The following information details the collection of personal data when using our website. Personal data refers to any data that can be personally linked to you, such as your name, address, email addresses, or user behavior.

I. Name and Address of the Responsible Party

Mark Hellbusch
Wagemannstr. 2
65183 Wiesbaden
Phone:0176 21916227

Email: markhellbusch@web.de

II. Name and Address of the Data Protection Officer

The legal requirements for the obligation to appoint a data protection officer do not apply.

For any concerns regarding data protection, please contact info@littlevangogh.de.

III. General Information on Data Processing

1. Purpose and Scope of Processing Personal Data

We collect and use personal data of our users based on legal regulations, to the extent necessary to provide and maintain the functions, content, and services of the website. When using special services, such as a contact form, the collection and use of personal data of our users occurs with the user's consent.

2. Legal Basis for Processing Personal Data

The legal basis for processing personal data is, with the consent of the affected person, Art. 6 para. 1 lit. a GDPR. For the processing of personal data for the fulfillment of a contract, Art. 6 para. 1 lit. b GDPR applies. For the processing of personal data to fulfill a legal obligation, Art. 6 para. 1 lit. c GDPR applies. In cases where vital interests of the affected person or another natural person make it necessary to process personal data, Art. 6 para. 1 lit. d GDPR applies.

3. Data Deletion and Storage Duration

Personal data of the affected person will be deleted or blocked as soon as the purpose or legal obligation for storage ceases to apply. Further storage may occur if legal provisions allow for it.

4. Encrypted Transmission

This website uses SSL encryption (Secure Socket Layer) in conjunction with the highest encryption level supported by your browser, typically 256-bit encryption, for security reasons and to protect the transmission of personal data, such as inquiries you send to us as the site operator. If your browser does not support 256-bit encryption, we will use 128-bit v3 technology instead.

IV. Provision of the Website and Creation of Log Files

1. Description and Scope of Data Processing

When you visit our website for informational purposes only, i.e., without registering or otherwise transmitting information to us, our system automatically collects personal data and information that your computer system transmits to our server. When you view our website, we collect the following data, which is technically necessary for us to display the website and ensure its stability and security:

(1) Information about the browser software, its language, and the version used
(2) The user's operating system and interface
(3) The user's IP address
(4) Date and time of access
(5) Content of the request (specific page)
(6) Access status/http status code
(7) Websites from which the user's system accessed our website

This data is also stored in the log files of our system. This data is not stored together with other personal data of the user.

2. Legal Basis for Data Processing

The legal basis for the temporary storage of data is Art. 6 para. 1 lit. f GDPR.

3. Purpose of Data Processing

The temporary storage of the IP address by the system is necessary to deliver the website to the user's computer. For this purpose, the user's IP address must be stored for the duration of the session.

Storage in log files is done to ensure the functionality of the website. Additionally, the data helps us optimize the website and ensure the security of our information technology systems. The data is not evaluated for marketing purposes in this context.

These purposes also constitute our legitimate interest in data processing according to Art. 6 Para. 1 lit. f GDPR.

4. Duration of Storage

The data will be deleted as soon as it is no longer necessary for achieving the purpose for which it was collected. In the case of data collection for providing the website, this is the case when the respective session is ended.

In the case of data storage in log files, this is the case after no more than seven days. Further storage is possible. In this case, the IP addresses of the users are deleted or anonymized so that it is no longer possible to assign the calling client.

5. Objection and Removal Option

An objection to the collection and processing of personal data is only possible for voluntary information provided within the scope of consent, but not for data in log files that are absolutely necessary for the operation of the website.

V. Use of Cookies

1. Description and Scope of Data Processing

Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's terminal device (PC, laptop, tablet, smartphone, etc.). When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string that enables the browser to be uniquely identified when the website is accessed again. Cookies do not cause any damage to your terminal device, do not contain viruses, trojans, or other malware. The cookie stores information that is related to the specific device used. However, this does not mean that we immediately become aware of your identity.

We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser can be identified even after a page change. The following data is stored and transmitted in the cookies:

(1) Session ID
(2) Acceptance of the cookie notice

Additionally, cookies from Google Analytics are used to analyze visitor behavior, for more information see IX 1. a).

2. Legal Basis for Data Processing

The legal basis for the processing of personal data is Art. 6 Para. 1 lit. f GDPR.

3. Purpose of Data Processing

The use of cookies aims to make the use of websites easier for users. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized even after a page change.

We need cookies for the following applications:

(1) To provide a shopping cart function
(2) To prevent/detect misuse of the website
(3) To provide a customer account
(4) Cookie notice banner
(5) Wishlist

The user data collected by technically necessary cookies is not used to create user profiles. These purposes also constitute our legitimate interest in processing personal data according to Art. 6 Para. 1 lit. f GDPR.

4. Duration of Storage, Objection, and Removal Option

Cookies are stored on the user's computer and transmitted to our site by it. Therefore, you as the user also have full control over the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may not be possible to use all the functions of the website to their full extent.

VI. Contact Form and Email Contact

1. Description and Scope of Data Processing

 

At the time of sending the message, the following data is also stored:

(1) IP address
(2) Date and time of sending the form

For the processing of the data, your consent is obtained during the sending process and reference is made to this privacy policy.

Alternatively, it is possible to contact us via the provided email address. In this case, the user's personal data transmitted with the email will be stored.

In this context, the data is not passed on to third parties. The data is used exclusively for processing the conversation.

2. Legal Basis for Data Processing

The legal basis for processing the data is Art. 6 Para. 1 lit. a GDPR if the user has given consent. The legal basis for processing data transmitted in the course of sending an email is Art. 6 Para. 1 lit. f GDPR.

If the email contact aims to conclude a contract, the additional legal basis for processing is Art. 6 Para. 1 lit. b GDPR.

3. Purpose of Data Processing

The processing of personal data from the input mask serves us solely to process the contact. In the case of contact via email, this also constitutes the necessary legitimate interest in processing the data.
The other personal data processed during the sending process is used to prevent misuse of the contact form and to ensure the security of our information technology systems.

4. Duration of Storage

The data will be deleted as soon as it is no longer necessary for achieving the purpose for which it was collected. For personal data from the input mask of the contact form and those sent by email, this is the case when the respective conversation with the user has ended. The conversation is considered ended when it can be inferred from the circumstances that the relevant facts have been conclusively clarified.

The additional personal data collected during the sending process will be deleted no later than seven days.

5. Objection and Removal Option

The user has the right to revoke their consent to the processing of personal data at any time. If the user contacts us via email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. If the objection concerns optional personal data that is not marked as mandatory in the contact forms, the conversation may be continued under certain circumstances.

To revoke the processing of personal data transmitted via contact form or email, simply send an informal email to info@littlevangogh.de.

All personal data stored in the course of contacting us will be deleted in this case.

VII. Ordering Process

1. Description and Scope of Data Processing

You can order items on our website. If a user takes advantage of this option, the data entered in the input mask will be transmitted to us and stored. This data includes:

• Salutation, First Name, Last Name, Company, Email, Street, House Number, Address Addition, Postal Code, City, Country, Phone, Fax
• Optionally, if a different delivery address is entered: Salutation, First Name, Last Name, Company, Email, Street, House Number, Address Addition, Postal Code, City, Country, Phone, Fax

During the ordering process, we collect the shipping method and payment method you selected. Depending on the payment method chosen, your data will be transmitted to payment providers for the purpose of processing the payment. More detailed information can be found in section IX. 2.

As part of the ordering process, you can voluntarily create a customer account, through which we can store your data for future purchases. When a customer account is created, the data you provide will be stored revocably.

2. Legal Basis for Data Processing

The processing of the data is necessary for the completion of the contract, and therefore, Art. 6 para. 1 lit. b GDPR serves as the legal basis for data processing. For the entry of voluntary information, consent is given, and thus Art. 6 para. 1 lit. a GDPR serves as the legal basis.

3. Purpose of Data Processing

The processing of personal data in the ordering process serves to:
• Identify you as a customer
• Process your order
• Contact you, for example, regarding inquiries, clarification of discrepancies, or other information about your order
• Issue invoices
• Address any warranty and liability issues and assert any claims against you
• Manage our customer data.

4. Duration of Storage

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. For personal data from the ordering process, this is the case when the respective contract has been fulfilled and there are no legal retention obligations preventing deletion.

5. Objection and Removal Option

The user has the right to revoke their consent to the processing of personal data at any time. In such a case, the contract cannot be fulfilled.

To revoke the processing of personal data transmitted during the ordering process, simply send an informal email to info@littlevangogh.de.

All personal data stored during the ordering process will be deleted in this case.

VIII. Analysis & Payment Tools

1. Tracking Tools

The tracking measures listed below and used by us are carried out based on Art. 6 para. 1 sentence 1 lit. f GDPR. With the tracking measures we use, we aim to ensure a needs-based design and the continuous optimization of our website. Additionally, we use tracking measures to statistically record the use of our website and evaluate it for the purpose of optimizing our offerings for you. These interests are considered legitimate within the meaning of the aforementioned provision.

The specific data processing purposes and data categories can be found in the corresponding tracking tools.

a) Google Analytics

For the purpose of needs-based design and continuous optimization of our pages, we use Google Analytics, a web analytics service provided by Google Inc. (https://www.google.com/intl/en/about/ ) (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; hereinafter referred to as “Google”). In this context, pseudonymized usage profiles are created and cookies (see section V.) are used. The information generated by the cookie about your use of this website, such as
• Browser type/version,
• Operating system used,
• Referrer URL (the previously visited page),
• Hostname of the accessing computer (IP address),
• Time of the server request,
is transmitted to a Google server in the USA and stored there. The information is used to evaluate the use of the website, compile reports on website activities, and provide other services related to website and internet usage for market research and needs-based design of these internet pages. This information may also be transferred to third parties if required by law or if third parties process this data on behalf of Google. Under no circumstances will your IP address be merged with other data from Google. The IP addresses are anonymized so that an assignment is not possible (IP masking).

You can prevent the installation of cookies by adjusting the settings of your browser software accordingly; however, we would like to point out that in this case, not all functions of this website may be fully usable.

You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) and the processing of this data by Google by downloading and installing a browser add-on (https://tools.google.com/dlpage/gaoptout?hl=en).

As an alternative to the browser add-on, especially for browsers on mobile devices, you can also prevent data collection by Google Analytics,by clicking on this linkAn opt-out cookie will be set to prevent the future collection of your data when visiting this website. The opt-out cookie is only valid in this browser and only for our website, and it will be stored on your device. If you delete the cookies in this browser, you will need to set the opt-out cookie again.

For more information on data protection in connection with Google Analytics, please refer to the Google Analytics Help (https://support.google.com/analytics/answer/6004245?hl=en).

2. Payment Methods

The payment tools listed below and used by us are employed on the basis of Article 6(1)(b) of the GDPR. With the help of these tools, we fulfill a contract or carry out pre-contractual measures.

The specific purposes of data processing and data categories are listed below.

a) PayPal

When paying via PayPal, credit card through PayPal, direct debit through PayPal, or – if offered – purchase on account through PayPal, we transmit your payment data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter referred to as "PayPal").

The transmission is carried out in accordance with Article 6(1)(b) of the GDPR for the purpose of fulfilling the contract.

PayPal reserves the right to conduct a credit check for payment methods such as credit card via PayPal, direct debit via PayPal, or – if offered – purchase on account via PayPal. For this purpose, your payment data may be forwarded to credit agencies in accordance with Art. 6 para. 1 lit. f GDPR based on PayPal's legitimate interest in determining your creditworthiness.

The result of the credit check regarding the statistical probability of default is used by PayPal to decide on providing the respective payment method. The credit report may contain probability values (so-called score values). For more information on data protection, including the credit agencies used, please refer to PayPal's Privacy Policy.https://www.paypal.com/us/webapps/mpp/ua/privacy-full

You can object to this processing of your data at any time by sending a message to PayPal. In some cases, the completed payment contract may then not be fulfilled.

IX. Tools / Other Data Privacy Technologies

1. YouTube (Embedded Videos)

This website uses YouTube's embedding feature to play and display videos uploaded to the YouTube platform. The provider YouTube is part of Google LLC., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

The embedding is done in the so-called 'Enhanced Privacy Mode,' which, according to the provider, only processes personal data once the user has started playing the video.

When playback is started by the user, YouTube collects information, according to its own statements, to gather video statistics, improve user-friendliness, and prevent misuse of features. If the user is logged into their Google account within the browser, the data collected by YouTube is associated with their account. To prevent this, the user should log out of their account before starting playback of embedded YouTube videos. YouTube uses cookies to process, among other things, the mentioned data.

The data is stored and analyzed by Google (even if the user is not logged in) as usage profiles. The legal basis for such analysis is Art. 6 para. 1 lit. f GDPR, based on Google's legitimate interests in tailoring its content, market research, and/or displaying personalized advertising. The user has the right to object to the creation of these usage profiles. This right must be exercised directly with YouTube.

Google LLC, based in the USA, is certified under the US-European Privacy Shield agreement, which ensures compliance with the data protection standards applicable in the EU.

For more information on data protection at YouTube, please refer to the provider's privacy policy at:https://www.google.com/intl/en/policies/privacy

2. Google reCAPTCHA

This website uses the reCAPTCHA function from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). This function helps distinguish between abusive entries made through automated or machine processing (often used to create spam entries via contact forms) and those made by natural persons. The reCAPTCHA function is used in the website's contact forms.

When using the function, the user's IP address and potentially other data required by Google for the service will be transmitted to Google.

The legal basis is Art. 6 para. 1 lit. 1 GDPR due to the legitimate interest of the website operator in preventing misuse of the contact forms.

Google LLC, based in the USA, is certified under the US-European Privacy Shield agreement, which ensures compliance with the data protection standards applicable in the EU.

For more information about Google reCAPTCHA and Google's privacy policy, please visit: https://www.google.com/intl/en/policies/privacy/

X. Rights of the Data Subject

If your personal data is being processed, you are considered an affected individual under the GDPR, and you have the following rights against the data controller. For questions regarding data protection, and especially concerning your rights as an affected individual, please contact info@littlevangogh.de.

1. Right to Information (Art. 15 GDPR)

You have the right to request confirmation from the responsible party as to whether personal data concerning you is being processed by us.

If such processing occurs, you can request the following information from the controller about your personal data processed by us in accordance with Art. 15 GDPR.

2. Right to Rectification (§ 16 GDPR)

You have the right, in accordance with Article 16 of the GDPR, to request the immediate correction of inaccurate personal data or the completion of incomplete personal data stored with us.

3. Right to Restrict Processing (Art. 18 GDPR)

Under the conditions of Art. 18 GDPR, you can request the restriction of the processing of your personal data.

If the restriction of processing has been limited according to the aforementioned conditions, you will be informed by the responsible party before the restriction is lifted.

4. Right to Erasure (Art. 17 GDPR)

In accordance with Article 17 of the GDPR, you can request the deletion of your personal data stored with us.

5. Right to Inform Third Parties

If you have exercised your right to rectification, deletion, or restriction of processing towards the responsible party, they are obligated to inform all recipients to whom your personal data has been disclosed of this rectification, deletion, or restriction of processing, unless this proves impossible or involves disproportionate effort. You also have the right to be informed about these recipients.

6. Right to Data Portability

In accordance with Article 20 of the GDPR, you have the right to receive your personal data, which you have provided to us, in a structured, commonly used, and machine-readable format, or to request the transfer of this data to another controller.

7. Right to Object

If your personal data is processed based on legitimate interests according to Art. 6(1)(f) GDPR, you have the right to object to the processing of your personal data according to Art. 21 GDPR, provided there are reasons arising from your particular situation or if the objection is directed against direct marketing. In the latter case, you have a general right to object, which we will implement without the need for a particular situation. If you wish to exercise your right of withdrawal or objection, an email to info@littlevangogh.de is sufficient.

8. Right to Withdraw Consent for Data Protection

You have the right to revoke your data privacy consent at any time. Revoking consent does not affect the legality of the processing carried out based on the consent until the revocation.

9. Automated Individual Decision-Making, Including Profiling

You have the right not to be subject to a decision based solely on automated processing – including profiling – that produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision (1) is necessary for entering into, or the performance of, a contract between you and the controller, (2) is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or (3) is based on your explicit consent. However, these decisions must not be based on special categories of personal data as referred to in Article 9(1) of the GDPR, unless Article 9(2)(a) or (g) applies and suitable measures to safeguard the rights and freedoms and your legitimate interests are in place. In the cases referred to in (1) and (3), the controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, which include at least the right to obtain human intervention on the part of the controller, to express your point of view, and to contest the decision.

10. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your residence, place of work, or the place of the alleged infringement, if you believe that the processing of your personal data violates the GDPR. The supervisory authority with which the complaint was lodged will inform the complainant about the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

Created on 12/12/2018