Privacy Policy - What happens to your personal data

1) Information about the collection of personal data and contact details of the controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about how we handle your personal data when you use our website. Personal data refers to all data that can be used to personally identify you.

1.2 The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Andreas Leschke, CBD Hexe Onlinehandel A. Leschke, Frankenstr. 47, 45134 Essen, Germany, Tel.: 015738275951, Email: info@cbd-hexe.de. The controller for the processing of personal data is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data.

1.3 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the character string "https://" and the lock symbol in your browser bar.

2) Data collection when visiting our website

If you use our website for informational purposes only, i.e., if you do not register or otherwise provide us with information, we only collect data that your browser transmits to our server (so-called "server log files"). When you visit our website, we collect the following data, which is technically necessary for us to display the website to you:

  • Our visited website
  • Date and time of access
  • Amount of data sent in bytes
  • Source/reference from which you came to the page
  • Browser used
  • Operating system used
  • IP address used (if applicable: in anonymized form)

Processing is carried out in accordance with Art. 6 (1) (f) GDPR based on our legitimate interest in improving the stability and functionality of our website. The data will not be shared or used for any other purpose. However, we reserve the right to subsequently review the server log files if there are concrete indications of illegal use.

3) Cookies

To make visiting our website more attractive and enable the use of certain functions, we use cookies, i.e., small text files that are stored on your device. Some of these cookies are automatically deleted after closing your browser (so-called "session cookies"); others remain on your device for a longer period and allow you to save page settings (so-called "persistent cookies"). In the latter case, you can find out how long cookies are stored in the overview of your web browser's cookie settings.
If personal data is also processed by individual cookies used by us, the processing is carried out in accordance with Art. 6 (1) (b) GDPR either to execute the contract, in accordance with Art. 6 (1) (a) GDPR in the event of consent being given, or in accordance with Art. 6 (1) (f) GDPR to protect our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the site visit.
You can set your browser so that you are informed about the setting of cookies and can decide individually whether to accept them or to exclude the acceptance of cookies in certain cases or in general.
Please note that if you do not accept cookies, the functionality of our website may be limited.

4) Contact

4.1 Review reminder by eKomi
If you have given us your express consent to do so during or after your order in accordance with Art. 6 (1) (a) GDPR, we will transmit your email address to the eKomi rating platform of eKomi Ltd., Markgrafenstraße 11, 10969 Berlin, (www.ekomi.de) so that it can send you a rating reminder by email.
You can revoke your consent at any time by sending a message to the person responsible for data processing or to the rating platform.

4.2 Review reminder by ShopVote
If you have given us your express consent to do so during or after your order in accordance with Art. 6 (1) (a) GDPR, we will transmit your email address to the ShopVote rating platform of Blickreif GmbH, Schulstraße 46, 80634 Munich (www.shopvote.de) so that they can send you a rating reminder by email.
You can revoke your consent at any time by sending a message to the person responsible for data processing or to the rating platform.

4.3 Review reminder by Trusted Shops
If you have given us your express consent to do so during or after your order in accordance with Art. 6 (1) (a) GDPR, we will transmit your email address to the rating platform Trusted Shops GmbH, Subbelrather Str. 15c, 50823 Cologne (www.trustedshops.de) so that they can send you a rating reminder by email.
You can revoke your consent at any time by sending a message to the person responsible for data processing or to the rating platform.

4.4 Review reminder by Trustpilot
If you have given us your express consent to do so during or after your order in accordance with Art. 6 (1) (a) GDPR, we will transmit your email address to the review platform Trustpilot of Trustpilot A/S, Pilestræde 58, 1112 Copenhagen K, Denmark (www.trustpilot.com) so that they can send you a review reminder by email.
You can revoke your consent at any time by sending a message to the person responsible for data processing or to the rating platform.

4.5 When you contact us (e.g., via contact form or email), personal data will be processed exclusively for the purpose of processing and responding to your request and only to the extent necessary for this purpose. The legal basis for processing this data is our legitimate interest in responding to your request in accordance with Art. 6 (1) (f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 (1) (b) GDPR. Your data will be deleted if it can be inferred from the circumstances that the matter in question has been conclusively clarified and provided that there are no statutory retention periods to the contrary.

5) Data processing when opening a customer account

In accordance with Art. 6 (1) (b) GDPR, personal data will continue to be collected and processed to the extent necessary if you provide it to us when opening a customer account. You can find out which data is required to open an account in the input mask of the corresponding form on our website. You can delete your customer account at any time by sending a message to the controller at the above-mentioned address. After your customer account has been deleted, your data will be deleted provided that all contracts concluded through it have been fully processed, there are no statutory retention periods to the contrary, and we have no legitimate interest in continuing to store it.

6) Comment function

As part of the comment function on this website, in addition to your comment, information about the time the comment was created and the commenter name you chose will be saved and published on this website. Furthermore, your IP address will be saved for security reasons to enable attribution to the author in the event of illegal comments. Your email address will be saved so that we can contact you if a third party should object to your published content as illegal.

7) Use of customer data for direct marketing

Subscribe to our email newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information required to receive the newsletter is your email address. Providing additional data is voluntary and will be used to address you personally. We use the so-called double opt-in procedure to send the newsletter, which ensures that you only receive the newsletter after you have expressly confirmed your consent to receive the newsletter by clicking on a verification link sent to the specified email address.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Art. 6 (1) (a) GDPR. We will save your IP address entered by your Internet Service Provider (ISP) as well as the date and time of registration so that we can trace any possible misuse of your email address at a later date. The data we collect when you register for the newsletter will be used strictly for the intended purpose. You can unsubscribe from the newsletter at any time using the link provided in the newsletter or by sending a corresponding message to the person responsible named above. After unsubscribing, your email address will be immediately deleted from our newsletter distribution list unless you have expressly consented to further use of your data or we reserve the right to use the data in any other way that is permitted by law and about which we will inform you in this declaration.

8) Data processing for order processing

8.1 To the extent necessary for the execution of the contract for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6 (1) (b) GDPR.

If we owe you updates for goods with digital elements or for digital products based on a corresponding contract, we will process the contact information you provided when placing your order (name, address, email address) in order to inform you personally about upcoming updates within the legally stipulated period via a suitable communication channel (e.g., by post or email) within the scope of our statutory information obligations pursuant to Art. 6 (1) (c) GDPR. Your contact information will be used strictly for the purpose of notifying you about updates owed by us and will only be processed by us to the extent necessary for the respective information.

To process your order, we also work with the following service provider(s), who support us in whole or in part in the execution of concluded contracts. Certain personal data will be transmitted to these service providers in accordance with the following information.

8.2 Use of payment service providers (payment services)

– Klarna
If you select a Klarna payment service, payment will be processed via Klarna Bank AB (publ), https://www.klarna.com/de/ , Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter "Klarna"). To enable payment processing, your personal data (first and last name, street, house number, postal code, city, gender, email address, telephone number, and IP address) as well as data related to the order (e.g., invoice amount, item, delivery method) will be passed on to Klarna for the purpose of identity and credit checks, provided that you have expressly consented to this in accordance with Art. 6 (1) (a) GDPR during the ordering process. You can see which credit agencies your data may be forwarded to here:
https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies
The credit report may contain probability values ​​(so-called score values). To the extent that score values ​​are included in the credit report results, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of the score values ​​includes, but is not limited to, address data. Klarna uses the information obtained regarding the statistical probability of a payment default to make a considered decision regarding the establishment, implementation, or termination of the contractual relationship.
You can revoke your consent at any time by sending a message to the data controller or to Klarna. However, Klarna may still be entitled to process your personal data if this is necessary for contractual payment processing.
Your personal information will be processed in accordance with applicable data protection regulations and in accordance with the information in Klarna's privacy policy for data subjects based in Germany https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/privacy
or for data subjects based in Austria https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_at/privacy
treated.
– Comfort checkout
If you choose a prepayment payment method from the payment service provider Komfortkasse, payment processing will be handled by LTC Information Services GmbH, Business Tower, Seligenstädter Str. 107, 63073 Offenbach am Main, to which we will forward the information you provided during the ordering process, along with information about your order, in accordance with Art. 6 (1) (b) GDPR. Your data will be passed on exclusively for the purpose of payment processing with the payment service provider Komfortkasse and only to the extent necessary for this purpose. Komfortkasse's privacy policy can be found at: https://komfortkasse.eu/datenschutz.
– Paypal
When paying via PayPal, credit card via PayPal, direct debit via PayPal, or – if offered – "purchase on account" or "payment by installments" via PayPal, we will pass your payment data on to PayPal (Europe) Sarl et Cie, SCA, 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal") as part of the payment processing. This transfer takes place in accordance with Art. 6 (1) (b) GDPR and only to the extent necessary for payment processing.
PayPal reserves the right to conduct a credit check for payment methods such as credit card via PayPal, direct debit via PayPal, or – if offered – “purchase on account” or “payment by installments” via PayPal. For this purpose, your payment data may be passed on to credit agencies in accordance with Art. 6 (1) (f) GDPR based on PayPal's legitimate interest in determining your ability to pay. PayPal uses the result of the credit check with regard to the statistical probability of default to decide whether to provide the respective payment method. The credit check may contain probability values ​​(so-called score values). To the extent that score values ​​are included in the result of the credit check, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of the score values ​​includes, among other things, but not exclusively, address data. For further information on data protection, including information on the credit agencies used, please refer to PayPal's privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for contractual payment processing.
- IMMEDIATELY
If you select the "SOFORT" payment method, payment processing will be carried out by the payment service provider SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany (hereinafter "SOFORT"), to which we will pass on the information you provided during the ordering process, along with information about your order, in accordance with Art. 6 (1) (b) GDPR. Sofort GmbH is part of the Klarna Group (Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden). Your data will be passed on exclusively for the purpose of payment processing with the payment service provider SOFORT and only to the extent necessary for this purpose. You can find further information about SOFORT's data protection provisions at the following website address: https://www.klarna.com/sofort/datenschutz.

9) Web analysis services

Google (Universal) Analytics
This website uses Google (Universal) Analytics, a web analysis service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). Google (Universal) Analytics uses “cookies,” which are text files placed on your device, to help the website analyze how users use the site. The information generated by the cookie about your use of the website (including your shortened IP address) is typically transferred to a Google server and stored there. This may also include transmission to Google LLC servers in the USA.
This website uses Google (Universal) Analytics exclusively with the extension “_anonymizeIp()”, which ensures that the IP address is anonymized by shortening it and prevents it from being directly linked to a person. This extension means that your IP address will be shortened beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google LLC server in the USA and shortened there. On our behalf, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide us with other services relating to website activity and internet usage. The IP address transmitted by your browser as part of Google (Universal) Analytics will not be merged with other Google data.
Google Analytics also uses a special feature called "demographic features" to compile statistics about the age, gender, and interests of site visitors based on an analysis of interest-based advertising and third-party information. This allows the definition and differentiation of website user groups for the purpose of targeting marketing measures. However, data collected using "demographic features" cannot be assigned to a specific individual.
Details on the processing initiated by Google Analytics and how Google handles data from websites can be found here: https://policies.google.com/technologies/partner-sites
All processing described above, in particular the setting of Google Analytics cookies for reading information on the device used, will only be carried out if you have given us your express consent in accordance with Art. 6 (1) (a) GDPR. Without this consent, Google Analytics will not be used during your visit to the site.
You can revoke your consent at any time with future effect. To exercise your right of revocation, please deactivate this service using the "Cookie Consent Tool" provided on the website. We have concluded a data processing agreement with Google for the use of Google Analytics, which obligates Google to protect the data of our website visitors and not to share it with third parties.
For the transfer of data from the EU to the USA, Google relies on the so-called standard data protection clauses of the European Commission, which are intended to ensure compliance with the European level of data protection in the USA.
Further information on Google (Universal) Analytics can be found here: https://policies.google.com/privacy?hl=de&gl=de

10) Rights of the data subject

10.1 The applicable data protection law grants you the following data subject rights (rights of information and intervention) vis-à-vis the controller with regard to the processing of your personal data, whereby reference is made to the legal basis stated for the respective conditions for exercising these rights:

  • Right to information pursuant to Art. 15 GDPR;
  • Right to rectification pursuant to Art. 16 GDPR;
  • Right to erasure pursuant to Art. 17 GDPR;
  • Right to restriction of processing pursuant to Art. 18 GDPR;
  • Right to information pursuant to Art. 19 GDPR;
  • Right to data portability pursuant to Art. 20 GDPR;
  • Right to revoke consent given in accordance with Art. 7 (3) GDPR;
  • Right to lodge a complaint pursuant to Art. 77 GDPR.

10.2 RIGHT OF OBJECTION

IF WE PROCESS YOUR PERSONAL DATA BASED ON OUR OVERRIDING LEGITIMATE INTEREST AS PART OF A BALANCE OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME WITH FUTURE EFFECT FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION.
If you exercise your right to object, we will stop processing the data in question. However, we reserve the right to continue processing if we can demonstrate compelling legitimate grounds for the processing that override your interests, fundamental rights, and freedoms, or if the processing serves to assert, exercise, or defend legal claims.

If we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes. You can exercise your right of objection as described above.

IF YOU EXERCISE YOUR RIGHT OF OBJECTION, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

11) Duration of storage of personal data

The duration of storage of personal data is determined by the respective legal basis, the purpose of the processing and – where applicable – also by the respective statutory retention period (e.g. retention periods under commercial and tax law).

When personal data is processed on the basis of an express consent in accordance with Art. 6 (1) (a) GDPR, this data will be stored until the data subject revokes his or her consent.

If there are statutory retention periods for data that are processed within the framework of legal transactions or obligations similar to legal transactions on the basis of Art. 6 (1) (b) GDPR, these data will be routinely deleted after the retention periods have expired, provided that they are no longer required to fulfil or initiate a contract and/or we no longer have a legitimate interest in continuing to store them.

When processing personal data on the basis of Art. 6 (1) (f) GDPR, these data will be stored until the data subject exercises his or her right of objection in accordance with Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.

When processing personal data for the purpose of direct marketing on the basis of Art. 6 (1) (f) GDPR, these data will be stored until the data subject exercises his or her right of objection in accordance with Art. 21 (2) GDPR.

Unless otherwise stated in the other information in this statement on specific processing situations, stored personal data will be deleted when they are no longer necessary for the purposes for which they were collected or otherwise processed.