data protection

Privacy policy of the Tropimarkt website

Tropimarkt UG (limited liability)

levetzowstrasse 13

10555 Berlin, Germany

contact@tropimarkt. com

1. Security and protection of your personal data when visiting our website

Tropimarkt UG (limited liability) (hereinafter only "Tropimarkt" or "we") takes the protection of personal data very seriously and applies the utmost care and the most modern security standards to ensure this.

We consider it our primary task to maintain the confidentiality of the personal data you provide and to protect it from unauthorized access.

2. Definitions

In order to ensure a transparent and easily understandable declaration on the processing of personal data, we are informing you about the individual legal definitions that are also used in this data protection declaration:

1. Personal data
   "Personal data" is any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more special features that express the physical , physiological, genetic, psychological, economic, cultural or social identity of that natural person.
2. Processing
   "Processing" is any process carried out, with or without the aid of automated processes, or any such series of processes in connection with personal data, such as the collection, recording, organisation, ordering, storage, the adaptation or modification, the reading, the query, the use, the disclosure by transmission, distribution or any other form of provision, the comparison or the linking, the restriction, the deletion or the destruction.
3. Restriction of processing
   "Restriction of processing" is the marking of stored personal data with the aim of restricting their future processing.
4. Profiling
   "Profiling" means any type of automated processing of personal data, which consists in using this personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects related to work performance, economic condition, health, personal preferences, interests, reliability, behavior, whereabouts or relocation of that natural person.
5. Pseudonymization
   "Pseudonymization" is the processing of personal data in such a way that the personal data can no longer be assigned to a specific data subject without the use of additional information, provided that this additional information is stored separately and is technical and are subject to organizational measures that ensure that the personal data cannot be assigned to an identified or identifiable natural person.
6. File system
   "File system" is any structured collection of personal data that is accessible according to certain criteria, regardless of whether this collection is centralized, decentralized or organized according to functional or geographical aspects.
7. Responsible person
   "Responsible person" is a natural or legal person, public authority, institution or other body that alone or jointly with others decides on the purposes and means of processing personal data; if the purposes and means of this processing are specified by Union law or the law of the Member States, the person responsible or the specific criteria for his naming can be provided for by Union law or the law of the Member States.
8. Processor
   "Processor" is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the person responsible.
9. Recipient
   "Recipient" means a natural or legal person, public authority, agency or other body to which personal data is disclosed, whether a third party or not. However, authorities that may receive personal data in the context of a specific investigation under Union or Member State law are not considered recipients; the processing of this data by the said authorities is carried out in accordance with the applicable data protection regulations in accordance with the purposes of the processing.
10. Third party
    "Third party" is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons working under the direct responsibility of the controller or processor processors are authorized to process the personal data.
11. Consent
    A "consent" by the data subject is any voluntarily given, informed and unequivocal expression of will in the form of a declaration or other unequivocal confirmatory action with which the data subject can be understood indicates that she consents to the processing of her personal data.

3. Lawfulness of processing

The processing of personal data is only lawful if there is a legal basis for the processing. According to Article 6 paragraph 1
a – f GDPR, the legal basis for processing can be in particular:

1. The data subject has given their consent to the processing of their personal data for one or more specific purposes;
2. the processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract;
3. the processing is necessary for compliance with a legal obligation to which the controller is subject;
4. the processing is necessary to protect vital interests of the data subject or another natural person;
5. the processing is necessary for the performance of a task that is in the public interest or in the exercise of official authority that has been delegated to the controller;
6. The processing is necessary to safeguard the legitimate interests of the person responsible or a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data prevail, in particular if the data subject is a child acts.

4. Collection of personal data when visiting our website

If you only use the website for informational purposes, i.e. if you do not register, buy something or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. When you visit our website, we collect the following data that is technically necessary for us to display our website to you and to ensure stability and security (the legal basis for this is Art. 6 paragraph 1 sentence 1 f GDPR):

• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access Status/HTTP Status Code
• Amount of data transmitted in each case
• Web page from which the request comes
• browser
• Operating system and its interface
• Language and version of browser software.

5. Information about the collection of personal data - (e-mail, contact form, customer account and online shop)

(1) In the following we inform you about the collection of personal data when using our website (contact form, customer account and online shop)

If you contact us by e-mail or via our contact form, the data you provide (e-mail address, possibly Your name and phone number) stored by us to answer your questions. We delete the data arising in this context after the storage is no longer necessary, or the processing is restricted if there are statutory storage obligations.

(3) If you buy products via our site or create a customer account to manage your previous or future orders, we collect the data that we need to process the contract. These can be seen from the respective input fields for registration (customer account) or the order form. When placing an order, we need at least the mandatory information marked with an *. We use this data in accordance with Art. 6 Paragraph 1 Clause 1 b GDPR for the execution of the contract and for the processing of your inquiries.

Our shop is operated by SiteGround Spain S. L hosted inc. SiteGround Spain S. L provides us with an e-commerce platform that allows us to sell you our products and services.

Your data will be processed via data storage, database and generally the SiteGround Spain S. L managed. SiteGround Spain S. L stores your data on a secure server behind a firewall.

If you pay by credit card, Stripe stores your credit card details. These are encrypted using the Payment Card Industry Data Security Standard (PCI-DSS). The data of your purchase will only be stored for as long as it is necessary for the duration of the purchase. As soon as this is completed, your purchase data will be deleted. All direct payment gateways are PCI-DSS compliant and managed by the PCI Security Standards Council - a joint initiative of Visa, MasterCard, American Express and Discover. PCI-DSS requirements help with secure payment transactions with credit card information in our shop and with the service providers. More detailed information can be found in the Terms of Use https://stripe. com/en-de/privacy from Stripe.

(4) In addition to credit card payment, we offer other payment methods for using the web shop and use different payment service providers with whom we have concluded an order data processing contract. Depending on which payment method you choose, different data will be transmitted to the respective payment service provider. The legal basis for the transmission is Art. 6 paragraph 1 sentence 1 a, b, f GDPR.

The following is a list of our payment service providers:

Stripe

Your privacy policy can be found at https://stripe. com/us/privacy .

PayPal
If you pay for your purchase from us with PayPal, your personal data will be transmitted to PayPal. If you have not yet opened a PayPal account, you will be prompted to do so by PayPal during the payment process. With the use or Opening a PayPal account requires, among other things, your name, address, telephone number and e-mail address to be sent to PayPal. The legal basis for the transmission of the data is Article 6 Paragraph 1 a GDPR and Article 6 Paragraph. 1 sentence 1 b GDPR

The PayPal payment service is operated by:

PayPal (Europe) p. at r. l et Cie, p. C A
22-24 Boulevard Royal
L-2449 Luxembourg
E-Mail: impressum@paypal. com

With the PayPal payment option, you agree to the transmission of personal data such as name, address, telephone number and e-mail address to PayPal. Which other data is collected by PayPal can be found in PayPal's respective data protection declaration. This can be found at: https://www. PayPal. com/de/webapps/mpp/ua/privacy-full

Klarna
In the case of a payment with Klarna, your personal data will be transmitted to Klarna Bank AB, which operates the payment service provider Klarna. The legal basis for the transmission of the data is Article 6 Paragraph 1 Clause 1 a GDPR and Article 6 Paragraph 1 Clause 1 b GDPR.

Klarna AB can be reached as follows:

Klarna Bank AB (publ)
Sveavägen 46
111 34 Stockholm
Sweden
Phone: 0046 8-120 120 00
Fax: 0046 8-120 120 99
Contact : info@klarna. en

Klarna collects the following data when processing the payment of orders from our online shop:

• Name, date of birth, title, billing and shipping address, email address, mobile phone number
• Information about ordered products
• Income information, credit obligations and payment notes
• Location-related information
• IP address

Klarna also carries out an identity and credit check. The data you provide for the purchase will be compared with the data available from a credit agency. This data processing takes place on the basis of your express consent, the legal basis is Art. 6 para 1 sentence 1 a GDPR You can revoke your consent at any time without giving reasons with effect for the future in accordance with Art. kind 7 para. 3 GDPR.

You can find detailed information about the privacy policy of Klarna Bank AB (publ) at https://www. of course. com/de/datenschutz/

Wirecard
You can find information on the data protection regulations of Wirecard Bank AG at https://www. wirecard bank. de/fileadmin/user_upload/wirecardbank/fileuploads/Documents/Wirecard_-_kommunikation_Haendler_WDB_als_Controller_-_DE. PDF

(5) We will also pass on your contact details to the commissioned shipping company if this is necessary to process the order (here: delivery of the goods).

(6) Due to commercial and tax law requirements, we are obliged to store your address, payment and order data for a period of ten years. However, after two years we restrict the processing, i. H. Your data will only be used to comply with legal obligations. The legal basis for this is Article 6 Paragraph 1 Clause 1 c GDPR.

6. Newsletter

(1) With your consent, you can subscribe to our newsletter, with which we will inform you about our current interesting offers. The advertised goods and services are named in the declaration of consent. The legal basis is Art. 6 paragraph 1 sentence 1 a GDPR

(2) To register for our newsletter, we use the so-called. Double opt-in procedure. This means that after you have registered, we will send you an e-mail to the e-mail address you provided, in which we ask you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, your information will be blocked and automatically deleted after one month. In addition, we store the IP addresses you use and the times of registration and confirmation. The purpose of the procedure is to prove your registration and, if necessary, to be able to clarify a possible misuse of your personal data.

(3) The only mandatory information for sending the newsletter is your e-mail address. Providing further, separately marked data is voluntary and is used to be able to address you personally. After your confirmation, we will save your e-mail address for the purpose of sending the newsletter.

(4) You can revoke your consent to the sending of the newsletter at any time and unsubscribe from the newsletter. You can declare your revocation by clicking on the link provided in every newsletter e-mail or by sending a message to the contact details given in the imprint.

(5) We use the external service provider Emarsys as a processor to send the newsletter. Separate order data processing has been concluded with the service provider to ensure the protection of your personal data. More information about Emarsys is available on the website https://www. emarsys. com/de/.

7. Use of external tools on our website

We have integrated various tools from different companies into our website, which enable us to evaluate user behavior or create links to other websites.

We work together with the following service providers:

Google Analytics

The person responsible for processing has integrated the Google Analytics component (with anonymization function) on this website.

Google Analytics is a web analysis service. Web analysis is the collection, collection and evaluation of data on the behavior of visitors to websites. A web analysis service collects, among other things, data about the website from which a person concerned came to a website (so-called referrer), which subpages of the website were accessed or how often and for how long a subpage was viewed. A web analysis is mainly used to optimize a website and for the cost-benefit analysis of internet advertising.

The operator of the Google Analytics component is Google Inc. , 1600 Amphitheater Pkwy, Mountain View, CA 94043-1351, USA.

Google Analytics uses cookies. The information generated by the Google Analytics cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. Google may pass on this personal data collected via the technical process to third parties.

By activating IP anonymization on our website, however, your IP address will be shortened beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the USA and shortened there. Google use this information to evaluate your use of the website, to compile reports on website activity and to provide us with other services related to website activity and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

This website also uses the analytics functions UserID to be able to track interaction data. This user ID is also made anonymous and encrypted and is not associated with other data.

You can prevent the storage of cookies by setting your browser software accordingly. In this case, you may not be able to fully use all functions of our website.

You can also prevent the data generated by the cookie and related to the use of the website (incl. your IP address) to Google and the processing of this data by Google by downloading and installing the browser plug-in available under the following link: https://tools. google. com/dlpage/gaoptout?hl=de

This browser add-on tells Google Analytics via JavaScript that no data and information about visits to websites may be transmitted to Google Analytics.

In addition, a cookie already set by Google Analytics can be deleted at any time via the Internet browser or other software programs.

More information and Google's applicable data protection regulations can be found at https://policies. google. com/privacy?hl=de and under https://marketingplatform. google. com/about/analytics/terms/de/. Google Analytics is available under this link https://marketingplatform. google. com/about/ explained in more detail.

Our website also uses Google Analytics reports on performance by demographics and interests and reports on impressions in the Google Display Network. You can disable Google Analytics for display advertising and customize the ads on the Google Display Network by visiting the ad settings at this link: https://adssettings. google. en

Google Tag Manager

This website uses Google Tag Manager. With this service, so-called website tags can be managed centrally via an interface. The Google Tag Manager only implements tags. No cookies are used and no personal data is collected.

Google has a corresponding data protection declaration available for this third-party data collection: https://www. google. com/intl/de/tagmanager/use-policy. html

However, the Google Tag Manager does not access this data. If a deactivation has been carried out for certain domains/websites or cookies, it remains in place for all tracking tags insofar as these are implemented with the Google Tag Manager.

Facebook tracking pixels

With your consent, we use the "tracking pixel" from Facebook. With the help of this pixel, the behavior of users can be tracked after they have been redirected to our website by clicking on a Facebook and/or Instagram ad. In this way, we can record the effectiveness of the Facebook and Instagram ads for statistical and market research purposes and, if necessary, take optimization measures. It may take up to 180 days to track users who land on our website after clicking one of my Facebook and Instagram ads.

The data collected in this way is anonymous to us, i.e. we do not see the personal data of individual users. However, this data is stored and processed by Facebook, about which we will inform you according to our level of knowledge.

Facebook can connect this data to the Facebook account and also use it for its own advertising purposes, in accordance with its data usage guidelines.

If you want to deactivate cookie storage for Facebook, you can do this via your browser settings.

Facebook communication tools

We also use communication tools from Facebook, in particular the "Custom Audiences" product and "Custom Audiences website". Basically, a non-reversible and non-personal checksum (hash value) is generated from your usage data, which can be transmitted to Facebook for analysis and marketing purposes.

If you wish to object to the use of the Facebook Custom Audiences website, you can do so at https://www. Facebook. com/ads/Website_custom_audiences/.

We also use customer match lists as part of our Facebook advertising activities, e.g. a for lookalike audiences and remarketing. For the use of Customer Match, lists with encrypted user data are uploaded to Facebook. After the upload, the system checks which data is already known and assigns these users to a list. After the customer match lists have been created, the encrypted customer data is automatically deleted. Facebook does not get new addresses as a result (encryption).

Twitter

We use components from the provider Twitter on our website. Twitter is a service of Twitter Inc. , 795 Folsom St. , Suite 600, San Francisco, CA 94107, USA.

Every time you visit our website, which is equipped with such a component, this component causes the browser you are using to download a corresponding representation of the component from Twitter. This process informs Twitter which specific page of our website is currently being visited.

We have no influence on the data that Twitter collects in this way, nor on the scope of this data collected by Twitter. To the best of our knowledge, Twitter collects the URL of the website accessed and the IP address of the user, but not for purposes other than displaying the Twitter component. Further information on this can be found in Twitter's privacy policy at https://twitter. com/de/privacy.

You can change your privacy settings in the account settings under https://twitter. com/account/settings.

Pinterest

On our site we use the service of Pinterest, Inc. , 808 Brannan St, San Francisco, CA 94103, USA. The integrated "Pin it" button on the page informs Pinterest that you have accessed the corresponding page of our website. If you are logged in to Pinterest, Pinterest can assign this visit to our site to your Pinterest account and thus link the data. The data transmitted by clicking the "Pin it" button is stored by Pinterest. You can find more information about the purpose and scope of the data collection, its processing and use, as well as your rights and setting options for protecting your privacy, in Pinterest’s data protection information: https://policy. pinterest. com/de/privacy-policy.

To prevent Pinterest from being able to associate your visit to our website with your Pinterest account, you must log out of your Pinterest account before visiting our site.

WhatsApp and Apple Business Chat

By sending a start message, I agree to the validity of TropiMarkt's internal data protection regulations.

In particular, according to Art. 6 para 1 lit. a DSGVO that my personal data (last and first name, telephone number, messenger ID, profile picture and message history) will be stored, processed and used within the framework of the use of the respective messenger in order to send messages to me. An active account with the respective provider is required to use the messenger service.

I am also aware that TropiMarkt uses MessengerPeople GmbH, Herzog-Heinrich-Str. 9, 80336 Munich as a technical service provider and processor.

My consent to the processing of personal data can always be freely revoked; a corresponding notification to TropiMarkt is sufficient for this. Further information is contained in the respective data protection guidelines of TropiMarkt, the messenger services and MessengerPeople GmbH.

8. Tracking & Cookies Data

We use cookies and similar tracking technologies to track activity on our Service and we hold certain information.

Cookies are files with a small amount of data that may contain an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your device. Other tracking technologies such as beacons, tags and scripts are also used to collect and track information and to improve and analyze our Service.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some parts of our service.

Examples of cookies we use:

• Session cookies. We use session cookies to operate our service.
• Preferred cookies. We use preference cookies to remember your preferences and various settings.
• Security cookies. We use security cookies for security reasons.

9. Your data protection rights towards TropiMarkt

(1) Revocability of consent, Article 7 GDPR
According to Article 7 paragraph 3 GDPR, you have the right to revoke your consent to data processing given to us at any time without giving reasons. You can informally send your revocation to the address given at the beginning of this data protection declaration. direct email. The revocation of the consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the point of revocation (Article 7 paragraph 3 sentence 2 GDPR).

(2) Right to information, Article 15 GDPR
According to Article 15 paragraph 1 GDPR, you have the right to information as to whether we are processing your personal data. If this is the case, you are entitled to further information (Article 15 Paragraph 2 GDPR).

(3) Right to correction, deletion or restriction of processing, Articles 16, 17 and 18 GDPR
According to Article 16 GDPR, you have the right to have incorrect data corrected and incomplete data completed immediately - also by means of a supplementary Explanation - to request.
You have the right to delete personal data in accordance with Article 17 GDPR in particular if the processing of your personal data is not or no longer permissible.

(4) Right to objection, Article 21 GDPR
You have the right, for reasons that arise from your particular situation, at any time against the processing of personal data concerning you, which is based on Article 6 Paragraph 1 e or f GDPR takes place to file an objection; this also applies to profiling based on these provisions. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms.
You can exercise your right to object at any time by contacting us using the contact options listed in the imprint.

(5) Right to lodge a complaint with a supervisory authority, Article 77 GDPR
You also have the right, without prejudice to any other administrative or judicial remedy, to lodge a complaint with a supervisory authority, in particular in the member state of your place of residence, your place of work or the Place of the alleged infringement if you believe that the processing of your personal data is unlawful. The data protection authority of the Republic of Austria provides https://www. dsb. gv. at/dokumente Forms for exercising your legal rights and for making a complaint are available. The following applies to our German customers: Your responsible supervisory authority is that of your place of residence. A list of all supervisory authorities can be found at https://www. bfdi. Federation de/DE/Infothek/Addresses Links/addresses links-node. html

10. Cloudflare content delivery network

We use a Content Delivery Network (CDN) provided by Cloudflare, Inc. , 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare is certified under the Privacy Shield Agreement, which provides a guarantee of compliance with European data protection laws (https://www. privacy shield. gov/participant?id=a2zt0000000GnZKAA0&status=Active).

A CDN is a service with which content from our online offer, in particular large media files such as graphics or scripts, can be made available via regionally distributed servers connected to the Internet. User data is processed exclusively for the aforementioned purposes and to maintain the security and functionality of the CDN.

Use is based on our legitimate interests, i.e. H Interest in a secure and efficient provision, analysis and optimization of our online offer acc. Art. 6 para 1 lit. f GDPR

For more information, see the Cloudflare Privacy Policy: https://www. cloudflare. com/security-policy.