Privacy Policy
1. Data Controller
The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection laws is:
Schera GmbH
Grundtalring 22
63868 Großwallstadt
Germany
Telephone: +49 6022 5089 - 100
Email: info@schera.de
Represented by its Managing Directors: Ralf Schellenberger, David Schellenberger, Tobias Schellenberger
2. Data Protection Officer
Our Data Protection Officer is:
Protektis GmbH
Benzstraße 2a
63741 Aschaffenburg
Email: datenschutz@schera.de
If you have any questions about data protection, you can contact our Data Protection Officer directly.
3. General Information on the Processing of Personal Data
We only process personal data to the extent necessary to operate our website and online shop, process orders, communicate with you or fulfil the other purposes described in this Privacy Policy.
Depending on the purpose, the processing of personal data is based in particular on:
- your consent in accordance with Art. 6(1)(a) GDPR,
- the performance of a contract or steps taken prior to entering into a contract in accordance with Art. 6(1)(b) GDPR,
- compliance with legal obligations in accordance with Art. 6(1)(c) GDPR, or
- our legitimate interests in accordance with Art. 6(1)(f) GDPR.
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.
4. Hosting and Server Log Files
Our website is hosted by:
Mittwald
CM Service GmbH & Co. KG
Königsberger Straße 4–6
32339 Espelkamp
Germany
When you visit our website, certain technical information required for its operation is processed. This may include your IP address, the date and time of access, the content accessed, the amount of data transferred, the referrer URL, browser, operating system and information about the device used.
This processing is necessary to ensure the technical operation, stability and security of our website.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to ensure the secure and reliable operation of our website.
According to Mittwald, IP addresses in web server access logs are anonymised, and the anonymised data is retained for 60 days. Error logs are deleted after seven days. mittwald - Web Technology for Agencies
We have entered into a data processing agreement with Mittwald in accordance with Art. 28 GDPR.
5. Cookies and Consent Management
Our website uses cookies and similar technologies.
Some of these technologies are technically necessary to operate our website and provide the functions you request. Other technologies, particularly those used for analytics, marketing and convenience features, are only used with your consent.
When you visit our website, you can use our Consent Manager to decide which optional services you wish to allow.
Where information is stored on your device or information already stored on your device is accessed, this is done on the basis of your consent in accordance with Section 25(1) TDDDG, unless a statutory exception applies. The exception under Section 25(2) TDDDG may apply to strictly necessary technologies. German Federal Laws Online
Any subsequent processing of personal data is carried out on the legal bases described in the following sections.
You can change or withdraw your consent at any time with effect for the future via the cookie settings on our website.
6. Customer Account
You can create a customer account in our online shop. When you do so, we process personal data including your basic personal details, contact information, login credentials and information about your orders.
This data is processed to create and manage your customer account and provide the associated functions.
The legal basis is Art. 6(1)(b) GDPR.
Your customer account will generally remain active until you request its deletion or until further storage is no longer necessary or legally permitted.
If you would like your customer account to be deleted, you can contact us using the contact details provided in this Privacy Policy.
Statutory retention obligations relating to certain data, particularly information associated with completed orders, remain unaffected.
7. Orders in Our Online Shop
When you place an order, we process the personal data necessary to fulfil the purchase contract.
This may include, in particular:
Your name, billing and delivery addresses, contact details, items ordered, order information, payment information and any other details required to process the contract.
This data is processed to fulfil the purchase contract, including order processing, payment processing, shipping, customer service, returns and refunds.
The legal basis is Art. 6(1)(b) GDPR.
Where commercial or tax law requires us to retain certain information, the relevant data will be stored for the legally prescribed period. The legal basis for this is Art. 6(1)(c) GDPR.
8. Payment Processing
To process your order, we transfer personal data to your chosen payment service provider to the extent necessary to complete the payment.
8.1 PayPal
If you choose PayPal as your payment method, the information required to process your payment will be transferred to PayPal.
For customers in the European Economic Area, the service provider is generally:
PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg.
Your data is processed to complete your chosen payment method on the basis of Art. 6(1)(b) GDPR.
As part of its services, PayPal may also process data outside the European Economic Area.
8.2 Credit Card Payments via CrefoPay
We use CrefoPay to process credit card payments.
The customer, order and payment information required for payment processing is processed and transferred to the parties involved in completing the payment.
The legal basis is Art. 6(1)(b) GDPR.
9. Purchase on Invoice, Credit Checks and Automated Decision-Making
If you select purchase on invoice as your payment method, an identity and credit check is carried out via CrefoPay to assess the risk of non-payment.
For this purpose, we process information including your name, address, date of birth and the order and payment information required for the assessment.
The credit check is carried out exclusively with the involvement of:
Creditreform Aschaffenburg Schurk KG
Magnolienweg 31
63741 Aschaffenburg
Germany
Email: info@aschaffenburg.creditreform.de
This process may involve the use of credit information and statistically calculated probability scores to assess the risk of non-payment.
Automated Decision-Making
The decision as to whether purchase on invoice can be offered to you is made entirely automatically on the basis of the credit and risk assessment.
As a result, purchase on invoice may not be available to you.
However, if this payment method is declined, this does not mean that your order as a whole is rejected. You can still complete your order using another available payment method, particularly credit card or PayPal.
10. Shipping with DHL
To deliver your order, we transfer the necessary information to our shipping provider DHL.
In particular, we provide the following information:
Name and delivery address.
We do not share your email address or telephone number with DHL for the purpose of parcel notifications.
This data is transferred for the performance of the purchase contract in accordance with Art. 6(1)(b) GDPR.
11. Returns
You can register returns using the dedicated function in your customer account.
For this purpose, we process customer, order, product and return information to the extent necessary to handle your return, refund and any other related processes.
The legal basis for this processing is Art. 6(1)(b) GDPR.
12. Contacting Us
If you contact us via our contact form, by email or through any other channel, we process the information you provide in order to respond to your enquiry.
This may include your name, email address, the content of your message and any additional information you choose to provide.
If your enquiry relates to a contract or steps taken prior to entering into a contract, the processing is carried out in accordance with Art. 6(1)(b) GDPR.
For other enquiries, the processing is based on our legitimate interest in handling your request appropriately, in accordance with Art. 6(1)(f) GDPR.
Emails generated or sent by Shopware are stored for technical purposes for approximately 10 days and are then deleted.
Independently of this, messages received in our email system may be retained for as long as necessary to process your enquiry or where statutory retention obligations or other lawful grounds justify further storage.
13. Newsletters via Mailchimp
We use Mailchimp, a service provided by The Rocket Science Group LLC d/b/a Mailchimp, a company within the Intuit Group, to send our newsletters.
When you subscribe to our newsletter, we process your email address and, where applicable, any additional information you voluntarily provide.
Subscription takes place through a double opt-in procedure. After signing up, you will receive an email asking you to confirm your subscription.
Your data is processed for the purpose of sending newsletters on the basis of your consent in accordance with Art. 6(1)(a) GDPR.
You can withdraw your consent at any time with effect for the future, particularly by using the unsubscribe link included in our newsletters.
Mailchimp may also process personal data outside the European Economic Area.
14. Newsletter Performance Tracking
We analyse how our newsletters are used in order to measure their performance and optimise their content.
This may include collecting the following information:
- whether a newsletter has been opened,
- which links have been clicked,
- how often links have been clicked, and
- which newsletter recipient can be associated with these activities.
Invisible web beacons or similar technologies may be used to track newsletter opens.
In addition, we use Mailchimp E-Commerce Link Tracking. This allows us to link activities originating from our newsletters with orders and purchasing activity in our online shop. For example, purchases, conversions and revenue can be attributed to specific newsletter campaigns or recipients.
General Mailchimp Website Tracking is currently not enabled.
15. Google Tag Manager
We use Google Tag Manager to manage and control various services integrated into our website.
In particular, Google Tag Manager is used to manage Google Analytics tracking functions.
Google Tag Manager is used to control the technical integration of other services. The personal data processed by these services is described in the relevant sections below.
16. Google Analytics 4
We use Google Analytics 4 to analyse how visitors use our website.
This may involve processing information about page views, interactions, clicks, scrolling behaviour, browsers, devices and approximate location data.
We use Google Analytics on the basis of your consent in accordance with Art. 6(1)(a) GDPR. Where information is stored on or accessed from your device, this is also based on your consent in accordance with Section 25(1) TDDDG. German Federal Laws Online
You can withdraw your consent at any time via our cookie settings.
The following data retention settings are currently configured for our Google Analytics property:
Event data: 2 months
User data: 14 months
The option to reset the retention period upon new user activity is enabled.
Google Signals is not enabled.
17. Google Ads – Conversion Tracking and Remarketing
We use Google Ads services to measure the effectiveness of our advertising and for remarketing purposes.
Conversion Tracking
Conversion Tracking allows us to determine whether certain actions have been completed on our website following an interaction with a Google advertisement, such as making a purchase.
Remarketing
The remarketing function allows us to show visitors to our website personalised or interest-based advertising at a later stage.
The processing is based on your consent in accordance with Art. 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 25(1) TDDDG. German Federal Laws Online
You can withdraw your consent at any time via our cookie settings.
Enhanced Conversions are currently not enabled.
Google Consent Mode V2 is currently not enabled in the Shopware extension we use.
18. Meta Pixel
We use the Meta Pixel provided by Meta Platforms Ireland Limited.
The Meta Pixel allows us to understand how visitors interact with our website after viewing or clicking on advertisements on Meta platforms. This enables us to measure the effectiveness of our advertising and create target audiences for advertising campaigns.
The Meta Pixel is managed through our Shopware Consent Manager.
Processing is based on your consent in accordance with Art. 6(1)(a) GDPR and Section 25(1) TDDDG, where information is stored on or accessed from your device. German Federal Laws Online
You can withdraw your consent at any time via our cookie settings.
The Meta Conversions API is currently not enabled.
19. Flockler / Social Media Content
We use Flockler to display publicly available social media content, particularly from Instagram, on our website.
For example, Flockler allows us to display publicly shared posts from influencers, customers and other users in a social media carousel.
This may involve processing and displaying publicly available images, videos, usernames and other information published alongside the respective posts.
According to Flockler, visitors to our website are not individually tracked through the Flockler integration, and Flockler does not set tracking cookies. Flockler states that it only processes anonymised or aggregated usage information.
This processing serves to showcase our brand, our products and publicly available content from our community.
20. YouTube
We embed videos from YouTube, a service provided by Google, on our website.
The videos are embedded using a standard Shopware module. YouTube is assigned to the Convenience category in our Consent Manager.
YouTube content is only loaded once you have given your consent.
When a video is loaded, information such as your IP address, device and browser details, and information about your use of the video may be transmitted to Google. If you are logged into your Google or YouTube account at the same time, Google may be able to associate your activity with your user account.
The legal basis is your consent in accordance with Art. 6(1)(a) GDPR and Section 25(1) TDDDG. German Federal Laws Online
21. Vimeo
We embed videos from Vimeo on our website.
The videos are embedded using a standard Shopware module. Vimeo is assigned to the Convenience category in our Consent Manager.
Vimeo content is only loaded once you have given your consent.
When a video is loaded, information such as your IP address, device and browser details, and information about your use of the embedded video may be transmitted to Vimeo.
The legal basis is Art. 6(1)(a) GDPR and Section 25(1) TDDDG. German Federal Laws Online
22. Store Finder and Google Maps
Our website provides a store finder under "Stores", allowing you to search for retail locations.
We use Google Maps services to display maps and search for locations.
When you access the store finder page, the iframe is loaded. This may result in data being transmitted to Google, including your IP address, device and browser information, and information about your use of the store finder.
For example, if you enter a town, city or postcode in the search field, this information is processed to display suitable retail locations in your chosen area.
23. Social Media Links
Our website contains links to our profiles on social media platforms.
Simply displaying these links does not generally result in data being transmitted to the respective platform as a result of the link itself. Only when you click on a link will you leave our website or open the service provided by the respective platform operator.
Any data processing that takes place on these platforms is also subject to the privacy policies of the respective providers.
24. Online Job Applications
Purpose of Data Collection
If you wish to apply for a position with us online, we require certain personal information from you. We assure you that your information will be treated confidentially. The data collected will be processed exclusively for the purpose of selecting suitable candidates and, where necessary, shared with and used by the relevant internal departments.
Legal basis for data collection: Art. 88 GDPR in conjunction with Section 26 of the German Federal Data Protection Act (BDSG).
Application Information
We aim to recruit the best candidates, regardless of ethnic origin, gender, religion or belief, disability, age or sexual orientation. We therefore do not require you to provide any information relating to these characteristics.
Processing and Deletion of Your Application
You may request changes to or the deletion of your application at any time by contacting our Human Resources department. Your personal data will then be deleted in accordance with the applicable legal requirements. This does not apply where statutory provisions prevent deletion, where further storage is necessary for evidential purposes, or where you have consented to a longer retention period. Personal data will be deleted after the recruitment process has been completed and no later than six months after its conclusion.
If an employment contract is concluded, your data may be transferred to your personnel file for standard organisational and administrative purposes, in compliance with the relevant legal requirements. You also have the right to withdraw your application at any time.
Handling of Applicant Data
We offer you the opportunity to apply for positions with us, for example by email, post or via an online application form. The following information explains the scope, purpose and use of the personal data collected during the recruitment process. We assure you that your data will be collected, processed and used in accordance with applicable data protection laws and all other relevant legal requirements, and that your information will be treated as strictly confidential.
Scope and Purpose of Data Collection
If you submit an application to us, we process the associated personal data, such as contact and communication details, application documents and notes taken during interviews, to the extent necessary to decide whether to establish an employment relationship. The legal basis for this is Section 26 BDSG under German law (initiation of an employment relationship), Art. 6(1)(b) GDPR (steps taken prior to entering into a contract) and, where you have given your consent, Art. 6(1)(a) GDPR. You may withdraw your consent at any time. Within our company, your personal data will only be shared with individuals involved in processing your application.
If your application is successful, the data you have submitted will be stored in our data processing systems for the purpose of managing the employment relationship, on the basis of Section 26 BDSG and Art. 6(1)(b) GDPR.
Data Retention Period
If we are unable to offer you a position, you decline a job offer or you withdraw your application, we reserve the right to retain the data you have provided for up to six months after the recruitment process has ended (rejection or withdrawal of your application), on the basis of our legitimate interests in accordance with Art. 6(1)(f) GDPR.
After this period, the data will be deleted and any physical application documents will be destroyed. The purpose of this retention is primarily to provide evidence in the event of a legal dispute. If it becomes apparent that the data will still be required after the six-month period, for example due to a pending or anticipated legal dispute, the data will only be deleted once the reason for its continued retention no longer applies.
Data may also be retained for longer if you have given your consent in accordance with Art. 6(1)(a) GDPR or if statutory retention obligations prevent deletion.
Inclusion in Our Applicant Pool
If we are unable to offer you a position, we may offer to include you in our applicant pool. If you agree, all documents and information submitted as part of your application will be added to the applicant pool so that we can contact you if suitable vacancies arise. Inclusion in the applicant pool is based exclusively on your express consent in accordance with Art. 6(1)(a) GDPR. Providing consent is voluntary and has no bearing on the current recruitment process. You may withdraw your consent at any time. In this case, your data will be permanently deleted from the applicant pool, unless statutory retention requirements apply.
Data held in the applicant pool will be permanently deleted no later than two years after consent was given.
25. Recipients of Personal Data
We only transfer personal data where this is necessary for the purposes described in this Privacy Policy, where we are legally obliged to do so, where you have given your consent or where another legal basis permits the transfer.
Recipients may include, in particular:
- hosting and IT service providers,
- payment service providers,
- credit reference agencies,
- shipping service providers,
- newsletter and communication service providers,
- analytics and marketing service providers, and
- public authorities and other bodies where disclosure is required by law.
Where service providers process personal data exclusively on our behalf, the necessary data processing agreements are concluded in accordance with Art. 28 GDPR.
26. Data Transfers to Third Countries
Some of the service providers we use may process personal data outside the European Union or the European Economic Area.
Such transfers only take place where the applicable data protection requirements are met.
Depending on the recipient, the transfer may be based on an adequacy decision by the European Commission or appropriate safeguards, such as Standard Contractual Clauses.
27. Data Retention
As a general rule, we only retain personal data for as long as necessary for the purpose for which it was collected and processed.
After this period, the data will be deleted or anonymised, unless statutory retention obligations, the establishment, exercise or defence of legal claims, or other lawful grounds justify further storage.
Where specific retention periods apply to individual processing activities, these are stated in the relevant sections of this Privacy Policy.
28. Your Rights
Subject to the applicable legal requirements, you have the following rights in particular:
- the right of access in accordance with Art. 15 GDPR,
- the right to rectification in accordance with Art. 16 GDPR,
- the right to erasure in accordance with Art. 17 GDPR,
- the right to restriction of processing in accordance with Art. 18 GDPR,
- the right to data portability in accordance with Art. 20 GDPR, and
- the right to object in accordance with Art. 21 GDPR.
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future in accordance with Art. 7(3) GDPR.
Right to Object
Where we process personal data on the basis of our legitimate interests in accordance with Art. 6(1)(f) GDPR, you have the right to object to such processing on grounds relating to your particular situation, in accordance with Art. 21 GDPR.
Where personal data is processed for direct marketing purposes, you may object to such processing at any time.
Rights Relating to Automated Decision-Making
Where automated decision-making within the meaning of Art. 22 GDPR takes place, you are entitled to the rights provided for under the applicable law.
29. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.
In particular, you may contact the data protection supervisory authority responsible for us or a supervisory authority in your country or place of residence.
30. Data Security
We implement appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and other unlawful processing.
In particular, our website uses encrypted data transmission via TLS/SSL.
31. Updates and Changes
We reserve the right to update this Privacy Policy if legal requirements, our website, our business processes or the services we use change.