclusively for sending our newsletter, in which we inform you about all our services and news. After registration, we will send you a confirmation email containing a link that you must click to complete your newsletter subscription (double opt-in).

• Storage duration

  You can unsubscribe from our newsletter at any time by clicking the unsubscribe link, which is included in every newsletter. Your data will be deleted immediately after you unsubscribe. Similarly, your data will be deleted immediately if you do not complete the registration process. We reserve the right to delete your data without giving reasons and without prior or subsequent notification.

• Right of withdrawal and removal

  You can withdraw your consent at any time in accordance with Article 7(3) GDPR. However, processing carried out before the withdrawal remains unaffected. For information on your other rights, please refer to the overview at the end of this privacy policy.

• Necessity of providing personal data

  If you wish to subscribe to our newsletter, you must fill in the fields marked as mandatory and confirm your email address by clicking the double opt-in link. Providing this information for newsletter registration is neither necessary to enter into a contract with us nor legally required. It is used solely for sending our newsletter. If you do not fill in the required information, we unfortunately cannot provide you with our newsletter service.

Online cancellation form

• Scope of processing personal data and personal data collected

  The data you enter into the form fields of the online cancellation form (such as your name, information to identify the cancelled contract and an electronic means of communication such as your email address) will be processed by us to fulfill the purpose described below.

• Legal basis for the processing of personal data

  Article 6 paragraph 1 letter c GDPR (compliance with a legal obligation)

• Purpose of data processing

  The processing of your data is necessary to comply with our legal obligations regarding the handling of your right of withdrawal for distance contracts. If you exercise your statutory right of withdrawal, we are legally obligated to accept your declaration, properly unwind the contract, and, if the withdrawal is submitted electronically, to immediately confirm receipt of it on a durable medium (e.g., by email). The processing of the data entered in the form is essential for fulfilling all these legal requirements. Collecting this data is legally necessary to enable you to declare your withdrawal online, to clearly link the withdrawal to your existing contract, and to carry out the lawful unwinding of the contract. Furthermore, the processing serves the purpose of providing you with immediate confirmation of receipt of your withdrawal, which we are legally required to do.

• Storage duration

  The data collected via our online cancellation form is generally transferred to our accounting records after the cancellation has been processed and the contract has been fully reversed. It is stored there in accordance with statutory (in particular tax and commercial law) retention periods and deleted after these periods expire, as it serves as proof of the proper contract reversal.

• Right to object and to have data deleted

  You can find information about your rights in the section below this privacy policy.

• Necessity of providing personal data

  Providing your data in the online cancellation form is legally and contractually mandatory to process your cancellation properly. Of course, you can also use the sample cancellation form or other legally permissible methods of cancellation at any time. However, if you choose to submit your cancellation electronically via our form, providing this data is necessary to effectively assign your declaration to our system and to fulfill our legal obligations (such as sending confirmation of receipt). If you do not complete all the required information correctly, your cancellation may not be submitted or processed.

Automated credit check / scoring

If you wish to enter into a contract with us, we reserve the right to process your personal data exclusively using automated means to check your creditworthiness. We are also authorized to make such automated decisions pursuant to Article 22 Paragraph 2 a of the GDPR. Whether or not the contract can be concluded depends on the result of the automated credit check. A credit check calculates statistical probabilities of payment default. The credit report may include probability values ​​(score values) calculated using scientifically recognized mathematical-statistical methods. A variety of characteristics, such as income, address data, occupation, marital status, and previous payment behavior, are used to infer the customer's future risk of payment default. The result is expressed as a payment value (so-called score). The information obtained in this way forms the basis of our decision regarding the establishment, execution, or termination of a contractual relationship. If you believe that you have been wrongly excluded from concluding a contract due to the credit check, you are welcome to explain your position to us by email. We will then review the automated decision in accordance with Article 22(3) GDPR in the specific individual case. In order to carry out the credit check, we are permitted to store and process your personal data in accordance with Article 6(1)(b) GDPR.

Due to the pending contract, we will transmit your data to the following provider(s) in the cases listed below:

• Klarna Bank AB (publ):

  Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden ( https://www.klarna.com/de/ ): Our company regularly checks your creditworthiness when concluding contracts and, in certain cases where there is a legitimate interest, also for existing customers. For this purpose, we work with Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden, from whom we obtain the necessary data. We transmit your name and contact details to Klarna Bank AB (publ) for this purpose.

• Automatic identity and credit check when selecting Klarna payment methods

  • What personal data is collected and to what extent is it processed?

    If you choose to pay by invoice with Klarna Invoice Purchase or by installment purchase via Klarna Installments Purchase or Klarna Instant, you will be asked during the order process to consent to the transfer of the data required for processing the payment and for an identity and credit check to Klarna AB, Sveavägen 46, 11134 Stockholm, Sweden (hereinafter: Klarna). If you give your consent, Klarna will receive the following data from us: first and last name, street, house number, postal code, city, date of birth, telephone number, and data related to your order.

  • Legal basis for the processing of personal data

    Article 6 paragraph 1 letter b GDPR (performance of (pre-)contractual measures)

  • Purpose of data processing

    For the purpose of identity and credit checks, Klarna transmits data to credit reference agencies and receives information from them, including, where applicable, creditworthiness information based on mathematical-statistical methods, in whose calculation address data is included (so-called score values). This provides Klarna with information about the statistical probability of a payment default, which forms the basis for the decision regarding the establishment, execution, or termination of the contractual relationship. However, the selection of one of the offered payment methods before the conclusion of the contract is not dependent on such information.

    The credit reporting agencies are the following companies:

    • Bürgel Wirtschaftsinformationen GmbH & Co. KG, Postfach 5001 66, 22701 Hamburg
    • Creditreform Boniversum GmbH, Hellersbergstraße 11, 41460 Neuss
    • Deltavista GmbH, Freisinger Landstr. 74, 80939 Munich
    • Arvato Infoscore Consumer Data GmbH / Infoscore Consumer Data GmbH, Rheinstraße 99, 76532 Baden-Baden
    • SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden

    Detailed information can be found in Klarna's privacy policy ( https://cdn.klarna.com/1.0/shared/content/policy/data/de_de/data_protection.pdf ) and terms of use ( https://klarna.com/de/AGB ).

  • Storage duration

    We will store the relevant data for processing the payment for as long as necessary to complete the transaction. If the data is subject to statutory retention obligations, it will be deleted after the retention period expires. The duration of data storage by Klarna is governed by Klarna's privacy policy: https://cdn.klarna.com/1.0/shared/content/policy/data/de_de/data_protection.pdf

  • Right to object and to have data deleted

    You can object to the processing of your data at any time in accordance with Article 21 of the GDPR and request its erasure in accordance with Article 17 of the GDPR. Information about your rights and how to exercise them can be found at the bottom of this privacy policy.

Statistical analysis of visits to this website - web tracker

When you access this website or individual files on this website, we collect, process, and store the following data: IP address, the website from which the file was accessed, the name of the file, the date and time of access, the amount of data transferred, and a message indicating whether the access was successful (so-called web log). We use this access data exclusively in non-personalized form for the continuous improvement of our website and for statistical purposes. We also use the following web trackers to analyze visits to this website:

• Google Analytics

  We use Google Analytics, a service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, email: support-deutschland@google.com , website: https://www.google.com/ , on our website . Personal data is also transferred to the USA. Regarding the transfer of personal data to the USA, there is an adequacy decision by the EU Commission under the EU-US Data Privacy Framework pursuant to Article 45 GDPR (hereinafter: DPF - https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en ). The service provider is certified under the DPF, so the usual level of protection under the GDPR applies to the data transfer.

  The legal basis for the processing of personal data is your consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, which you have given on our website.

  Google Analytics is a web tracker that analyzes the behavior of website visitors and their interactions with our website, providing us with evaluations and forecasts about the content and products on our website and their popularity (so-called tracking). We have integrated Google Analytics so that the service can compile an analysis of the browsing behavior of website users. For this purpose, Google collects the page interactions of website visitors with our website and, if applicable, existing information resulting from the reading of cookies or other storage technologies, and prepares this data for us statistically. Google Analytics uses data processing technologies that enable the tracking of individual website visitors and their interaction with other Google services, such as the Google Ads advertising network. Data from other Google services is also used to fill data gaps and create comprehensive statistics about the content of our website using machine learning technologies, modeled statistics, and forecasting functions. If Google Analytics is activated on our website, the data collected by Google Analytics is transferred to servers of Google Ireland Limited. As part of order processing, personal data may also be transferred to the servers of our parent company, Google LLC, 1600 Amphitheatre Parkway, 94043 Mountain View, USA. We use Google Analytics for analysis to continuously optimize our website and improve its availability. This is a so-called audience measurement.

  For processing purposes, the service or we collect the following data: data on the interactions of website visitors with the website's content, data on the handling of the services presented on our website, data from external Google services if they interact with our website, such as advertising data or data on behavior in relation to advertising, data on the general geographical origin, the browser used, operating system, and other information about the end device used.

  Google Analytics will store the data relevant for providing web tracking for as long as necessary to fulfill the booked web service. Data collection and storage are anonymized. If individual interactions of website visitors allow for subsequent identification of specific individuals, we will delete the collected data once the purpose has been fulfilled. The data will be deleted at the latest when it is no longer subject to any legal retention obligations. As a rule, we will delete this data after 12 months at the latest. You can view the provider's certification under the EU-US Data Privacy Framework at https://www.dataprivacyframework.gov/list .

  You can withdraw your consent at any time. Further information on how to withdraw your consent can be found either in the consent form itself or at the end of this privacy policy.

  Further information on how the transferred data is handled can be found in the provider's privacy policy at https://policies.google.com/privacy .

  The provider also offers an opt-out option at https://tools.google.com/dlpage/gaoptout?hl=de .

Integration of external web services and processing of data outside the EU

Our website uses active content from external providers, so-called web services. By accessing our website, these external providers may receive personal information about your visit. This may involve the processing of data outside the EU. You can prevent this by installing a suitable browser plugin or disabling the execution of scripts in your browser. However, this may result in limited functionality on websites you visit.

We use the following external web services:

• Legal text snippet and modules

  We use the legal text snippet service and modules from Website-Check GmbH, Beethovenstraße 24, 66111 Saarbrücken, Germany, email: support@website-check.de , website: https://www.website-check.de/ , on our website . Personal data is transmitted exclusively to servers within the European Union.

  The legal basis for the processing is Article 6(1)(c) GDPR. The use of this service helps us to comply with our legal obligations.

  This service loads content from our legal texts on our website. The integration on our site ensures that the most up-to-date legal texts are loaded. This integration may also load other technical modules related to the legal texts or legally required elements.

  You can find information about your rights regarding data processing at the end of this privacy policy.

  Further information on how the transferred data is handled can be found in the provider's privacy policy at https://www.website-check.de/datenschutzerklaerung/ .

• Website Check Seal

  We use the Website-Check seal service on our website, provided by Website-Check GmbH, Beethovenstraße 24, 66111 Saarbrücken, Germany, email: support@website-check.de , website: https://www.website-check.de/ . Personal data is transmitted exclusively to servers within the European Union.

  The legal basis for processing personal data is our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in achieving the purpose described below.

  The script from Website-Check GmbH is used for the technical integration of the Website-Check seal. With this seal, we want to demonstrate that we take data protection very seriously. Data is transmitted to Website-Check GmbH for the purpose of delivering and displaying the seal on our website.

  With regard to the processing of your data, you have the right to object as set out in Article 21. Further information can be found at the end of this privacy policy.

  Further information on how the transferred data is handled can be found in the provider's privacy policy at https://www.website-check.de/datenschutzerklaerung/ .

Data security and privacy, communication via email

Your personal data is protected by technical and organizational measures during collection, storage, and processing to ensure it is inaccessible to third parties. However, we cannot guarantee complete data security during transmission to our IT systems via unencrypted email. Therefore, for highly confidential information, we recommend encrypted communication or sending it by post.

Right to information and requests for rectification – Deletion & restriction of data – Withdrawal of consent – ​​Right to object

Right to information

You have the right to request confirmation as to whether we process personal data concerning you. If this is the case, you have the right to access the information specified in Article 15(1) GDPR, provided that the rights and freedoms of other persons are not adversely affected (see Article 15(4) GDPR). We will gladly provide you with a copy of the data.

Claim for rectification

In accordance with Article 16 of the GDPR, you have the right to have any incorrect personal data we hold about you (such as your address, name, etc.) corrected at any time. You can also request that we complete any data we have stored about you. Any such changes will be made immediately.

Right to erasure

According to Article 17 Paragraph 1 of the GDPR, you have the right to have us delete the personal data we have collected about you if

• the data is either no longer needed;
• Due to the withdrawal of your consent, the legal basis for processing has ceased to exist without replacement;
• You have objected to the processing and there are no legitimate grounds for the processing;
• Your data is being processed unlawfully;
• a legal obligation requires this or a collection has taken place in accordance with Art. 8 para. 1 GDPR.

The right does not exist according to Art. 17 para. 3 GDPR if

• the processing is necessary for exercising the right to freedom of expression and information;
• Your data has been collected on the basis of a legal obligation;
• the processing is necessary for reasons of public interest;
• the data are required for the establishment, exercise or defense of legal claims.

Right to restriction of processing

According to Article 18 Paragraph 1 GDPR, you have the right in certain cases to request the restriction of the processing of your personal data.

This is the case when

• the accuracy of your personal data is disputed;
• the processing is unlawful and you do not consent to its deletion;
• the data are no longer needed for the processing purpose, but the collected data serve the establishment, exercise or defense of legal claims;
• An objection has been lodged against the processing pursuant to Art. 21 para. 1 GDPR and it is still unclear which interests prevail.

Right of withdrawal

If you have given us your explicit consent to the processing of your personal data (Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR), you can withdraw this consent at any time. Please note that this does not affect the lawfulness of the processing carried out on the basis of the consent before its withdrawal.

Right to object

Pursuant to Article 21 of the GDPR, you have the right to object at any time to the processing of personal data concerning you which is based on Article 6(1)(f) (legitimate interest). This right applies only if there are specific circumstances that justify your objection to the storage and processing.

How do you exercise your rights?

You can exercise your rights at any time by contacting us using the contact details below:

Amy Deluxe Ibrahim Dabes eK,
Pöttmeser Str. 20,
86165 Augsburg,
Germany,
Email: onlineshop@amydeluxe.de
, Tel.: +49 821 90726623

Right to data portability

According to Article 20 of the GDPR, you have the right to receive the personal data concerning you. We will provide the data in a structured, commonly used, and machine-readable format. The data can be sent either to you or to a controller designated by you.

Upon request, we will provide you with the following data in accordance with Article 20 Paragraph 1 of the GDPR:

• Data collected on the basis of explicit consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR;
• Data that we have received from you in accordance with Art. 6 para. 1 lit. b GDPR within the framework of existing contracts;
• Data that has been processed as part of an automated procedure.

We will transfer your personal data directly to a controller of your choice, provided this is technically feasible. Please note that, according to Article 20(4) of the GDPR, we are not permitted to transfer data that infringes on the rights and freedoms of other individuals.

Right to lodge a complaint with the supervisory authority pursuant to Art. 77 para. 1 GDPR

If you suspect that your data is being processed unlawfully on our website, you can, of course, seek legal clarification of the issue at any time. Furthermore, you have every other legal recourse available to you. Regardless of this, pursuant to Article 77(1) of the GDPR, you have the right to lodge a complaint with a supervisory authority. This right to lodge a complaint under Article 77 of the GDPR applies in the EU member state of your residence, your place of work, and/or the place of the alleged infringement. This means you can choose the supervisory authority to which you submit your complaint from among those locations. The supervisory authority with which the complaint is lodged will then inform you of the progress and outcome of your complaint, including the possibility of a judicial remedy under Article 78 of the GDPR.