SUPPLEMENTARY PRIVACY POLICY
Café Royal / CoffeeB

1. What is this privacy policy about?

Group. The processing of personal data in connection with Café Royal and CoffeeB is subject to the Migros Group's general privacy policy, which you can read here: www.migros.ch/de/datenschutz.

This supplementary privacy policy contains further information on data processing in connection with Café Royal or CoffeeB. It applies in addition to the general privacy policy.

2. Who is the controller responsible for data processing?

The following company ("we" or "us") is the Controller usually responsible for the data processing in connection with Café Royal or CoffeeB:

Delica AG
Hafenstrasse 120
CH-4127 Birsfelden
Telefon: +41 800 506 506 (Switzerland)
E-mail: info@cafe-royal.com

In certain cases, another company in the Migros Group may also be a controller responsible for data processing alone or co-responsible jointly with us.

If you have any questions regarding the processing of your personal data in connection with Café Royal or CoffeeB or would like to exercise one of your rights under data protection law, please contact us as follows:

Please contact the Data Protection Officer of the Controller here:

Datenschutz Café Royal / CoffeeB
E-mail: datenschutz-caferoyal@delica.com

The EU/EEA Representative of the Controller can be reached at:

Delica Deutschland GmbH
Königsallee 63-65
40215 Düsseldorf, Germany
E-mail: datenschutz-caferoyal@delica.com

3. What personal data do we process?

In connection with Café Royal or CoffeeB, we process the following personal data in particular:

Randomly generated user IDs
Technical personal data (e.g. IP address)
Master data (title, first name, last name, ...)
Communication data (e-mail address, telephone number, ...)
Address data (shipping, billing, delivery address, ...)
Transaction and payment data (account details, payment type, ...)
Behavioural data (browsing behaviour, ...)
Individual privacy settings and consent

Further information as well as a detailed list of the personal data per processing purpose can be found in our statements in section 5.

We may also process further master data, contract data, communication data, behavioural and transaction data, preference data, technical data, image and sound recordings and other categories of personal data. For further details, please refer to section 4 of the general privacy policy.

4. For what purposes do we process personal data?

In connection with Café Royal or CoffeeB, we process personal data for the following purposes in particular:

Providing a consent management platform (CMP)
Providing the website and generating log files
Providing the DELIZIO online shop including its functions
Managing purchases
Sending transactional e-mails
Communicating with customers and business partners
Conducting customer satisfaction surveys
Providing vouchers
Providing and implementing competitions and campaigns
Sending notifications
If necessary, contacting customers
Statistically evaluating the website and the web shop
Marketing the website and the web shop
Integrating social media content
Evaluating performance, retargeting and remarketing

A detailed list of the purposes for each instance of processing can be found in our statements under section 5.

We may also process personal data for further purposes associated with communication, contract processing, information and marketing, market research and product development, security and prevention, compliance with legal requirements, legal compliance as well as internal administration and support within the group. For further details, please refer to section 5 of the general privacy policy.

5. Data processing in detail

I. General information on data processing

1. Scope of personal data processing

We process personal data (hereinafter also "data") of visitors to the website insofar as this is necessary to provide a functional website as well as our content and the services of our shop.

Personal data of the visitors of our website are, as a rule, only processed after obtaining the user's consent to the processing and to the purchase and order process. An exception is made in those cases in which processing of the data is permitted by legal regulations or is technically necessary.

You as a visitor have access to our content management platform ("CMP" for short), which you can control via our cookie banner (see section "II. Privacy settings via Usercentrics") and which gives you the option to decide for yourself whether or not you want to give consent to the collection and processing of your personal data through the use of technical measures. In our CMP, we disclose what technical measures are involved and who will receive your data. Please note that certain data processing operations are necessary to establish and guarantee the security of our website as well as technically necessary for other individual data processing procedures, making consent to this data processing impossible.

Providing your data is not required by law but is required to create an account and for ordering and delivery of the goods and services. Without the data necessary to handle orders, we cannot carry out the order you have placed in the shop. By marking the mandatory fields as such, we advise you of which data are absolutely necessary for handling the order procedure, creating an account, subscribing to our newsletter or participating in a competition.

2. Data erasure and storage period

The personal data of the data subject will be erased or blocked as soon as the purpose for the storage no longer applies. They may also be stored if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the Controller is subject. Data will also be blocked from further data processing or erased after a legally prescribed storage period has expired, unless it is necessary to store the data further to fulfil the contract.

II. Privacy settings via Usercentrics

1. Description and scope of data processing

The website uses the services of Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany (hereinafter referred to as "Usercentrics") for the provision of a consent management platform (CMP) or cookie banner, i.e. a system that regulates the use of third-party providers, technical measures as well as cookies via granted or rejected consent.

The CMP ensures that no measures are set or carried out without previously granted consent that are subject to a consent requirement. Usercentrics processes the following data for the provision and management of the CMP:

(1) Your IP address, which is anonymised when collected by Usercentrics, as well as further information on the end device used,
(2) Date and time of your visit to our website or time of consent,
(3) Information on the browser used and the browser version,
(4) Information on the website accessed (Refferer URL)
(5) your given consents or individual data protection settings (opt-in and opt-out data, banner language, template version, consent type) incl. a randomly selected anonymous ID (Consent ID)

and uses both the local memory (also called local storage) on your end device and the setting of cookies to store this information locally in your browser. The data is also stored on cloud servers hosted by Usercentrics in the European Union (Frankfurt am Main and Brussels). The retention period is the period during which the data processed by the CMP is stored for the purpose of consent management. The consent data (consent given and withdrawal of consent) is kept for three years. Within this period, no new consent is required, unless new systems are introduced or a new consent is required due to legal or regulatory frameworks.

Further information on data processing by Usercentrics can be found in the Usercentrics data protection declaration at https://usercentrics.com/privacy-policy/.

2. Legal basis and purpose of data processing

The purpose of the data processing by Usercentrics is the provision and management of the consents granted by our website visitors in order to comply with data protection-compliant consent management. The use of User-centrics serves the purpose of providing evidence of granted and non-granted consents as well as the management of the individual data protection settings of our website visitors. The processing is carried out for the purpose of obtaining the consent of the website visitor, providing revocation and objection options, providing evidence of the consent received (time of consent, end device used) as well as for identifying the user for the management of his individual data protection settings.

The use of a consent management platform as well as the management and storage of your consent to the processing of your personal data is based on our legal obligation to provide a data protection-compliant website. The legal basis for the use of the service provider Usercentrics is also the protection of our legitimate interest. Our legitimate interest lies in the legally secure documentation and verifiability of consent as well as the control of our analysis campaigns on the basis of your consent through the use of specialised processors and the associated technical implementation.

3. Possibility of objection and elimination

The processing of data for the provision of a CMP solution is absolutely necessary for the operation of the website. There is no possibility for the user to object as long as we are legally obliged to obtain the user's consent to certain data processing operations.

III. Provision of the website and generation of log files

1. Description and scope of data processing

In the case of a mere informational use of the website / our shop, we only collect the personal data that your browser transmits to our server or provider and which are technically necessary for the purpose of being able to display our website to you and to guarantee its stability and security.

We have commissioned Delica Deutschland GmbH, Königsallee 62-65, 40215 Düsseldorf, Germany (hereinafter referred to as "MID"), with the hosting and the technical provision and support of our website. MID guarantees the necessary protection of your data in accordance with the applicable data protection regulations on our behalf and processes them exclusively in accordance with our instructions.

The following data in log files are processed:

(1) The type of browser used and the version of the browser (if you have agreed to a transmission in your browser settings),
(2) The operating system,
(3) Date and time of the server request,
(4) The number of visits,
(5) The time you have spent on the website,
(6) The previously visited website (if you have agreed to a transmission in your browser settings),
(7) The IP address of the users.

The data are hosted on certified Google Cloud servers of the Google Cloud Platform, a service offered by Google LLC, 1600 Amphitheater Parkway Mountain View, CA 94043, USA (hereinafter referred to as "Google"). They are hosted in the Google Cloud in Germany, specifically in the region of Frankfurt. Please note that Google uses a multi-tenant environment to replicate data between multiple geographically dispersed data centres. The log files mentioned herein are transmitted to countries outside the EU only in the context of hosting the website. The legal basis for this are the EU standard contractual clauses provided by Google in the context of hosting (see https://cloud.google.com/security/gdpr/resource-center/contracts-and-terms?hl=de).

We use this information collected from the user and their terminal device exclusively for the purpose set forth in this privacy policy and to optimise the service. The data will not be used for any further purpose and will not be disclosed to third parties without authorisation. We do not store these data together with other personal data about you.

2. Legal basis for data processing

The legal basis for the temporary storage of data and log files is the safeguarding of our legitimate interest.

3. Purpose of data processing

Temporary storage of the IP address by the system is necessary in order to enable delivery of the website to the terminal device used by the user. For this purpose, the IP address of the user must be stored for the duration of the session.

All the above-mentioned information ((1) - (7)) in log files is stored in order to ensure the functionality of the website. In addition, we use the data to optimise the website and to ensure the necessary security of our information technology systems. The data are not evaluated for marketing purposes.

4. Storage period

The IP addresses of the users are anonymised as soon as they are no longer necessary for the purpose of their collection. This is the case at the end of the respective session of the user. It is then no longer possible to allocate them to the client accessing the website.

The log files are stored for the purposes listed above for a maximum of 30 days.

5. Objection and removal options

Collecting data for the purpose of making available the website and storing the data in log files is absolutely necessary to operate the website. The user has no option to object to collection and storage of such data.

IV. Use of cookies

1. Description and scope of data processing

Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's computer system. Once a user accesses a website, a cookie can be stored on the user's terminal device. This cookie contains a characteristic string of characters that allows a unique identification of the browser when the website is revisited. Some of the cookies we use are erased at the end of the browser session, i.e. after closing your browser (these are known as "session cookies"). Other cookies will remain on your device and allow us to recognise your browser on your next visit.

When accessing our website, we advise users by means of an information banner (see section "II. Privacy settings via ACRIS") of the use of cookies (essential or technically necessary cookies as well as statistical and marketing cookies) and have set up a technical collection of the consent for setting the cookies for which consent is required. Except for the essential or technically necessary cookies, consent must always be given in advance to place and store cookies on your terminal device. The same applies to other technical measures, such as the use of Google Analytics on our website. The info banner also refers the user to this privacy policy.

In the following we provide you with an overview of the cookies used, their term of validity and the relevant objection/opt-out possibilities. In addition, please note that you can edit your cookie settings at any time and withdraw your consent at any time for the future.

(a) Essential cookies:

We use cookies to make our website and our shop more user-friendly. Some elements of our website / shop require that the accessing browser can be identified even after changing to a new page.

The following essential or technically required cookies will be placed and stored on your terminal device and transmitted to us every time you access a new page:

(1) __cfduid (valid for the current session),
(2) _cfduid (valid for the current session),
(3) __cflb (valid for the current session),
(4) _cf_bm (valid for the current session),
(5) csrf.* (valid for the current session),
(6) session-.* (valid for the current session),
(7) timezone (valid for the current session),
(8) sw-states (valid for 1 year),
(9) sw-cache-hash (valid for 1 year),
(10) sw-currency (valid for 1 year),
(11) cookie-preference (valid for 30 days),
(12) usercentrics (valid for 3 years),
(13) JSESSIONID (valid for the current session),
(14) captcha.basic-captcha.validate (valid for the current session),
(15) wishlist-enabled (valid for 1 year),
(16) bc.visitor_token (valid for 10 months).

Technically required, also called essential, cookies support the smooth operation of your visit to our website as well as the shop. This includes making available our website via our hosting service provider (see (1) - (4)), using the shop as a registered customer, making available the login area, providing your shopping cart, ensuring page navigation and payment methods (see (5) - (10) and (13) - (14)) as well as the help tool and the possibility of contacting someone (16) or storing your individual cookie settings (see (12) and (15)) for our website. These cookies are necessary for a secure visit to the shop and our website and cannot be deactivated.

(b) Statistical cookies:

We also use cookies to analyse the browsing behaviour of our users.

Thus, further information of the following categories is transmitted via the data specified in (a) Essential cookies:

(1) Keywords entered
(2) Frequency of page views
(3) Use of website function
(4) Duration of visit

The user data collected in this way is anonymised by technical means. Therefore, connecting the data to the visiting user is no longer possible. The data are not stored together with other personal data of the users.

Die auf diese Weise erhobenen Daten der Nutzer werden durch technische Vorkehrungen anonymisiert. Daher ist eine Zuordnung der Daten zum aufrufenden Nutzer nicht mehr möglich. Die Daten werden nicht gemeinsam mit sonstigen Personendaten der Nutzer gespeichert.

The statistical cookies are used to improve the quality of our website as well as our shops and their content. Through the statistical cookies, we learn how the website is used and can thus continuously optimise our offer. For a description of the technical measures used, the cookies placed, the mode of operation, the purpose and the options of objection, please refer to the statements on the individual analysis tool under "III. Website analysis services".

(c) Marketing cookies:

In addition, third-party cookies are placed through the use of advertising and marketing services. These cookies are used to display advertisements on third-party sites and social media platforms that might be of interest to you based on your browsing behaviour. Third-party advertisers may combine the information gathered on our site with existing information to display personalised and interest-based ads to you.

We use technical measures for conversion tracking and remarketing such as Google Ads, Exactag and Facebook Pixel for our advertising and marketing services. With the help of the technical measures, we evaluate cost-benefit analyses of our published ads and optimise our ad placement. These measures also have the purpose of interacting with other websites and social media platforms. For a description of the cookies and technologies as well as the functionality, the purpose and the options to object, please refer to the statements under "VII.2 Newsletter (Emarsys) and tracking", "IX. Advertising and marketing services for promotions & retargeting" as well as "X. Social media".

2. Legal basis for data processing

The legal basis for processing personal data using technically required cookies (cf. (a)) is the safeguarding of our legitimate interest.

The legal basis for processing personal data using cookies for statistical or marketing purposes or for personalisation (cf. (b) - (c)) is your consent given via the cookie banner.

3. Purpose of data processing

The purpose of using essential or technically required cookies is to enable you to use our websites and our shop . Some features of our website/shop cannot be offered without the use of cookies. These features require that the browser be identified even after changing pages. The user data collected by essential or technically required cookies are not used to create user profiles.

For the statements on the purpose and the options of objection to cookies for statistical or marketing purposes (see (b) - (c)), please refer to the statements under "VIII. Website analysis services" as well as the statements under "VII.2 Newsletter (Emarsys) and tracking", "IX. Advertising and marketing services for promotions & retargeting" and "X. Social media".

4. Duration of storage, options of objection and removal

Cookies are stored on the user's computer and transmitted from it to our site. Therefore, you as the user also have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the relevant settings in your internet browser. Cookies already placed on your device can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, not all features of the website or the shop may be used in full.

You can change your settings for the use of cookies made via our cookie banner at any time here: Cookie settings. Removing the "active" check mark in the sliders will deactivate the respective cookies or technical measures.

V. Use of the Café Royal or CoffeeB shop

In order to make our shop and the products offered for sale available to you so that you can make purchases in our shop, personal data must be processed. You may place orders in our shop with or without a user account. The scope of processing of personal data depends on which option you select for orders. We use service providers for the technical provision of our shop system and to accept various payment options. Frequently, personal data are passed on to our service providers or automatically evaluated. The following lists and explains the nature, scope and purpose of such processing of personal data:

V.1 Shop system (Shopware) & data management platform (SIDIS)

We use the company Shopware AG, Ebbinghoff 10, 48624 Schöppingen, Germany (hereinafter referred to as "Shopware"), to make our shop available. We have concluded a data processing agreement with Shopware as required under applicable data protection law. Therein, Shopware undertakes to protect the data of our users and to process them exclusively on our behalf in accordance with the applicable data protection regulations.

We use the service of the company Nemobile Applications Worldwirde, Unipessoal LDA, Avenida Manuel Violas, 476, s 21.2 4410-137 S. Félix da Marinha, Vila Nova de Gaia, Portugal (hereinafter referred to as "SIDIS") to provide the data management platform SIDIS. SDIS has entered into the data processing agreement required under data protection law with us. Therein, SIDIS undertakes to protect the data of our users and to process them exclusively on our behalf in accordance with the applicable data protection regulations.

V.2 Registration of a customer account and login

1. Description and scope of data processing

You can either create a customer account or place an order as a guest to make a purchase in the shop. If you are able to register for a Migros account or log into the CoffeeB shop with a Migros account in your country (Switzerland), please refer to our statements under V.3 Registration of a Migros account and login.

Your customer account should facilitate later orders by automatically filling in the information you provided while setting up the customer account when placing an order at a later time. The information saved in the customer account is stored in the central customer database. The data will be saved in our customer database only if you request this by clicking on "Register" when registering as a new customer or by creating a customer account during the order process. In addition, we offer you further services with the customer account, e.g. displaying your purchase history and managing your invoice and delivery addresses. You can view, update, add or erase the information in your customer account at any time.

Creating your personal account requires a one-time registration with the personal data described below. Once you have registered an account, we collect, process and use the data provided by you to provide your customer account and the associated services exclusively:

(1) Your address*,
(2) Your first* and last name*,
(3) Your e-mail address*,
(4) Your password*,
Your address (street*, house number*, address addition, postal code*, town*, country*),
(6) If applicable, a different delivery address.

Mandatory information (*) and optional information are indicated in the registration form.

You will receive an automated welcome email after registering successfully. You may then log in at any time using your e-mail address and the assigned password. Once you have logged in, you have the option of changing your password and further profile information under “Profile” at any time.

2. Legal basis for data processing

The legal basis for the processing of the data collected and processed by us in the context of the provision and management of your customer account is the rendering of the service owed under the concluded usage agreement.

3. Purpose of the data agreement

We process the personal data exclusively for setting up and providing a customer account or for providing our online shop for our customers in accordance with the valid terms of use.

4. Duration of storage and removal

Your data are stored on Shopware servers hosted in Germany. The password is stored in a protected area and secured using a cryptographic method before being stored.

If you do not provide us with your personal data, in particular the data necessary for setting up your customer profile, we will not be able to offer you this service or the features.

The data will be erased as soon as they are no longer necessary for the purpose of their collection. For personal data, this is the case if you object to the processing and request erasure of your data.

You can delete your account at any time using the function under "Profile". Alternatively, it is possible to request the deletion of the assigned customer account using the contact data under points I and II.

V.3 Registration of a Migros account and login

You can create a Migros account or use your existing Migros account in the CoffeeB shop and when registering your CoffeeB coffee machine. The Migros account is the central user account for Migros customers of the Migros-Genossenschafts-Bund, Limmatstrasse 152, 8005 Zurich, Switzerland (hereinafter "Migros"). It grants users access to services of companies of the Migros Group and partner companies as well as to bonus programmes (cumulus), online offers, competitions and online communities. This privacy policy does not include registering to your Migros account at https://login.migros.ch/register or logging in with your Migros account at https://login.migros.ch/login. Migros attaches great importance to the protection of your privacy and that of your personal data as well as the necessary data security and has established the necessary data protection measures.

Please note that by following the link to the Migros account, you will leave our website, and cookies as well as tracking technologies may be used.

For further information on data processing within the scope of your Migros account, please refer to the separate privacy policy at https://privacy.migros.ch/de.html and its general terms of use at https://login.migros.ch/legal/MIGROS_ACCOUNT_0_3 .

V.4 Processing of data within the scope of a purchase transaction

1. Description and scope of data processing

We process your personal data on the basis of the orders you have placed in the shop and to process the purchase contract you have entered into, as well as for delivering your order and for invoicing.

If you use our services, i.e. order a product in the shop, we process the data you provide in the shop solely in connection with your shopping and payment behaviour. This includes the following data:

(1) Your address*,
(2) Your first* and last name*,
(3) Your e-mail address*,
(4) Your password (if a customer account was created),
(5) Your billing and, if applicable, delivery address (street*, house number*, additional address information, postal code*, town*, country*),
(6) Account information (depending on the chosen payment method).

Mandatory information (*) and optional information are indicated in the order form.

In connection with the concluded purchase contract and your payment method, we may also check your creditworthiness or pass on the specified data to our logistics and payment service providers for the payment or the dispatch of your ordered goods (see also "VIII.5 Use of logistics and payment service providers").

If you are already logged in with your existing customer account when ordering, the data ((1) - (5)) listed above are not required, and we will forward you directly to the order overview or subsequently to the payment process.

Following your order, you will receive an order confirmation sent by the system to the e-mail address provided with the order. For more information about our system e-mails, please refer to section "V.7 Sending transaction e-mails using Mailgun".

2. Legal basis for data processing

The legal basis for processing the provided data is the contractual relationship within the scope of the purchase contract. This includes delivery of the goods to the recipient you have specified.

3. Purpose of the data agreement

We process your personal data exclusively for the purpose of initiating and processing the purchase contract: The aforementioned data are processed in order to enter into the sales contract with you and to be able to process the contractually received service obligations and to be able to deliver the ordered goods. This includes data processing for the purpose of shipping, delivery, payment processing, granting discounts and redeeming vouchers, status update regarding the respective order, return of goods or warranty for defects.

4. Storage period

We store your personal data only as long as it is necessary to achieve the respective storage purpose. We will then erase your data, unless we are obliged to retain them for a longer period due to tax, commercial law or other legal retention or documentation obligations. Your data together with your transaction data for the respective order are stored on Shopware servers hosted in Germany and transferred to our data management platform SIDIS.

5. Objection and removal options

You are not obliged to provide us with your personal data when you are making a purchase. However, orders and the purchase of our products are not possible without us processing personal data. In addition, please take note of the rights you have as the data subject (further information under "XI. Rights of the data subject").

V.5 Use of logistics and payment service providers

1. Description and scope of data processing

In order to fulfil your order, we transmit the personal data required for the delivery of the goods ordered by you in compliance with the applicable data protection regulations and the necessary security measures to our service provider Odoo S.A., Chaussée de Namur, 40, 1367 Grand-Rosière, Belgium (hereinafter "Odoo"). We have concluded a data processing agreement with Odoo as required under applicable data protection law. Therein, Odoo undertakes to protect the data of our users and to process them exclusively on our behalf in accordance with the applicable data protection regulations.

We transmit to our merchandise management system Odoo the data necessary for shipping, such as first and last name, address, e-mail address as well as the necessary information about the ordered goods. Odoo provides our logistics partners with the information required to carry out the delivery. Our e-commerce fulfilment centre receives the information about the goods and quantity you ordered.

The following logistics partners are currently assigned to handling shipments depending on your country:

Switzerland:
Post CH Network Ltd, Wankdorfallee 4, 3030 Bern (Swiss Post),

France:
La Poste, 9 RUE DU COLONEL PIERRE AVIA, 75015 Paris (La poste),

Germany:
DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn (DHL),

Your contact data (e.g. e-mail address) will not be forwarded to the respective logistics partner.

Depending on your chosen payment method, the data required for payment processing are sent to the respective credit institution, credit card company or PayPal (Europe) S.à.r.l. & Cie., S.C.A. or Klarna GmbH. Our service provider Adyen N.V, PO Box 10095, 1001 EB Amsterdam, Netherlands (hereinafter referred to as "Adyen") is responsible for the technical connection of the payment service providers. We have concluded a data processing agreement with Adyen as required under applicable data protection law. Therein, Adyen undertakes to protect the data of our users and to process them exclusively on our behalf in accordance with the applicable data protection regulations. We pass on the respective data to service providers commissioned by us, insofar as this is necessary for the payment transaction or delivery.

The following payment service providers or payment methods are available depending on the country and shop:

Switzerland (Café Royal and CoffeeB):
(1) Credit card (VISA, Mastercard),
(2) PayPal (eWallet),
(3) TWINT,
(4) Klarna (direct transfer or purchase on account)
(5) Google Pay
(6) Amazon Pay
(7) Apple Pay

France (Café Royal and CoffeeB):
(1) Credit card (VISA, Mastercard),
(2) PayPal (eWallet),
(3) Klarna (direct transfer or purchase on account)
(4) Google Pay
(5) Amazon Pay
(6) Apple Pay

Germany (Café Royal):
(1) Credit card (VISA, Mastercard),
(2) PayPal (eWallet),
(3) Klarna (direct transfer or purchase on account)
(4) Google Pay
(5) Amazon Pay
(6) Apple Pay

For the processing of your data by the payment service providers, please refer to their terms of use and privacy policies.

2. Legal basis for data processing

The legal basis for our transmission of data to our logistics and payment service providers is based on the fulfilment of the contractual obligation under the purchase contract.

3. Purpose of data processing and duration of storage

We store your personal data as long as this is necessary to achieve the relevant storage purpose. We will then erase your data unless we are obliged to retain them for a longer period on the basis of tax, commercial law or other legal retention or documentation obligations or if the storage purpose no longer applies but you have consented to storage going beyond this.

The personal data that are handed over to our logistics service provider Odoo for the delivery of your ordered goods will be stored on servers hosted in Switzerland by Odoo for a period of seven days.

Your data are transmitted to the respective payment provider exclusively to fulfil of our contractual obligations and are therefore subject to legal retention obligations.

V.6 Identity and creditworthiness check when choosing Klarna payment methods

1. Description and scope of data processing

The shop offers different payment options. If you are interested in one of the payment options of our partner Klarna GmbH, Theresienhöhe 12, 80339 Munich, Germany (hereinafter referred to as "Klarna"; see also https://www.klarna.com/de/), your data transferred during the ordering process for the processing of the payment and the execution of an identity and credit check will be forwarded to Klarna. If you select the payment method on account, your data (first and last name, street, house number, postal code, town, date of birth, telephone number) as well as the data associated with your order will be transmitted to Klarna and, if applicable, to the credit or financial service institution (Factor) cooperating with Klarna.

For the purpose of its own identity and credit check, Klarna or its partner companies commissioned by Klarna transmit data to credit bureaus and receive from them information and, if applicable, credit information on the basis of mathematical-statistical methods, in the calculation of which address data are included, among other things. Detailed information on this and on the credit bureaus used can be found in the privacy policy https://www.klarna.com/de/datenschutz/ of Klarna GmbH.

In addition, Klarna may use third-party tools to discover and prevent cases of fraud. Data obtained with these tools may be stored with third parties in encrypted form so that they can only be read by Klarna. These data will only be used if you select a payment type from our cooperation partner Klarna; otherwise, a system mechanism will automatically erase the data after 30 minutes.

2. Legal basis for data processing

The legal basis for the transfer of data to Klarna is based on your consent given by selecting the payment method in the ordering process and the contractual relationship within the scope of the purchase agreement.

3. Purpose of data processing and duration of storage

The transmission of your data is necessary for the execution of the purchase contract. Klarna processes your data exclusively for the purpose of its own identity and credit check. We do not store the data.

V.7 Sending transaction e-mails using Mailgun

1. Description and scope of data processing

For the technical realisation of the dispatch of system e-mails or for the e-mail communication of our shop (e.g. for the dispatch of order confirmations or for the implementation of the password reset function), we use the service of the company Mailgun Technologies Inc., 112 E Pecan St. 1135, San Antonio, TX 78205, USA (hereinafter "Mailgun"), which processes the data provided to us as a processor in compliance with the necessary measures for data security. We have concluded a contract regulating the processing relationship between our companies. Mailgun uses the data exclusively for sending our system e-mails. The data are processed exclusively on servers within the European Union.

For more information on Mailgun, visit https://www.mailgun.com/. For more information on how Mailgun handles personal data, please visit: https://www.mailgun.com/gdpr/.

2. Purpose and legal basis for data processing

Personal data are processed by us and our service provider Mailgun solely for the purpose of processing and sending our transaction e-mails. The legal basis for this data processing is the contractual relationship within the scope of the purchase contract.

3. Storage period

We store your personal data for as long as it is necessary to achieve the respective storage purpose or as long as we have your consent to the storage. We will then erase your data unless we are obliged to retain them for a longer period on the basis of tax, commercial law or other legal retention or documentation obligations or if the storage purpose no longer applies but you have consented to storage going beyond this.

4. Objection and removal options

Processing of the data is essential to process the orders. The customer has no option to object to collection and storage of such data.

VI. Registration of your CoffeeB coffee machine

1. Description and scope of data processing

We process your personal data on the basis of the product registration made by you using our CoffeeB registration form as well as for the delivery of your voucher in consideration for the registration of your CoffeeB coffee machine.

After entering the registration code and the place of purchase of the CoffeeB coffee machine, the registration process requires that you log in with your customer account or Migros account access data.

If you are able to register for a Migros account or log into the CoffeeB shop with a Migros account in your country (Switzerland), please refer to our statements under V.3 Registration of a Migros account and login.

If you are already logged in with your existing customer account or MIGROS account during the product registration, you will not have to enter your e-mail address and your password, and we will guide you directly to entry of the shipping address.

We need a shipping address for the delivery of your voucher in consideration of the registration. If you have not yet entered an address in your customer account or Migros account, you have the option to enter an address (country, postal code, city, street and house number) in your customer account or Migros account after logging in. Alternatively, you can select the desired shipping address from your already saved addresses.

After successful registration of your CoffeeB coffee machine, you will receive a confirmation e-mail sent by the system to the e-mail address provided during registration. For more information on our system e-mails, please refer to section "V.7 Sending transaction e-mails using Mailgun".

2. Purpose and legal basis for data processing

The legal basis for processing the data provided is the contractual relationship in the context of product registration. This also includes delivery of the voucher to the shipping address you have specified.

3. Purpose of the data agreement

We process your personal data exclusively for the purpose of initiating and executing the contract for product registration: We process the aforementioned data in order to be able to carry out the product registration, to fulfil the contractually undertaken service obligations and to deliver the voucher. This includes data processing for the purpose of shipping and delivery.

4. Storage period

5. Objection and removal options

You are not obliged to disclose your personal data when registering your product. However, product registration and sending the voucher is not possible without us processing personal data. In addition, please take note of the rights you have as the data subject (further information under " XI. Rights of the data subject").

VII. Communications & events

VII.1 E-mail contact, use of the help tool and contact form

1. Description and scope of data processing

You can contact us or send a complaint/request/question regarding a product by e-mail, our contact form or via our help tool on our website. In all cases, the user's personal data are transmitted to our support staff.

We use the services of TYPEFORM SL, C/Bac de Roda, 163, 08018 Barcelona, Spain (hereafter referred to as "Typeform") for the technical provision of contact forms and for collecting and transmitting the data provided by you via these forms. Typeform states that it does not store any data that would enable users to be identified. We have concluded a commissioned data processing agreement with Typeform as required by the relevant data-protection legislation. This includes the valid standard data-protection provisions. In this agreement, Typeform pledges to protect our users' data and process it exclusively on our behalf in accordance with the applicable data-protection regulations. Further information on Typeform can be found on its website: https://www.typeform.com/.

To provide you with the help tool and to receive, process and evaluate customer inquiries and to improve the support (help tool) we provide, we use tools from Freshworks, Inc., 2950 S. Delaware Street, Suite 201, San Mateo, California 94403, USA (hereinafter: "Freshdesk") and Genesys Telecommunications Laboratories, B.V., Gooimeer 6-02, 1411DD Naarden, the Netherlands (hereinafter "Genesys"). If you send us a contact request by e-mail, contact form or via our help tool, your contact request will be organised via a ticket system. Processing the contact request using a ticket system enables us to provide a high quality of service.

The servers of Freshdesk and Genesys that we use to process your request are located in the EU. However, due to the company's U.S. connection, access to the data by U.S. authorities cannot be ruled out. We concluded the agreements for processing pursuant to Art. 28 of the GDPR with the valid standard data protection clauses with Freshdesk and Genesys as required by applicable data protection law. Therein, Freshdesk and Genesys undertake to protect the data of our users and to process them exclusively on our behalf in accordance with the applicable data protection regulations. For more information about Freshdesk or Freshworks, please visit: https://www.freshworks.com/privacy/, for more information on Genesys, please visit https://www.genesys.com/company/legal/privacy-policy.

You can find information on the scope of the processed personal data, as well as which personal data are processed in individual cases, in the contact form or our help tool. In particular, the following data will be processed when you contact us:

(1) Your name*;
(2) Your communication data (e-mail address* and telephone number);
(3) Reason for contacting* / subject*;
(4) Order number, promotional code or product number;
(5) Resulting correspondence (message*);
(6) The country you are from*
(7) A screenshot or files you would like to send us

Mandatory information is indicated by "*" in the contact form.

Should you provide us with further personal data in the message field, they will be treated strictly confidentially and will only be made available to the employees who are responsible for processing your inquiry.

When lodging a complaint about a product or making product inquiry, we also process your information about our product. This is the product name, the product expiration date and the required product identifiers or order number.

Your data or the resulting correspondence are processed exclusively by us. It may be necessary to forward the data to one of our trading or product partners in order to process your request. In principle, only the data or information about the product will be forwarded. Should it be necessary for us to forward your data to the trading or product partner in individual cases, we will inform you about this in advance and, if necessary, obtain your consent. Apart from this, no data are passed on to third parties. The data will only be used for the conversation you have started to contact you via the contact options you have given us regarding your request.

2. Legal basis and purpose for data processing

The legal basis for the processing of the data transmitted in the course of providing contact and help tools or when sending an e-mail or using the contact form is your consent. If contact is made with a view to concluding a contract, this must be mentioned as the legal basis for processing.

3. Purpose of data processing

We process your personal data voluntarily provided to us by e-mail, help tool or contact form solely for the purpose of processing the contact or to resolve the complaint or request.

4. Storage period

The data will be erased as soon as they are no longer necessary for the purpose of their collection. For personal data that have been transmitted by e-mail or via our contact form, this is the case when the respective conversation with the user has ended. Your entries in our contact form will be erased from our web server after seven days. The conversation ends when it can be inferred from the circumstances that the matter in question has been settled comprehensively.

5. Objection and removal options

The user has the option to withdraw their consent to the processing of personal data at any time. If the user contacts us by e-mail or via the form, they can object to the storage of their personal data at any time. In such a case, the conversation cannot continue. The withdrawal can also be effected at any time using the contact data under I. and II. See also our statements under section " XI. Rights of the data subject". In this case, all personal data that were stored during the contact will be erased.

VII.2 Newsletter (Emarsys) and Tracking

1. Description and scope of data processing

You have the option to subscribe to one of our following newsletters on our website:

(1) Café Royal Newsletter: News about promotions and Café Royal products
(2) CoffeeB Newsletter: News and promotions about our CoffeeB brand

The personal data are processed when subscribing to the newsletter are listed in the input mask. Providing your e-mail address is required to allow us to send you the newsletter. If you do not provide us with your e-mail address, we cannot offer you this service. You also have the option of entering your first and last name, your date of birth and select the appropriate title when subscribing to the newsletter.

Subscribing to our e-mail newsletter is a double opt-in procedure, i.e. after entering your personal data, you will receive an e-mail with a confirmation link sent to the e-mail address provided to us. This confirmation e-mail is used to authorise the receipt of the newsletter by the owner of the provided e-mail address. The e-mail address will be added to the mailing list only after confirmation has been received. The following data are saved and stored: Login data, time of login, confirmation and deregistration, IP address as well as changes to the stored data. The collection of this data is necessary in order to be able to trace any abuse of the e-mail address of the data subjects and to protect the Controller.

If you have subscribed to our newsletter by clicking the button provided for this purpose and entering the required personal data, we will process these data exclusively for the purposes indicated here.

We use the service of Emarsys Interactive Services GmbH, Willi-Schwabe-Straße 1, 12489 Berlin (hereinafter referred to as "Emarsys"). We have concluded a data processing agreement with Emarsys as required under applicable data protection law. Therein, Emarsys undertakes to protect the data of our users and to process them exclusively on our behalf in accordance with the applicable data protection regulations.

For more information about Emarsys, please visit https://emarsys.com/de/. The Emarsys privacy policy can be found at https://www.emarsys.com/de/datenschutzrichtlinie/.

In order to further improve what we offer in the newsletter, data on the use and the associated interests of the recipients are collected and processed to generate statistics. For this purpose, the newsletters sent include something called web beacons. These web beacons are used to collect the following data: IP address, access location (via the IP address), request time, content of the request, access status, transferred data quantity, how often you open the e-mail or click on a link, received mailings, browsers and operating system. This information will be allocated to your e-mail address and will be linked to a separate ID. With the help of conversion tracking, it can be further analysed whether a predefined action (e.g. linking to an event) has taken place after clicking on the link in the newsletter. We use the information received from Emarsys for the statistical evaluation of our newsletters, for optimisation and further development of our newsletter content as well as for the control of personalised content in our newsletter.

To make the newsletters with personalised content appealing to you, we also use the function Webextend, an analysis technology from Emarsys. Webextend analyses your interaction with our website or our shop.

After you have given your consent via our cookie banner, we integrate functions of Emarsys into our website using Google Tag Manager and enable Emarsys to add cookies to your device (see IV. Use of cookies).

Emarsys / Scarabresearch.com placed the following marketing cookies:

(1) scarab.mayAdd (valid for 1 year),
(2) scarab.mayViewed (valid for 1 year),
(3) scarab.visitor (valid for 1 year),
(4) scarab.profile (valid for 1 year).

Using the information generated by the cookies, such as predictUserID (public key for identifying contacts), PredictSecret (private key for identifying contacts), recently visited products, last visited categories, time and duration of your visit to our website/shop, we or Emarsys can create evaluations about your use of our shop. This may include but is not limited to products and items that you have looked at in our product range as well as information about your computer, your browsing history and the time of your visit to the website. The collected data are processed exclusively after being pseudonymised. If you are subscribed to our newsletter with your e-mail address, the information collected will be merged with the data from the Emarsys newsletter tool in order to create newsletters that are suitable and interesting for you. You can object to this use for personalised content at any time.

2. Purpose and legal basis for data processing

The legal basis for processing of the data transmitted for the sending of the newsletter and for the temporary storage of the data for the success evaluation is your consent. We have an interest in direct advertising and the success evaluation of your response to the contents of the newsletter in order to be able to compete successfully in the market.

3. Storage period

The data will be erased as soon as they are no longer necessary for the purpose of their collection. This is the case for the personal data that you have provided to us for the purpose of requesting and sending the newsletter if the consent for processing is withdrawn. After unsubscribing from the newsletter, all stored data will be erased.

4. Objection and removal options

You can withdraw your consent to the newsletter dispatch at any time for the future. A link to withdraw your consent and thus cancel the newsletter can be found at the end of each newsletter e-mail and on our website in the newsletter form. If you withdraw your consent to further receive the newsletter, your data will no longer be used for this purpose.

In addition, you can object to the collection, storage and use of information by Emarsys at any time with effect for the future using the following methods / withdraw your consent given via the cookie banner:

a) You can prevent the placing of cookies by Emarsys / scarabresearch.com by configuring your browser software accordingly.

b) You can move the slider for Emarsys in the CMP to prevent Emarsys from performing technical measures and placing cookies on your device.

However, please note that in the event of deactivation or opt-out, you may not be able to use all functions of the website to the full extent.

VII.3 Customer satisfaction surveys with LimeSurvey and Lumoa

1. Description of the scope of data processing

In order to receive feedback from our customers on our products and the ordering experience in our shop, we use the services of Lumoame Oy, Hermannin rantatie 8, 00580 Helsinki, Finland (hereinafter "Lumoa") or LimeSurvey GmbH, Survey Services & Consulting, Papenreye 63, 22453 Hamburg, Germany (hereinafter "LimeSurvey"). The agreements required under data protection law for order processing pursuant to Art. 28 GDPR have been concluded with Lumoa and LimeSurvey (hereinafter jointly referred to as "providers"). In these, the Providers undertake to protect the data of our users and to process it exclusively on our behalf in accordance with the applicable data protection provisions.

We partially send the customer satisfaction survey to the e-mail address you provided in your order form approximately 5 days after your purchase in our webshop, using your first and last name, in order to be able to continuously improve ourselves through your feedback. In individual cases, we use your e-mail address to contact you personally regarding your enquiries and wishes within the customer satisfaction survey.

We have commissioned Lumoa or LimeSurvey for the technical implementation of our customer satisfaction survey. Through your voluntary participation in the customer survey, you will be forwarded directly to the provider, who will process the data you have provided for us in compliance with the necessary data security measures. The providers generally do not collect any personal data within our customer satisfaction surveys. You can only voluntarily enter personal data in the free text field at the end of the survey. Your data will be used by Lumoa or LimeSurvey exclusively for conducting the customer satisfaction surveys and for the feedback evaluation of surveys. However, it is not mandatory to provide this personal data.

In order to carry out our customer satisfaction survey, we transmit your e-mail address to the selected providers so that we can trace your survey result back to you after evaluation of the provider in order to be able to contact you subsequently in the free text field in the event of enquiries and wishes about products or our ordering process.

2. Purpose and legal basis for data processing

The processing of your personal data by us is solely for the purpose of evaluating your information, insofar as you provide us with feedback in the free text field beyond your response within the framework of the satisfaction scale.

The data you provide will be stored on certified servers of Lumoa or LimeSurvey. The providers use this information to evaluate the customer satisfaction survey on our behalf for the purpose of optimising our products and services. The providers do not use the data themselves, for example to contact you, nor do they pass it on to third parties.

The legal basis for processing is the customer's consent given in the context of the evaluation. We also have a legitimate interest in subsequently contacting you in the event of enquiries and requests received from you regarding our products and our ordering process. This is important for us so that we can successfully assert ourselves in the market.

3. Storage period and revocation option

We store your personal data as long as this is necessary to achieve the respective storage purpose or your consent to storage has been given. We will then delete your data unless we are obliged to store it for a longer period of time due to tax, commercial or other legal storage or documentation obligations or you have consented to a longer storage period in the event that the storage purpose no longer applies.

The user has the option at any time to revoke his or her consent to the processing of personal data with effect for the future. If the user contacts us by e-mail or via the form, he or she can object to the storage of his or her personal data at any time. The revocation can also be made at any time via the contact data under I. and II. See also our explanations under section "XI. Rights of the data subject".

VII.4 Registration for and participation in competitions

1. Description and scope of data processing

You have the opportunity to participate in one of our competitions on our website as well as on selected competition forms. The scope of the processed personal data and the indication of which personal data is processed in individual cases may vary depending on the competition. Please refer to the respective specific privacy policy of the respective competition.

This includes but is not limited to the following data:

(1) Your name;
(2) Your date of birth;
(3) Your contact details;
(4) The fact of participation;
(5) The outcome of the participation;
(6) Correspondence about the event if applicable.

For more information, please refer to the terms and conditions of the respective competition. In each competition, it is also made transparent what personal data about the participants are processed.

2. Legal basis and purpose for data processing

If you participate in a competition, you agree that to us processing your data exclusively for the purpose of the competition. We process your data in connection with a specific competition in order to be able to successfully carry it out and to be able to perform our duties accordingly. Participation in competitions is voluntary but not possible without the processing of personal data.

3. Storage period

The data are erased by the system, and the forms used are destroyed as soon as they are no longer necessary for the purpose of their collection. For personal data provided to us for the respective competition, this is the case when the respective event has ended and legal retention periods have expired in individual cases.

We collect, process and use your data provided to us in the context of the competition exclusively for contacting the winner and sending the prize. In the event of you winning a prize by participating in one of our competitions, we may request the address information (street, house number, postal code, town) required for sending the prize in individual cases, if it has not already been provided by you at the time of the declaration of participation.

If there is no legal obligation to temporarily store data or if you have not explicitly consented to it, all personal data stored in connection with the event or the competition will be destroyed after the end of the participation phase.

4. Objection and removal options

The user has the option to withdraw their consent to the processing of personal data at any time. In the event of withdrawal of their data in the context of participation in a competition, the withdrawal shall have the effect of ending the performance relationship entered into. If the user contacts us by e-mail, they can object to the storage of their personal data at any time.

The withdrawal can be declared at any time using the contact data in the legal notice of our website, as well as to the e-mail address datenschutz-caferoyal@delica.com. In this case, all personal data stored in the course of the competition will be erased.

VII.5 Other forms of contact if necessary

If necessary, we process personal data of our customers in order to ensure food safety in the event of faulty products, to prevent possible personal injury or damage to property and to implement product recalls or warnings. The legal basis for this data processing is the fulfilment of a legal obligation to which we are subject or the protection of vital interests of the data subject or another natural person.

VII.6 Participation in the bonus points programme

1. Description and scope of data processing

On our website or within the scope of the registration process for a customer account, you have the opportunity to register for our bonus points programme (hereinafter referred to as "bonus programme") in the Café Royal-Shop.

The following data are processed by us in the bonus programme:

(1) Your name;
(2) Your e-mail address;
(3) Your bonus points;
(4) Participation in activities and benefits offered;
(5) If applicable, correspondence pertaining to the bonus programme.

For more information, see the terms and conditions of the bonus programme at https://www.cafe-royal.com/de-de/p/informationen/teilnahmebedingungen-be-loyal.

2. Legal basis and purpose for data processing

If you participate in our bonus programme, you agree that the processing of your data by us exclusively for the purpose of implementing the bonus programme. We process your data in connection with our bonus programme in order to be able to carry it out in accordance with the terms and conditions of participation and to be able to perform our contractual duties. Participation in the bonus programme is voluntary, but not possible without the processing of personal data.

3. Storage period

The data collected in the bonus programme will be stored in Emarsys (see also "VI.2 Newsletter (Emarsys) and tracking"). Our customers who participate in the bonus programme are identified as loyal customers for the addressing of target groups. The identification allows us to inform the participants in the bonus program about the promotions, activities and advantages within the scope of the bonus programme.

The data are erased by the system as soon as they are no longer necessary for the purpose for which they were collected. For personal data provided to us for the bonus programme, this is the case when the bonus programme has ended or you have de-registered from our bonus programme and legal retention periods have expired in individual cases. Bonus points are valid for a period of one calendar year and are then deleted.

If there is no legal obligation to temporarily store data or if you have not explicitly agreed to this, all personal data stored in connection with our bonus programme will be erased after the end of the participation phase.

4. Objection and removal options

The participant has the option to revoke their consent to the processing of personal data at any time. In the event of withdrawal of their data in the context of participation in our bonus programme, the withdrawal has the effect of ending the concluded performance relationship. If the user contacts us by e-mail, they can object to the storage of their personal data at any time.

The withdrawal can be declared at any time via the button provided in the customer account or via the contact data provided in the legal notice of our website, as well as under the following e-mail address datenschutz-caferoyal@delica.com. In this case, all personal data stored in the course of the bonus programme will be erased.

VII.7 Fraud prevention - use of Google reCAPTCHA

1. Description and scope of data processing

Our website and contact form use Google reCAPTCHA to check and prevent interactions on our website by automated access, for example by means of bots. This is a service of Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043 USA (hereinafter referred to as "Google").

By means of this service, Google can determine from which website a request is sent and from which IP address you use the reCAPTCHA input box. In addition to your IP address, Google may collect additional information necessary to provide and guarantee this service.

Google is the controller for the data processing. Google offers further information on the general handling of your user data in this regard at https://policies.google.com/privacy.

2. Purpose and legal basis for data processing

The legal basis for the use of Google reCAPTCHA is the safeguarding of our legitimate interest. Our legitimate interest lies in the security of our website as well as in the prevention of unwanted, automated accesses in the form of spam or the like and thus is also conducive to the security of visitors of our website.

3. Objection and removal options

You can object to the collection, storage and use of information by Google at any time with effect for the future via the opt-out link https://adssettings.google.com/authenticated, or you can unsubscribe from the Google service.

VIII. Website analysis services

We use statistics and analysis services and third-party offers on our website for the evaluation and analysis of your use of our website and our shop. This often involves the disclosure of personal data to third-party providers or their automatic evaluation. The type, scope and purpose of this processing of personal data are listed and explained in the following:

VIII.1 Google Analytics and Google Optimize

1. Description and scope of data processing

We have integrated functions of the web analysis service Google Analytics of Google Inc., 1600 Amphitheater Parkway Mountain View, CA 94043, USA (hereinafter referred to as "Google" or "Google Analytics") by means of Google Tag Manager in our shop. We also use the Google Optimize service to increase the attractiveness, content and functionality of our website by releasing new functions and content of the shop to a percentage of our users and statistically evaluating the change in use. Google Optimize is a subservice of Google Analytics.

Google uses cookies or "third-party cookies". These are text files that are placed and stored on your computer or the device you are using (tablet, smartphone, etc.) and which allow an analysis of your use of our website (see IV. Use of cookies).

The following statistics cookies are placed on your computer:

(1) _ga (valid for 2 years),
(2) _gid (valid for 1 day),
(3) _gat_.+ (valid for 1 minute),
(4) _dc_gtm_UA-.+ (valid for 1 minute),
(5) ga-disable-UA-.+ (valid for 1 minute),
(6) __utm(a|b|c|d|t|v|x|z) (valid for the current session),
(7) _gat (valid for 1 minute),
(8) _swag_ga_.* (valid for 2 years),
(9) _gac.*. (valid for 90 days).

Using the functions provided in the website analysis services, Google is able to assign data, sessions and interactions across several devices to an anonymised user ID and thus analyse the activities of an anonymised user across devices.

The information generated by the cookies about your use of this website (including your IP address) is also transmitted to Google servers in the USA and stored there. Google will use this information to evaluate your use of the website, to compile reports on website activity for the website operators and to provide other services related to website use and internet use. Google may also transfer this information to third parties if required by law or if third parties process this data on behalf of Google. Due to the activation of IP anonymisation on our website, your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before the transmission in order to exclude the establishment of any direct personal relations. Outside the European Union or the European Economic Area, the Google system is not set up for IP anonymisation. You can object to the collection, storage and use of information by Google at any time with effect for the future by installing the deactivation add-on provided by Google.

We have concluded a data processing agreement with Google as required under applicable data protection law. Therein, Google undertakes to protect the data of our users and to process them exclusively on our behalf in accordance with the applicable data protection regulations.

For more information on how Google Analytics handles user data, see the Google Privacy Policy, for example: https://support.google.com/analytics/answer/6004245?hl=de.

2. Purpose and legal basis for data processing

We use Google's analysis and tracking technologies on the basis of your consent given through our cookie banner:

for the purpose of monitoring the correct functioning of our website or our offers,
for the purposes of KPI reporting within our business reports,
for the purpose of automated content playback,
for the purpose of statistical recording of the use and performance of data analyses in order to optimise the usability, the performance and the content of our website,
for the purpose of debugging technical errors,
for the purpose of evaluating control key figures,
for the purpose of product optimisation.

3. Storage period

Sessions are generally terminated after 30 minutes without activity, and campaigns are terminated after six months. The time limit for campaigns can be two years maximum.

4. Option of withdrawal, objection and removal

You can object to the collection, storage and use of information by Google at any time with effect for the future in the following ways / withdraw your consent given via the cookie banner:

a) You can object by installing the deactivation add-on provided by Google. For more information, see https://tools.google.com/dlpage/gaoptout?hl=de.

b) Alternatively, you can prevent the placing of cookies by Google by configuring your browser software accordingly.

c) You can move the slider of Google Analytics in the CMP to prevent technical measures from being carried out by Google and cookies from being placed.

However, please note that in the event of deactivation or opt-out, you may not be able to use all functions of the website to the full extent.

VIII.2 Spread

1. Description and scope of data processing

We have incorporated functions of the Spread service of SPREADING APPS, société par actions simplifiées, 72 rue de la République, Immeuble Seine Innopolis, 76140 LE PETIT QUEVILLY, France (hereinafter referred to as "Spread"), in our shop.

Spread uses cookies or "third-party cookies". These are text files that are placed and stored on your computer or the device you are using (tablet, smartphone, etc.) and which allow an analysis of your use of our website (see IV. Use of cookies).

The following statistics cookies are placed on your computer:

(1) sbt (valid for 3 months),
(2) spv (valid for 3 months),
(3) spw (valid for 3 months),
(4) SPREAD_utm (valid for 3 months).

The information generated by the cookies about your use of this website (including your IP address) is also transmitted to Spread servers in France and stored there. Spread will use this information to evaluate your use of the website to compile reports on website activity for us.

We have concluded a data processing agreement with Spread as required under applicable data protection law. Therein, Spread undertakes to protect the data of our users and to process them exclusively on our behalf in accordance with the applicable data protection regulations.

For more information on Spread, visit: https://hello.spreadfamily.com/.

2. Purpose and legal basis for data processing

We use Spread's analysis and tracking technologies based on your consent given through our cookie banner:

for the purpose of monitoring the correct functioning of our website or our offers,
for the purposes of KPI reporting within our business reports,
for the purpose of automated content playback,
for the purpose of statistical recording of the use and performance of data analyses in order to optimise the usability, the performance and the content of our website,
for the purpose of debugging technical errors,
for the purpose of product optimisation.

3. Storage period

The data collected is stored on certified Spread servers in France. Spread will erase the data after a maximum of 30 days.

4. Option of withdrawal, objection and removal

You can object to the collection, storage and use of information by Spread at any time with effect for the future in the following ways / withdraw your consent given via the cookie banner:

a) You can prevent the placing of cookies by Spread by configuring your browser software accordingly.

b) You can move the Spread slider in the CMP to prevent Spread from performing technical measures and setting cookies.

However, please note that in the event of deactivation or opt-out, you may not be able to use all functions of the website to the full extent.

VIII.3 Kameleoon

1. Description and scope of data processing

We have integrated functions of the test and web analysis service Kameleoon, an offer of Kameleoon GmbH, Im Alten Ausbesserungswerk 4, 77654 Offenburg, Germany (hereinafter referred to as "Kameleoon"), in our shop. In order to be able to continuously improve our web sites, we carry out tests on individual sub-pages. The use of Kameleoon allows us to analyse user behaviour based on segmentation. We collect anonymised statistical data for such testing purposes.

Kameleoon uses cookies or "third-party cookies". These are text files that are placed and stored on your computer or the device you are using (tablet, smartphone, etc.) and which allow an analysis of your use of our website (see IV. Use of cookies).

Kameleoon uses the following marketing cookie:

(1) kameleoonVisitorCode (valid for 380 days).

To evaluate the analyses carried out by us with the help of Kameleoon, we use the local storage of your browser and the placed cookie, which are linked with a pseudonymised ID (hashed UserID).

The information generated by the cookies about your use of our website (including the pseudonymised ID) is also transmitted to Kameleoon servers in Germany and is stored there. Kameleoon will use this information to evaluate your use of the website to compile reports (A/B testing) about the website activities for us. Your IP address transmitted to Kameleoon by calling up one of the tested sub-paged will not be saved.

We have concluded a data processing agreement with Kameleoon as required under applicable data protection law. Therein, Kameleoon undertakes to protect the data of our users and to process them exclusively on our behalf in accordance with the applicable data protection regulations.

For more information about Kameleoon, visit: https://www.kameleoon.com/de.

2. Purpose and legal basis for data processing

We use the analysis and tracking technologies of Kameleoon on the basis of your consent given through our cookie banner:

to perform data analysis and A/B testing (for user interaction, content, wordings or navigation),
to record the use of our website statistically and to evaluate it for the purpose of optimising our website for you,
to constantly improve and manage our website.
to use specialised processors and the economic and technical advantages associated therewith.

3. Storage period

The data collected are stored on certified Kameleoon servers in Germany. Kameleoon will erase the data after a maximum of 380 days.

4. Option of withdrawal, objection and removal

You can object to the collection, storage and use of information by Kameleoon at any time with effect for the future in the following ways / withdraw your consent given via the cookie banner:

a) You can prevent the placing of cookies by Kameleoon by configuring your browser software accordingly.

b) You can move the Kameleoon slider in the CMP to prevent Kameleoon from performing technical measures and setting cookies.

However, please note that in the event of deactivation or opt-out, you may not be able to use all functions of the website to the full extent.

IX. Advertising and marketing services for promotion & retargeting

We use advertising and marketing services and third-party offers for promotion and retargeting on our website. This often involved the disclosure of personal data to our service providers or their automatic evaluation. The type, scope and purpose of this processing of personal data are listed and explained in the following:

IX.1 Use of Google Ads

1. Description and scope of data processing

We use the online advertising programme "Google Ads" of the provider Google to draw attention to our offers in the shop on third-party websites by means of advertising material ("ads"). We can determine how successful the individual advertising measures using the data of the advertising campaigns. In doing so, we are pursuing the interest of showing you advertising that is of interest to you, making our website more interesting for you and achieving a fair calculation of advertising costs.

These advertising materials are delivered by Google via "ad servers". For this purpose, we use ad server cookies, which can be used to measure certain success parameters, such as the display of the ads or clicks by the users. If you access our shop via a Google ad, Google will place cookies on your PC. These cookies are not intended to identify you personally and become invalid after 30 days. As a rule, the unique cookie ID, number of ad impressions per placement (frequency), last impressions (relevant for post-view conversions) and opt-out information (indication that the user no longer wishes to be contacted) are stored as analysis values.

The following marketing cookies are placed by Google:

(1) _gcl_au (valid for 3 months)

This cookie allows Google to recognise your Internet browser. If a user visits certain pages of an Ads customer's website and the cookie stored on their computer has not yet expired, Google and the customer can recognise that the user has clicked on the ad and has been forwarded to this page. Each Google Ads customer is assigned a different cookie. Cookies therefore cannot be tracked via the websites of Google Ads customers.

We do not collect and process personal data in the advertising activities mentioned. We only receive statistical evaluations from Google. Based on these evaluations, we can identify which of the advertising measures used are particularly effective. We do not receive any further data on the use of the advertising material, in particular, we are not able to identify the users on the basis of this information.

Due to the marketing tools used, your browser automatically establishes a direct connection to the Google server. We have no influence on the scope and further use of the data collected through the use of this tool by Google and therefore inform you according to our state of knowledge: By integrating Ads Conversion, Google receives the information that you have accessed the corresponding part of our website or clicked on an ad from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, it is possible that the provider will find out and save your IP address.

For information from Google about Google Ads Conversion: https://ads.google.com/intl/de_de/home/faq/gdpr/.

In addition to Google Ads Conversion, we also use Ads Remarketing. This is a procedure in which we wish to address you again. This application allows us to display our advertisements to you while you continue to use the Internet after visiting our website. This is achieved by means of cookies stored in your browser which allow Google to record and evaluate your usage behaviour while visiting various websites. Thus, Google "knows" that you have previously visited our website. According to Google's own statements, the data collected in the context of the remarketing is not combined with your personal data possibly stored by Google. In particular, Google claims that pseudonymisation is used in remarketing.

For information from Google on Google Ads Remarketing: https://support.google.com/google-ads/answer/9028179?hl=de.

2. Purpose and legal basis for data processing

It is important for us to make our website attractive and to increase interaction with our visitors with the help of this service. We use the advertising and marketing services, especially Google Ads, for our conversion tracking and remarketing. We use the statistics provided by Google through the Google Ads service exclusively to measure the performance of our advertisements in order to ascertain the success of specific marketing measures.

The legal basis for the processing of personal data using marketing cookies as well as functions of Google Ads is your consent to this via the cookie settings or our cookie banner.

3. Storage period

We will erase the information provided by Google after six months at the latest.

4. Option of withdrawal, objection and removal

You can object to the collection, storage and use of information by Google at any time with effect for the future in the following ways / withdraw your consent given via the cookie banner:

a)You can object by installing the deactivation add-on provided by Google. For more information, see https://tools.google.com/dlpage/gaoptout?hl=de.

b) Alternatively, you can prevent the placing of cookies by Google by configuring your browser software accordingly.

c) You can move the slider of Google Ads in the CMP to prevent Google from performing technical measures and storing cookies.

However, please note that in the event of deactivation or opt-out, you may not be able to use all functions of the website to the full extent.

IX.2 Using Exactag to analyse our marketing campaigns

1. Description and scope of data processing

We use the web analysis service Exactag, a service of Exactag GmbH, Wanheimer Straße 68, 40468 Düsseldorf, Germany (hereinafter "Exactag"), to measure the effectiveness of our online marketing campaigns. Exactag uses cookies or "third-party cookies". These are text files that are placed and stored on your computer or the device you are using (tablet, smartphone, etc.) and which allow an analysis of our online marketing campaigns (see IV. Use of cookies).

Exactag: uses the following marketing cookies:

(1) et_gk (valid for 90 days),
(2) et_uk (valid for 1 year),
(3) exactag_new_gk (valid for 90 days),
(4) exactag_new_uk (valid for 1 year),
(5) exactag_new_user (valid for 1 year),
(6) session_session (valid for the current session).

The cookie used by Exactag stores a random identification number for assignment, the status of the present opt-out or opt-in options and information about campaign activities on our website. In addition, the cookie-based Exactag profiles store information such as device type, operating system, browser version, geographical location and information about the interaction with advertising (e.g. number of clicks or views).

The information generated by the cookies about your use of our website (including the identification number) is also transmitted to Exactag servers in Germany and stored there. In addition, your IP address is also visible for Exactag as part of the connection to the Exactag web server. The IP addresses are anonymised by Exactag and are erased after one year.

We have concluded a data processing agreement with Exactag as required under applicable data protection law. Therein, Exactag undertakes to protect the data of our users and to process them exclusively on our behalf in accordance with the applicable data protection regulations.

For more information on Exactag, visit: https://www.exactag.com/datenschutz/.

2. Purpose and legal basis for data processing

We use Exactag's analysis and tracking technologies on the basis of your consent given through our cookie banner

measuring the effectiveness of our online marketing campaigns
as well as for constant improvement of our offer.

3. Storage period

The data collected is stored on certified Exactag servers in Germany. Exactag will erase the data after a maximum of one year.

4. Option of withdrawal, objection and removal

You can object to the collection, storage and use of information by Exactag at any time with effect for the future using the following methods / withdraw your consent given via the cookie banner:

a) You can prevent the placing of cookies by Exactag by configuring your browser software accordingly.

b) You can move the slider for Exactag in the CMP to prevent Exactag from performing technical measures and setting cookies.

However, please note that the opt-out procedure leads to the deletion of all collected data, causing an alternative Exactag cookie ("exactag_new_optout") to be saved in your browser with a special indication of an opt-out choice and without further data. The cookie only applies to the browser of the terminal device on which you have chosen the opt-out. If you also want to opt out for other browsers or other devices, you must repeat this process with the other browsers or devices. Please also note that deleting the cookies in your browser will also remove the opt-out cookie, and this process must be repeated in the event of a renewed consent.

Please also note that in the event of deactivation or opt-out, you may not be able to use all functions of the website in full.

IX.3 Conversion tracking for affiliate marketing partners (AWIN and ADOT)

1. Description and scope of data processing

We use the following marketing partners:
- Awin AG, Eichhornstraße 3, 10785 Berlin, Germany (hereinafter: "Awin" or "Marketing Partner") – exclusively in the shop for Germany and Switzerland
- Adot, 32 René Boulanger Street, 75010 Paris, France (hereinafter: "Adot" or "Marketing Partner") – exclusively in the French shop

The Marketing Partners provide networks that bring parties interested in our products to our website in order to buy our products there. The Marketing Partners are entitled to a commission for brokered interested parties and their purchases on our website. In order to be able to track the interested party across various devices and to calculate correspondingly incurred commissions, a tracking pixel is set when visiting our website.

The tracking pixel and your visit to our website establish a connection between your browser and the server of the respective Marketing Partner. Using this link, the Marketing Partner collects the following information: Information about your terminal device such as operating system and screen resolution, browser type and the website you visited. In addition, information about the order value, order ID, time of the order, SessionID are collected. The information varies between the Marketing Partners and basically contains only pseudonymous data, which cannot be traced back to you without additional information.

AWIN uses cookies or "third-party cookies" to process the listed information. Cookies are text files that are placed and stored on your computer or the device you are using (tablet, smartphone, etc.) and which enable AWIN to analyse the executed online marketing campaigns (see IV. Use of cookies).

AWIN uses the following marketing cookies:

(1) bId (valid for 1 year),
(2) aw+ (valid for 30 days),
(3) AWSESS (valid for the current session),
(4) awpv+ (valid for 1 day),
(5) _aw_m_+ (valid for 24 hours),
(6) _aw_sn_ (valid for 1 year).

For more information on the Marketing Partners, please visit the following links:
- Adot: https://we-are-adot.com/privacy-policy/,
- for Awin: https://www.awin.com/de/datenschutzerklarung.

2. Purpose and legal basis for data processing

We use the data collected through the Marketing Partners on the basis of the consent you granted us via our cookie banner to

increase the visibility of our products and their sale
as well as for constant improvement of our offer.

3. Storage period

The Marketing Partners will erase their tracking data as follows:
- Awin 60 days server in the EU/ DE.

4. Option of withdrawal, objection and removal

You can object to the collection, storage and use of information by our Marketing Partners at any time with effect for the future in the following ways / withdraw your consent given via the cookie banner:

a) You can prevent the use of the tracking pixels of our Marketing Partners by configuring your browser software accordingly.

b) You can deactivate the placing of cookies directly at the respective provider:
- for Awin: https://www.awin.com/de/rechtliches/optout.

c) You can move the slider for the respective Marketing Partner in the CMP to prevent the tracking pixels of our Marketing Partner from being set.

Please also note that in the event of deactivation or opt-out, you may not be able to use all functions of the website in full.

X. Social Media

We use add-ons, plug-ins and third-party offers on our website for uniform presentation of the website as well as for the integration of social media content. This often involved the disclosure of personal data to our service providers or their automatic evaluation. The type, scope and purpose of this processing of personal data are listed and explained in the following:

X.1 Links to social media networks

1. Description and scope of data processing

Links to the following social networks are integrated in our website:

Meta Inc., 1601 S. California Avenue, Palo Alto, CA 94304, USA; privacy policy: https://www.facebook.com/policy.php,
Instagram LLC, 1601 Willow Road, Menlo Park, CA 94025, USA; privacy policy: https://help.instagram.com/519522125107875,
YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (‘YouTube’); privacy policy: https://policies.google.com/privacy?hl=de&gl=de.

When you visit our website, no personal data will be passed on to the respective providers of the social networks initially. You can recognise the providers by the marking on the button, the initial letter or the logo. We offer you the opportunity to communicate directly with the provider of the respective social network via the button. The provider only receives the information that you have accessed the corresponding website of our online shop if you click on the marked field and thereby activate it.

We have no influence on the scope of data that Facebook, Instagram and YouTube process with the help of this link and are therefore informing you according to our state of knowledge: This linking informs the providers that you have visited their respective internet presence from our website. We have no influence on the data collected by the above-mentioned providers and their data processing operations, nor are we aware of the full scope of data collection, the purposes of processing or the storage periods. The general terms and conditions and privacy policies of the providers shall apply. The providers store the data collected about you as usage profiles and use them for the purposes of advertising, market research and/or demand-oriented design of their websites. If you are logged in to Facebook, Instagram and YouTube, they can assign the information to your respective account.

2. Purpose and legal basis for data processing

The legal basis for redirecting you to the respective linked social network is your consent given by voluntarily clicking on the button of the respective social network.

X.2 Use of Facebook Pixel and Facebook Advanced Matching

1. Description and scope of data processing

We use the online advertising programme "Facebook Business" and, within this programme, the functions "Facebook Pixel" and "Advanced Matching". The functions of Facebook Business are an analysis service of Meta Platforms Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or if you are based in the EU, Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; (hereinafter jointly referred to as "Facebook").

After you have given your consent to the placing of retargeting/advertising cookies, we use Google Tag Manager to integrate a Facebook pixel on our website and enable Facebook to evaluate your surfing behaviour. Google Tag Manager is an offer of Google Inc., 1600 Amphitheater Parkway Mountain View, CA 94043, USA ("Google"), which allows us to manage website tags via a user interface. Google Tag Manager does not process any personal data and only allows us to display the tags and to control the integrated technical measures.

The built-in pixel and your visit to our website establish a connection between your browser and a Facebook server. Through this connection, Facebook collects the following information: Your browser type, your terminal device, the website you are visiting and, for example, the effect of a Facebook advertisement, and stores these in cookies which are stored on your terminal device. Facebook discloses the purpose for which the collected data is processed in its own privacy policy. We have no influence on the data collected by Facebook through the pixel and its data processing operations, nor do we know the full extent of the data collection, the purposes of processing and the storage periods; In this regard, please refer to Facebook’s privacy policy. We use the Facebook Pixel and the information generated in this way exclusively for a cost-benefit analysis as well as for optimising of our Facebook advertisements. For this purpose, Facebook provides us with anonymised statistical evaluations.

When you click on an ad placed by Facebook, a cookie for the Facebook pixel will be placed on the respective device you are using. Facebook uses the following cookies:

(1) mediameets-facebook-pixel-enabled (valid for 90 days),
(2) fb_conversion_api.advanced_matching_data (valid for 90 days).

For more information on cookies, see IV. Use of cookies.

If you visit certain pages of our website and the cookie has not yet expired, Facebook and we can recognize that you have clicked on one of our ads on Facebook and have been redirected to this page. Every Facebook Business customer receives a different pixel. This means that it is not possible to track cookies via the websites of Facebook Business customers.

After obtaining your required consent to the use of Automatic Advanced Matching, we activate the function or interface between our servers and the Facebook servers provided by Facebook. If you subsequently provide us with personal data such as your e-mail address, your first or last name, your address, your date of birth or other contact data in the context of an order process or registration (see section "V.3 Processing of data within the scope of a purchase transaction") on our website, this information will be transmitted in a hashed form to Facebook in addition to the information generated by the use of the Facebook Pixel. Facebook can then match the additionally provided data with existing profile data. The use of Advanced Matching allows Facebook and us to better adapt our planned advertising campaigns to you and your interests.

The data obtained by Facebook using the functions are made available to us in aggregated statistics. This tells us the total number of users who clicked on their ad and were redirected to a page with a Facebook pixel. This information is used to create conversion statistics as well as custom audiences or look-alike audiences and to evaluate them as well. If you are logged into Facebook with your profile, Facebook can link the information obtained via the pixel to your profile.

For more information on data processing, see the privacy policy of Facebook at http://www.facebook.com/policy and regarding the Facebook pixel at https://www.facebook.com/business/learn/facebook-ads-pixel.

2. Purpose and legal basis for data processing

It is important for us to make our website attractive and to increase interaction with our visitors with the help of the service. We use our advertising and marketing services, especially the Facebook Pixel and Advanced Matching, for our conversion tracking and remarketing. The functions provided by Facebook help make a cost-benefit analysis of placed Facebook ads and the optimisation of our ad placement possible.

The processing, i.e. the activation of the pixel as well as the placing of cookies and the evaluation of information stored in them, is performed exclusively on the basis of your consent for the placing of retargeting or advertising cookies given via the cookie banner. Any additional use of the functions provided by Facebook as part of the Advanced Matching, as well as the processing of the data, is also exclusively based on your consent given via the cookie banner.

3. Option of withdrawal, objection and removal

You can object to the collection, storage and use of information by Facebook at any time with effect for the future using the following methods / withdraw your consent given via the cookie banner:

a) You can deactivate the placing of cookies by appropriate configuration or configure your browser so that you are notified when cookies are placed. To do this, you must adjust the necessary settings in the browser preferences or options menus. Please note that in this case, some areas of our website may not or no longer function properly, i.e. only to a limited extent.

b) You can object to the generating of user profiles on registered Facebook users by contacting Facebook directly. As a Facebook member, you can change your Facebook settings at https://www.facebook.com/settings?tab=ads and object to data collection using Facebook pixels. In addition, please note that you can prevent an assignment of the data to your profile by logging out of your respective social media profile before visiting the website and additionally deleting the cookies used by the social media channel. If you do not have a Facebook account, you can disable use-based advertising from Facebook on the European Interactive Digital Advertising Alliance website: http://www.youronlinechoices.com/de/praferenzmanagement/.

c) You can change your cookie settings made via the cookie banner at any time here: Cookie settings. Under marketing, you can deactivate the relevant cookies or the use of Facebook Pixel and/or Facebook Advanced Matching using the slider.

However, please note that in the event of deactivation or opt-out, you may not be able to use all functions of the website to the full extent.

X.3 Integration of YouTube videos

1. Description and scope of data processing

For the integration of videos, we use a plugin from the provider YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (hereinafter "YouTube") on our website. The content of the plugin is transmitted directly from YouTube to your browser via a link to the YouTube servers and integrated into the website by it. This will transmit information regarding your visit to the website to YouTube together with your IP address.

If you are logged in to YouTube with your user account, YouTube can allocate the information obtained via the plugin to your respective account. In this case, the information is transmitted to your personal YouTube user account and stored there by YouTube. This is done with the use of cookies (cf. section "IV. Use of cookies").

We have integrated our videos with the "privacy-enhanced" setting as a standard. As a result, YouTube does not place third-party cookies via the plug-in on your computer.

We have no influence on the data collected by YouTube and its data processing operations, nor are we aware of the full scope of data collection, the purposes of processing, the storage periods and the location. There is also no information on the erasure of the data collected by YouTube. For further information on the purpose and scope of data processing, as well as your rights and settings options for the protection of your privacy, please refer to the YouTube Terms of Use and Privacy Policy at https://www.youtube.com/t/terms or https://policies.google.com/privacy?hl=de&gl=de.

2. Purpose and legal basis for data processing

The aforementioned processing purposes are intended to protect our legitimate interests. It is important for us to make our website attractive and to increase the interaction with our visitors with the help of the plugins.

3. Option of withdrawal, objection and removal

Under European and German law, you have the right to object to the generation of user profiles or the allocation to an existing account; to exercise this right, you must contact the plugin provider or YouTube directly.

In addition, please note that you can prevent this allocation by logging out of your YouTube profile before visiting the website.

X.4 Integration of Google Maps

1. Description and scope of data processing

Our website uses the functions of the Google Maps API, of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin 4, Ireland (hereinafter Google), in order to offer geographical information about our points of sale (in our store finder) to visitors to our website.

Through the use of Google Maps and your visit to our website, on which the Google Maps plugin is used, data (including the date and time of your visit to our website, location information, URL of the website accessed, search terms) are generally collected, processed and stored. By calling up the Google Maps component on our website, Google independently stores cookies about your browser on your computer or mobile device. In addition, Google may store and analyse your IP address and our website, as the starting point of your Google Maps request, via an interface. For more information on the processing of data by Google, please refer to Google's privacy policy. We have no influence on the data and data processing procedures collected by Google, nor is the full extent of the data collection, the purposes of the processing, the storage periods and the storage location known. There is also no information available on the deletion of the collected data by Google. Further information and the applicable data protection provisions of the operator can be found at https://www.google.com/intl/de_de/help/terms_maps.html.

2. Purpose and legal basis for data processing

The aforementioned processing purposes are based on the protection of our legitimate interests. It is important for us to make our website attractive and to increase the interaction with our visitors with the help of the plugins.

3. Possibility of objection and removal

You can, however, object to the collection, storage and use of information by Google at any time with effect for the future by installing the deactivation add-on provided by Google or by adjusting your browser settings so that cookies cannot be stored.

According to European and German law, you have the right to object to the creation of user profiles or the allocation, whereby you must contact the plug-in provider or Google directly to exercise this right.

XI. Rights of the data subject

If your personal data is processed, you are a data subject and have the following rights towards the Controller. As the EU/EEA Representative of the Controller, please direct your inquiries to Delica Deutschland GmbH.

1. Right of access

You may ask the Controller to confirm that personal data relating to you are processed by it. If this is the case, you can request access to the following information from the Controller:

(1) The purposes for which the personal data are processed;
(2) The categories of personal data which are processed;
(3) The recipients or the categories of recipients to whom the personal data relating to you have been disclosed or are still being disclosed;
(4) The planned duration of the storage of the personal data relating to you or, if specific details in this regard cannot be provided, criteria for determining the storage period;
(5) The existence of a right to rectify or erase the personal data concerning you, a right to restrict the processing by the Controller or a right to object to this processing;
(6) The existence of a right of lodge a complaint with a supervisory authority;

You have the right to request information on whether the personal data related to you are transmitted to a third country or to an international organisation. In this context, you may request to be informed of the appropriate guarantees relating to the transmission.

In order to exercise your right to free access, please contact us directly via the contact details in our legal notice or contact our EU/EEA Representative (see sections I and II).

2. Right to rectification

You have a right to rectification and/or completion towards the Controller if the processed personal data relating to you are inaccurate or incomplete. The Controller must make the rectification immediately.

3. Right to restriction of processing

You may request the restriction of processing of personal data relating to you under the following conditions:

(1) If you dispute the accuracy of the personal data relating to you for a period which allows the Controller to verify the accuracy of the personal data;
(2) If the processing is unlawful and you refuse to erase the personal data and instead demand the restriction of the use of the personal data;
(3) If the Controller no longer requires the personal data for the purposes of processing but you need them for asserting, exercising or defending legal claims, or
(4) If you have objected to the processing and if it is not yet clear whether the legitimate grounds of the Controller outweigh your reasons.

If the processing of personal data relating to you has been restricted, these data may only be processed with your consent – apart from their storage – or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the European Union or of a Member State.

If the restriction of the processing was limited according to the above conditions, you will be advised by the Controller before the restriction is lifted.

4. Right to erasure

a) Erasure obligation

You may request the Controller to immediately erase the personal data relating to you, and the Controller is then obligated to immediately erase these data, provided that one of the following reasons applies:

(1) The personal data relating to you are no longer necessary for the purposes for which they were collected or otherwise processed.
(2) You withdraw your consent on which the processing is based, and there is no other legal basis for the processing.
(3) You object to the processing and there are no overriding legitimate reasons for the processing, or you object to the processing.
(4) The personal data relating to you have been processed unlawfully.
(5) The erasure of personal data concerning you is necessary to fulfil a legal obligation under the law of the European Union or the Member States to which the Controller is subject.
(6) The personal data relating to you have been collected in relation to offered information society services.

b) Information to third parties

If the Controller has made the personal data relating to you public and is obligated to erase them, it shall take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform controllers who process the personal data that you as the data subject have requested from them the erasure of all links to these personal data or of copies or reproductions of these personal data.

c) Exceptions

You do not have a right to erasure if as the processing is necessary

(1) to exercise the right of freedom of expression and information;
(2) for compliance with a legal obligation which requires processing Union or Member State laws to which the Controller is subject, or to perform a task which is of public interest or to exercise an official authority vested in the Controller;
(3) to assert, exercise or defend legal claims.

5. Right to notification

If you have asserted the right to rectification, erasure or restriction of processing vis-à-vis the Controller, the Controller is obliged to inform all recipients to whom the personal data relating to you have been disclosed of this rectification or erasure of the data or restriction of processing unless this proves impossible or involves a disproportionate effort. You have the right to be informed about these recipients by the Controller.

6. Right to data portability

You have the right to receive the personal data relating to you which you have provided to the Controller in a structured, common and machine-readable format. In addition, you have the right to transmit these data to another controller without any obstruction by the Controller to whom the personal data have been provided, provided that

(1) the processing is based on your consent, and
(2) the data are processed using automated methods.

In exercising this right, you also have the right to have the personal data relating to you transmitted directly from one controller to another controller, where technically feasible. The freedoms and rights of other persons may not be affected by this.

The right to data portability shall not apply to the processing of personal data necessary for the performance of a task in the public interest or in exercising official authority vested in the Controller.

7. Right to object

You have the right to object to processing of the personal data related to you at any time on grounds relating to your particular situation.

In addition, you have the right to object to the processing of your personal data for direct marketing purposes at any time; this also applies to profiling if it is connected with such direct advertising.

The Controller will no longer process the personal data relating to you unless it can prove compelling legitimate grounds for processing which outweigh your interests, rights and freedoms, or if the processing is necessary to assert, exercise or defend legal claims.

8. Right to withdraw consent given under data protection law

You have the right to withdraw a consent given by you under data protection law at any time. The withdrawal of consent shall not affect the legality of the processing which had been performed on the basis of consent until its withdrawal.

9. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or place of the alleged infringement if you are of the opinion that the processing of personal data relating to you violates data protection laws.

The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy.

The data protection authority responsible for the EU/EEA Representative is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, Postfach 20 04 44, 40102 Düsseldorf, further information on the Internet at https://www.ldi.nrw.de/index.php.

The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).

XII. Automated decision-making and profiling

As a responsible company, we do not perform profiling or use automated decision-making.

XIII. Links to other websites

This privacy policy applies exclusively to the website, the shop of Café Royal and CoffeeB. The pages in this website may contain links to websites with products of Delica AG, the Migros-Genossenschafts-Bund or third parties. Our privacy policy does not cover such websites. When you leave the website, it is recommended that you carefully read the privacy policy of each website that collects personal data.

XIV. Security

We take the necessary security measures to protect your personal data from unlawful or unintentional access or erasure, alteration or loss as well as against unauthorised disclosure. We encrypt your data when they are transmitted via our website and use SSL (Secure Socket Layer) or TLS (Transport Layer Security) connections. We secure our website and our other systems and personal data by appropriate technical and organisational measures, in particular against loss, destruction, unauthorised access, alteration or disclosure to third parties.

XV. Availability and changes

You can view this privacy policy at any time. You can also save or print this privacy policy by using the appropriate functions of your browser.

We reserve the right to amend this privacy policy from time to time or to adapt it to legal requirements and therefore ask you to review the current privacy policy every time you visit our website.

6. More information

Please also read the general privacy policy. It also applies to the processing of personal data in connection with the DELIZIO web shop and contains further information on data protection.

Among other things, the general privacy policy advises you on:

how you benefit from data processing by Migros;
from which sources the personal data processed by us originate;
what legitimate interests we have in data processing and on which further legal bases our processing is based;
how we use personal data within the Migros Group and under what circumstances we may share personal data with companies outside the Migros Group;
how we transfer personal data abroad and how we ensure adequate data protection in this process;
how and for what we use profiling and whether we make key decisions in a fully automated process;
what measures we take to ensure the security of personal data in an appropriate manner;
for how long we process and store personal data in general;
how we use cookies and similar technologies when you visit our websites and mobile apps;
What rights you have in connection with the processing of your personal data and how you can exercise them;
how you can contact the Data Protection Officer of the Migros Group or the Representative in the European Union or the European Economic Area.

7. Changes to this privacy policy

This supplementary privacy policy may be adapted over time, especially if we change our data processing or if new legislation comes into effect. In the event of significant changes, we actively inform people whose contact details are registered with us about such changes if this is possible without a disproportionate effort. In general, the privacy policy in the version in force at the beginning of the relevant processing applies to data processing.

Version: August 2022

SUPPLEMENTARY PRIVACY POLICY Café Royal / CoffeeB

1. What is this privacy policy about?

2. Who is the controller responsible for data processing?

3. What personal data do we process?

4. For what purposes do we process personal data?

5. Data processing in detail

I. General information on data processing

1. Scope of personal data processing

2. Data erasure and storage period

II. Privacy settings via Usercentrics

1. Description and scope of data processing

2. Legal basis and purpose of data processing

3. Possibility of objection and elimination

III. Provision of the website and generation of log files

1. Description and scope of data processing

2. Legal basis for data processing

3. Purpose of data processing

4. Storage period

5. Objection and removal options

IV. Use of cookies

1. Description and scope of data processing

(a) Essential cookies:

(b) Statistical cookies:

(c) Marketing cookies:

2. Legal basis for data processing

3. Purpose of data processing

4. Duration of storage, options of objection and removal

V. Use of the Café Royal or CoffeeB shop

V.1 Shop system (Shopware) & data management platform (SIDIS)

V.2 Registration of a customer account and login

1. Description and scope of data processing

2. Legal basis for data processing

3. Purpose of the data agreement

4. Duration of storage and removal

V.3 Registration of a Migros account and login

V.4 Processing of data within the scope of a purchase transaction

1. Description and scope of data processing

2. Legal basis for data processing

3. Purpose of the data agreement

4. Storage period

5. Objection and removal options

V.5 Use of logistics and payment service providers

1. Description and scope of data processing

2. Legal basis for data processing

3. Purpose of data processing and duration of storage

V.6 Identity and creditworthiness check when choosing Klarna payment methods

1. Description and scope of data processing

2. Legal basis for data processing

3. Purpose of data processing and duration of storage

V.7 Sending transaction e-mails using Mailgun

1. Description and scope of data processing

2. Purpose and legal basis for data processing

3. Storage period

4. Objection and removal options

VI. Registration of your CoffeeB coffee machine

1. Description and scope of data processing

2. Purpose and legal basis for data processing

3. Purpose of the data agreement

4. Storage period

5. Objection and removal options

VII. Communications & events

VII.1 E-mail contact, use of the help tool and contact form

1. Description and scope of data processing

2. Legal basis and purpose for data processing

3. Purpose of data processing

4. Storage period

5. Objection and removal options

VII.2 Newsletter (Emarsys) and Tracking

1. Description and scope of data processing

2. Purpose and legal basis for data processing

3. Storage period

4. Objection and removal options

VII.3 Customer satisfaction surveys with LimeSurvey and Lumoa

1. Description of the scope of data processing

2. Purpose and legal basis for data processing

3. Storage period and revocation option

VII.4 Registration for and participation in competitions

1. Description and scope of data processing

2. Legal basis and purpose for data processing

3. Storage period

SUPPLEMENTARY PRIVACY POLICY
Café Royal / CoffeeB