Privacy policy

This privacy policy is a translation. The French version is authoritative.

2) Data collected when you visit our website

2.1 If you use our website for information only, that is, if you do not register or otherwise send us information, we collect only the data that your browser transmits to our server (server log files). When you visit our website, we collect only the following data, which we need for technical reasons to display the website to you:

• the page visited
• date and time of access
• amount of data transferred in bytes
• the source or referrer from which you reached the page
• the browser used
• the operating system used
• the IP address used (anonymised where applicable)

Processing is based on Art. 6(1)(f) GDPR and our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used for any other purpose. We reserve the right to review the server log files retrospectively if there are specific indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (for example orders or enquiries), this website uses SSL or TLS encryption. You can recognise an encrypted connection by “https://” and the padlock symbol in your browser’s address bar.

2.3 This website is hosted by our sister company inett GmbH, Altenkesseler Straße 17 / B8, 66115 Saarbrücken, Germany. inett GmbH processes the data listed in section 2.1 (server log files) on our behalf as a processor within the meaning of Art. 28 GDPR under a data processing agreement.

4) Contacting us

We collect personal data when you contact us (for example via the contact form or by email). Via the contact form we collect only your email address and your message; we need both to be able to reply. You can see which data the contact form collects in the form itself. We store and use this data solely to answer your enquiry, to get in touch with you and for the related technical administration. The legal basis is Art. 6(1)(f) GDPR, based on our legitimate interest in answering your enquiry.

If your enquiry is aimed at concluding a contract, Art. 6(1)(b) GDPR is an additional legal basis.

Once your enquiry has been dealt with, that is, once the circumstances show that the matter has been finally resolved, we delete your data without delay, unless statutory retention obligations apply.

Data entered in the contact form is first received by our web server (see section 2.3), which checks it and sends it over an encrypted connection to inett SARL’s Odoo customer relationship management system (CRM). This system runs on Odoo.sh, the hosting platform of Odoo S.A., which acts as our processor (see section 6.2). To protect against abusive submissions, our web server stores the time of submission and the sender’s IP address, the latter only as a salted hash, for no more than 24 hours. The legal basis is Art. 6(1)(f) GDPR, based on our legitimate interest in protection against spam. The form requires JavaScript and does not set cookies.

6) Data processing for order fulfilment

6.1 To perform the contract, we pass the personal data we collect to the transport company commissioned with delivery only if this is necessary for delivering the goods.

Where, under a corresponding contract, we owe you updates for goods with digital elements or for digital products, we process the contact details you provided when ordering (name, address, email address) in order to inform you personally, as part of our statutory duty to inform under Art. 6(1)(c) GDPR, by suitable means (for example by post or email) and within the statutory period, about upcoming updates. We use your contact details solely for communications about the updates we owe and only to the extent necessary for the information concerned.

To process payment, we pass the data we collect only to the bank we have instructed, to the extent necessary for payment. Section 6.4 lists the payment methods and payment service providers we use. The legal basis for passing on this data is Art. 6(1)(b) GDPR.

6.2 Odoo

Our online shop and our CRM (shop.inett.lu) run on the Odoo software and are hosted on Odoo.sh, the hosting platform of Odoo S.A., Chaussée de Namur 40, 1367 Grand-Rosière, Belgium, on servers in the European Union. Odoo S.A. processes the data on our behalf as a processor within the meaning of Art. 28 GDPR under a data processing agreement.

We process names, addresses and, where applicable, other personal data in Odoo under Art. 6(1)(b) GDPR to fulfil your online order, and enquiries sent via the contact form as described in section 4. We also use Odoo for our accounting: incoming and outgoing invoices and, where applicable, our company’s bank transactions are recorded there, matched to payments and booked in a semi-automated process.

Where personal data is also processed for these purposes, processing is based on Art. 6(1)(f) GDPR and our legitimate interest in the efficient organisation and documentation of our business operations.

6.3 Delivery and disclosure of personal data to shipping service providers

As a rule, physical goods are delivered to you directly by our supplier (drop shipping). In that case we pass the recipient’s name and delivery address to the supplier under Art. 6(1)(b) GDPR, to the extent necessary for delivery. When we ship goods ourselves, we use the following providers.

• DHL

We use the following provider as a shipping service: Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany

Under Art. 6(1)(a) GDPR, we pass your email address and/or telephone number to the provider before the goods are delivered so that it can agree a delivery date with you or announce the delivery, provided you have given your express consent during the ordering process. Otherwise, for the purpose of delivery, we pass only the recipient’s name and the delivery address to the provider (Art. 6(1)(b) GDPR). Data is passed on only to the extent necessary for delivering the goods. In that case, agreeing a delivery date with the provider in advance or announcing the delivery is not possible.

You can withdraw your consent at any time with effect for the future, either towards the controller named above or towards the provider.

• UPS

We use the following provider as a shipping service: United Parcel Service Deutschland Inc. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany

Under Art. 6(1)(a) GDPR, we pass your email address and/or telephone number to the provider before the goods are delivered so that it can agree a delivery date with you or announce the delivery, provided you have given your express consent during the ordering process. Otherwise, for the purpose of delivery, we pass only the recipient’s name and the delivery address to the provider (Art. 6(1)(b) GDPR). Data is passed on only to the extent necessary for delivering the goods. In that case, agreeing a delivery date with the provider in advance or announcing the delivery is not possible.

You can withdraw your consent at any time with effect for the future, either towards the controller named above or towards the provider.

6.4 Payment methods and payment service providers

We offer two payment methods: payment on invoice by bank transfer, and online payment via Stripe.

• Invoice / bank transfer

If you pay on invoice, you transfer the amount to our bank account. No data is passed to a payment service provider; the payment is handled by your bank and ours.

• Stripe

For online payments we use the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). If you choose this payment method, we pass the payment data you provide during the ordering process (in particular name, address, email address, card or account details, amount, currency and transaction number) and information about your order to Stripe under Art. 6(1)(b) GDPR. Data is passed on solely to process the payment and only to the extent necessary for that purpose.

Stripe also processes certain data as an independent controller, in particular to meet its legal obligations (for example anti-money-laundering rules) and to prevent fraud. Data may be transferred to Stripe, Inc. in the USA; this transfer is based on the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses. See Stripe’s privacy policy for details.

8) Page features

The fonts used on this website are hosted on our own servers. Visiting the website does not open any connection to third-party servers to load fonts. This website does not use Google reCAPTCHA.

10) Retention period of personal data

How long we store personal data depends on the respective legal basis, the purpose of processing and, where applicable, the relevant statutory retention period (for example retention periods under commercial and tax law).

If we process personal data on the basis of express consent under Art. 6(1)(a) GDPR, we store it until the data subject withdraws consent.

Where statutory retention periods apply to data processed in the context of legal or quasi-legal obligations on the basis of Art. 6(1)(b) GDPR, we routinely delete this data after the retention periods expire, provided it is no longer required to perform or initiate a contract and/or we no longer have a legitimate interest in storing it.

If we process personal data on the basis of Art. 6(1)(f) GDPR, we store it until the data subject exercises the right to object under Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.

If we process personal data for direct marketing on the basis of Art. 6(1)(f) GDPR, we store it until the data subject exercises the right to object under Art. 21(2) GDPR.

Unless the other information in this policy on specific processing operations states otherwise, we delete stored personal data once it is no longer required for the purposes for which it was collected or otherwise processed.