Data protection

Privacy Policy of the Tropimarkt website

Tropimarkt UG (limited liability)

Levetzowstrasse 13

10555 Berlin, Germany

contact@tropimarkt.com

1. Security and protection of your personal data when visiting our website

The Tropimarkt UG (limited liability) (hereinafter referred to as “Tropimarkt” or “we”) takes the protection of personal data very seriously and applies the utmost care and the most modern security standards to ensure this.

We consider it our primary task to maintain the confidentiality of the personal data you provide and to protect it from unauthorized access.

2. Definitions

In order to ensure a transparent and easily understandable explanation of the processing of personal data, we inform you about the individual legal definitions that are also used in this data protection declaration:

1. Personal data
   “Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
2. processing
   “Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
3. Restriction of processing
   “Restriction of processing” means the marking of stored personal data with the aim of limiting its future processing.
4. Profiling
   “Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
5. Pseudonymization
   “Pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data cannot be attributed to an identified or identifiable natural person.
6. File system
   ‘Filing system’ means any structured set of personal data accessible according to specific criteria, whether centralised, decentralised or dispersed in a functional or geographical manner.
7. Person responsible
   "Controller" means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
8. Processor
   “Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
9. Recipient
   "Recipient" means a natural or legal person, public authority, agency or other body to which personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be considered recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules and in accordance with the purposes of the processing.
10. Third
    “Third party” means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons authorised to process personal data under the direct authority of the controller or processor.
11. consent
    “Consent” of the data subject is any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

3. Lawfulness of processing

The processing of personal data is only lawful if there is a legal basis for the processing. Pursuant to Article 6(1), the legal basis for processing may be
a – f GDPR in particular:

1. The data subject has given his or her consent to the processing of personal data concerning him or her for one or more specific purposes;
2. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. processing is necessary to fulfill a legal obligation to which the controller is subject;
4. processing is necessary to protect the vital interests of the data subject or of another natural person;
5. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. processing is necessary to protect the legitimate interests of the controller or of a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

4.Collection of personal data when visiting our website

If you use the website for purely informational purposes, i.e., if you do not register, purchase anything, or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. When you visit our website, we collect the following data, which is technically necessary for us to display our website to you and ensure stability and security (the legal basis for this is Art. 6 (1) (f) GDPR):

• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• amount of data transferred
• Website from which the request comes
• Browser
• Operating system and its interface
• Language and version of the browser software.

5. Information about the collection of personal data – (email, contact form, customer account and online shop)

(1) In the following, we inform you about the collection of personal data when using our website (contact form, customer account and online shop)

If you contact us by email or via our Contact form The data you provide (email address, your name, and your telephone number, if applicable) will be stored by us in order to answer your questions. We will delete the data collected in this context once storage is no longer required, or we will restrict processing if statutory retention periods apply.

(3) If you purchase products through our website or create a customer account to manage your previous or future orders, we collect the data we need to process the contract. This data can be found in the respective input fields for registration (customer account) or on the order form. When placing an order, we require at least the mandatory information marked with an asterisk (*). We use this data in accordance with Art. 6 (1) (b) GDPR to process the contract and to process your inquiries.

Our store is hosted by SiteGround Spain SL Inc. SiteGround Spain SL provides us with an e-commerce platform that allows us to sell our products and services to you.

Your data is managed through the data storage, database, and general services of SiteGround Spain SL. SiteGround Spain SL stores your data on a secure server behind a firewall.

If you pay by credit card, Stripe stores your credit card information. This information is encrypted using the Payment Card Industry Data Security Standard (PCI-DSS). Your purchase data is stored only for as long as necessary for the duration of the purchase. Once the purchase is completed, your purchase data is deleted. All direct payment gateways are subject to the PCI-DSS standard and are managed by the PCI Security Standards Council – a joint initiative of Visa, MasterCard, American Express, and Discover. PCI-DSS requirements help ensure secure payment transactions with credit card information in our store and with our service providers. More detailed information can be found in the Terms of Use. https://stripe.com/en-de/privacy can be read by Stripe.

(4) In addition to credit card payments, we offer other payment methods for using the web shop and use various payment service providers with whom we have concluded a data processing agreement.Depending on the payment method you choose, different data will be transmitted to the respective payment service provider. The legal basis for this transmission is Art. 6 Paragraph 1 Sentence 1 a, b, f GDPR.

Below we list our payment service providers:

Stripe

Their privacy policy can be found at https://stripe.com/us/privacy can be viewed.

PayPal
If you pay for your purchase with PayPal, your personal data will be transmitted to PayPal. If you have not yet opened a PayPal account, you will be prompted to do so by PayPal during the payment process. When using or opening a PayPal account, your name, address, telephone number, and email address, among other information, must be transmitted to PayPal. The legal basis for the transmission of data is Article 6 (1) (a) GDPR and Article 6 (1) (b) GDPR.

The operator of the payment service PayPal is:

PayPal (Europe) S.à rl et Cie, SCA
22-24 Boulevard Royal
L-2449 Luxembourg
E-mail: impressum@paypal.com

By choosing PayPal as your payment option, you consent to the transmission of personal data such as your name, address, telephone number, and email address to PayPal. Details of other data collected by PayPal can be found in the respective PayPal privacy policy. This can be found at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Klarna
If you pay with Klarna, your personal data will be transferred to Klarna Bank AB, the operator of the payment service provider Klarna. The legal basis for this transfer is Article 6 (1) (a) GDPR and Article 6 (1) (b) GDPR.

Klarna AB can be reached as follows:

Klarna Bank AB (publ)
Sveavägen 46
111 34 Stockholm
Sweden
Telephone: 0046 8-120 120 00
Fax: 0046 8-120 120 99
Contact: info@klarna.de

Klarna collects the following data when processing payments for orders from our online shop:

• Name, date of birth, title, billing and delivery address, email address, mobile phone number
• Information about ordered products
• Information about income, credit obligations and payment notes
• Location-based information
• IP address

Klarna also conducts an identity and credit check. The data you provided for the purchase is compared with the data available from a credit agency. This data processing is based on your express consent; the legal basis is Art. 6 (1) Sentence 1 a GDPR. You can revoke your consent at any time without giving reasons, with effect for the future, in accordance with Art. 7 (3) GDPR.

Detailed information on the privacy policy of Klarna Bank AB (publ) can be found at https://www.klarna.com/de/datenschutz/

Wirecard
Information on the data protection regulations of Wirecard Bank AG can be found at https://www.wirecardbank.de/fileadmin/user_upload/wirecardbank/fileuploads/Dokumente/Wirecard_-_Kommunikation_Haendler_WDB_als_Controller_-_DE.PDF

(5) We will also pass on your contact details to the commissioned shipping company if this is necessary to process the order (here: delivery of the goods).

(6) Due to commercial and tax law, we are required to store your address, payment, and order data for a period of ten years. However, after two years, we restrict processing, i.e., we delete your personal data.Your data will only be used to comply with legal obligations. The legal basis for this is Article 6 Paragraph 1 Sentence 1 c GDPR.

6. Newsletter

(1) With your consent, you can subscribe to our newsletter, with which we will inform you about our current, interesting offers. The advertised goods and services are listed in the declaration of consent. The legal basis is Art. 6 (1) (a) GDPR.

(2) We use the so-called double opt-in procedure for registering for our newsletter. This means that after your registration, we will send you an email to the email address you provided, asking you to confirm that you wish to receive the newsletter. If you do not cancel your registration within 24 hours, If you confirm within 24 hours, your information will be blocked and automatically deleted after one month. In addition, we store your IP addresses and the times of registration and confirmation. The purpose of this process is to verify your registration and, if necessary, to investigate any possible misuse of your personal data.

(3) The only mandatory information required to receive the newsletter is your email address. Providing additional, separately marked data is voluntary and will be used to address you personally. After your confirmation, we will save your email address for the purpose of sending you the newsletter.

(4) You can revoke your consent to receive the newsletter at any time and unsubscribe from the newsletter. You can do so by clicking on the link provided in each newsletter email or by sending a message to the contact details provided in the imprint.

(5) We use the external service provider Emarsys as a processor for sending the newsletter. A separate data processing agreement has been concluded with this service provider to ensure the protection of your personal data. Further information about Emarsys can be found on the website https://www.emarsys.com/de/ provided.

7. Use of external tools on our website

We have integrated various tools from different companies into our website that enable us to evaluate user behavior or create links to other websites.

We work with the following service providers:

Google Analytics

The controller has integrated the Google Analytics component (with anonymization function) on this website.

Google Analytics is a web analytics service. Web analytics is the collection, gathering, and evaluation of data about the behavior of website visitors. A web analytics service collects, among other things, data about the website from which a data subject came to a website (so-called referrers), which subpages of the website were accessed, and how often and for how long a subpage was viewed. Web analytics is primarily used to optimize a website and for the cost-benefit analysis of online advertising.

The operator of the Google Analytics component is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

Google Analytics uses cookies. The information generated by the Google Analytics cookie about your use of this website is usually transferred to a Google server in the USA and stored there. Google may transfer this personal data collected through this technical process to third parties.

However, by activating IP anonymization on our website, your IP address will be shortened by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide us with other services related to website activity and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

This website also uses the analytics feature UserID to track interaction data. This UserID is additionally anonymized and encrypted and is not associated with any other data.

You can prevent cookies from being saved by selecting the appropriate settings in your browser. However, if you do this, you may not be able to use the full functionality of our website.

You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by downloading and installing the browser plug-in available under the following link: https://tools.google.com/dlpage/gaoptout?hl=de

This browser add-on informs Google Analytics via JavaScript that no data and information about visits to websites may be transmitted to Google Analytics.

In addition, a cookie already set by Google Analytics can be deleted at any time via the Internet browser or other software programs.

Further information and Google’s applicable privacy policy can be found at https://policies.google.com/privacy?hl=de and under https://marketingplatform.google.com/about/analytics/terms/de/ Google Analytics is available at this link https://marketingplatform.google.com/about/ explained in more detail.

Our website also uses Google Analytics demographic and interest reporting, as well as Google Display Network impression reporting. You can opt out of Google Analytics for Display Advertising and customize your Google Display Network ads by visiting Ad Settings at this link: https://adssettings.google.de.

Google Tag Manager

This website uses Google Tag Manager. This service allows so-called website tags to be managed centrally via an interface. Google Tag Manager merely implements tags. no Cookies are used and no personal data is collected.

Google provides a corresponding privacy policy for this data collection by third parties: https://www.google.com/intl/de/tagmanager/use-policy.html

However, Google Tag Manager does not access this data. If deactivation has been performed for specific domains/websites or cookies, this will remain in effect for all tracking tags implemented with Google Tag Manager.

Facebook Tracking Pixel

With your consent, we use Facebook's "tracking pixel." This pixel allows us to track user behavior after they have been redirected to our website by clicking on a Facebook and/or Instagram ad.This allows us to measure the effectiveness of Facebook and Instagram ads for statistical and market research purposes and to implement optimization measures if necessary. Tracking users who landed on our website after clicking on one of my Facebook and Instagram ads can take up to 180 days.

The data collected in this way is anonymous to us, meaning we do not see the personal data of individual users. However, this data is stored and processed by Facebook, and we will inform you about this as soon as we know.

Facebook may link this data to the Facebook account and also use it for its own advertising purposes, in accordance with its data usage policy.

If you would like to deactivate the storage of cookies for Facebook, you can do so via your browser settings.

Facebook communication tools

We also use communication tools from Facebook, in particular the "Custom Audiences" and "Website Custom Audiences" products. This generally generates a non-reversible and non-personal checksum (hash value) from your usage data, which can be transmitted to Facebook for analysis and marketing purposes.

If you wish to object to the use of Facebook Website Custom Audiences, you can do so at https://www.facebook.com/ads/Webseite_custom_audiences/ do.

We also use Customer Match lists as part of our Facebook advertising activities, including for "lookalike audiences" and remarketing. To use Customer Match, lists with encrypted user data are uploaded to Facebook. After the upload, the system checks which data is already known and assigns these users to a list. After the Customer Match lists are created, the encrypted customer data is automatically deleted. This prevents Facebook from obtaining new addresses (encryption).

Twitter

We use components from the provider Twitter on our website. Twitter is a service of Twitter Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA.

Each time you visit our website that contains such a component, this component causes your browser to download a corresponding representation of the component from Twitter. This process informs Twitter which specific page of our website is currently being visited.

We have no influence on the data Twitter collects through this, nor on the extent of this data collected by Twitter. To the best of our knowledge, Twitter collects the URL of the respective website accessed and the user's IP address, but does not use this information for any purpose other than displaying the Twitter component. Further information can be found in Twitter's privacy policy at https://twitter.com/de/privacy.

You can manage your privacy settings in your account settings under https://twitter.com/account/settings change.

Pinterest

We use the service of Pinterest, Inc., 808 Brannan St, San Francisco, CA 94103, USA, on our website. The integrated "Pin it" button informs Pinterest that you have accessed the corresponding page of our website. If you are logged in to Pinterest, Pinterest can assign this visit to our site to your Pinterest account and thus link the data. The data transmitted by clicking the "Pin it" button is stored by Pinterest.For further information on the purpose and scope of data collection, its processing and use, as well as your rights and setting options for protecting your privacy, please see Pinterest's privacy policy: https://policy.pinterest.com/de/privacy-policy.

To prevent Pinterest from associating your visit to our website with your Pinterest account, you must log out of your Pinterest account before visiting our site.

WhatsApp & Apple Business Chat

By sending a start message, I agree to the validity of TropiMarkt's internal data protection regulations.

In particular, in accordance with Art. 6 (1) (a) GDPR, I consent to my personal data (first and last name, telephone number, Messenger ID, profile picture, and message history) being stored, processed, and used in connection with the use of the respective messenger service to send messages to me. An active account with the respective provider is required to use the messenger service.

I am also aware that TropiMarkt uses MessengerPeople GmbH, Herzog-Heinrich-Str. 9, 80336 Munich, as a technical service provider and processor to provide this service.

My consent to the processing of personal data is freely revocable at any time; a corresponding notification to TropiMarkt is sufficient. Further information can be found in the respective privacy policies of TropiMarkt, the messenger services, and MessengerPeople GmbH.

8. Tracking & Cookies Data

We use cookies and similar tracking technologies to track the activity on our Service and we hold certain information.

Cookies are small text files that may include an anonymous unique identifier. Cookies are sent from a website to your browser and stored on your device. Other tracking technologies, such as beacons, tags, and scripts, are also used to collect and track information, improve, and analyze our service.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some parts of our Service.

Examples of cookies we use:

• Session cookies. We use session cookies to operate our service.
• Preferred cookies. We use preference cookies to store your preferences and various settings.
• Security cookiesWe use security cookies for security reasons.

9. Your data protection rights towards TropiMarkt

(1) Revocability of consent, Article 7 GDPR
According to Article 7, Paragraph 3 of the GDPR, you have the right to revoke your consent to data processing at any time without giving reasons. You can send your revocation informally to the address or email address provided at the beginning of this privacy policy. Revoking your consent does not affect the legality of the processing carried out on the basis of your consent up to the time of revocation (Article 7, Paragraph 3, Sentence 2 of the GDPR).

(2) Right to information, Article 15 GDPR
According to Article 15 (1) GDPR, you have the right to information about whether we process your personal data. If so, you have the right to receive further information (Article 15 (2) GDPR).

(3) Right to rectification, erasure or restriction of processing, Articles 16, 17 and 18 GDPR
According to Article 16 GDPR, you have the right to immediately request the rectification of inaccurate data and the completion of incomplete data – also by means of a supplementary declaration.
You have the right to erasure of personal data in accordance with Article 17 GDPR, in particular if the processing of your personal data is not or no longer permitted.

(4) Right to object, Article 21 GDPR
You have the right to object at any time, for reasons related to your particular situation, to the processing of personal data concerning you which is based on Article 6 Paragraph 1 e or f GDPR; this also applies to profiling based on these provisions. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms.
You can exercise your right of objection at any time by contacting us using the contact options listed in the imprint.

(5) Right to lodge a complaint with a supervisory authority, Article 77 GDPR
Furthermore, without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you is unlawful. The Data Protection Authority of the Republic of Austria provides https://www.dsb.gv.at/dokumente Forms are available for exercising your legal rights and filing complaints. For our German customers: Your responsible supervisory authority is the one in your place of residence. A list of all supervisory authorities can be found at https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html

10. Cloudflare Content Delivery Network

We use a Content Delivery Network (CDN) provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare is certified under the Privacy Shield Agreement, which provides a guarantee of compliance with European data protection laws (https://www.privacyshield.gov/participant?id=a2zt0000000GnZKAA0&status=Active).

A CDN is a service that allows us to deliver content from our online offering, especially large media files such as graphics or scripts, via regionally distributed servers connected to the Internet. User data is processed exclusively for the aforementioned purposes and to maintain the security and functionality of the CDN.

The use is based on our legitimate interests, i.e. interest in the secure and efficient provision, analysis, and optimization of our online offering in accordance with Art. 6 (1) (f) GDPR.

For more information, see the Cloudflare Privacy Policy: https://www.cloudflare.com/security-policy.