Privacy Policy

I. Name and address of the person responsible

The data controller within the meaning of the General Data Protection Regulation and other national data protection laws of the Member States, as well as other data protection provisions, is:

• WINDOW FASHION AG
• Feldstraße 2
• CH-8194 Hüntwangen
• Switzerland

II. General information on data processing

1. Scope of the processing of personal data

   We generally process our users’ personal data only to the extent necessary to provide a fully functional website and our content and services. The processing of our users’ personal data is normally carried out only with the user’s consent. An exception applies in cases where it is not possible, for practical reasons, to obtain consent in advance and where the processing of the data is permitted by statutory provisions.

2. Legal basis for the processing of personal data

   Where we obtain the data subject’s consent for the processing of personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis. Where the processing of personal data is necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) of the GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of pre-contractual measures. Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6(1)(c) of the GDPR serves as the legal basis. Where the vital interests of the data subject or of another natural person necessitate the processing of personal data, Article 6(1)(d) of the GDPR serves as the legal basis. Where processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests, fundamental rights and freedoms of the data subject do not override the former interest, Article 6(1)(f) of the GDPR serves as the legal basis for the processing.

3. Data erasure and retention period

   The data subject’s personal data shall be erased or blocked as soon as the purpose for which it was stored ceases to apply. Data may also be retained if this is provided for by European or national legislation in EU regulations, laws or other provisions to which the controller is subject. Data will also be blocked or erased when a retention period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or performance of a contract.

III. Provision of the website and creation of log files

1. Description and scope of data processing

   Every time our website is accessed, our system automatically collects data and information from the computer system of the visiting user. The following data is collected:

   • The website from which the user visits us (referrer URL)
   • Date and time of access
   • The user’s Internet Protocol (IP) address
   • Browser type and version
   • Operating system

   The data is also stored in our system’s log files. This data is not stored together with any other personal data relating to the user.

2. Legal basis for data processing

The legal basis for the temporary storage of the data is Article 6(1)(f) of the GDPR.

3. Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user’s computer. To this end, the user’s IP address must be stored for the duration of the session. The data is stored in log files to ensure the website functions properly. The data also helps us to optimise the website and ensure the security of our IT systems. The data is not analysed for marketing purposes in this context. These purposes also constitute our legitimate interest in data processing pursuant to Article 6(1)(f) of the GDPR.

4. Duration of storage

The data is deleted as soon as it is no longer required to fulfil the purpose for which it was collected. In the case of data collected for the purpose of providing the website, this is the case once the relevant session has ended. The storage of data in log files is regularly reviewed to ensure it is necessary. The data will be deleted unless there is a legal obligation or a legitimate interest in archiving it.

5. Right to object and right to erasure

The collection of data for the purpose of providing the website and the storage of data in log files is strictly necessary for the operation of the website. Consequently, the user has no right to object.

IV. Use of cookies

1. Description and scope of data processing

So-called cookies are used to recognise repeated use of our website by the same user. Cookies are small text files that the internet browser places and stores on the user’s computer. These are known as ‘session cookies’. No personal data is collected via these cookies. The following data is stored and transmitted in the cookies: Session ID the user’s current shopping basket contents the time of the last check of the session ID

2. Legal basis for data processing

The legal basis for the processing of personal data using cookies is Article 6(1)(f) of the GDPR.

3. Purpose of data processing

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be provided without the use of cookies. For these, it is necessary for the browser to be recognised even after a page change. We use cookies to assign you a unique shopping basket. The user data collected by technically necessary cookies is not used to create user profiles. This stated purpose also constitutes our legitimate interest in the processing of personal data pursuant to Article 6(1)(f) of the GDPR.

4. Duration of storage, right to object and option to delete

Cookies are stored on the user’s computer and transmitted by the user to our website. The user therefore has full control over the use of cookies. By changing the settings in their web browser, the user can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may no longer be possible to use all of the website’s functions.

V. Contact forms and email contact

1. Description and scope of data processing

• Our website features contact forms which can be used to contact us electronically. If a user makes use of this option, the data entered in the form is transmitted to us and stored. This data comprises:
• Name
• Address, postcode and town (withdrawal and complaints forms only)
• Email
• Telephone
• Enquiry text
• Product type (withdrawal and complaints forms only)
• List of items (withdrawal form only)
• Case number (withdrawal and complaints forms only)
• The following data is also stored when the message is sent:
• User’s IP address
• Date and time
• Alternatively, you may contact us via the email address provided. In this case, the user’s personal data transmitted with the email will be stored.
• The data is used exclusively for the purpose of handling the correspondence.

2. Legal basis for data processing

The legal basis for the processing of the data is Article 6(1)(f) of the GDPR. If the contact is aimed at concluding or fulfilling a contract, the additional legal basis for the processing is Article 6(1)(b) of the GDPR.

3. Purpose of data processing

We process the personal data entered via the contact form solely for the purpose of handling your enquiry. Where contact is made via email, this also constitutes the necessary legitimate interest in processing the data. The other personal data processed during the submission process serves to prevent misuse of the contact form and to ensure the security of our IT systems.

4. Retention period

The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. For personal data entered via the contact form and that sent by email, this is the case once the relevant conversation with the user has ended. The conversation is deemed to have ended when it is clear from the circumstances that the matter in question has been conclusively resolved.

5. Right to object and right to erasure

The user has the right to object to the processing of their personal data at any time. If the user contacts us by email, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. The objection must be submitted to the data controller named under I. In this case, all personal data stored in the course of the contact will be deleted.

VI. Order process

1. Description and scope of data processing

We process our customers’ data as part of the ordering process to enable them to order products, as well as to facilitate payment and delivery. The data required for this are: First name Surname Street and house number Postcode, town and country Email address Telephone number Data will only be disclosed to third parties where this is necessary for order processing.

2. Legal basis for data processing

The legal basis for the processing of data is the fulfilment of a contract pursuant to Article 6(1)(b) of the GDPR and the fulfilment of the controller’s legal obligations pursuant to Article 6(1)(c) of the GDPR.

3. Purpose of data processing

The personal data provided is used to fulfil the contract concluded between us and the user and for the technical implementation and fulfilment of contract-related obligations. The user’s personal data will only be transferred to third parties where this is necessary for the fulfilment of the contract. This includes, in particular, the disclosure of the user’s address details to suppliers and to logistics service providers commissioned by us. Personal data relating to the user will only be processed in third countries where this is necessary for the performance of the contract. This may, for example, be necessary in the case of deliveries abroad. The user’s data will only be used in connection with competitions, newsletters or other promotional activities with the user’s separate consent.

4. Duration of storage

The user’s personal data provided will be deleted once statutory warranty obligations and similar obligations have expired. The necessity of retaining the data is reviewed on a regular basis. Where statutory archiving obligations apply, the data will be deleted once the tax-related archiving obligation has expired (10 years).

5. Right to object and right to erasure

The user has the right to withdraw their consent to the processing of the personal data provided, provided that no contract has yet been concluded or the contract has been fulfilled by both parties. The objection must be notified to the data controller named under I. Provided there is no obligation under Article 6(1)(c) of the GDPR, the user’s data will be deleted in this case.

VII. Rights of the data subject

Where the user’s personal data is processed, they are a data subject within the meaning of the GDPR and are entitled to the following rights vis-à-vis the controller:

1. Right of access under Article 15 of the GDPR

The user may request confirmation from the controller as to whether personal data concerning them is being processed by us.

2. Right to rectification under Article 16 of the GDPR

The user has the right to request that the controller rectify and/or complete their personal data, provided that the personal data concerning them that is being processed is inaccurate or incomplete.

3. Right to erasure under Article 17 of the GDPR

The user may request that the controller erase personal data relating to them without delay, and the controller is obliged to erase such data without delay where one of the grounds set out in Article 17 of the GDPR applies. Reasons for which erasure must be carried out therefore include, amongst others: The purpose for which the personal data was originally collected, processed and stored no longer applies. The user withdraws their consent to the storage and processing of the personal data and there is no other legal basis for the storage and processing of this data. The processing and storage of the personal data took place without a legal basis. There are overriding legal grounds for the erasure of the personal data. Where the user’s personal data has been made public and the controller is obliged to erase it in accordance with Article 17(1) of the GDPR, the controller shall, taking into account the available technology and the costs of implementation, take reasonable steps to inform other controllers that the user, as the data subject, has requested the erasure of all links to, or copies of, such personal data. The right to erasure does not apply where the processing is necessary for the establishment, exercise or defence of legal claims.

4. Right to restriction of processing under Article 18 of the GDPR

The user may request the restriction of the processing of personal data relating to them if the user contests the accuracy of the personal data relating to them, if the processing is unlawful and the user objects to the erasure of the personal data, if the controller no longer requires the personal data for the purposes of the processing, or if the user has objected to the processing in accordance with Article 21(1) of the GDPR and it has not yet been established whether the legitimate grounds override the user’s grounds.

5. Right to be informed (duty to notify under Article 19 of the GDPR)

Where the user has exercised their right to rectification, erasure or restriction of processing of their data vis-à-vis the controller, the controller is obliged to notify all recipients to whom personal data relating to the user have been disclosed of such rectification, erasure or restriction of processing, unless this proves impossible or involves a disproportionate effort. The user has the right to be informed by the controller of the recipients.

6. Right to data portability under Article 20 of the GDPR

The user has the right to receive the personal data concerning them, which they have provided to the controller, in a structured, commonly used and machine-readable format. Furthermore, the user has the right to transmit this data to third parties. Where technically feasible, this data may be transmitted directly from one controller to another. The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to object under Article 21 of the GDPR

The user has the right to object at any time to the processing of personal data concerning them which is carried out on the grounds of public interest pursuant to Article 6(1)(e) or the legitimate interests of the controller pursuant to Article 6(1)(f) of the GDPR. The controller shall no longer process the personal data relating to the user unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the user, or the processing is necessary for the establishment, exercise or defence of legal claims.

8. Right to withdraw consent under data protection law

The user has the right to withdraw their declaration of consent under data protection law, which was implicitly given through the use of our service, at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent prior to its withdrawal.

9. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, the user has the right to lodge a complaint with a supervisory authority if the user considers that the processing of personal data relating to them infringes the GDPR. The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR. The user may exercise these rights by submitting a written or electronic request to the data controller named under I. The data controller shall provide the user with information on the measures taken in accordance with Articles 15–22 of the GDPR without undue delay, and in any event within one month of receiving the request. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests.

VIII. Third-party providers and order data processing

1. mg Systems GmbH

In accordance with Article 6(1)(b) of the GDPR, the data necessary for the performance of the contract is processed by automated systems operated by MG Systems GmbH, Friedrich-Eckardt-Straße 17, 08529 Plauen. The transfer of data collected during the ordering process for electronic processing by the systems of mg-Systems GmbH is essential for the performance of the contract.

2. PayPal

When using the payment methods PayPal, direct debit, credit card or purchase on account, your data (name, address, purchase amount, order number) will be transferred to PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. By using one of these options, you consent to the collection of your data by PayPal. PayPal’s privacy policy can be found here. Please note that if you pay without a PayPal account, PayPal will carry out an identity and credit check.

3. Sofortüberweisung

When using the Sofortüberweisung payment method, your data (name, purchase amount, order number) will be transmitted to Sofort GmbH, Theresienhöhe 12, 80339 Munich. You can find Sofort GmbH’s privacy policy here.

4. Google Analytics

On the basis of our legitimate interests (i.e. our interest in the analysis, optimisation and commercial operation of our online service within the meaning of Article 6(1)(f) of the GDPR), we use Google Analytics, a web analytics service provided by Google LLC (‘Google’). Google uses cookies. The information generated by the cookie regarding the user’s use of the online service is usually transmitted to a Google server in the USA and stored there. Google is certified under the Privacy Shield Agreement and thus guarantees compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status;=Active). Google will use this information on our behalf to analyse how users use our website, to compile reports on activity within the website, and to provide us with other services relating to the use of the website and internet usage. In doing so, pseudonymous user profiles may be created from the processed data. We only use Google Analytics with IP anonymisation enabled. This means that the user’s IP address is truncated by Google within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. The IP address transmitted by the user’s browser is not combined with other data held by Google. The user can prevent the storage of cookies by adjusting the settings in their browser software accordingly; furthermore, the user may prevent Google from collecting the data generated by the cookie and relating to their use of the online service, as well as the processing of this data by Google, by downloading and installing the browser plug-in available via the following link: http://tools.google.com/dlpage/gaoptout?hl=de. Further information on Google’s use of data, as well as options for settings and opting out, can be found in Google’s Privacy Policy (https://policies.google.com/technologies/ads) and in the settings for the display of adverts by Google (https://adssettings.google.com/authenticated). The user’s personal data will be deleted after 26 months.

5. Google Marketing Services

We use the marketing and remarketing services (hereinafter ‘Google Marketing Services’) provided by Google LLC on the basis of our legitimate interest (i.e. our interest in the analysis, optimising and ensuring the efficient operation of our online offering within the meaning of Article 6(1)(f) of the GDPR) the marketing and remarketing services (hereinafter ‘Google Marketing Services’) provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, (‘Google’). Google is certified under the Privacy Shield Framework and thereby provides a guarantee that it complies with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status;=Active). Google’s marketing services enable us to display targeted adverts for and on our website, so as to present users only with adverts that are likely to match their interests. Where a user is shown adverts for products in which they have previously expressed an interest on other websites, this is referred to as ‘remarketing’. For these purposes, when our website or other websites on which Google Marketing Services are active are accessed, a Google code is executed directly by Google and so-called remarketing tags are embedded in the website. These are used to store an individual cookie on the user’s device (comparable technologies may also be used instead of cookies). This file records which websites the user has visited, what content they are interested in and which offers they have clicked on, as well as technical information about the browser and operating system, referring websites, the time of the visit and further details regarding the use of the online service. The user’s IP address is also recorded; however, we would like to point out, in the context of Google Analytics, that within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area, the IP address is truncated and is only transferred in full to a Google server in the USA – where it is then truncated – in exceptional cases. The IP address is not merged with the user’s data held within other Google services. Google may also combine the aforementioned information with data from other sources. If the user subsequently visits other websites, they may be shown adverts tailored to their interests. The user’s data is processed pseudonymously within the framework of Google’s marketing services. This means that Google does not, for example, store or process the user’s name or email address, but instead processes the relevant data on a cookie-by-cookie basis within pseudonymous user profiles. In other words, from Google’s perspective, the adverts are not managed and displayed for a specifically identified individual, but for the cookie holder, regardless of who that cookie holder is. This does not apply if a user has expressly authorised Google to process the data without this pseudonymisation. The information collected by Google Marketing Services about users is transmitted to Google and stored on Google’s servers in the USA. For further information on Google’s use of data for marketing purposes, please visit the overview page: https://www.google.com/policies/technologies/ads; Google’s privacy policy is available at https://www.google.com/policies/privacy. If you wish to object to interest-based advertising by Google Marketing Services, you can use the settings and opt-out options provided by Google: http://www.google.com/ads/preferences.

6. Social plug-ins

This website also uses social plug-ins (hereinafter referred to as ‘plug-ins’). When a user visits one of our pages containing one or more of these plug-ins, our server establishes a direct connection to the servers of the plug-in provider. The content of the plug-ins embedded on the website is transmitted directly by the operators to the user’s browser. For this reason, we have no influence over the nature and extent to which data is collected by the operators via the plug-ins, and we would therefore like to refer you to the data protection policies of the individual operators, which are summarised in the table below. To the best of our knowledge, the following is to be expected: By embedding these plug-ins, the respective operators receive information that the page they are on has been accessed by a user. If the user accessing the page is logged in to one of these services at the same time, the service can associate the visit to the page with the user’s account. When interacting with one of the buttons, this information is also transmitted directly to the provider’s server. If the user is logged in to one or more of these services and wishes to use our site without this happening, we recommend logging out of the relevant account before visiting our pages. It is nevertheless possible (even for those who do not use any of these services) that the service providers may obtain and store the user’s IP address.

7. Privacy Policy for the use of YouTube

Our website uses plugins from YouTube, a service operated by Google. The operator of the site is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. When a user visits one of our pages featuring a YouTube plugin, a connection is established with YouTube’s servers. In doing so, the YouTube server is informed which of our pages the user is visiting. If the user is logged into their YouTube account, they allow YouTube to link their browsing behaviour directly to their personal profile. The user can prevent this by logging out of their YouTube account. Further information on the handling of user data can be found in YouTube’s privacy policy at https://www.google.de/intl/de/policies/privacy.