Privacy policy

Privacy Policy

Data Protection Information of Igel-Service GmbH

Preface

We, Igel-Service GmbH, take the protection of your personal data seriously and would like to inform you here about data protection in our company.
With the entry into force of the EU General Data Protection Regulation (Regulation (EU) 2016/679, hereinafter “GDPR”), additional obligations have been imposed on us to ensure the protection of personal data of individuals affected by processing (hereinafter also referred to as “customer”, “user”, “you”, or “data subject”).

Where we determine the purposes and means of processing alone or jointly with others, this includes the duty to inform you transparently about the type, scope, purpose, duration, and legal basis of the processing (Articles 13 and 14 GDPR). With this declaration (“Privacy Policy”), we inform you about how your personal data is processed by us.

Our Privacy Policy is modular in structure. It consists of a general section applicable to all processing situations and a specific section relating to particular processing situations, especially the use of our websites.

  1. General

(1) Definitions
Based on Article 4 GDPR:

  • “Personal data” means any information relating to an identified or identifiable natural person (“data subject”). This includes identifiers such as name, ID number, location data, online identifiers, or factors specific to physical, physiological, genetic, mental, economic, cultural, or social identity. Identifiability can result from linking such data with other information. Form or embodiment (photos, videos, audio) is irrelevant.
  • “Processing” means any operation performed on personal data, whether automated or not (e.g. collection, recording, organization, storage, adaptation, retrieval, use, disclosure, alignment, restriction, erasure, or destruction).
  • “Controller” is the natural or legal person determining purposes and means of processing personal data.
  • “Third party” means any natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons under the direct authority of the controller or processor authorised to process personal data.
  • “Processor” is a natural or legal person processing personal data on behalf of the controller (e.g. IT service providers).
  • “Consent” means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which they signify agreement to the processing of personal data relating to them.

(2) Controller Contact Details
Igel-Service GmbH
Kolonnenstraße 8, 10827 Berlin
T: +49 (0) 30 439 714 27
E: info@igel-service.com
Further company details are available in our legal notice: https://klo-igel.de/pages/impressum

(3) Data Protection Officer Contact
datenschutz@igel-service.com

(4) Legal Basis for Processing

Processing personal data is generally prohibited unless justified by:

  • Art. 6(1)(a) GDPR (Consent)
  • Art. 6(1)(b) GDPR (Contract performance or pre-contractual steps)
  • Art. 6(1)(c) GDPR (Legal obligation)
  • Art. 6(1)(d) GDPR (Vital interests)
  • Art. 6(1)(e) GDPR (Public interest or official authority)
  • Art. 6(1)(f) GDPR (Legitimate interests)

Storage/access on user devices requires:

  • §25(1) TTDSG (consent)
  • §25(2) No.1 TTDSG (message transmission)
  • §25(2) No.2 TTDSG (essential for a requested service)

We indicate the applicable legal basis for each processing operation below.

(5) Data Deletion and Retention

Unless otherwise stated, data is deleted or restricted when the processing purpose or legal basis ceases to apply. Extended retention may occur due to legal obligations (§257 HGB, §147 AO) or pending legal matters.

(6) Data Security

We implement technical and organizational measures to protect your data against manipulation, loss, destruction, or unauthorized access (e.g. TLS encryption). These measures are continuously improved according to technological developments.

(7) Use of Processors

Like most companies, we engage external domestic and international service providers (IT, logistics, telecommunications, sales, marketing) bound by contracts per Art. 28 GDPR to uphold data protection standards.

(8) Data Transfers to Third Countries

Data may be transferred outside the EEA for business purposes under Art. 6(1)(b) or (f) GDPR in conjunction with Art. 44 et seq. GDPR. Adequacy decisions can be found here:
EU Adequacy Decisions

Otherwise, safeguards include Binding Corporate Rules, Standard Contractual Clauses (2021 SCCs: link), certifications, or codes of conduct. Contact our DPO for details.

(9) No Automated Decision-Making / Profiling

We do not use your personal data for automated decision-making or profiling.

(10) No Obligation to Provide Data

There is no general contractual or legal obligation to provide personal data, though some services may require it.

(11) Legal Obligation to Disclose

We may be required by law to provide personal data to public authorities under Art. 6(1)(c) GDPR.

(12) Your Rights

You can exercise your rights at any time using the contact details above:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection (Art. 21 GDPR)
    (If based on Art. 6(1)(e) or (f) GDPR, explain your reasons unless it concerns direct marketing.)
  • Withdrawal of consent (Art. 7(3) GDPR) – future processing based on that consent will cease.
  • Complaint (Art. 77 GDPR) – e.g. with the Berlin Data Protection Authority:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61, 10555 Berlin
T: +49 30 13889-0
E: mailbox@datenschutz-berlin.de

(13) Changes to This Policy

We regularly review and update our privacy policy to reflect legal or technological changes. Updates will be published on our website.

  1. Website Use

(1) Function

When visiting our websites (https://klo-igel.de), personal data may be processed.

(2) Processed Data

  • Log data: referrer URL, page name and URL, date/time, browser type/version, IP address (anonymised), data volume, operating system, access status/HTTP status code, GMT time difference.
  • Contact form data: gender, name, address, company, email, submission time.
  • Newsletter data: referrer URL, date/time, browser type, anonymised IP, email, registration/confirmation time.
    We analyse newsletter usage via web beacons/tracking pixels linked to your email and an ID (pseudonymised, no direct personal link).

(3) Purpose and Legal Basis

Processing is based on Art. 6(1)(a) or (f) GDPR for security, stability, and statistics; Art. 6(1)(b) or (f) GDPR for contact forms. For device storage/access, §25 TDDDG applies.

(4) Retention

Data is retained only as necessary. See section A.(5) and our Cookie Policy.

(5) Data Sharing

  • Website and IT service providers (Art. 6(1)(b) or (f) GDPR)
  • Public authorities (Art. 6(1)(c) GDPR)
  • Business partners (auditors, banks, insurers, legal advisors) under Art. 6(1)(b) or (f) GDPR.

For third country transfers, see A.(8). Other sharing occurs only with your consent under Art. 6(1)(a) GDPR.

(6) Cookies and Services

  1. a) Cookies
    We use cookies (session and persistent) for website functionality, performance, advertising, and sharing. Legally required under §25(2) TDDDG or with consent under §25(1) TDDDG + Art. 6(1)(a) GDPR. For details, see our Cookie Policy.
  2. b) Social Media Plugins
    We do not use plugins; social media icons are passive links.

(7) Shopify

Our shop runs on Shopify, which processes order, payment, shipping, and customer data under its Privacy Policy.

(8) Newsletter

Subscription uses double opt-in. Data is retained until withdrawal and for up to three years for proof of consent (Art. 6(1)(f) GDPR). Withdraw consent anytime via the unsubscribe link or email to info@klo-igel.de.