Data protection information 

Thank you for using CopeCart. With this document, we would like to inform you how we process your personal data in connection with the use of our offer.

Who is responsible and how can I contact you?

Person responsible

Copecart GmbH
Rosenstr. 2
10178 Berlin
Deutschland
Verantwortlicher: Jan Brüger
datenschutz@copecart.com

Data Protection Officer

Williams-Connect
Straße der Jugend 18
14974 Ludwigsfelde
DE
Janko Williams
kontakt@williams-connect.eu

Questions about data protection and exercising your rights

For questions about data protection or to exercise your data protection claims, please use the contact details above .

When do we process which personal data?

We process personal data that you actively transmit to us through your input. Furthermore, we automatically process personal data based on the use of our website. Your personal data may therefore be processed in the following cases in particular:

1. visiting our website;
2. Establishment of a customer account;
3. Buying a product in our shop;
4. Registration for the email newsletter;
5. Contacting us;
6. Analysis of why which visitors come to our website and how they use it;
7. Analysis of the success of our advertising measures;
8. Defense against attacks against our technical infrastructure;
9. Creditworthiness check according to § 505a BGB
10. Passing on of data in the case of collection measures
    For the details, we refer to the following explanations.

Visiting our website

When you visit our website, the company commissioned by us to operate the website processes and stores technical information about the device you are using (operating system, screen resolution and other non-personal characteristics) and the browser (version, language settings) , in particular the public IP address of the computer with which you visit our website, including the date and time of access. The IP address is a unique numerical address under which your device sends or retrieves data on the Internet.

Our service provider does not use the processed data personally for statistical purposes so that we can understand which end devices are used with which settings to visit our website in order to optimize them for this, if necessary. These statistics do not contain any personal data. The legal basis for the compilation of the statistics is Art. 6 Para. 1 f) GDPR.

The IP address is also used so that you can technically access and use our website and to detect and defend against attacks against our service provider or our website. Unfortunately, there are always attacks designed to harm website operators or their users (e.g. preventing access, spying on data, spreading malware (e.g. viruses) or other unlawful purposes). Such attacks would impair the intended functionality of the data center of the company commissioned by us, the use of our website or its functionality as well as the security of the visitors to our website. The processing of the IP address including the time of access takes place in order to defend against such attacks. With this processing, we pursue the legitimate interest of our service provider to ensure the functionality of our website and to ward off illegal attacks against us and the visitors to our website. The legal basis for processing is Art. 6 Para. 1 f) GDPR.

The stored IP data are deleted (through anonymization) when they are no longer required for the detection or defense of an attack.

Creating a customer account

When you create a customer account, we process the data you provide in order to create and manage it and to enable you to use the services associated with your customer account. The legal basis for processing is Article 6 (1) a) GDPR. If the creation of the customer account serves to conclude a contract with us, the additional legal basis for processing is Art. 6 Para. 1 b GDPR.

This data is stored until the customer account is deleted. If we are legally obliged to store longer (e.g. to fulfill accounting obligations) or are legally entitled to longer storage (e.g. due to an ongoing legal dispute against the owner of a user account), the deletion takes place after the storage obligation or the legal authorization has expired.

We use intercom.com, an offer from Intercom R&D Unlimited Company, 2nd Floor, Stephen Court, 18-21 St. Stephen’s Green, Dublin 2, Republic of Ireland, for us to manage our customer data and communicate with our customers Processor becomes active. Intercom is a member of the PrivacyShield Agreement, https://www.privacyshield.gov/participant?id=a2zt0000000TNQvAAO&status=Active

Buying a product in our shop or selling a product to us

If you as a customer buy a product in our shop or we give it to us If you sell a product as a vendor, we process the data you provide to conclude and execute the contract. To the extent necessary, customer data is passed on to service providers or the vendor for the dispatch and billing of your purchase. The legal basis for processing is Article 6 (1) b) GDPR.

Due to legal requirements, in the event of a purchase via our website, we are obliged to process your e-mail address in order to send an electronic order confirmation to it. The legal basis for this is Article 6 Paragraph 1 c) GDPR. Insofar as there are legal recording and retention obligations (e.g. retention of invoices in accordance with tax law) due to the processing of a sales contract, the legal basis for processing is Art. 6 Paragraph 1 c) GDPR.

We also process this data to detect and defend against attempted fraud on the basis of Art. 6 Para. 1 f) GDPR. We are pursuing the goal of protecting ourselves against fraudulent transactions.

Data that is stored in connection with the conclusion of a contract for the purchase of a product will be deleted after the statutory retention period has expired.

For the use of PayPal, all transactions are subject to the PayPal data protection declaration available at https://www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE.

Credit check according to § 505a BGB

If you choose payment by installments, we will carry out the credit check required according to § 505a BGB. For this purpose, we use the data you provide in order to comply with our legal obligation to check creditworthiness (the legal basis for processing is Art. 6 Para. 1 c) GDPR) and to fulfill the contract with you (the legal basis for processing is Art. 6 Para. 1 b) GDPR).

Passing on of data in the event of debt collection measures

If you are in default of payment, we will take collection measures at our discretion in order to protect ourselves against bad debts and to enforce the claims to which we are entitled. Here, personal data can be passed on to our service providers, insofar as this is necessary to enforce our claims. Furthermore, the claim can be assigned to a third party, who then asserts payment claims from the assigned right in his own name. The legal basis for processing is Article 6 Paragraph 1 b) and f) GDPR.
 

KYC Identity Verification for Vendors

Type and Extent of Processing

We collect and process your personal data solely for the purpose of identity verification, risk assessment, and to fulfill our legal obligations in the context of anti-money laundering. Your data is used to create an appropriate customer profile and to identify potential risks associated with money laundering and terrorist financing.

Purpose and Legal Basis

We collect and process your personal data exclusively for the purpose of identity verification, risk assessment, and to fulfill our legal obligations in the context of anti-money laundering. Your data is used to create an appropriate customer profile and to identify potential risks associated with money laundering and terrorist financing. The legal basis for the processing of your personal data is derived from Article 6 paragraph 1 lit. c GDPR (fulfillment of a legal obligation) and Article 6 paragraph 1 lit. f GDPR (legitimate interest). Our legitimate interest lies in fulfilling our legal obligations to prevent money laundering and terrorist financing. We collect and process master data, identification data, financial data, and communication data. This data is used exclusively for identity verification, risk assessment, and to fulfill our legal obligations. Your data is passed on within our company to the departments responsible for fulfilling the legal obligations.

Storage Duration

Your personal data is stored for the duration of the business relationship and beyond as long as it is necessary for the fulfillment of our legal obligations. The storage duration is based on the legal retention periods.

Newsletter

If you register for our newsletter, the data you provide for the creation and dispatch of the newsletter as well as for the proof of registration for our newsletter will be processed until you withdraw your consent. The legal basis for processing is Article 6 (1) a) GDPR.

To send the newsletter, you have to click on the confirmation link in the verification email that we send to you after your registration in order to be able to prove your consent. By clicking on the corresponding link, we process the public IP address of the computer from which the link is accessed, together with the date and time of the click. We process this data in order to be able to provide evidence that you have confirmed receipt of our email newsletter. The legal basis for processing is Art. 6 Para. 1 f) GDPR. Our legitimate interest in this is the fulfillment of the obligations incumbent on us to provide evidence of the subscription you have made.

You can revoke your consent at any time by unsubscribing from the newsletter. You will find a corresponding link at the end of each newsletter.

We delete your data when you unsubscribe from the newsletter. The data that we need as proof that you have consented to the sending of the newsletter will be deleted after the statute of limitations has expired for the corresponding obligation to provide evidence.

For the newsletter we use the platform of an external service, we pass on to as processors to the extent necessary, your personal data. This is ActiveCampaign, Inc., 1 N Dearborn, 5th Floor, Chicago, Illinois 60602, USA. This company is based in the USA, but is a member of the Privacy Shield Agreement, https://www.privacyshield.gov/participant?id=a2zt0000000GnH6AAK&status=Active

contact requests, chat

If you send us a message using one of the contact options offered, we use the data you have given us to process your request. The legal basis for this is our legitimate interest in answering your request in accordance with Art. 6 Para. 1 f) GDPR. If your request serves to conclude or execute a contract with us, the further legal basis for processing is Art. 6 Para. 1 b) GDPR. The data will be deleted after your request has been dealt with. If we are legally obliged to store the data for a longer period, the data will be deleted after the relevant period has expired.

For the chat function on our website, we use intercom.com, an offer from Intercom R&D Unlimited Company, 2nd Floor, Stephen Court, 18-21 St. Stephen’s Green, Dublin 2, Republic of Ireland, which works for us as a processor. Intercom is a member of the PrivacyShield Agreement, https://www.privacyshield.gov/participant?id=a2zt0000000TNQvAAO&status=Active

Use of cookies

We use cookies for the operation of our website to ensure the technical functionality of our website, to understand how Visitors use our website and to save preferences that a user has made in their browser. We also use this to control our advertising measures.

Cookies are a small text files that are stored in access our website through your browser on your mobile device. If you visit our website again later, we can read these cookies again. Cookies are stored for different lengths of time. You have the option of setting which cookies it should accept in your browser at any time, but this may mean that our website no longer works properly. You can also delete cookies yourself at any time. If you do not do this, we can specify how long a cookie should be stored on your computer when saving. A distinction must be made here between so-called session cookies and permanent cookies. Session cookies are deleted from your browser when you leave our website or exit the browser. Persistent cookies are stored for the duration that we specify when they are saved.

We use cookies for the following purposes:

1. Technically necessary cookies that are absolutely necessary for the use of the functions of our website (e.g. recognition of whether you have logged in). Without these cookies, certain functions could not be provided.
2. Functional cookies that are used to technically perform certain functions that you want to use.
3. Analysis cookies, which are used to analyze your user behavior. For details, please read the information on “Google Analytics”.
   Most of the browsers that our users use allow us to set which cookies should be stored and enable (certain) cookies to be deleted again. If you restrict the storage of cookies on certain websites or do not allow cookies from third-party websites, this may mean that our website can no longer be used to its full extent. Here you will find information on how you can adjust the cookie settings for the most common browsers:

1. Google Chrome ( support.google.com/chrome/answer/95647?hl=de )
2. Internet Explorer ( https://support.microsoft.com/ de-de / help / 17442 / windows-internet-explorer-delete-manage-cookies )
3. Firefox ( https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen )
4. Safari ( https: // support.apple.com/kb/PH21411?locale=de_DE )

Google Analytics

We use Google Analytics, a service of Google LLC (“Google”), Amphitheater Parkway, Mountain View, CA 94043, for order processing via the Google Tag Manager, UNITED STATES. As a processor, Google uses a so-called “cookie” for this. This is a small text file that is saved on your computer by your browser. By means of this cookie, Google receives information about which website you have accessed and in particular the following information: browser type / version, operating system used, technical information about the operating system and browser as well as the public IP address of the computer you are using. We use Google Analytics in such a way that your IP address is only used in anonymised form. According to Google, this anonymization takes place in the European Union or a member state of the EEA. The full IP address should only be transmitted to a Google server in the USA and only shortened there in exceptional cases. According to Google, the anonymization takes place before the IP address is stored on a permanent data carrier for the first time. For details, we refer to Google’s privacy policy, available at https://support.google.com/analytics/answer/6004245?hl=de.

Google Analytics allows us to create usage statistics for our website as well as demographic data about visitors and their user behavior in a non-personal form. Statistics are also created that enable us to better understand how our website is found in order to improve our search engine optimization and our advertising measures. With this processing, we are pursuing the legitimate interest in being able to improve our website and our advertising measures. The legal basis for processing is Art. 6 Para. 1 f) GDPR.

Atyou can find https://tools.google.com/dlpage/gaoptout?hl=de information on how you can object to the use of Google Analytics.

As an alternative to this or within browsers on mobile devices, please click this link to prevent Google Analytics from collecting data on this website in the future (the opt-out only works in this browser and only for this domain. Cookie stored on your device. If you delete your cookies in this browser, you have to click this link again.

Google is a member of the PrivacyShield Agreement and has concluded aprocessing agreement with us for Google Analytics.

dataThe pseudonymous data will be deleted after 14 months.

Categories of further Recipients of personal data In addition to the recipients mentioned above, other categories of recipients of personal data are third-party service providers that we use to fulfill our contractual or statutory obligations and control of advertising measures and companies for the programming, maintenance and operation of our website.

Use of tools for our advertising

In order to advertise the products we offer and thus increase their sales, we display advertising on other websites or in apps. In this respect, we are of the opinion that our advertising measures work better and are therefore more successful if we only display them if they are in the presumed interest of the user of the respective website or app. According to market knowledge, advertising that corresponds to the presumed interests of the users of a website is more effective, is clicked on more often and is therefore more economically successful. Furthermore, advertising that corresponds to the presumed interests will be viewed as less disruptive. We therefore use tools that enable us to show our advertisements only to those users who are interested in them (so-called “retargeting”). For this purpose, various cookies are stored in the browser of your terminal device so that an appropriate identification is possible. However, this does not enable your person to be identified; the cookies can only be used to identify your presumed interests. Furthermore, we do not receive any information from the operators of the services on which we display our advertising that would enable us to identify an individual user or recipient of our advertising.

By using the tools specified below, we can also measure the effectiveness of our advertisements and derive statistical data from this to monitor the success and control of our advertising measures, as we can see whether a visitor to our website has previously clicked on one of our advertisements (so-called “conversion”) ).

The legal basis for the corresponding processing of your personal data is Art. 6 Para. 1 f) GDPR.

We use the following tools for this purpose:

Facebook Pixel

We use the so-called Facebook Pixel, an offer from Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland. This enables Facebook to identify visitors to our website as a target group for corresponding advertisements, the so-called Facebook ads, and to only show them to Facebook users who are relevant to us as a target group. If you have a Facebook account, Facebook can save your visit to our website in your Facebook profile.

You can find Facebook’s data protection declaration and thus the information on how your relevant data is used by Facebook at https://de-de.facebook.com/policy.php

The opt-out from data processing by Facebook for personalized advertising can be explained here:

https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fads%2Fpreferences%2F % 3Fentry_product% 3Dad_settings_screen

Google Ads

We use Google Ads, an offer from Google Ireland Limited, https://www.google.de/contact/impressum.html. We use the services Google Ads Conversion (display of advertisements), Google Ads Remarketing (display of advertisements if the respective user is suspected of being interested), Google Analytics advertising functions (evaluation of the success of our advertising measures) and Campaign Manager (control of the delivery of advertisements)

You can find Google’s data protection declaration and thus the information on how your corresponding data is used by Google at https://policies.google.com/privacy?hl=de#about

The opt-out from data processing by Google for personalized advertising can be explained here: https://adssettings.google.com

Note on the opt-out options

The opt-out options referred to above are provided by the respective Offered to operators, so that we have to refer to the information of the respective operator for their functionality. As a rule, the operator uses a cookie in the browser of the device you are using to save your opt-out, so that an opt-out must be carried out in every browser used. If you should delete these cookies later, the opt-out would have to be carried out again.

You also have to object to the use of the advertising ID of the respective device on devices that are operated with iOS or Android.

For iOS: Open the “Settings” app and select the “Data protection” item, “Advertising” sub-item and activate the “Limit ad tracking” item.

For Android: Open Google Settings, tap Ads, and turn on Disable Interest-Based Ads. You can also replace your original advertising ID under “Reset advertising ID” with a new, random ID.

GoogleFonts

WebWe use Google Web Fonts to display our website. It is a collection of fonts from Google LLC (“Google”), Amphitheater Parkway, Mountain View, CA 94043, USA, which can be used in particular for websites. When the font used by our website is called up by your browser, the public IP address of the computer you are using is transmitted to Google LLC (“Google”), Amphitheater Parkway, Mountain View, CA 94043, USA. The IP address is a unique numerical address under which this computer sends or retrieves data on the Internet.

When you visit our website, your browser loads the fonts required for their correct display in order to display them as we intended. If your browser does not support web fonts, a standard font on your device will be used to display our website. You can find more information about Google Webfonts at https://developers.google.com/fonts/faq . The general data protection declaration from Google applies for this, which is available at https://www.google.com/policies/privacy/ . Our legitimate interest in the use of Google web fonts is to ensure a uniform appearance of the website and thus functionality on all end devices. The legal basis for processing is therefore Art. 6 Para. 1 f. GDPR.

Right to information

According to Art. 15 GDPR, you have the right to request confirmation from us as to whether we are processing personal data relating to you. If this is the case, you have a right to information about this personal data and to further information, which is mentioned in Art. 15 GDPR.

Right to correction

According to Art. 16 GDPR, you have the right to request us to correct incorrect personal data concerning you without delay. Taking into account the purposes of the processing, you also have the right to request the completion of incomplete personal data – including by means of a supplementary declaration.

Right to deletiondelete

You have the right to demand that wepersonal data relating to you immediately. We are obliged to delete personal data immediately, provided that the relevant requirements of Art. 17 GDPR are met. For details, we refer to Art. 17 GDPR.

Right to restriction of processing

In accordance with Art. 18 GDPR, you have the right, under certain conditions, to request that we restrict the processing of your personal data.

Right to data portability

According to Art 20 GDPR, you have the right to receive the personal data concerning you that you have provided to us in a structured, common and machine-readable format, and you have the right to transfer this data to another person responsible without hindrance from us if the processing is based on consent in accordance with Article 6 (1) a) GDPR or Article 9 (2) a) GDPR or on a contract in accordance with Article 6 (1) b) GDPR and the processing is carried out using automated procedures.

objectionobject

Right ofAccording to Art. 21 GDPR, you have the right toto the processing of personal data concerning you, which is based on Article 6 Paragraph 1 Letter e or f GDPR; this also applies to profiling based on these provisions.

If we process your personal data in order to operate direct mail, you have the right at any time to object to the processing of your personal data for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct advertising.

If you would like to exercise a right to which you are entitled, please contact us as the person responsible using the contact details given above or use one of the other methods we offer and send this message. If you have any questions about this, please contact us.

Existence of a right to lodge a complaint with the supervisory authoritylodge a complaint with the supervisory authority

According to Art. 77 GDPR, without prejudice to any other administrative or judicial remedy, you have the right to. This right exists in particular in the member state of your place of residence, your place of work or the place of the alleged violation if you are of the opinion that the processing of your personal data violates the GDPR.