Privacy policy

Privacy Policy

Unless otherwise stated below, the provision of your personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide the data. Failure to provide them has no consequences. This applies only insofar as no other information is given for the processing operations described below.
"Personal data" means any information relating to an identified or identifiable natural person.

Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. An adequacy decision of the EU Commission exists for Canada. An adequacy decision of the EU Commission exists for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to the EU Commission's standard contractual clauses.

Contact

Controller
Contact us if you wish. The controller responsible for data processing is: Vladimir Amstislavski/Firstcom Trading GmbH, Marienstr. 41, 40210 Düsseldorf Germany, +49 (0) 21163552858, shop@carbonphonepro.com

Customer-initiated contact by e-mail
If you contact us on your own initiative by e-mail for business purposes, we collect your personal data (name, e-mail address, message text) only to the extent provided by you. The data processing serves to handle and respond to your contact request.
If the contact serves to carry out pre-contractual measures (e.g. advice in the event of interest in a purchase, preparation of an offer) or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 (1) (b) GDPR.
If the contact is made for other reasons, this data processing is carried out on the basis of Art. 6 (1) (f) GDPR on the basis of our overriding legitimate interest in handling and responding to your request. In this case, you have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you based on Art. 6 (1) (f) GDPR.
We use your e-mail address only to process your request. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Collection and processing when using the contact form
When you use the contact form, we collect your personal data (name, e-mail address, message text) only to the extent provided by you. The data processing serves the purpose of making contact.
If the contact serves to carry out pre-contractual measures (e.g. advice in the event of interest in a purchase, preparation of an offer) or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 (1) (b) GDPR.
If the contact is made for other reasons, this data processing is carried out on the basis of Art. 6 (1) (f) GDPR on the basis of our overriding legitimate interest in handling and responding to your request. In this case, you have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you based on Art. 6 (1) (f) GDPR.
We use your e-mail address only to process your request. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Customer Account      Orders      

Customer account
When you open a customer account, we collect your personal data to the extent specified there. The data processing serves the purpose of improving your shopping experience and simplifying order processing. The processing is carried out on the basis of Art. 6 (1) (a) GDPR with your consent. You can withdraw your consent at any time by notifying us, without affecting the lawfulness of the processing carried out on the basis of the consent until its withdrawal. Your customer account will then be deleted.

Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. An adequacy decision of the EU Commission exists for Canada. An adequacy decision of the EU Commission exists for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to the EU Commission's standard contractual clauses.

Reviews       Advertising      

Use of your e-mail address for sending newsletters
Independently of the performance of the contract, we use your e-mail address exclusively for our own advertising purposes to send newsletters, provided that you have expressly consented to this. The processing is carried out on the basis of Art. 6 (1) (a) GDPR with your consent. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent until its withdrawal. To do so, you can unsubscribe from the newsletter at any time by using the corresponding link in the newsletter or by notifying us. Your e-mail address will then be removed from the mailing list. 

Your data is passed on to a service provider for e-mail marketing as part of commissioned processing. It is not passed on to any other third parties.

Shipping Service Providers       Merchandise Management      

Disclosure of your e-mail address to shipping companies for information on the shipping status
As part of the performance of the contract, we pass on your e-mail address to the transport company if you have expressly consented to this during the ordering process. The purpose of passing on the data is to inform you of the shipping status by e-mail. The processing is carried out on the basis of Art. 6 (1) (a) GDPR with your consent. You can withdraw your consent at any time by notifying us or the transport company, without affecting the lawfulness of the processing carried out on the basis of the consent until its withdrawal.

Use of an external merchandise management system
We use a merchandise management system as part of commissioned processing to process contracts. For this purpose, the personal data collected from you in the course of the order are transmitted to
ViA-Online GmbH, Kimplerstraße 296, 47807 Krefeld
Amicron Software,Gewerbegebiet Stedener Feld 4, 33104 Paderborn 
.

The processing of your personal data serves the purpose of fulfilling the contract concluded with you and is carried out on the basis of Art. 6 (1) (b) GDPR.

Payment Service Providers      

Use of PayPal
On our website we use the PayPal payment service of PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal"). The data processing serves the purpose of offering you payment via this payment service. When you select and use payment via PayPal, the data required for payment processing is transmitted to PayPal in order to be able to perform the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6 (1) (b) GDPR.

All PayPal transactions are subject to the PayPal Privacy Statement. This can be found at https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Use of PayPal Express
On our website we use the PayPal Express payment service of PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal"). The data processing serves the purpose of offering you payment via the PayPal Express payment service. To integrate this payment service, it is necessary for PayPal to collect, store and analyse data (e.g. IP address, device type, operating system, browser type, location of your device) when the website is accessed. Cookies may also be used for this purpose. The cookies enable your browser to be recognised.
Your personal data is processed on the basis of Art. 6 (1) (f) GDPR on the basis of our overriding legitimate interest in a customer-oriented offer of various payment methods. You have the right to object to this processing of personal data concerning you at any time on grounds relating to your particular situation.
When you select and use PayPal Express, the data required for payment processing is transmitted to PayPal in order to be able to perform the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6 (1) (b) GDPR. Further information on data processing when using the PayPal Express payment service can be found in the associated privacy policy at www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE#Updated_PS.

Use of PayPal Check-Out
On our website we use the PayPal Check-Out payment service of PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal"). The data processing serves the purpose of offering you payment via this payment service. When you select and use payment via PayPal, credit card via PayPal, direct debit via PayPal or "Pay Later" via PayPal, the data required for payment processing is transmitted to PayPal in order to be able to perform the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6 (1) (b) GDPR.

In this context, cookies may be stored that enable your browser to be recognised. The resulting data processing is carried out on the basis of Art. 6 (1) (f) GDPR on the basis of our overriding legitimate interest in a customer-oriented offer of various payment methods. You have the right to object to this processing of personal data concerning you at any time on grounds relating to your particular situation.

Credit card via PayPal, direct debit via PayPal & "Pay Later" via PayPal 
For certain payment methods, such as credit card via PayPal, direct debit via PayPal or "Pay Later" via PayPal, PayPal reserves the right to obtain credit information, if necessary, on the basis of mathematical-statistical procedures using credit agencies. For this purpose, PayPal transmits the personal data required for a credit check to a credit agency and uses the information received about the statistical probability of a payment default for a balanced decision on the establishment, performance or termination of the contractual relationship. The credit report may contain probability values (score values) that are calculated on the basis of scientifically recognised mathematical-statistical procedures and in whose calculation, among other things, address data are included. Your legitimate interests are taken into account in accordance with the statutory provisions. The data processing serves the purpose of checking creditworthiness for the initiation of a contract. The processing is carried out on the basis of Art. 6 (1) (f) GDPR on the basis of our overriding legitimate interest in protection against payment default if PayPal makes an advance payment. 
You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you based on Art. 6 (1) (f) GDPR by notifying PayPal. The provision of the data is necessary for the conclusion of the contract with the payment method you have requested. If the data is not provided, the contract cannot be concluded with the payment method you have selected.

Third-party providers
When paying via the payment method of a third-party provider, the data required for payment processing is transmitted to PayPal. This processing is carried out on the basis of Art. 6 (1) (b) GDPR. To carry out this payment method, PayPal may then pass the data on to the respective provider. This processing is carried out on the basis of Art. 6 (1) (b) GDPR. Local third-party providers may include, for example:

• Sofort (SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany)
• giropay (Paydirekt GmbH, Stephanstr. 14-16, 60313 Frankfurt am Main)

Purchase on account via PayPal 
When paying via the purchase on account payment method, the data required for payment processing is first transmitted to PayPal. To carry out this payment method, PayPal then transmits the data to Ratepay GmbH (Franklinstraße 28-29, 10587 Berlin; "Ratepay") in order to be able to perform the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6 (1) (b) GDPR. Ratepay may carry out a credit check on the basis of mathematical-statistical procedures (probability or score values) using credit agencies in accordance with the procedure already described above. The data processing serves the purpose of checking creditworthiness for the initiation of a contract. The processing is carried out on the basis of Art. 6 (1) (f) GDPR on the basis of our overriding legitimate interest in protection against payment default if Ratepay  makes an advance payment. Further information on data protection and on which credit agencies Ratepay uses can be found at https://www.ratepay.com/legal-payment-dataprivacy/ and https://www.ratepay.com/legal-payment-creditagencies/. 

Further information on data processing when using PayPal can be found in the associated privacy policy at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Analytics       Communication      

Use of Google Analytics 4
On our website we use the web analytics service Google Analytics of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google").
The data processing serves the purpose of analysing this website and its visitors as well as marketing and advertising purposes. For this purpose, Google will use the information obtained on behalf of the operator of this website to evaluate your use of the website, to compile reports on website activities and to provide the website operator with further services associated with website use and internet use. 
The following information, among others, may be collected: IP address, date and time of the page view, click path, information about the browser you use and the device you use, pages visited, referrer URL (website via which you accessed our website), location data, purchase activities. Your data may be linked by Google with other data, such as your search history, your personal accounts, your usage data from other devices and any other data that Google holds about you.

The IP address is first shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area.

Your personal data is processed with your consent on the basis of Art. 6 (1) (a) GDPR. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent until its withdrawal.

The information generated in this way about your use of this website is generally transferred to a Google server in the USA and stored there. An adequacy decision of the EU Commission exists for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Google has certified itself under the TADPF and has thus undertaken to comply with European data protection principles. Both Google and US government authorities have access to your data.

Further information on the terms of use and data protection can be found at https://policies.google.com/technologies/partner-sites and at https://policies.google.com/privacy?hl=de&gl=de.

Plug-ins and Other

Use of social plug-ins via "Shariff"
We use social network plug-ins on our website. So that you remain in control of your data, we use the privacy-friendly "Shariff" buttons.
Without your express consent, no connections are established with the servers of the social networks and consequently no data is transmitted.
"Shariff" was developed by the specialists of the computer magazine c’t. It enables more privacy online and replaces the usual "Share" buttons of the social networks. More information about the Shariff project can be found here https://www.heise.de/ct/artikel/Shariff-Social-Media-Buttons-mit-Datenschutz-2467514.html.
When you click the buttons, a pop-up window appears in which you can log in to the respective provider with your data. Only after you have actively logged in is a direct connection established with the social networks.
By logging in, you consent to the transmission of your data to the respective social media provider. In this process, among other things, both your IP address and information about which of our pages you have visited are transmitted. If you are simultaneously logged in to one or more of your social network accounts, the information collected will also be assigned to your corresponding profiles. You can only prevent this assignment by logging out of your social media accounts before visiting our website and before activating the buttons. The social networks named below are integrated via the "Shariff" function.
Further information on the scope and purpose of data collection and use, as well as on your rights in this regard and options for protecting your privacy, can be found in the providers' linked privacy notices.

Facebook of Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland):
https://www.facebook.com/policy.php
Your data may be transferred to the USA. An adequacy decision of the EU Commission exists for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Meta has certified itself under the TADPF and has thus undertaken to comply with European data protection principles.

Instagram of Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland) https://help.instagram.com/155833707900388.
Your data may be transferred to the USA. An adequacy decision of the EU Commission exists for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Meta has certified itself under the TADPF and has thus undertaken to comply with European data protection principles.

Use of social plug-ins via the "2-click solution"
We use social network plug-ins on our website via the "2-click solution". Without your express consent, no connections are established with the servers of the social networks and consequently no data is transmitted.
With the standard integration of plug-ins, when you access the pages of our website that contain such a plug-in, a connection is established between your computer and the servers of the social network provider, and the plug-in is displayed on the page by means of a notification to your browser. In this process, both your IP address and information about which of our pages you have visited are transmitted to the provider's servers. This applies regardless of whether you are registered with or logged in to the social network. Transmission also takes place for users who are not registered or not logged in. If you are also logged in to the social network Facebook, this information will be assigned to your personal user account. When you use the plug-in functions (e.g. by clicking the button), this information is also assigned to your user account, which you can only prevent by logging out before using the plug-in. So that you remain in control of your data, we have decided to initially deactivate the corresponding button. You can recognise this by the greyed-out button. Without your express consent - in the form of activating the button - no connection is established with the server of the social network and consequently no data is transmitted.
Only when you activate the button does it become active (highlighted in colour) and a direct connection is established with the servers of the social network.
By activating it, you consent to the transmission of your data to the respective social network provider. In this process, among other things, both your IP address and information about which of our pages you have visited are transmitted. If you are simultaneously logged in to one or more of your social network accounts, the information collected will also be assigned to your corresponding profiles. You can only prevent this assignment by logging out of your social network user accounts before visiting our website and before activating the buttons.
The social networks named below are integrated via the "2-click function". Further information on the scope and purpose of data collection and use, as well as on your rights in this regard and options for protecting your privacy, can be found in the providers' linked privacy notices.

Facebook of Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland):
https://www.facebook.com/policy.php
Your data may be transferred to the USA. An adequacy decision of the EU Commission exists for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Meta has certified itself under the TADPF and has thus undertaken to comply with European data protection principles.

Instagram of Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland): 
http://instagram.com/legal/privacy/
Your data may be transferred to the USA. An adequacy decision of the EU Commission exists for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Meta has certified itself under the TADPF and has thus undertaken to comply with European data protection principles.

Integration of the idealo logo
The logo of our partner idealo (idealo internet GmbH, Ritterstraße 11, 10969 Berlin) is integrated on our website. When you access our website, the browser used on your device automatically sends information to the idealo server. This information is temporarily stored in a so-called server log file for 7 days. The following information is collected without your intervention and stored until it is automatically deleted:

• IP address of the requesting computer,
• date and time of access,
• name and URL of the file accessed,
• website from which access is made (referrer URL),
• browser used and, if applicable, the operating system of your computer and the name of your access provider.

The temporary storage of the IP address by the system is necessary to enable the website to be delivered. For this purpose, the IP address  must remain stored for the duration of the session. Storage in log files is carried out to ensure the functionality of the website. In addition, the data serves to optimise the website and to ensure the security of the information technology systems. This data is not stored together with other personal data. The legal basis for the data processing is Art. 6 (1) sentence 1 (f) GDPR.

Data Subject Rights and Storage Period

Storage period
After complete performance of the contract, the data is initially stored for the duration of the warranty period, then taking into account statutory retention periods, in particular those under tax and commercial law, and then deleted after the periods have expired, unless you have consented to further processing and use.

Rights of the data subject
If the statutory requirements are met, you have the following rights under Art. 15 to 20 GDPR: right of access, right to rectification, right to erasure, right to restriction of processing, right to data portability.
In addition, under Art. 21 (1) GDPR you have a right to object to processing based on Art. 6 (1) (f) GDPR and to processing for the purposes of direct marketing.

Right to lodge a complaint with the supervisory authority
In accordance with Art. 77 GDPR, you have the right to lodge a complaint with the supervisory authority if you believe that the processing of your personal data is not lawful.

Right to object
If the processing of personal data listed here is based on our legitimate interest pursuant to Art. 6 (1) (f) GDPR, you have the right to object to this processing at any time with effect for the future on grounds relating to your particular situation.
Once you have objected, the processing of the data concerned will be stopped, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Last updated: 31.07.2024